ILC Dover and ILC Astrospace Agree to Pay $13 Million to Resolve Cybersecurity False Claims Act Allegations

Summary

On November 3, 2026, the Department of Justice announced that ILC Dover LP and ILC Astrospace LLC, two affiliated defense and aerospace contractors in Frederica, Delaware, agreed to pay $13 million. The settlement resolves allegations that they billed the Army, Missile Defense Agency, and NASA despite knowing they had not complied with the cybersecurity requirements in their contracts and subcontracts.

The signed settlement agreement states that $6.5 million of the payment is restitution, that the covered conduct ran from January 1, 2018 through October 30, 2024, and that interest accrues at 4.375% per year from September 24, 2026 until payment. The case began as a sealed qui tam complaint filed in the U.S. District Court for the District of Delaware on January 17, 2025 by Philip Root, the companies’ former director of cybersecurity, who is to receive $2.35 million as his whistleblower share. Neither the press release nor the settlement agreement alleges that a breach occurred. The claims resolved by the settlement are allegations only, and there has been no determination of liability.

The striking point is not a reported cyberattack. It is what the government alleges happened beforehand: outside consultants identified missing controls, assessment problems went unresolved, and the companies kept seeking payment.

What the Government Alleged

The settlement identifies a NASA contract and subcontracts under prime contracts with the Army, Missile Defense Agency, and NASA. The government alleged that ILC submitted or caused the submission of false claims for payment because the companies knowingly failed to meet the cybersecurity requirements tied to those contracts.

The covered conduct breaks into five allegations:

1. Cloud storage without the required protections. From February 1, 2023 to October 30, 2024, an external cloud service provider was allegedly used to store engineering, manufacturing, and quality documentation, including covered defense information, without requiring and ensuring that the provider met security requirements equivalent to the FedRAMP Moderate baseline or complied with Department of Defense requirements for cyber incident reporting, malicious software, media preservation, forensic access, and damage assessment.
2. No system security plan. From January 1, 2018 to March 10, 2022, and again from September 1, 2022 to October 30, 2024, the companies allegedly did not develop, document, and periodically update a system security plan for each covered information system.
3. Controls never fully implemented. From January 1, 2018 to October 30, 2024, the companies allegedly had not fully implemented all controls in NIST Special Publications 800-171 and 800-53, including controls whose absence could allow significant exploitation of the network or exfiltration of controlled defense information.
4. No plans of action and milestones. From January 1, 2018 to May 13, 2019, and from January 1, 2022 to September 11, 2024, the companies allegedly had not developed and implemented plans of action and milestones to correct known deficiencies.
5. Missing or stale assessment scores. From November 30, 2020 to October 30, 2024, one entity allegedly posted no assessment at all to the Supplier Performance Risk System, and the other allegedly posted one that was not current, not based on a review of a system security plan, and not conducted under the DoD assessment methodology.

This is a recurring shape in government and defense contractor fraud cases: the product may be delivered and the program may run, but a condition of payment goes unmet and unreported.

The Two Assessments at the Center of the Case

The settlement agreement includes a telling detail that is not in the DOJ press release.

In November 2018 and again in September 2024, third-party cybersecurity consultants told the companies that assessments of their information systems had identified dozens of unimplemented NIST SP 800-171 controls. Under the DoD assessment methodology, those gaps would have produced scores of negative 59 and positive 21, if a system security plan had existed that allowed a score to be calculated at all. The scoring range runs from negative 203 at the low end to 110 at the high end.

The agreement states that ILC did not report those scores or the underlying vulnerabilities to the Department of Defense. The government also alleged that, from November 30, 2020 through October 30, 2024, ILC was ineligible to be considered for DoD contracts and subcontracts, yet the contract work and the invoicing continued.

The alleged disconnect between what the consultants found, what ILC reported, and what ILC billed is the heart of the case. A cybersecurity lapse does not automatically violate the False Claims Act; knowledge, the representations made, and materiality to the government’s payment decision all matter.

The Cybersecurity Requirements in the Contracts

The government’s theory starts with the actual contract clauses, not simply a general complaint about weak security. The issue is whether ILC knowingly sought payment despite noncompliance that was material under the False Claims Act.

Requirement	What it obligates	Source cited in the settlement
DFARS 252.204-7008 and 252.204-7012	Adequate security on covered contractor information systems, implementing NIST SP 800-171 no later than December 31, 2017	Defense Federal Acquisition Regulation Supplement
DFARS 252.204-7012(b)(2)(ii)(D)	Cloud providers holding covered defense information must meet FedRAMP Moderate equivalent security and comply with incident reporting and forensic access duties	Amendment effective October 21, 2016
DFARS 252.204-7019 and 252.204-7020	A current assessment, no more than three years old, posted to the Supplier Performance Risk System for each relevant covered system	Effective November 30, 2020
NFS 1852.204-76	NASA contractors and subcontractors must develop and maintain an IT security plan and protect NASA electronic information	NASA FAR Supplement
NIST SP 800-171 and SP 800-53	The control sets incorporated by the above, including control 3.12.4 on system security plans	NASA Procedural Requirements 2810.1, 2810.1F, and 2810.7

 

The assessment methodology depends on a system security plan. The agreement states the point plainly: without a plan describing how the security requirements are met, an assessment cannot be completed, and the absence of one is itself a finding of noncompliance.

What the Whistleblower Received

Philip Root was ILC’s former director of cybersecurity. That role is significant because the allegations concern records someone responsible for cybersecurity compliance could see: consultant assessment reports, the absence of a system security plan, and what was or was not posted to a federal scoring system.

The agreement sets out three separate payments connected to the whistleblower:

• $2.35 million as the relator’s share of the $13 million settlement, paid by the United States under 31 U.S.C. section 3730(d) once the government receives the settlement amount.
• $288,000 paid by the companies to the whistleblower’s counsel for reasonable expenses, attorneys’ fees, and costs.
• $180,000 paid by the companies in full satisfaction of the whistleblower’s claims that fell outside the covered conduct, expressly without any admission of liability.

The case also moved relatively quickly for a qui tam action. The complaint was filed on January 17, 2025 and the resolution was announced on November 3, 2026, just under 22 months later. Other qui tam investigations can take years longer, particularly while the complaint remains under seal. If you are thinking through sequence and timing, our overview of tips to filing a qui tam and the discussion of whistleblower retaliation protections cover the questions that tend to come first.

What Insiders Can Watch For

The government’s allegations point to several warning signs for employees who work with sensitive federal information.

• An assessment report from an outside consultant that lists unimplemented controls, followed by no visible change and no submission to the government.
• A score that is never calculated or never posted, or a posted score that is years old and does not match what the technical staff knows about the environment.
• No system security plan for a covered system, or a plan that exists as a stale file nobody updates while the environment changes around it.
• Covered defense information, engineering files, manufacturing records, or quality documentation moved into a commercial cloud tool without anyone confirming the provider meets the security baseline the contract requires.
• A list of known deficiencies that never becomes a plan of action with milestones and owners.
• Invoices and progress payments continuing on contracts whose clauses carry obligations the company internally knows are unmet.
• Pressure to treat cybersecurity clauses as paperwork, or an answer like “that is a prime contractor problem” when the subcontract carries the same flow-down terms.

None of these warning signs, standing alone, proves a False Claims Act violation. The legal analysis turns on what the contractor knew, what it represented to the government, whether any noncompliance was material, and whether it submitted claims for payment anyway.

Has This Happened Where You Work?

If you work in IT, cybersecurity, quality assurance, program management, or contracts for a federal contractor or subcontractor, consider these questions:

• Have you seen an assessment, internal or from a consultant, identify missing controls that were then left in place while the company kept billing?
• Have you been asked to sign, approve, or stay quiet about a self-assessment score you believed was wrong or could not be supported?
• Has sensitive government data been stored or shared through a tool that was never cleared against the security requirements in the contract?
• Did you raise any of this internally and watch it go nowhere, or hear that the issue would be handled later?
• Did your role, your access, or your standing change after you raised it?

Philip Root was an insider, not a competitor speculating about ILC’s practices from the outside. His cybersecurity position is important because the case turns on internal assessments and what the companies allegedly failed to report to the government.

The Broader Push to Enforce Cybersecurity Requirements

This settlement did not appear out of nowhere. The DOJ reported that False Claims Act settlements and judgments exceeded $6.8 billion in fiscal year 2025, the largest annual total in the statute’s history, and the Department reported settlements and judgments exceeding $5.3 billion in qui tam suits filed that year and earlier. Whistleblowers filed 1,297 new qui tam lawsuits that year, the highest number ever recorded in a single year.

Cybersecurity-related claims have become a more visible part of False Claims Act enforcement. The DOJ has reported recovering more than $52 million across nine cybersecurity-related False Claims Act settlements in fiscal year 2025 alone. At $13 million, this single resolution is a meaningful share of what the entire category produced in a record year.

The investigative footprint is also telling. The settlement was announced as a coordinated effort of the Civil Division’s Commercial Litigation Branch Fraud Section and the U.S. Attorney’s Office for the District of Delaware, with assistance from NASA’s Office of Inspector General, the Defense Criminal Investigative Service, Army CID, the Navy Criminal Investigative Service, the Air Force Office of Special Investigations, and the General Services Administration Office of Inspector General.

The settlement also makes clear what it does not resolve. The agreement expressly reserves criminal liability, the suspension and debarment rights of any federal agency, and any liability of individuals. A civil settlement by a company does not close the door on those paths.

Speak With a Defense Contractor Whistleblower Attorney

If you have seen similar conduct at a federal contractor or subcontractor, consider speaking confidentially with a whistleblower law firm before making disclosures that could affect your rights. Qui tam complaints generally must be filed under seal, and the first-to-file rule can make timing critical.

Sources and Legal Notes

The principal sources are the DOJ announcement and the signed settlement agreement. The DOJ’s fiscal year 2025 materials provide the broader enforcement statistics.

The settlement amount, the agency list, the five categories of covered conduct and their date ranges, the whistleblower share, the case number, and the filing date all come from the DOJ press release of November 3, 2026 and from the signed settlement agreement posted with it. The consultant assessment dates, the scores of negative 59 and positive 21, the scoring range of negative 203 to 110, the restitution figure, the interest rate, the attorneys’ fee payment, the separate payment for claims outside the covered conduct, and the reservation of criminal, debarment, and individual liability come from the settlement agreement itself.

The fiscal year 2025 recovery figures and qui tam filing counts come from the DOJ’s annual False Claims Act statistics announcement of January 16, 2026, and the cybersecurity figure of more than $52 million across nine settlements comes from the fact sheet issued with it.

Two limitations should be stated plainly. First, the comparison of this settlement to the overall size of cybersecurity-related False Claims Act recoveries reflects the figures the DOJ has reported publicly; the Department does not publish a ranked list of cyber-fraud settlements, so no claim is made here that this is the largest such resolution. Second, the settlement agreement states expressly that it is neither an admission of liability by the companies nor a concession by the United States that its claims are not well founded. The contested conduct described in this post remains alleged, not adjudicated.

Links

• DOJ press release, November 3, 2026
• Signed settlement agreement
• DOJ announcement of fiscal year 2025 False Claims Act settlements and judgments
• DOJ fact sheet, fiscal year 2025 False Claims Act settlements and judgments
• DOJ fiscal year 2025 False Claims Act statistics sheet
• DOJ press release, June 18, 2026 cybersecurity False Claims Act settlement with an Alabama defense contractor