A cybersecurity firm that worked for the Los Angeles Department of Water and Power is alleging in a new legal claim that there are widespread security gaps at the utility and that the DWP and city staff concealed those vulnerabilities from regulators.
Ardent Cyber Solutions LLC submitted a 10-page claim against the city earlier this year, alleging retaliation and breach of contract. The firm alleges that Mayor Eric Garcetti personally ordered its contract canceled as a “retaliatory measure” after Ardent alerted officials to the utility’s physical and cybersecurity problems, according to the claim.
City Attorney Mike Feuer’s office declined to comment. Claims are typically submitted to the city before the filing of a lawsuit and are lodged to preserve a claimant’s right to sue.
Ardent worked out of Figueroa Plaza, a pair of downtown office towers that house several city agencies. The firm was one of several companies named in an FBI search warrant served at the utility during agents’ raid of city buildings last year. Investigators searched Ardent’s computers on the day of the raid and sought information about any security reviews done by the firm and documents related to DWP’s compliance with industry security standards, according to sections of the warrant reviewed by The Los Angeles Times and an eyewitness report.
Federal agents also sought evidence related to litigation sparked by DWP’s botched rollout of a new billing software system in 2013.
In its claim against the city submitted Jan. 10, Ardent says its firm was hired in April 2019 by DWP to perform cybersecurity work. During the course of its work, the firm scanned DWP’s “corporate IT network” and concluded there were an “extremely high number of unpatched vulnerabilities,” according to the claim.
Ardent’s top staff informed DWP Board President Mel Levine and DWP’s senior executives about the security issues via email on Aug. 12, 2019, the claim states.
In its claim, Ardent said it told Levine and others that it had uncovered evidence that DWP and city officials had made “false statements and failed to disclose material facts” about the utility’s security. City officials and DWP staff “acted to conceal these facts from federal and state regulators, bond rating agencies, purchasers of municipal securities issued by the LADWP and the public at large,” the claim states.
Later on Aug. 12, Garcetti ordered Ardent’s contract suspended, according to the claim.
The claim alleges the city and DWP breached the contract with Ardent by failing to pay the firm more than $3 million.
DWP spokesman Joe Ramallo said the utility “strongly disagrees” with Ardent’s allegations. He said the Ardent contract was severed because of “concern over their continued involvement in critical cyber issues.” Ramallo declined to elaborate on those concerns and said the U.S. attorney’s office had advised the utility that public disclosures could hurt any investigation.
“We want to assure our customers and stakeholders that cybersecurity is of the utmost importance to DWP,” Ramallo said. “And the appropriate steps have been taken to ensure that our cybersecurity is compliant with all applicable laws and security standards.”
Garcetti spokesman Alex Comisar declined to comment. The U.S. Attorney’s Office also declined to comment.
The firm’s most recent business filing with the secretary of state, made in November 2019, lists Ardent’s president as Paul Paradis. He is a key figure in a scandal stemming from the city’s handling of a class action lawsuit filed over inaccurate DWP bills from the 2013 billing system. He was hired by the city attorney’s office for legal work related to the fallout over the faulty system. At the same time, his company, Aventador, won a $30 million, no-bid contract from DWP to fix the billing system and for cybersecurity work.
Paradis has denied wrongdoing.
No one has been arrested or charged in connection with the FBI raid of DWP and the city attorney’s office.
(c)2020 the Los Angeles Times. Distributed by Tribune Content Agency, LLC.
