GOVERNMENT CONTRACTING LAW

Transcription

1 AN A.S. PRATT PUBLICATION APRIL 2016 VOL. 2 NO. 4 PRATT S GOVERNMENT CONTRACTING LAW REPORT EDITOR S NOTE: A CURIOUS CASE Victoria Prussen Spears IT S GOOD TO BE THE KING: THE CURIOUS CASE OF UNITED STATES V. JAAAT TECHNICAL SERVICES J. Andrew Howard, Breana Ware, and Janille C. Corbett UNDERSTANDING WHEN AN OVERPAYMENT CAN RESULT IN FALSE CLAIMS LIABILITY AND WHY CURRENT COURT PRECEDENT AND REGULATORY GUIDANCE IS MISTAKEN PART II Robert S. Salcido U.S. FEDERAL CONTRACTORS: ARE YOU UP TO DATE ON ALL NEW REQUIREMENTS? Meghan E. Hill, Christina A. Pate, Jill S. Kirila, and Susan M. DiMickele TWO MORE YEARS: DOD GIVES DEFENSE CONTRACTORS UNTIL DECEMBER 31, 2017 TO COMPLY WITH BASELINE ADEQUATE CYBERSECURITY REQUIREMENTS Ronald D. Lee, Charles A. Blanchard, and Tom McSorley 2015 DOJ FALSE CLAIMS ACT STATISTICS REVEAL TREND SHIFTS AND INCREASING ENFORCEMENT FOR 2016 Suzanne Jaffe Bloom and Benjamin Sokoly

2 PRATT S GOVERNMENT CONTRACTING LAW REPORT VOLUME 2 NUMBER 4 APRIL 2016 Editor s Note: A Curious Case Victoria Prussen Spears 113 It s Good to be The King: The Curious Case of United States v. JAAAT Technical Services J. Andrew Howard, Breana Ware, and Janille C. Corbett 115 Understanding When an Overpayment Can Result in False Claims Liability and Why Current Court Precedent and Regulatory Guidance is Mistaken Part II Robert S. Salcido DOJ False Claims Act Statistics Reveal Trend Shifts and Increasing Enforcement for 2016 Suzanne Jaffe Bloom and Benjamin Sokoly 135 U.S. Federal Contractors: Are You Up to Date on All New Requirements? Meghan E. Hill, Christina A. Pate, Jill S. Kirila, and Susan M. DiMickele 140 Two More Years: DoD Gives Defense Contractors Until December 31, 2017 to Comply With Baseline Adequate Cybersecurity Requirements Ronald D. Lee, Charles A. Blanchard, and Tom McSorley 145

3 QUESTIONS ABOUT THIS PUBLICATION? For questions about the Editorial Content appearing in these volumes or reprint permission, please call: Heidi A. Litman at For assistance with replacement pages, shipments, billing or other customer service matters, please call: Customer Services Department at (800) Outside the United States and Canada, please call (518) Fax Number (518) Customer Service Web site For information on other Matthew Bender publications, please call Your account manager or (800) Outside the United States and Canada, please call (518) Library of Congress Card Number: ISBN: (print) Cite this publication as: [author name], [article title], [vol. no.] PRATT S GOVERNMENT CONTRACTING LAW REPORT [page number] (LexisNexis A.S. Pratt); Michelle E. Litteken, GAO Holds NASA Exceeded Its Discretion in Protest of FSS Task Order, 1 PRATT S GOVERNMENT CONTRACTING LAW REPORT 30 (LexisNexis A.S. Pratt) Because the section you are citing may be revised in a later release, you may wish to photocopy or print out the section for convenient future reference. This publication is sold with the understanding that the publisher is not engaged in rendering legal, accounting, or other professional services. If legal advice or other expert assistance is required, the services of a competent professional should be sought. LexisNexis and the Knowledge Burst logo are registered trademarks of Reed Elsevier Properties Inc., used under license. A.S. Pratt is a registered trademark of Reed Elsevier Properties SA, used under license. Copyright 2016 Reed Elsevier Properties SA, used under license by Matthew Bender & Company, Inc. All Rights Reserved. No copyright is claimed by LexisNexis, Matthew Bender & Company, Inc., or Reed Elsevier Properties SA, in the text of statutes, regulations, and excerpts from court opinions quoted within this work. Permission to copy material may be licensed for a fee from the Copyright Clearance Center, 222 Rosewood Drive, Danvers, Mass , telephone (978) An A.S. Pratt Publication Editorial Office 630 Central Ave., New Providence, NJ (908) (2016 Pub.4938)

4 Editor-in-Chief, Editor & Board of Editors EDITOR-IN-CHIEF STEVEN A. MEYEROWITZ President, Meyerowitz Communications Inc. EDITOR VICTORIA PRUSSEN SPEARS Senior Vice President, Meyerowitz Communications Inc. BOARD OF EDITORS MARY BETH BOSCO Partner, Holland & Knight LLP DARWIN A. HINDMAN III Shareholder, Baker, Donelson, Bearman, Caldwell & Berkowitz, PC J. ANDREW HOWARD Partner, Alston & Bird LLP KYLE R. JEFCOAT Counsel, Latham & Watkins LLP JOHN E. JENSEN Partner, Pillsbury Winthrop Shaw Pittman LLP DISMAS LOCARIA Partner, Venable LLP MARCIA G. MADSEN Partner, Mayer Brown LLP KEVIN P. MULLEN Partner, Jenner & Block VINCENT J. NAPOLEON Partner, Nixon Peabody LLP STUART W. TURNER Counsel, Arnold & Porter LLP WALTER A.I. WILSON Senior Partner, Polsinelli PC iii

5 PRATT S GOVERNMENT CONTRACTING LAW REPORT is published twelve times a year by Matthew Bender & Company, Inc. Copyright 2016 Reed Elsevier Properties SA., used under license by Matthew Bender & Company, Inc. All rights reserved. No part of this journal may be reproduced in any form by microfilm, xerography, or otherwise or incorporated into any information retrieval system without the written permission of the copyright owner. For permission to photocopy or use material electronically from Pratt s Government Contracting Law Report, please access or contact the Copyright Clearance Center, Inc. (CCC), 222 Rosewood Drive, Danvers, MA 01923, CCC is a not-for-profit organization that provides licenses and registration for a variety of users. For subscription information and customer service, call Direct any editorial inquires and send any material for publication to Steven A. Meyerowitz, Editor-in-Chief, Meyerowitz Communications Inc., Grand Central Parkway Suite 18R, Floral Park, New York 11005, smeyerowitz@meyerowitzcommunications.com, Material for publication is welcomed articles, decisions, or other items of interest to government contractors, attorneys and law firms, in-house counsel, government lawyers, and senior business executives. This publication is designed to be accurate and authoritative, but neither the publisher nor the authors are rendering legal, accounting, or other professional services in this publication. If legal or other expert advice is desired, retain the services of an appropriate professional. The articles and columns reflect only the present considerations and views of the authors and do not necessarily reflect those of the firms or organizations with which they are affiliated, any of the former or present clients of the authors or their firms or organizations, or the editors or publisher. POSTMASTER: Send address changes to Pratt s Government Contracting Law Report, LexisNexis Matthew Bender, 630 Central Avenue, New Providence, NJ iv

6 BASELINE ADEQUATE CYBERSECURITY REQUIREMENTS Two More Years: DoD Gives Defense Contractors Until December 31, 2017 to Comply With Baseline Adequate Cybersecurity Requirements By Ronald D. Lee, Charles A. Blanchard, and Tom McSorley * Recently, the Department of Defense modified its contractor cybersecurity and cloud computing interim rule, extending the date on which all defense contractors must be compliant with a baseline set of adequate security requirements. The authors of this article discuss the new interim rule. At the eleventh hour (or, really, past the stroke of midnight), the Department of Defense ( DoD ) issued a short modification to its contractor cybersecurity and cloud computing interim rule, primarily to push back the date on which all defense contractors must be compliant with a baseline set of adequate security requirements from now to December 31, The new interim rule otherwise modestly amends the interim rule that DoD implemented in August. THE NEW INTERIM RULE In particular, and most importantly, the new interim rule amends Defense Federal Acquisition Regulation Supplement ( DFARS ) clause , Safeguarding Covered Defense Information and Cyber Incident Reporting, which requires (in the absence of other requirements specific to a particular contract or the approval of alternative measures) that all contractors with systems that store, transmit, or process covered defense information ensure that such covered systems meet the security requirements of National Institute of Standards and Technology ( NIST ) Special Publication ( SP ) * Ronald D. Lee is a partner at Arnold & Porter LLP advising and representing clients in national security, cybersecurity and privacy, and government contracts matters. Charles A. Blanchard, a partner at the firm, represents U.S. and foreign defense and aerospace companies on a wide range of national security and government contracts issues. Tom McSorley, an associate at the firm, advises and represents clients in national security, cybersecurity and privacy, and government contracts matters. The authors may be reached at ronald.lee@aporter.com, charles.blanchard@aporter.com, and tom.mcsorley@aporter.com, respectively. 1 See Federal Register, Defense Federal Acquisition Regulation Supplement: Network Penetration Reporting and Contracting for Cloud Services, available at federalregister.gov/articles/2015/12/30/ /defense-federal-acquisition-regulationsupplement-network-penetration-reporting-and-contracting-for. 145

7 GOVERNMENT CONTRACTING LAW REPORT The original interim rule provided that contractors were obligated to meet, without exception, the requirements of NIST SP at the time of contract award. The revised clause now provides that contractors must meet the requirements as soon as practical, but not later than December 31, This two-year extension is significant, and indicates that DoD recognized the contractor concerns over compliance with the interim rule that were raised in the rulemaking docket and at the Industry Day public meeting that DoD held on December 14. In exchange for this two-year extension, however, DoD is requiring all contractors to report, within 30 days of contract award, any security requirements specified by NIST SP not implemented at the time of contract award[.] DoD explains in the preamble to the new interim rule that this reporting requirement will enable DoD to: (1) monitor progress across the Defense industrial base ; (2) identify trends in the implementation of these requirements and, in particular, identify issues with industry implementation of specific requirements that may require clarification or adjustment ; and (3) inform the Department in assessing the overall risk to DoD covered defense information on unclassified contractor systems and networks. In addition to the two-year extension, DoD also modified the original interim rule to indicate that contractors can seek DoD Chief Information Officer approval before and, now, after contract award of alternative security measures to NIST SP that provide an equivalent level of protection. The newly issued rule also slightly curtails the clause flowdown requirement (the original rule required flowdown to all subcontractors full stop; the new rule requires flowdown only to subcontracts, or similar contractual instruments, for operationally critical support, or for which subcontract performance will involve a covered contractor information system, including subcontracts for commercial items ). In practice, the flowdown requirement will likely remain broad, given the broad applicability of the rule, and the revised rule also clarifies that the clause must be flowed down without alteration, except to identify the parties. Finally, the revised rule includes a technical change to the definition of cyber incident to make it uniform across all parts of the interim rule. WHAT THE REVISIONS DO NOT ADDRESS The revisions DoD released are also notable for what they do not address: Despite significant contractor concerns about the broad definitions of covered defense information and cyber incident, those definitions remain un- 146

8 BASELINE ADEQUATE CYBERSECURITY REQUIREMENTS changed, as do all of the elements of the cyber incident reporting provisions in the interim rule which are the source of much controversy. In short, while the two-year extension for contractors to attain full compliance with NIST SP is a response to many concerns regarding the adequate security elements of the interim rule, the revisions do not begin to address all of the concerns voiced by the many stakeholders engaged in this process. WHAT CONTRACTORS SHOULD DO NOW Defense contractors subject to the rule should, if they have not already, audit their systems for compliance with NIST SP , be prepared to identify non-implemented requirements of SP , and ensure that they are prepared to meet the cyber incident reporting requirements of the interim rule. The rule may be subject to additional modifications as DoD continues to refine it in response to public comments and information gathered from contractors, but the rule is likely here to stay in a form similar to the interim rule currently in effect. 147