What is the False Claims Act (FCA)?

What is the False Claims Act? 

The False Claims Act is intended to reach all fraudulent attempts to cause the Government to pay out sums of money or to deliver property or services. The FCA imposes liability on any person (or entity) who knowingly presents, or causes to be presented, a false or fraudulent claim to the government. 

Many of the Fraud Section’s cases are suits filed under the False Claims Act (FCA), 31 U.S.C. §§ 3729 – 3733, a federal statute originally enacted in 1863 in response to defense contractor fraud during the American Civil War. The FCA provided that any person who knowingly submitted false claims to the government was liable for double the government’s damages plus a penalty of $2,000 for each false claim.  The FCA has been amended several times and now provides that violators are liable for treble damages plus a penalty that is linked to inflation.  In addition to allowing the United States to pursue perpetrators of fraud on its own, the FCA allows private citizens to file suits on behalf of the government (called “qui tam” suits) against those who have defrauded the government.  Private citizens who successfully bring qui tam actions may receive a portion of the government’s recovery.  Many Fraud Section investigations and lawsuits arise from such qui tam actions.

The Department of Justice obtained more than $5.6 billion in settlements and judgments from civil cases involving fraud and false claims against the government in the fiscal year ending Sept. 30, 2021.  More information about those recoveries can be found here and the 2021 FCA statistics can be found here.

Source: The False Claims Act (justice.gov)

How does the False Claims Act relate to Cybersecurity?

On October 6th, 2021, the U.S. Department of Justice (DOJ) announced the launch of its new Civil Cyber-Fraud Initiative — an effort designed to harness the department’s knowledge in civil fraud enforcement, government procurement and cybersecurity to combat emerging (and escalating) cyber threats. The initiative comes on the heels of the DOJ’s comprehensive, 120-day review into its cybersecurity strategy for defending and deterring cyber threats. According to the announcement, the initiative’s aim is to “hold accountable” those entities and individuals that put sensitive U.S. information at risk by failing to comply with federal cybersecurity requirements.

For purposes of the FCA, the “knowing” and “knowingly” standard means that a person 1) has actual knowledge of the information; 2) acts in deliberate ignorance of the truth or falsity of the information; or 3) acts in reckless disregard of the truth or falsity of the information. 31 U.S.C. § 3729(b). Importantly, no proof of specific intent to defraud is required.

The DOJ’s announcement is part of the federal government’s larger effort to improve the nation’s cybersecurity. Other efforts include President Joe Biden’s Executive Order on Improving the Nation’s Cybersecurity, issued in May 2021, in which President Biden declared “bold changes and significant investments” were needed in order to defend and protect information systems that process, store or transmit sensitive federal information – whether cloud-based, on-premises or hybrid. (See Holland & Knight’s previous blog post, “Cybersecurity for All: President Biden Issues Sweeping Cybersecurity Executive Order,” May 13, 2021). The president issued the Executive Order in response to a wave of recent cyberattacks, such as those against SolarWinds. The U.S. Department of Defense (DoD) is also in the process of reviewing its Cybersecurity Maturity Model Certification (CMMC) program that would require all DoD contractors and subcontractors not selling commercial off-the-shelf (COTS) products to obtain a third-party cybersecurity certification. As it is now, certain DoD contractors are required to comply with cybersecurity self-certification requirements.

However, FCA cybersecurity actions aren’t (that) new. There has been an uptick in cybersecurity-based FCA actions in recent years, predominantly qui tam actions filed by former employees that “blew the whistle” on their company’s deficient cybersecurity standards and practices.  

Deputy Attorney General Lisa O. Monaco Announces New Civil Cyber-Fraud Initiative

DoD Uses False Claims Act to Stop 800-171 Contractor Fraud

As part of the CMMC roll-out, DoD subcontractors must now audit their cybersecurity and post scores and PoAM info to the Supplier Performance Risk System. Department of Defense (DoD) contractors have been required (by law) to be 100% compliant with the NIST SP 800-171 regulation since December 2017 and contractors have been “self-certifying” their compliance with that requirement. Thus the DoD has been forced to implement the Cybersecurity Maturity Model Certification (CMMC) program which requires contractors to have their cybersecurity programs certified by a third party before they can be awarded any DoD contracts. But the sheer enormity of the U.S. Defense Industrial Base (DIB) and the complexity of cybersecurity means that it will take up to 5 years to fully implement the CMMC. All Companies that do business with the DoD will have to fully certify their CMMC compliance by October 1, 2025, passing an audit performed by a DoD accredited auditor. Level 1 is where the DoD expects most firms to be currently, with select practices being documented where required. Therefore over the last 18 months, the Defense Contract Management Agency (DCMA) has been auditing contractors for NIST SP 800-171 compliance. 

But what is truly different (and most significant) about this particular audit process is that all contractors now must post their cybersecurity audit scores to the DoD Supplier Performance Risk System (SPRS) portal for all agencies to view. And not only do contractors have to post their cybersecurity audit scores, they must also post the date that they intend to be 100% NIST SP 800-171 compliant based on a written plan of action with milestones (PoAM).

And the Department of Justice is using the False Claims Act to crack down on contractors who are exposed as fraudulently claiming that their security practices meet 800-171 requirements. The Department of Justice recovered $5.6B in 2021 using the False Claims Act as its hammer.

Source: DoD Uses False Claims Act to Stop 800-171 Contractor Fraud – EIN Presswire (einnews.com)

Takeaways and Considerations

For contractors, now is a good time to review your organization’s cybersecurity practices and ensure they are in compliance with federal regulations. Take a close look at your federal prime and subcontracts — any of the following could potentially serve as a basis for an FCA enforcement action:

• FAR 52.204-21, Basic Safeguarding of Covered Contractor Information Systems: Requires contractors to employ certain “basic” security controls, such as limiting access, authenticating users and identifying system flaws in a “timely manner.
• DFARS 252.204-7012, Safeguarding Covered Defense Information and Cyber Incident Reporting: Requires contractor information systems to comply with the cybersecurity requirements in National Institute of Standards and Technology (NIST) Special Publication (SP) 800-171. The clause also requires reporting of “cyber incidents” within 72 hours and other mitigation measures.
• DFARS 252.204-7020, NIST SP 800-171 DoD Assessment Requirements: Applies to covered contractor information systems that are required to comply with NIST SP 800-171, in accordance with the -7012 clause. This clause requires contractors to provide access to their facilities, systems and personnel necessary for the government to conduct a NIST SP 800-171 DoD Assessment, as described in NIST SP 800–171 DoD Assessment Methodology (latest version, version 1.2.1 (June 24, 2020)).
• DFARS 252.204-7019, Notice of NIST SP 800-171 DoD Assessment Requirements: Requires offerors, as a prerequisite for award, to perform and hold a current (i.e., not more than three years old) NIST SP 800-171 DoD Assessment for each covered contractor information system that is relevant to the offer, contract, task or delivery order. This can initially be accomplished by entering NIST SP 800-171 compliance information within the DoD-operated Supplier Performance Risk System (SPRS) database.
• DFARS 252.204-7021 Contractor Compliance with the CMMC Level Requirement: Requires contractors to have a current CMMC certificate at the CMMC level required by the contract, and to maintain that certificate for the duration of the contract. CMMC only builds upon DFARS 252.204-7012 and having the security measures required by DFARS -7012 (i.e., NIST SP 800-171 requirements) in place is the first step toward CMMC certification.

These clauses are aimed at ensuring contractors implement robust cybersecurity measures to protect sensitive federal information residing in their information systems. Where these protections are a material requirement of payment under a government contract, the knowing failure to implement such protections or report vulnerabilities could give rise to liability under the FCA. 

Although DOJ’s Civil Division is launching the initiative, it does not preclude parallel government enforcement actions, including criminal prosecutions, where potential criminal liability is found. It is not uncommon for the DOJ to initiate criminal proceedings based off the same factual allegations underlying qui tam complaints and DOJ civil fraud investigations, especially as the FCA shares elements in common to criminal statutes where there is criminal intent. For example, 18 U.S.C. § 287, criminalizes making false, fictitious or fraudulent claims upon the United States or conspiring to do so. As a result, this Civil Cyber-Fraud Initiative could lead to increased coordination between the criminal and civil divisions in the cyber arena.

For more information on the DOJ’s Civil Cyber-Fraud Initiative, the FCA or any of the issues raised above, contact the authors.

Source: False Claims Act Meets Cybersecurity: DOJ’s New Civil Cyber-Fraud Unit | Insights | Holland & Knight (hklaw.com)

The Current Version of the False Claims Act Prohibits Seven Types of Action

The current version of the False Claims Act identifies seven violations, any of which is a violation of the False Claims Act:

1. False Claims – Presenting, or causing the presentment, of a false claim for payment or approval. 31 U.S.C. §§ 3729(a)(1)(A).
2. False Records or Statements – Making, using, or causing others to make or use, a false record or statement that is material to a false or fraudulent claim. 31 U.S.C. §§ 3729(a)(1)(B).
3. Conspiracy – Conspiring to violate the False Claims Act. 31 U.S.C. §§ 3729(a)(1)(C).
4. Conversion –  Failing to return government property. 31 U.S.C. §§ 3729(a)(1)(D).
5. False Receipts – Making or delivering a receipt of government property without completely knowing that the information in it is true. 31 U.S.C. §§ 3729(a)(1)(E).
6. Unlawful purchase of Government Property – Buying public property from a government employee who may not lawfully sell it. 31 U.S.C. §§ 3729(a)(1)(F).
7. Reverse False Claims – Making, using, or causing to be made or used, a false record or statement material to an obligation to pay money to the government; or conceals, avoids, or decreases an obligation to pay money to the government. 31 U.S.C. §§ 3729(a)(1)(G).

Congress Explained That Many Different Fraudulent Actions Violate the False Claims Act

In 1986, as part of major revisions of the False Claims Act.  The Senate issued a report explaining how the law worked and how it was supposed to work. Congress explained that False claims under the statute take many forms the most common being a claim for goods or services not provided, or provided in violation of contract terms, specification, statute, or regulation. S. Rep. No. 99-345, at 9-10, reprinted in 1986 U.S.C.C.A.N. at 5274.

The report also offers several examples of actions that congress believed would violate the False Claims Act.

• In Health Care – A false claim for re­imbursement under the Medicare, Medicaid or similar program.
• A false application for a loan from a Government agency.
• A false claim in connection with a sale financed by Government Agencies such as the Agency for International Development or Export-Import Bank.
• Any claims made by individuals ineligible to participate in a program.
• Cashing a Government check, which was wrongfully or mistakenly obtained.
• A fraudulent attempt to pay the Government less than is owed in connection with any goods, services, concession, or other benefits provided by the Government is also a false claim under the act.

S. Rep. No. 99-345, at 9-10, reprinted in 1986 U.S.C.C.A.N. at 5274.  Further, these claims may be false even though the services are provided as claimed. This can happen when someone is is ineligible to participate in the program, or obtains loans based on false statements.

Source: False Claims Act Violations & Prohibitions Explained – Whistleblower Law (whistleblowerllc.com)

Federal and State Law Protects Employee Whistleblowers Who Expose Fraud Against the Government.

Not only is your employer prohibited by law from firing you for reporting illegal activity – but you may also be entitled to a monetary reward from the government for exposing fraud.

Federal and state laws prohibit companies from defrauding the government, including healthcare fraud (e.g, Medicare, Medicaid, TRI-CARE, and more), defense contractor fraud, insurance fraud, securities regulation and financial fraud (e.g, fraud on shareholders), tax fraud, fraud on farm and education programs, and more.

Because nobody wants companies to be able to steal from taxpayer coffers, individuals who report fraud on the government are protected as whistleblowers under state and federal laws, such as the False Claims Act, Dodd-Frank Wall Street Reform and Consumer Protection Act, Sarbanes-Oxley, and more. These whistleblowers (sometimes called “relators”) are entitled to monetary rewards for exposing the fraud.

Violations of these laws and their state equivalents can result in serious monetary penalties. For example, in the case of the False Claims Act, judgments can be up to three times the amount of losses sustained by the government, plus civil fines. Additionally, people and companies can be subject to criminal prosecution for their perpetuation of the fraud.

Many of the Fraud Section’s cases are suits filed under the False Claims Act (FCA), 31 U.S.C. §§ 3729 – 3733, a federal statute originally enacted in 1863 in response to defense contractor fraud during the American Civil War.

The FCA provided that any person who knowingly submitted false claims to the government was liable for double the government’s damages plus a penalty of $2,000 for each false claim.  The FCA has been amended several times and now provides that violators are liable for treble damages plus a penalty that is linked to inflation. 

In addition to allowing the United States to pursue perpetrators of fraud on its own, the FCA allows private citizens to file suits on behalf of the government (called “qui tam” suits) against those who have defrauded the government.  Private citizens who successfully bring qui tam actions may receive a portion of the government’s recovery.  Many Fraud Section investigations and lawsuits arise from such qui tam actions.

The Department of Justice obtained more than $5.6 billion in settlements and judgments from civil cases involving fraud and false claims against the government in the fiscal year ending Sept. 30, 2021.  More information about those recoveries can be found here and the 2021 FCA statistics can be found here.

Who can be a Whistleblower?