Current Month (October 2025)
Business Crimes & Corporate Compliance
Georgia Tech Research Corporation Settles Civil False Claims Act Case
By Margaret M. Cassidy, Cassidy Law PLLC
It can cost an organization a lot of money if it tells the U.S. government that it has cybersecurity controls in place when it does not in fact have the controls in place.
Georgia Tech Research Corporation (“GTRC”) learned this when it resolved Department of Justice (“DOJ”) allegations that it misrepresented its cybersecurity for $875,000. United States ex rel. Craig v. Georgia Tech Research Corp., No. 1:22-cv-02698 (N.D. Ga.).
GTRC had contracts with the U.S. Air Force and the Defense Advanced Research Projects Agency (“DARPA”) for cyber-defense research performed at the Astrolavos Lab of the Georgia Institute of Technology (“Georgia Tech”), an affiliate of GTRC.
These contracts included Defense Federal Acquisition Regulation Supplement (“DFARS”) requirements obligating contractors and subcontractors to have defined cybersecurity controls, to assess the quality of those controls, and to report the assessment score to the Department of Defense (“DoD”). According to DOJ, Georgia Tech’s Astrolavos Lab did not have the required controls in place and misrepresented its assessment score.
More specifically, DOJ claimed that GRTC and Georgia Tech violated the False Claims Act (31 U.S.C. § 1379, et seq.) by not having antivirus and antimalware tools on their computer devices, servers, and networks when their government contracts required that they do so. DOJ also pled in its civil complaint against GRTC and Georgia Tech that the Astrolavos Lab did not have a cybersecurity plan for protecting against unauthorized access of sensitive defense information as required by their government contracts.
The Astrolavos Lab was also required to assess its cybersecurity controls and provide the results to the DoD. DOJ asserted that the assessment results provided were false because, among other things, the assessment was supposedly of Georgia Tech’s “campus-wide” IT system when there is no such system. Rather, DOJ claimed that the assessment was of a virtual IT environment, which according to Georgia Tech employees did not exist. According to DOJ, the Astrolavos Lab should have assessed its IT system since it was the entity with the sensitive defense information. It did not, and according to DOJ’s complaint it did not want to “bother” with its cybersecurity obligations.”
The issues came to light when two former Georgia Tech cybersecurity employees filed a False Claims Act case against GTRC and Georgia Tech asserting they did not comply with cybersecurity regulations included in their contracts, which DOJ intervened in.
When announcing the settlement, prosecutors made clear that DOJ will continue filing False Claims Act cases against contractors who fail to implement required cybersecurity controls, since doing so exposes sensitive government information to exploitation by bad actors.
As a new DFARS takes effect in November requiring defense contractors to not only implement cybersecurity controls but also to file Cybersecurity Maturity Model Certifications on the status of their cybersecurity (48 C.F.R. § 252.204-7021), defense contractors need to be sure to implement the required controls and be sure certifications are accurate or risk investigation and prosecution.
Sixth Circuit Says It Again: Outside Counsel’s Internal Investigations Are Privileged and Protected from Disclosure
By Sarah M. Hall, Epstein Becker Green
In summer 2025, the U.S. Court of Appeals for the Sixth Circuit issued a strongly worded decision in In re FirstEnergy Corporation (No. 24-3654)—confirming the core concept that internal investigations conducted by counsel and in anticipation of litigation are privileged and protected from disclosure. When securities plaintiffs in the case sweepingly sought all documents “related to the internal investigation,” the district court ordered their production. After much legal wrangling, the Sixth Circuit rebuked the district court on August 7, 2025, and reaffirmed in a per curiam opinion filed October 3, 2025.
The Sixth Circuit restated what corporate America’s legal departments can and should rely upon: that internal investigations led by legal counsel are and will remain privileged. This opinion affirms the intent of the privilege: to allow companies to receive privileged legal advice in the course of internal investigations, uncover potential risk areas, and take remedial action—without worrying that the investigation will become public at some later point.
The relevant background of this case is as follows. Following the federal indictment of the former speaker of the Ohio House of Representatives, Larry Householder, and related Department of Justice investigations into FirstEnergy, an Ohio public utilities company, shareholders brought a securities class action seeking documents regarding the company’s internal investigations. The district court ordered the company to produce the documents, and the company moved to stay that order pending resolution of its petition for a writ of mandamus. The Sixth Circuit granted the stay on August 7, 2025, concluding that the company was likely to succeed on its arguments since the lower court incorrectly applied the attorney-client privilege and work-product doctrines—and that it faced irreparable harm.
The Sixth Circuit relied on Upjohn v. United States, 449 U.S. 383 (1981), the seminal 1981 U.S. Supreme Court case holding that the attorney-client privilege applies when companies seek legal advice through internal investigations in response to civil and criminal investigations. The Sixth Circuit firmly held, “What matters for attorney-client privilege is not what a company does with its legal advice, but simply whether a company seeks legal advice.”
Addressing the attorney work-product doctrine, the Sixth Circuit held that the documents generated by the internal investigation existed owing to the company’s “‘reasonable’ anticipation of litigation, as opposed to its ordinary business purposes,” meaning that the attorney work-product doctrine also likely applied. The Sixth Circuit found a strong public interest in preserving both the attorney-client privilege and the work-product doctrine.
The October 3, 2025, per curiam opinion again granted the company’s motion for a stay and vacated the district court’s production order. The Sixth Circuit held that the district court rulings amounted to legal error that was sufficiently exceptional to warrant mandamus relief—again relying on Upjohn and the established principle that the work product doctrine applies to documents “prepared in anticipation of litigation,” Fed. R. Civ. P. 26(b)(3), meaning “because of” a “reasonable” anticipation as opposed to ordinary business purposes, In re Pros. Direct Ins. Co., 578 F.3d 432, 439 (6th Cir. 2009).
This decision affirms that companies can rightly expect that when they hire outside counsel to conduct sensitive internal investigations, the privileged advice and work product resulting from the investigation should and will remain protected from disclosure.
Bearing Witness to the CTA’s Dead(ish) Hand
By William E. H. Quick, Polsinelli PC
Visit Business Law Today’s October 2025 in Brief: Corporations, LLCs & Partnerships to read the full update on the Corporate Transparency Act.
Consumer Finance Law
California SB 82 Limits Arbitrability of Disputes in Consumer Contracts
By Olivia (Liv) Lawless, Pilgrim Christakis LLP
On October 6, 2025, California Governor Gavin Newsom signed Senate Bill 82 into law, limiting the applicability of dispute resolution provisions in consumer contracts “to the use, payment, or provision of the good, service, money, or credit provided by that consumer use agreement.” Aimed at dismantling what State Senator Thomas J. Umberg refers to as “infinite arbitration clauses,” the bill prohibits contractual language seeking to arbitrate consumer claims outside the scope of goods or services specifically provided within by making such provisions void and unenforceable. As a result, far-reaching arbitration provisions will face scrutiny when the bill takes effect on January 1, 2026.
While SB 82 is limited to consumer agreements, its expanse is largely left to be determined. Not only is it unclear which consumers will be subject to the bill, and which choice of law provisions will require the bill’s application, it’s possible that federal law could preempt it entirely. If courts determine that the law discriminates against, or generally disfavors, arbitration, it could violate the Federal Arbitration Act. And although Senator Umberg considers the Bill to “restore[] fairness and common sense to California’s justice system,” the California Supreme Court may see it differently.
Gaming Law
Illegal Gambling Arrests Rock the NBA
By Ashley Fortner, South Texas College of Law, and Megan Carrasco, Snell & Wilmer LLP
During opening week of the 2025–2026 NBA season, the FBI announced the arrests of Portland Trail Blazers head coach Chauncey Billups, Miami Heat guard Terry Rozier, and former National Basketball Association (“NBA”) player and assistant coach Damon Jones. All three were suspects in a yearslong federal gambling investigation. More than thirty other people were also arrested in connection with the investigation. Multiple charges have been filed, and the FBI alleged connections with organized crime families. Billups and Rozier have been placed on leave.
Billups was indicted on charges of wire fraud conspiracy and money laundering conspiracy rigging underground poker games. He was not indicted for sports betting. The FBI claims that both Jones and Billups would lure people into rigged poker games by using their celebrity status. The games allegedly employed sophisticated cheating technology, like tables that could read face-down cards and glasses with special lenses that could reveal hidden markers on cards. After players lost, the FBI asserted that persons associated with organized crime families used extortion and violence to ensure payment.
Rozier was indicted on charges of wire fraud conspiracy and money laundering conspiracy related to sports betting. According to the indictment, the scheme involved unnamed co-conspirators who allegedly told bettors insider information about upcoming games. For example, Rozier allegedly tipped off a childhood friend that he would be removing himself from a March 2023 game with an injury, and then the friend allegedly sold the information to bettors for $100,000. The FBI alleged that Rozier pulled himself from the game after nine minutes when hundreds of thousands of dollars had already been wagered.
Jones was an unofficial assistant coach for the Los Angeles Lakers during the 2022–2023 NBA season. The FBI alleged he participated in the sports betting scheme as well and used his personal relationships with players to access insider information, which was passed to co-conspirators to place bets. Jones was charged with a total of two counts each of wire fraud conspiracy and money laundering conspiracy.
In light of these arrests, there has been increased scrutiny of NBA Commissioner Adam Silver’s past statements on gambling. Silver published a 2014 New York Times opinion piece arguing that “Congress should adopt a federal framework that allows states to authorize betting on professional sports.” Every major sports league has since come to support his position. Silver commented on the arrests, saying he was “deeply disturbed” and that “[t]here’s nothing more important to the league . . . than the integrity of the competition.”
The House Committee on Energy and Commerce sent a letter to Silver in response to the allegations of illegal gambling, requesting that Silver provide a briefing that addresses details about the alleged gambling, actions the NBA intends to take to limit the disclosure of nonpublic information, details about the NBA’s code of conduct regarding illegal gambling, how any existing regulations allow illegal betting, and if the NBA is reconsidering its partnerships with sports betting companies.
Currently, there is a patchwork of state regulations on sports betting across thirty-nine states that permit betting, in part because in 2018 the Supreme Court struck down the Professional and Amateur Sports Protection Act of 1992 in Murph v. National Collegiate Athletic Association, 584 U.S. 453 (2018). In the wake of massive sports betting scandals, Congress may step in to tighten federal restrictions where possible.
Sports Law
Anonymous Tipline Launched by CSC, Raises Questions About Implementation
By Megan Carrasco, Snell & Wilmer LLP, and Ashley Fortner, South Texas College of Law Houston
A key component of the House v. NCAA settlement is the formation of the College Sports Commission (“CSC”) to ensure name, image, and likeness (“NIL”) deals for college athletes are in compliance with the new National Collegiate Athletic Association (“NCAA”) rules. The CSC is an independent entity, entirely separate from the NCAA, that is charged with overseeing compliance on college sport roster limits, revenue-sharing, and student-athlete NIL deals.
The CSC’s primary function is to investigate potential NCAA rules violations. For example, the CSC is responsible for analyzing student NIL deals to assure there is a valid business purpose and evaluating the range of compensation. Once the CSC completes its review, it either must clear the deal or flag it for additional review. If the CSC fails to approve a deal, the student-athlete can renegotiate the deal, cancel the deal, or request neutral arbitration.
Additionally, on October 8, the CSC implemented an anonymous reporting system available to “anyone with information or concerns” about the process. The CSC provided examples of the type of information or concerns to report, such as a school’s failure to accurately report money paid to student-athletes, failure to report third-party NIL deals or false reporting of deals, or failure to accurately report a team’s roster. An anonymous report can be made by online submission, email, text message, or phone call.
Although the online reporting process requires that some mandatory fields be completed such as the type of concern, which school or schools are involved, and which sport or sports are involved, the tipline is completely anonymous.
The CSC says the anonymous tipline will “help ensure fairness and integrity in college sports.” If contact information is voluntarily disclosed or any identifying information is provided, the CSC says it can follow up and still maintain strict confidentiality. CSC CEO Bryan Seeley stressed the importance of anonymity, saying that it makes people feel more comfortable reporting. One issue CSC sought to address was coaches’ reluctance to report infractions out of fear of retaliation from rivals. However, the anonymous tipline will likely also be a forum for disappointed fans, jealous teammates, and disgruntled individuals to target players, clog the system with unwarranted complaints, and potentially cause unnecessary scandal. It is unclear what process the CSC will use to verify reports or how it will conduct investigations into anonymous allegations.
RealResponse is the platform CSC is using for reporting. It is the same platform used by many universities, Major League Baseball, and the NFL Players Association. The platform boasts anonymous and confidential two-way communication, which could help prevent scandal by allowing the CSC to conduct thorough investigations before any information is made public. But if there is an influx of cases as the contours of these brand-new NIL deals are tested, the CSC may be biting off more than it can chew when it comes to reviewing and investigating reports.
Tax Law
IRS Provides Transitional Relief for Businesses Reporting Passenger Vehicle Loan Interest
By Amy L. Castell and Douglas W. Charnas, McGlinchey Stafford
The Internal Revenue Service (“IRS”) has issued transitional relief in Notice 2025-57 for businesses that receive interest on specified passenger vehicle loans.
The “One Big, Beautiful Bill” allows certain taxpayers to deduct interest paid on a “qualified passenger vehicle” loan for taxable years 2025 through 2028. Businesses that receive from any individual interest of $600 or more for any calendar year on a qualified passenger vehicle loan must comply with the new reporting requirements.
For 2025, the IRS will consider that lenders have met their reporting obligations for interest received on a qualified passenger car loan if they make a statement available to the buyer indicating the total amount of interest received during calendar year 2025.
Specifically, lenders can meet their reporting requirements by making this total amount of interest available:
- on an online portal that the buyer can easily access;
- in a regular monthly statement;
- on an annual statement that is provided to the buyer; or
- by other similar means designed to provide accurate information to the buyer regarding interest received.
The statement should be made available to the buyer by January 31, 2026.
If a lender satisfies these reporting obligations, the IRS will not impose penalties on lenders for a failure to file information returns and provide payee statements.
