ATLANTA — The Department of Justice announced on Thursday a complaint against the Georgia Institute of Technology, alleging the school had a culture of non-enforcement of cybersecurity regulations for "star researchers" who were obtaining large government contracts.
Georgia Tech called the complaint "entirely off base," and the school said it would "vigorously dispute it in court."
The complaint, announced by the U.S. Attorney's Office in Atlanta, alleges that the school's research arm that obtains federal contracts, the Georgia Tech Research Corporation, "failed to meet cybersecurity requirements" on such contracts with the Department of Defense across a period from May 2019 to as late as December 2021.
In a release, the U.S. Attorney's Office said: "Georgia Tech, the suit alleges, routinely acquiesced to the demands of 'star researchers' — who were treated like 'star quarterbacks' because they secured large government contracts — when those researchers 'pushed back' on cybersecurity compliance because the researchers found it troublesome."
Georgia Tech, however, said the case "has nothing to do with confidential information or protected government secrets."
"The government told Georgia Tech that it was conducting research that did not require cybersecurity restrictions, and the government itself publicized Georgia Tech’s groundbreaking research findings. In fact, in this case, there was no breach of information, and no data leaked," a school statement said. "Despite the misguided action by the Department of Justice, Georgia Tech remains committed to strong cybersecurity and continuing its collaborative relationship with the Department of Defense and other federal agencies."
A release by U.S. Attorney for the Northern District of Georgia Ryan K. Buchanan specifies a Georgia Tech lab, Astrolavos Lab, that allegedly failed to properly implement cybersecurity protocols in at least two instances, including a failure to use anti-virus software on hardware and networks at the lab "to satisfy the demands of the professor who headed the lab." It further accused Tech of submitting a falsified cybersecurity compliance score, required to obtain Department of Defense contracts, for campus systems "used to store or access covered defense information."
Tech, in its response, said: "We are extremely disappointed by the Department of Justice’s filing, which misrepresents Georgia Tech’s culture of innovation and integrity."
To read the DOJ's full release, click here.