Defense Contractors Are Now Subject to Notice Requirements for Hacked Systems
This post was written by Gunjan Talati and Timothy Nagle. 
The 2013 National Defense Authorization Act (“NDAA”) became the law of the land in early January. This NDAA contains a notice requirement that follows the government trend of the past few years of being required to tattle on yourself. Specifically, the NDAA directs the Department of Defense (“DoD”) to create notice requirements that mandate notification by “cleared” defense contractors to the government if covered networks are successfully penetrated.
A lot of uncertainty surrounds how the DoD will implement these notice requirements and exactly what they will cover. The NDAA explains that the Under Secretary of Defense for Intelligence (in conjunction with other enumerated officials) “shall establish the criteria for designating the cleared defense contractors’ networks or information systems that contain or process information created by or for the [DoD] to be subject to the reporting [requirements].” Thus, the NDAA gives the DoD significant discretion in determining what networks and systems will be covered, and whether unclassified networks and systems will be included.
The NDAA also gives the DoD broad discretion with the procedure for reporting, requiring only that the reporting be “rapid.” The NDAA does, however, outline certain elements a report must have, such as how the system was penetrated, and a sample of the malicious code if available.
The law also requires the DoD to establish a process that gives DoD personnel the authority to access “equipment or information of a contractor necessary to conduct a forensic analysis” to determine if any DoD information was “exfiltrated” by the hack. While the language of the statute appears to limit the access of the DoD to simply determining if information was “exfiltrated,” the actual procedures proposed by the DoD may be a different story. If the DoD drafts procedures that go beyond just determining what was “exfiltrated,” companies will have to grapple with a number of issues, such as the inadvertent release of trade secrets, DoD access to privileged records, and attorney/client communications. As is almost always the case, the true devil will be in the details.
d
Suspension and debarment has long been a remedy available to the government to ensure that it only does business with currently responsible contractors. When a company is suspended or debarred, it is subject to a number of restrictions, primarily not being able to do business with the government as a prime contractor or subcontractor. For a company that does nothing but government contracts, this can be a substantial blow to
On Friday, August 24, the Federal Acquisition Regulation (“FAR”) Council issued a proposed rule that adds a subpart and contract clause to the FAR that would force government contractors to implement basic information-systems safeguards for any non-public information that is provided by or generated for the government. While the proposed rule is intended to plug a hole in the FAR that does not currently require such safeguards, the draft of the rule is so broad that it is not clear what holes it will actually plug. Rather, what we do know is that it adds yet another FAR clause in government contracts to an already long list that companies will have to monitor for compliance. Comments to the proposed rule are due no later than October 23, 2012.
Back in 2000, Professor David C. Wyld published an initial report on the potential of reverse auctions as a government cost-saving tool. Reverse auctions enable sellers to “bid down” prices for their goods and services, and have become an increasing method for federal procurement. In his
Earlier this month, the government issued an interim rule amending the Federal Acquisition Regulation (FAR) to implement set-aside requirements of the Small Business Jobs Act of 2010. The Small Business Jobs Act amended the Small Business Act to require the government to set aside parts of a multiple-award contract for small businesses; set aside orders placed against multiple-award contracts for small businesses; and reserve one or more contract awards for small businesses under full and open multiple-award procurements.