6. DolT Managed Endpoint Cybersecurity Protection and Monitoring Services - Carahsoft I thank the City of Pasadena for investing in the protection of our invisible critical infrastructure.
We are in a positive position to have received a good amount ofwell-qualified vendors to select from to assist with protecting our technology infrastructure. I ask the City Council to award the contract to an alternate vendor who does not have ties or contracts with DHS or ICE, and in alignment with the City's commitment to protect residents regardless of immigration status.
The staff report states Carahsoft is essentially a reseller (Carahsoft Master Aggregator™).1 Therefore, it is more questionable to treat a reseller as a vendor, and it only serves to further obfuscate who the city is doing business with. How can Carahsoft and the city staff confidently say what the ultimate technology product will be in terms of costs and capabilities? Unless it already knows who the end vendor is (and is not telling the council and the public), it cannot.
Will we end up with Palantir by way of Carahsoft - another surveillance technology platform aiding with DHS and ICE crimes against humanity?2
Carahsoft is itself embroiled in significant controversy and deep legal hot waters:
Carahsoft settled for $75.5 million over a Fair Claims Act lawsuit in 2015 for concealing commercial pricing and overcharging the government,3
The FBI raided Carahsoft offices in 2024 and is being investioated by the U.S. Justice department for conspiracy to overcharge the government billions of dollars, facing more False Claims Act violations, for "conspriringl with other companies to rig bids, inflate prices, overcharge and defraud the Department of Defense (DoD), among other federal government agencies, in selling [redacted] software, cloud storage and related hardware and services."4 5 According to Federal News Network reporting, the FBI raid should serve as a wake up call for the reseller market. It should be a wake up call for municipal governments procuring tech as well.
I
1 https://www.carahsoft.com/about
2 https://comptroller.nyc.gov/reports/]etter-to-palantir-technologies-requesting-third-party-human-rights-risk-assessment/ 3 https://www.justice.gov/archives/opa/pr/vmware-and-carahsoft-agree-pay-755-million-settle-claims-they-concealed- commercial-pricing?bm-verify=AAQAAAAN_3uxlAa7awUBZYVUrS9jszC3e7UNBqBEEjlVUvdmiV9frV- J6kf4fvHFnLoZaVkbzdVpzXsmJmzN_punoByM56KrhjP4v8jVvDDFAaAkH5JRwqOYCZRLrBxOjuprltxAmJ17CjbSZue_BV h_66a3pOK_xDDErB28DSBrH3Jwhvxp-2oDFpm4-
OqWiRwrv8gAA3041cEuPLNk6ulkGRB3735XEvD-9LedkdzTb8MktONE9xuNpHx5G4iXumQz2Ncn8jpwq5KrXkGskApn7S jfQ2tLsSaRQdEWX6mcK-v6unPEuHqVerYA9CKsuW6DRH7l3VIVd8dZ6jk8Er4xqqOc52Cu11SzlacFRN2rYc1- _h6JkwnE2DowoUd6v05KOUmik4fNf29a-ljjLe_SDfnPv70EUDDCqQ
4 https://federalnewsnetwork.com/contracting/2024/09/fbi-dcis-raid-carahsoft-headquarters/ 5 https://www.investing.com/news/company-news/doj-probe-into-carahsoft-may-disrupt-sap-and-servicenow- sales-93CH-3632261
06/08/2026
Item 20
6. DolT Managed Endpoint Cybersecurity Protection and Monitoring Services - Carahsoft Former federal executives and industry experts said it may be time to rethink the IT value added reseller (ITVAR) approach as the FBI and DCIS raid shined a brighter light on supply chain risks that most vendors and agencies generally glossed over until now.6 As several industry sources said, the FBI and DCIS don't raid companies if it's just a civil matter. Without knowing any details of Carahsoft's situation, sources said history has shown if the FBI shows up, there usually is something more serious and illegal going on.
But, the source said "when the FBI decides to arrive at your door unannounced, it's usually an "extreme" situation...This had to be a massive non-compliance with a lot of missed deadlines and something criminal going on."
A long-time federal procurement expert said he could see agencies looking for alternatives to Carahsoft until they know more about what's going on.
"They will look at those contracts and see if they can get this technology from somewhere else. IfJ, was a Qovernment employee and this was ooinq on, part of my thinkino would be how do I aet what I need and not buy it here," he said. "/ would think companies also are examinino whether they can partner with someone else, especially if an aoencv is not willinci to use that company for now."
The concerns expressed by several industry executives aren't just about Carahsoft, but around the entire ITVAR approach. "There are downstream risks from that are biproducts of the market and do not lead to healthy outcomes for the government."7 Say no, reject the Carahsoft contract and go with another competent vendor (not a reseller).
Yadi
Pasadena Education Technology Committee Meeting
May 19,2026
6. DolT Managed Endpoint Cybersecurity Protection and Monitoring Services - Carahsoft Q
3o
^
^°Q
ISf
>
r--j
C=l
r~o
a~>
c=
Or3 2
"n ».,.
00 73
m
0 s'n
y» -<.
g m
0 0
t-n
C3
6 https://federalnewsnetwork.com/acquisition-policy/2024/10/carahsoft-raid-may-be-a-wake-up-call-for-the-reseller-markeV 7 https://federalnewsnetwork.com/acquisition-policy/2024/10/carahsoft-raid-may-be-a-wake-up-call-for-the-reseller-market/ McMillan, Acquanette (Netta)
From:
Sent:
To:
Subject:
humaira afzal
Monday, June 8, 2026 4:05 PM
PublicComment-AutoResponse
public comment on agenda item 20: contract with Carahsoft Technology (June 8 meeting) [ l ] CAUTION: This email was delivered from the Internet. Do not click links or open attachments unless you know the content is safe. Report phish using the Phish Alert Button. For more information about the Phish Alert Button view article "KB0011474" on the DolT portal.
City Council,
I am writing in response to the Department of Information Technology report regarding the proposed contract with Carahsoft Technology. I again urge the City not to sign this contract with Carahsoft.
Key Clarification #1 notes that Carahsoft is a reseller and does not develop or operate the underlying MDR technology. Why are we buying from a reseller instead of directly from Quzara (the actual service provider)? Additionally, the service provider (Quzara) should have been named in the initial report from 4 April 2026. It is only now named because this was asked about in the EDTech meeting. If community members had not voiced concerns about Carahsoft, Council would likely have signed off on the contract on the consent agenda in April without even knowing who the actual service provider is. Quzara is also STILL not named in the 8 June staff report, which is the April report with the date changed. Council would still be agreeing to a contract that does not actually name the service provider.
Key Clarification #2 notes that Carahsoft's "ICE related work represents an extremely small fraction of the company's overall federal contract portfolio." However, it is the type of technology that Carahsoft sells to DHS that matters, not the percent of ICE business in its federal portfolio. As a reminder, Carahsoft Technologies sells surveillance technology to DHS, and more broadly, the federal government. This technology is used not just to surveit, track and hunt down immigrants, but also to do the same to anyone that the federal government views "unfavorably". That includes protesters, community defenders, women seeking reproductive healthcare, people seeking transgender care, and a list that grows daily. Anyone, including City Council members, can get caught up in this surveillance. For example, Councilmember Cole's social media posts expressing outrage at the urban warfare training exercises in Pasadena last week has almost certainly been flagged by Zignal as anti-government, anti-Trump and anti-American. (I commend Councilmember Cole for his outspokenness on this).
Zignal. Al-powered social media surveillance system. Rather than repeat previous comments, I will just share an article ICE Just Spent Millions on a Social Media Surveillance Al Program Cellebrite - used to hack phones and other electronics without a warrant. AFSC overview of use of Cellebrite by repressive Qovernments
The fact that Carahsoft is the reseller, not the developer, of Zignat or Cellebrite is irrelevant. Carahsoft still profits from selling the technology to entities that use it against to harm people.
Key Clarification #3 shows that staff have checked to determine whether Quzara has contracts with DHS (they don't). Thank you.
Key Clarification #4. The city should request access to Quzara's SOC 2 Type 2 audits to confirm that City data is not being used for any purpose not authorized in the contract.
Key Clarification #5. City Council needs to give Staff explicit direction in evaluating the ethical conduct of vendors, especially regarding DHS and ICE. However, it should not require a year to begin explicitly requiringthatpotentialvendors disclose info on DHS contracts, nor should staff rely on the self-disclosure as wholly accurate. The development of a procurement process that factors ethical considerations as part of the decision making should have already begun. Instead, the process appears to only have started because concerned members of the community have pushed for it by putting a spotlight on issues with contracts. I urge Council to be more proactive and work on this process with full transparency and also seek community input.
I also urge Council to not sign the contract with Carahsoft or another reseller.
Regards,
06/08/2026
Item 20
HumairaAfzal, PhD
Sent with Proton Mail secure email.