ILC Dover LP and its affiliate ILC Astrospace LLC, Delaware-based subsidiaries of Ingersoll Rand that manufacture NASA spacesuits and protective equipment for the U.S. Army, agreed to pay $13 million to resolve False Claims Act allegations that they knowingly fell short of mandatory cybersecurity requirements while certifying compliance across a span of nearly seven years, from January 2018 through October 2024. The failures touched contracts with three separate federal customers: the Department of the Army, the Missile Defense Agency, and NASA. According to the government’s allegations, the companies did not fully implement the security controls required by NIST Special Publications 800-171 and 800-53, relied on a third-party cloud provider without verifying that it met FedRAMP Moderate-equivalent protections, submitted system security plans that were either missing or outdated, and failed to provide current NIST SP 800-171 self-assessments to the Department of Defense as those contracts required.
The case began when Philip Root, who served as ILC Dover’s Director of Cybersecurity, filed a sealed qui tam complaint in January 2025 after observing these compliance shortfalls in the course of his work. DOJ intervened and announced the settlement on November 3, 2026, crediting the Civil Cyber-Fraud Initiative, a DOJ program launched in October 2021 to pursue cybersecurity fraud through the False Claims Act, with driving the recovery. DOJ described the $13 million figure as the largest government cybersecurity fraud recovery to date under that initiative. Root received $2.35 million as his relator’s share. The investigation involved the DOJ Civil Division, the U.S. Attorney’s Office for the District of Delaware, NASA’s Office of Inspector General, the Defense Criminal Investigative Service, and the Army Criminal Investigation Division.
The specific compliance gaps alleged here, cloud hosting without confirmed FedRAMP authorization, stale or absent security plans, and unfiled DoD assessment scores; are precisely the documentation and verification failures that federal cybersecurity contract requirements are designed to surface and correct. ILC Dover and ILC Astrospace held contracts with agencies responsible for missile defense systems and human spaceflight hardware, contexts in which cybersecurity attestations carry direct national security implications. For prospective whistleblowers, the case illustrates that a relator who occupies a senior technical compliance role and can document the gap between a contractor’s internal security posture and its contractual representations has the foundation for a viable qui tam action, even when the alleged misconduct is administrative and documentation-based rather than involving overt falsification of invoices or cost figures.