Pennsylvania State University: Cybersecurity Representations on NASA Research Contracts

Pennsylvania State University agreed to pay $1,250,000 to resolve allegations about cybersecurity representations on NASA research contracts and Department of Defense work. The government alleged that the university failed to implement required controls and adequately pursue plans to correct known deficiencies. For someone inside a research institution, the revealing detail is the promise to fix a gap: the assessment can disclose the missing protection while the commitment beside it misleads the government about what will happen next.

The Justice Department announced the settlement on October 22, 2024. It covered fifteen NASA or Department of Defense contracts or subcontracts, with alleged failures running from 2018 through 2023. The whistleblower who brought the case was the former chief information officer of Penn State’s Applied Research Laboratory.

Missing Controls and Promised Fixes

The Penn State cybersecurity representation allegations concerned both required protections and the work promised to correct deficiencies. The government said the university failed to implement contractually required controls and failed to adequately develop and carry out corrective plans.

The Department of Defense requires contractors to submit summary scores showing their compliance with applicable cybersecurity requirements on systems that hold or access the Defense Department’s sensitive information. In Penn State’s case, the government’s account says the scores disclosed missing controls:

Justice Department, Penn State settlement announcement, October 22, 2024

The government alleged that Penn State identified missing protections, then misrepresented when it would implement them and did not pursue the work. The promised correction was itself part of the alleged deception.

We see the absurdity in treating an identified security problem as handled because someone has put a completion date beside it.

The Cloud Provider Had Its Own Requirement

The government separately alleged that Penn State did not use an external cloud service provider meeting Department of Defense security requirements for the Defense Department’s sensitive information while performing certain contracts and subcontracts. That allegation reaches the service used to carry out the contract, alongside the university’s own controls and corrective work.

For a person involved in choosing or managing the provider, the comparison is concrete: the security requirement, the service actually used and the information it handled. We examine those connections with the insider who understands them.

The View From the Applied Research Laboratory

The former chief information officer brought a qui tam case under the False Claims Act.

Someone who works with assessments or corrective plans may understand what an implementation date means in practice: which protection is missing, what work would close the gap and whether that work is being pursued. Someone responsible for contract communications may see the commitment sent to the sponsor. We bring those perspectives together to understand the representation and the decisions behind it.

A research administrator, security employee or contract manager may recognize the difference between the promised fix and the work underway before it is visible outside the institution.

What Proof Do You Need as a Whistleblower?

For a research-contract cybersecurity case, useful proof connects the contract’s security requirement to what the institution represented and what it actually implemented. We look at the assessment submission, promised dates, corrective plans and cloud-provider records in that context, with the person who can explain the work.

The contract and payment records connect that technical account to the government’s purchase. We want to understand which requirement applied to which work, what statement the government received and how the performance records compare.

The 2025 chapter Combating Procurement Fraud in the Public Sector, published in Modern Anthology in Education, Administration, Science and Technology, argues that thorough audit trails and automated documentation improve traceability and accountability. It also describes audits comparing contract procedures, supplier selection, payment records and inventories to identify discrepancies.

You may know the system better than the person who submitted the representation. Our work with you is to connect that knowledge to the promise, the purchase and the people responsible for carrying it out.

NASA Research Contracts and the Mixed-Agency Settlement

NASA research contracts were expressly part of the Penn State resolution, alongside Department of Defense work. The settlement covered that group of contracts and subcontracts together. The detailed assessment-score and cloud-provider requirements described in the government’s announcement were Defense Department requirements.

What security work did this particular contract require, and what did the university say about performing it? We begin with that purchase and its representations.

The cybersecurity matter is also separate from Penn State’s 2020 research-charging settlement. That earlier matter concerned alleged mischarges on research awards from the National Science Foundation, NASA, the Navy and the Air Force.

Aerojet Rocketdyne and the Same Contractual Promise

Aerojet Rocketdyne agreed to pay $9 million in a separate cybersecurity settlement announced in July 2022. The government alleged that the propulsion and power systems supplier misrepresented its compliance with contractual cybersecurity requirements. Its customers included NASA, the Department of Defense and other agencies.

The useful parallel is the promise about security in a government purchase. A university and a propulsion supplier perform different work, but both cases concerned what the customer was told about contractual protections. Penn State’s account adds a particularly revealing detail: the government alleged deception in the promised response to deficiencies already disclosed in assessment scores.

How Does the Civil False Claims Act Affect Government Procurement Fraud?

The civil False Claims Act lets insiders bring cases on the government’s behalf over false claims for federal funds. Penn State’s case concerned allegedly unmet cybersecurity requirements in government contracts.

The Justice Department’s Civil Cyber-Fraud Initiative pursues knowing misrepresentations about cybersecurity practices, knowingly deficient cybersecurity products or services and knowing violations of incident-monitoring or reporting duties.

NASA’s Office of Inspector General assisted the Justice Department in resolving the Penn State case.

How Much Money Can a Whistleblower Get From a Qui Tam Lawsuit?

A whistleblower case under the False Claims Act can pay 15% to 30% of what the government recovers. Penn State’s settlement provided a share for the former laboratory chief information officer who brought the case.

The whistleblower reward gives value to the insider’s contribution. In a cybersecurity matter, that contribution may be an understanding of the missing protection, the commitment to fix it or the provider used to perform the contract. We work with you to assess what that knowledge shows about the government’s purchase.

You Know Whether the Promised Fix Happened

If you saw a cybersecurity commitment leave the university while the required work stood still, speak to one of our Whistleblower Experts about the fix that never happened. We work with you to build your strongest cybersecurity whistleblower case and bring in government contract cybersecurity whistleblower lawyers who understand the promises at issue. We stay beside you through the process.