Aerojet Rocketdyne is paying the US government $9 million to end fraud allegations. Brian Markus, head of IT security and compliance at Aerojet in 2014/2015, sounded the alarm as a whistleblower: The company had fraudulently embellished the state of its own IT security in order to obtain government contracts. In fact, IT security was not the issue, which meant that Aerojet was disqualified from government contracts.
But US authorities did not open any proceedings against Aerojet Rocketdyne (formerly GenCorp). Instead, the whistleblower went to court himself. Years of proceedings culminated in a jury trial in April. Only then did Markus and Aerojet agree on a comparison. Rocketdyne pays the US $9 million, but explicitly admits no guilt.
In addition, Rocketdyne is paying an undisclosed sum for part of Markus’ legal and legal fees. The United States, in turn, pays Markus 29 percent of the nine million dollars won, i.e. $2.61 million. This is the law in the country.
Accusation of insufficient IT security
Aerojet Rocketdyne is based in California and manufactures engines for space rockets and ballistic missiles. In addition to the US space agency NASA, customers include the United States Air Force, Army and Missile Defense Agency. Both NASA and the armed forces require potential contractors such as Aerojet Rocketdyne to meet certain IT security standards. This is intended to reduce the risk of sensitive data falling into the wrong hands.
According to Markus, this did not work for Aerojet Rocketdyne. In just four hours, hired pentesters were able to obtain all of the company’s user accounts and passwords, access documents covered by attorney-client privilege, and remotely view and eavesdrop on all surveillance cameras and microphones at Aerojet Rocketdyne’s facilities.
At the same time, the company assured its future clients that it would comply with all IT security regulations. According to Aerojet Rocketdyne, this is not necessarily a contradiction to the miserable result of the penetration test. And even if regulations were violated, no harm would have been done to the US since all orders had been fulfilled. In principle, the company denies Markus’ allegations.
Lawsuit with late success
In 2015 Markus filed suit under the False Claims Act. This US federal law expressly allows US citizens to sue for damages from perpetrators who enrich themselves through criminal activities at the expense of the US federal budget. Any payments then flow into the federal budget, but by law the successful plaintiff is entitled to a 15 to 30 percent reward, which, however, must be fully taxed as income.
The former IT security manager referred in court to 18 government contracts that Aerojet Rocketdyne should never have gotten. Aerojet attempted to have the proceedings dropped. However, this was only partially successful: Eleven of the 18 government contracts were dropped from the process for formal reasons, for example because the contracts were only signed after the lawsuit had been filed.
But Markus did not give up, so that after seven years of proceedings, a courtroom trial with a jury finally took place. The parties were only able to agree on the settlement on the second day of the jury hearing. The case is dropped, Markus receives a gross reward of $2.61 million. That is 29 percent of the payments won, almost the maximum permitted by law.
Orders kept coming
In the meantime, the company has been able to land further orders. For example, in 2020 NASA ordered rocket engines for moon landings from Aerojet Rocketdyne for $1.8 billion. In the same year, the armaments company Lockheed Martin announced that it would take over Aerojet Rocketdyne for $4.4 billion. However, the US competition authority FTC (Federal Trade Commission) prevented this purchase because it would have restricted competition on the armaments market too much.
The process is called United States ex relator Brian Markus v. Aerojet Rocketdyne Holdings Inc., et al. It was pending in the United States District Court for Eastern California at Case No. 2:15-cv-02245.
To home page