Cybersecurity liability doesn’t necessarily start with a breach

Terry Gerton We are gonna talk about something that’s come up several times lately, the DOJ’s increasing use of the False Claim Act to enforce a variety of behaviors. Here particularly, they recently settled a case with Honeywell Aerospace to resolve allegations that they violated the False Clams Act by failing to meet cybersecurity requirements in their defense contract. What does this case tell us about what DOJ is really policing here in the cyber fraud investigations?

Michael Volkov Well, this is a really important case and it’s an important reminder. And A lot of people have, I think, come to the misnomer that this administration is not aggressively enforcing certain laws, and there’s one law in particular that they are enforcing more aggressively than any administration prior to this date, and that’s the False Claims Act. And they’re using it, and I’ll talk a little bit about it, they’re using it in a variety of ways to aggressively further their agenda and their policies that they want to sort of enforce. Where it came here with the Honeywell case, Honeywell Aerospace, is really interesting because it’s a very significant precedent. They’ve done it before, but this is a case which I think sends a real signal to every defense contractor with regard to your cybersecurity protocol program and making sure you meet certain government requirements. And in particular, and let me go through a little bit of the particulars on the case and I hate to talk so long, but Honeywell agreed to pay over $2 million but for one of its networks, only one, handling DoD information did not meet certain NIST requirements during the time period from April 2020 to December 2023. Now, what’s interesting here? One, there was no breach. There was no breach whatsoever. There was not a security lapse. There was was not discovered by all of a sudden there’s a earth shattering breach of protocol. What happened is an insider whistleblower reported to the government and gets a financial reward for pointing out that they are not meeting certain requirements that they have certified to — Honeywell certified in a signed document to the government that they were meeting these standards. So this is what’s called a False Claims Act case. There was a Qui Tam, and I hate to use that phrase, Q-U-I T-A-M, which is an employee who is a whistleblower and receives up to a reward of one-third of the settlement amount. So what happened is this whistleblower filed the case under seal, under protection. And then the government investigated it and verified it. Now, that is a big deal. One of many of their networks did not meet the certification requirement. All their other networks did. So, to me, this is a real warning to everybody right now when you’re certifying as to certain cybersecurity requirements, and I’ll go through a couple more in a minute, that you make sure you’re accurate, you’re doing it, and you’re meeting the requirement. Because lying to the government is a false claim. And that can result in up to 2 million to more in terms of penalties. So that’s a long-winded answer. But it is something that, and I can go into a couple of other areas where the government is going after companies, but this is to me is a very, very significant and worthy of a show in my view, Terry, because of the precedent and the fact that they went against a big player, Honeywell Aerospace.

Terry Gerton Michael Volkov is CEO of the Volkov Law Group. Well, let’s talk about this for a minute because this gets directly to the CMMC certification requirements that DoD has, and they’ve been sort of on again, off again. Companies say, well, do we need to certify? Do we not? This seems to really get to the core argument we’ve heard many times, which is regardless of where the CMMC program is, companies still have to comply with the NIST standards and they have to certifying that.

Michael Volkov And Terry, thank you for using that acronym, which I had to look up a long time ago, but you obviously are familiar with it. And frankly, in July, I think of this year, the CMMC self-assessment process was delayed for at least 60 days and a review. And you said it perfectly. I don’t need to promote this idea, terry, you just need to be on the air reminding people, which is what you said, that the standards still apply. So in other words, your DFAR standards, your annual, so let me go through a couple, your SPRS score, however you self-assess yourself, better be accurate. And if you’ve got a gap in one of your 10 areas, you better disclose it and say, here’s my plan for working on this. Because if your score is inaccurate, that’s a false certification unto itself. And a whistleblower could report you. And then your company could be, and you don’t wanna pay a lot of lawyers like me, okay? You do not wanna pay lawyers. You don’t want to have to defend yourself in this situation. I’m sure Honeywell spent millions of dollars in legal expenses to get just a $2 million result. Now, CMMC, there still are affirmative statements that you’re making in your cybersecurity representations that have to be accurate, and be accurate in the sense of disclose remediation projects where you’re meeting an element still, disclose it and be fair on what your timeline is. Because if you win a contract because it turns out that you had a false SPRS score, then your contract is tainted and all of a you’re subject to liability. I know this sounds ridiculous. I know this sounds kind of like, you know, this is just trying to harm or like overly sort of squeeze big companies for money, but really when you think about it, the NIST 800, there are about over 100 controls that have to be either through yourself or a third party assessment, but the third party part is obviously delayed right now. You’ve really got to be honest, deliberate, and really make sure your compliance program is accurate before anybody signs their name. Because if they sign that name and there’s a gap, that person is on the hook.

Terry Gerton You made a point earlier that this case originated with a whistleblower claim, specifically a whistle blower from inside the company’s IT shop who had visibility over this. What lessons should companies learn about where that insight comes from or how to take care of it before it becomes a whistle-blower complaint?

Michael Volkov That’s a fantastic question. And the reason is that I work with companies, for example, to promote the idea of a speak up culture. And a speak-up culture means I want that employee, if they see something wrong, to bring it to me internally in the company and say, look, we’re not meeting this requirement. The last thing I want to do is to not listen to that person, punish them and/or frustrate them to the point that they have to go outside the company to report this and try to make money. The problem is there are lots of lawyers out there who will say, hey, I’ll represent you whistleblower on a contingency basis. Bring me, bring me, bring me something. The number one thing I’ve found, and I’ve been working for many years in compliance and ethics, is that most whistleblowers want to be listened to. That’s all. So if we create a culture where we reward people for raising issues internally. In other words, that person, that whistleblower, if they brought it to their supervisor, they want them, the supervisor says, great job, thank you for bringing this to us. And here’s a reward, like, you know, we promote you on our newsletter, we cite you for your great work. That person that you’ve made that person a whole and that person is going to be feel less disenchanted and wanting to go outside and report to the government. So every government contractor has got to dedicate themselves to the idea of a speak up culture. We want to know what’s going on. You think the CEO and the c-suite knows what’s went on? They have no clue but when they hear from people who are in the trenches, they’ve got to listen.

Terry Gerton Again, this case seems like it is continuing to really hit the nail on the head about how the Trump administration is using the False Claims Act to drive compliance with a variety of things. We’ve seen it in HR, we’ve seen in DEI, we’ve see it in cyber. If you were counseling a contractor today on how to prepare for this broader approach to compliance and certification, where would you tell them to start?

Michael Volkov Well, first off, just to throw in one more sort of monkey into the wrench or the wrench into the monkey, whatever the expression goes, Terry. The first thing here is they’re also using False Claims Act aggressively, not only in DEI, HR issues, not only cybersecurity, but also in trade enforcement. So now when you are facing tariffs, when you’re facing importation fees and duties, those have got to be paid and nobody can circumvent or try to monkey with the system to avoid that payment. And they have been incredibly aggressive. They just had, against Applied Materials, they had a $440 million set up on tariff requirements. So how do we get at the issue? How do we prevent this from occurring? And this is really, you’ve asked a great question and it requires a detailed pulling apart of your controls over how you manage your cybersecurity risks. And it means not just having IT sitting at the table, or your CISO sitting at the table, I want to have compliance, business, everybody at the table. And now I want everybody to understand exactly what it is we’re representing. The IT people, the number one challenge that I see with IT departments is the ability to speak English that we can understand. Okay. I’ve seen some tremendous CISOs and some really talented people. But when they start to explain things, they’ve got to explain it in a basic way. And Einstein always said that was the best indicator of a person’s intelligence was the ability to explain a difficult complex issue in an easy way. And here what we have to do is then understand exactly what we’re certifying to and who’s to be responsible for generating that judgment and who’s going to be responsible for ultimately signing it. I hate to use an analogy, but if we go back to socks and we go back to financial controls and there’s a whole elaborate process that public companies have for ensuring that the representations that are made in their financial audits are accurate. We need the same kind of approach here. I know that sounds like, oh, that’s make work and whatever. But if Honeywell faces a $2 million penalty for one inaccurate certification relating to one network that had inadequate certifications, everybody is at risk. And if whistleblowers are there with an aggressive contingency fee bevy of lawyers ready to support them, we’ve got to be careful here. And this government, this False Claims Act, is done by the Civil Division and by the Criminal Division, and they are ready to go when they get these because they realize this is a national security issue, and the one thing about this administration is they are all about national security, be it trade, tariffs, be it cybersecurity. So this is right in the core area. So I urge everybody to keep listening to Terry because Terry is going to help you and keep you going through this in a way to mitigate your risks.