United States ex rel. Tenney v. Honeywell: The Facts

What the Public Record Establishes

The action is United States of America ex rel. Rachel Tenney v. Honeywell International Inc., filed March 25, 2022, in the Western District of North Carolina. The court's August 2026 order confirms that the United States intervened in part and unsealed three documents: the government's notice, the redacted complaint, and the order itself. Everything else on file remains sealed, including the original complaint. The paper is built on that deliberately limited record, and it is careful about what the record cannot support. Partial intervention is not adoption of every allegation, and the order does not explain the settlement amount, the scope of the release, or the reason particular records remain sealed.

The Gray Network

According to the complaint, the government work involved quantum computing contracts supported by a Special Use Network called the Gray Network, alleged to hold engineering drawings, technical specifications, simulations, and research associated with sensitive defense and intelligence programs. Tenney alleges the environment was separated from corporate systems while lacking protections that existed elsewhere in Honeywell, including monitoring by the corporate Security Operations Center. For any contractor using an enclave for Controlled Unclassified Information, the practical question the allegations raise is whether separation preserved accountability or merely moved the work beyond the people responsible for it.

The alleged deficiencies are recognizable operating disciplines rather than exotic failures: antivirus coverage that reached workstations but not servers, devices that could not be identified or administered, access that could not be attributed to an authorized person, and alerts that reached no one capable of acting on them. The paper connects each to the NIST SP 800-171 requirements involved while being explicit that the record contains no judicial finding that any particular control was violated.

The Decision to Close the Incident

SolarWinds gives the complaint its most detailed account. Tenney alleges compromised Orion software, unexplained remote sessions, configuration changes, and more than 1,200 megabytes moving to the compromised server, with administrators unable to account for the users or the activity. In a January 6, 2021 email reproduced in the complaint, she challenged the basis for treating the investigation as complete, describing unfinished analysis, missing logs, and software deployment no team member could explain.

When Security Becomes a Payment Question

The complaint alleges that Honeywell continued invoicing while making false representations about network security and incidents. A deficiency alone does not establish False Claims Act liability; knowledge and materiality still have to be established. The paper works through those elements, the DFARS 252.204-7012 reporting obligation with its 72-hour trigger that does not wait for proven theft, and the CUI identification questions, including why the complaint's shorthand equating legacy FOUO markings with CUI is too broad to adopt as a compliance rule.

Notably, the case was not built on a failed CMMC assessment or an inaccurate SPRS score. Its account runs through the underlying work, the required security, incident handling, and payment. An assessment calendar and a contractual obligation operate on different terms, and a change to the former does not by itself amend the latter.

Before the Record Is Reconstructed

The settlement cannot responsibly be used to calculate the price of ignoring cybersecurity requirements, because the public record does not establish Honeywell's total cost or the damages rationale. Its more useful lesson concerns the evidence a company creates while performing the work: the device inventory, the access record, the alert, the email requesting investigation, the explanation for closure, and the representation associated with payment. A contractor can examine those records now, while corrective action remains an ordinary management task, rather than after an outside party begins reconstructing its decisions from emails, invoices, and incident logs.