Aero Turbine and Gallant Capital Partners: Foreign Access and an Unchecked Security Assumption

The Aero Turbine and Gallant Capital Partners cybersecurity settlement required the companies to pay $1.75 million to resolve allegations of missing security controls and unauthorized foreign access under an Air Force contract. The government alleged that Aero Turbine assumed its export controls satisfied its cybersecurity obligations without verifying the required safeguards, and that a Gallant employee sent sensitive defense information to unauthorized software personnel in Egypt. If you worked on the system, the vendor relationship or the compliance review, that gap between an assumption and an actual check may be familiar.

The Justice Department announced the civil settlement on July 31, 2025. The government connected the alleged failures to claims for payment on engine-repair work.

The Engine-Repair Contract Included Security for Its Data

Aero Turbine is an aerospace maintenance, repair and overhaul provider in Stockton, California. The Air Force awarded it the Management of Items Subject to Repair contract, or MISTR contract, in January 2017 to repair and maintain General Electric J85 turbojet engines. The settlement agreement describes the information system supporting that work: Aero Turbine Online Management System, known as ATOMS, which contained controlled unclassified information.

The contract required adequate security for covered information systems, including implementation of NIST security controls by December 31, 2017. The government alleged that from January 2018 through February 2020, Aero Turbine had not fully implemented the required controls for ATOMS. Some of the missing controls, it alleged, could leave the system open to significant exploitation or allow defense information to be taken out of it.

The government tied those failures to Aero Turbine’s allegedly false claims for payment under the repair contract. That makes the information system part of the purchase: the Air Force bought engine work with security requirements attached. An insider who knows the repair operation and an insider who knows the system may see different parts of the same government bill.

Export Controls Became an Unchecked Assumption

According to the government’s allegations in the agreement, Aero Turbine assumed that its export controls protecting technical data were sufficient to meet the contract’s cybersecurity obligations. The government alleged that neither Aero Turbine nor Gallant had verified whether ATOMS met the specific NIST controls before the written disclosure. We see the absurdity: the contract named the safeguards, and Aero Turbine allegedly assumed something else had them covered.

A technical-data restriction tells one part of the story; whether the required protections actually operate on the system tells another. Here, the government alleged both an unchecked security baseline and a specific transfer of information to unauthorized recipients.

These safeguarding duties were already part of defense contracting before later cybersecurity certification requirements. The defense safeguarding rules adopted in 2015 moved the requirements toward NIST security controls and set the implementation deadline. Aero Turbine’s agreement identifies the requirement in its own engine-repair contract, giving a security employee a concrete system and contractual promise to compare.

Foreign Access Through a Software-Improvement Project

The government alleged that the foreign-access failures occurred from June 6 through July 29, 2019. They concerned both the flow of controlled unclassified information and access to ATOMS. The agreement uses ATI for Aero Turbine and CUI for controlled unclassified information. It describes how the software project allegedly put defense data in unauthorized hands:

For someone working on that kind of project, permission to improve a system and permission to receive its defense information are separate questions. The allegation identifies a person inside the business making the handoff, the system the information came from and the authorization the recipients lacked. Those details put the foreign-access issue within the view of people who arrange software work, administer accounts or oversee technical data.

In defense contracting, the work and information handled help determine which security obligations reach an outside provider. We examine the provider agreement alongside the government’s contract and the access actually granted. The useful comparison is between the task the vendor was hired to perform, the information made available and the people authorized to receive it.

A related provider problem appeared at Penn State, where the government alleged that an external cloud provider failed to meet defense security requirements. That case also concerned promised remediation dates and work left undone. The common thread is the contractor’s promise reaching beyond its own employees to the systems and providers handling government information.

Gallant’s Role Reached Into the System Project

The government alleged that Gallant’s own employee handed over the defense data. The agreement identifies Gallant as a Los Angeles private equity company that held a controlling stake in Aero Turbine through investment funds it advised from January 2019 to August 2024. The alleged foreign-access period fell during that ownership.

That gives the private-equity part of the story a specific act to examine. The government’s account also alleged that neither company had verified the required controls, while the agreement made both companies responsible for the full settlement payment. For an employee who saw an investor’s personnel work directly on a contractor’s systems, who requested the change and who supplied the information can matter as much as the ownership chart.

What the Companies Disclosed After Discovery

Aero Turbine submitted two written disclosures about cybersecurity noncompliance under the repair contract. The agreement says Aero Turbine and Gallant identified people involved in or responsible for the issues and disclosed facts gathered in an independent investigation, connecting those facts to specific sources. Aero Turbine also represented that it promptly put measures in place to correct the issues and prevent similar problems.

The government expressly credited disclosure, cooperation and remediation in reaching the settlement. The concrete work behind that credit matters: identifying the people, explaining what happened and showing where the information came from. An insider’s account of what the company knew and reported can connect the original failure with the decisions made after discovery.

The Settlement Costs Could Not Go Back on the Government’s Bill

The agreement required Aero Turbine and Gallant to account separately for the settlement payment and other specified costs, including investigation, defense and corrective-action costs incurred in response to the government’s audits and civil investigations. The companies could not charge those costs directly or indirectly to federal contracts. If they had already sought payment for such costs, the agreement required them to identify and repay them.

That provision gives the finance side of this cybersecurity case its own concrete question: where did the costs of resolving it go? For a contract accountant, the settlement payment and the cost accounts are connected. Taxpayers were not supposed to receive a second bill for the company’s response to the first one.

What Evidence Is Needed to Prove Fraud?

For this kind of cybersecurity case, the useful evidence connects the contract, the actual system and claims for payment. We compare what the government required with the controls implemented, the information shared, the users authorized and what the business knew. A system administrator may understand the access history, while an export-compliance employee may understand the assumption made about technical-data restrictions. A contract employee may connect those decisions to the work being billed.

A broader study reinforces why the existence of a compliance program tells only part of the story. A 2022 study in the International Journal of Management and Humanities found that firms with compliance programs had higher penalties in its sample of 49 defense contractors. For us, the useful distinction is between a program’s existence and the work it actually performs, the same distinction an insider can illuminate through the system’s records.

A whistleblower case under the False Claims Act can pay 15% to 30% of what the government recovers. Your technical knowledge can explain how a security promise, a vendor project and a payment claim fit together, and our whistleblower experts work with you to build that account into a case.

You Know Who Had Access

If you saw defense information shared with unauthorized software personnel or security assurances resting on an unchecked assumption, talk with our whistleblower experts about what happened inside the project. We build the case with you, bring in defense cybersecurity whistleblower lawyers who understand the contract and the systems, and stay beside you through the pursuit of a recovery.