Circuit Wire — a daily news update from the Circuit.
ILC Dover LP and ILC Astrospace LLC, both of Frederica, Delaware, agreed on November 3 to pay $13 million to resolve False Claims Act allegations over their cybersecurity practices, the Justice Department announced. The claims at issue involved contracts with the Department of the Army, the Missile Defense Agency and NASA.
The settlement ends a whistleblower lawsuit filed under the act's qui tam provisions. Philip Root, ILC's former Director of Cybersecurity, will receive $2.35 million of the total. The case is United States ex rel. Root v. ILC Dover LP, filed in the District of Delaware. The release states there has been no determination of liability.
Prosecutors allege the problems ran from January 2018 to October 2024. They say ILC used a third-party company for cloud storage of controlled unclassified information between February 2023 and October 2024 without ensuring it met security requirements equivalent to the FedRAMP Moderate baseline. The same allegation covers Defense Department requirements on incident reporting, malicious software, media preservation, forensic access and damage assessment.
The government also alleges ILC did not develop, document and update system security plans for its covered information systems. It says the companies did not fully implement controls from NIST SP 800-171 and 800-53, including controls whose absence could enable significant exploitation or exfiltration of controlled defense information.
Two further allegations concern remediation and reporting. Officials say ILC did not develop and carry out plans of action and milestones to correct known deficiencies. They also say that from November 2020 to October 2024, ILC Astrospace did not submit a current NIST SP 800-171 assessment to the Defense Department. ILC Dover allegedly did not submit a current assessment based on its system security plan and conducted under the DoD Assessment Methodology.
Brett A. Shumate, Assistant Attorney General for the Civil Division, said contractors must comply with the cybersecurity requirements in their federal contracts and subcontracts, and that the department will keep pursuing those that fail to meet them. Benjamin L. Wallace, the US Attorney for the District of Delaware, said, "The best response to cyberattacks is to prevent them from happening in the first place."
The investigation involved the Civil Division's Fraud Section, the Delaware US Attorney's Office, NASA's Office of Inspector General, the Defense Criminal Investigative Service, Army CID, the Navy Criminal Investigative Service, the Air Force Office of Special Investigations and the GSA Inspector General.
Want a weekly roundup of the major stories shaping the security industry? The On The Circuit newsletter is read by more than 12,000 protection professionals.
Spotted something we should cover? Send tips and feedback via circuit-magazine.com.