Whistleblower programs that previously focused on
traditional concerns such as accounting and FCPA issues should now
consider expanding to incorporate company IT and information
security teams and account for data protection and
cybersecurity-related whistleblower complaints.
On July 31, 2019, Cisco Systems agreed to pay $8.6 million in
civil damages—including approximately $1.6 million to a
whistleblower—to resolve claims that it sold video
surveillance software that had significant security vulnerabilities
to local, state, and federal governments. The settlement is the
first payout on a False Claims Act ("FCA") case brought
over cybersecurity vulnerabilities.
According to the complaint, a subcontractor for Cisco in Denmark
alerted the company to the vulnerabilities in November 2008. When
the subcontractor discovered in June 2010 that Cisco had not
addressed the vulnerabilities, he notified the FBI. Cisco
acknowledged the vulnerabilities and released an updated
