ILC Dover and ILC Astrospace to Pay $13 Million to Settle Cybersecurity Fraud Allegations
The U.S. Department of Justice (DOJ) announced on November 3 that ILC Dover LP and ILC Astrospace LLC, defense and aerospace companies based in Frederica, Delaware, have agreed to pay $13 million to resolve allegations that they violated the False Claims Act by failing to comply with cybersecurity requirements in their contracts with the Department of the Army, the Missile Defense Agency, and the National Aeronautics and Space Administration (NASA).
"To protect sensitive information from cyber threats, defense and aerospace contractors must comply with the cybersecurity requirements in their federal contracts and subcontracts," said Assistant Attorney General Brett A. Shumate of the Justice Department's Civil Division. "We will continue our efforts to hold accountable government contractors and subcontractors that fail to meet their cybersecurity commitments."
The settlement resolves allegations that from January 2018 to October 2024, ILC submitted false or fraudulent claims for payment on contracts with the Army, the Missile Defense Agency, and NASA, knowing it had not complied with those contracts' cybersecurity requirements. Among the allegations: from February 2023 to October 2024, ILC used a third-party company to store controlled unclassified information in the cloud without requiring and ensuring that the third party met security requirements equivalent to the Federal Risk and Authorization Management Program (FedRAMP) Moderate baseline and complied with Department of War requirements for cyber incident reporting and related matters.
The government also alleged that ILC did not develop, document, and periodically update system security plans for each of its covered information systems as required; did not fully implement all cybersecurity controls in National Institute of Standards and Technology (NIST) Special Publications 800-171 and 800-53; did not develop and implement plans of action and milestones to correct deficiencies; and that, from November 2020 to October 2024, ILC Astrospace had not submitted any current assessment of its implementation of NIST SP 800-171 controls, while ILC Dover's submitted assessment was allegedly not current or properly based.
"The best response to cyberattacks is to prevent them from happening in the first place," said U.S. Attorney Benjamin L. Wallace for the District of Delaware. "The obligations that ILC violated exist to prevent bad actors from taking advantage of the United States' technical innovation." Investigators from the Department of Defense Office of Inspector General's Defense Criminal Investigative Service (DCIS), the Army Criminal Investigation Division, and the NASA Office of Inspector General also commented in the announcement.
The settlement resolves a lawsuit filed under the whistleblower provisions of the False Claims Act, which permit private parties to sue on behalf of the government and receive a share of any recovery. The whistleblower, Philip Root, ILC's former Director of Cybersecurity, will receive a $2.35 million share of the settlement. The case is captioned United States ex rel. Root v. ILC Dover LP, et al., No. 25-cv-70 (D. Del.).
The matter was handled by the Civil Division's Commercial Litigation Branch, Fraud Section, and the U.S. Attorney's Office for the District of Delaware, with assistance from NASA OIG, DCIS, Army CID's Northeast Field Office, the Naval Criminal Investigative Service, the Air Force Office of Special Investigations, and the General Services Administration Office of Inspector General. The claims resolved by the settlement are allegations only, and there has been no determination of liability.
Source: U.S. Department of Justice
Published by GSM · USA (original Chinese edition)
Photo: 图：美国司法部本部大楼（GSM 四级固定图库）。 / Photo: U.S. Department of Justice headquarters building (GSM fixed asset library).
