U.S. Department of Justice Files Lawsuit Against Georgia Tech for Cybersecurity Failures

The U.S. Department of Justice has taken legal action against the prestigious Georgia Institute of Technology, commonly known as Georgia Tech, and its research corporation for allegedly failing to meet crucial cybersecurity standards in contracts with the Department of Defense. The lawsuit, filed alongside a whistleblower complaint, accuses the defendants of jeopardizing the confidentiality of sensitive government information.

The lawsuit highlights lapses at the Astrolavos Lab within Georgia Tech, where a system security plan required by Department of Defense regulations was reportedly not developed and implemented until February 2020. Even after its implementation, the plan was allegedly not properly scoped to include all necessary equipment, such as laptops, desktops, and servers. Additionally, the lab failed to install and update anti-virus and anti-malware tools on its devices, despite federal law and Georgia Tech policies mandating such measures.

Special Agent in Charge Darrin K. Jones of the DoD’s Office of Inspector General emphasized the significant threat posed by cybersecurity deficiencies to national security and the safety of armed services personnel. The lawsuit also accuses Georgia Tech of submitting a false cybersecurity assessment score to the DoD for the entire campus, further highlighting the alleged lack of compliance with cybersecurity requirements.

If found liable, Georgia Tech and its research corporation could face penalties of up to three times the government’s losses, in addition to fines. U.S. Attorney Ryan K. Buchanan stressed the importance of cybersecurity for government contractors, stating that those who disregard security measures will be held accountable. The case is being handled by the Justice Department’s Civil Division and the U.S. Attorney’s Office for the Northern District of Georgia.