Johnson Controls与两家子公司付500万美元和解联邦指控：被指联邦合同网络安全要求多年未达标
美国司法部佐治亚州北区联邦检察官办公室11月13日宣布，总部位于 Milwaukee 的暖通设备供应商 Johnson Controls, Inc. 与旗下两家子公司同意支付500万美元，和解联邦政府对其违反《虚假申报法》（False Claims Act）的指控，涉及它们在联邦合同中未落实网络安全要求。两家子公司是 Johnson Controls Fire Protection LP 与 Johnson Controls Security Solutions LLC。
司法部称，2018年1月至2025年8月间，Johnson Controls 与两家子公司同美国航天局 NASA 以及国防部、能源部、司法部签订合同与分包合同，为建筑产品与服务提供支持，合同要求它们落实安全控制措施、保护政府信息。
指控称，Johnson Controls 对自身信息系统掌握不足、管控不足，未能充分控制对受保护信息的访问；部分政府合同要求的系统安全计划（System Security Plan）未达到要求；用于纠正缺陷、减少或消除信息系统漏洞的行动与里程碑计划，也没有得到充分记录、完整制定或完整实施。
这项和解了结了两宗依据《虚假申报法》提起的吹哨人（qui tam）诉讼，起诉人是 Johnson Controls 的前雇员 Kelly Vance 与 David Thomas。按和解安排，Vance 将分得85万美元。两案分别是北佐治亚州联邦地区法院的 United States ex rel. Kelly Vance v. Johnson Controls, Inc. 与哥伦比亚特区联邦地区法院的 United States ex rel. David Thomas v. Johnson Controls Int'l PLC。
佐治亚州北区联邦检察官 Theodore S. Hertzberg 表示，网络安全要求对政府至关重要，他的办公室将大力追究不遵守这些要求的承包商，尤其是违规持续多年、无谓地让国家暴露于恶意攻击与利用的情形。司法部民事司助理司法部长 Jonathan Guynn 表示，联邦承包商必须遵守规定的网络安全标准、保护敏感政府信息，司法部将继续与执法伙伴合作，确保联邦机构与纳税人得到他们付费购买的东西。
此案由佐治亚州北区与哥伦比亚特区两地联邦检察官办公室、司法部民事司商业诉讼处，以及国防刑事调查局、海军刑事调查局、空军特别调查办公室、NASA 监察长办公室、能源部监察长办公室、司法部监察长办公室与总务管理局监察长办公室协同办理。经办检察官为助理联邦检察官 Adam Nugent、司法部出庭律师 Jennifer Cook 与哥伦比亚特区助理联邦检察官 Sean Tepe。
（来源：美国司法部）
Johnson Controls and Two Subsidiaries to Pay $5 Million to Settle Federal Cybersecurity Fraud Allegations
The U.S. Attorney's Office for the Northern District of Georgia announced on November 13 that Johnson Controls, Inc., a Milwaukee-based heating, ventilation, and air conditioning supplier, and two subsidiaries have agreed to pay $5 million to resolve allegations that they violated the False Claims Act by failing to comply with cybersecurity requirements in their federal contracts and subcontracts for building products and services. The two subsidiaries are Johnson Controls Fire Protection LP and Johnson Controls Security Solutions LLC.
According to the Justice Department, from January 2018 to August 2025, Johnson Controls and the two subsidiaries entered into contracts and subcontracts with NASA and the Departments of Defense, Energy, and Justice that required the companies to implement security controls to protect government information.
The government alleged that Johnson Controls failed to control access to protected information due to insufficient knowledge of, and insufficient control over, its information systems. It also allegedly failed to maintain a System Security Plan that met requirements for certain government contracts, and failed to adequately document, fully develop, or fully implement a plan of action and milestones to correct deficiencies and reduce or eliminate vulnerabilities in its information systems.
The settlement resolves two qui tam whistleblower lawsuits filed under the False Claims Act by former Johnson Controls employees Kelly Vance and David Thomas. The settlement provides for Vance to receive an $850,000 share. The cases are United States ex rel. Kelly Vance v. Johnson Controls, Inc. in the Northern District of Georgia and United States ex rel. David Thomas v. Johnson Controls Int'l PLC in the District of Columbia.
"Cybersecurity requirements are of the utmost importance to the government," said U.S. Attorney Theodore S. Hertzberg. "My office will vigorously pursue contractors who fail to follow these requirements, particularly when those failures persist over several years, needlessly exposing our nation to malevolent attacks and exploitation by bad actors." Assistant Attorney General Jonathan Guynn of the Justice Department's Civil Division said federal contractors must follow required cybersecurity standards to safeguard sensitive government information.
The resolution was the result of a coordinated effort between the U.S. Attorney's Offices for the Northern District of Georgia and the District of Columbia; the Justice Department Civil Division, Commercial Litigation Branch; Defense Criminal Investigative Service; NCIS; Air Force Office of Special Investigations; NASA OIG; Department of Energy OIG; the Department of Justice OIG; and GSA OIG. The matter was handled by Assistant U.S. Attorney Adam Nugent, Trial Attorney Jennifer Cook, and Assistant U.S. Attorney Sean Tepe for the District of Columbia.
(Source: U.S. Department of Justice)
来源：美国司法部
发布：GSM·美国（发布链接）
图片来源：图：美国司法部本部大楼入口石墙特写，刻有 DEPARTMENT OF JUSTICE 字样（固定图库联邦核心包）。G. Edward Johnson 摄，CC BY 4.0，经 Wikimedia Commons。 / Photo: Entrance wall of the U.S. Department of Justice headquarters engraved with DEPARTMENT OF JUSTICE (fixed federal-core asset-pack image). Photo by G. Edward Johnson, CC BY 4.0, via Wikimedia Commons.
GSM Global · 本篇英文版 English edition of this story
