Former Tiversa employee takes the stand in FTC v. LabMD, claims Tiversa falsified data presented to FTC and Congress (updated)
Update: The transcript of Rick Wallace’s testimony is now available online, here. At the time this post was written, only an unofficial transcript was available.
After months of delay while immunity was sought and obtained for a former Tiversa employee, Rick Wallace finally took the stand today in FTC v. LabMD.
And as LabMD’s CEO Michael Daugherty had been telling everyone and anyone who would listen, it was blockbuster testimony.
Wallace, who was one of two analysts for Tiversa in 2008, testified that documents submitted to a Congressional hearing in 2007, the FTC, and the House Oversight Committee had all been falsified at Tiversa CEO Bob Boback’s direction to make it appear that certain companies’ files – including LabMD’s “1718 File” – had been found at multiple IP addresses on a file-sharing network.
Wallace testified that in actuality, the LabMD file was only found once – in February 2008 – and it was found on a single LabMD IP address, along with 18 other files in an employee’s folder.
According to Wallace, it was part of Tiversa’s business model to call companies and tell them that their file(s) had been found in various locations as a way of frightening them into purchasing Tiversa’s services to either monitor their files or clean up the single incident. If the potential client didn’t sign up, Wallace testified that Boback would have him create fraudulent records that appeared to show that the file had been found in new and other locations – including the IP addresses of known criminals.
In the case of LabMD, Wallace testified, Boback allegedly wanted to make trouble for the company after Daugherty refused to buy his services. Wallace testified that Boback directed him to “increase the spread” on LabMD and to put their name on a list being given to the FTC of companies that had exposed PII or PHI via file-sharing. In Wallace’s testimony below, the questioner is William Sherman of Dinsmore & Shohl, counsel for LabMD, and Ms. Buchanan is counsel for Wallace. “Mr. Boback” or “Bob” refers to the CEO of Tiversa, Robert Boback. This is from an unofficial transcript of today’s hearing and may change when the final version is released:
Q. When a company refused to do business with Tiversa, did Mr. Boback have a certain reaction to that?
Q. What was that reaction?
A. Usually it would be something to the effect of they, you know, they — I’ve heard this said many, many times, that, you know, you think you had a problem now, you just wait. It would — their information would then proliferate over these networks, actually in our data store, but we would make it look like data had spread to multiple places to then follow up with that company again and try to get them to do business again.
Q. Are you aware of whether or not LabMD agreed or refused to do business with Tiversa?
A. I think initially I don’t think that there was a — I don’t think that they did not want to do business with Tiversa initially, and I think that as the communication advanced back and forth from Bob and different people with LabMD, I think that that’s when they decided that they did not want to do business with Tiversa.
Q. Did Mr. Boback have a reaction to LabMD’s decision not to do business with Tiversa?
Q. And what was that reaction?
A. Do I say it?
MS. BUCHANAN: Answer the question.
THE WITNESS: He basically said F him, make sure he’s at the top of the list.
According to Wallace, not only did the list provided to the FTC in response to their Civil Investigative Demand contain false information about the companies by making it seem that their problems were worse than they were, but Boback also instructed Wallace to delete or scrub companies from the list being given to the FTC if they had purchased Tiversa’s services.
Counsel for FTC had no cross-examination for Wallace, and waived their right to depose him for two hours following his testimony. They have one week to decide if they will call any rebuttal witnesses.
After Wallace was excused, one of his attorneys informed Judge Chappell that they would be filing a motion to have Boback charged under 18 USC 1505 for obstruction. DataBreaches.net learned that staff from the House Oversight Committee was also present during today’s hearing, which may not bode well for Mr. Boback or Tiversa – or the FTC, for that matter, if the House Oversight Committee resumes its investigation of them.
If the FTC does call any rebuttal witnesses, it may be to try to discredit Wallace using some of the same materials Tiversa had provided to Judge Chappell in a Notice of Information that the judge had rejected because Tiversa had not sought leave to intervene and it was an “improper attempt to place evidence on the public record, unilaterally, with the transparent purpose of impugning the credibility of Mr. Wallace’s anticipated testimony and/or influencing the immunity process.” Now that Wallace has testified under immunity, however, will the judge admit it?
Two other points of note in today’s testimony: there was no testimony that indicated that the FTC or any of its staff knowingly received or used falsified data, and there was no accusatory testimony about any FTC personnel’s conduct. But there was also no testimony indicating that the FTC ever made any attempt to verify what Tiversa had provided to them. And that, DataBreaches.net believes, is a serious problem – not only for this case, but in general as to how they proceed in a data security enforcement action.
Previous coverage of this case can be found by searching for “LabMD.” Extensive earlier coverage of the case can be found on PHIprivacy.net.
UPDATE: Robert Boback, CEO of Tiversa, has responded to yesterday’s testimony in a statement, here.