ILC Dover LP and ILC Astrospace LLC, both based in Frederica, Delaware, agreed to pay $13 million to resolve allegations that they failed to meet cybersecurity requirements on Army, Missile Defense Agency and NASA contracts, the Justice Department announced on Nov. 3. The release says the claims are allegations and no court determined liability.
The ILC Dover settlement covers conduct the government alleges began in January 2018 and ran through October 2024, nearly seven years in which the companies kept billing the government on contracts that carried security terms. The suit came under the False Claims Act, which lets a private citizen sue on the government’s behalf.
What the Justice Department Alleges
The government alleges the companies stored controlled unclassified information with a third-party cloud provider that lacked equivalence to the FedRAMP Moderate standard, from February 2023 through October 2024. It also alleges they lacked or failed to update system security plans, did not fully implement controls from the National Institute of Standards and Technology’s SP 800-171 and 800-53 publications, and did not keep plans of action and milestones. The release adds that the companies did not submit a current NIST SP 800-171 assessment to the Defense Department from November 2020 through October 2024. That span of nearly four years is the longest single gap in the list.
How the Whistleblower Case Worked
A former ILC Dover director of cybersecurity, Philip Root, filed the suit under the False Claims Act’s whistleblower provision. The case is United States ex rel. Root v. ILC Dover LP, No. 25-cv-70, in the U.S. District Court for the District of Delaware. Root receives $2.35 million, which is 18.1% of the settlement, a calculation from the two figures. The government keeps the remaining $10.65 million.
What Officials Said
U.S. Attorney Benjamin L. Wallace of the District of Delaware said the best response to cyberattacks is to prevent them from happening in the first place. Robert Steinau, the assistant inspector general for investigations at the NASA Office of Inspector General, called strict compliance with federal cybersecurity standards “non-negotiable” for any company doing business with the agency.
Brett A. Shumate, the assistant attorney general for the Civil Division, said defense and aerospace contractors must comply with the requirements that protect sensitive information from cyber threats. Jessica Herrington, the acting special agent in charge of the Defense Criminal Investigative Service’s Northeast field office, said cybersecurity lapses place critical defense information at risk.
