Call for Experts: Arlington County Privacy Pilot

Objective

Virginia’s Commonwealth Cyber Initiative (CCI) aims to create a commonwealth-wide ecosystem of innovation excellence at the intersection of cybersecurity, autonomous systems, and data. CCI’s mission includes research, innovation, and workforce development. At times, CCI will work with partner organizations to fulfill this goal.

Arlington County is running a pilot project in coordination with Comcast, US Ignite, and CCI to test using sensor technology to meet public safety needs while maintaining citizen privacy. The pilot will use sensors on lampposts on one block in the Clarendon neighborhood in Arlington.

CCI has an advisory role to ensure data privacy policies are adhered to in every stage of the pilot. As such, CCI seeks faculty members and researchers from Virginia institutions of higher education to help ensure the demonstration pilot meets the cybersecurity, privacy, and data management requirements defined by the County and supports research on pilot results.

This is a two-phase project. This call invites researchers to propose to participate in Phase I, Phase II, or both phases.

Phase I: Pilot Planning and Execution. This (these) faculty member(s) with cybersecurity and privacy expertise will:

• Become a full member of the newly formed Safety & Innovation Zone Privacy Oversight Panel
• Provide input to the final design of the pilot plan months 1-3
• Coordinate with Arlington County staff, Comcast/Juganu, and US Ignite during pilot execution (months 4-9) to access and assess non-image sensor data

Phase II: Pilot Assessment and Research.  Additional CCI researchers will assist in the assessment of pilot results (months 10-12), conduct and publish research.

Eligibility

Researchers and faculty members at public institutions of higher education in CCI who are deemed eligible by their home institution to serve as a Principal Investigator (PI) on an external grant are eligible to apply.

Awards

Phase I includes an estimated 1-2 researchers providing approximately 160 hours of support. Therefore, grant awards will be between $10-$20K depending on experience and expertise of faculty/graduate students involved.

Phase II includes an estimated 2-4 researchers providing approximately 320 hours of support. Therefore grant awards will be up to $20-$40K depending on experience and expertise of faculty/graduate students involved.

Please note, it’s possible that applicants for both Phase I and Phase II may only be selected for one phase.

Successful applicants are expected to participate fully in the activities of CCI, including providing materials needed for reports, participation in CCI meetings, and responding to data collection requests by CCI. All publications and presentations resulting from the grant should acknowledge support from the Commonwealth Cyber Initiative (CCI). Grant award letters will supply an example of this acknowledgement.

According to the terms under which CCI is funded, the following costs are not allowable:

• Costs of developing and delivering undergraduate capstone programs, except as part of the larger effort to align cyber and CPSS-focused undergraduate program content with industry needs.
• A portion of salaries and benefits of faculty for time spent teaching undergraduates, including teaching cyber-related courses.
• Scholarships for costs of attendance at institutions of higher education.

Proposal Format

Proposals must use 1-inch margins, 11-point font or larger (Arial or Helvetica), and single line spacing. The following outline is to be followed:

1. Title page (one page). Title of the proposed project, name, affiliation, and contact information for Principal Investigator (PI). Phase of the project in which the expert plans to be involved (Phase I only, Phase II only, Phase I + II).
2. The proposed plan for engagement (up to 1 page per phase). Include any principles or rubrics that would define the PI’s role on the oversight panel.  Discuss relevant experience and expertise.
3. Budget and budget justification (up to one page).
4. Biography (up to 2 pages). Use NSF format.

Schedule

Approximate Project Dates

• Phase 1: March 1 - Dec. 1, 2021
• Phase 2: Dec. 2, 2021 - March 2+ 2022

The proposal must be submitted via email to proposals@cyberinitiative.org no later than the close of business (5:00 p.m.) on Wednesday, March 3, 2021. Please indicate “CCI Arlington County Call_PI Last Name” in the subject line.

All proposals must be submitted as a single PDF document.

Evaluation Criteria

A committee including representatives from CCI, Arlington County, and US Ignite will review the proposals and make funding recommendations. Evaluation criteria will include demonstrated expertise in at least one of the following areas:

• Demonstration of experiences in network architecture security, i.e.:
  • Security architecture end-2-end (devices, network and applications)
  • End devices that are Internet of Things (IoT) sensors communicating over various radio networks from WiFi to Mobile Network Operator (MNO) provided mobile access or Private Radio Networks.
• Demonstration of experiences in identity security, i.e.:
  • Identity and access management (IAM) elements for a network security architecture end-2-end (people, devices, network, software / applications).
  • Use of Identity Security in areas related to data and artificial intelligence to meet the evolving understanding of Privacy as purpose-governed to meet Privacy Principles
• Demonstration of knowledge of privacy by design principles
  • Familiarity with principles represented in regulations (e.g., General Data Protection Regulation), standards (e.g., National Institute of Standards and Technologies Special Publication 800-122) or frameworks (e.g., NIST Privacy Framework or ISO/IEC 27701) and,
  • Experience with evolving data governance and privacy protections that are not from the typical Personally Identifiable Information (PII) sources such as web collection forms, rather from IoT devices collecting, storing and processing information that indirectly relates to PII and can be used directly or in enriching other privacy data and can potentially go in conflict with the privacy principles / practices as listed here.
  • Privacy Principles and Practices with a working knowledge of the policies, procedures and implementation for
    • Lawfulness, Fairness, Transparency
    • Data minimization
    • Purpose / Collection, Processing and Retention and Storage Limitation
    • Data accuracy
    • Consent
    • Proactivity
    • Integrity and Confidentiality
    • Privacy Impact Assessments

Specific questions concerning this RFP and the requirements set forth herein should be directed in writing to the email address: proposals@cyberinitiative.org. Please see presentation to the Arlington County Board for additional information.