Billed for compliance nobody verified
A Delaware maker of spaceflight pressure gear has settled a case built on paperwork rather than intrusion. ILC Dover and its sister company ILC Astrospace will pay $13M to resolve allegations that they collected payments on federal contracts while knowing they had not met the cybersecurity terms attached to them.
The Justice Department announced the agreement on November 3. Contracts at issue covered the Army, the Missile Defense Agency and NASA, and the alleged conduct runs from January 2018 to October 2024.
The shortcuts listed in the settlement are ordinary and familiar. Prosecutors said the companies put controlled unclassified information in a third-party cloud without requiring protections equal to the FedRAMP Moderate baseline, and without the incident reporting and forensic access terms their contracts demanded. They are also accused of failing to keep a system security plan for covered systems, and of leaving NIST SP 800-171 and SP 800-53 controls only partly implemented.
Why a supply-chain case lands here
ILC Dover supplies extravehicular activity suits and pressure systems, work that reaches human spaceflight and missile defence. The allegations describe the class of vendor the Pentagon’s cyber rules were written for: small enough to treat a system security plan as overhead, placed deep enough in a supply chain that its network touches controlled design data.
The claims are allegations only and no liability was determined. The case came from a whistleblower, Philip Root, a former cyber director at the firm, who will receive $2.35M.
