FOR IMMEDIATE RELEASE
June 12, 2014
Congress Questions FTC’s Evidence Against LabMD
WASHINGTON – On June 11, 2014 Congress’s chief watchdog, the House Committee on Oversight and Government Reform, advised the Federal Trade Commission (FTC) that the information the FTC obtained from Tiversa, Inc. is “false,” “incomplete” and “inaccurate.” The Committee also said that it expected the FTC to “cooperate fully” with any subsequent document requests or transcribed interviews with FTC employees.
Cause of Action, a government accountability and transparency organization, has been defending LabMD, an Atlanta-based cancer-detection lab, in an ongoing Federal Trade Commission enforcement action alleging that LabMD’s data security, though not in violation of applicable HIPAA regulations, is unreasonable.
The FTC commenced its four and one-half year assault against LabMD based on information it obtained from Tiversa, Inc. Tiversa is a company claiming to specialize in peer-to-peer network security.
The FTC obtained confidential LabMD patient information from Tiversa in 2009 by way of a sham corporation located in the home of Tiversa’s CEO’s uncle. Although Tiversa had a strong commercial interest in the FTC’s commencement of enforcement proceedings, there is no evidence that the FTC took any steps to authenticate Tiversa’s claim that LabMD patient files had been found in multiple places on a peer-to-peer network. As the FTC and Tiversa were both aware, the unauthorized taking of patient files from a Georgia workstation, by peer-to-peer software or by any other means, is a crime under Georgia law.
To date, the FTC has refused to make public the full nature and extent of its relationship with Tiversa.
According to Dan Epstein, Cause of Action’s Executive Director, “the House Oversight Committee’s investigation should send a message to federal agencies, the President and the courts that the arbitrary abuse of administrative power will not go unchecked. Cause of Action exists to hold accountable those who so choose to abuse their office. This is why it has investigated and litigated for LabMD to stop the FTC from arbitrarily expanding and abusing its power by victimizing an entrepreneur who did nothing wrong. The Committee’s action, and the record of testimony before the Administrative Law Judge and Judge Duffey in the U.S. District Court in Georgia, all lead to a single conclusion: That the FTC – including its commissioners and staff attorneys – must be stopped.”
Excerpts from today’s hearing before the Chief Administrative Law Judge Michael Chappell of the FTC as well as statements from FTC Commissioner J. Thomas Rosch and U.S. District Court Judge William Duffey all point to the dangers or the FTC relying upon unauthenticated evidence as the basis for targeting LabMD:
Commissioner J. Thomas Rosch from his dissent on June 21, 2012 to the FTC’s denial of LabMD’s request to quash civil investigative demands against the company:
Specifically, I am concerned that Tiversa is more than an ordinary witness, informant, or “whistle-blower.” It is a commercial entity that has a financial interest in intentionally exposing and capturing sensitive files on computer networks, and a business model of offering its services to help organizations protect against similar infiltrations. Indeed, in the instant matter, an argument has been raised that Tiversa used its robust, patented peer-to-peer monitoring technology to retrieve the 1,718 File, and then repeatedly solicited LabMD, offering investigative and remediation services regarding the breach, long before Commission staff contacted LabMD. In my view, while there appears to be nothing per se unlawful about this evidence, the Commission should avoid even the appearance of bias or impropriety by not relying on such evidence or information in this investigation.
Judge William Duffey, from the May 7, 2014 United States District Court Northern District of Georgia hearing in LabMD v. FTC:
THE COURT: But the assistant director has just said that there will be evidence presented before a judicial officer, I guess an administrative law judge, in which somebody will state these nine thousand individuals — information about individuals in a single record was accessed by an outside source through a file-sharing program that had been installed on LabMD’s computers. You are going to say that there is no evidence of that —that that ever happened, and you are going to believe that you are right, and the FTC, although sometimes I wonder if they are — just how compelling their evidence is, that they are going to claim that they are right, and somebody will make a determination of whether there has been a breach or not. Then the question is — and I do find this — and I think I know enough about this, and I learned a lot from the CID hearing — is that the FTC is going to go into the business of monitoring and investigating and regulating security breaches and that they have decided I think to do that within what they believe is their administrative authority, because I think they went to Congress and Congress wouldn’t authorize that for whatever reason, whether it’s politics or not. But I think there has been no amendment to Section 5 to specifically allow that. But they are taking the position that they have the authority to do that.
During that same hearing, Mr Schoshinski, an attorney representing the FTC, stated:
THE COURT: So sitting here today, you have no idea where the documents came from, whether they came from LabMD or some other source? Is that a fair thing to say?
MR. SCHOSHINSKI: No. We believe they were LabMD’s documents.
THE COURT: Well, they might have been LabMD’s documents, but you don’t know how they got into the possession of the two individuals that you tried to contact that pled guilty to this offense?
MR. SCHOSHINSKI: That’s correct, Your Honor.
THE COURT: So you have no information to establish how those documents were obtained; is that right?
MR. SCHOSHINSKI: That’s correct, Your Honor.
THE COURT: And you are still proceeding on this claim?
MR. SCHOSHINSKI: Yes, Your Honor, because the claim is not concerning that incident alone. It’s concerning —
THE COURT: All right. But are you still proceeding on that claim?
MR. SCHOSHINSKI: We are proceeding on that evidence, Your Honor.
THE COURT: And that evidence relates to other claims, because you have other documents that were found in other places?
MR. SCHOSHINSKI: That evidence relates to the potential injury suffered by consumers as a result of exposure of this information.
THE COURT: Are you serious about that last response?
MR. SCHOSHINSKI: Yes, Your Honor, I am.
THE COURT: So you don’t know where the documents came from, you don’t know how these people got the possession of it, you don’t know whether they originated from LabMD or some other place, but you are going to use that to show that, because they committed identity theft, that certain individuals were damaged by documents, the source of which you don’t even know?
MR. SCHOSHINSKI: Yes, Your Honor.
THE COURT: Holy cow.
From the June 12, 2014 proceedings before the Administrative Law Judge Chappell at the FTC. The “letter” referenced below is a June 11, 2014 letter from the House Oversight Committee to the FTC found here. Ms. VanDruff, counsel representing the FTC, stated:
JUDGE CHAPPELL: Ms. VanDruff, what part of this letter do you think is not relevant to this proceeding? Stand up and address that question immediately. I just read paragraph 2. I want to hear from you.
MS. VANDRUFF: Your Honor, I didn’t say it wasn’t relevant, Your Honor. And Mr. Sherman is also copied on this letter and it is Mr. Sherman who raised the issue of Mr. Wallace this morning. To the extent that Mr. Sherman believed that this letter was relevant to Your Honor’s —
JUDGE CHAPPELL: You would agree this letter refers to the 1718 File.
MS. VANDRUFF: Absolutely, Your Honor.
JUDGE CHAPPELL: In black-and-white, it’s right there. You would agree it refers to testimony being accurate or not regarding this case.
MS. VANDRUFF: Yes, Your Honor. I made no representation to the contrary.
JUDGE CHAPPELL: Yet you didn’t talk about the letter until I asked you; is that correct?
MS. VANDRUFF: Your Honor.
JUDGE CHAPPELL: Until this lady brought it up.
MS. VANDRUFF: The issue that Your Honor —
JUDGE CHAPPELL: Were you going to sit there and not tell me about this letter? Were you going to do that if I hadn’t asked you? That’s what I want to know.
MS. VANDRUFF: Your Honor, I was prepared address this letter today. Mr. Wallace is not our witness, nor is Mr. Boback, and so if it was in the interest of — I don’t know.
JUDGE CHAPPELL: You don’t think in the interest of truth this information should be disclosed to this court in this proceeding?
MS. VANDRUFF: I was not withholding the information, Your Honor.
JUDGE CHAPPELL: We’re trying to get to the truth here, aren’t we?
MS. VANDRUFF: Of course we are.
JUDGE CHAPPELL: You don’t think this letter touches on this matter in truth on this matter that we’re having a trial. You were not going to bring up this letter; is that correct?
MS. VANDRUFF: No, Your Honor, that is not what I said. No. That is not the position of the government, of course not.
JUDGE CHAPPELL: Then you had plans to offer this letter because it’s relevant? Is that what you’re doing?
MS. VANDRUFF: Excuse me, Your Honor?
JUDGE CHAPPELL: You had plans to offer this as an exhibit?
MS. VANDRUFF: Your Honor, I don’t think that it is admissible for any purpose in this matter because it is hearsay. Nonetheless, I think it’s appropriate in the context of Ms. Dickie’s representations to the court regarding Mr. Wallace and the conduct of the committee for Your Honor to have been advised about the current state of the committee’s investigation.
JUDGE CHAPPELL: This is a letter to the head of the FTC.
MS. VANDRUFF: Correct.
JUDGE CHAPPELL: Talking about fundamental matters in this proceeding about truth or veracity, fundamental matters of a source that’s been very helpful to the government I might add in its case based on what I’ve heard. I’m very disappointed this was not brought to my attention by the government. Go ahead.
MS. VANDRUFF: I apologize, Your Honor. Thank you.