Penn State has agreed to pay $1,250,000 to resolve allegations that violated the False Claims Act by failing to comply with cybersecurity requirements involving either the Department of Defense (DOD) or the National Aeronautics and Space Administration (NASA).

The settlement aimed to resolve allegations that, sometime between 2018 and 2023, Penn State failed to incorporate cybersecurity controls that were contractually mandated by the DOD and NASA, as well as not adequately implementing plans of action to correct deficiencies it identified. The DOD requires contractors to submit summary-level scores that reflect the status of their adherence to the required cybersecurity measures on covered contracting systems used to store or access sensitive defense information.

The U.S. argued that Penn State submitted cybersecurity scores to the DOD that showed it had not implemented certain controls, but misrepresented by which dates it would be implemented and did not pursue plans to rectify the situation. The U.S. also claimed Penn State did not use an external cloud service provider that met the DOD’s security requirements for secured defense information.

“Universities that receive federal funding must take their cybersecurity obligations seriously,” Principal Deputy Assistant Attorney General Brian M. Boynton, head of the Justice Department’s Civil Division, said in a release made by the Office of Public Affairs within The U.S. Department of Justice. “We will continue our efforts under the department’s Civil Cyber-Fraud Initiative to hold contractors accountable when they fail to honor cybersecurity requirements designed to protect government information.”

“Protecting the integrity of Department of Defense procurement activities is a top priority for the DOD Office of Inspector General’s Defense Criminal Investigative Service (DCIS),” Special Agent in Charge Patrick J. Hegarty of the DCIS Northeast Field Office said. “Failing to comply with DOD contract specifications and cybersecurity requirements puts DOD information and programs at risk.  We will continue to work with our law enforcement partners and the Department of Justice to investigate allegations of false claims on DOD contracts.”

The settlement resolved a lawsuit filed under the whistleblower provisions of the False Claims Act and allocated $250,000 to whistleblower Matthew Decker, the former chief information officer for Penn State’s Applied Research Laboratory.