Defense Contractors ILC Dover and ILC Astrospace Agree to $13 Million Settlement Over Cybersecurity Non-Compliance
To protect sensitive information from cyber threats, defense and aerospace contractors must comply with the cybersecurity requirements in their federal contracts and subcontracts,
said Assistant Attorney General Brett A. Shumate of the Justice Department’s Civil Division, as the federal government announced a settlement involving companies in Frederica, Delaware.
Defense and aerospace companies ILC Dover LP and ILC Astrospace LLC have agreed to pay $13 million to resolve allegations that they violated the False Claims Act. The companies failed to maintain mandatory cybersecurity standards in federal contracts spanning multiple agencies, including the Department of the Army, the Missile Defense Agency, and the National Aeronautics and Space Administration (NASA).
Details of the Alleged Cybersecurity Failures
The settlement resolves federal allegations that from January 2018 to October 2024, ILC Dover and ILC Astrospace submitted false or fraudulent payment claims while knowing they had bypassed required digital safeguards. Federal notices outline several distinct areas of non-compliance across nearly seven years of contract execution.
From February 2023 to October 2024, the companies allegedly used an outside third-party vendor to store controlled unclassified information in the cloud. Federal authorities state that ILC failed to ensure this third party met security benchmarks equivalent to the Federal Risk and Authorization Management Program (FedRAMP) Moderate baseline. The cloud storage arrangement allegedly lacked required Department of Defense protocols for incident reporting, malicious software handling, media preservation, forensic access, and damage assessment.
Investigators also found that between January 2018 and March 2022—and again from September 2022 to October 2024—the entities did not properly develop, document, or periodically update system security plans for covered information systems. These plans are contractually mandated to map system boundaries, operational environments, and network connections.
Contractors Omitted Key Cybersecurity Controls Required by NIST
Federal oversight revealed that the contractors allegedly omitted key cybersecurity controls detailed in National Institute of Standards and Technology (NIST) Special Publications 800-171 and 800-53 throughout the entire January 2018 to October 2024 window. Officials noted that leaving these specific controls unimplemented left networks vulnerable to significant exploitation and the exfiltration of controlled defense information.
Additional gaps included failing to formulate and implement plans of action and milestones designed to correct system vulnerabilities during specific stretches from 2018 to 2019 and 2022 to 2024. ILC Astrospace allegedly did not submit current assessments of its NIST SP 800-171 controls to the Department of Defense after November 2020, while ILC Dover failed to provide a current assessment based on a formal system security plan review.
Whistleblower Provisions of False Claims Act Spark Investigation
The investigation drew resources from multiple military and civilian oversight bodies. U.S. Attorney Benjamin L. Wallace for the District of Delaware emphasized that the rules exist to protect technical innovation from bad actors.
The obligations that ILC violated exist to prevent bad actors from taking advantage of the United States’ technical innovation. My office is committed to ensuring that cybersecurity requirements in contracts are honored and that America’s leadership in aerospace is protected.
U.S. Attorney Benjamin
The legal action originated under the whistleblower provisions of the False Claims Act, which allow private citizens to file lawsuits on behalf of the government and share in any financial recovery. Philip Root, ILC’s former Director of Cybersecurity, filed the initial qui tam lawsuit under the caption United States ex rel. Root v. ILC Dover LP, et al., No. 25-cv-70 (D. Del.). Under the terms of the settlement, Root is slated to receive a $2.35 million share of the $13 million recovery.
The settlement agreement explicitly notes that the resolved claims are allegations only, and no formal determination of liability has been made.
