Tips for Whistleblowers Who Identify Cybersecurity Violations

Companies and governments devote billions of dollars to cybersecurity, but major breaches still occur. To protect personal and confidential information, government contractors often must declare that have taken appropriate measures to guard against digital misappropriation. This can be an expensive and complex task however, and there are situations where businesses are unable or unwilling to install the necessary precautions. 

Cybersecurity failures can be treated as fraud against the government. The Department of Justice is actively pursuing these matters under its Civil Cyber-Fraud Initiative, using the False Claims Act (FCA) to investigate and resolve cases where companies misrepresented their cybersecurity practices or concealed reportable incidents. Though you might believe that only an expert in the field can detect when something is wrong, this is not the case. Even an employee without a technical background can become a cybersecurity whistleblower in one of the following ways:   

  • Recognizing certification fraud — A contract negotiator or project manager might see that a specific certification is required to show that systems are safe against digital breaches. If there is no evidence of the company qualifying for the requested certification, it could trigger a False Claims Act case.

  • Reporting excessive charges — Cybersecurity is highly complex and often requires customization for the particular systems and threats. Pinpointing the exact value of these services can be tricky, which could tempt dishonest contractors to overcharge for the measures they install. Similarly, charging for “compliant hosting,” MFA, encryption or 24/7 monitoring that is not actually implemented constitutes fraud. 

  • Flagging unreported breaches — Compliance with cybersecurity provisions includes prompt, complete reports of any breaches that occur. When an employee is aware of a problem after which the government was not notified, they can act as a whistleblower. 

The False Claims Act’s qui tam provisions allow insiders to file a legal action under seal on the government’s behalf. If the case is successful, the whistleblower can obtain a share of the government’s financial recovery, usually between 15 and 30 percent. You can be confident about coming forward to report misconduct because the FCA’s anti-retaliation provision protects employees (and certain contractors/agents) from discharge, demotion or harassment in response to lawful efforts to stop fraud.

At Kardell Law Group, we are accomplished attorneys who have secured substantial compensation for whistleblowers in various forms of qui tam litigation. If you know of contractor misconduct related to cybersecurity or another type of fraud against the government, reach out to us today.