Defense Industry
Software Provider and DOJ Reach $8.6M Settlement for FCA Case Involving Alleged Cyber Security Shortcomings
Amid increased public and government attention to cyber security, a qui tam plaintiff’s lawsuit has resulted a large settlement for a government contractors’ purported misrepresentations regarding compliance with government cyber security standards. In what is believed to be the first-of-its-kind settlement of an FCA claim premised upon cyber security misrepresentations, Cisco Systems recently agreed to pay $8.6 million to the federal and state governments. The case, United States of America v. Cisco Systems, involved allegations from a former-subcontractor whistleblower that Cisco Systems knowingly sold video monitoring technology containing security flaws to the United States, eighteen states, and the District of Columbia. See Complaint, Case No. 11-cv-400 (W.D.N.Y. May 5, 2011). According to the whistleblower, the security flaws to the video monitoring technology created a backdoor to the system, enabling a potential user to gain unauthorized access to the entire network of a federal agency, take control of or bypass an agency’s physical security systems, or even allow an unauthorized user to obtain administrative access to the system to make modifications. Id. Notwithstanding its awareness of the security flaws, and knowing that the disclosure of the security flaws would have prevented the federal government from purchasing the video monitoring technology, the Relator alleged that Cisco Systems withheld information regarding the security flaws from multiple federal and state agencies to which it sold the video monitoring technology. Id. On July 31, 2019, the federal government, fifteen states, and the District of Columbia settled the claims against Cisco Systems. Pursuant to that agreement, Cisco Systems will pay $2.6 million to the federal government to resolve the FCA claims and approximately $6 million to state governments to resolve similar state law fraud-in-contracting claims. Cisco framed the settlement as a “partial refund” to the governments involved, and did not explicitly admit liability. The company acknowledged that “times and expectations have changed.” The settlement may be a harbinger of more cyber security claims to come. Information security has become an increasingly prominent component of all government contracts, extending well beyond contracts in the information technology space. Government contractors will therefore be increasingly required to abide by the security standards imposed by the Federal Information Security Management Act and related regulations when selling products to the government. The recent seven-figure settlement emphasizes the government’s interest in pursuing FCA actions premised upon cyber security shortcomings, and serves as a reminder to government contractors to be mindful of their cyber security compliance obligations.
August 20, 2019
by Jack Huerter
Defense Industry
Supreme Court Considers Whether to Extend FCA Statute of Limitation
On Tuesday, March 19, the Supreme Court considered whether to extend the FCA’s alternate 10-year statute of limitations to cases in which the government does not intervene. The case, Cochise Consultancy Inc. v. United States, ex rel. Hunt, involves a whistleblower’s qui tam action alleging that two defense contractors defrauded the government. The case centers on the FCA’s two statutes of limitations. One allows lawsuits to be filed within six years of the alleged fraud. 31 U.S.C. § 3731(b)(1). The other allows lawsuits to be filed three years after the federal government knows of facts “material to the right of action,” but never more than 10 years after the alleged fraud. 31 U.S.C. § 3731(b)(2). In Cochise, the relator filed his complaint in 2013, more than six after the alleged fraud, which took place in 2006 and 2007. The relator argued that his complaint was timely under the 10-year limitations period of § 3731(b)(2) because he filed it within three years after the FBI learned of the fraud in 2010. It was undisputed that if the government had intervened, the 10-year limitations period would have applied. At issue was whether that period can apply in cases where, as in Cochise, the government does not intervene. The Fourth and Tenth Circuits had previously ruled that it could not, but the Eleventh Circuit created a split when it ruled—in the decision on appeal in Cochise, and as previously reported by this blog here—that that period could apply to cases in which the government is not a party. At Tuesday’s argument, defense contractors’ counsel argued that extending the 10-year limitations period would result in increased claims, impose higher evidentiary burdens, and allow relators to “wait in the weeds” while developing their cases. But relator’s counsel argued that, in practice, relators have a strong incentive to file as soon as possible, because otherwise the potential plaintiff risks their claim being dismissed under the “first to file bar,” which is intended to avoid duplicative FCA litigation by prohibiting subsequent FCA actions based upon the same essential facts as a previously filed qui tam action. The Solicitor General’s Office also argued the relator’s position was consistent with the FCA’s purpose because “the majority of any recovery would go to the United States” even where the government does not intervene. Although it is difficult to predict the Court’s decision based on oral argument, it seems at least possible that the Court will extend the FCA’s 10-year statute of limitations to cases where the government does not intervene. That result would likely increase risk and costs for defendants facing FCA claims.
March 22, 2019
by Alan J. Iverson
