In a groundbreaking lawsuit, the US Department of Justice (DoJ) has taken legal action against the Georgia Institute of Technology and its cybersecurity lab, led by Dr. Emmanouil 'Manos' Antonakakis.

The lawsuit alleges numerous failures to comply with mandatory security protocols for Department of Defense (DoD) research projects, putting sensitive government data at risk.

The core issue revolves around the lab's non-compliance with the National Institute of Standards and Technology Special Publication 800-171, which outlines critical security measures for handling controlled unclassified information. One of the most significant concerns is the absence of endpoint antivirus software on devices accessing or storing sensitive information. This oversight, according to the lawsuit, heightened the risk of unauthorized access and potential data breaches.

Moreover, the lawsuit accuses Georgia Tech and Antonakakis of knowingly submitting invoices for DoD projects while being aware of their non-compliance with security requirements, effectively defrauding the Department of Defense. Antonakakis reportedly opposed the installation of antivirus software, labeling it a 'nonstarter' and opting to rely solely on the school's firewall. This resistance, coupled with Georgia Tech's self-assessment score of 98 out of 110 for its security controls, paints a picture of negligence and a disregard for cybersecurity best practices.

The lawsuit also reveals a broader cultural issue at Georgia Tech, where cybersecurity compliance was viewed as burdensome. Researchers, who played a crucial role in securing substantial government contracts, often influenced the institution to bypass compliance, prioritizing financial benefits over security obligations.

The case came to light through whistleblowers within Georgia Tech's IT staff, who exposed the institution's failure to meet its cybersecurity obligations. The DoJ's lawsuit serves as a stern warning to academic institutions: compliance with security obligations is paramount when federal funding is involved.

Unsecured Government Data? DoJ Sues Georgia Tech over Cybersecurity Negligence

Actions