Commercial Litigation Update

On August 22, 2024, the United States Department of Justice (“DOJ”) filed a complaint-in-intervention in a whistleblower lawsuit brought against Georgia Institute of Technology (“Georgia Tech”) and Georgia Tech Research Corporation (“GTRC”) asserting claims under the False Claims Act (“FCA”) and federal common law based on allegations that Georgia Tech and GTRC failed to meet cybersecurity requirements mandated by U.S. Department of Defense (“DoD”) contracts and DoD regulations.

In United States ex rel. Craig v. Georgia Tech Research Corp, et al., which is pending in the United States District Court for the Northern District of Georgia, the DOJ alleges that, from as early as May 2019, Georgia Tech and GTRC, an affiliate of Georgia Tech that contracts with government agencies for work to be performed at Georgia Tech, failed to enforce cybersecurity regulations in order to allegedly “accommodate ‘researchers [who were] pushing back’ on cybersecurity compliance because they found it burdensome.” The complaint-in-intervention further alleges that, until at least February 2020, “Georgia Tech failed to enforce basic cybersecurity at the Astrolavos Lab” despite the lab possessing “nonpublic and sensitive DoD information.” It is also alleged that, even after Astrolavos Lab implemented a system security plan, Georgia Tech and GTRC “failed to: (1) assess the system on which the Astrolavos Lab processed, stored or transmitted sensitive DoD data using DoD’s prescribed assessment methodology; and (2) provide to DoD an accurate summary level score for Astrolavos Lab to demonstrate the state of the lab’s compliance with applicable cybersecurity regulations.” The submission of a summary level score is a “condition of contract” for most DoD contracts.