Defense contractor Aerojet to pay $9 million over claims it lied to feds about cybersecurity

Aerojet Rocketdyne Holdings Inc., the defense contractor with deep Sacramento roots, has agreed to pay a $9 million fine to resolve accusations that it lied to the federal government about its cybersecurity capabilities.

The settlement, announced Friday by the U.S. Attorney’s Office in Sacramento, stems from a whistleblower lawsuit initially filed by the company’s former senior director of cybersecurity. The ex-employee, Brian Markus, will receive $2.6 million of the settlement as part of the federal False Claims Act.

Contractors that do business with the Defense Department and NASA must meet certain federal standards for cybersecurity to prevent leaks of sensitive government data stored on the companies’ computers. Markus, who joined Aerojet when it was still headquartered in Rancho Cordova in 2014, said in his lawsuit that the rocket-engine manufacturer provided him with about half the staffing and budget he was promised.

Aerojet’s “computer systems failed to meet the minimum cybersecurity requirements,” he said in his lawsuit.

Aerojet did report some shortcomings in its systems to the government in 2014 but gave misleading information about some of its capabilities, Markus said.

When asked if it “had a certain piece of security equipment, they would say ‘yes,’ even though the equipment was sitting in a box and not connected to their computer system,” his lawsuit said. “Defendants represented they had cybersecurity software/hardware installed to protect the systems when in reality the software/hardware in question only covered part of the environment leaving defendants vulnerable to a cyber attack.”

The lawsuit went to trial in April in U.S. District Court in Sacramento. On the second day of trial, the two sides announced they had reached a settlement and the jury was sent home.

The settlement document says the defendants “expressly deny any violation of the False Claims Act or wrongdoing of any kind,” and decided to settle the case to save time and money.

At one time, Aerojet was Sacramento’s leading non-government employer. In the 1950s and 1960s, roughly 20,000 employees built engines for the Apollo moon program and the Cold War effort. The company’s Rancho Cordova complex was open 24 hours a day.

Aerojet has gradually shed much of its Sacramento identity in recent years. After buying Rocketdyne in 2013, it announced three years later it was moving its headquarters to Rocketdyne’s offices in El Segundo. Its manufacturing workforce in Rancho Cordova is long gone, and the company’s workforce in the region was down to 300 employees in 2020.

Its legacy in the Sacramento area is mostly tied up in real estate. Much of its land was designated a Superfund site in 1983 by the federal Environmental Protection Agency, and the company must continue to oversee the cleanup of toxic rocket-fuel chemicals that were dumped in the soil during years of engine testing. At the same time, other land holdings are being converted into residential developments.

Aerojet Rocketdyne agreed to a $4.4 billion takeover by Lockheed Martin Corp. two years ago. But earlier this year, after the Federal Trade Commission sued to block the deal, Lockheed scrapped the purchase.