Key Takeaways
- • The U.S. Department of Justice intervened in a whistleblower False Claims Act case against the Georgia Institute of Technology and Georgia Tech Research Corp. (GTRC), alleging the entities knowingly failed to meet contractual cybersecurity requirements on Department of Defense contracts.
- • DOJ's complaint-in-intervention is its first under the Civil Cyber-Fraud Initiative (CCFI), launched in October 2021, signaling that cybersecurity compliance failures can trigger False Claims Act treble damages and per-claim penalties.
- • The complaint alleges a lab failed to develop a required system security plan and to install or update antivirus software, and that Georgia Tech submitted a false summary score for a nonexistent "campus-wide" IT system.
- • Georgia Tech denies the allegations, stating that there was no breach of information and no data leaked.
- • The action follows DoD's amendment of the DFARS to incorporate proposed CMMC 2.0 requirements, which would require contractors to prove compliance through self-certification or third-party certification.
Summary
The Department of Justice has intervened in a whistleblower False Claims Act case against the Georgia Institute of Technology and Georgia Tech Research Corp. (GTRC), the non-profit contracting entity for Georgia Tech, according to a client alert from Dorsey & Whitney LLP authored by Alex Hontos and Seth Goertz. The complaint-in-intervention alleges that Georgia Tech knowingly failed to meet contractual cybersecurity requirements in performance of Department of Defense (DoD) contracts. The original whistleblower suit was filed months earlier by a current and a former member of Georgia Tech's cybersecurity compliance team.
According to the complaint, from as early as 2019 Georgia Tech allegedly engaged in what a former employee described as "no enforcement" of cybersecurity regulations, yielding to pressure from large-dollar grant researchers who viewed compliance as excessively burdensome. Specifically, a lab allegedly failed to develop or implement a required system security plan covering covered defense information and failed to install or update antivirus software on servers and computers holding non-public DoD information. The complaint further alleges Georgia Tech provided DoD with an inaccurate summary-level score for the lab's compliance, submitting a score for a "campus-wide" IT system that purportedly did not exist.
The primary cause of action is the False Claims Act, 31 U.S.C. tt3729-3733, rather than breach of contract or administrative sanction. The statute imposes liability for knowingly presenting false claims or making false records material to such claims, including significant per-claim penalties plus treble damages. A Georgia Tech spokesperson denied the allegations, stating, "in this case, there was no breach of information, and no data leaked."
This is DOJ's first complaint-in-intervention under the Civil Cyber-Fraud Initiative, launched in October 2021 under then-Deputy Attorney General Lisa Monaco, which aims to use the False Claims Act against cybersecurity fraud by government contractors and grant recipients. According to the client alert, DOJ's CCFI has reached multimillion-dollar settlements in several other cases over the past two years. The action also follows DoD's recently announced DFARS amendment incorporating contractual requirements tied to the proposed Cybersecurity Maturity Model Certification (CMMC) 2.0 program, which would apply to all DoD solicitations and require contractors to self-certify or obtain third-party certification before beginning work.
The authors advise research universities and government contractors to review compliance programs, evaluate subcontractor cybersecurity practices, document and audit protocols, ensure leadership understands personal exposure, verify the accuracy of government submissions, and conduct prompt investigations with timely voluntary self-disclosure where appropriate.
According to the complaint, from as early as 2019 Georgia Tech allegedly engaged in what a former employee described as "no enforcement" of cybersecurity regulations, yielding to pressure from large-dollar grant researchers who viewed compliance as excessively burdensome. Specifically, a lab allegedly failed to develop or implement a required system security plan covering covered defense information and failed to install or update antivirus software on servers and computers holding non-public DoD information. The complaint further alleges Georgia Tech provided DoD with an inaccurate summary-level score for the lab's compliance, submitting a score for a "campus-wide" IT system that purportedly did not exist.
The primary cause of action is the False Claims Act, 31 U.S.C. tt3729-3733, rather than breach of contract or administrative sanction. The statute imposes liability for knowingly presenting false claims or making false records material to such claims, including significant per-claim penalties plus treble damages. A Georgia Tech spokesperson denied the allegations, stating, "in this case, there was no breach of information, and no data leaked."
This is DOJ's first complaint-in-intervention under the Civil Cyber-Fraud Initiative, launched in October 2021 under then-Deputy Attorney General Lisa Monaco, which aims to use the False Claims Act against cybersecurity fraud by government contractors and grant recipients. According to the client alert, DOJ's CCFI has reached multimillion-dollar settlements in several other cases over the past two years. The action also follows DoD's recently announced DFARS amendment incorporating contractual requirements tied to the proposed Cybersecurity Maturity Model Certification (CMMC) 2.0 program, which would apply to all DoD solicitations and require contractors to self-certify or obtain third-party certification before beginning work.
The authors advise research universities and government contractors to review compliance programs, evaluate subcontractor cybersecurity practices, document and audit protocols, ensure leadership understands personal exposure, verify the accuracy of government submissions, and conduct prompt investigations with timely voluntary self-disclosure where appropriate.
Go deeper than the headline
Research every firm in this story, track the ones that matter and get the daily briefing — free for 7 days.