KBK Partner Matthew LaGarde Evaluates Recent DOJ Intervention in Cybersecurity Qui Tam Lawsuit

In another indication of the U.S. Department of Justice’s (“DOJ”) ongoing commitment to safeguarding data privacy, the DOJ announced last week that it was joining a qui tam whistleblower suit against the Georgia Institute of Technology (“Georgia Tech”) and Georgia Tech Research Corp. (“GTRC,” and together with Georgia Tech, the “Defendants”).  The suit, brought under the federal False Claims Act (“FCA”), 31 U.S.C. § 3729 et seq., alleges that the Defendants knowingly failed to meet cybersecurity requirements in connection with Department of Defense (“DoD”) contracts.  The suit provides a noteworthy example of the vital role of whistleblowers in protecting data privacy and of the government’s willingness to take proactive measures even where there has been no data breach.

Since October 2016, DoD regulations have mandated that “[t]o provide adequate security, [defense contractors] shall implement, at a minimum . . . the security requirements in National Institute of Standards and Technology (NIST) Special Publication (SP) 800-171, ‘Protecting Controlled Unclassified Information in Nonfederal Information Systems and Organizations,’” also known as the NIST SP 800-171 standards, that are “in effect at the time the solicitation is issued[.]”  DFARS 7012(b)(2).  The NIST guidelines require contractors to implement comprehensive security controls and practices, including access control, incident response, and risk assessment.  Among the requirements in the NIST guidelines is a direction that contractors “[d]evelop, document, and periodically update system security plans that describe system boundaries, system environments of operation, how security requirements are implemented, and the relationships with or connections to other systems.”  NIST SP 800-171 Control 3.12.4.  Defense contractors are further required to provide the DoD with an up-to-date Supplier Performance Risk System (“SPRS”) score, which informs the DoD of the status of the contractors’ compliance with the 110 controls set forth by NIST.  DFARS 7032(a)(2); 48 C.F.R. § 252.204-7019(b).

According to the qui tam complaint, up until at least February 2020, Georgia Tech’s Astrolavos Lab did not develop or implement the required system security plan.  Even after the lab did create a security plan in February 2020, the lawsuit contends that it was improperly scoped, failing to cover all computers and servers in the lab.  Furthermore, the lawsuit alleges that until December 2021, the Astrolavos Lab did not install, update, or run any anti-virus or anti-malware tools on its servers or computers.

The lawsuit further states that in December 2020, the Defendants submitted a fraudulent SPRS score to the DoD.  The DOJ alleges that the Defendants based the score on a “fictitious” or “virtual” environment that did not correspond to any actual system handling defense information at Georgia Tech.  According to the lawsuit, Georgia Tech condoned these lapses in security to meet the demands of the lab’s principal investigator.

Perhaps the most noteworthy aspect of the lawsuit and the DOJ’s intervention is that this is a so-called “failure to secure” case, not a “breach” case.  In other words, there was not a significant cyber breach arising because of the Defendants’ allegedly deficient cybersecurity practices; rather, the lax practices by the Defendants simply created the risk of such a breach.  In this way, the case is similar to another qui tam case the DOJ settled against Cisco Systems in 2019.  It is also distinct from the lion’s share of cybersecurity cases brought to date by the U.S. Securities and Exchange Commission (“SEC”), nearly all of which have occurred on the heels of an actual breach at a publicly traded company, as opposed to mere cybersecurity lapses creating the risk of such a breach.

Christopher Craig and Kyle Koza, former senior members of Georgia Tech’s cybersecurity compliance team, are the whistleblowers who initially filed the lawsuit under the FCA’s qui tam provisions.  The statute permits private individuals to bring suit on behalf of the United States for fraudulent claims and to receive a portion of any financial recovery. Thus, if and when the DOJ either settles this case or litigates it to a successful verdict, the whistleblowers will be entitled to between 10 and 30 percent of the government’s recovery.

In an era where digital threats are increasingly sophisticated and pervasive, the importance of government efforts to safeguard cybersecurity cannot be overstated.  Contractors play a vital role in the execution of government projects and are often entrusted with handling vast amounts of sensitive information, from personal data of citizens to critical national security details.  Ensuring that these contractors comply with the NIST guidelines is essential to maintaining cybersecurity integrity.  Rigorous contractor oversight helps safeguard against security gaps and ensures the protection of national interests, maintaining public trust and defending against evolving cyber threats.  To that end, it is imperative that the DOJ shows government contractors that, if they fail to adhere to these critical standards, it will hold them accountable.  Through the FCA, whistleblowers are empowered to assist in that effort and—given the vast number of contractors with access to government information and systems—those whistleblowers play a pivotal role in ensuring compliance with cybersecurity requirements.