ILC Dover to pay $13 million in largest cyber False Claims Act settlement

Two defense and aerospace contractors will pay $13 million to settle allegations they knowingly misrepresented cybersecurity compliance in Army, Missile Defense Agency and NASA contracts. The Justice Department announced the settlement with ILC Dover LP and ILC Astrospace LLC on Tuesday. The department said the agreement is the largest False Claims Act (a federal law penalizing fraudulent claims for government payment) cybersecurity settlement to date.

The settlement resolves allegations, not proven claims. "There has been no determination of liability," the Justice Department said in a statement.

What did the contractors allegedly fail to do?

The government alleges ILC submitted false and fraudulent claims for payment while failing to meet contractual cybersecurity requirements mandated by the Army, the Missile Defense Agency and NASA from January 2018 to October 2024. The alleged failures span nearly seven years of federal work.

According to the Justice Department, the alleged deficiencies include:

• Storing controlled-unclassified information (sensitive but unclassified federal data) with an external cloud service provider without ensuring the provider met Federal Risk and Authorization Management Program Moderate baseline requirements, the government's cloud security standard, or complied with the Defense Federal Acquisition Regulation Supplement, the cyber clause set governing DoD contracts.
• Incomplete implementation of cybersecurity controls under National Institute of Standards and Technology Special Publications 800-171 and 800-53, the control catalogs required for federal and defense information systems.
• Failure to develop, implement and update system security plans for each covered information system, as required by Defense Department and NASA contracts.
• Failure to develop and implement plans of action and milestones (POA&Ms), the documents used to identify and mitigate cybersecurity weaknesses.

The control-implementation allegations carry weight beyond paperwork. The government cited controls that, if not implemented, "could lead to significant exploitation of the network or exfiltration of controlled defense information and controls that, if not implemented, could have a specific and confined effect on the security of the network and its data."

The settlement focuses on the potential security risks the alleged deficiencies created, not on any confirmed breach.

Who raised the allegations?

A whistleblower started the case. Philip Root, ILC's former Director of Cybersecurity, filed a lawsuit under the False Claims Act raising similar allegations. Root will receive a $2.35 million share of the settlement amount. ILC will also pay Root's attorney $288,000 to cover expenses and fees.

The case landed with the U.S. Attorney's Office for the District of Delaware. U.S. Attorney Benjamin Wallace framed the settlement in preventive terms. "The best response to cyberattacks is to prevent them from happening in the first place," Wallace said in a statement. "The obligations that ILC violated exist to prevent bad actors from taking advantage of the United States' technical innovation."

Why does this matter for contractors?

The settlement sets a marker for procurement-related cyber enforcement. It ties False Claims Act exposure directly to DFARS clause compliance, NIST SP 800-171 and 800-53 control implementation, FedRAMP verification for cloud providers handling controlled-unclassified information, and the administrative artifacts — system security plans and POA&Ms — that prove the controls exist.

For CIOs and security leaders at federal contractors, the case shows regulators will treat unimplemented controls and missing documentation as claim-fraud exposure, not merely audit findings. The alleged conduct persisted from January 2018 to October 2024, a period in which the Pentagon progressively tightened enforcement of DFARS 252.204-7012 and its assessment regime.

The whistleblower's role also matters. The former cybersecurity director inside the company initiated the litigation, and his $2.35 million award plus $288,000 in legal fees signals the incentive structure facing internal security staff with knowledge of compliance gaps. The Justice Department did not announce any related actions against other parties.