DEA Posted the No-Bid Notice After Signing

Introduction

DEA signed its second straight no-bid contract for a masked-browsing tool called Chameleon on September 9, 2025. The public notice went up the next day: it announced DEA's intent to buy sole-source and named the vendor, with a window for any other company to argue it could do the work instead. Responses were due September 25, sixteen days after the award already existed.

DEA did the same thing the year before, in reverse, signing the first no-bid bridge on September 10, 2024, eight days before that notice's own window closed. Both awards are labeled "CHAMELEON BRIDGE" in DEA's own records and cost about $5.2 million between them. Across nine orders since 2017, this program has taken $21,974,489.86 in public money, and only the first one was ever decided against a competing bid.

From Full-and-Open to CHAMELEON BRIDGE

Chameleon is managed attribution: an agent runs an online investigation from an address and a persona that don't trace back to a federal network. Concealing a government IP during an undercover narcotics case is long-standing, accepted practice. The question here is how DEA buys the capability, not whether it should have one.

In 2017, DEA competed it properly. USASpending's award detail codes the parent vehicle, IDIQ DJD17K0022, as FULL AND OPEN COMPETITION with two offers received, and Ntrepid, LLC won. The first delivery order under it, DJD17022K17D001, was signed September 14, 2017 for $1,983,033. The same record carries a qualifier: the IDIQ was a SINGLE AWARD vehicle, so once Ntrepid held it, nothing further could be competed underneath it. Six more annual delivery orders followed through FY2023, each inheriting the parent's competition coding.

The vehicle's ordering period ended March 11, 2023, and DEA signed the last order under it three days before that. Then 549 days passed with no recompete. When DEA needed the capability again in September 2024, it wrote a purchase order under FAR Part 13 simplified acquisition procedures instead, coded NOT COMPETED UNDER SAP, one offer received. A year later it did the same thing again.

One thing contract-aggregator sites get backwards: GovTribe's Ntrepid page says all five DEA awards from September 2021 through December 2025 were sole-source under FAR Part 13, while USASpending's award detail says otherwise for FY2021 through FY2023.

Both Bridges Beat Their Own Comment Windows

The FY2025 bridge is PIID 15DDHQ24P00000767, $2,577,338.80, signed September 10, 2024. Its sole-source notice had gone up on SAM.gov a week earlier, on September 3, naming Ntrepid directly, with the window for anyone else to respond closing September 18. DEA signed eight days before that window closed.

The FY2026 bridge is PIID 15DDHQ25P00000770, $2,605,039 obligated against a $3,256,303 ceiling, signed September 9, 2025. Its sole-source notice, solicitation number D-25-OD-0058, posted on September 10 — the day after. Capability statements were due September 25 at 10:00 AM.

The 2025 notice isn't sloppy. It names Ntrepid, LLC at 12801 Worldgate Drive in Herndon, Virginia, carries a NAICS code, 519290, and the FAR citation the rules require. Every piece of the disclosure machinery ran on schedule, just after the decision.

DEA's own description field on the FY2026 award cross-references the FY2025 one by PIID, "REF AWARD/BPA: 15DDHQ24P00000767," so the bridge chain documents itself inside the government's record. That same field puts the base period at three months, ending December 13, 2025, while the structured performance field on the identical award runs a full year to September 13, 2026.

The Recompete That Lasted 18 Days

On July 2, 2026, DEA posted the real thing: a combined synopsis/solicitation titled "Managed Attribution Systems (Chameleon)," number 15DDHQ26Q00000027, a Total Small Business Set-Aside under FAR 19.5, responses due July 31 at 11:00 AM ET. The requiring office is DEA's Cyber Support Section (ODV), which wrote that it "needs to continue to modernize and streamline DEA's Internet-based investigative resources with an integrated managed attribution and evidence collection system."

Eighteen days later, DEA cancelled it. The SAM.gov record for the cancelled version carries cancelled: true and archived: true, timestamped July 20, 2026.

DEA said why. The cancellation notice states the solicitation is "being withdrawn to allow the agency time to thoroughly review and incorporate updated technical, security, and compliance requirements," that "this requirement remains an ongoing agency priority," and that "the DEA intends to issue a revised solicitation on SAM.gov at a future date." No revised solicitation has appeared.

On July 24, Biometric Update published a detailed piece describing a new DEA competition for Chameleon. It had been dead for four days, because a SAM.gov cancellation notice doesn't come with a press release.

DOJ's own acquisition forecast, published January 15, 2024 and relayed through the contract-forecast aggregator HigherGov, told the market to expect a competed "New Award" for this requirement that year, estimated between $701,000 and $10,000,000. DEA issued two non-competed bridges instead.

A Second Chameleon With No Contract Behind It

This next part is murkier, and the sourcing doesn't close the loop.

404 Media obtained and published a leaked internal HSI document on July 23, a 12-page May 2024 inventory titled "ICE Wide Analytical Tools." Biometric Update's review counted 115 separate systems in 11 categories. One of them, inside HSI's RAVEn platform, is called Chameleon, described in the file (per Latin Times) as "a way to browse the web and build cover identities while keeping a government network hidden." No public ICE award reviewed identifies it by name. As Biometric Update put it, "the contract that placed it there remains hidden from public view."

ICE has bought from Ntrepid exactly once on the public record: purchase order HSCETE16P00050, $221,589.00, signed August 19, 2016, described only as "IGF::OT::IGF SOFTWARE," not competed, one offer. The award record carries two different office fields, a distinction that hasn't been reported anywhere. ICE's Information Technology Division awarded it, but Homeland Security Investigations Division 4 funded it.

That's suggestive without being proof, and a documented alternative fits just as well. A SAM.gov presolicitation from the State Department's Office of Open Source Intelligence, posted April 23, 2024, announces an intent to sole-source to The MITRE Corporation for deployment of the "MITRE-developed Chameleon tool" and the "HSSEDI-funded and developed Chameleon capability." HSSEDI is DHS's own federally funded research center, operated by MITRE for DHS, and a capability built inside an FFRDC wouldn't leave a commercial contract trail under its own name, which is precisely what HSI's listing looks like.

Two federal tools carry this name and no document I've seen resolves which one HSI is running. Biometric Update's own summary reads: "Ntrepid is the confirmed provider of DEA's Project Chameleon, ICE separately bought software from Ntrepid, and HSI later listed Chameleon among the tools available through RAVEn." The next sentence in that same article: "no document reviewed expressly connects the ICE purchase order to the platform." 404 Media also flags the inventory as possibly out of date, since it was generated in 2024.

A DHS spokesperson did respond to 404 Media, in a statement Latin Times quoted verbatim: "[L]ike other law enforcement agencies, ICE employs various forms of technology to investigate criminal activity and support law enforcement efforts." It's boilerplate, and it's the only response anyone gave: neither DEA nor Ntrepid has addressed the contracting question publicly.

The same inventory holds a contrast: HSI's Office of Intelligence bought SILO browser licenses through Slam Technical Services in September 2025, $457,039.57 against a $1,465,638.46 ceiling, coded COMPETED UNDER SAP with seven offers, vendor and price both public.

Who Benefits

DEA's contracting apparatus, and the benefit is friction avoided rather than money pocketed. Nothing in this record shows personal enrichment, and no individual decision-maker appears anywhere in it. A FAR Part 13 bridge purchase order skips the competition and the pricing pressure that comes with it, keeping the incumbent running without a gap. The sole-source notice is the disclosure obligation attached to that shortcut, and signing the award before the notice's window runs satisfies it on paper while the outcome was never in play.

Accountability diffuses too, and the award records show how. The funding office on this program changed twice: Office of Investigative Technology carried it from 2017 through FY2023, Operational Support Division funded the FY2025 bridge, and Office of Information Systems funded the FY2026 one. Cyber Support Section (ODV) is a fourth entity, the requiring office that posted and killed the 2026 recompete. No single office owns the full history, which means no single office has to answer for it.

Ntrepid gets a durable federal revenue line, and the vendor isn't the villain here. It beat another bidder in open competition in 2017, and nothing in the record makes it responsible for how either agency handles disclosure. Its largest federal award isn't even a DEA order: it's a $6,919,191 software license from 2014, nominally an Army award but funded by HQ USCENTCOM CCJ3.

GAO Wrote the Warning in 2015

GAO published a report in October 2015 titled "Sole Source Contracting: Defining and Tracking Bridge Contracts Would Help Agencies Manage Their Use." It found that DOJ, DEA's own department, had "limited or no insight into their use of bridge contracts." GAO made two recommendations to the Office of Federal Procurement Policy. Both are still listed Open as of February 2026, eleven years on.

That same report carries the number that keeps this honest. Of 26 cases GAO reviewed where a follow-on contract was eventually awarded, 23 were competed. Bridge contracts are common, and they usually resolve into a real competition. DEA's resolved into a second bridge, then into a recompete the agency pulled 11 days before its own response deadline.

That's why the sequencing carries this story, more than the sole-sourcing itself. Every document federal acquisition rules require here exists, vendor named, FAR citation in the text. They just arrive in an order that makes them ceremonial: a comment window that opens after the check is written can't change the award, and a competition cancelled before its own response deadline never has to be scored against anyone.

The Bottom Line

The FY2026 bridge expires September 13, 2026, according to USASpending's structured performance field, though DEA's own description field on that same award says the base period ended in December 2025. Six weeks out, SAM.gov shows no replacement solicitation, only DEA's stated intent to issue one "at a future date." The cancelled notice auto-archives August 15.

If nothing lands before September 13, DEA still needs the capability, and it has used the same instrument twice to keep one running past an expired vehicle. The thing worth watching is whether a third bridge's public notice shows up before the signature this time, or after it again.

This story is developing. Details may change.