Skip to main content
Top Button
Ice Miller Cybersecurity Law Snapshot: Settlement in Cybersecurity-Related False Claims Act Case, Eu Ice Miller Cybersecurity Law Snapshot: Settlement in Cybersecurity-Related False Claims Act Case, Eu

Ice Miller Cybersecurity Law Snapshot: Settlement in Cybersecurity-Related False Claims Act Case, Europe Releases Hardened Directives, and CISA Warns of Looming Cyberattacks

Aerojet Offers Insight into the Financial and Legal Risks of Cybersecurity in DFARS

On April 26, Aerojet Rocketdyne settled the first-of-its-kind cybersecurity-focused False Claims Act (FCA) case for $9 million dollars, in addition to other undisclosed payments. As we mentioned in a previous Cybersecurity Law Snapshot, United States ex rel. Markus v. Aerojet Rocketdyne Holdings, Inc. involved the cybersecurity requirements outlined in the Defense Federal Acquisition Regulations Supplement (DFARS). Aerojet stood accused of misrepresenting its compliance with the DFARS § 252.204-7012 cybersecurity requirements through allegedly false claims and insufficiently partial disclosure of compliance shortfalls. This case was the first instance in which a court found that a failure to comply with cybersecurity regulations could serve as the basis for an FCA suit.

While the settlement cut short a full-fledged holding on this particular case, the Department of Justice (DOJ) has already hinted that this will be the first in a new string of FCA crackdowns. Accordingly, there are a few critical takeaways, particularly from the DOJ’s statement of interest, that clients involved in government contracts should remain mindful of:

·       Non-compliance with the cybersecurity requirements can be considered a material cause for the government to enter into a contract;

  • Partial disclosure of non-compliance will likely be insufficient;
  • Identifying industry compliance problems does not excuse misrepresentations or partial disclosure; and
  • The government’s existing knowledge of non-compliance will not excuse misrepresentations.

Companies that contract or are contemplating contracting with the federal government should review the cybersecurity disclosures, maintain thorough documentation of their compliance, and consider whether any contracting procedures should be updated.

Europe: The Cyber-Regulator that Keeps on Giving

Earlier this month, the European Parliament announced that they had reached a provisional agreement on new cybersecurity regulations for public and private entities in the European union. The new directives, called NIS2, are designed to expand the existing rules on network and information system security to cover medium and large entities across an even wider array of industry sectors. While we are still awaiting whether the agreement carries any revisions from the original NIS2 publication, we are likely to see a range of new cybersecurity requirements for covered entities. Currently, NIS2 is likely to impact an organization’s cybersecurity policies in the following areas: business continuity and crisis management, incident handling, testing and auditing, encryption, and standardization of network and information systems specifications. Additionally, the directives are poised to introduce new reporting requirements, including a requirement to report certain cybersecurity incidents within 24 hours of being made aware of the incident.

CISA Advisories to Managed Service Providers and Block Chain Companies

Over the past few weeks, the Cybersecurity and Infrastructure Security Agency (CISA) has issued cyber awareness warnings regarding cyberattacks against managed service providers (MSPs) and blockchain companies. CISA, alongside the cybersecurity authorities in the United Kingdom, Australia, Canada, and New Zealand, warns MSPs that malicious actors engaging in an array of exploits aimed at vulnerable devices and internet services compromise their provider-customer network. Similarly, CISA warns that North Korean cyber actors are deploying a wide array of tactics to target vulnerabilities in blockchain technology to acquire cryptocurrency and intellectual property, as well as otherwise target financial assets.

To safeguard against these attacks, CISA encourages companies to take the following steps:

  • Identify and disable network accounts that are no longer in use;
  • Train employees on social engineering and phishing;
  • Enforce application security and utilize file verification software and procedures;
  • Implement and enforce multifactor authentication;
  • Apply the principle of least privilege through your system; and
  • Perform an incidence response and recovery exercise.

Connect with Ice Miller Cybersecurity Attorneys

Ice Miller has extensive experience assisting companies to navigate and comply with federal cybersecurity laws and regulations, as well as taking advantage of cybersecurity-related procurement opportunities. Our team includes Guillermo Christensen, managing partner of the firm’s Washington, D.C. office and former CIA officer with national security experience in the intelligence community and internationally with the U.S. Department of State; Christian Robertson, a former U.S. Air Force intelligence officer who regularly advises clients on federal procurement cybersecurity laws and regulations; Angad Chopra, a Certified Privacy Professional and associate in Ice Miller’s Data, Security, and Privacy Group; and Dakota Coates, an associate in Ice Miller’s Litigation and Data, Security, and Privacy Groups.

This publication is intended for general information purposes only and does not and is not intended to constitute legal advice. The reader should consult with legal counsel to determine how laws or decisions discussed herein apply to the reader's specific circumstances.

View Full Site View Mobile Optimized