Cybersecurity Violations Trigger $4.6 Million Penalty for Defense Contractor

Defense contracts are big business. Many companies depend on the funds from these agreements that enable our armed forces to meet their needs. However, these deals impose critical responsibilities on contractors. Perhaps, most importantly, companies that do business with branches of our armed forces must observe strict rules relating to cybersecurity, and attest that they have done so.

Despite clear requirements in this area, some businesses violate these provisions, potentially putting our military at risk. Recently, the Department of Justice announced a major settlement in a case involving false cybersecurity representations by a defense contractor. 

MORSE, a Massachusetts company, is paying $4.6 million to resolve allegations that it violated the False Claims Act in contracts with the Departments of the Army and Air Force between January 2018 and September 2022. According to the settlement, MORSE knew that it had not complied with the cybersecurity requirements outlined in the agreements, but acted as if it had. One example is that MORSE used a third-party company to host its emails but failed to ensure that the third party met the Federal Risk and Authorization Management Program (FedRAMP) Moderate baseline security requirements.

Under the system used by the Defense Department, security controls are measured on as scale that runs from -203 to 110. In its self-reporting, MORSE claimed that its score was 104. However, when a third-party cybersecurity consultant had conducted a review of the company, they assigned a score of -142. Some of the specific problems related to the reporting and damage assessment associated with cyber incidents. Other areas of concern involved malicious software handling, media preservation and access to information and equipment necessary for forensic analysis.

For businesses engaged in federal contracting, it is essential to understand and adhere to all cybersecurity requirements outlined in their agreements. Employees who learn about misrepresentations to the government might qualify as whistleblowers, potentially making them eligible to receive a portion of any recovery collected from the company committing fraud. 

Kardell Law Group represents whistleblowers in all types of cases involving violations of the False Claims Act. When you work with us, we’ll give you an honest assessment of your case and will advocate for appropriate payment if you are eligible.