Photo: Shutterstock

With a tsunami of False Claims Act whistleblower cases looming on the horizon, companies that contract with the federal government should assess their cybersecurity measures if they want to avoid being swept up in the litigation. 

What’s pushing the wave? Over the past several years, the government has begun to hold contractors and their subcontractors to heightened cybersecurity standards in an effort to better protect federal data and respond quickly to breaches.

Now, litigation connected to the beefed-up cybersecurity rules and False Claims Act liability is bubbling to the surface. 

In May, the U.S. District Court for the Eastern District of California sent ripples through the False Claims Act community when it refused to dismiss a case in which a whistleblower alleged that his former employer, Aerojet Rocketdyne Holdings Inc., falsely asserted that it was complying with the Department of Defense’s cybersecurity standards. 

The ruling made it clear for the first time that “qui tam relators who allege that a contractor didn’t comply with cybersecurity requirements have a viable case against a contractor,” said Andrew Mohr, a partner at Morris, Manning & Martin in Washington, D.C., who has more than three decades of government contracts practice experience. 

“This simply hadn’t been said before,” Mohr added. “These regulations are relatively new and it takes a while for these cases to percolate. I’ve been expecting them, but this was the first evidence I’ve seen in print that it’s happening.”

➤➤ Cannabis law is going mainstream. To find out what it all means for your practice, check out a new special report on cannabis and the legal industry, and sign up for Higher Law, Law.com’s exclusive weekly newsletter that tracks cannabis practices and the latest regulatory developments.

The second indication of the coming wave of qui tam litigation occurred in late July, when it was announced that Cisco Systems Inc. had agreed to pay $8.6 million to settle a whistleblower suit alleging it ran afoul of federal cybersecurity standards by selling the government video surveillance products with known vulnerabilities that hackers could exploit. 

“We can expect more of these” types of cases, Mohr noted. “This is going to be a target. Other relators are going to start looking at their company’s cybersecurity compliance.”

Firms that want to avoid qui tam whistleblower litigation should first determine whether they contract with the government—this might seem obvious, but Mohr said “you’d be amazed how many times large cap companies don’t even realize what their subsidiaries are doing.” 

The next step is taking a close look at the company’s cybersecurity practices, and not just once or twice a year, said Tom McSorley, a senior associate at Arnold & Porter Kaye Scholer in Washington, D.C., where he specializes in data security, privacy and government contracts. 

“What you really need to do is demonstrate and document on an ongoing basis that you are assessing your compliance and updating your system security plan. It’s a living activity,” he added. “One place where folks can get into more risks is in viewing this as a static effort.” 

McSorley noted that the Department of Defense is in the process of offering companies a way to receive certification from third parties for cybersecurity compliance. But at the moment, most firms are depending on self-compliance. 

“Unfortunately in that environment individuals within a company can have a different perspective on whether what the contractor views as compliance is actually compliant. That’s what happened in the Aerojet case,” McSorley said.

And he expects that the disconnect in cybersecurity compliance perspectives will be at the heart of much of the coming False Claims Act whistleblower litigation.

“There’s a lot of room to have to litigate whether the company’s view is consistent with the rule,” he said. “A lot of these standards are not ‘yes’ or ‘no.’ They’re questions that can be debated.”