Insights

On September 1, 2026, the Eleventh Circuit issued its long-anticipated decision in U.S. ex rel. Zafirov v. Florida Medical Associates LLC, holding that the qui tam provisions of the False Claims Act are constitutional because relators are not officers of the United States who occupy continuing positions established by law. The decision overturned the 2024 district court ruling that sparked a wave of constitutional challenges to qui tam suits and aligns the Eleventh Circuit with the Fifth, Sixth, Ninth, and Tenth Circuits on the issue. The constitutional debate is far from over, however, as the decision is limited to the constitutionality under the Appointments Clause. The court remanded the case for further evaluation of the parties’ Take Care and Vesting Clause arguments. At the same time, similar constitutional arguments are pending in the Third Circuit, related to the largest-ever FCA judgment in a non-intervened case, and multiple Supreme Court justices have already signaled potential willingness to weigh in on the qui tam provisions’ constitutionality. Crowell's FCA attorneys explain these developments and what's next in a “Feature Comment” published in The Government Contractor.

In recent years, the U.S. federal government has taken significant interest in the cybersecurity compliance of its contractor base. In 2025 alone, the U.S. Department of Justice’s (DOJ) Civil Cyber-Fraud Initiative recovered more than $50 million across nine False Claims Act (FCA) cybersecurity fraud settlements, and it has secured almost 20 settlements since its launch in October 2021. Because most defendants facing FCA liability for alleged cybersecurity noncompliance enter into pre-litigation settlements, the last court decision in a cybersecurity FCA case was in 2022. However, earlier this month, on September 2, 2026, in  United States ex rel. Pannek v. Archer Daniels Midland Co., No. 23-cv-15145, 2026 WL 2593317 (N.D. Ill. Sept. 2, 2026), Judge Sunil R. Harjani of the U.S. District Court for the Northern District of Illinois granted a motion to dismiss on materiality grounds and offered additional guidance on what a plaintiff must allege to adequately state an FCA cybersecurity claim.

On Tuesday, August 25, 2026, the U.S. Department of Justice (DOJ) announced that Deloitte LLP and several of its subsidiaries agreed to pay, collectively, $21.5 million to resolve allegations that Deloitte violated the False Claims Act (FCA) by failing to comply with new anti-discrimination requirements incorporated into its federal contracts, by discriminating against employees and applicants on the basis of race and sex, and by allocating and seeking reimbursement for costs related to those practices under its federal government contracts. This resolution is the second of its kind under DOJ’s recently launched Civil Rights Fraud Initiative, following a similar settlement by IBM in April 2026.

On September 1, 2026, the Eleventh Circuit issued its long-anticipated decision in United States v. Florida Medical Associates, LLC, – F.4th –, 2026 WL 2581886 (11th Cir. Sept. 1, 2026) (the “Zafirov appeal”) overturning the district court and holding that the qui tam provisions of the False Claims Act (“FCA”) do not violate the Appointments Clause of Article II of the United States Constitution because relators are not officers of the United States that occupy “continuing positions.” The Eleventh Circuit did not reach other arguments made by the parties and remanded the case to the District Court for the Middle District of Florida to address two other constitutional arguments challenging the FCA’s qui tam provisions based on Article II’s Vesting and Take Care Clauses. 

On June 18, 2026, the U.S. Department of Justice (DOJ) announced that LOGZONE Inc., a defense contractor based in Huntsville, Alabama, agreed to pay $507,144 to resolve allegations that it violated the False Claims Act (FCA) by knowingly failing to satisfy cybersecurity requirements in its contracts with the U.S. Department of the Navy. The resolution is the latest action under DOJ’s Civil Cyber-Fraud Initiative and the first publicly reported settlement this fiscal year. It underscores a continued enforcement posture in which noncompliance with contractual cybersecurity obligations serves as the basis for potential FCA liability. Notably, this settlement did not arise from a whistleblower complaint but from a government-initiated assessment, signaling to contractors that proactive government assessments can pose enforcement consequences.

The Department of Justice (DOJ) and the cross-agency Trade Fraud Task Force have upped the ante by an order of magnitude in the government’s pursuit of customs fraud. On May 1, 2026—only a few months after setting its previous record-high customs-related False Claims Act (FCA) settlement of $54.4 million with Ceratizit USA, LLC—the DOJ shattered that record with a $549.5 million settlement with Perfectus Aluminum Inc., its subsidiary Perfectus Aluminum Acquisitions LLC, and a set of four affiliated warehousing companies. The Perfectus settlement resolves allegations that the defendants violated the FCA by evading antidumping and countervailing duties (AD/CVD). The settlement resolves three separate qui tam complaints filed by two individual relators and the Aluminum Extruders Council, an international industry association. Defendants were previously criminally convicted on charges related to the same scheme, and those convictions were affirmed by the Ninth Circuit in 2024.

On Friday, April 10, 2026, the U.S. Department of Justice (DOJ) announced that International Business Machines Corporation (IBM) has agreed to pay just over $17 million to resolve allegations that it violated the False Claims Act (FCA) by failing to comply with federal anti-discrimination requirements incorporated into its federal contracts due to allegedly discriminatory diversity, equity, and inclusion (DEI) employment practices. This resolution marks the first FCA settlement secured by the DOJ under its Civil Rights Fraud Initiative, created in May 2025, and announced by then-Deputy Attorney General Todd Blanche as part of the administration’s coordinated efforts to target allegedly unlawful DEI practices. Per the agreement, the settlement is neither an admission of liability by IBM nor a concession by the United States that its claims are not well founded.

On March 26, 2026, President Trump issued an executive order (EO) titled Addressing DEI Discrimination by Federal Contractors. The EO declares diversity, equity, and inclusion (DEI) “activities” “unethical and often illegal,” and imposes new obligations on federal contractors and subcontractors related to DEI programming. Contractors that do business with the federal government — or that work as subcontractors for companies that do — should review the EO closely to determine the extent to which they are compliant with the new requirements.

False Claims Act (FCA) settlements and judgments hit record highs yet again in FY 2025, surpassing the previous record by over $1 billion and setting a new high-water mark for the number of new FCA cases filed.  These records were built both on existing enforcement priorities such as pandemic-related fraud and healthcare enforcement actions and new guidance from the Executive Branch instructing the Department of Justice to enforce its 2025 priorities including Diversity, Equity, and Inclusion (DEI), civil rights, and customs issues.  Procurement fraud, cybersecurity issues, and small business fraud also remained focal points, with significant settlements in each of those areas.  In the courts, an Eleventh Circuit decision expanded relators’ ability to use discovery to avoid dismissal under Rule 9(b), and a Ninth Circuit ruling clarified a number of customs fraud issues while applying the Supreme Court’s Schutte scienter test.  Debate over the qui tam provisions’ constitutionality continued to grow, with arguments made in multiple circuits, including an Eleventh Circuit oral argument in the appeal of the Middle District of Florida’s Zafirov decision that helped to spark the recent wave of challenges.  Crowell FCA attorneys explain these developments, trends, and what’s next for the FCA in a “Feature Comment” published in The Government Contractor.

Earlier this month, the Department of Justice (DOJ) announced that Swiss Automation Inc., an Illinois-based precision machining company, agreed to pay $421,234 to resolve allegations that it violated the False Claims Act (FCA) by inadequately protecting technical drawings for parts delivered to Department of Defense (DoD) prime contractors.  This settlement reflects DOJ's persistent emphasis on cybersecurity compliance across all levels of the defense industrial base, reaching beyond prime contractors to encompass subcontractors and smaller suppliers.  The settlement is also a reminder to all contractors not to overlook the often confusing relationship between Controlled Unclassified Information (CUI) and export-controlled information.

On the morning of December 12, 2025, the Eleventh Circuit heard argument in United States ex rel. Zafirov v. Florida Medical Associates, LLC, et al., No. 24-13581 (11th Cir. 2025). This case concerns the constitutionality of the False Claims Act (FCA) qui tam provisions and a groundbreaking September 2024 opinion in which the United States District Court for the Middle District of Florida held that the FCA’s qui tam provisions were unconstitutional under Article II. See United States ex rel. Zafirov v. Fla. Med. Assocs., LLC, 751 F. Supp. 3d 1293 (M.D. Fla. 2024). That decision, penned by District Judge Kathryn Kimball Mizelle, was the first success story for a legal theory that has been gaining steam ever since Justices Thomas, Barrett, and Kavanaugh indicated they would be willing to consider arguments about the constitutionality of the qui tam provisions in U.S. ex rel. Polansky v. Exec. Health Res., 599 U.S. 419 (2023). In her opinion, Judge Mizelle held (1) qui tam relators are officers of the U.S. who must be appointed under the Appointments Clause; and (2) historical practice treating qui tam and similar relators as less than “officers” for constitutional purposes was not enough to save the qui tam provisions from the fundamental Article II infirmity the court identified. That ruling was appealed and, after full briefing, including by the government and a bevy of amici, the litigants stepped up to the plate this morning for oral argument.

On September 30, 2025, the Department of Justice (DOJ) announced that Georgia Tech Research Corporation (GTRC) agreed to pay $875,000 to settle allegations that it violated the False Claims Act (FCA) and federal common law by failing to meet cybersecurity requirements under certain Air Force and Defense Advanced Research Projects Agency (DARPA) contracts.  The settlement adds to the growing list of recoveries under DOJ’s Civil Cyber-Fraud Initiative and is yet another example of DOJ’s ongoing enforcement focus on cybersecurity obligations for federal contractors handling sensitive government information.  The settlement also provides insight into how government contractors may challenge FCA liability when faced with allegations of cybersecurity noncompliance.

On July 31, 2025, the Department of Justice (DOJ) announced that Illumina, Inc. will pay $9.8 million to resolve allegations that it violated the False Claims Act (FCA) by selling genomic sequencing systems with software containing cybersecurity vulnerabilities to federal agencies. This is the first FCA settlement involving claims that a medical manufacturer failed to incorporate adequate product cybersecurity into its software design and development.The allegations were first made in United States ex rel. Lenore v. Illumina Inc., No. 1:23-cv-00372 (D.R.I.), a qui tam action filed by Illumina’s former Director for Platform Management, On-Market Portfolio in September 2023. The relator alleged that, between February 2016 and September 2023, Illumina knowingly sold genomic sequencing systems to government agencies without adequate security programs or quality systems to identify and address software vulnerabilities. The complaint further alleged that Illumina failed to properly resource personnel and processes responsible for product security, did not remediate design features introducing cybersecurity risks, and misrepresented the software’s adherence to required cybersecurity standards.According to the government, Illumina’s actions included:

On July 25, 2025, the Eleventh Circuit Court of Appeals issued its decision in United States ex. rel. Sedona Partners LLC v. Able Moving & Storage Inc. et al., holding that a district court cannot ignore new factual allegations included in an amended complaint filed by a False Claims Act qui tam relator based on the fact that those additional facts were learned in discovery, even while a motion to dismiss for failure to comply with the heightened pleading standard under Federal Rule of Civil Procedure 9(b) is pending.  Under Rule 9(b), allegations of fraud typically must include factual support showing the who, what, where, why, and how of the fraud to survive a defendant’s motion to dismiss.  And while that standard has not changed, Sedona gives room for a relator to file first and seek out discovery in order to amend an otherwise deficient complaint and survive a motion to dismiss, at least in the Eleventh Circuit.  Importantly, however, the Eleventh Circuit clarified that a district court retains the discretion to dismiss a relator’s complaint before or after discovery has begun, meaning that district courts are not required to permit discovery at the pleading stage.  Nevertheless, the Sedona decision is an about-face from precedent in the Eleventh Circuit, and many other circuits, where, historically, facts learned during discovery could not be used to circumvent Rule 9(b) by bolstering a relator’s factual allegations while a motion to dismiss was pending.  While the long-term effects of the decision remain to be seen, in the short term the decision may encourage relators to engage in early discovery in hopes of learning facts that they can use to survive otherwise meritorious motions to dismiss.

On June 23, 2025, the Ninth Circuit issued a long-awaited decision in Island Industries Inc. v. Sigma Corp. affirming a $26M False Claims Act (“FCA”) judgment against the defendant importer.  Sigma had appealed the judgment after a jury found the company violated the FCA by failing to pay customs duties owed to U.S. Customs and Border Protection (“CBP”).  The Ninth Circuit’s decision addresses an important jurisdictional issue and illustrates the significant financial exposure importers can face under the FCA at a time of increased tariffs and enforcement by the government.  

Underscoring the Administration’s intention to eradicate DEI preferences and mandates, the Department of Justice (DOJ) launched a new Civil Rights Fraud Initiative (Initiative) to be co-led by DOJ’s Civil Rights Division and Fraud Section. In response, Crowell launched its own DEI and Civil Fraud Initiative to support clients in managing the heightened risks associated with this new enforcement landscape.

On May 19, 2025, Deputy Attorney General Todd Blanche issued a Memorandum creating the Civil Rights Fraud Initiative that will “utilize the False Claims Act to investigate and . . . pursue claims against any recipient of federal funds that knowingly violates federal civil rights laws.” According to the Memorandum, though racial discrimination has “always been illegal,” the Administration posits that “many corporations and schools continue to adhere to racist policies and preferences—albeit camouflaged with cosmetic changes that disguise their discriminatory nature.” In an effort to prevent federal funds from being used in connection with or support of these purportedly racist policies and preferences, the Initiative will wield the power of the False Claims Act, the government’s most powerful tool to fight fraud, waste, and abuse.

On March 26, 2025, the Department of Justice (DOJ) announced that defense contractor MORSECORP Inc. (MORSE) will pay $4.6 million to settle allegations that MORSE violated the False Claims Act (FCA) by failing to comply with cybersecurity requirements and subsequently submitting false or fraudulent claims for payment in its contracts with the Departments of the Army and Air Force. This is the first FCA settlement that is based on a defense contractor’s failure to reevaluate and promptly update its self-assessment score in the Supplier Performance Risk System (SPRS) after a third-party assessment resulted in a lower score.

FY 2024 saw continued growth in False Claims Act enforcement, with a record year for new qui tam and government-initiated actions, and the highest total recovery in three years. Enforcement of pandemic-related fraud and cybersecurity noncompliance increased, and health care, procurement, and small business fraud violations were again priority areas. A groundbreaking opinion from the District Court for the Middle District of Florida may have teed up a potentially landscape-shifting decision about the viability of the qui tam mechanism in the not too distant future. And a landmark administrative law decision at the U.S. Supreme Court may impact many FCA cases to come. Significant decisions regarding retaliation, excessive fines, the first-to-file rule, and the public disclosure bar were also handed down by courts of appeals. Crowell attorneys discuss these highlights and others in a “Feature Comment” published in The Government Contractor.

Yesterday, less than an hour into the first day of confirmation hearings for attorney general nominee Pam Bondi, Senator Chuck Grassley (R-IA) questioned Bondi on her commitment to defending the constitutionality of the False Claims Act (FCA) if she is confirmed.  Bondi responded that she would “of course” defend the constitutionality of the FCA and that she understands the importance of whistleblowers, the FCA’s protections, and “the money it brings back to our country.”  Senator Grassley’s questioning indicated he was focused on the FCA’s qui tam provisions, as it comes on the heels of U.S. ex rel. Zafirov v. Florida Medical Associates, Inc., -- F.Supp.3d --, 2024 WL 4349242 (M.D. Fla. Sept. 30, 2024), a first-of-its-kind decision from Judge Kathryn Kimball Mizelle, who held that the FCA’s qui tam provisions improperly appoint a relator “an officer of the United States” in violation of the Appointments Clause in Article II of the Constitution, and are therefore unconstitutional.  Senator Grassley appeared to be seeking assurances about Bondi’s willingness to ensure the Department of Justice continues to defend the FCA’s qui tam provisions and commit the resources necessary to do so.