Georgia Tech Research Corporation Agrees to Pay $875,000 to Resolve Civil Cyber-Fraud Litigation

Georgia Tech Research Corporation has agreed to pay $875,000 to resolve allegations under the False Claims Act and federal common law that it failed to meet cybersecurity requirements in connection with Air Force and DARPA contracts.

The settlement resolves a civil action brought by the United States, which alleged that until December 2021 GTRC and Georgia Tech failed to install, update or run anti-virus or anti-malware tools on desktops, laptops, servers and networks at Georgia Tech’s Astrolavos Lab, where sensitive cyber-defence research was conducted for DoD.

It also contends that until at least February 2020 there was no system security plan for the Astrolavos Lab to outline required cybersecurity controls, and that in December 2020 a false summary level cybersecurity assessment score of 98 was submitted to DoD, premised on a fictitious or virtual environment and not applicable to any actual covered contracting system.

The settlement follows a qui tam action filed by Christopher Craig and Kyle Koza, former Georgia Tech cybersecurity team members, with the United States intervening in August 2024 and Craig and Koza receiving $201,250 as their share of the recovery. The case caption is United States ex rel. Craig v. Georgia Tech Research Corporation et al., No. 1:22-cv-02698 (N.D. Ga.), and the matter involved coordination between the Justice Department’s Civil Division, the U.S. Attorney’s Office for the Northern District of Georgia, DCIS, AFOSI and DARPA. Updated September 30, 2025.