New York — In a cybersecurity landscape fraught with risks and challenges, Verizon Business Network Services LLC, a subsidiary of Verizon Communications Inc., demonstrated a compelling commitment to rectify past shortcomings. On September 5, the U.S. Department of Justice (DOJ) announced a settlement that saw Verizon agree to pay $4.1 million to resolve specific False Claims Act (FCA) allegations linked to cybersecurity.

The allegations centered around Verizon's Managed Trust Internet Protocol Service (MTIPS), a platform designed to establish secure connections for federal agencies. It came to light that, between 2017 and 2021, the service did not fully adhere to the cybersecurity controls mandated by the U.S. General Services Administration (GSA).

In essence, the government required Verizon to meet specific cybersecurity criteria as part of its contracts, and the company, it seemed, had fallen short. However, instead of evading responsibility or concealing these lapses, Verizon opted for transparency and accountability.

Verizon's swift response involved submitting a written self-disclosure to the GSA when the issues came to their attention. Simultaneously, they launched an independent investigation and compliance review to address the problems head-on. Subsequent detailed self-disclosures were provided to the GSA. This article delves into the confluence of factors within this settlement, examining the broader context of the DOJ's Civil Cyber-Fraud Initiative and its stance on self-disclosure.

The Civil Cyber-Fraud Initiative

Worth noting is that this resolution is only the fourth to emerge since Deputy Attorney General Lisa Monaco unveiled the DOJ's Civil Cyber-Fraud Initiative in October 2021. This initiative aimed to harness the DOJ's expertise in civil fraud enforcement, government procurement, and cybersecurity to combat emerging cyber threats. Although touted with great fanfare, the DOJ has thus far announced only four resolutions under this initiative.

A singular example is the 2022 resolution of U.S. v. Aerojet Rocketdyne Holdings Inc. in the U.S. District Court for the Eastern District of California. Notably, the DOJ chose not to intervene in this case. While the combined settlements under the initiative amount to just over $14 million, this is less than 1% of the DOJ's total FCA recoveries in 2022. Nevertheless, the Verizon settlement showcases the efficacy of the initiative.

Without the impetus of the DOJ's cybersecurity focus, it remains unclear whether Verizon and other companies would have deemed these failures significant enough to warrant a self-disclosure. Undoubtedly, the DOJ has more nonpublic cybersecurity cases or resolutions in the pipeline that are yet to be revealed.

Furthermore, it's crucial to highlight that, under the initiative, the DOJ has resolved allegations not only in healthcare but also in procurement. This illustrates that cybersecurity fraud and its associated allegations are not confined to a specific sector.

A Self-Disclosure Success

The Verizon settlement also underscores the DOJ's commitment to another crucial facet — self-disclosure. It reveals the delicate interplay between the DOJ's assertion of prioritizing cyber-fraud and the practicality of self-disclosure for a company.

The DOJ's self-disclosure policy became a topic of significant discussion in September 2022 when the Criminal Division published a memorandum titled "Further Revisions to Corporate Criminal Enforcement Policies Following Discussions with Corporate Crime Advisory Group." This memo provided comprehensive guidance on timely self-disclosures, among other areas.

Crucially, it states that a corporation can approach the DOJ and disclose misconduct as soon as it becomes aware of any such issues involving employees, even before the misconduct is publicly reported or known to the DOJ.

Indeed, before this memo, the DOJ's Civil Division's Fraud Section had updated its self-disclosure and cooperation policies in May 2019. These updates underlined the significance of self-disclosure and cooperation, emphasizing that entities or individuals that proactively and voluntarily disclose misconduct will receive favorable treatment during the resolution of an FCA case.

The revision of the DOJ's criminal policies in Fall 2022 rejuvenated the focus on self-disclosure among legal practitioners and clients. Companies, when faced with the decision to self-disclose, often deliberate its prudence.

Key Takeaways from Verizon's Self-Disclosure

The Verizon settlement offers several valuable takeaways:

1. Extent of Cooperation and Self-Disclosure: Verizon's commitment to self-disclosure was far-reaching, involving written self-disclosures, independent investigations, compliance reviews, identifying individuals responsible for the issues, participating in damages analysis, and remediating the problems. Such thorough cooperation resulted in a 1.5 multiplier, significantly less than potential exposure under the FCA, which can reach three times the loss to the government plus penalties.
2. Setting the Venue: Companies that self-disclose in a timely manner can often steer the case towards the civil realm, avoiding criminal liability. Once a company's management becomes aware of misconduct, failing to disclose it and continuing such conduct can expose the company to civil and potentially criminal liability. By promptly disclosing misconduct, a company can choose where to disclose it, such as directly to the contracting agency or the DOJ's civil fraud division, and potentially evade severe administrative measures like suspension or exclusion.
3. Decreasing Financial Ramifications: Verizon's self-disclosure and collaboration resulted in a relatively swift resolution, lasting under two years. This not only translated to lower legal and expert expenses but also minimized reputational costs for the company and its shareholders. Furthermore, Verizon's proactive stance may lead to additional contracts with the GSA and other government agencies, ultimately bolstering the company's revenue.

While the approach to alleged FCA misconduct varies depending on the specific case and facts, the Verizon settlement serves as an exemplary case of a self-disclosure executed effectively.