REPORT/RECOMMENDATION TO THE BOARD OF SUPERVISORS
OF SAN BERNARDINO COUNTY
AND RECORD OF ACTION
September 13, 2022
FROM
LARRY AINSWORTH, Chief Information Officer, Innovation and Technology Department
SUBJECT
Title
Agreements with OPSWAT Inc. and dtSearch for Software, Support and Professional Services
End
RECOMMENDATION(S)
Recommendation
1. Approve Terms of Service, including non-standard terms, with OPSWAT Inc. for cloud-based advanced threat prevention and malware analysis software, support and professional services for purchase amounts as authorized by County Policy, for the period of September 13, 2022, until terminated.
2. Approve License Agreement, including non-standard terms, with dtSearch Corp. for text retrieval software for purchase amounts as authorized by County Policy, for a term running concurrent with the OPSWAT Terms of Service.
(Presenter: Larry Ainsworth, Chief Information Officer, 388-5501)
Body
COUNTY AND CHIEF EXECUTIVE OFFICER GOALS & OBJECTIVES
Operate in a Fiscally-Responsible and Business-Like Manner.
FINANCIAL IMPACT
Approval of this item will not result in the use of Discretionary General Funding (Net County Cost). The Terms of Service with OPSWAT Inc. (OPSWAT) and the License Agreement with dtSearch Corp. (dtSearch) are non-financial in nature and do not commit the County to make any purchases. If future purchases are made under the Terms of Service and License Agreement (Agreements), the Innovation and Technology Department (ITD) will adhere to County purchasing policies and return to the Board of Supervisors (Board) for approval, if necessary.
BACKGROUND INFORMATION
The OPSWAT MetaDefender platform is an advanced threat prevention solution, which can integrate into web applications to provide protection against malicious file upload attacks. MetaDefender is a cybersecurity malware detection and prevention solution that integrates with ITD’s existing advanced threat protection platform and allows for files uploaded to web applications such as the Employee Management and Compensation System (EMACs), to be scanned for malicious content prior to those files being stored within the County’s infrastructure.
The Terms of Service are OPSWAT’s standard commercial agreement, which include terms that differ from the standard County contract and omit certain County standard contract terms. While the parties negotiated certain contract terms to meet County standards, OPSWAT would not agree to all County standard terms. The non-standard and missing terms include the following:
1. OPSWAT’s cumulative liability to the County for all claims is limited to two times the total fees paid by the County in the 12 months prior to the claim for the specific services giving rise to the claim, except for OPSWAT’s indemnification obligations, gross negligence, willful misconduct and violation of law.
• The County standard contract does not include a limitation of liability.
• Potential Impact: Claims could exceed the liability cap and the Terms of Service amount leaving the County financially liable for the excess.
2. The term of the Terms of Service is indefinite beginning on September 13, 2022, and continuing until terminated by either party.
• County Policy 11-06SP does not permit indefinite term or automatically renewing contracts unless approved by the Board.
• Potential Impact: There is no end term to the Terms of Service and the County is indefinitely bound to the Terms of Service until terminated.
A third-party License Agreement with dtSearch Corporation (dtSearch) is incorporated into the OPSWAT Terms of Service. The License Agreement is dtSearch’s standard commercial agreement, which includes terms that differ from the standard County contract and omits certain County standard contract terms. dtSearch is unwilling to negotiate these terms. The non-standard and missing terms include the following:
1. Governing law of the License Agreement is the State of Maryland.
• The County standard contract requires California governing law.
• Potential Impact: The License Agreement will be interpreted under Maryland law. Any questions, issues, or claims arising under this License Agreement will require the County to hire outside counsel competent to advise on Maryland law, which may result in fees that exceed the total License Agreement amount.
2. All disputes arising under the License Agreement must be settled by binding arbitration.
• The County standard contract does not require arbitration.
• Potential Impact: Arbitration decisions are not appealable. In addition, disputes that might otherwise be settled in small claims court would incur arbitration costs that would exceed the costs of a small claims action, and the License Agreement amount. County Counsel cannot advise on whether and to what extent such arbitration provisions may be enforceable against a government entity under Maryland law.
3. There is no provision in the License Agreement addressing each party’s responsibility for paying attorneys’ fees, except that an arbitrator cannot award attorneys’ fees in any arbitration matter.
• The County standard contract requires each party to bear its own costs and attorney fees, regardless of who is the prevailing party.
• Potential Impact: County Counsel cannot advise on, whether and to what extent, Maryland law may affect a party’s requirement to pay the prevailing party’s attorneys’ fees and costs in a legal action where no specific provision is provided in the License Agreement.
4. The License Agreement does not require dtSearch to indemnify the County, as required by County Policy 11-07, including for intellectual property infringement claims.
• The County standard contract indemnity provision requires contractors to indemnify, defend, and hold County harmless from third party claims arising out of the acts, errors or omissions of any person. The standard contract provision for intellectual property indemnity is: Contractor will indemnify, defend, and hold harmless County and its officers, employees, agents and volunteers, from any and all third party claims, costs (including without limitation reasonable attorneys’ fees), and losses for infringement of any United States patent, copyright, trademark or trade secret (Intellectual Property Rights) by any goods or services.
• Potential Impact: dtSearch is not required to defend, indemnify or hold the County harmless from any claims, including indemnification for claims arising from dtSearch’s negligent or intentional acts and intellectual property infringement. If the County is sued for any claim, including intellectual property infringement based on its use of dtSearch’s software or services, the County may be solely liable for the costs of defense and damages, which could exceed the total License Agreement amount. County Counsel cannot advise on whether and to what extent Maryland law may allow the County to require dtSearch to defend or indemnify it absent an express provision in the License Agreement.
5. The License Agreement does not require dtSearch to meet the County’s insurance standards as required pursuant to County Policy 11-07.
• The County Policy requires contractors to carry appropriate insurance at limits and under conditions determined by the County’s Risk Management Department and set forth in the County standard contract.
• Potential Impact: The County has no assurance that dtSearch will be financially responsible for claims that may arise from the County’s use of the software, which could result in expenses to the County that exceed the total License Agreement amount.
6. dtSearch’s total liability to the County for all claims under the License Agreement is limited to the lesser of the license fee or the amount paid by the County during the one-year period prior to the filing of the claim.
• The County standard contract does not include a limitation of liability.
• Potential Impact: Claims could exceed the liability cap and the License Agreement amount leaving the County financially liable for the excess. County Counsel cannot advise on, whether and to what extent, Maryland law may limit or expand the exclusion of limits to the extent prohibited by applicable law.
7. The County’s right to bring any claim is limited to one year from the earlier of the date of purchase of the software or the date of the License Agreement.
• The County standard contract does not include a limit on the time to bring action.
• Potential Impact: Limiting the County’s ability to bring suit to one year amounts to a waiver of the Statute of Limitations for claims and shortens the period of time in which the County may file a lawsuit under the License Agreement. dtSearch’s right to bring claims is not similarly limited, so dtSearch may bring claims any time within the Statute of Limitations. County Counsel cannot advise on, whether and to what extent, Maryland law may allow parties to contractually agree to override the Statute of Limitations on claims.
8. The venue for arbitration proceedings is Bethesda, Maryland. The venue for any other actions is in the court with jurisdiction over the matter that is located in the State of Maryland or the District of Columbia, which is geographically closest to Bethesda, Maryland.
• The County standard contract requires the venue for disputes to be the Superior Court of California, County of San Bernardino, San Bernardino District.
• Potential Impact: Having a venue in Maryland or District of Columbia may result in additional expenses that exceed the amount of the License Agreement.
ITD recommends approval this item, including the non-standard terms, to allow ITD to purchase an advanced threat detection and prevention cloud platform to protect critical County data from breaches and malware attacks. ITD evaluated advanced threat detection and prevention cloud software and determined that OPSWAT software is the best option for the County as it integrates with ITD’s existing advanced threat protection platform. There is also no guarantee that another vendor will negotiate their terms.
PROCUREMENT
The Agreements, including non-standard terms, will be used to accompany future purchase orders to be approved, as necessary, per County Policy 11-04 Procurement of Goods, Supplies, Equipment and Services.
REVIEW BY OTHERS
This item has been reviewed by County Counsel (Bonnie Uphold, Supervising Deputy County Counsel, 387-5455) on August 4, 2022; Purchasing (Tevan Stremel, Buyer III, 387-2092) on August 4, 2022; Risk Management (Victor Tordesillas, Director, 386-8623) on August 17, 2022; Finance (Ivan Ramirez, Administrative Analyst, 387-4020) on August 24, 2022; and County Finance and Administration (Paloma Hernandez-Barker, Deputy Executive Officer, 387-5423) on August 28, 2022.