On October 6, 2021, the Department of Justice opened up a new front in cybersecurity compliance when it announced a Civil Cyber-Fraud Initiative using the False Claims Act and other civil enforcement tools against government contractors and grant recipients.

This raises the specter not just of DOJ enforcement, but more numerous claims by private actors — specifically, whistleblowers or qui tam relators seeking a share of the government’s recovery. For example, in United States ex rel. Markus v. Aerojet Rocketdyne Holdings Inc., the relator — a former employee of the defendant — brought two claims of fraud under the False Claims Act. The relator alleged that the “defendants fraudulently entered into contracts with the federal government despite knowing that they did not meet the minimum [cybersecurity] standards required to be awarded a government contract.” The court declined to dismiss the False Claims Act claims, finding that the relator had “plausibly pled that defendants’ alleged failure to fully disclose its noncompliance [with relevant DOD and NASA regulations] was material to the government’s decision to enter into and pay on the relevant contracts.” And the potential costs in a case that might stem from the initiative are significant, as the False Claims Act also allows for triple damages.

Continue reading on CarltonFields.com »