Another FCA Cybersecurity Settlement Signals Continued Commitment to Enforcement Priorities
This month’s announcement by the United States Department of Justice (DOJ) of another False Claims Act (FCA) settlement with a federal contractor offers further proof that the government continues to prioritize cybersecurity enforcement. According to DOJ’s press release, government contractor Honeywell Aerospace Inc. (Honeywell Aerospace) agreed to pay over $2 million to settle an FCA matter, which arose from allegations related to the company’s cybersecurity practices with respect to its Department of Defense contracts.
The Honeywell Settlement
Honeywell Aerospace is an Arizona-based company that provides aerospace products and solutions to government and commercial customers. A former IT employee filed a qui tam complaint after she was allegedly constructively discharged by the company for raising cybersecurity concerns related to the company’s contracts with the Department of Defense.
According to the complaint, pursuant to the contracts, Honeywell Aerospace provided the government with quantum computing services. Federal defense contractors like Honeywell Aerospace are required to implement certain cybersecurity controls outlined in the National Institute of Standards and Technology Special Publication 800-171 (NIST SP 800-171). But, according to this lawsuit, Honeywell Aerospace failed to meet these requirements in connection with its work on the Quantum Contracts.
The complaint alleged myriad cybersecurity failings by Honeywell Aerospace with respect to the Quantum Contracts from April 2020 through December 2023, particularly as to the company’s treatment of controlled unclassified information (CUI) hosted on its “Gray Network,” an electronic network used for its work on the Quantum Contracts. The relator alleged that Honeywell Aerospace relied on a firewall to protect the Gray Network that was simply “a smokescreen to hide its inadequate security practices,” and that the company employed inadequate malicious code protection, access control, incident testing and response, and oversight of suspicious activity. Further, the complaint alleged that the company failed to report suspected cyber incidents or breaches as required by the Quantum Contracts and federal cybersecurity requirements.
Honeywell Aerospace did not admit these allegations but agreed to pay over $2 million to settle the claims, of which the qui tam relator will receive $375,823.
Implications of the Honeywell Aerospace Settlement
This settlement serves as a reminder that the government’s enforcement work on cybersecurity issues under the FCA is alive and well. As noted by Assistant Attorney General Brett A. Shumate of the Justice Department’s Civil Division in connection with the Honeywell Aerospace settlement: “The Justice Department will continue to investigate potential violations of these cybersecurity requirements to protect this critical information.”
This case fits a pattern of other recent cybersecurity FCA settlements that involve federal defense contractors whose contracts have contractual clauses requiring compliance with the NIST SP 800-171 requirements for handling CUI. Defining what constitutes CUI and mapping the boundaries of information systems that hold CUI is notoriously challenging. The threat of FCA enforcement raises the stakes for confronting that challenge even more.
In addition, this also highlights the risk of FCA suits arising from insiders, as the FCA is a rare statute that allows private individuals to file suit on behalf of the United States. Just like multiple other recent cyber FCA settlements, the relator in this case was an IT employee of the company who allegedly had raised concerns about the company’s cybersecurity compliance.
Recommendations
Government contractors and other recipients of federal funds should consider the following steps to enhance cybersecurity compliance and reduce FCA risk:
- Catalogue and monitor compliance with all government-imposed cybersecurity standards. Ensure your organization has a comprehensive list of all cybersecurity requirements and covered systems in your organization. These requirements may come not only from prime government contracts but also subcontracts, grants, or other federal programs. This includes not only ongoing knowledge of the organization’s contracts but also diligently classifying the types of information the organization handles (such as CUI) and which systems process that information. This also includes continuously monitoring and assessing the organization’s cybersecurity program to identify and patch vulnerabilities and to assess compliance with those contractual cybersecurity standards. This assessment should also consider third-party relationships, including vendors and service providers.
- Develop and maintain a robust and effective compliance program that addresses cybersecurity issues. In many companies, the compliance program and information security functions are not well integrated. An effective compliance program will address cybersecurity concerns and encourage employees to report such concerns. When concerns are identified, it is critical to escalate and investigate them promptly — the allegations in the Honeywell Aerospace complaint serve as a cautionary tale highlighting the potential consequences of not effectively responding to employees’ concerns. And companies should take care to ensure that there is no retaliation against employees who report concerns in good faith. It may often be beneficial to involve counsel in the investigation of concerns as early intervention is key to assessing and minimizing risk.
- Where non-compliance with cybersecurity standards is identified, organizations should evaluate potential next steps. This includes whether to disclose the matter to the government and cooperate with government investigators. Organizations should work with experienced counsel in this regard. Proactively mapping out a strategy for investigating and responding to potential non-compliance can instill discipline to the process and streamline the organization’s approach. And a proactive approach may mitigate the impact of consequences down the line.
If you have questions about cybersecurity or the False Claims Act, reach out to the authors or your Foley & Lardner attorney.
