DOJ, Georgia Tech affiliate company settle over alleged failure to meet DOD contract cyber requirements

The company agreed to pay $875,000, with neither side conceding to the other as part of resolving the suit.

A company affiliated with the Georgia Institute of Technology agreed to pay $875,000 to the U.S. government to settle a case involving allegations that it knowingly failed to meet cybersecurity requirements for obtaining Pentagon contracts, the Justice Department announced Tuesday.

Two Georgia Tech whistleblowers who worked on the university’s cybersecurity team first filed suit in 2022 under the False Claims Act, a Civil War-era law aimed at combatting shady contractors. The Justice Department joined the suit two years later on behalf of the Defense Department, Air Force and Defense Advanced Research Projects Agency.

The settlement resolves the suit against Georgia Tech and Georgia Tech Research Corporation over allegations that they failed to install antivirus tools at Georgia Tech’s Astrolavos Lab while it conducted sensitive cyber-defense research for the Pentagon. The Justice Department also had said that Georgia Tech and the affiliate company submitted a false cybersecurity assessment score to the Defense Department.

“When contractors fail to follow the required cybersecurity standards in their DoD contracts, they leave sensitive government information vulnerable to malicious actors and cyber threats,” said Brett Shumate, assistant attorney general of the Justice Department’s Civil Division.

Under the settlement agreement, neither side concedes to the other over the allegations.

“From the outset, Georgia Tech denied the government’s allegations that mischaracterized our commitment to cybersecurity,” said a spokesperson for the university, Blair Meeks. “We worked hard to educate the government about the strong compliance efforts of our researchers and are pleased to avoid the distraction of litigation by resolving this matter without any admission of liability. Georgia Tech looks forward to continued collaboration with the Department of Defense and other federal partners in conducting ground-breaking research in a secure manner.”

The two sides first reached a tentative settlement agreement in May. The government will pay the two whistleblowers, Kyle Koza and Christopher Craig, $201,250 out of the settlement.
The Justice Department began using the False Claims Act in 2022 to punish contractors over cybersecurity shortcomings under its Civil Cyber-Fraud Initiative. It has since settled with a number of parties in those cases, including for $9 million with Aerojet Rocketdyne, $8.4 million with Raytheon and Nightwing, $4.6 million with MORSECORP and $4 million with Verizon Business Network Services.

Government

• FBI officials say AI is bolstering adversaries, emphasizing need to focus on cyber basics, patching

• Feds accuse China of ‘systematic’ distillation of U.S. AI models

• CIA’s Michael Ellis says cyber intelligence is changing how the agency operates

• The G7 tells industry to hurry up and prep for post-quantum encryption

Technology

• European parliament members call for slowdown of Serbia’s EU entry over spyware use

• FCC proposes public scorecard to rate telecoms on anti-robocall efforts

• Pegasus, NoviSpy variant spyware found on devices of Serbian activists

• Wyden seeks upgraded NSA security guidance on commercial VPN use

Threats

• Microsoft discloses two actively exploited zero-days among 974 vulnerabilities

• Russian national extradited to US for alleged involvement in bank-account takeover scheme

• Attackers exploit zero-days in consistently besieged SonicWall product

• Jail time for Maine child in 764 marks turning point in federal law enforcement

Policy

• Whistleblower says USPS deploying new, ‘untested’ IT systems governing mail-in ballots

• ‘Watershed 250’ test program in Texas looks to private sector for water cybersecurity help

• Former sexual abuse victims say Grok used their images, videos to train deepfake capabilities

• Cyber threats nudge Trump to sign executive order on foreign equipment in U.S. energy infrastructure