ARMED SERVICES BOARD OF CONTRACTAPPEALS Appeal of-- ) ) IBM Corporation ) ) Under ContractNo. W91QUZ-04-D-0003 )
APPEARANCES FOR THE APPELLANT:

APPEARANCES FORTHE GOVERNMENT: ASBCA No. 60332

David W. Burgett, Esq. Brendan M. Lill, Esq. Nicole D. Picard, Esq.

Hogan Lovells US LLP Washington, DC Raymond M. Saunders, Esq.

Army ChiefTrial Attorney FrankA. March, Esq.

Trial Attorney

OPINION BYADMINISTRATIVE JUDGE WOODROW ON APPELLANT'S MOTIONS FOR SUMMARYJUDGMENTAND DISMISSAL

In 2003, the United States Army Contracting CommandAgency (Army or government) awarded Indefinite-Delivery/Indefinite-Quantity (IDIQ) Contract No. W91QUZ-04-D-0003 to IBM Corporation (appellant or IBM) for worldwide information technology (IT) services. In 2003, the Army issued Task Order0002 (TO 2) for IT support at the National Defense University at Fort McNair in Washington, DC. This appeal arises out of
a contracting officer's final decision (COFD) asserting a government claim for $5,903,353 in alleged overcharges by IBM under TO 2, based on IBM's alleged failure to perform the requirements ofTO 2. Appellant's briefcontains three distinct motions: (1) a partial motion to dismiss for lack of jurisdiction; (2) a motion for summaryjudgment on the basis that the government's claim is time-barred by the six-year statute oflimitation set forth in the Contract Disputes Act (CDA), 41 U.S.C. §§ 7101-7109; and (3) a motion to dismiss the government's complaint with prejudice for failure to state a claim upon which reliefcan be granted.

We address each ofappellant's motions separately.STATEMENT OF FACTS (SOF) FORPURPOSES OF THE MOTIONS

1. On 22 October 2003, the Army Contracting Command Agency-ITEC4 (Army or government) awarded IDIQ ContractNo. W91QUZ-04-D-0003 (the contract) to IBM for IT services worldwide. With options, the contractperiod was from 22 October 2003 until 21 October 2010. (R4, tab 1at 1)

2. On 30 June 2005, the Army awarded TO 2 to IBM for IT support at the National Defense University (NDU) (R4, tab 12 at 2). The task order included a base period of performance of 1July 2005 through 1July 2006, as well as two 12-month option periods, 1July 2006 to 30 June 2007 and 1July 2007 to 30 June 2008 (id. at 1, 5-17). The period of performance was extended to 2 September 2008 by Modification No. 27 (R4, tab 19).
3. TO 2's Performance Work Statement (PWS) provides: "The Contractor shall operate and maintain baseline services and infrastructure in accordance with Appendix C" (R4, tab 12 at 22). Appendix C consists ofa table entitled "Operate and Maintain Baseline Services and Infrastructure." Below is an excerpt ofthe portion ofthe table relevantto the present motions.

Establish I) Create, maintain I) Ensure security I) Monthly certified 0.5%oftotal monthly and and update required documentation review ofsecurity price shall be administer NDU IA policy and complies with documentation deducted for IT security procedures mandated Federal documented program by DOD regulations legislation

... deficiencies noted in and federal laws Monthly reviews for 2) Review audit logs 2) Respond to 2) Review network identified monitor and monitornetwork security breaches security reports and activities and not securitytools within 4 hours of logs corrected within 30 notification days. 3) Establish and 3) Ensure that 3) Review patch monitor University systems have latest documentation software patch security patches reports and logs program installed within 24 hours ofapproved release; 4) Analyze network 4) Provide monthly 4) Review IA related and web activity data network metric help tickets to identify possible reports to include problem trends and but limited to: propose proactive network, server and solutions services downtime;

25) Create and oversee 5) Provide IA 5) Survey users to
a securitytraining and trainingto faculty, ensure training [has]
awareness program staffand students at been met least once a year; 6) Establish and 6) Ensure COOP 6) Reviewtestplans, maintain for critical plans are current procedures and test NDU systems and and tested annually results continue to operate (COOP) plan, procedures and
resources for ongoing operations under emergency situations 7) Provide 7) Test new 7) ReviewNDU information assurance technologies, projects for IA and security analysis securitytools and compliance and
on proposals related procedures priorto documentation to new technologies implementation and new operational policies within the university Establish Create, maintain and Ensure program Provide monthly 0.5% oftotal and update network documentation and network operational monthly price shall administer security policies, resource security activity be deducted for
a network procedures and assignment reports to the NDU documented operations operational guidance necessary to ChiefInformation deficiencies noted in security mandated by federal achieve and Security Officer monthly reviews for program and DOD regulations maintain DOD and identified monitored federal compliance activities that are not corrected within 30 days ofnotification
or by mandated DOD and federal implementation deadlines.

(R4, tab 12 at 33-34) Staffing underthe Contract

4. IBM had beenproviding IT support services toNDUunderperformance-based contracts for several years priorto 2005 (app. mot., StatementofUndisputed Material Facts (ASUMF), 1; gov'tresp., Statement ofGenuine Issues ofMaterial Facts (GSGIMF), 1), when it was awarded TO 2 (ASUMF, 2).

35. NDU staffhad the opportunity to directly observe IBM's day-to-day performance underTO 2. IBM employees worked side-by-side and in the same location as NDU employees. (ASUMF , 5)

6. IBMprovided the government with a staffingplan at the contract's inception (ASUMF, 15; GSGIMF, 15). There are factual disputes concerning the content ofthe staffing plan, including whether certain personnel relevantto the government's claim were included in the staffingplan (R4, tab 8 at 18-20, 40-47; ASUMF, 15; GSGIMF, 15).

7. Ofthe 22 employees at issue in the government's claim, 4 had supportedNDU priorto TO 2, under IBM's former contracts (ASUMF, 16; GSGIMF, 16).

8. Before making personnel changes during performance, IBM consulted with NDU officials aboutproposedpersonnel changes (ASUMF , 20). IBM providedto the government
resumes ofnew candidates for review and also gave the government an opportunity to meet new candidates for contractpositions during task orderperformance (ASUMF , 21; see, e.g., R4, tabs 36, 38).
NetworkIntrusions andSubsequent GovernmentInvestigations
9. The government identified a total ofsix malicious network intrusions during the period from January 2006 until June 2009. The six intrusions occurred on orabout January 2006, November 2007, 4 November 2008, 14 May 2009, 17 June 2009, and 23 June 2009. The first network intrusion occurred in January 2006, but was not detected until November
or December 2006 (ASUMF,24; GSGIMF,24; app. reply br., ex. A,24). Two ofthe six network intrusions occurred during TO 2'speriod ofperformance, from 2005 to September 2008 (ASUMF,23; GSGIMF,23).

10. The six attacks resulted in the exfiltration ofunclassified but sensitive DoD information, includingpersonally identifiable information ofNDU students and faculty, expense and budgetreports, and documents related to U.S. military technology and technical tradecraft. The attacks degraded NDU's network and compromised the DoDNon-Classified Internet Protocol RouterNetwork (NIPRNET). (R4, tab 31 at 15-25)

Government'sDemandLetterandContracting Officer'sFinalDecision
11. By letter dated 8March 2013, the contracting officer (CO) issued a demand for payment of$8,998,187 allegedly owed as a result ofIBM's failure to perform and deliver services as required under TO 2. The letter stated, in part:
There were six (6) majornetwork intrusions requiring IBM to execute network security IT services in the systems that IBM
was to support underthis Task Order. These intrusions
4(R4, tab 22) compromised the DoD computers assigned to the National Defense University (NDU), FortMcNair, Washington D.C., and commenced approximately January 2006

IBM failed to plan, develop, manage, and execute substantial network security IT services and related enterprise architecture management in accordance with the subject Task Order. Furthermore investigation revealed that IBMpersonnel did not have the appropriate subject matter expertise, and were not qualified to execute the IT security related tasks to properly plan, test and conduct specific tasks ofIT security, as required in the subject Task Order. In addition, IBM failed to develop, test, and execute apropernetwork security incidentresponse plan.

12. On 21 March 2013, IBMresponded by letter, through counsel, denying liability (R4, tab 23).

13. On 23 May 2013, the Contracting Officer (CO) responded to IBM by letter and provided it copies ofthe Government Audit Net Security Reports. The CO also proposed a meeting for 12 June 2013 to discuss the findings ofthe government's audits. (R4, tab 25) The exhibits summarizedthe results ofgovernment investigations, during the period from 12 December2006 through 9January 2009:

- Exhibit#1: "National Security Agency Blue Team Assessment," dated 15 December 2006;

- Exhibit#2: "DISANIPRNET Compliance Review," dated 18 May 2007;

- Exhibit#3: "ArmyResearch Lab NDUNorfolk Campus DIACAP Status Report," dated 14 December 2007;

- Exhibit#4: "NDUIA Issues," dated 15 January 2008;

- Exhibit#5: "NDUDIACAP Outbrief," dated 21 March 2008;

- Exhibit#6: "DISAInformation Assurance Readiness Review (IARR)," dated 5December2008;

- Exhibit#7: "DISA Information Assurance Readiness Review Final Report," dated 9 January 2009 (R4, tab 24) The record does not contain full copies ofthese investigations, only summaries ofthe findings.
14. On 12 June 2013, the CO made a presentation concerning the government's investigations into IBM'sperformance ofTO 2 (R4, tab 31). IBM was present at the
5meeting where the CO delivered the presentation (id. at 2). Thepresentation slides identified a series ofnetwork security assessments by the government, apparently referencing the exhibits attached to the CO's 23 May 2013 letter (R4, tab 25).

15. The 12 June 2013 presentation also included a breakdown ofthe claimed total damages to the government resulting from IBM's alleged deficientperformance.

1) DISA NetworkAssessments 11-15 December 2006 $137,874 14-18 May 2007 $114,741 1-5 December2008 $113,965 15-19 December2008 $105,331
2) NDU Personal ldentifving Info Protection Coveraee 01 February2009-31 January20IO $44,492
3) Arml'.: Research Lab {ARL} IA Consultation & CNDSP 01 Dec 2006- 30 Sept 2007 $221,325 1 Oct 2007

- 30 Sept 2008 $265,590 1 Oct 2008

- 30 Jun 2009 $351,600
4) LaborMischarging and Labor Deficiencies (21 Individuals) 2005

- 2008 ContractPeriod $4,037,019 Sub Total: $5.277.973

5) Total Contract Invoices PAID {JulI $16,426,47c 2005-Seo 2008) PWS Aooendix C deficiency Areas**~** Penalty for each deficiency Area 0.00~ (0.5%) Sub Total: $657.059
6) DIACAP Training Class (20 persons) $19,04< Sub Total $19,049 Grand Total: $5.954.081 (R4, tab 31 at 53)

616. On 13 June 2013, the Defense Contract AuditAgency (DCAA) completed a formal laborbilling analysis identifying 22 individuals thatpurportedly billed at different labor category rates than those applicable to the actual tasks performed, and some who did not perform the minimumrequired elements ofthe task order (R4, tabs 26-27). This analysis was the basis ofthe claimed $4,037,019 in damages for "LaborMischarging and Labor Deficiencies (21 Individuals)" set forth in the CO's 12 June 2003 presentation.

17. On 2 August 2013, IBMresponded by letter, providing a detailed response to each ofthe government's allegations and denying liability (R4, tab 28). IBM contended, in part, that it did notwarrant freedom from unauthorized access and is not contractually liable for security breaches (id. at 6). IBM further contended that its performancewas subject to oversightbyNDU's chiefinformation officerand that NDU failed to implement many of IBM's recommendations for improving network security (id. at 3-4).

18. By letter dated 24 August 2015, the CO issued a COFD asserting a government claim for $5,903,353. The COFD stated that six majornetwork intrusions had compromised the DoD computers assigned to theNDU, beginning in January 2006. Based on internal investigations, the COFD claimed:
(1) [T]hat IBM failed toplan, develop, manage, and execute substantial network security IT services and related enterprise architecture management in accordance with the subjectTask Order, (2) IBM failed to adhere to material requirements ofthe Task Orderby failing to ensurethatNDU's networkwasproperly secured, managed, and maintained, and as a result offailing to meet material requirements and (3) IBM failed to apply orto execute necessary security safeguards, as requ_ired bythe subjectTask Order.
(R4, tab 29 at 1-2)

19. With respectto the internal investigations, the COFD stated that:

TheDefense Criminal Investigative Services (DCIS), Cyber CrimesDivision conducted an investigation; in conjunction with examining Government network security audit reports, while consulting with Government SubjectMatterExperts who specifically examinedthe network security posture ofNDU and IBM'sperformance, it was determined that IBM was responsible for network security violations, labor mischarging and personnel securityviolations during IBM's contract performance.
(R4, tab 29 at 2)
720. The COFD further claimedthat IBMpersonnel did nothave the appropriate subject matter expertise and were not qualified to execute the IT security-related tasks required in the subjecttask order. The COFD also alleged that IBM failed to develop, test, and execute a propernetwork security incident responseplan, and that IBM failed to execute their Quality Control Plan, which IBM stated wouldbe used to identify the process for achieving all performance objectives ofthe PWS. The COFD concluded that IBM failed to perform all TO 2 requirements, as well as submitted invoices, and was paid, for worknot performed. (R4, tab 29 at 1-2)

21. Appellant timely filed a notice ofappeal from the 24 August 2015 COFD. The notice ofappeal included a request that the governmentberequired to file the complaint. The Board docketed the appeal as ASBCA No. 60332. On 22 February 2016, the government filed its complaint.

22. Paragraph 15 ofthe government's complaint states: "Thetask order PWS § 6.4.3 required: 'The Contractor shall operate and maintain baseline services and infrastructure in accordance with Appendix C (Operate and Maintain Baseline Services and Infrastructure)."' Subparagraph (a) ofparagraph 15 further provides: "Thetasks at Appendix C contained eight specific areas related to network security." The complaint then lists eighttasks appearing in the Required Service column ofAppendix C that correlate to two desired functions. The associated desired functions are "Establish and administer IT security program" and "Establish and administer a network operations securityprogram." (Compl. 

### ,-r 15; see also SOF 

### ,-r 3) Subparagraph (b) ofparagraph 15 provides: "Each ofthe eight areas containedperformance standards and acceptable quality levels ('AQLs')." Itthen lists the eight items appearing in the "Performance Standard and AQL" column ofAppendix C associated withthe same two desired functions. (Id.)

PARTIAL MOTION TO DISMISS FORLACK OF JURISDICTION Appellant contends that we lackjurisdictionto entertain the government's allegations in its complaintthat IBM failed to meetthe "acceptable quality levels" (AQLs) set forth in the contract for network security, becausethose allegations were not within the COFD. 1 Appellant moves to strike the allegations relating to the network security AQLs from the government's complaint. (App. mot. at 19)

We conclude that allegations in the complaint relating to AQL deficiencies relate to the same set of"operative facts" set forth in the COFD and, therefore, fall within the

1 In the contract's statement ofwork, performance standards are expressed as acceptable quality levels orAQLs (R4, tab 1at 112).8scope ofthe COFD. We deny appellant's partial motion to dismiss and/or to strike these allegations from the government's complaint.

DISCUSSION
The scope ofthe Board'sjurisdiction is determined by the contents ofthe claims submitted to the CO who issues a decision on said claims which are timely appealed to the Board. Thus the claim, and not the complaint, determines the scope ofourjurisdiction. American General Trading & Contracting, WLL, ASBCANo. 56758, 12-1 BCA,34,905 at 171,639; see also US. CoatingSpecialties & Supplies, LLC, ASBCA No. 58245, 15-1 BCA,35,957 at 175,706 (citing Optimum Services, Inc., ASBCA No. 57575, 13 BCA,35,412 at 173,726) ("The Board lacksjurisdiction over claims raised for the first time on appeal."). In Placeway Construction Corporation v. UnitedStates, 920 F.2d 903, 907 (Fed. Cir. 1990), the Federal Circuit explained that in determining whether an issue constitutes a new or separate claim, "the court must assess whether or not the claims are based on a common or related set ofoperative facts." In determining a claim's scope, we are not limited to the claim documentbut may examine the totality ofthe circumstances. SauerIncorporated, ASBCANo. 60366, 16-1 BCA,36,565 at 178,101. Appellant asserts that the government's allegation that IBM's performance failed to meet the network security AQLs specified in the task order, set forth in paragraph 15, subparagraph (b) ofcomplaint, was not asserted in a government claim or in the COFD and is, therefore, notproperlybeforethe Board ( app. mot. at 19).2 Atparagraph 15 ofthe government's complaint, the government identifies eight tasks, and their associated AQLs, as concerning network security; these are the tasks associated with the "Establish and administer IT security Program" and "Establish and administer a network operations securityprogram" functions in Appendix C (SOF ,,22, 18). Forthe purposes ofthis motion, we will refer to these desired functions, collectively, as the network security functions.3

The government argues that the COFD's reference to IBM's failure to complete tasks corresponding to three desired functions, which includes the network security

2 Appellant also argues that the Board lacksjurisdiction overthe government's complaintto the extent that it seeks reliefon the basis ofthe follow-on task order contractperformed by IBM from 3 September2008 to 2 September 2009 (app. mot. at 25). The government has acknowledged and agreed thatthe follow-on task order is not apart ofthe government claim before the Board in this appeal and states that the government has lodged no claim against appellant under the follow-on task order contract (gov'tresp. at 25). 3 We will refer to the tasks associated with the network security functions as the network security tasks; we will referto the AQLs associated with the network security functions as network security AQLs. 9functions, "are sufficientreferences to the AQLs to maintain the Board'sjurisdiction regarding any issue allegingthat IBM failed to meet network security AQLs" (gov'tresp. at 21). Itfurther contends that appellant was aware, at the time the COFD was issued, that aportion ofthe claimed damages was attributable to AQL deficiencies (id. at 22).

A comparison ofthe language ofthe COFD and the complaint demonstrates that they are based on the same operative facts. The COFD states that "IBM failed to plan, develop, manage, and execute substantial network security IT services" (SOF 1 18). It also references the contractor'sresponsibility to perform network security tasks in accordance with TO 2 and alleges that IBM did notproperlyperform these tasks (see id.). The language ofthe complaint is more specific. Paragraph 15 ofthe complaint recites specific portions ofthe contract'sperformance work statement and enumerates eight specific tasks relatingto network security atthe NDU (compl. 115.a.; SOF 113, 22). It further enumerates the AQLs associated with each ofthe eight tasks (compl. 115.b.). Finally, it describes the contractual penalty for failing to meet the AQLs - a deduction of 0.5% ofthe total monthly price for each documented deficiency that is not corrected within 30 days (compl. 115.c.). Appellant cites this penalty clause as the alleged factual distinction between the claim in the COFD and the allegations in the complaint. According to appellant, the 0.5% penalty was notpart ofthe government's claim (app. mot. at 20). Appellant's argument elevates form over substance. While the language ofthe complaint is more specific, the COFD expressly references the contractor's responsibility to perform network security tasks in accordance with TO 2 and alleges that IBM did not properly perform these tasks (see SOF 11 18, 19). TO 2 provides that monthly invoices are to be deducted by 0.5% for AQL deficiencies (see SOF 13). The COFD's reference to IBM's failure to perform the "network security tasks" set forth in TO 2 encompasses the specific tasks and associated AQLs alleged in the complaint and set forth in the TO. Although the allegations in the complaint are more detailed and specific, they are based on the same operative facts as the COFD. See DSP, Inc., ASBCA No. 32869, 87-1 BCA 119,452 at 98,290 (fact that one claim included a specific item ofdamage that did not appear in the other claim was not sufficient to treat claims as being separate and discrete). Indeed, in orderto adjudicate whether IBM failed to perform network security tasks as claimed in the COFD, orwhether it failed to meet the AQLs for specific network security tasks as alleged in the complaint, the Board must review the same evidence concerning IBM's performance ofnetwork securitytasks. See LaelAlSahab & Co., ASBCANos. 58344, 59009, 15-1BCA135,809 at 175,130 (quotingPlaceway Constr., 920 F.2d at 907) (holding that ifthe Board "will have to reviewthe same orrelated evidence to make its decision, then only one claim exists").
Moreover, there is evidence that the 0.5% deduction accounts for aportion ofthe government's claimed damages in the COFD. Priorto issuing the COFD, the CO conducted apresentation regarding the government's claim against IBM, at which IBM
10was present (SOF

## ,r 14). The presentation divided into parts the government's claim, stating that approximately $657,059 ofthe government's $5,903,353 claim is attributable to a 0.5% penalty against all invoices paid between July 2005 and September2008 for Appendix C deficiencies (SOF

## ,r 15). Appellant offers no rebuttal to this evidence in support ofits contentionthat the AQL deficiencies were not included in the government's claim (see generally app. reply hr.). The 0.5% contractual penalty, which appellant contends applies onlyto AQL deficiencies, appears to always have been apart ofthe government's claimed damages. The complaint's direct reference to network security AQLs merely provides details about the government claim, where the language ofthe COFD includes the broad assertion that IBM is liable for failure to provide network security services in accordance with TO 2.

Even ifthe Board concluded that the COFD did not state a claim on the basis of AQL deficiencies, the allegations in the complaint only would assert a new legal theory for recovery. The complaint seeks the same relief. The operative facts for these allegations in the complaint are the same as those underlying the claim as stated in the COFD. Both the claim and the complaint require examiningthe facts regarding how IBM performedthe network security functions under TO 2. The assertion ofa differing legal theory for recovery, when based on the same operative facts, does not defeat our jurisdiction. Scott Timber Co. v. UnitedStates, 333 F.3d 1358, 1365 (Fed. Cir. 2003). Appellant'spartial motion to dismiss and/or to strike from the complaint all allegations that IBM failed to meet the network security AQLs is denied.

MOTION FOR SUMMARY JUDGMENT

We tumnextto appellant's motion for summaryjudgment. The basis for appellant's motion is that the government's claim is time-barred by the six-year statute of limitation set forth in the CDA, 41 U.S.C. 

### §§ 7101-7109. We find the currentrecord to be inadequate to sustain a finding thatthe government's claim is time-barred and deny summaryjudgmentin appellant's favor.

DISCUSSION

I. SummaryJudgmentStandard Summaryjudgmentis appropriate when, drawing all inferences in the non-movant's favor, the movant establishes that there is no genuine dispute as to any material fact and the movant is entitled tojudgment as a matter oflaw. Mingus Constructors, Inc. v. United States, 812 F.2d 1387, 1390-91 (Fed. Cir. 1987). It is appellant's burden as movantto show by undisputed material facts thatthe government's claim is time-barred underthe

11CDA. See Supreme Foodservice GmbH, ASBCANo. 57884 etal., 16-1 BCA 1 36,426 at 177,582.

II. Six-YearStatute of Limitations Under the CDA
The CDA requires a contract claim to be "submitted within 6 years afterthe accrual ofthe claim." 41 U.S.C. §7103(a)(4)(A). A claim accrues underthe CDA when "all events, that fix the alleged liability

...and permit assertion ofthe claim, were known or should have been known." Some injury must have occurred; however "monetary damages need not have been incurred." FAR 33.201. The events fixing liability should have been known when they occurred unless they can be reasonably found to have been either concealed or "inherently unknowable" at that time. RaytheonMissile Systems, ASBCA No. 58011, 13 BCA 135,241 at 173,017. Appellant alleges that there is no genuine dispute over certain facts which establish that "the claims asserted in the complaint accrued more than six years before the Government asserted them" (app. mot. at 1). Appellant divides the government claim into two claims with different accruals, arguingthat the governmentis asserting entitlement to costs on the basis oftwo legal theories: (1) a claim for costs for breach of contract due to deficient performance under the task order, and (2) a claim for labor mischarging (app. mot. at 6). We first address the date on which the government filed its claims, and then address the dates on which those claims allegedly accrued.


### A. Date ofthe Government's Claims

Atthe outset, we note that appellant has failed to establish, or even propose, as an undisputed material fact a date on which the government submitted its claims (see generally, ASUMF). However, appellant's briefargues thatthe government did not issue its claims until, at the earliest, 8 March 2013, when it issued a demand for payment letter (app. reply br. at 1-2). Appellant also argues that the government's claims accrued more than six years before 8March 2013. We understand this to mean that, for purposes ofits motion, appellant accepts that the government filed its claims on 8March 2013. The government, for its part, also refers to the 8March 2013 demand letter as a claim, referring to the letter as "demandingthe sum certain of$8,998,187.87" (gov't opp'n at 2, 15), and arguing that the CO's 8March 2013 demand letter was within the six-year statute oflimitations (id. at 4). In the alternative, the government argues that the COFD
on 25 August 2015 was within the six-year statute oflimitations, on the grounds that the claimaccrued no earlierthan 4 April 2012, when DCIS reported its findings to the CO (comp

### I. 

## 17).

We conclude that the government first asserted its claim on 8 March 2013, when it issued a demand letter for the sum certain amount of$8,998,187 (SOF 111). The government's demand letter satisfies the definition of"claim" set forth in FAR 2.101,
12because it contains a "written demand or written assertion by one ofthe contracting parties seeking, as a matter ofright, the payment ofmoney in a sum certain." FAR 2.101; Eaton ContractServices, Inc., ASBCA No. 52888 etal., 02-2 BCA

## ,r 32,023 at 158,267 (total overall demand for payment ofa specific dollar amount meets the FAR'srequirement that a monetary claim be for a sum certain). The 8March 2013 demand letter is distinct from a "voucher, invoice, or otherroutine request for payment that is not in dispute when submitted,"because IBMunequivocally denied liability for the payment demand on 21 March 2013, when its counsel responded to the CO's letter (SOF

## ,r 12). Theparties continued to dispute both liability and quantum during their subsequent discussions, which culminated in the COFD, dated 25 August 2015. (SOF

## ,r 17; compl.

## ,r 19).



### B. The Dates ofAlleged Accrual

A claim accrues "when all events, that fix the alleged liability ofeitherthe Government orthe contractor and permit assertion ofthe claim, were known or should have been known." FAR 33.201. The "knewor should have known test" includes a reasonableness componentregarding "what facts were reasonably knowable to the claimant. Summaryjudgmentis not normally appropriate where reasonableness and subjective knowledge are facts at issue." KelloggBrown & RootServices, Inc., ASBCA Nos. 58518, 59005, 16-1 BCA

## ,r 36,408 at 177,528 (quotingRaytheon Company, ASBCA No. 58840, 15-1 BCA

## ,r 36,000 at 175,868). To determine when the alleged liability was fixed, we begin by examiningthe legal basis ofa particular claim. Gray Personnel, Inc., ASBCANo. 54652, 06-2 BCA

## ,r 33,378 at 165,475.


### i. DeficientPerformance Claim Appellant asserts thatthe government's deficientperformance claim accrued at the time ofthe first network intrusion in January 2006, or, at the latest, by December 2006, when the government discovered the first network intrusion (app. mot. at 7-8). The government argues that it could not have known ofits claim against IBM until it completed an investigation ofthe network intrusion (gov't opp'n at 14).

IBM has failed to demonstrate by undisputed facts thatthe government knew or should have known at the time ofthe discovery ofthe first network intrusion that the government was aware ofthe facts concerning IBM'sperformance ofTO 2 requirements. The government's claim is based, in part, on the contentionthat the network intrusions
were caused by IBM's failure to perform network security IT services and enterprise architecture management in accordance with TO 2 (SOF 

## ,r 15). IBM has established only the time ofthe first network intrusion, the time ofdiscovery ofthe first network intrusion, and that IBM staffworked in the same location as NDU employees (see SOF 

## ,r,r 10, 14). This is not sufficient for the Board to conclude that, at the time ofthe discovery ofthe network intrusion, the government knew orreasonably shouldhave known ofits claim
13against IBM, especially in light ofthe government's assertion that multiple investigations
were necessary to reveal the alleged deficiencies in IBM'sperformance that serve as the basis for the government's claim (gov't opp'n at 2-3).
The Board also rejects appellant's characterization ofthe government's briefas concedingthat the government had knowledge in December2006 offindings ofthe investigation that are the basis for the government's claim 

### (see app. reply br. at 8). Appellant refers to language in the government's briefthatprovides: "these items [the alleged acts and omissions giving rise to the government's claim] were noted after a Defense Information Systems Agency ('DISA') Incident Response & Recovery Team (IRRT) visit on 30 November 2006 to 15 December 2006" (gov'tresp. at 18). The government's briefconcedes the timing ofDISA's visit, but not the timing ofwhen DISA could report its findings. Moreover, a separate part ofthe government's briefasserts that the government's claim was based on the findings ofthe Defense Criminal Investigative Service investigation, which was not completed until 4 April 2012 (gov'topp'n at 2-3, 13).

In addition, the record is incomplete regarding the scope, nature, and details ofthe government's internal investigations. Although the record contains slides from the government's 12 June 2003 presentation with some information about the dates ofits internal investigations (SOF 

## ,r 14), as well as copies ofa series ofgovernment audit net security reports (SOF

## ,r 13), the summary nature ofthese reports do notprovide sufficient detail to determine the relationship betweenthe government's audit findings and the network intrusions. Moreover, as IBM itselfpointed out in its response to the government's initial claim, there are significant disputes ofmaterial fact regarding whose responsibility itwas to implement various network security measures designed to prevent network intrusions (SOF

## ,r 17). In orderto draw conclusions about the timing and scope ofthe government's knowledge ofthe network intrusions, and IBM's alleged failure to prevent the intrusions, we would need significantly more information about the government's investigations.

The multiple investigations, and the lack ofdetailed information aboutthose investigations in the record, raise a genuine issue ofmaterial fact regarding when the government should reasonably have known ofits deficientperformance claim against IBM. As such, summaryjudgmentis not appropriate with respect to the deficient performance claim.
ii. Labor Mischarging Claim Appellant separately asserts that the government's labor mischarging claim is time-barred (app. mot. at 9-11). The only date proposed and established by appellant as undisputed that relates to the labor mischarging claim is September2008, the month when TO 2performancewas completed (SOF 

## ,r 9). Appellant contends that the latestthe
14government claim could have accrued is September2008, "the latest month for which the Government asserts that NDU was overcharged" (app. mot. at 10). Appellant further alleges that the first time the government asserted a claim for labor mischarging was in the 24 March 2015 COFD. Appellant does not argue that the 8 March 2013 demand letter is not a claim; it only argues that the 8 March 2013 letter does not include a claim for labor mischarging. Accordingly, appellant contends that the labor mischarging claim is time-barred because the latest the claim could have accrued was at the end ofIBM's performance ofTO 2 in September2008, more than six years priorto the 24 March 2015 COFD. (Id.)
The government has statedthat the primary concern ofthe government's labor mischarging claim is that "IBM mischarged the government for personnel who did not meet the contractually specified qualifications" (gov'tresp. at 20; compl. , 15) The 8March 2013 letter states: "Furthermore investigation revealed that IBMpersonnel did not have the appropriate subject matter expertise, and were not qualified to execute the IT security related tasks to properlyplan, test and conduct specific tasks ofIT security, as required in the subjectTask Order" (SOF, 11). In light ofthis language, we see no basis to determine that the 8 March 2013 letter does not encompass the government's labor mischarging claim. Accordingly, the Board need not assess ifthe claim could have accrued any later than September2008 because the 8March 2013 demand letter was issued within six years ofthe end ofthe task orderperformance. Appellant's alternative arguments alleging earlier accrual ofthe government's labor mischarging claim are not supported by undisputed facts. Appellant argues thatall but 4 employees that serve as the basis for the labor mischarging claim were engaged on the task orderbefore March 2007, and, therefore, it is entitledto summaryjudgmentwith respect to those 18 employees on the basis that the government would have received their
resumes at the time the employees were hired (app. mot. at 10). We disagree. While appellant established undisputed facts concerning general routines for hiring new personnel during performance ofthe task order (see SOF, 13), appellant failed to establish or even propose the dates when the 18 individuals were hired underTO 2. Accordingly, appellant has failed to establish as an undisputed fact the timing ofthe 18 individuals' employment. Appellant also argues that all charges for invoices submitted priorto March 2007 should be dismissed under summaryjudgment and asserts that any aspect ofthe government's claim relating to background investigations also is time-barred (app. mot. at 11-12). Appellant failed to establish facts regarding the date of specific invoices for which it seeks summaryjudgment. Nordid it establish any facts concerning howbackground investigations were conducted underthe task order.
Thus, we conclude that the current record is inadequate to sustain a finding that the government's claim is time-barred and deny appellant's motion for summary judgment as to the labormischarging claim.

15

### III. PartialSummaryJudgmentas toAQLs Appellant also contends that it is entitled to summaryjudgment on theportion of the government's claim that alleges IBM failed to meetthe network security AQLs (app. mot. at 21). Appellant contends that an AQL violation occurs only ifa relevant deficiency is noted in monthly metric reports, and there is no dispute that none were reported (app. mot. at 21; see also ASUMF, 12; GSGIMF, 12). However, the government has disputed the veracity ofthe information contained in the monthly metric reports (see gov't opp'n at 2-3,,3). IBM prepared monthly metric reports as a deliverable underthe contract (R4, tab 12 at 23; GSGIMF, 10). The government contends that its investigationrevealed that securitypatches were missing, documentation
was lacking, and that information systems were not in compliance withDoD configuration standards at thetime when IBMwas reporting no deficiencies andpolicy compliance in its reports. 

### It also asserts that the reports were not properly signed, certified, or accredited. (Gov'topp'n at 2-3,, 3)

As the government factually has challenged the documents upon which appellant relies to establish thatthere were no AQL deficiencies, it has established a material fact in dispute. Appellant's argumentthatthe auditreports are not relevant to the question of AQL deficiencies is unpersuasive. Appellant asserts that only the information in the monthly reports is relevanttothe question ofwhetherthere were AQL deficiencies, because there is no contractual right to recover 0.5% ofinvoicepayments based upon audit findings. (App. reply at 17) In this instance, the government does not use the audit report as an independentbasis for a claim, butrather as evidence to dispute the factual information contained in IBM's monthly reports. This is sufficientto create a genuine issue ofmaterial fact thatprecludes ourgranting summaryjudgment in appellant's favor.

MOTION TO

### DISMISS FORFAILURETO STATEA CLAIM Finally, appellant also has moved to dismiss the government's complaint for failure to state a claim upon which reliefcan be granted, alleging that the complaint is insufficientto state a claim for labor mischarging. Specifically, appellant contends that the complaint's allegations do not identify any contractual provision specifyingthat particulartasks may beperformedby a person in a specific labor category.
The complaint contains two allegations concerning labor mischarging. First, the government alleges that "[IBMbilled] 22 individuals

...at different labor category rates than those applicable to the actual tasks performed." Second, the government alleges that
some ofthose 22 individuals "did notperform the minimum required elements ofthe task order." The complaint also references DCAA's analysis of22 specific employees, which found examples ofunqualified personnel and defective performance. (Compl., 18)

16

### A. Standard ofReview

Dismissal for failure to state a claim upon which reliefcan be granted is appropriate where the facts asserted in the complaint do not entitle the claimantto a legal remedy. Lindsayv. UnitedStates, 295 F.3d 1252, 1257 (Fed. Cir. 2002). The Boardwill grant a motion to dismiss for failure to state a claim when the complaint fails to allege facts plausibly suggesting (not merely consistentwith) a showing ofentitlementto relief. Cary
v. UnitedStates, 552 F.3d 1373, 1376 (Fed. Cir. 2009) (citingBellAtlantic Corp. v. Twombly, 550 U.S. 544, 557 (2007)). In deciding a motion to dismiss for failure to state a claim, "the court must accept well-pleaded factual allegatfons as true and must draw all reasonable inferences in favor ofthe claimant." KelloggBrown & RootServices, Inc. v. United States, 728 F.3d 1348, 1365 (Fed. Cir. 2013). In this review, "[w]e decide only whetherthe claimant is entitledto offer evidence in support ofits claims, not whetherthe claimantwill ultimatelyprevail." Matcon Diamond, Inc., ASBCA No. 59637, 15-1 BCA

## ,r 36,144 at 176,407. The scope ofourreview is limitedto consideringthe sufficiency ofallegations set forth in the complaint, "matters incorporatedby reference or integral to the claim, items subjecttojudicial notice, [and] matters ofpublic record." 

### A&D Auto Sales, Inc. v. UnitedStates, 748 F.3d 1142, 1147 (Fed. Cir. 2014) (citing 5B CHARLES ALAN WRIGHT & ARTHUR R. MILLER, FEDERAL PRACTICE AND PROCEDURE § 1357 (3d ed. 2004)). Forpurposes ofassessing whether an appeal before us states a claimupon which reliefcan be granted, the primary document setting forth the claim is notthe complaint,per se, but is eitherthe contractor's claim orthe government's claim, the letter asserted in a COFD as required bythe Contract Disputes Act, 41 U.S.C. 

### § 7103(a)(3). LockheedMartin IntegratedSystems, Inc., ASBCA Nos. 59508, 59509, 17-1 BCA

## ,r 36,597 at 178,281.


### B. The Parties' Contentions Appellant contends that the governmenthas failed to state a claim for breach of contract, becausethe complaint's allegations do not identify any contractualprovision specifying thatparticulartasks may only beperformedby aperson in a specific labor category. According to appellant, the contract required merely that IBMbill based on laborrates defined by each worker's labor category, not by the actual tasks performed (app. reply at 15-16). Appellantrelies on pre-award discussions concerning IBM's proposed staffing approach to demonstrate that the government was aware that IBM personnel assigned to the task order would not be limited to supporting only certain tasks
or sub-areas (app. mot. at 18).

In response, the government insists thattheprimary concern in its complaint is that IBM mischarged the government for personnel who did not meet the contractually-specified qualifications, notthat contractorpersonnel worked on tasks outside their assigned labor categories. According to the government, it does not matterwhattask an employee is performing ifthe governmentis consistently payingthe contractor for a more costly labor category. The government also notes that the complaint references the DCAA's
17investigation into labor mischarging, including DCAA's analysis of22 specific employees, and that the allegations in the complaint are sufficientto state a claim labor mischarging based on unqualified personnel (gov'tresp. at 20).
C. The Government has Stated a Claim for which ReliefMay be Granted Appellant's contention that the complaint is deficient, because it does not identify
a contractual provision requiringparticulartasks to be performed by aperson in a specific labor category, fails to account for the complaint's allegations that individuals failed to meet contractual specifications. We read the labor mischarging allegations in the complaint more broadly; as alleging both that appellant overcharged for tasks performed by certain individuals, and that certain individuals did not perform the minimum required elements ofthe task order.

Ourunderstanding ofthe complaint's allegations is reinforced by the specific factual allegations set forth in the COFD. See LockheedMartin IntegratedSystems, 17-1 BCA

## ,r 36,597 at 178,281 (holding that Board will examine complaint and COFD in analyzing a motion for dismiss for failure to state a claim). Although the complaint could have been more specific in terms ofidentifying alleged violations ofcontractual terms, the COFD alleges that IBM employees violated the task orderby failing to perform "tangible work in the area ofquality assurance, network security and enterprise architecture as prescribed in the PWS" (R4, tab 29 at 2). Moreover, with respect to employee qualifications, the COFD alleges that IBMpersonnel "didnot have the appropriate subject matterexpertise, and were not qualified to execute the IT security related tasks toproperly plan, test and conduct specifictasks ofIT security, as required in the subject Task Order" (SOF

## ,r 18). Takentogether, the allegations in the complaint and the COFD are sufficient to state a claim for labor mischarging.

CONCLUSION

For these reasons, each ofappellant's motions is denied.

Dated: 8 March 2018

(Signatures continued)

18 Administrative Judge Armed Services Board ofContract AppealsI concur

RICHARD SHACKLEFORD Administrative Judge Acting Chairman Armed Services Board ofContract Appeals I concur

OWEN C. WILSON Administrative Judge Vice Chairman Armed Services Board ofContractAppeals

I certify that the foregoing is a true copy ofthe Opinion and Decision ofthe Armed Services Board ofContractAppeals in ASBCA No. 60332, Appeal ofIBM Corporation, rendered in conformance with the Board's Charter.

Dated:

19 JEFFREYD. GARDIN Recorder, Armed Services Board ofContract Appeals