Defense contractor pays $9m to settle whistleblower's cybersecurity allegations
(2022/07/11)
- Reference: 1657563533
- News link: https://www.theregister.co.uk/2022/07/11/aerojet_cybersecurity_whistleblower/
- Source link:
Aerojet Rocketdyne, which makes propulsion and power systems for launch vehicles, missiles and satellites for NASA and the US military, has agreed to pay $9 million to settle charges it misrepresented its products' compliance with cybersecurity requirements in federal government contracts.
The El Segundo, California-based company has a deep history in American space and military contracting, including on long-term development efforts such as a [1]hypersonic cruise missile design, recently tested by DARPA and manufactured by Aerojet Rocketdyne and Lockheed Martin.
The settlement stems from a five-year-old whistleblower lawsuit brought by former Aerojet employee Brian Markus. Federal district judge William Shubb last week approved
[4]
In his 2017 complaint, Markus alleged the company's computer systems failed to meet minimum cybersecurity standards that the federal government requires for contracts funded by NASA and the Department of Defense.
[5]
[6]
Almost immediately upon being hired, Markus found Aerojet was understaffed and underbudgeted to meet federal cybersecurity rules, according to his lawsuit's complaint
Markus alleged he was promised a budget of $10 million to $15 million to improve the corporation's IT security, along with an internal staff of five to 10 employees and an external staff of up to 25 contractors. Instead, Markus claimed he received a $3.8 million budget, two internal staffers and seven contractors.
[8]
Additionally, Aerojet's computer systems didn't comply with federal regulations, and when asked about cybersecurity, the defense firm "gave the government misleading information," the lawsuit alleged. Here's an excerpt from the 2017 complaint:
For example, they were asked if they had a certain piece of security equipment, they would say 'yes' even though the equipment was sitting in a bog and not connected to their computer system. Defendants represented they had cybersecurity software/hardware installed to protect the systems when in reality the software/hardware in question only covered part of the environment, leaving defendants vulnerable to a cyberattack. In some cases, they claimed compliance only considering the primacy control and not the sub-controls, which were clearly not being met.
Aerojet hired outside consulting firm Emagined in 2014 to determine [9]DFARS compliance , and according to the lawsuit that audit found the defense contractor was "less than 25 percent compliant." The consultancy's report also found it would cost more than $34.5 million over a five-year period to bring Aerojet's computer systems' into compliance, the court documents allege.
Markus claimed he then prepared a report for the company's board of directors, which showed the IT systems were "unpatched, misconfigured, outdated and thus vulnerable to a cyberattack." When the company's president Warren Boley got wind of the presentation, Boley allegedly changed it so the board wouldn't know that Aerojet's computers didn't comply with federal laws.
A year later, in April 2015, Ernst & Young assessed Aerojet's vulnerability to cyberattacks, according to the lawsuit.
"Within four hours the EY team was able to utilize vulnerabilities in defendants' computer systems to fully compromise the windows network and retrieve all defendants' user accounts and passwords," the lawsuit alleged. "Information accessed included the CEO and CFO's inbox and network files that included board strategy documents and merger and acquisition files and technical documents. Employee personal information was accessed including social security numbers and salary."
[10]
The EY team also accessed legal documents along with rocket design blueprints and other unclassified technical information, and remotely compromised the security cameras so they could view and listen to Aerojet's security camera footage, according to the court papers.
[11]DARPA says US hypersonic missile is ready for real world
[12]DARPA says US hypersonic missile is ready for real world
[13]US military contractor moves to buy Israeli spy-tech company NSO Group
[14]Info on 1.5m people stolen from US bank in cyberattack
Markus claimed that in July 2015, Aerojet COO Mark Tucker and CIO Jose Ruiz asked him to sign documents stating the defense contractor's computer systems complied with federal rules. He refused, and said two months later he was fired.
In canned [15]statements about the settlement, US attorneys applauded Markus' actions.
Aerojet Rocketdyne (2021 net income: $142.8 million) did not respond to The Register 's request for comment.
"Whistleblowers with inside information and technical expertise can provide crucial assistance in identifying knowing cybersecurity failures and misconduct," said Principal Deputy Assistant Attorney General Brian M. Boynton, head of the Justice Department's Civil Division. ®
Get our [16]Tech Resources
[1] https://www.theregister.com/2022/04/06/darpa_hypersonic_missile/
[2] https://regmedia.co.uk/2022/07/11/court_order_approving_aerojet_settlement.pdf
[3] https://www.justice.gov/civil/report-fraud
[4] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/cso&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=2&c=2YsydjD3ztl12NTtWxhsL-wAAABU&t=ct%3Dns%26unitnum%3D2%26raptor%3Dcondor%26pos%3Dtop%26test%3D0
[5] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/cso&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=4&c=44YsydjD3ztl12NTtWxhsL-wAAABU&t=ct%3Dns%26unitnum%3D4%26raptor%3Dfalcon%26pos%3Dmid%26test%3D0
[6] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/cso&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=3&c=33YsydjD3ztl12NTtWxhsL-wAAABU&t=ct%3Dns%26unitnum%3D3%26raptor%3Deagle%26pos%3Dmid%26test%3D0
[7] https://regmedia.co.uk/2022/07/11/lawsuit_against_aerojet.pdf
[8] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/cso&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=4&c=44YsydjD3ztl12NTtWxhsL-wAAABU&t=ct%3Dns%26unitnum%3D4%26raptor%3Dfalcon%26pos%3Dmid%26test%3D0
[9] https://www.federalregister.gov/documents/2020/09/29/2020-21123/defense-federal-acquisition-regulation-supplement-assessing-contractor-implementation-of
[10] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/cso&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=3&c=33YsydjD3ztl12NTtWxhsL-wAAABU&t=ct%3Dns%26unitnum%3D3%26raptor%3Deagle%26pos%3Dmid%26test%3D0
[11] https://www.theregister.com/2022/04/06/darpa_hypersonic_missile/
[12] https://www.theregister.com/2022/04/06/darpa_hypersonic_missile/
[13] https://www.theregister.com/2022/07/11/l3harris_nso_group/
[14] https://www.theregister.com/2022/06/21/flagstar_bank_breached_ssn/
[15] https://www.justice.gov/opa/pr/aerojet-rocketdyne-agrees-pay-9-million-resolve-false-claims-act-allegations-cybersecurity
[16] https://whitepapers.theregister.com/
The El Segundo, California-based company has a deep history in American space and military contracting, including on long-term development efforts such as a [1]hypersonic cruise missile design, recently tested by DARPA and manufactured by Aerojet Rocketdyne and Lockheed Martin.
The settlement stems from a five-year-old whistleblower lawsuit brought by former Aerojet employee Brian Markus. Federal district judge William Shubb last week approved
[2]PDF
the out-of-court deal struck by the biz and Markus, who joined the defense contractor in 2014 as senior director of cybersecurity, compliance, and controls. He is set to receive a $2.61 million share of the [3]False Claims Act recovery.[4]
In his 2017 complaint, Markus alleged the company's computer systems failed to meet minimum cybersecurity standards that the federal government requires for contracts funded by NASA and the Department of Defense.
[5]
[6]
Almost immediately upon being hired, Markus found Aerojet was understaffed and underbudgeted to meet federal cybersecurity rules, according to his lawsuit's complaint
[7]PDF
.Markus alleged he was promised a budget of $10 million to $15 million to improve the corporation's IT security, along with an internal staff of five to 10 employees and an external staff of up to 25 contractors. Instead, Markus claimed he received a $3.8 million budget, two internal staffers and seven contractors.
[8]
Additionally, Aerojet's computer systems didn't comply with federal regulations, and when asked about cybersecurity, the defense firm "gave the government misleading information," the lawsuit alleged. Here's an excerpt from the 2017 complaint:
For example, they were asked if they had a certain piece of security equipment, they would say 'yes' even though the equipment was sitting in a bog and not connected to their computer system. Defendants represented they had cybersecurity software/hardware installed to protect the systems when in reality the software/hardware in question only covered part of the environment, leaving defendants vulnerable to a cyberattack. In some cases, they claimed compliance only considering the primacy control and not the sub-controls, which were clearly not being met.
Aerojet hired outside consulting firm Emagined in 2014 to determine [9]DFARS compliance , and according to the lawsuit that audit found the defense contractor was "less than 25 percent compliant." The consultancy's report also found it would cost more than $34.5 million over a five-year period to bring Aerojet's computer systems' into compliance, the court documents allege.
Markus claimed he then prepared a report for the company's board of directors, which showed the IT systems were "unpatched, misconfigured, outdated and thus vulnerable to a cyberattack." When the company's president Warren Boley got wind of the presentation, Boley allegedly changed it so the board wouldn't know that Aerojet's computers didn't comply with federal laws.
A year later, in April 2015, Ernst & Young assessed Aerojet's vulnerability to cyberattacks, according to the lawsuit.
"Within four hours the EY team was able to utilize vulnerabilities in defendants' computer systems to fully compromise the windows network and retrieve all defendants' user accounts and passwords," the lawsuit alleged. "Information accessed included the CEO and CFO's inbox and network files that included board strategy documents and merger and acquisition files and technical documents. Employee personal information was accessed including social security numbers and salary."
[10]
The EY team also accessed legal documents along with rocket design blueprints and other unclassified technical information, and remotely compromised the security cameras so they could view and listen to Aerojet's security camera footage, according to the court papers.
[11]DARPA says US hypersonic missile is ready for real world
[12]DARPA says US hypersonic missile is ready for real world
[13]US military contractor moves to buy Israeli spy-tech company NSO Group
[14]Info on 1.5m people stolen from US bank in cyberattack
Markus claimed that in July 2015, Aerojet COO Mark Tucker and CIO Jose Ruiz asked him to sign documents stating the defense contractor's computer systems complied with federal rules. He refused, and said two months later he was fired.
In canned [15]statements about the settlement, US attorneys applauded Markus' actions.
Aerojet Rocketdyne (2021 net income: $142.8 million) did not respond to The Register 's request for comment.
"Whistleblowers with inside information and technical expertise can provide crucial assistance in identifying knowing cybersecurity failures and misconduct," said Principal Deputy Assistant Attorney General Brian M. Boynton, head of the Justice Department's Civil Division. ®
Get our [16]Tech Resources
[1] https://www.theregister.com/2022/04/06/darpa_hypersonic_missile/
[2] https://regmedia.co.uk/2022/07/11/court_order_approving_aerojet_settlement.pdf
[3] https://www.justice.gov/civil/report-fraud
[4] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/cso&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=2&c=2YsydjD3ztl12NTtWxhsL-wAAABU&t=ct%3Dns%26unitnum%3D2%26raptor%3Dcondor%26pos%3Dtop%26test%3D0
[5] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/cso&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=4&c=44YsydjD3ztl12NTtWxhsL-wAAABU&t=ct%3Dns%26unitnum%3D4%26raptor%3Dfalcon%26pos%3Dmid%26test%3D0
[6] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/cso&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=3&c=33YsydjD3ztl12NTtWxhsL-wAAABU&t=ct%3Dns%26unitnum%3D3%26raptor%3Deagle%26pos%3Dmid%26test%3D0
[7] https://regmedia.co.uk/2022/07/11/lawsuit_against_aerojet.pdf
[8] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/cso&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=4&c=44YsydjD3ztl12NTtWxhsL-wAAABU&t=ct%3Dns%26unitnum%3D4%26raptor%3Dfalcon%26pos%3Dmid%26test%3D0
[9] https://www.federalregister.gov/documents/2020/09/29/2020-21123/defense-federal-acquisition-regulation-supplement-assessing-contractor-implementation-of
[10] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/cso&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=3&c=33YsydjD3ztl12NTtWxhsL-wAAABU&t=ct%3Dns%26unitnum%3D3%26raptor%3Deagle%26pos%3Dmid%26test%3D0
[11] https://www.theregister.com/2022/04/06/darpa_hypersonic_missile/
[12] https://www.theregister.com/2022/04/06/darpa_hypersonic_missile/
[13] https://www.theregister.com/2022/07/11/l3harris_nso_group/
[14] https://www.theregister.com/2022/06/21/flagstar_bank_breached_ssn/
[15] https://www.justice.gov/opa/pr/aerojet-rocketdyne-agrees-pay-9-million-resolve-false-claims-act-allegations-cybersecurity
[16] https://whitepapers.theregister.com/
Re: Security
Anonymous Coward
No wonder China builds better Aerojet Rocketdyne products than Aerojet Rocketdyne does.
All your Aerojet Rocketdyne are belong to us.
Interesting
Anonymous Coward
Are there similar rewards for whistleblowers in the EU or the UK?
Asking for a friend :D
So apart from this…
Anonymous Coward
> "Within four hours the EY team was able to utilize vulnerabilities in defendants' computer systems to fully compromise the windows network and retrieve all defendants' user accounts and passwords," the lawsuit alleged. "Information accessed included the CEO and CFO's inbox and network files that included board strategy documents and merger and acquisition files and technical documents. Employee personal information was accessed including social security numbers and salary."
…was their security OK?
The truly unfortunate thing
HildyJ
This will have zero effect on Aerojet Rocketdyne or its contracts.
There will certainly be no attempt to void any contracts or even to claw back any money for the fraud.
Security
This really is depressing reading. I've had my arguments, sorry, discussions, with management concerning compliance with security regulations. You know the sort of thing - the government says we must do this, we are telling the government we are doing it, so we really ought to be doing it or someone is going to have a problem when they find out. Sounds like the management simply was not interested in compliance, just wanted NASA's and the DoD's money. After all, usually Security is the IT Security minion's responsibility isn't it, and spending money on security does so reduce teh profitability of the company and slow down the system with those naughty internet firewalls.
This is why I retired. Will horses would not drag me back.