Georgia Tech: The Assessment Score of 98

In the Georgia Tech cybersecurity settlement, Georgia Tech Research Corporation agreed to pay $875,000 to resolve allegations of missing cybersecurity protections and a false assessment score on research contracts with the Air Force and the Defense Advanced Research Projects Agency. The government alleged that a supposedly campus-wide score described an imagined environment, while the Astrolavos Lab doing sensitive cyber-defense research lacked required protections. For someone who knows the lab’s computers, security plan or assessment, this case turns on a familiar question: did the statement sent to the government describe the systems actually doing the work?

The Justice Department announced the civil settlement on September 30, 2025. Georgia Tech Research Corporation contracts with government agencies for research performed at the Georgia Institute of Technology. Two former members of Georgia Tech’s cybersecurity team brought the False Claims Act whistleblower case behind the resolution.

Astrolavos Lab’s Missing Protections

The government alleged that Astrolavos lacked a system security plan until at least February 2020 and failed to install, update or run antivirus or anti-malware tools until December 2021. Those allegations covered the lab’s desktops, laptops, servers and networks while it conducted sensitive research for the Defense Department. A cybersecurity research lab, of all places.

The government’s complaint goes beyond whether a plan existed. It alleged that the plan eventually developed for Astrolavos left out most of the lab’s desktops and laptops, even though those devices could connect remotely to servers holding covered defense information. The complaint quoted the lab’s head of IT acknowledging a scoping problem. Protecting the server while leaving out the computer used to reach it was the gap the government described.

The antivirus allegation also concerned a decision inside the lab. According to the complaint, its director resisted installing the software and rejected the proposed endpoint agent in an email. A compliance employee said leadership permitted reliance on mitigating measures, including the university network’s firewall. The lab’s head of IT, however, testified that the network protection he had assumed existed was not running.

The whistleblowers’ original complaint described the inventory problem from another angle. They alleged that most systems listed in the Astrolavos inventory sat on a network without the firewall credited in the signed compliance documents. That is a discrepancy a person maintaining the network can recognize: the protection named on paper and the network a machine actually uses.

The Assessment Score of 98 Described a Model

Georgia Tech’s score of 98 allegedly described a model of how a lab could operate, rather than an assessment of an actual covered contracting system. The government said Georgia Tech and its research corporation submitted the score in December 2020 as an enterprise assessment. According to the complaint, it was a score out of 110 under the NIST SP 800-171 assessment framework, with a campus system security plan named as the plan assessed.

The complaint quoted the employee who drafted that campus plan describing its assumption:

The government alleged that Georgia Tech instead had independently operated IT systems across its campus, with individual labs departing from that model. Astrolavos was among them: its own plan differed from the campus model, including on antivirus protection, and the complaint alleged that nobody calculated a separate score for the lab. We see the central problem in that substitution. On the government’s account, a model of what everyone could implement became the number describing what it was buying.

This is why the system behind a reported assessment score matters as much as the number. The assessment framework introduced in 2020 linked scores to relevant contractor information systems. The complaint also described the system security plan as identifying the system’s boundaries, operating environment, implemented protections and connections to other systems. The inventory and those connections give an insider a way to test whether the assessment describes the work.

Why the Assessment Reached the Government’s Bill

The government alleged that submitting a cybersecurity assessment score was a condition of award for the research corporation’s Defense Department contracts. It also alleged that a senior research-contracting official warned the campus score could mislead the government into thinking it covered everything. The complaint said the institutions submitted it despite that warning.

The research corporation’s role explains how the lab’s security reached government money. It paid the university for the work it billed the government for. In the government’s account, the contracting office, the cybersecurity team and the lab each held a different part of the same promise: which protections the work required, what the score represented and what was operating on the machines.

That connection became explicit when the whistleblowers raised the antivirus problem. According to the government’s complaint, research administrators suspended invoicing on the EA contract, a joint Air Force and DARPA project to identify the parties behind cyberattacks. The lab installed antivirus software within days. The complaint quoted the research corporation’s general manager explaining the billing concern:

For the period from May 2019 through the end of the EA contract, the government alleged that it paid $10,237,622 on invoices for the lab’s work. The complaint said the invoices certified that payments complied with the application and award agreements, without mentioning the alleged cybersecurity failures. We would call that settlement a bargain against the government’s account of what it paid. In the complaint’s account, the decision to stop billing is especially revealing: the people responsible for the contracts themselves connected the missing protection to the government’s bill.

The Whistleblower Case and the Civil Settlement

The two former cybersecurity-team members started the qui tam case, and the government joined part of it. The Justice Department worked with the Defense Criminal Investigative Service and the Air Force Office of Special Investigations on the investigation and resolution. The case brought technical knowledge from inside the university together with the government’s investigative and contracting expertise.

The settlement also provided for the whistleblowers to share in the recovery. A whistleblower case under the False Claims Act can pay 15% to 30% of what the government recovers. Here, the insiders’ familiarity with the systems gave the case its concrete subject: the security described to the government and the security used for its research.

What the Systems Staff Could See

The whistleblowers alleged that pressure to keep research funded affected how compliance staff assessed the labs. Their complaint described the problem in terms an assessor would recognize:

The allegation is about how the answer was reached. If the task becomes finding an interpretation that approves existing practice, the person who knows the system can be the one who sees why the certification is wrong. In this case, the alleged exclusions from the plan, the firewall mismatch and the internal billing objection connect technical detail to decisions about federal money.

A 2022 study of compliance programs and contracting fraud penalties, published in the International Journal of Management and Humanities, found higher penalties among companies with formal compliance and ethics programs in its sample of 49 defense contractors. The paper described the association as weak. We look for what a compliance program changes on the machines, not just whether one exists. At Astrolavos, the specific allegations concerned what staff checked, what leadership permitted and what the contracting office was told.

The Pattern Beyond Georgia Tech

MORSECORP’s cybersecurity settlement shows how a later assessment can contradict a reported score. MORSECORP admitted reporting 104, receiving a consultant’s assessment of minus 142 and leaving its reported score unchanged until after a government subpoena. Georgia Tech’s distinctive allegation reached further back in the process: which system, if any, the assessment actually described.

In the Penn State settlement, the government alleged false promised remediation dates and failure to pursue the plans for fixing missing controls. The shared question for research and cybersecurity staff is whether the assessment, the promised work and the system used for government business agree. The person who sees the discrepancy may hold the evidence that connects a security statement to a government payment.

You Know Which System Was Assessed

If a security score describes protections your lab never used, speak to one of our Whistleblower Experts about the score that was sent. We work with you to build your strongest cybersecurity whistleblower case from the systems, the assurances and the government money, and bring in cybersecurity fraud whistleblower lawyers who understand defense research contracts. We bring the expertise to connect your view from inside the lab to the government’s bill and stay beside you through the case.