Defense and Aerospace Contractors ILC Dover and ILC Astrospace Agree to Pay $13M to Resolve Cybersecurity Fraud Allegations

Defense and aerospace companies ILC Dover LP and ILC Astrospace LLC, of Frederica, Delaware, have agreed to pay $13 million to resolve allegations that they violated the False Claims Act by failing to comply with cybersecurity requirements in their contracts with the Department of the Army, the Missile Defense Agency, and the National Aeronautics and Space Administration (NASA).

"To protect sensitive information from cyber threats, defense and aerospace contractors must comply with the cybersecurity requirements in their federal contracts and subcontracts," said Assistant Attorney General Brett A. Shumate of the Justice Department's Civil Division. "We will continue our efforts to hold accountable government contractors and subcontractors that fail to meet their cybersecurity commitments."

Today's settlement resolves allegations that from January 2018 to October 2024, ILC Dover and ILC Astrospace (collectively, ILC) submitted false or fraudulent claims for payment on contracts with the Army, Missile Defense Agency, and NASA, and that those claims were false or fraudulent because ILC knew it had not complied with those contracts' cybersecurity requirements. The settlement resolves allegations that:

• From February 2023 to October 2024, ILC allegedly used a third-party company to store controlled unclassified information in the cloud without requiring and ensuring that the third party met security requirements equivalent to the Federal Risk and Authorization Management Program (FedRAMP) Moderate baseline and complied with Department of Defense (DoD) requirements for cyber incident reporting, malicious software, media preservation and protection, access to additional information and equipment necessary for forensic analysis, and cyber incident damage assessment.
• From January 2018 to March 2022, and from September 2022 to October 2024, ILC allegedly did not develop, document, and periodically update a system security plan for each of its covered information systems, as required by DoD and NASA contracts, describing system boundaries, system environments of operation, how security requirements are implemented, and the relationships with or connections to other systems.
• From January 2018 to October 2024, ILC allegedly had not fully implemented all cybersecurity controls in National Institute of Standards and Technology (NIST) Special Publications (SP) 800-171 and 800-53, including controls that, if not implemented, could lead to significant exploitation of the network or exfiltration of controlled defense information and controls that, if not implemented, could have a specific and confined effect on the security of the network and its data.
• From January 2018 to May 2019, and from January 2022 to September 2024, ILC allegedly had not developed and implemented plans of action and milestones designed to correct deficiencies and reduce or eliminate vulnerabilities in ILC's systems.
• From November 2020 to October 2024, ILC Astrospace allegedly had not submitted to DoD any current assessment of its implementation of NIST SP 800-171 cybersecurity controls, and ILC Dover allegedly had not submitted an assessment that was current, based on the entity's review of a system security plan associated with covered contractor information systems, and conducted in accordance with the NIST SP 800-171 DoD Assessment Methodology.

"The best response to cyberattacks is to prevent them from happening in the first place," said U.S. Attorney Benjamin L. Wallace for the District of Delaware. "The obligations that ILC violated exist to prevent bad actors from taking advantage of the United States' technical innovation. My office is committed to ensuring that cybersecurity requirements in contracts are honored and that America's leadership in aerospace is protected."

"Cybersecurity lapses place critical defense information at risk," said Acting Special Agent in Charge Jessica Herrington of the Department of Defense Office of Inspector General, Defense Criminal Investigative Service (DCIS), Northeast Field Office. "DCIS remains committed to ensuring that companies entrusted with sensitive data fully meet the security obligations outlined in their federal contracts. This settlement reflects our continued efforts to safeguard the Department of Defense's information and hold contractors accountable when they fail to uphold required cybersecurity standards."

"This case should send a clear message to anyone conducting business with the Department of the Army: If you engage in fraudulent or illegal activity, the Department of the Army Criminal Investigation Division (CID) will vigorously pursue those responsible and work tirelessly to bring them to justice," said Special Agent in Charge Joel Kirch, of Army CID's Northeast Field Office.

"Strict compliance with federal cybersecurity standards is non-negotiable for any company doing business with NASA," said Robert Steinau, Assistant Inspector General for Investigations at the NASA Office of Inspector General. "Those who jeopardize America's space program by ignoring government protocols will incur steep financial penalties. We are grateful to whistleblowers who do right by reporting these wrongs."

The settlement resolves a lawsuit filed under the whistleblower provisions of the False Claims Act, which permit private parties to sue on behalf of the government when they believe that a defendant has submitted false claims for government funds and receive a share of any recovery. The settlement in this case provides for the whistleblower, Philip Root, ILC's former Director of Cybersecurity, to receive a $2.35 million share of the settlement amount. The qui tam case is captioned United States ex rel. Root v. ILC Dover LP, et al., No. 25-cv-70 (D. Del.).

This year the Administration launched the Task Force to Eliminate Fraud and the National Fraud Enforcement Division to enhance the Administration's war on fraud, waste, and abuse in federal programs. When unscrupulous actors exploit these programs for their own financial gain, they defraud the government, harm the people these programs are designed to aid and protect, and undermine American businesses that play by the rules. The Civil Division's FCA enforcement plays a critical role in combatting such fraudulent schemes, recovering billions of dollars for the American taxpayers, and holding wrongdoers accountable. FCA matters will continue to be on the forefront of the battle against fraud, and the Civil Division's FCA work will support and advance the mission of the Task Force to Eliminate Fraud and the National Fraud Enforcement Division.

The settlement announced today was the result of a coordinated effort between the Civil Division's Commercial Litigation Branch, Fraud Section and the U.S. Attorney's Office for the District of Delaware, with assistance from NASA OIG, the Defense Criminal Investigative Service, Army CID's Northeast Field Office, the Navy Criminal Investigative Service, the Air Force Office of Special Investigations, and the General Services Administration Office of Inspector General.

The matter was handled by Assistant Director Christopher Terranova in the Civil Division's Commercial Litigation Branch (Fraud Section) and Assistant U.S. Attorneys Dylan Steinberg and Jacob Laksin in the U.S. Attorney's Office for the District of Delaware.

The claims resolved by the settlement are allegations only and there has been no determination of liability.