RTX fined $200 million for leaking data from F-22, F-35, B-2, E-3 and other aircraft to Russia, Iran and China

Technical leaks have occurred with Russia and Iran, and trade transactions involving aerospace components have occurred with China.

The U.S. State Department has announced a $200 million settlement with aerospace and defense company RTX after its employees inadvertently leaked technical secrets and traded aircraft components for nearly every major aircraft and missile system in its military with Russia, Iran, and China. This includes the VC-25 (Air Force One), the F-22 Raptor, the F-35 Lightning II and B-2 Spirit stealth aircraft, the B-1B Lancer, and the F/A-18, F-15, and F-16 fighters.

Technical leaks occurred on the first two aircraft when aircraft components were traded with the People’s Republic of China.

RTX “voluntarily” disclosed the incidents to the government. The violations, which occurred between August 2017 and September 2023, constitute 750 violations of the Arms Export Control Act and International Traffic in Arms Regulations (ITAR), which were defined as “unauthorized exports of defense articles resulting from failure to establish proper jurisdiction and classification; unauthorized exports of defense articles, including classified defense articles; unauthorized exports of defense articles by employees through personal carry to prohibited destinations.”

The stunning revelations come just a day after the US Air Force announced a $1 billion contract with Raytheon’s RTX unit to upgrade its F-22 Raptor fleet with new sensors, avionics, electronics and software to increase survivability and utility, a need that is acutely felt ahead of a possible military confrontation with peer and technologically comparable Russian and Chinese armies.

Voluntary Disclosures

“RTX voluntarily disclosed all alleged violations. RTX also cooperated with the Department to review this matter and has implemented numerous improvements to its compliance program since the disputed conduct occurred,” the statement added. The reports cited RTX’s response, which called the action “consistent with the company’s expectations,” which it disclosed in its second-quarter earnings report on July 25, 2024.

The company’s upcoming disclosure also likely led to a softening of the settlement. Under the 36-month Settlement Agreement, it would have withheld $100 million of that amount, provided the funds were used for “remedial measures to strengthen RTX compliance.”

In addition, for at least the next 24 months, RTX will retain an external Compliance Officer to oversee the implementation of the Settlement Agreement. This will include at least one external audit of RTX’s ITAR and other compliance measures.

Employee violations

The breaches mainly occurred when employees travelled abroad with company laptops, without considering the security of their contents.

For example, in May and June 2021, an RTX employee traveled to St. Petersburg, Russia, with an RTX-issued laptop containing ITAR-controlled technical data for at least five military aircraft. During the trip, although the employee notified the company’s cybersecurity team about several alerts on his laptop, they were “incorrectly dismissed” as false positives. This may have been due to the team transitioning to a new cybersecurity tool.

In another case, while in Iran, an RTX employee tried to log into his system, which involved using the local internet service provider and thus inviting access to data. This time, however, the RTX cyber cell immediately detected and froze the laptop. It later turned out that its hard drive contained technical data on the B-2 Spirit and F-22 Raptor.

Then, between August 2017 and August 2022, Raytheon/RAY “exported without authorization” defense items, “parts, components, and technical data” for the Tomahawk LACM, RIM-162 ESSM (Evolved Sea Sparrow Missile), RIM-116 Rolling Airframe Missile, SM-2, and Paveway-1 LGB (Laser Guided Bomb). They were sent to Australia, Belgium, Canada, France, Germany, Greece, Israel, Japan, Mexico, the Netherlands, the Republic of Korea, Saudi Arabia, Singapore, Sweden, Turkey, the United Arab Emirates, and the United Kingdom.

China

The Department’s “charging letter” notes that RTX-owner Collins Aerospace (formerly Rockwell Collins) is at fault for the majority of the violations because of “historical, systemic failures” in its export control compliance. “While all of Respondent’s affiliates had a significant number of violations, widespread weaknesses in ITAR compliance at Rockwell Collins led to the most egregious violations, such as the unauthorized export of technical data to the People’s Republic of China to facilitate the purchase of defense items from Chinese entities.”

These include “two instances” of importing and “integrating thousands” of Chinese-made defense articles into “multiple U.S. and partner military platforms.” RTX informed the department that in 2021 and 2022, its Cedar Rapids, Iowa, facility engaged in “unauthorized exports of technical data” from E-3 Sentry AWACS aircraft and KC-390 Millenium medium transport aircraft to Chinese FPEs.

Again in January 2023, he exported technical data for an aluminum component of the F-22 display housing to two Chinese FPEs at Collins’ facility in Shanghai. The “root cause” was “misclassification” and “misinterpretation” of defense articles. It identified “circuit cards” and thousands of “Printed Wiring Boards” that Rockwell Collins (before it became part of RTX in 2018) and Collins had purchased from “PRC entities.” As part of the order, he was required to export controlled technical data.

They have been used on the VC-25 Presidential Transport Aircraft (Air Force One), A-10 Thunderbolt II, B-1B Lancer, B-52 Stratofortress, C-17 Globemaster III, C-130J Super Hercules, CH-53 Stallion helicopter, F-15 Eagle, F-16 Fighting Falcon, F/A-18 Hornet, KC-46 Pegasus, KC-130, KC-135 Stratotanker, MQ-4 Triton UAV, MQ-8 Fire Scout UAV, MQ-9 Reaper UCAV, MQ-25 Stingray and P-8 Poseidon.