Five Years of the Civil Cyber-Fraud Initiative: Sixteen Settlements, Ten Whistleblower Suits and No Judgment

The 2021 Announcement

On October 6, 2021, Deputy Attorney General Lisa Monaco announced the Civil Cyber-Fraud Initiative, to be led by the Civil Division's Commercial Litigation Branch, Fraud Section. The release said the initiative "will utilize the False Claims Act to pursue cybersecurity related fraud by government contractors and grant recipients," and named three kinds of conduct: "knowingly providing deficient cybersecurity products or services, knowingly misrepresenting their cybersecurity practices or protocols, or knowingly violating obligations to monitor and report cybersecurity incidents and breaches."

It was not a new statute, regulation or unit. The same release describes it as a product of a departmental cyber review ordered that May, drawing on existing expertise in "civil fraud enforcement, government procurement and cybersecurity." The legal footing is the False Claims Act, and the initiative's reach is therefore limited to what that statute reaches: requests for federal money.

The False Claims Act Theory

31 U.S.C. § 3729(a)(1) makes liable any person who "knowingly presents, or causes to be presented, a false or fraudulent claim for payment or approval," or who knowingly makes or uses a false record or statement material to one. Liability is three times the government's damages plus a per-claim civil penalty, adjusted for inflation from a statutory base of $5,000 to $10,000. A defendant that reports within 30 days and cooperates fully may have damages reduced to double under § 3729(a)(2).

Two definitions do the work in the cyber cases. "Knowingly" in § 3729(b)(1) covers actual knowledge, deliberate ignorance and reckless disregard, and requires "no proof of specific intent to defraud." A "claim" in § 3729(b)(2) includes a request to a contractor or grantee where the United States provides or reimburses any portion of the money. That second definition is why state-administered programs funded with federal dollars appear in the record: a Florida children's insurance website paid with Medicaid funds, Pennsylvania contact tracing paid with CDC funds, and New York's federally funded rental assistance portal.

The pattern in the releases is an invoice, or a certification or assessment score submitted to win or keep a contract, that is alleged to be false because a contractual security requirement was not being met.

Qui Tam Relators

Section 3730(b) lets a private person sue "for the person and for the United States Government." The complaint is filed under seal for at least 60 days while the government decides whether to intervene. Under § 3730(d)(1) a relator whose case the government takes over receives 15 to 25 per cent of the proceeds; under § 3730(d)(2), where the government does not proceed, 25 to 30 per cent. Section 3730(h) protects employees who are retaliated against.

Ten of the sixteen releases charted below describe a qui tam action. The relators named in them are mostly insiders: a former Aerojet employee, a former Insight Global contact tracing staff member, an entity owned by a former Guidehouse employee, the former chief information officer of Penn State's Applied Research Laboratory, a former Raytheon director of engineering, a former Illumina platform management director, two members of Georgia Tech's cybersecurity team, and a former Honeywell employee. The Aerojet relator "filed and litigated" the case himself and settled on the second day of trial; his $2.61 million share of $9 million is 29 per cent, above the 25 per cent ceiling § 3730(d)(1) sets where the government takes over a case and within the § 3730(d)(2) range where it does not.

The Settlement Record

The table lists each resolved matter this publication found in a DOJ release, fetched on September 21, 2026. It records what each release alleges, not what was proved.

The sixteen amounts total $69,099,872, before ASRC's waived reimbursement. The Comprehensive Health Services figure covers drug-approval allegations as well as the records failure, and the release does not split it. DOJ called that matter its "first resolution of a False Claims Act case involving cyber fraud since the launch" of the initiative.

Most releases from 2022 through October 2024 name the initiative in a closing paragraph. From February 2025 the releases fetched for this account generally do not use the phrase, though the Georgia Tech release is headed "Civil Cyber-Fraud Litigation," and the Department's FY2025 False Claims Act fact sheet reports under "Cybersecurity Fraud" that it "recovered over $52 million in nine cybersecurity fraud settlements" that fiscal year. This publication located eight settlements dated within fiscal year 2025, from ASRC in October 2024 to Georgia Tech in September 2025, totaling about $38.2 million. At least one FY2025 matter is missing from the table, and the count above is the count found, not a census.

Contract Clauses the Settlements Cite

The defense cases converge on one clause. DFARS 252.204-7012 requires "adequate security" on covered contractor information systems and, for systems not operated on the government's behalf, the security requirements of NIST SP 800-171, implemented "not later than December 31, 2017." It defines rapid incident reporting as within 72 hours of discovery. The Raytheon release names the clause alongside FAR 52.204-21, which it describes as requiring "basic safeguarding requirements" for systems that process or store federal contract information.

The self-assessment score is the recurring false statement. The MORSECORP, Georgia Tech, Penn State and LOGZONE releases each turn on a summary assessment score reported to DoD; the MORSECORP and LOGZONE releases give the scale as -203 to 110. MORSECORP reported 104 and, according to the facts it admitted, did not correct it for eleven months after a consultant put the real figure at -142, and then only three months after a subpoena. Georgia Tech's 98 was alleged to rest on a "fictitious" or "virtual" environment. The Georgia Tech release adds that the NIST SP 800-171 obligation has applied to DoD contracts "since 2017" and "will continue" under the Cybersecurity Maturity Model Certification program.

The civilian and grant-funded cases cite different requirements. Jelly Bean's contract required a hosting environment meeting HIPAA protections. Verizon's service had to satisfy Trusted Internet Connections controls. Guidehouse's contract required pre-production security testing. ASRC's required protection of Medicare beneficiary data that its subcontractor's disk-level encryption did not provide against credentialed access. Illumina, alone in the record, is a product case: the allegation is that the government bought sequencers whose software was represented as meeting ISO and NIST standards.

What the Record Does Not Show

No matter in the table reached a judgment. Each release states, in some form, that the claims resolved "are allegations only" and that "there has been no determination of liability." Admissions appear in two: Guidehouse and Nan McKay admitted that neither completed the required testing, and MORSECORP admitted a set of facts about its controls and its score. The only case taken to trial, Aerojet, settled on its second day.

The third branch of the 2021 announcement, knowing violations of duties to monitor and report incidents, has no settlement in the table built primarily on it. MORSECORP's admitted facts include a cloud email host that did not meet DoD incident reporting requirements, but the matters that followed an actual breach (Jelly Bean, Guidehouse and ASRC) were resolved on the security failure that preceded it, not on a late or missing report.

Cooperation credit is visible but not quantified. Verizon and Aero Turbine are described as receiving credit for self-disclosure, cooperation and remediation, and ASRC for prompt notice and cooperation. None of the releases states how much the credit reduced the amount. Finally, the table is built only from announced resolutions. Investigations closed without action, declined qui tam suits and sealed complaints do not appear in DOJ releases and are not counted here.

Frequently Asked Questions