Provision of UxS Digital Forensics training

The United Nations Office on Drugs and Crime Regional Office for Central Asia (UNODC ROCA) hereby invites qualified vendors to submit their Expression of Interest for the provision of an on-site Regional Training for Central Asian Law Enforcement Agencies: "UxS Digital Forensics: Advanced Drone Forensic Acquisition & Analysis," to be delivered in Issyk-Kul, Kyrgyz Republic. The training is an advanced, practitioner-level course in the forensically sound identification, extraction, decryption, interpretation and reporting of digital evidence recovered from unmanned systems (UxS) across the full ecosystem,— unmanned aerial, ground, surface and underwater vehicles (UAV/UGV/USV/UUV), together with their controllers/handheld devices and associated mobile applications. Delivery shall be hands-on, with live extraction, decryption and analysis laboratory exercises, conducted in English with Russian-language instructional support for the regional audience, and shall be accompanied by a comprehensive set of participant materials that participants retain after the course. The detailed ToR/scope of work, including the full materials and deliverables specification, will be provided to the companies that qualify for the RfX to be issued immediately following this Request for EOI. MINIMUM ELIGIBILITY CRITERIA - At least two (2) years of demonstrable experience delivering training to law enforcement and/or national security agencies specifically in UxS (drone/unmanned systems) digital forensics, not general digital forensics and not generic drone/UAV operation. - Demonstrable capability to deliver advanced, hands-on instruction across the full UxS ecosystem (UAV/UGV/USV/UUV), including forensically sound acquisition from aircraft, ground controllers/handheld devices and associated mobile applications, decryption and interpretation of flight and telemetry data, and defensible reporting. - Instructional staff who are active, practising UxS/drone digital-forensic examiners (operational practitioners, not solely classroom instructors), evidenced by relevant casework or professional experience. - Authorization and capability to deliver hands-on instruction using current industry-leading UxS forensic platforms, specifically the CFID, DISERO and DroneTrace platforms (or demonstrably equivalent platforms providing the same acquisition, decryption and analysis capability), with participants receiving guided, hands-on use of those platforms during the course, including the decryption of encrypted flight/telemetry data (e.g. DJI encrypted-log decryption) and advanced flight-data analysis. - Capability to provide each participant with a comprehensive, professional-quality participant guide/manual covering the full course content, together with practical exercise datasets and any tools used during instruction, for retention and operational use after the course. - Capability to deliver the training on-site in the Kyrgyz Republic on the indicated dates, with instruction in English and dedicated Russian-language support for participants. Please note that this is not an invitation for submission of a proposal. This is a request for Expressions of Interest (EOI) in order to identify qualified vendors interested in participating in the solicitation. Vendors interested on provision of the above services must express their interest electronically throgh ungm.org. UNODC ROCA will examine this EOI and reserves the right to select the invitees for competitive bidding. Accordingly, an expression of interest does not automatically warrant an interested vendor's participation in the competitive bidding exercise. UNODC ROCA reserves the right to change or cancel any of this requirement at any time during the EOI and/or solicitation process. Specific Requirements/Information The main objective of this regional training is to equip participants (experts from law enforcement agencies of the Central Asian States) with practical, best-practice competencies to identify, extract and analyze data recoverable from unmanned systems (UxS) - UAV, UGV, USV and UUV, and their associated devices in a forensically sound manner. The training shall develop the capability to perform drone threat analysis and apply appropriate extraction approaches across the full UxS ecosystem. Participants shall learn methods to extract and preserve artifacts from drones, controllers/handheld devices and mobile applications, preferably through non-destructive acquisition; then to decrypt and interpret relevant logs, correlate telemetry with user/application data, and produce defensible reporting suitable for criminal-justice proceedings and actionable intelligence. Indicative scope of instruction (advanced, hands-on). The course shall address, at an advanced and practical level: foundations of the UxS ecosystem (platform types, operating systems, communication protocols, storage mechanisms, telemetry structures and evidentiary considerations); drone threat analysis and introduction to UxS/drone forensics; forensically sound acquisition and extraction from UxVx, (including PixHawk extraction via the MavLink protocol and work with flight logs in Mission Planner), removable/flash storage media and ground-controller applications, with emphasis on non-destructive methods; decryption and interpretation of flight logs, telemetry and controller/mobile-application data, including encrypted datasets (e.g. DJI encrypted-log decryption); correlation of telemetry with user and application artifacts for incident reconstruction and attribution; advanced analysis of parameter and flight data; report writing; and a practical skills assessment on a representative UxS platform. Required platform capability (mandatory). The training must include guided, hands-on instruction on current industry-leading UxS forensic platforms, specifically CFID, DISERO and DroneTrace, or demonstrably equivalent platforms delivering the same forensic acquisition, decryption and analysis capability. Participants must gain practical, instructor-led experience using these platforms during the course (not solely demonstrations), including the decryption and interpretation of encrypted flight and telemetry data and advanced flight-data analysis. Bidders will be required, at the RfX stage, to evidence their authorization/licensing to instruct on these platforms (or the equivalent) and to confirm the hands-on access participants will receive. Delivery parameters. The training shall be delivered on-site over five (5) training days for a single cohort of up to twelve (12) participants drawn from the beneficiary States, in English with dedicated Russian-language instructional support. The vendor shall provide instructor-led, hands-on laboratory exercises and scenario-based practical work that replicate real operational examinations, including basic drone-flight familiarization and instructor-led extraction/analysis labs. Equipment and tooling necessary for the practical exercises (representative drones and controllers, a mobile application environment, industry-standard extraction tooling, and analysis/decryption software appropriate to UxS log structures) shall be available for use during the course as required by the agreed scope of work. Required deliverables and quality standard (results the vendor must guarantee). The expected results of the training are: an enhanced understanding of the end-to-end UxS evidence ecosystem; the practical ability to conduct forensically sound, preferably non-destructive extractions from drones, controllers/handheld devices and mobile applications while preserving key artifacts (flight logs, aircraft data, photos, video); the ability to decrypt and interpret protected datasets and advanced flight data and to correlate telemetry with user/application data; and the ability to produce clear, defensible forensic reports suitable for criminal-justice proceedings, supported by validated analytical methods and quality-assurance practices. To secure these results, the vendor shall as a minimum provide, for each participant to retain: - A comprehensive, professional-quality participant guide/manual (printed in full colour and/or supplied in durable digital form) covering the full course content module-by-module, of a depth sufficient to serve as a standalone post-course reference for operational examinations. - Practical exercise datasets used during the course, enabling participants to reproduce and continue practising the methodologies after the training. - Any instructional tools/utilities used during the course that the vendor is able to provide for retention, for immediate operational use by participants. - A certificate of completion for participants who satisfy the assessment requirements. - Post-course access to the instructional team for reasonable technical/professional follow-up. The vendor shall demonstrate the expertise underpinning these results through the operational experience of its instructors and the quality and comprehensiveness of its training materials. UNODC ROCA intends to evaluate these elements, instructor expertise, depth and quality of the participant guide and datasets, and completeness of coverage against the agreed agenda, as part of the technical evaluation at the RfX stage.