ILC Dover, ILC Astrospace Pay $13 Million Over Cybersecurity Claims

Two aerospace and defense contractors will pay $13 million to resolve allegations that they failed to meet mandatory cybersecurity standards required by the U.S. Army, NASA, and the Missile Defense Agency.

The settlement involving ILC Dover LP and ILC Astrospace LLC addresses claims that the companies misrepresented their compliance with security protocols for several years. According to a statement from the Justice Department, the companies allegedly submitted false and fraudulent claims for payment while failing to satisfy the cybersecurity requirements embedded in their federal contracts.

The alleged misconduct spanned from January 2018 to October 2024, Federal News Network reported. While the $13 million agreement resolves the allegations, the Justice Department said that there has been no formal determination of liability regarding the companies’ actions.

ILC Dover, ILC Astrospace to Pay $13M Over Alleged Cybersecurity Lapses on Army, MDA, NASA Contracts — GovConFeed

“The best response to cyberattacks is to prevent them from happening in the first place. The obligations that ILC violated exist to prevent bad actors from taking advantage of the United States’ technical innovation,” said U.S. Attorney Benjamin Wallace for the District of Delaware.

The mechanics of the alleged security failures

The government’s case centers on how the contractors handled sensitive data. Specifically, the Justice Department alleges that ILC used an external cloud service provider to store controlled-unclassified information without verifying that the provider met the Federal Risk and Authorization Management Program (FedRAMP) Moderate baseline requirements.

ILC Dover Pays $13 Million — Julie Kay

Beyond the use of cloud services, the contractors are accused of failing to implement essential cybersecurity controls found in National Institute of Standards and Technology Special Publications 800-171 and 800-53. The government argued that these missing controls could have allowed for the exploitation of networks or the exfiltration of controlled defense information.

The allegations also point to a lack of administrative oversight. The Justice Department claims the company failed to develop, implement, and update system security plans for its covered information systems. They also allegedly did not maintain plans of action and milestones (POA&Ms), which are intended to identify and mitigate known cybersecurity weaknesses.

A whistleblower’s role in the settlement

This legal action was triggered by a whistleblower lawsuit filed by Philip Root, the former Director of Cybersecurity at ILC. Root’s filing raised the same allegations of non-compliance that the Justice Department eventually pursued. Under the terms of the settlement, Root will receive a $2.35 million share of the total amount. The contractor will also pay $288,000 to cover the whistleblower’s attorney fees and expenses.

The $13 million settlement is the largest False Claims Act cybersecurity settlement to date.