In 2021, the United States Department of Justice (“DOJ”) announced the launch of its Civil Cyber-Fraud Initiative (“CCF” or “the Initiative”).[1] As noted by the DOJ, the Initiative aims to “utilize the False Claims Act to pursue cybersecurity related fraud by government contractors and grant recipients.”[2] This blog post will discuss this Initiative and provide some insight into recent CCF cases.
As we noted in a previous blog post, the False Claims Act (“FCA”) is a powerful tool used by the Government to ensure that taxpayer funds are used properly.[3] According to the DOJ, the CCF “will hold accountable entities or individuals that put U.S. information or systems at risk by knowingly providing deficient cybersecurity products or services, knowingly misrepresenting their cybersecurity practices or protocols, or knowingly violating obligations to monitor and report cybersecurity incidents and breaches.”[4] Under the Initiative, the DOJ seeks to hold government contractors accountable for failures to adhere to the cybersecurity requirements found in government contracts or grants.[5] According to the DOJ, the Initiative will have several benefits, including “[b]uilding broad resiliency against cybersecurity intrusions across the government, the public sector[,] and key industry partners,” “[h]olding contractors and grantees to their commitments to protect government information and infrastructure,” and “[i]mproving overall cybersecurity practices that will benefit the government, private users[,] and the American public.”[6]
Two recent cases demonstrate the DOJ’s commitment to the Initiative. On August 22, 2024, the DOJ announced that it intervened (or joined) a suit filed against The Georgia Institute of Technology (“Georgia Tech”) and the Georgia Tech Research Corporation (“GTRC”).[7] The complaint asserted that the “defendants knowingly failed to meet cybersecurity requirements in connection with the Department of Defense (DoD) contracts.”[8] According to the head of the DOJ’s Civil Division, Principal Deputy Assistant Attorney General Brian M. Boynton, “‘Government contractors that fail to fully implement required cybersecurity controls jeopardize the confidentiality of sensitive government information[.]’”[9] He went on to state, “‘The department’s Civil Cyber-Fraud Initiative was designed to identify such contractors and to hold them accountable.’”[10] Special Agent in Charge Darrin K. Jones of the DoD’s Office of the Inspector General added, “‘Deficiencies in cybersecurity controls pose a significant threat not only to our national security, but also to the safety of the men and women of our armed services who risk their lives daily[.]’”[11]
According to the suit, the defendants failed to implement a system security plan in accordance with DoD regulations and, when a plan was implemented, the defendants “failed to properly scope that plan to include all covered laptops, desktops, and servers.”[12] The complaint alleged other deficiencies as well, including a failure by the defendants to run anti-virus or anti-malware tools on the desktops, laptops, and servers and that the defendants “submitted a false cybersecurity assessment score to DoD for the Georgia Tech campus.”[13] This matter is still in the early stages of litigation, so it is worth monitoring the progress of this case, as it is one of the few cases in active litigation arising from the Initiative.
On October 22, 2024, the DOJ announced a settlement in a case brought against The Pennsylvania State University (“Penn State”).[14] In that case, the Relator alleged that Penn State “violated the False Claims Act by failing to comply with cybersecurity requirements in fifteen contracts or subcontracts involving the [DoD] or National Aeronautics and Space Administration (NASA).”[15] Specifically, Penn State allegedly “failed to implement cybersecurity controls that were contractually required by DoD and NASA and did not adequately develop and implement plans of action to correct deficiencies it identified.”[16] This is one of the first settlements announced by the DOJ under the Initiative. As part of the settlement, the Relator will receive a $250,000 share of the amount as a Relator under the FCA.[17]
As we have mentioned previously, FCA cases are complex and require a careful review of all documents and information available. Having experienced FCA counsel is critical, and the attorneys of Jill S. Schwartz & Associates are well-versed in FCA claims and the representation of Relators in these matters. If you have any questions or concerns regarding this topic, or any topic related to labor and employment law, please contact us.
[1] Deputy Attorney General Lisa O. Monaco Announces New Civil Cyber-Fraud Initiative, Office of Public Affairs, U.S. Dep’t of Justice, available at https://www.justice.gov/opa/pr/deputy-attorney-general-lisa-o-monaco-announces-new-civil-cyber-fraud-initiative (last visited Feb. 27, 2025).
[2] Id.
[3] For more on the FCA, see Don’t Cross Uncle Sam: A Brief Overview of the False Claims Act, Jill S. Schwartz & Associates, P.A., Blog (May 16, 2022), https://www.schwartzlawfirm.net/dont-cross-uncle-sam-a-brief-overview-of-the-false-claims-act/ (last visited Feb. 27, 2025); see also The False Claims Act, U.S. Dep’t of Justice, https://www.justice.gov/civil/false-claims-act (last visited Feb. 27, 2025).
[4] Deputy Attorney General Lisa O. Monaco Announces New Civil Cyber-Fraud Initiative, supra, note 1.
[5] See Leslie Weinstein, An Introduction to the DOJ’s CCFI, Bracker & Marcus, LLC, Blog, https://www.fcacounsel.com/blog/doj-civil-cyber-fraud-initiative/ (last visited Feb. 27, 2025). As Ms. Weinstein notes, clauses in government contracts refer to specific portions of the Federal Acquisition Regulation (“FAR”) and/or agency-specific regulations, such as the Defense Federal Acquisition Supplement (“DFARS”). Id.
[6] Deputy Attorney General Lisa O. Monaco Announces New Civil Cyber-Fraud Initiative, supra, note 1.
[7] United States Files Suit Against the Georgia Institute of Technology and Georgia Tech Research Corporation Alleging Cybersecurity Violations, Office of Public Affairs, U.S. Dep’t of Justice, available at https://www.justice.gov/opa/pr/united-states-files-suit-against-georgia-institute-technology-and-georgia-tech-research (last visited Feb. 27, 2025). This case was filed in July 2022 by our FCA co-counsel, Bracker & Marcus, LLC.
[8] Id.
[9] Id.
[10] Id.
[11] Id.
[12] Id.
[13] Id.
[14] The Pennsylvania State University Agrees to Pay $1.25M to Resolve False Claims Act Allegations Relating to Non-Compliance with Contractual Cybersecurity Requirements, Office of Public Affairs, U.S. Dep’t of Justice, available at https://www.justice.gov/opa/pr/pennsylvania-state-university-agrees-pay-125m-resolve-false-claims-act-allegations-relating (last visited Feb. 27, 2025). Bracker & Marcus also initiated this case.
[15] Id.
[16] Id.
[17] Id.
Photo by Joshua Koblin on Unsplash