Defense and aerospace contractors ILC Dover LP and ILC Astrospace LLC of Frederica, Delaware, agreed to pay $13 million to resolve allegations that they billed the Army, the Missile Defense Agency and NASA while failing to meet cybersecurity terms in their contracts, the Justice Department said Tuesday. The settlement is another sign that security promises in government contracts carry fraud liability, not just audit risk.
What Happened
The government resolved claims under the False Claims Act, the federal law that lets the U.S. recover money from contractors that bill it improperly. The alleged conduct ran from January 2018 through October 2024.
According to the department, the companies stored controlled unclassified information, sensitive government data that is not classified, with an outside cloud provider without ensuring it met protections equivalent to the government’s FedRAMP Moderate baseline. The government also alleged the companies did not maintain required system security plans, did not fully put in place controls set out in National Institute of Standards and Technology (NIST) guidelines SP 800-171 and SP 800-53, and did not keep plans to fix known weaknesses. ILC Astrospace allegedly never submitted a current self-assessment against NIST SP 800-171 to the Defense Department, and ILC Dover allegedly submitted one that was out of date.
The case began as a whistleblower suit by Philip Root, the companies’ former director of cybersecurity, who will receive $2.35 million. The department said the claims are allegations only and there has been no determination of liability.
Ingersoll Rand, which bought ILC Dover in June 2024, said it learned of the matter after the acquisition, fixed the issues by October 2024 and settled “without an admission of liability,” CyberScoop reported.
Why It Matters
For boards of federal contractors, the case turns security paperwork into legal exposure. Employees who know the gaps can sue on the government’s behalf and share the recovery. And the buyer here inherited conduct that predated its ownership.
“The best response to cyberattacks is to prevent them from happening in the first place,” Delaware U.S. Attorney Benjamin Wallace said in the release.
What to Watch
CyberScoop called the payment one of the larger such settlements since the department began using the False Claims Act against contractor cyber shortfalls in 2022. Government contract attorneys told the outlet that a coming overhaul of rules for controlled unclassified information could expose more companies to similar claims.
