The US State Department has announced a $200 million settlement with defense contractor RTX, stemming from allegations that its employees compromised military secrets while traveling abroad. This settlement follows RTX’s voluntary disclosures of 750 violations of the Arms Export Control Act and the International Traffic in Arms Regulations (ITAR) occurring between August 2017 and September 2023.
In an official statement, the government noted, “RTX disclosed all of the alleged violations voluntarily. The company also cooperated with the Department’s review of this matter and has implemented numerous improvements to its compliance program since the incidents in question.”
In a brief comment to Breaking Defense, an RTX spokesperson stated, “Today’s action is in line with the company’s expectations, which we disclosed during the company’s second quarter earnings report on July 25, 2024.”
The violations primarily involve employees traveling abroad—specifically to sanctioned countries like Iran and Russia—while bringing work laptops that contained sensitive US military data. The State Department indicated that these laptops included a variety of “defense articles” pertaining to critical military programs such as the Aegis Ballistic Missile Defense System, B-2 Spirit bomber, F/A-18 E/F Super Hornet, and F-35 Lightning II.
One notable incident occurred during a trip to St. Petersburg, Russia, in May and June 2021. An RTX employee took an RTX-issued laptop loaded with ITAR-controlled technical data about five military aircraft. While in Russia, the employee alerted the cybersecurity team about several “alerts” on the laptop, which were mistakenly categorized as false positives due to a transition to a new cybersecurity tool.
Another significant violation involved an employee traveling to Iran who attempted to log into his laptop while there. Although RTX security detected the action and froze the laptop, it was found that the hard drive contained technical data on the B-2 Spirit bomber and the F-22 Raptor fighter—information the US typically seeks to keep within its borders, especially in countries like Iran.
A third case involved an employee who made multiple trips to Lebanon. RTX’s internal investigation revealed that the employee’s laptop held technical information on Standard Missile-3, Standard Missile-6, and ESSM missiles. The State Department indicated that the unauthorized export of this technical data posed threats to US national security and negatively affected a Department of Defense program.
Under the terms of the 36-month settlement agreement, RTX will pay a civil penalty of $200 million; however, the government has agreed to reduce this amount by half if RTX invests $100 million in remedial compliance measures.
Further details about the proposed charging letter and the consent agreement can be accessed through the official documents provided.
