Aerospace firm pays $13M to cover cyber gaps in Army, MDA and NASA work
Gettyimages.com/Iana Kunitsa
By
Nick Wakeman
The payment also includes $2.35 million for the whistleblower who kicked off the Justice Department investigation.
Two business units of an aerospace-and-defense company have agreed to jointly pay $13 million to settle allegations it falsified its compliance with cybersecurity requirements involving contracts with the Army, the Missile Defense Agency and NASA.
The settlement payments from ILC Dover LP and ILC Astrospace LLC are not admissions of liability and the allegations are not proven facts, according to the Justice Department's Nov. 3 announcement.
The settlement resolves a whistle-blower lawsuit filed by Philip Root, ILC’s former director of cybersecurity, who will receive $2.35 million as part of the agreement.
His lawsuit and the Justice Department investigation outlined several allegations, including that ILC allegedly used a third-part company to store controlled-unclassified information in a cloud environment without assuring that the company met FedRAMP moderate requirements.
ILC is also accused of not updating systems security plans for each of its covered information systems, as required by the Defense Department and NASA.
A second accusation is that the company did not submit any current assessments to DOD for its implementation of NIST SP180-171 cybersecurity controls.
The government also alleges that the company had no plans or milestones set to close the alleged security gaps.
The settlement does not describe any breach or data theft that occurred, but is focused on the risks created by the alleged non-compliance.
“The best response to cyberattacks is to prevent them from happening in the first place,” said U.S. Attorney Benjamin L. Wallace for the District of Delaware. “The obligations that ILC violated exist to prevent bad actors from taking advantage of the United States’ technical innovation.”