Oracle America, Inc. v. United States

975 F.3d 1279

• Court: Court of Appeals for the Federal Circuit
• Decided: September 2, 2020
• Docket: 19-2326
• Status: Published

Opinion

Case: 19-2326 Document: 82 Page: 1 Filed: 09/02/2020

United States Court of Appeals for the Federal Circuit ______________________

ORACLE AMERICA, INC., Plaintiff-Appellant

v.

UNITED STATES, AMAZON WEB SERVICES, INC., Defendants-Appellees ______________________

2019-2326 ______________________

Appeal from the United States Court of Federal Claims in No. 1:18-cv-01880-EGB, Senior Judge Eric G. Bruggink. ______________________

Decided: September 2, 2020 ______________________

CRAIG HOLMAN, Arnold & Porter Kaye Scholer LLP, Washington, DC, argued for plaintiff-appellant. Also rep- resented by KARA L. DANIELS, NATHANIEL EDWARD CASTELLANO, AMANDA J. SHERWOOD.

WILLIAM PORTER RAYEL, Commercial Litigation Branch, Civil Division, United States Department of Jus- tice, Washington, DC, argued for defendant-appellee United States. Also represented by ETHAN P. DAVIS, ROBERT EDWARD KIRSCHMAN, JR., PATRICIA M. MCCARTHY.

DANIEL RUBEN FORMAN, Crowell & Moring, LLP, Washington, DC, argued for defendant-appellee Amazon Case: 19-2326 Document: 82 Page: 2 Filed: 09/02/2020

Web Services, Inc. Also represented by ROBERT JOSEPH SNECKENBERG, OLIVIA LOUISE LYNCH, ZACHARY H. SCHROEDER; GABRIELLE TRUJILLO, Los Angeles, CA; MARK ANDREW PERRY, Gibson, Dunn & Crutcher LLP, Washing- ton, DC. ______________________

Before NEWMAN, BRYSON, and O’MALLEY, Circuit Judges. BRYSON, Circuit Judge. This is a federal contract pre-award protest case. The United States Court of Federal Claims (“the Claims Court”) analyzed a number of legal challenges by Oracle America, Inc., to a large Department of Defense procurement. After a thorough treatment of all the issues presented, the Claims Court rejected Oracle’s protest. Oracle Am., Inc. v. United States, 144 Fed. Cl. 88 (2019). We affirm. I The procurement at issue in this case, known as the Joint Enterprise Defense Infrastructure (“JEDI”) Cloud procurement, is directed to the long-term provision of en- terprise-wide cloud computing services to the Department of Defense. The JEDI Cloud solicitation contemplated a ten-year indefinite delivery, indefinite quantity contract. The Defense Department decided to award the contract to a single provider rather than making awards to multiple providers. The JEDI Cloud solicitation included several “gate” provisions that prospective bidders would be required to satisfy. One of the gate provisions, referred to as Gate Cri- teria 1.2 or Gate 1.2, required that the contractor have at least three existing physical commercial cloud offering data centers within the United States, each separated from the others by at least 150 miles. Those data centers were re- quired to provide certain offerings that were “FedRAMP Moderate Authorized” at the time of proposal. The Federal Case: 19-2326 Document: 82 Page: 3 Filed: 09/02/2020

ORACLE AMERICA, INC. v. UNITED STATES 3

Risk and Authorization Management Program (“FedRAMP”) is an approach to security assessment, au- thorization, and continuous monitoring for cloud products and services. “FedRAMP Moderate Authorized” is a desig- nation given to systems that have successfully completed the FedRAMP Moderate authorization process. FedRAMP Moderate is the Defense Department’s minimum security level for processing or storing the Department’s least sen- sitive information. Oracle did not satisfy the FedRAMP Moderate Authorized requirement as of the time the pro- posals were to be submitted. Oracle filed a pre-bid protest challenging the solicita- tion. Oracle’s protest focused on the Department’s adop- tion of Gate 1.2 and on the Department’s decision to conduct the procurement on a single-source basis, rather than providing for multi-source contracts. Following a hearing and briefing, the U.S. Government Accountability Office (“GAO”) denied the protest. Oracle then filed suit in the Claims Court challenging the solicita- tion. The court analyzed Oracle’s claims in detail and re- jected Oracle’s protest in a lengthy opinion. The court first addressed Oracle’s claim that the con- tracting officer and the Under Secretary of Defense vio- lated separate provisions of 10 U.S.C. § 2304a when they each determined that it was appropriate to structure the JEDI Cloud procurement on a single-award basis rather than providing for multiple awards. Section 2304a sets out the conditions under which the Department may enter into large task and delivery order contracts with a single awardee, as opposed to awarding such contracts to two or more sources. Case: 19-2326 Document: 82 Page: 4 Filed: 09/02/2020

Section 2304a(d)(3) generally prohibits the award of a task or delivery order contract in excess of $100 million 1 to a single vendor unless the head of the agency determines in writing that one of four exceptions to that general prohi- bition applies. The exceptions are: (i) the task or delivery orders expected under the contract are so integrally related that only a single source can efficiently perform the work; (ii) the contract provides only for firm, fixed price task orders or delivery orders for— (I) products for which unit prices are estab- lished in the contract; or (II) services for which prices are established in the contract for the specific tasks to be per- formed; (iii) only one source is qualified and capable of per- forming the work at a reasonable price to the gov- ernment; or (iv) because of exceptional circumstances, it is nec- essary in the public interest to award the contract to a single source. 10 U.S.C. § 2304a(d)(3)(A). In addition to that provision, section 2304a(d)(4) re- quires that regulations implementing section 2304a(d) “es- tablish a preference for awarding, to the maximum extent practicable, multiple task or delivery order contracts for the same or similar services,” and that they “establish cri- teria for determining when award of multiple task or deliv- ery order contracts would not be in the best interest of the

1 The statutorily defined threshold amount is subject to an inflation adjustment requirement. See 41 U.S.C. § 1908. Case: 19-2326 Document: 82 Page: 5 Filed: 09/02/2020

ORACLE AMERICA, INC. v. UNITED STATES 5

Federal Government.” 10 U.S.C. § 2304a(d)(4). Pursuant to that directive, the Federal Acquisition Regulation (“FAR”) provides that, except for indefinite-quantity con- tracts for advisory and assistance services, “the contracting officer must, to the maximum extent practicable, give pref- erence to making multiple awards of indefinite-quantity contracts under a single solicitation for the same or similar supplies or services to two or more sources.” 48 C.F.R. § 16.504(c)(1)(i) (“FAR 16.504(c)(1)(i)”). The FAR further provides, however, that the contracting officer must not elect to use a multiple-contract award if one or more of sev- eral conditions applies: (1) Only one contractor is capable of providing per- formance at the level of quality required because the supplies or services are unique or highly spe- cialized; (2) Based on the contracting officer’s knowledge of the market, more favorable terms and conditions, including pricing, will be provided if a single award is made; (3) The expected cost of administration of multiple contracts outweighs the expected benefits of mak- ing multiple awards; (4) The projected orders are so integrally related that only a single contractor can reasonably per- form the work; (5) The total estimated value of the contract is less than the simplified acquisition threshold; or (6) Multiple awards would not be in the best inter- ests of the Government. Case: 19-2326 Document: 82 Page: 6 Filed: 09/02/2020

FAR 16.504(c)(1)(ii)(B). 2 The head of the agency—in this case, Under Secretary of Defense Ellen Lord—made a finding under section 2304a(d)(3)(B)(ii) that a single-source contract was permis- sible because the solicitation provides exclusively for firm, fixed price task orders, or delivery orders for services for which prices are established in the contract for the specific tasks to be performed. For her part, the contracting officer found that three of the reasons set forth in FAR 16.504(c)(1)(ii)(B) prohibited the use of the multiple-award approach for the JEDI Cloud procurement: (1) more favor- able terms and conditions, including pricing, would be pro- vided in the case of a single award; (2) the expected cost of administering multiple contracts outweighed the expected benefits of making multiple awards; and (3) multiple awards would not be in the best interests of the govern- ment. Before the Claims Court, Oracle challenged the deter- minations of both the contracting officer and Under Secre- tary Lord. As to the contracting officer, Oracle argued that she failed to properly balance the multiple-award prefer- ence against a single-award approach. As to Under Secre- tary Lord, Oracle argued that the JEDI Cloud solicitation contained provisions for future services that were not spe- cifically defined and for which specific prices were not given. For that reason, Oracle contended, the contract did not qualify as one providing only for firm, fixed prices for services for which prices are established in the contract for the specific tasks to be performed.

2 On August 3, 2020, the regulation was amended to replace the phrase “less than” with “at or below.” Federal Acquisition Regulation: Evaluation Factors for Multiple- Award Contracts, 85 Fed. Reg. 40068-01 (July 2, 2020). Case: 19-2326 Document: 82 Page: 7 Filed: 09/02/2020

ORACLE AMERICA, INC. v. UNITED STATES 7

The Claims Court held that the contracting officer’s de- termination complied with the requirements of section 2304a(d)(4) and FAR 16.504(c). The court concluded that the contracting officer, based on her knowledge of the mar- ket, “drew the reasonable conclusion that a single award was more likely to result in favorable terms, including price.” Oracle, 144 Fed. Cl. at 113. In addition, the court found that it was “completely reasonable” for the contract- ing officer to find that a multisource award would be more expensive to administer and that a single cloud services provider would be best positioned to provide the necessary security for the agency’s data. Id. The court concluded that Oracle had pointed to no reason to disturb the contracting officer’s determination that multiple awards should not be employed. With respect to section 2304a(d)(3), however, the Claims Court reached a different conclusion. The court held that the solicitation did not qualify for a single-source award under the exception relied on by Under Secretary Lord to the statutory prohibition against awarding large task order contracts to a single vendor. Specifically, the court found that the solicitation contemplated that during the life of the contract, services not envisioned at the time of the initial award would likely be needed. New services would likely have to be added to the contract in light of the fact that cloud computing technology was constantly evolv- ing. The solicitation provided that if at some point during the pendency of the contract the cloud services provider created a new service, it would be required to offer that ser- vice to the Department at a price no higher than the price publicly available in the commercial marketplace in the continental United States. The solicitation also permitted the Department to obtain services before they were offered on the commercial market, even if those services would never be offered commercially. Those services, the court explained, could not be identified as “specific tasks” much less “priced[] at the time of the award.” Oracle, 144 Fed. Case: 19-2326 Document: 82 Page: 8 Filed: 09/02/2020

Cl. at 114. Accordingly, the court concluded, “the Under Secretary apparently chose an exception under § 2304a(d)(3) which does not fit the contract.” Id. at 115. The Claims Court then turned to the question whether Oracle was prejudiced by the Department’s failure to com- ply with section 2304a(d)(3). Oracle argued that if the De- partment had employed a multiple-award procurement, Oracle might have had the chance to compete, because the agency’s needs, as expressed in the gate criteria, might have been different in that setting. The government re- sponded that the agency’s minimum security needs would not have changed in a multiple-award scenario. In a mul- tiple-award procurement, according to the government, the Department still would have insisted on gate criteria in general and Gate 1.2 in particular. The Claims Court agreed with the government. The court acknowledged that “Oracle may well be correct that some aspects of the gate criteria are driven by the agency’s insistence on using a single provider to manage an im- mense amount of data.” Oracle, 144 Fed. Cl. at 115. The court observed, however, that “one critical aspect of the gate criteria is not connected to the choice of a single pro- vider: data security.” Id. The court pointed in particular to a memorandum prepared by Tim Van Name, Deputy Di- rector of the Defense Digital Service. In that memoran- dum, Mr. Van Name stated that FedRAMP Moderate, which was incorporated as a requirement in Gate 1.2, rep- resented the Department’s minimum level of security re- quired for processing and storing the Department’s least sensitive information. That level of security, according to Mr. Van Name’s memorandum, was “the minimum criteria necessary for DoD to have confidence that the Offeror’s pro- posed data centers have met the underlying physical secu- rity requirements necessary to successfully perform the contract.” J.A. 100947. Case: 19-2326 Document: 82 Page: 9 Filed: 09/02/2020

ORACLE AMERICA, INC. v. UNITED STATES 9

In addition, the court noted that many of the acquisi- tion documents “bolster the agency’s conviction that use of multiple cloud service providers exponentially increases the challenge of securing data.” Oracle, 144 Fed. Cl. at 116. The court explained that it had “no reason to doubt” that the security requirements of Gate 1.2 “are the minimum that will be necessary to perform even the least sensitive aspects of the JEDI Cloud project.” Id. Based on that evi- dence, the court stated that “the only logical conclusion is that, if multiple awards were made, the security concerns would ratchet up, not down.” Id. Because the agency’s se- curity concerns would not change, the court explained, Or- acle “would not stand a better chance of being awarded this contract if the agency determined that the procurement must be changed to multiple award.” Id. The court there- fore concluded that the decision to proceed with the pro- curement on a single-source basis did not prejudice Oracle. The Claims Court next addressed Oracle’s claim that Gate 1.2 was unenforceable, both because the agency did not have a demonstrated need to impose the requirements set forth in Gate 1.2 and because Gate 1.2 is an impermis- sible “qualification requirement” imposed without satisfy- ing the preconditions set forth in 10 U.S.C. § 2319. Section 2319(a) defines a “qualification requirement” as “a require- ment for testing or other quality assurance demonstration that must be completed by an offeror before award of a con- tract.” Section 2319(b) provides that, except in limited cir- cumstances, the agency must satisfy several prerequisites before establishing a qualification requirement. One such prerequisite is that “the head of the agency shall . . . pre- pare a written justification stating the necessity for estab- lishing the qualification requirement and specify why the qualification requirement must be demonstrated before contract award.” 10 U.S.C. § 2319(b)(1). The Claims Court rejected both of Oracle’s arguments that Gate 1.2 was unenforceable. As to the issue of need, Case: 19-2326 Document: 82 Page: 10 Filed: 09/02/2020

the court agreed with the government that Gate 1.2 was tied to the agency’s minimum needs. The court referred to the memorandum from Mr. Van Name, one of the principal architects of the solicitation requirement, which justified imposing the FedRAMP Moderate Authorized requirement on the ground that FedRAMP Moderate represents the De- partment’s minimum security requirements for processing or storing the Department’s least sensitive information. As noted, Mr. Van Name explained that FedRAMP Moderate was the minimum level of security necessary for the De- fense Department to have confidence that the Offeror’s pro- posed data centers would have been able to timely meet the physical security requirements needed to successfully per- form the contract. Based on the record evidence, the court found that the requirement to satisfy FedRAMP Moderate is “a useful proxy . . . for the agency’s real need. If an offe- ror were unable to meet the lower threshold, it could not hope to meet the higher” security requirements that would be required during the performance of the contract. Oracle, 144 Fed. Cl. at 117. As for Oracle’s argument that the government improp- erly used Gate 1.2 as a “qualification requirement” without satisfying the preconditions set forth in section 2319, the Claims Court ruled that Oracle had waived that argument by not raising it before the bids were due. Oracle did not raise the argument about the impermissible use of a qual- ification requirement until its post-hearing comments sub- mitted to the GAO after the close of the bidding on the procurement. In any event, the court concluded that there was no merit to the argument, because Gate 1.2 did not constitute “a requirement for testing or other quality assurance demonstration that must be completed by an offeror before award of a contract.” Id. (quoting 10 U.S.C. § 2319(a)). In- stead, according to the Claims Court, Gate 1.2 constituted a specification. The statute describes a qualification re- quirement as generally consisting of “a qualified bidders Case: 19-2326 Document: 82 Page: 11 Filed: 09/02/2020

ORACLE AMERICA, INC. v. UNITED STATES 11

list, qualified manufacturers list, or qualified products list.” 10 U.S.C. § 2319(c)(3). A specification, by contrast, is a requirement “of the particular project for which the bids are sought, such as design requirements, functional re- quirements, or performance requirements.” W.G. Yates & Sons Constr. Co. v. Caldera, 192 F.3d 987, 994 (Fed. Cir. 1999) (citing 10 U.S.C. § 2305(a)(1)(C)). The court concluded that Gate 1.2 is not a qualification requirement, because the agency did not require an offeror to prequalify in order to submit a proposal. In addition, the court explained, FedRAMP Moderate authorization is not an independent requirement that the Department regu- larly imposes in its procurements. Finally, the court pointed out that the security features that FedRAMP Mod- erate authorization imposes are the same security features that the Department believed were the minimum neces- sary to store the Department’s data for the JEDI Cloud pro- ject. Accordingly, the court found, the Department was not using the FedRAMP standard as a way to examine the of- feror’s past performance in storing government data. Ra- ther, “it [was] a uniform way to determine which offerors have certain security capabilities on a number of their cloud offerings.” Oracle, 144 Fed. Cl. at 118. The Claims Court next rejected Oracle’s argument that Gate 1.2 transformed the procurement into one that uses other than competitive procedures, in violation of 10 U.S.C. § 2304. The court found that the agency structured the procurement as a full and open competition, and that sat- isfying the gate criteria was merely the first step in ensur- ing that the Department’s time in the evaluation process was not wasted on offerors who could not meet the agency’s minimum needs. Finally, the Claims Court examined Oracle’s claims that several Department officials who were involved in some way with the procurement had conflicts of interest, and that Amazon Web Services, Inc., (“AWS”), one of the Case: 19-2326 Document: 82 Page: 12 Filed: 09/02/2020

bidders on the contract, had an organizational conflict, all of which infected the procurement. The court addressed the question whether the contracting officer had properly assessed the impact of the conflicts on the procurement and found that she had. The court then concluded that the con- tracting officer had properly exercised her discretion in finding that the individual and organizational conflicts complained of by Oracle did not affect the integrity of the procurement. Based on the court’s determination that Gate 1.2 is en- forceable and Oracle’s concession that it could not meet the requirements of Gate 1.2 at the time of proposal submis- sion, the Claims Court found that Oracle could not “demon- strate prejudice as a result of any other possible errors.” Oracle, 144 Fed. Cl. at 126. The court therefore denied Or- acle’s motion for judgment on the administrative record and granted the cross-motions filed by the government and intervenor AWS. Oracle then took this appeal. II Oracle’s principal argument on appeal is that the De- fense Department committed legal error when it elected to conduct the JEDI Cloud procurement as a single-source procurement. Although the Claims Court agreed with Or- acle that the Department committed legal error with re- spect to the ground it invoked to justify the use of a single- source procurement, the court found the error to be harm- less. The court concluded that the error was harmless be- cause even if the Department had opted for a multi-source procurement, Oracle would not have been able to satisfy the requirements of Gate 1.2, which the Department would have imposed regardless of whether the procurement was conducted on a single-source or multi-source basis. A In challenging the Department’s decision to conduct the JEDI Cloud procurement on a single-source basis, Case: 19-2326 Document: 82 Page: 13 Filed: 09/02/2020

ORACLE AMERICA, INC. v. UNITED STATES 13

Oracle begins by pointing out that Congress has expressed its preference for awarding, “to the maximum extent prac- ticable, multiple task or delivery order contracts for the same or similar services or property.” 10 U.S.C. § 2304a(d)(4). Section 2304a(d) and the regulations issued pursuant to that provision state that the contracting officer and the agency head must make certain specified determi- nations before the agency can proceed with a single-source award in a large procurement such as this one. On appeal, Oracle does not take issue with the Claims Court’s finding that the contracting officer’s determination was reasona- ble. And Oracle agrees with the Claims Court that Under Secretary Lord’s rationale for approving the use of a single- source award for the JEDI Cloud procurement did not sat- isfy the exception to section 2304a(d)(3) that she invoked. Oracle takes issue, however, with the Claims Court’s con- clusion that Oracle was not prejudiced by Under Secretary Lord’s determination. In response, the government endorses the Claims Court’s “no-prejudice” ruling. In the alternative, the gov- ernment argues that, apart from the merits of the court’s prejudice analysis, we may still affirm because the Claims Court incorrectly rejected Under Secretary Lord’s determi- nation that a single-source award was justified under sec- tion 2304a(d)(3). Under Secretary Lord based that determination on the exception set forth in section 2304a(d)(3)(B)(ii) for contracts that provide for “firm, fixed price task orders or delivery orders” for services for which “prices are established in the contract for the specific tasks to be performed.” The Claims Court, however, held that the JEDI Cloud solicitation did not provide for “firm, fixed price task orders” for which prices were established in the contract, because the solicitation contained provisions for the awardee to supply unspecified services in the future at as-yet unspecified prices. The government’s argument that the contract provides only for firm, fixed price task orders is unpersuasive for the Case: 19-2326 Document: 82 Page: 14 Filed: 09/02/2020

reasons given by the Claims Court. The JEDI Cloud con- tract contains a technology refresh provision (section H2) that allows the addition of new cloud services during the period of contract performance, when those services did not exist at the time of award, in order “to keep pace with ad- vancements in the industry.” Under that clause, it is an- ticipated that there will be updates to the cloud services during the pendency of the contract. Thus, the solicitation provides that new services will be added, with new prices, that are not provided for in the initial contract. The government argues that the exception in section 2304a(d)(3)(B)(ii) applies here because the statute does not require that “all tasks/prices must be established ‘at the time of the award.’” Rather, the government argues, the requirement that tasks and prices be “established in the contract” does not address when the “tasks and prices upon which future orders will be based must be ‘established.’” It is enough, according to the government, that new tasks and prices are set pursuant to the terms of the contract, includ- ing section H2, and the subsequent task orders are issued on a fixed-price basis. The Claims Court properly rejected the government’s argument. As the court explained, the language of section 2304a(d)(3) makes clear that the services to be performed under the contract and the prices for those services must be established in the contract at the time of award. That follows from the provision in the statute that “no . . . con- tract . . . may be awarded” unless the agency head deter- mines that the “contract provides only for firm, fixed price task orders or delivery orders for . . . services for which prices are established in the contract.” 10 U.S.C. § 2304a(d)(3). The plain language of the statute refers to conditions that must exist at the time of the contract award. Case: 19-2326 Document: 82 Page: 15 Filed: 09/02/2020

ORACLE AMERICA, INC. v. UNITED STATES 15

B Having found that the statutory prerequisite for use of a single-source contract had not been satisfied, the Claims Court moved to the question whether that flaw in the pro- cess prejudiced Oracle. The court found no prejudice from the error based on the court’s finding that the agency’s min- imum needs, as expressed in Gate 1.2, would not have been different in a multi-award scenario than in a single-award scenario. Therefore, the court concluded, even if the agency had been required to conduct the procurement on a multi- ple-award basis, the requirements of Gate 1.2 would have applied. And because Oracle would not have been able to satisfy those requirements, it would have had no chance of a contract award, so the flaw in the procurement process did not harm Oracle. Oracle takes issue with the Claims Court’s harmless error analysis. In particular, Oracle argues that the Claims Court erred by accepting the government’s argu- ment that under a multiple-award solicitation the Depart- ment would still have insisted on imposing Gate 1.2. That decision, Oracle argues, was one that should have been made by the agency. It was improper, according to Oracle, for the court to decide that the agency would have insisted on Gate 1.2 even if it had known that it was required to use a multiple-award solicitation for the JEDI Cloud procure- ment. Citing SEC v. Chenery Corp., 318 U.S. 80 (1943), Oracle contends that the Claims Court should not have “presume[d] how DoD would structure a multiple-award procurement as DoD must make that decision in the first instance.” Appellant’s Br. 35–36. The Supreme Court has referred to the Chenery doc- trine as embodying a “‘foundational principle of adminis- trative law’ that judicial review of agency action is limited to ‘the grounds that the agency invoked when it took the action.’” Dep’t of Homeland Sec. v. Regents of the Univ. of Cal., 140 S. Ct. 1891, 1907 (2020) (quoting Michigan v. Case: 19-2326 Document: 82 Page: 16 Filed: 09/02/2020

EPA, 576 U.S. 743, 758 (2015)). In Chenery, the Supreme Court explained the rationale for that rule: If an order is valid only as a determination of policy or judgment which the agency alone is authorized to make and which it has not made, a judicial judg- ment cannot be made to do service for an adminis- trative judgment. For purposes of affirming no less than reversing its orders, an appellate court cannot intrude upon the domain which Congress has ex- clusively entrusted to an administrative agency. 318 U.S. at 88. The Chenery doctrine, however, does not invariably re- quire a remand to the agency whenever a court holds that the agency’s action was based on legally improper grounds. As the Supreme Court, this court, and other circuit courts have recognized, principles of harmless error apply to judi- cial review of agency action generally. A remand is unnec- essary when the error in question “clearly had no bearing on the procedure used or the substance of decision reached,” Mass. Trs. of E. Gas & Fuel Assocs. v. United States, 377 U.S. 235, 248 (1964); if there is no reason to believe that the decision would have been different, In re Watts, 354 F.3d 1362, 1370 (Fed. Cir. 2004); if it is clear that the agency would have reached the same result, Flesh- man v. West, 138 F.3d 1429, 1433 (Fed. Cir. 1998); if the result is “foreordained,” Bethlehem Steel Corp. v. Gorsuch, 742 F.2d 1028, 1036 (7th Cir. 1984); if the court is not “in substantial doubt whether the administrative agency would have made the same ultimate finding with the erro- neous finding removed,” Kurzon v. U.S. Postal Serv., 539 F.2d 788, 796 (1st Cir. 1976); or where there is no “signifi- cant chance that but for the error, the agency might have reached a different result,” NLRB v. Am. Geri-Care, Inc., 697 F.2d 56, 64 (2d Cir. 1982). As this court has summed up the rule, a court may af- firm the decision of an agency on a ground other than the Case: 19-2326 Document: 82 Page: 17 Filed: 09/02/2020

ORACLE AMERICA, INC. v. UNITED STATES 17

ground given by the agency, so long as it is clear that the agency would have reached the same decision if it had been aware that the ground it invoked was legally unavailable, or if the decision does not depend on making a finding of fact not previously made by the agency. See Ford Motor Co. v. United States, 811 F.3d 1371, 1380 (Fed. Cir. 2016); Killip v. OPM, 991 F.2d 1564, 1568–69 (Fed. Cir. 1993); Ward v. Merit Sys. Prot. Bd., 981 F.2d 521, 528 (Fed. Cir. 1992). In this case, the Claims Court found, based on the evi- dence in the administrative record, that the Defense De- partment would have stuck with Gate 1.2 even if it had been required to conduct the procurement on a multiple- award basis. As the court explained: [T]he only logical conclusion is that, if multiple awards were made, the security concerns would ratchet up, not down. They are, indeed, minimally stated. If Oracle cannot meet Gate Criteria 1.2 as currently configured, it is thus not prejudiced by the decision to make a single award. The agency’s needs would not change, so Oracle would not stand a better chance of being awarded this contract if the agency determined that the procurement must be changed to [a] multiple award. Oracle, 144 Fed. Cl. at 116. This appeal is a review of a Claims Court decision on an administrative record. We review a finding of prejudice or no prejudice by the Claims Court in a trial on an admin- istrative record under the clearly erroneous standard. See Office Design Grp. v. United States, 951 F.3d 1366, 1374 (Fed. Cir. 2020); CliniComp Int’l, Inc. v. United States, 904 F.3d 1353, 1359 (Fed. Cir. 2018); Diaz v. United States, 853 F.3d 1355, 1359 (Fed. Cir. 2017); Bannum, Inc. v. United States, 404 F.3d 1346, 1354 (Fed. Cir. 2005). “To establish prejudicial error, a party must show that “but for the error, it would have had a substantial chance of securing the Case: 19-2326 Document: 82 Page: 18 Filed: 09/02/2020

contract.” Labatt Food Serv., Inc. v. United States, 577 F.3d 1375, 1378 (Fed. Cir. 2009). 3 In light of the Claims Court’s careful consideration of the record evidence, the court’s conclusion that the Defense Department would have included Gate 1.2 even if it had modified the solicita- tion to allow for multiple awards, and that Oracle therefore would not have had a substantial chance of securing the contract, is not clearly erroneous. We therefore will not disturb the Claims Court’s determination that the case did not need to be remanded to the Defense Department for a further determination whether a single-source award is ap- propriate. 4 III Oracle next argues that Gate 1.2 transformed the pro- curement into one that did not use competitive procedures.

3 Oracle asserts that in pre-award protests, “non- trivial competitive injury which can be redressed by judi- cial relief” establishes prejudice. Appellant’s Br. 33 (quot- ing Weeks Marine, Inc. v. United States, 575 F.3d 1352, 1361 (Fed. Cir. 2009)). In some pre-award cases, we have used the “non-trivial competitive injury” test “because there is an inadequate factual foundation for performing a ‘substantial chance’ test.” Orion Tech., Inc. v. United States, 704 F.3d 1344, 1348 (Fed. Cir. 2013). In this case, however, there was an adequate factual predicate to apply the “substantial chance” test. 4 Oracle argues, inter alia, that a remand to the agency is justified because Oracle now meets the FedRAMP Moderate Authorized standard set forth in the solicitation and should be allowed to bid on the contract based on its current qualifications. The issue before the Claims Court and before us, however, is whether the agency committed prejudicial error in the solicitation as of the time that Oracle filed its protest. Subsequent events are irrelevant to that inquiry. Case: 19-2326 Document: 82 Page: 19 Filed: 09/02/2020

ORACLE AMERICA, INC. v. UNITED STATES 19

Oracle further contends that the Defense Department was required to complete a mandatory justification and ap- proval process before using procedures other than compet- itive procedures, such as Gate 1.2. According to Oracle, the Defense Department failed to do so. The government re- sponds that the Defense Department was not required to engage in the justification and approval process because the JEDI Cloud procurement used competitive procedures. We agree with the government. Section 2304 of Title 10 prohibits an agency from using “other than competitive procedures” in contracting, except in certain limited circumstances. See 10 U.S.C. § 2304(c). Even in such circumstances, section 2304(f) further pro- vides that the head of the agency generally “may not award a contract using procedures other than competitive proce- dures unless . . . the contracting officer for the contract jus- tifies the use of such procedures in writing and certifies the accuracy and completeness of the justification” and “the justification is approved.” Oracle makes several arguments in support of its con- tention that the procurement used other than competitive procedures. First, Oracle contends that the Department knew that only two offerors, AWS and Microsoft, could sat- isfy Gate 1.2 at the time the proposals were due. According to Oracle, the decision to adopt Gate 1.2 was therefore equivalent to prohibiting any parties other than AWS and Microsoft from bidding on the JEDI Cloud contract. Oracle adds that the evidence showed that the Department “de- vised the gated approach for the express purpose of limit- ing the number of proposals received.” Appellant’s Br. 41. Oracle also relies on the regulations issued pursuant to section 2304. In particular, Oracle relies on the regulation that provides that when there is “a reasonable basis to con- clude that the agency’s minimum needs can only be satis- fied by . . . a limited number of sources,” full and open Case: 19-2326 Document: 82 Page: 20 Filed: 09/02/2020

competition does not exist and the agency must follow the justification and approval process. FAR 6.302-1(b)(1)(ii). We see no error in the Claims Court’s rejection of Ora- cle’s arguments. Citing this court’s decision in National Government Services, Inc. v. United States, 923 F.3d 977 (Fed. Cir. 2019), the Claims Court explained that a solici- tation requirement is not necessarily objectionable simply because the requirement has the effect of excluding certain offerors who cannot satisfy that requirement. The Claims Court found that “[t]he few record statements Oracle high- lights are insufficient to demonstrate” that the Department was using “other than competitive procedures” in the JEDI Cloud procurement. Oracle, 144 Fed. Cl. at 119. Rather, the court explained, the Department “structured this pro- curement to use full and open competition and the gate cri- teria are just the first step in the evaluation of proposals.” Id. The court added that the use of the gate criteria could have occurred at any point in the evaluation of the pro- posals; “the agency simply put the gate criteria first to en- sure its evaluation was not wasted on offerors who could not meet the agency’s minimum needs.” Id. As the Claims Court explained, “evaluation criteria which have the effect of limiting competition do not neces- sarily trigger the procedures required by § 2304(c).” Id. “Full and open competition . . . means that all responsible sources are permitted to submit sealed bids or competitive proposals on the procurement.” 41 U.S.C. § 107; 10 U.S.C. § 2302(3)(D). Even if the agency expected that only certain firms would be able to satisfy the agency’s minimum needs, the solicitation permitted all responsible sources to submit proposals. Under these circumstances, we agree with the Claims Court that the FedRAMP Moderate authorization component of Gate 1.2 did not transform the solicitation into one for less than full and open competition. Nor did the Department violate FAR 6.302-1. That reg- ulation is one of several “authorities” that “permit Case: 19-2326 Document: 82 Page: 21 Filed: 09/02/2020

ORACLE AMERICA, INC. v. UNITED STATES 21

contracting without providing for full and open competi- tion.” FAR 6.302. In this case, the Department did not prohibit any responsible sources from submitting pro- posals, so the Department did not need to invoke section 6.302-1 as authority to contract without providing for full and open competition. IV Oracle next argues that Gate 1.2 violated 10 U.S.C. § 2319, which requires, inter alia, a written justification when the Defense Department imposes a “qualification re- quirement” in a solicitation. Section 2319(a) defines a “qualification requirement” as a “requirement for testing or other quality assurance demonstration that must be com- pleted by an offeror before award of a contract.” Oracle contends that Gate 1.2 constituted a qualification require- ment, as that term has been interpreted, and that because there was no advance written justification for that require- ment, Gate 1.2 is unenforceable. The Claims Court held that Oracle waived the section 2319 argument by not raising it on a timely basis. The court also held that even if the argument had been timely raised, it failed on the merits, because Gate 1.2 is not a “qualification requirement” within the meaning of that term in section 2319. The Claims Court correctly held that Gate 1.2 does not constitute a “qualification requirement” within the mean- ing of section 2319. 5 “An essential step in every procure- ment involves a determination that the potential contractor is qualified to serve as a Government contrac- tor.” J. Cibinic, Jr. & R. Nash, Jr., Formation of

5 Because we agree with the Claims Court that Gate 1.2 is not a “qualification requirement,” we do not reach the issue of whether the Claims Court correctly held that Ora- cle waived its section 2319 argument. Case: 19-2326 Document: 82 Page: 22 Filed: 09/02/2020

Government Contracts 403 (3d ed. 1998). That determina- tion requires consideration of whether the firm can be ex- pected to complete the contract work on time and in a satisfactory manner. Id. In an individual procurement, the government uses “nonresponsibility” determinations to avoid awarding contracts to unqualified firms. Id. Alt- hough the government is required to make a determination of responsibility in every case, see 10 U.S.C. 2305(b)(4)(C); FAR 9.103, we do not think that Congress intended to im- pose the obligations enumerated in section 2319 on every government procurement. Instead, as this court has explained, section 2319 draws a line between extraneous “qualification require- ments,” such as a qualified manufacturers list, and re- quirements that are intrinsic to the particular solicitation, such as requirements that are directed to ensure that the contractor will be able to satisfy the requirements of that solicitation. In W.G. Yates & Sons Construction Co. v. Cal- dera, 192 F.3d 987 (Fed. Cir. 1999), the case on which Or- acle principally relies, this court held that a particular prerequisite fell on the “extraneous requirement” side of that line. There, a solicitation for the production of aircraft hangar doors required that the manufacturer either be prequalified or have previously made similar products. We held that those requirements constituted qualification re- quirements because they were not directly tied to the needs of the procurement. Unlike the requirements in the Yates case, the agency in this case used Gate 1.2 in a way that did not implicate section 2319. Gate 1.2 is analogous to an “intrinsic” re- quirement in, for example, a contract for emergency mili- tary air transport services that the bidding companies have a minimum number of certified pilots available at the time proposals are submitted. Such a requirement would en- sure that the company would be ready to proceed on day one of the contract and would not have to hire or train pi- lots. Gate 1.2 serves a similar purpose in the JEDI Cloud Case: 19-2326 Document: 82 Page: 23 Filed: 09/02/2020

ORACLE AMERICA, INC. v. UNITED STATES 23

solicitation. In particular, the Department was evaluating whether the actual data centers that would or could be used to provide cloud services would be able to meet the agency’s minimum security needs on the proposed sched- ule. As Mr. Van Name’s memorandum explained, the agency believed that if an offeror could not satisfy the se- curity requirements represented by FedRAMP Moderate at the time of proposal, that offeror would not be able to sat- isfy the more stringent security requirements the offeror would be required to meet shortly after award. 6 That is a standard type of responsibility determination that contracting officers regularly make. See FAR 9.104-1 (“To be determined responsible, a prospective contractor must . . . [b]e able to comply with the required or proposed delivery or performance schedule . . . [and] [h]ave the nec- essary production, construction, and technical equipment and facilities, or the ability to obtain them”); 50 State Sec. Serv., Inc., Comp. Gen. Dec. B-272114, 96-2 CPD ¶ 123 (Sept. 24, 1996) (upholding contracting officer’s determina- tion that the protestor did not have the ability to have a sufficient number of prison guards in place when perfor- mance of the contract was set to begin); Sys. Dev. Corp., Comp. Gen. Dec. B-212624, 83-2 CPD ¶ 644 (Dec. 5, 1983) (upholding nonresponsibility determination based on the agency’s conclusion that the protestor would not be able to comply with the proposed delivery schedule because the protestor had not yet secured “confirmation of supplier’s

6 Under the solicitation, the awardee would be re- quired, shortly after the award, to meet a modified version of the FedRAMP High security requirements, sometimes referred to in the record as “FedRAMP High Plus.” Accord- ing to Mr. Van Name’s testimony, there are “325 require- ments that FedRAMP Moderate covers, and there is a difference of about 145 to get to FedRAMP High. But a few of those, we’ve granted exemptions to . . . .” J.A. 105496. Case: 19-2326 Document: 82 Page: 24 Filed: 09/02/2020

and subcontractor’s commitments to deliver items and equipment with long lead-times”). And in this case, be- cause Gate 1.2 did not relate to an extraneous quality as- surance demonstration, such as the successful completion of other related projects, the responsibility determination did not implicate section 2319. V Oracle next contends that Gate 1.2 was unreasonable in light of the Defense Department’s needs, and that the solicitation should be invalidated on the ground that it un- necessarily restricted competition. The Claims Court ana- lyzed at some length the Department’s needs as the Department assessed them and found that the gating re- quirements, including Gate 1.2, were reasonable in light of that context. For that reason, the court found that the so- licitation requirements did not unduly restrict competi- tion. Oracle has not provided a sufficient basis for overturn- ing the Claims Court’s determination on that issue. As the Claims Court observed, an agency’s assessment of its needs in a procurement should not readily be second-guessed by a court. We are even more removed from a detailed assess- ment of the needs of the procurement than the Claims Court and therefore are even more hesitant to override the agency’s judgment as to its needs. Oracle has not shown that the Department’s determination as to its need for a level of security represented by Gate 1.2 was unreasonable; that clause of the solicitation therefore cannot be rejected as unnecessarily restrictive of competition VI In the final section of its brief, Oracle contends that conflicts of interest on the part of three former Defense De- partment employees tainted the procurement in a way that requires that the solicitation be set aside. When the claimed conflicts surfaced, the contracting officer Case: 19-2326 Document: 82 Page: 25 Filed: 09/02/2020

ORACLE AMERICA, INC. v. UNITED STATES 25

conducted a detailed investigation and made findings as to the conflicts and their effects on the procurement. She de- termined that although there were conflicts of interest on the part of two of the employees, those conflicts and the asserted conflict on the part of the third employee did not have any effect on the procurement. After reviewing the contracting officer’s findings, the Claims Court concluded that the contracting officer’s investigation was thorough and her “no effect” determination was reasonable. A Oracle raises a number of challenges to the Claims Court’s ruling with respect to the conflicts of interest. At the outset, Oracle argues that the Supreme Court’s deci- sion in United States v. Mississippi Valley Generating Co., 364 U.S. 520 (1961), sets forth a per se rule that conflicts of interest that violate the federal criminal conflict-of-in- terest statute, 18 U.S.C. § 208, invalidate any government contracts to which the conflicts relate. Based on that inter- pretation of the Mississippi Valley case, Oracle argues that the conflicts of interest on the part of the former Defense Department employees invalidate the JEDI Cloud solicita- tion regardless of whether their conflicts had any effect on the solicitation. Contrary to Oracle’s contention, the Mississippi Valley case is best read as providing that conflicts of interest in- validate government contracts only if the conflicts materi- ally affect the contracts. That is the way this court read the Mississippi Valley case in Godley v. United States, 5 F.3d 1473 (Fed. Cir. 1993). In that case, we noted that the illegality in the Mississippi Valley case “permeated the con- tract.” Id. at 1475–76 (citing Mississippi Valley, 364 U.S. at 553). We then went on to explain: A contract without the taint of fraud or wrongdo- ing, however, does not fall within this rule. Illegal acts by a Government contracting agent do not alone taint a contract and invoke the void ab initio Case: 19-2326 Document: 82 Page: 26 Filed: 09/02/2020

rule. Rather, the record must show some causal link between the illegality and the contract provi- sions. Determining whether illegality taints a con- tract involves questions of fact. Id. at 1476; see also Long Island Sav. Bank, FSB v. United States, 503 F.3d 1234, 1250 (Fed. Cir. 2007) (“In Godley, we emphasized that for a government contract to be tainted by fraud or wrong doing and thus void ab initio, the record must show some causal link between the fraud and the con- tract.”). We are bound by that ruling interpreting the Missis- sippi Valley case, and we therefore reject Oracle’s argu- ment that the conflicts of interest in this case invalidate the solicitation regardless of whether they had any effect on the procurement. B The Claims Court separately addressed each of the in- dividual conflicts of interest as well as related allegations of an organizational conflict of interest on the part of AWS. The court noted that under the FAR, a contracting officer who receives information about a conflict of interest on the part of persons involved in a procurement “must determine if the reported violation or possible violation has any im- pact on the pending award or selection of the contractor.” Oracle, 144 Fed. Cl. at 121 (quoting FAR 3.104-7(a)). If the contracting officer determines that there is no impact on the procurement, the contracting officer must forward the information to a designated individual within the agency, and if that individual agrees with the contracting officer, the procurement may proceed. Id. The contracting officer for the JEDI Cloud project re- viewed each of the alleged conflicts of interest and found that while some of the conduct in question was improper, none of the activities by the individuals in question affected the solicitation, and in particular that none of those Case: 19-2326 Document: 82 Page: 27 Filed: 09/02/2020

ORACLE AMERICA, INC. v. UNITED STATES 27

activities affected the decision to employ a single-award ap- proach or the use of the gating requirements for the pro- curement. A designated Department official concurred in the contracting officer’s findings in each instance. The standard for Claims Court review of a contracting officer’s decision with regard to a conflict of interest is highly deferential. A contracting officer’s conflict of inter- est determination will be upheld unless it is “arbitrary, ca- pricious, or otherwise contrary to law.” PAI Corp. v. United States, 614 F.3d 1347, 1352 (Fed. Cir. 2010). If the con- tracting officer’s findings are rational, they will be upheld on judicial review. See Turner Constr. Co. v. United States, 645 F.3d 1377, 1383–87 (Fed. Cir. 2011). The Claims Court upheld the contracting officer’s con- clusion that the alleged conflicts on the part of the three Defense Department employees had no impact on the pro- curement. Specifically, the court ruled that the contracting officer was correct in concluding that the three individuals “were bit players in the JEDI Cloud project,” in that none of them held responsible positions with regard to the pro- curement. Oracle, 144 Fed. Cl. at 121. Based on its anal- ysis, the court concluded that “[w]hile they should not have had the opportunity to work on the JEDI Cloud procure- ment at all, or at least for certain periods of time, never- theless, their involvement does not taint the work of many other persons who had the real control of the direction of the JEDI Cloud project.” Id. The three former Defense Department employees whose conduct is at issue are Deap Ubhi, Anthony DeMar- tino, and Victor Gavin. Oracle challenges the Claims Court’s conclusions as to the conflict of interest claims with respect to all three employees. Specifically, Oracle con- tends that the conflicted employees influenced the procure- ment by affecting the decision to use a single award and the selection of the gate criteria. While we share the views of the contracting officer and the Claims Court that some Case: 19-2326 Document: 82 Page: 28 Filed: 09/02/2020

of the conduct at issue is troubling, at the end of the day we agree with the Claims Court that the conflict of interest problems of those three individuals had no effect on the JEDI Cloud solicitation. The Claims Court, like the contracting officer, con- cluded that at least two of the Department officials, Mr. Ubhi and Mr. Gavin, disregarded their ethical obligations by negotiating with AWS for employment while working on the procurement. The court added that the Department, because of “lax oversight, or in the case of Ubhi, deception . . . was apparently unaware of this fact.” Id. at 120. As the Claims Court explained, however, the question before it was “whether any of the actions called out make a differ- ence to the outcome,” and in particular, whether the con- tracting officer’s conclusion of no impact was reasonable. Id. As to that issue, the court found that the contracting officer conducted a detailed examination of the record, that her work was “thorough and even-handed,” that she “un- derstood the legal and factual questions and considered the relevant evidence,” and that she “determined that, alt- hough there were some violations or possible violations of law relating to conflicts of interest, those conflicted individ- uals did not impact the decision to use a single award ap- proach or the substance of the evaluation factors.” Id. at 120–21. 1 Mr. Ubhi was employed by AWS until January 2016. After a period of time working for the Defense Department between August 2016 and November 2017, he returned to AWS. The contracting officer found that during Mr. Ubhi’s tenure in the Department, he was involved in marketing research activities for the JEDI Cloud procurement and that he participated in drafting and editing some of the first documents shaping the procurement. In October 2017, Mr. Ubhi advised the Department that a company he had founded might be engaging in Case: 19-2326 Document: 82 Page: 29 Filed: 09/02/2020

ORACLE AMERICA, INC. v. UNITED STATES 29

discussions with Amazon, the owners of AWS, and that he was recusing himself from further involvement in the JEDI Cloud procurement. The contracting officer subsequently concluded that Mr. Ubhi’s involvement in the procurement did not materially impact the procurement, for several rea- sons: the restrictions on his involvement based on his prior employment had expired by the time he began working on the procurement; his participation in the procurement was limited; and he promptly recused himself when the poten- tial conflict arose. It was later determined that the reason Mr. Ubhi gave for his recusal was false, and that instead he was negotiat- ing for employment with AWS during the period before his recusal. When that fact came to light, the contracting of- ficer reassessed the impact of Mr. Ubhi’s actions in light of the new information. While the contracting officer found that Mr. Ubhi’s behavior was troubling, she again deter- mined that Mr. Ubhi’s conflict of interest had not tainted the JEDI Cloud procurement. The Claims Court agreed with the contracting officer that Mr. Ubhi’s behavior was troubling. The court agreed with the contracting officer that despite being aware of his ethical obligations, Mr. Ubhi ignored them and remained involved in the procurement when he should not have been. The situation with respect to Mr. Ubhi is more complex than is the case for the other alleged conflicts of interest. As the contracting officer recognized, his behavior was “dis- concerting,” as he was aware of his ethical obligations, but “ignored them.” Oracle, 144 Fed. Cl. at 122. The contract- ing officer concluded that Mr. Ubhi had violated FAR 3.101-1 and possibly other statutory and regulatory provi- sions governing conflicts of interest, including 18 U.S.C. § 208. Nonetheless, the contracting officer and the Claims Court noted that when Mr. Ubhi returned to AWS, he did not work on the JEDI Cloud proposal team or in AWS’s Federal Business Sector or its DoD Programs section. Case: 19-2326 Document: 82 Page: 30 Filed: 09/02/2020

Moreover, the contracting officer found no evidence that Mr. Ubhi had shared any information with the team at AWS that was working on the JEDI Cloud procurement. The court found that the contracting officer’s investigation in that regard was thorough and that there was no reason to disturb it. The contracting officer also found that even if Mr. Ubhi had disclosed nonpublic information to AWS, none of it would have been competitively useful. And she found that his seven-week period of work on the preliminary planning stage of the JEDI Cloud procurement did not introduce bias in favor of AWS. The Claims Court found the contracting officer’s conclusions on those issues to be supported by the record. The Claims Court, moreover, found that Mr. Ubhi’s primary role was industry liaison; the record did not “war- rant attributing to him any serious involvement in the technical or security aspects of the gate criteria.” Oracle, 144 Fed. Cl. at 123. Based on its review of the record, the Claims Court found that the contracting officer correctly concluded that although Mr. Ubhi should not have worked on the JEDI Cloud procurement, his involvement did not affect the pro- curement in any material way. With regard to the decision whether to use a single award or multiple awards, the Claims Court noted that the Defense Department’s Cloud Executive Steering Group (of which Mr. Ubhi was not a member) expressed a preference for a single-award ap- proach early on in the process, before Mr. Ubhi’s involve- ment. Yet even after Mr. Ubhi left the Department, “the Deputy Secretary remained unconvinced regarding which approach to use,” and the contracting officer recalled that as of April 2018, long after Mr. Ubhi was gone, “the single award decision was still being vigorously debated.” Oracle, 144 Fed. Cl. at 123–24. Thus, the contracting officer con- cluded that Mr. Ubhi had no effect on the decision to use a single-award approach or the fashioning of the gate crite- ria. The Claims Court sustained that judgment. Case: 19-2326 Document: 82 Page: 31 Filed: 09/02/2020

ORACLE AMERICA, INC. v. UNITED STATES 31

Oracle first argues that the contracting officer “failed to consider an important aspect of the problem” because she did not wait for the results of the Department of De- fense inspector general’s investigation of the conflict of in- terest allegations with respect to Mr. Ubhi as well as Mr. Gavin. That contention is meritless. The contracting of- ficer found that Mr. Ubhi and Mr. Gavin had conflicts of interest that violated federal regulations and possibly sec- tion 208. Neither the contracting officer nor the Claims Court needed the results of the inspector general’s investi- gation to confirm whether Mr. Ubhi and Mr. Gavin had acted improperly. 7 The critical question for the contracting

7 In April 2020, the Department of Defense Office of Inspector General (“OIG”) issued a report detailing its ex- tensive review of the JEDI Cloud procurement, including its conclusions regarding Mr. Ubhi’s and Mr. Gavin’s al- leged ethical violations and the impact of those violations on the procurement. With respect to Mr. Ubhi, the OIG reached the following conclusion: In sum, we concluded that Mr. Ubhi engaged in un- ethical conduct when he made three false state- ments and failed to properly report financial interests in Amazon. These actions, combined with his involvement in early Cloud Initiative activities in September and October 2017, also created the appearance of violation of laws and ethical stand- ards. However, his early involvement in the Cloud Initiative was not substantial and did not provide any advantage to his prospective employer, Ama- zon, in the JEDI Cloud contract competition, which was decided 2 years after Mr. Ubhi’s resignation from the DoD. Although Mr. Ubhi’s Cloud actions from September through October 2017 violated the JER and the FAR, his minimal and limited contri- butions were largely discarded and did not affect Case: 19-2326 Document: 82 Page: 32 Filed: 09/02/2020

officer and the Claims Court was whether their improper conduct had impacted the procurement in a way that re- quired the solicitation to be set aside. On that issue, the contracting officer’s investigation, which the Claims Court held to be thorough and even-handed, was sufficient. Second, Oracle argues that the Claims Court improp- erly upheld the contracting officer’s determination with re- spect to the impact of Mr. Ubhi’s conflict of interest on a ground different from that adopted by the contracting of- ficer. According to Oracle, the Claims Court held, in effect, that Mr. Ubhi’s involvement in the JEDI Cloud procure- ment occurred too late to influence the single-award deci- sion, while the contracting officer concluded that Mr. Ubhi’s involvement in the procurement occurred too early,

the conduct or outcome of the JEDI Cloud procure- ment. Dep’t of Def. Off. of Inspector Gen., Rep. on the Joint En- terprise Def. Infrastructure (JEDI) Cloud Procurement 157 (Apr. 13, 2020). The OIG also noted that it presented its findings regarding Mr. Ubhi to the United States Attorney for the Eastern District of Virginia for consideration as a criminal matter, but prosecution was declined. Id. at 154. With respect to Mr. Gavin, the OIG reached the following conclusion: In sum, we concluded that Mr. Gavin should have used better judgment by not attending the April 5, 2018, JEDI Cloud Acquisition strategy meeting af- ter he had accepted a job with AWS, or by sending someone else in his place, to avoid the appearance of a conflict. However, he did not violate ethical standards by following the ethics advice he re- ceived, and his participation in the meeting did not affect the JEDI Cloud procurement. Id. at 166. Case: 19-2326 Document: 82 Page: 33 Filed: 09/02/2020

ORACLE AMERICA, INC. v. UNITED STATES 33

i.e., before the final decisions were made as to whether to award one or multiple contracts. That is too facile a characterization of the ground for the Claims Court’s decision. The court recognized that, as the contracting officer found, the decision whether to use a single award or multiple awards was not made until long after Mr. Ubhi left the Defense Department. In fact, the Claims Court cited the contracting officer’s remark that she had attended a meeting in April 2018, well after Mr. Ubhi’s departure, in which the issue was “still being vigor- ously debated.” Oracle, 144 Fed. Cl. at 124. Yet, as the court noted, the record also showed that at a September 2017 meeting of the Cloud Executive Steering Group, of which Mr. Ubhi was not a member, the group expressed a preference for a single award. The Claims Court’s point was that there was an expressed preference among the de- cisionmakers for a single award approach from prior to the time Mr. Ubhi was involved in the procurement, but the debate on that issue continued until after he was gone. And a final decision was not made until months after his departure. Under those circumstances, the contracting of- ficer and the Claims Court agreed, there was no indication that Mr. Ubhi’s brief seven-week involvement in the pro- curement materially affected the decision to use a single- award approach. Oracle next contends that the Ubhi no-impact determi- nation “runs counter to the evidence before the agency.” There is no force to this argument. Oracle’s contention that Mr. Ubhi “deliberately, systematically, and successfully in- fluenced individuals to adopt the single-award approach” far outruns the limited evidence Oracle cites to support it. First, Oracle cites two separate instant messages in which a Department attorney told Mr. Ubhi, “Single is assumed now,” and added, “Really glad you were here this week.” That is not evidence that Mr. Ubhi’s support for a single- award approach was important to the decision. Moreover, as the contracting officer found, the evidence shows that Case: 19-2326 Document: 82 Page: 34 Filed: 09/02/2020

the issue of single-versus-multiple contract awards was de- bated long after Mr. Ubhi’s departure from the agency, con- trary to the implication in the instant message. Second, Oracle cites an instant message from Mr. Van Name in which he stated: “The single [vs.] multiple conversation is done. Everyone that matters is now convinced; Thursday’s meeting was decidedly clear that we are all in favor of a single award.” That message, however, does not remotely suggest that Mr. Ubhi’s preference for a single-award ap- proach was important to, or otherwise materially affected, the decisionmakers’ selection. Oracle next argues that the contracting officer was wrong to state that there was no evidence that Mr. Ubhi’s participation “had any substantive impact on the procure- ment decisions or documents,” because there was evidence that Mr. Ubhi “edited material in October 2017” that the Department ultimately included in the solicitation. But the contracting officer reviewed Mr. Ubhi’s “edits” in detail, and concluded that Mr. Ubhi’s “influence and direct edits to the documents were minimal.” The contracting officer estimated that Mr. Ubhi contributed an estimated 100 changes to the Problem Statement, “ranging in significance from formatting and grammar to revision of sentences and paragraphs,” which were made as part of a group effort. In addition, the contracting officer noted, Mr. Ubhi’s partici- pation “contributed a total of eight (8) edits to the [request for information], all of which were contained within two sentences.” Contrary to Oracle’s contention, the evidence amply supports the contracting officer’s conclusion that Mr. Ubhi did not materially impact the solicitation, partic- ularly with respect to the single-award approach and the gating requirements. On a separate issue, Oracle briefly contends that the contracting officer was wrong to find that there was “no ev- idence that . . . [Mr.] Ubhi obtained or disclosed any com- petitively useful nonpublic information.” In fact, Oracle argues, Mr. Ubhi had access to sensitive information, Case: 19-2326 Document: 82 Page: 35 Filed: 09/02/2020

ORACLE AMERICA, INC. v. UNITED STATES 35

including the JEDI Cloud team’s Google drive, which he had on his computer. The contracting officer, however, found that Mr. Ubhi did not share any competitively useful nonpublic information with AWS and was not in a position to do so. The contracting officer noted that when Mr. Ubhi was rehired by AWS, he did not join AWS’s JEDI Cloud proposal team, but joined the commercial team that was not involved in government contracts. Moreover, Mr. Ubhi was subject to firewalls within AWS, and the contracting officer reviewed numerous affidavits from AWS employees stating that he had not disclosed nonpublic information and that he was excluded from any involvement with AWS’s JEDI Cloud proposal. In light of the deferential standard of review for contracting officers’ findings regard- ing conflicts of interest, the finding that Mr. Ubhi did not share sensitive information with AWS must be sustained. 2 Mr. DeMartino was a consultant for AWS before join- ing the Defense Department and therefore was prohibited by applicable ethics rules from participating in matters in- volving AWS throughout his tenure at the Department. At the Department he occupied two positions at different times: Deputy Chief of Staff for the Secretary of Defense and Chief of Staff for the Deputy Secretary. In the course of his duties, Mr. DeMartino had limited involvement in the JEDI Cloud procurement. The contracting officer char- acterized Mr. DeMartino’s involvement in the procurement as “ministerial and perfunctory” and noted that he “pro- vided no input into the JEDI Cloud acquisition docu- ments.” The contracting officer noted that the Department’s Standards of Conduct Office had determined that “Mr. DeMartino’s involvement in ministerial/adminis- trative actions (such as scheduling meetings, editing/draft- ing public relations,[] etc.) did not constitute participating in the JEDI Cloud acquisition itself,” and that Mr. DeMar- tino therefore was not in violation of the applicable ethical standards. However, in light of the high visibility of the Case: 19-2326 Document: 82 Page: 36 Filed: 09/02/2020

procurement and in an abundance of caution Mr. DeMar- tino was advised that he should consider recusing himself from even ministerial and administrative matters related to the JEDI Cloud procurement, and he did so. In light of Mr. DeMartino’s limited role, the contracting officer con- cluded that his activities “did not negatively impact the in- tegrity” of the procurement. The Claims Court upheld that determination, finding that none of the facts in the case contradicted the contract- ing officer’s determination that Mr. DeMartino’s involve- ment with the JEDI Cloud project had no substantive impact on the procurement. According to the court, the contracting officer rationally determined that Mr. DeMar- tino “was merely a go-between for the Deputy Secretary and did not have substantive input into the structure or content of the solicitation.” Oracle, 144 Fed. Cl. at 121. The court found that Mr. DeMartino “did not have a voice in whether DoD should use a single or multiple award ap- proach and did not craft the substance of the evaluation factors.” Id. Oracle contends that the contracting officer failed to consider an important aspect of the problem and that her conclusions were contrary to the evidence. Oracle points to various communications among Department officials, in- cluding Mr. DeMartino, and a draft public statement relat- ing to the JEDI Cloud procurement that Mr. DeMartino participated in editing. The evidence cited by Oracle does not establish that Mr. DeMartino was significantly in- volved in crafting the substance of the procurement. 8 We

8 Many of the record excerpts cited by Oracle are so cryptic as to be of no value in supporting Oracle’s conten- tion that Mr. DeMartino was significantly involved in the substantive work of crafting the solicitation. Moreover, the list of 72 persons who the Department said were “person- ally and substantially” involved in the JEDI Cloud Case: 19-2326 Document: 82 Page: 37 Filed: 09/02/2020

ORACLE AMERICA, INC. v. UNITED STATES 37

conclude that the record supports the contracting officer’s finding, upheld by the Claims Court, that Mr. DeMartino’s role in the procurement was limited, largely nonsubstan- tive, and did not significantly impact the procurement. 3 During the procurement, Mr. Gavin was a Deputy As- sistant Secretary of the Navy. Between August 2017 and January 2018, he discussed retirement plans with an AWS recruiter. In October 2017, he attended a meeting of the Cloud Executive Steering Group, which was planning the JEDI Cloud procurement, to share the Navy’s experience with cloud services. In January 2018, he submitted a Re- quest for Disqualification from Duties, asking that he be excluded from matters affecting the financial interests of AWS. Later that month, he interviewed with AWS, and on March 29, 2018, he was offered a position with AWS, which he later accepted. On April 5, 2018, Mr. Gavin attended a meeting at which the attendees discussed the Draft Acqui- sition Strategy for the JEDI Cloud procurement. The con- tracting officer attended the same meeting and recalled that Mr. Gavin did not advocate for any particular vendor but instead advocated for a multiple-award approach. After beginning his employment with AWS, Mr. Gavin was instructed by AWS that he was subject to an infor- mation firewall that prohibited him from disclosing any nonpublic information about the JEDI Cloud procurement

procurement between September 2017 and August 2018 did not include Mr. DeMartino’s name. Oracle’s suggestion that the inclusion of the name of the Deputy Secretary of Defense must have implicitly included Mr. DeMartino is entirely speculative, particularly because Mr. DeMartino was recused from involvement in the JEDI Cloud procure- ment after April 2018. Case: 19-2326 Document: 82 Page: 38 Filed: 09/02/2020

to anyone at AWS. He agreed to comply with the firewall requirement. Following her investigation of the conflicts of interest involving the JEDI Cloud procurement, the contracting of- ficer concluded that Mr. Gavin had violated FAR 3.101 and possibly 18 U.S.C. § 208. But the contracting officer found that Mr. Gavin’s involvement in the JEDI Cloud project did not taint the procurement. In particular, the contracting officer found that Mr. Gavin had limited access to the Draft Acquisition Strategy, did not furnish any input to that doc- ument, did not introduce bias into any of the meetings that he attended, and did not disclose any competitively useful information to AWS. Although Mr. Gavin spoke with one member of the AWS JEDI Cloud proposal team before the firewall was instituted, that member and Mr. Gavin repre- sented that Mr. Gavin had not disclosed any nonpublic in- formation about the JEDI Cloud procurement. The Claims Court found that the contracting officer’s conclusions regarding Mr. Gavin were “well-supported.” Oracle, 144 Fed. Cl. at 121. In particular, the court con- cluded that the record supported the contracting officer’s findings that Mr. Gavin was involved in the procurement “only to offer his knowledge of the Navy’s cloud services ex- perience,” and was not a member of any team that was working on the JEDI Cloud procurement. Id. at 121–22. The court noted that Mr. Gavin did not “assist in crafting the single award determinations or the technical substance of the evaluation factors.” Id. at 122. At most, the court concluded, Mr. Gavin “attended a few JEDI Cloud meet- ings.” Id. Moreover, the court added, Mr. Gavin did not appear to have obtained any contractor bid or proposal in- formation, nor did he appear to have introduced any bias toward AWS in the meetings he attended. Id. The court agreed with the contracting officer that Mr. Gavin had acted improperly in having a conversation with an AWS employee about the JEDI Cloud procurement after Case: 19-2326 Document: 82 Page: 39 Filed: 09/02/2020

ORACLE AMERICA, INC. v. UNITED STATES 39

Mr. Gavin began working for AWS. The court found, how- ever, that the contracting officer had “reasonably deter- mined that Mr. Gavin simply did not have access to competitively useful information to convey to AWS.” Id. at 122. Oracle argues that the Claims Court’s statement that Mr. Gavin did not have access to competitively useful in- formation to convey to AWS is contrary to the contracting officer’s findings that Mr. Gavin had access to the draft Ac- quisition Strategy in April 2018. That draft Acquisition Strategy, according to the contracting officer, contained nonpublic information that could be competitively useful. The Claims Court observed, however, that by the time Mr. Gavin began working at AWS, the draft request for pro- posals had been released. The draft request for proposals, the court explained, provided AWS “access to the relevant information that also appeared in the draft Acquisition Strategy.” Id. The court’s observation that the information in the draft Acquisition Strategy had become public by the time Mr. Gavin began working for AWS thus provided sup- port for the contracting officer’s finding that Mr. Gavin did not disclose any competitively useful nonpublic infor- mation to AWS; it did not reflect a conflict between the findings of the contracting officer and the decision of the Claims Court. In sum, notwithstanding the extensive array of claims raised by Oracle, we find no reversible error in the Claims Court’s decision. AFFIRMED