In a recently announced settlement agreement with the U.S. Department of Justice (“DOJ”), Illumina, Inc. (“Illumina”) agreed to pay $9.8 million to resolve claims arising from alleged cybersecurity vulnerabilities in genomic sequencing systems that the company sold to federal agencies.  The case is the latest in a series of False Claims Act (“FCA”) settlements under the current administration that evidence DOJ’s continued focus on cybersecurity obligations for government contractors, particularly those that maintain sensitive data and personal information on behalf of federal customers.

Case Summary[1]

The case, which was filed by a former employee under the qui tam provisions of the FCA (31 U.S.C. § 3730(b)), alleged that Illumina submitted, or caused to be submitted, false claims under its government contracts for genomic sequencing systems which were allegedly susceptible to certain cybersecurity vulnerabilities and lacked an “adequate product security program and sufficient quality systems” to identify and address vulnerabilities.  Specifically, DOJ claimed that the company knowingly failed to:

• Incorporate product cybersecurity into software design, development, installation, and on-market monitoring;
• Properly support and resource personnel, systems, and processes tasked with product security; and
• Adequately correct design features that introduced cybersecurity vulnerabilities into its genomic sequencing systems.

Furthermore, DOJ alleged that the company falsely claimed that its software adhered to unspecified cybersecurity standards promulgated by the International Organization for Standardization and National Institute of Standards and Technology.

Takeaways

• Civil Cyber-Fraud Remains in Focus.  As we have discussed in prior blog posts and other publications, an increasing focus on civil cyber-fraud cases under the Biden Administration raised the stakes for many government contractors across various industries.  While the Trump Administration has signaled a shift in other enforcement areas, the Illumina settlement and other recent cases suggest that the momentum of civil cyber-fraud enforcement will continue under the current Administration.  
• Risk to Health-Related Data is a Priority.  The case reiterates that DOJ’s FCA enforcement priorities extend beyond defense contractors and traditional IT service providers to include biotechnology companies, medical device manufacturers, and other organizations that maintain personal information, including health-related data.  In the accompanying press release, DOJ specifically underscored the sensitivity of genetic information and emphasized its commitment to protect sensitive data from cyber threats.
• DOJ Does Not View Lack of Cyber Breach as a Defense. DOJ asserted that the company’s claims were false, “regardless of whether any actual cybersecurity breaches occurred,” as a result of alleged cybersecurity vulnerabilities in genomic sequencing systems.  This underscores the DOJ’s view that cybersecurity noncompliance need not result in a breach or other cyber-incident in order to trigger FCA liability, and further indicates that DOJ will not consider cyber breach as a gating issue when deciding whether to intervene in a qui tam action.  This fact, however, should clearly have an impact on whether damages can be proven, and how any damages may be calculated.

Looking Ahead

DOJ’s continued focus on cyber-related false claims comes at a time when cybersecurity obligations for government contractors continue to expand in scope and complexity.  For instance, the U.S. Department of Defense Cybersecurity Maturity Model Certification (“CMMC”) Program was issued late last year, and the procurement rule that will apply the CMMC program to federal contractors is expected in the near future.  In addition, the White House issued a Cybersecurity Executive Order in June, which included several directives that could flow down to government contractors, including for software supply-chain security and post-quantum cryptography.   As the cybersecurity landscape continues to evolve, contractors should regularly assess their compliance with cybersecurity requirements.  As a practical step, contractors can facilitate communications and alignment between their IT, InfoSec, Product and Delivery teams, and Legal functions, as appropriate, to ensure their organizations understand and address regulatory and contractual cybersecurity obligations.  Organizations may also consider implementing or enhancing procedures that enable employees to raise cybersecurity concerns internally and take appropriate steps to investigate and address instances of potential noncompliance.

[1] Source: Illumina, Inc. Settlement Agreement.