United States v. Aerojet Rocketdyne Holdings, Inc.

381 F. Supp. 3d 1240
CourtDistrict Court, E.D. California
DecidedMay 8, 2019
DocketNo. 2:15-cv-2245 WBS AC
StatusPublished
Cited by17 cases

This text of 381 F. Supp. 3d 1240 (United States v. Aerojet Rocketdyne Holdings, Inc.) is published on Counsel Stack Legal Research, covering District Court, E.D. California primary law. Counsel Stack provides free access to over 12 million legal documents including statutes, case law, regulations, and constitutions.

Bluebook
United States v. Aerojet Rocketdyne Holdings, Inc., 381 F. Supp. 3d 1240 (E.D. Cal. 2019).

Opinion

WILLIAM B. SHUBB, UNITED STATES DISTRICT JUDGE

Plaintiff-relator Brian Markus brings this action against defendants Aerojet Rocketdyne Holdings, Inc. ("ARH") and Aerojet Rocketdyne, Inc. ("AR"), arising from defendants' allegedly wrongful conduct in violation of the False Claims Act ("FCA"), 31 U.S.C. §§ 3729 et seq., and relating to defendants' termination of relator's employment. Defendants now move to (1) dismiss the Second Amended Complaint ("SAC") in part for the failure to state upon which can be granted under Federal Rule of Civil Procedure 12(b)(6), (2) stay proceedings, and (3) compel arbitration.

I. Background

Relator Brian Markus is resident of the State of California. (SAC ¶ 6 (Docket No. 42).) He worked for defendants as the senior director of Cyber Security, Compliance, and Controls from June 2014 to September 2015. (Id. ) Defendants ARH and AR develop and manufacture products for the aerospace and defense industry. (Id. ¶ 7.) Defendants' primary aerospace and defense customers include the Department of Defense ("DoD") and the National Aeronautics & Space Administration ("NASA"), who purchase defendants' products pursuant to government contracts. (See id. ) Defendant AR is a wholly-owned subsidiary of ARH, and ARH uses AR to perform its contractual obligations. (Id. ¶ 8.)

Government contracts are subject to Federal Acquisition Regulations and are supplemented by agency specific regulations. On November 18, 2013, the DoD issued a final rule, which imposed requirements on defense contractors to safeguard unclassified controlled technical information from cybersecurity threats. 48 C.F.R. § 252.204-7012 (2013). The rule required defense contractors to implement specific controls covering many different areas of cybersecurity, though it did allow contractors to submit an explanation to federal officers explaining how the company had alternative methods for achieving adequate cybersecurity protection, or why standards were inapplicable. See id. In August 2015, the DoD issued an interim rule, modifying the government's cybersecurity requirements for contractor and subcontractor information systems. 48 C.F.R. § 252.204-7012 (Aug. 2015). The interim rule incorporated more cybersecurity controls and required *1244that any alternative measures be "approved in writing prior by an authorized representative of the DoD [Chief Information Officer] prior to contract award." Id. at 252.204-7012(b)(1)(ii)(B). The DoD amended the interim rule in December 2015 to allow contractors until December 31, 2017 to have compliant or equally effective alternative controls in place. See 48 C.F.R. § 252.204-7012(b)(1)(ii)(A) (Dec. 2015). Each version of this regulation defines adequate security as "protective measures that are commensurate with the consequences and probability of loss, misuse, or unauthorized access to, or modification of information." 48 C.F.R. § 252.204-7012(a).

Contractors awarded contracts from NASA must comply with relevant NASA acquisition regulations. 48 C.F.R. § 1852.204-76 lists the relevant security requirements where a contractor stores sensitive but unclassified information belonging to the federal government. Unlike the relevant DoD regulation, this NASA regulation makes no allowance for the contractor to use alternative controls or protective measures. A NASA contractor is required to "protect the confidentiality, integrity, and availability of NASA Electronic Information and IT resources and protect NASA Electronic Information from unauthorized disclosure." 48 C.F.R. § 1852.204-76(a).

Relator alleges that defendants fraudulently entered into contracts with the federal government despite knowing that they did not meet the minimum standards required to be awarded a government contract. (SAC ¶ 30.) He alleges that when he started working for defendants in 2014, he found that defendants' computer systems failed to meet the minimum cybersecurity requirements to be awarded contracts funded by the DoD or NASA. (Id. ¶ 36.) He claims that defendants knew AR was not compliant with the relevant standards as early as 2014, when defendants engaged Emagined Security, Inc. to audit the company's compliance. (See id. at ¶¶ 43, 51-53.) Relator avers that defendants repeatedly misrepresented its compliance with these technical standards in communications with government officials. (Id. ¶ 59-64.) Relator alleges that the government awarded AR a contract based on these allegedly false and misleading statements.1 (Id. ¶ 65.) In July 2015, relator refused to sign documents that defendants were now compliant with the cybersecurity requirements, contacted the company's ethics hotline, and filed an internal report. (Id. ¶¶ 81-82.) Defendants terminated relator's employment on September 14, 2015. (Id. ¶ 83.)

Relator filed his initial complaint in this action on October 29, 2015. (Docket No. 1.) While the government was still deciding whether to intervene in this action, relator filed his First Amended Complaint ("FAC") on September 13, 2017. (Docket No.

Free access — add to your briefcase to read the full text and ask questions with AI

Related

Cite This Page — Counsel Stack

Bluebook (online)
381 F. Supp. 3d 1240, Counsel Stack Legal Research, https://law.counselstack.com/opinion/united-states-v-aerojet-rocketdyne-holdings-inc-caed-2019.