We Knew This Day Would Come: FCA Claim Based On Inadequate Cybersecurity Survives Dismissal Motion On Materiality Grounds

Whether the Department of Defense's (DoD) cybersecurity rules might prompt False Claims Act (FCA) liability has been a concern and debated issue ever since they were first rolled out in 2013 (modified substantially in 2015). By now, most defense contractors are subject to the latest requirements, which require both cyber incident reporting and "adequate security" compliant with NIST SP 800-171 standards (absent other specific contract instructions or contexts). It seemed inevitable that failing to live up to the government's cybersecurity standards would lead not only to contract disputes or national security concerns, but also FCA litigation. The wait is over.

In United States ex rel. Markus v. Aerojet Rocketdyne Holdings, Inc., No. 15-cv-2245, 2019 WL 2024595 (E.D. Ca. May 8, 2019), a relator—the company's former senior director of Cyber Security, Compliance, and Controls—has alleged that Aerojet Rocketdyne (Aerojet) impliedly, but falsely, certified to the