Aerojet Rocketdyne: NASA Contract Cybersecurity Disclosures and the Settlement During Trial

Aerojet Rocketdyne agreed to pay $9 million in a settlement during trial over alleged misrepresentations of cybersecurity compliance on federal contracts, including NASA work. The dispute concerned what the company disclosed about its systems and what its cybersecurity staff allegedly knew. If you saw the audit findings and the assurances sent to the government, this case turns on a difference you may recognize.

The company supplies propulsion and power systems for launch vehicles, missiles, satellites and other space vehicles. Its customers include NASA, the Department of Defense and other federal agencies.

A former employee brought the qui tam case and pursued it after the government declined to join. His role inside the company was senior director of cybersecurity, compliance and controls: someone whose work put the security promises and the systems behind them in the same view.

What Aerojet Sold and What NASA Needed Protected

NASA’s purchase involved more than the propulsion hardware. The agency also required protection of its information held on a contractor’s systems. The court’s May 2019 order described NASA’s security requirements for contractors storing sensitive but unclassified government information. Those requirements covered the confidentiality, integrity and availability of NASA electronic information and protection against unauthorized disclosure. The whistleblower alleged that Aerojet’s relevant NASA contracts incorporated those acquisition requirements, making the promised protections part of the work the agency had contracted to buy.

The engine is the visible product. The ability to handle the government’s technical information securely is another part of the purchase, one that a cybersecurity employee sees from the inside.

The court described an important difference between the agencies’ requirements at issue. The Defense Department rules allowed specified alternatives to required controls. The NASA provision discussed in the order made no such allowance. A contractor working for both agencies had to account for the requirements attached to each customer’s work.

That distinction matters when someone inside a supplier hears that the company has already addressed its compliance problem. Addressed for which contract, under which requirement, and through what actual protection? We connect the assurance to the agency’s purchase and the systems used to perform it. A general statement about the company’s cybersecurity cannot answer those contract-specific questions.

The Disclosure Letter and the Audit Behind It

The whistleblower alleged that Aerojet knew its systems fell short and repeatedly misrepresented the extent of the problem to government officials. In its account of the complaint, the court described an outside compliance audit that Aerojet commissioned in 2014. The whistleblower alleged that the company knew of its noncompliance by then and obtained a government contract through false and misleading statements.

The disclosure dispute had a concrete document at its center: a September 18, 2014 letter to the government. According to the allegations summarized in the order, the letter misrepresented the extent to which Aerojet had required equipment, had implemented security controls and possessed necessary firewalls.

Aerojet argued that it had disclosed its noncompliance to its government customers. The whistleblower’s allegation was more specific: the company had left out the extent of that noncompliance. The court described alleged omissions about required controls, misstatements about partial compliance and selective reporting of data. We see the problem with that defense: a disclosure can hide as much as it reveals.

We would put that letter beside the audit. What did the technical review identify, what did the company tell the customer, and what disappeared between the two? That comparison gives an insider’s knowledge a precise place in the case. The person who knows which protections were missing may be able to explain why an apparently candid disclosure still gave the customer the wrong picture.

The court reasoned that the government’s decision could have depended on how far the company actually was from full compliance. The depth of the gap mattered.

Why the Security Promise Mattered to the Purchase

Aerojet argued that its contracts concerned missile defense and rocket engine technology, so cybersecurity was outside their central purpose. The court did not buy it. It explained that compliance could affect Aerojet’s ability to handle the technical information needed to perform the work.

We think Aerojet’s hardware argument turns the purchase upside down. If handling the government’s technical information depends on promised security, protecting it belongs in the work. A contractor cannot make that promise unimportant simply by pointing to the hardware it sells.

The payment connection was equally concrete. As the court described the allegations, Aerojet secured contracts through misrepresentations to contracting officials, and the government then paid under those contracts. That is the procurement story behind the allegedly false compliance statements: the promise helped secure the business that generated the payments.

NASA and the Defense Department continued contracting with Aerojet after the investigation into the allegations began. Aerojet pointed to that continued business. The court focused instead on what the government knew when it entered into or paid under the contracts at issue. Later purchases could involve different circumstances.

For the person who knows the systems, dates give the comparison its meaning. A later improvement cannot describe the controls that were operating when an earlier assurance reached the customer. We examine the assessment and the disclosure together, at the time of the relevant purchase.

What Happened During Trial?

Aerojet and the whistleblower settled the case over allegedly misleading cybersecurity disclosures on the second day of trial. The Justice Department announced their agreement on July 8, 2022.

The Justice Department placed the resolution alongside its Civil Cyber-Fraud Initiative, announced in October 2021. The initiative targets knowingly deficient cybersecurity products or services, knowing misrepresentations about security practices, and knowing violations of incident-monitoring or reporting obligations. Aerojet’s announced settlement concerned the representations about contractual compliance.

A Similar Disclosure Problem at Penn State

The Pennsylvania State University later agreed to pay $1.25 million to resolve cybersecurity allegations involving NASA and Department of Defense contracts and subcontracts. The Justice Department’s October 2024 announcement described alleged failures to implement required controls and corrective plans, including false implementation dates.

The parallel is the relationship between a known security gap and what the customer hears about it. Aerojet’s case concerned the alleged understatement of noncompliance. Penn State’s allegations also reached the promised work to correct deficiencies. Someone who knows the systems may understand both the existing problem and whether the proposed fix matches the work actually being done.

That is why we examine the disclosure and the corrective plan as distinct representations. Describing a gap and promising to close it each tells the government something about the protection it is buying.

What Proof Do You Need as a Whistleblower?

For a case about cybersecurity disclosures, the useful proof connects the contract requirement, the statement made to the customer, the system’s actual condition and what the company knew. Aerojet’s court record makes the comparison tangible: an outside audit, a disclosure letter, specific claims about equipment and controls, and the award and payment under the resulting contract.

Those records answer different questions. The audit describes the condition the reviewer examined. The disclosure shows the account given to the customer. The contract identifies the promised protection. The award and payment records connect the representation to the government purchase. We follow that connection with you.

Your knowledge may concern a particular firewall, a control described as implemented, or the handling of an audit finding before a disclosure went out. We assess what that knowledge says about the company’s representation and who understood the discrepancy. The technical detail matters because it can explain why the written assurance was misleading.

The NASA and Defense Department distinction also belongs in that examination. We match the requirement to the customer and contract rather than treating one agency’s compliance approach as an answer for every federal purchase. The case takes shape where your knowledge of the system meets the promise made about it.

How Much Money Can a Whistleblower Get From a Qui Tam Lawsuit?

A whistleblower case under the False Claims Act can pay 15% to 30% of what the government recovers.

In the Aerojet case, the Justice Department announced that the former employee would receive $2.61 million as his share of the recovery.

You Know the Systems Behind the Assurance

If you know what a cybersecurity disclosure left out, speak to one of our Whistleblower Experts about the assurance and the system behind it. We work with you to build your strongest cybersecurity whistleblower case and bring in government contract cybersecurity whistleblower lawyers who understand the technical discrepancy and the government purchase. We stay beside you from the first conversation through the case.