Two Delaware aerospace contractors agreed to pay $13 million to resolve federal allegations that they billed the government while falling short of cybersecurity requirements in contracts with the Army, Missile Defense Agency and NASA. The Justice Department announced the civil settlement on November 3. It said the agreement resolves allegations and that there has been no determination of liability.
The case covers work by ILC Dover LP and ILC Astrospace LLC from January 2018 through October 2024. It concerns the security measures the companies were allegedly required to use, document and assess. The Justice Department announcement does not identify a data theft or an intrusion as the basis of the settlement.
What the government alleged
One allegation concerns controlled unclassified information stored with an outside cloud provider from February 2023 to October 2024. The government says the contractors failed to ensure that the provider met a security baseline equivalent to FedRAMP Moderate. It also says they failed to ensure the provider met defense requirements for reporting incidents and preserving material investigators might need to examine an incident.
Other allegations concern the contractors’ own systems. Prosecutors say the companies did not fully implement required safeguards and, during parts of the period, did not keep required security plans or plans for correcting deficiencies. The government also challenged the assessments the companies provided to the Defense Department. It alleges that ILC Astrospace lacked a current submission from November 2020 through October 2024 and that ILC Dover's assessment failed to meet requirements for currency, scope and method.
These obligations address different parts of the work. A system security plan describes what the contractor protects and how. A remediation plan tracks the shortcomings it has identified and how it intends to address them. An assessment measures how well the controls have been implemented. The government's case concerns both the underlying safeguards and the evidence that they were in place when the contractors sought payment.
How the case began
The settlement resolves a whistleblower lawsuit under the False Claims Act. Philip Root, the companies’ former cybersecurity director, is due $2.35 million from the settlement under the law’s provisions for whistleblower recoveries, the Justice Department said. CyberScoop reported that the contractors’ parent company said the issues had been addressed before the agreement and that the companies settled without admitting liability. The case was filed in federal court in Delaware.
The government pursued the case as a dispute over claims for payment. Its theory was that the contractors knew they had fallen short of security commitments when they sought federal funds. The agreement resolves that civil dispute without a ruling on whether the contractors violated the law.
