Aerojet Rocketdyne: What the Cybersecurity Disclosures Left Out

In the Aerojet Rocketdyne cybersecurity settlement, the company agreed to pay $9 million to resolve allegations that it misrepresented compliance with cybersecurity requirements in federal contracts. A former employee brought a defense contractor whistleblower claim under the False Claims Act’s qui tam provisions, connecting what the company told government customers with what its own security assessments showed.

Aerojet supplied propulsion and power systems for launch vehicles, missiles, satellites and other space vehicles to the Department of Defense, NASA and other federal agencies. The case named both Aerojet Rocketdyne Holdings and its operating company, Aerojet Rocketdyne. The dispute reached into the information systems behind that work: what protection the contracts required, what the company disclosed and whether the government received the full picture before committing its money.

The Cybersecurity Promise Inside the Rocket Contract

Defense contracts can require a manufacturer to protect the technical information it handles while building the product. The Defense Department’s November 2013 safeguarding rule required specified security controls for covered unclassified technical information on contractor systems. Contractors could explain why a control did not apply or how an alternative provided equivalent protection.

NASA had its own requirements for contractors handling sensitive but unclassified government information. As the court explained, its clause required protection of NASA electronic information against unauthorized disclosure and did not provide the same allowance for alternative controls. The particular agency’s contract mattered, even when the same company did work for both.

Aerojet argued that the contracts concerned missile defense and rocket engines, so cybersecurity did not go to their central purpose. In its May 8, 2019 order, the court rejected that argument at the outset of the case. Protecting technical information could affect Aerojet’s ability to perform the promised work. We see the problem with treating that protection as peripheral: the information is part of what makes the rocket work possible.

Why Were Aerojet’s Cybersecurity Disclosures Challenged?

Aerojet disclosed cybersecurity deficiencies to government customers, but the whistleblower alleged that those disclosures understated their extent. The former senior director for cybersecurity, compliance and controls alleged that the company misrepresented its security equipment, controls and firewalls. According to the court’s account of his allegations, he refused to sign compliance documents in July 2015 and submitted an internal report.

The disclosure dispute had a direct connection to an award decision. The 2019 order described a Defense Department representative who believed Aerojet could become compliant relatively easily, based on the company’s disclosure letter. The whistleblower alleged that the letter omitted the status of required controls and selectively reported information. The court allowed the fraud claims to proceed because those alleged omissions could have affected the government’s decision to award and pay on the contracts.

By the time of the February 1, 2022 order, Aerojet had presented evidence of disclosures through letters, emails and meetings, and of government agencies acknowledging noncompliance. The dispute concerned how completely those communications described the problems.

The Audit and the Disclosure Matrix Told Different Stories

The court described a 2014 outside audit that found Aerojet compliant with only five of 59 required controls. A company compliance matrix sent to the Army that September, and to other government agencies, listed ten controls as compliant. The court put the unanswered discrepancy plainly:

We see little comfort in a disclosure that makes the system look better than the audit did. The alleged mismatch went straight to what the government understood it was buying: work performed with the required protection for its technical information.

The same order described an auditing firm penetrating Aerojet’s network within four hours and recommending immediate action. Aerojet disputed whether those findings showed a failure to meet its contract clauses. The court left that dispute for trial, explaining that a jury could find the agencies would have viewed the company’s security differently had they known the findings.

An outside firm’s 2013 memo added another concern: large quantities of data leaving the Rocketdyne network. Aerojet pointed out that the attacks involved a predecessor company’s network before the merger and before Aerojet fully controlled the relevant resources. The court noted that the systems later integrated and found no evidence that the memo’s recommendations had been acted on. Whether the problems persisted after integration, and what the contracting agencies learned about them, remained disputed.

Aerojet’s Declined Case, Trial and Settlement Timeline

The government declined to join the case on June 5, 2018, and the whistleblower continued pursuing it. The court rejected Aerojet’s argument that the government’s decision to stay out showed the alleged misrepresentations did not matter.

The trial began on April 26, 2022, and the parties reached a settlement in principle on April 27. The Justice Department’s July 8, 2022 announcement confirmed that they settled on the second day of trial.

The Justice Department said the whistleblower would receive $2.61 million from that settlement as a share of the False Claims Act recovery. A whistleblower case under the False Claims Act can pay 15% to 30% of what the government recovers. That award puts a concrete value on the insider’s contribution to the recovery.

The Same Gap in Later Cybersecurity Cases

Later cases involving false SPRS scores and assessment scope show why the system behind a representation matters. In the Georgia Tech Research Corporation case, the government alleged that a reported score of 98 described a fictitious or virtual environment, rather than the systems used for the contracted work. The score was a condition of award on defense research contracts. For an insider, knowing which environment was actually assessed can explain why an apparently reassuring number misleads.

MORSECORP’s settlement carried factual admissions about compliance with NIST cybersecurity requirements and another gap between the reported picture and an outside assessment. The company admitted reporting a score of 104, later receiving a consultant’s score of -142 and leaving the reported score uncorrected until after a government subpoena. Aerojet’s dispute concerned the completeness of disclosures, Georgia Tech’s allegations concerned the environment assessed, and MORSECORP’s admissions concerned a score left standing after a conflicting assessment. The useful comparison is what the government was told beside the technical evidence inside the organization.

What Evidence Is Needed to Prove Fraud?

In a cybersecurity contract case, the evidence connects the required protection, the system assessed, the company’s representation and the government money that depended on it. Aerojet’s case makes that connection concrete through contract clauses, audit findings, disclosure letters and compliance matrices. The court examined which contracts actually carried the security requirements, including terms incorporated through other documents. We examine those records with the insider who can explain what each version described and who knew about the differences.

An insider can see whether a compliance program matches the work being done, just as Aerojet’s audits could be compared with its disclosures. A 2022 study of defense contractors in the International Journal of Management and Humanities reported higher penalties and penalty ratios among companies with compliance and ethics programs than among those without them. The study suggested greater government scrutiny as a possible explanation. We care about what a program does inside the business, not how reassuring it looks on paper.

For this case, our question is what the controls and disclosures actually did. The evidence behind a defense contractor fraud claim may sit in the difference between an internal assessment and the version a government customer received. Your knowledge of the system can explain that difference in a way the submitted matrix alone cannot.

The Justice Department’s Civil Cyber-Fraud Initiative targets knowing misrepresentations of security practices, knowingly deficient cybersecurity products or services, and knowing failures to meet incident-monitoring or reporting obligations. Aerojet’s case shows the value of an insider who can connect a technical problem to a specific promise made for government work. That connection is where we focus with you.

You Know What Changed Before the Disclosure

If you worked on a security assessment that changed on its way to a government customer, tell our whistleblower experts what changed. We build the case with you around the system, the disclosure and the contract, and bring in defense cybersecurity whistleblower lawyers who understand those connections. We stay beside you through the case, translating your technical knowledge into an account of what the government was promised and paid for.