ILC Dover 与 ILC Astrospace 付1300万美元和解网络安全欺诈指控
美国司法部（DOJ）11月3日宣布，总部位于特拉华州 Frederica 的国防与航天企业 ILC Dover LP 与 ILC Astrospace LLC 已同意支付1300万美元，和解针对两家公司的《虚假申报法》指控。司法部指，两家公司在与陆军部、导弹防御局以及国家航空航天局（NASA）的合同中，未能遵守合同约定的网络安全要求。
司法部民事司助理司法部长 Brett A. Shumate 说：「为防范网络威胁、保护敏感信息，国防与航天承包商必须遵守其联邦合同与分包合同中的网络安全要求。我们将继续追究那些未能履行网络安全承诺的政府承包商与分包商。」
和解所涉指控称，2018年1月至2024年10月间，ILC 向上述机构提交了虚假或欺诈性的付款申请，因为公司在明知未达标的情况下仍申领合同款。指控包括：2023年2月至2024年10月间，ILC 使用第三方公司在云端存储受控非密信息，却未要求并确保该第三方的安防水平达到联邦风险与授权管理计划（FedRAMP）中等基线同等要求，也未满足战争部在网络事件报告、恶意软件处置等方面的规定。
指控还称，ILC 在2018年1月至2022年3月、2022年9月至2024年10月等时段内，未按战争部与 NASA 合同要求为其各套受覆盖信息系统制定、记录并定期更新系统安全计划；2018年1月至2024年10月间未全面落实国家标准与技术研究院（NIST）SP 800-171 与 SP 800-53 的全部网络安全控制项；也未按要求制定并执行用于纠正缺陷的行动计划与里程碑。此外，ILC Astrospace 被指在2020年11月至2024年10月间从未向战争部提交现行的 NIST SP 800-171 落实情况评估，ILC Dover 提交的评估也被指不符合要求。
特拉华区联邦检察官 Benjamin L. Wallace 说：「应对网络攻击的最佳办法是防患于未然。ILC 违反的这些义务，正是为了防止不法分子利用美国的技术创新牟利。」战争部监察长办公室国防刑事调查局（DCIS）、陆军刑事调查局（Army CID）与 NASA 监察长办公室的调查人员也在公告中表示，将继续追究未履行合同网络安全义务的企业。
这起和解源于《虚假申报法》的吹哨人条款诉讼：私方可代表政府起诉提交虚假申请者，并分享追回款项。本案吹哨人是 ILC 前网络安全总监 Philip Root，他将分得235万美元和解金。案件名称为 United States ex rel. Root v. ILC Dover LP, et al.，编号 25-cv-70，在特拉华区联邦法院审理。
案件由司法部民事司商业诉讼处欺诈科与特拉华区联邦检察官办公室协调办理，NASA 监察长办公室、国防刑事调查局、陆军刑事调查局东北外地办公室、海军刑事调查局、空军特别调查办公室与总务管理局监察长办公室提供协助。司法部强调，和解所涉内容仅为指控，尚无任何责任认定。
ILC Dover and ILC Astrospace to Pay $13 Million to Settle Cybersecurity Fraud Allegations
The U.S. Department of Justice (DOJ) announced on November 3 that ILC Dover LP and ILC Astrospace LLC, defense and aerospace companies based in Frederica, Delaware, have agreed to pay $13 million to resolve allegations that they violated the False Claims Act by failing to comply with cybersecurity requirements in their contracts with the Department of the Army, the Missile Defense Agency, and the National Aeronautics and Space Administration (NASA).
"To protect sensitive information from cyber threats, defense and aerospace contractors must comply with the cybersecurity requirements in their federal contracts and subcontracts," said Assistant Attorney General Brett A. Shumate of the Justice Department's Civil Division. "We will continue our efforts to hold accountable government contractors and subcontractors that fail to meet their cybersecurity commitments."
The settlement resolves allegations that from January 2018 to October 2024, ILC submitted false or fraudulent claims for payment on contracts with the Army, the Missile Defense Agency, and NASA, knowing it had not complied with those contracts' cybersecurity requirements. Among the allegations: from February 2023 to October 2024, ILC used a third-party company to store controlled unclassified information in the cloud without requiring and ensuring that the third party met security requirements equivalent to the Federal Risk and Authorization Management Program (FedRAMP) Moderate baseline and complied with Department of War requirements for cyber incident reporting and related matters.
The government also alleged that ILC did not develop, document, and periodically update system security plans for each of its covered information systems as required; did not fully implement all cybersecurity controls in National Institute of Standards and Technology (NIST) Special Publications 800-171 and 800-53; did not develop and implement plans of action and milestones to correct deficiencies; and that, from November 2020 to October 2024, ILC Astrospace had not submitted any current assessment of its implementation of NIST SP 800-171 controls, while ILC Dover's submitted assessment was allegedly not current or properly based.
"The best response to cyberattacks is to prevent them from happening in the first place," said U.S. Attorney Benjamin L. Wallace for the District of Delaware. "The obligations that ILC violated exist to prevent bad actors from taking advantage of the United States' technical innovation." Investigators from the Department of Defense Office of Inspector General's Defense Criminal Investigative Service (DCIS), the Army Criminal Investigation Division, and the NASA Office of Inspector General also commented in the announcement.
The settlement resolves a lawsuit filed under the whistleblower provisions of the False Claims Act, which permit private parties to sue on behalf of the government and receive a share of any recovery. The whistleblower, Philip Root, ILC's former Director of Cybersecurity, will receive a $2.35 million share of the settlement. The case is captioned United States ex rel. Root v. ILC Dover LP, et al., No. 25-cv-70 (D. Del.).
The matter was handled by the Civil Division's Commercial Litigation Branch, Fraud Section, and the U.S. Attorney's Office for the District of Delaware, with assistance from NASA OIG, DCIS, Army CID's Northeast Field Office, the Naval Criminal Investigative Service, the Air Force Office of Special Investigations, and the General Services Administration Office of Inspector General. The claims resolved by the settlement are allegations only, and there has been no determination of liability.
来源：美国司法部
发布：GSM·美国（发布链接）
图片来源：图：美国司法部本部大楼（GSM 四级固定图库）。 / Photo: U.S. Department of Justice headquarters building (GSM fixed asset library).
GSM Global · 本篇英文版 English edition of this story
