EMBARGOED UNTIL AFTER THE TESTIMONY OF RICHARD WALLACE STAFF REPORT TIVERSA, INC.: WHITE KNIGHT OR HI-TECH PROTECTION RACKET? PREPARED FOR CHAIRMAN DARRELL E. ISSA COMMITTEE ON OVERSIGHT AND GOVERNMENT REFORM U.S. HOUSE OF REPRESENTATIVES 113TH CONGRESS JANUARY 2, 2015 EMBARGOED UNTIL AFTER THE TESTIMONY OF RICHARD WALLACE 1 EMBARGOED UNTIL AFTER THE TESTIMONY OF RICHARD WALLACE Table of Contents I. Introduction............................................................................................................................. 5 II. Tiversa’s Scheme to Defraud the Congress and Executive Agencies ..................................... 6 III. Tiversa’s Lack of Cooperation with this Investigation ........................................................ 7 IV. Tiversa, Inc. ......................................................................................................................... 9 A. Background on the company ............................................................................................ 9 B. Tiversa’s claimed abilities to monitor and track files and users on the peer-to-peer network are exaggerated. .......................................................................................................... 11 C. The Marine One leak .................................................................................................. 16 D. Boback created a hostile work environment at Tiversa ................................................. 18 E. Boback has not been forthcoming regarding the nature of his close relationship with Wallace, or the central role Wallace played at Tiversa ............................................................ 26 F. Tiversa’s Unseemly Business Practices ............................................................................. 39 1. Tiversa used fearmongering tactics to generate business ........................................... 39 2. Tiversa systematically mined for files for “potential” clients as a solicitation tactic. 42 3. Boback Misrepresented Howard Schmidt’s Role in Generating Business Contacts for Tiversa................................................................................................................................... 47 4. Boback Misrepresented Information about Tiversa’s Capabilities to Clients ............ 52 V. Tiversa’s Relationship with the Federal Trade Commission ................................................ 53 A. Tiversa misrepresented the extent of its relationship with the FTC to the Committee .. 54 B. The FTC misrepresented the extent of its relationship with Tiversa to the Committee. 56 C. The FTC failed to question Tiversa’s creation of a dubious shell organization, the Privacy Institute, to funnel information to the FTC .................................................................. 58 D. Tiversa manipulated advanced, non-public, knowledge of FTC regulatory actions for profit 62 E. Information provided by Tiversa formed the basis of the FTC’s case against LabMD . 67 F. Tiversa withheld documents from the FTC ....................................................................... 72 VI. Tiversa’s Involvement with House Ethics Committee Report Leak ................................... 78 A. The Washington Post breaks the story ........................................................................... 78 B. Tiversa “assists” the House Ethics Committee in its investigation ................................ 83 VII. Open Door Clinic ............................................................................................................... 88 A. Initial contact with Tiversa ............................................................................................. 89 2 EMBARGOED UNTIL AFTER THE TESTIMONY OF RICHARD WALLACE B. Tiversa only provided self-serving information to the Open Door Clinic in July 2008 92 C. Tiversa facilitates a class action lawsuit against the Open Door Clinic, and contacts Open Door patients directly ...................................................................................................... 93 D. Tiversa did not charge Bruzzese for the same information it refused to provide to the Open Door Clinic ...................................................................................................................... 97 E. Tiversa provided information on the Open Door Clinic to the FTC .............................. 98 VII. Conclusion ......................................................................................................................... 98 3 EMBARGOED UNTIL AFTER THE TESTIMONY OF RICHARD WALLACE Key Findings Rather than the cyber “white knight” Tiversa purports to be, the company often acted unethically and sometimes unlawfully in its use of documents unintentionally exposed on peer-to-peer networks. At least one Tiversa employee, under the direction of CEO Robert Boback, provided intentionally false information to the United States government on more than one occasion. Boback later provided false testimony about fabricated documents to the U.S. House of Representatives. According to a whistleblower, Tiversa fabricated that an Iranian IP address downloaded and disclosed the blue prints for the President’s helicopter, Marine One. Tiversa allegedly did so in order to receive press attention for the company. The Committee found that statements made by Tiversa under oath about this matter could not be substantiated. After obtaining information on HIV/AIDS patients at a clinic in Chicago, Tiversa employees called the patients, purportedly in an attempt to get the clinic to hire Tiversa. When the clinic refused to hire Tiversa, the company gave the information to a lawyer that worked with the company who filed a class-action lawsuit that eventually settled for a substantial amount of money. Tiversa had information about a breach at the House Ethics Committee exposing information about investigations into Members of Congress. Tiversa did not return this information to the Ethics Committee and instead appears to have sought publicity for the leak. Tiversa’s co-founder claims the company is in possession of a greater quantity of sensitive and classified information than NSA-leaker Edward Snowden. Information provided by Tiversa to the FTC through a shell organization known as the Privacy Institute was only nominally verified but was nonetheless relied on by the FTC for enforcement actions. Tiversa obtained non-public, advanced knowledge of FTC enforcement actions from which it attempted to profit. According to a whistleblower, Tiversa has knowingly accumulated and is in possession of massive amounts of child pornography and classified government documents. 4 EMBARGOED UNTIL AFTER THE TESTIMONY OF RICHARD WALLACE I. Introduction In the summer of 2013, the Committee learned the Federal Trade Commission would bring an enforcement action against LabMD, a Georgia-based cancer screening company, under the guise of its authority under Section 5 of the FTC Act.1 Serving as the basis for the enforcement action, the FTC filed an administrative complaint against LabMD after the personal information of approximately 9,000 LabMD patients was exposed on a peer-to-peer network. Tiversa, a Pittsburgh-based company that sells peer-to-peer monitoring services, provided information on LabMD and nearly 100 other companies to the FTC. This information formed the basis for multiple enforcement actions and dozens of warning letters sent by the FTC. In August 2013, Mike Daugherty, LabMD’s CEO, expressed concern to the Committee about both the relationship between the FTC and Tiversa, Inc., and the veracity of the information provided by Tiversa. In April of the following year, the Committee became aware of a former Tiversa employee with allegations of substantial misconduct related to Tiversa’s dealings with the federal government. Committee staff interviewed Tiversa’s CEO, Robert Boback, on June 5, 2014. Boback’s testimony failed to assuage Committee’s concerns and instead raised many more questions about the relationship between Tiversa and various federal government agencies. Two days later, Boback was deposed for a second time in the FTC action against LabMD. There were several major inconsistencies between this testimony and the testimony he provided to the Committee only days earlier.2 During the course of this investigation, the Committee conducted ten day-long transcribed interviews and reviewed over 50,000 pages of documents. Documents and testimony obtained by the Committee in the course of its investigation displayed a troubling pattern with respect to Tiversa’s business practices. Tiversa routinely provided falsified information to federal government agencies. Instead of acting as the “white knight” the company purports to be, Tiversa often acted unethically and sometimes unlawfully after downloading documents unintentionally exposed on peer-to-peer networks. At least one Tiversa employee, under the direction of Boback, provided intentionally false information to the United States government on more than one occasion. This is a crime. In addition, Boback provided false testimony about fabricated documents to the U.S. House of Representatives. In many instances, documents that Tiversa produced to the Committee pursuant to a subpoena issued on June 3, 2014 lacked important context without explanation. Such gaps prompted the Committee to ask Tiversa’s representatives on several occasions whether the company had produced all documents responsive to the Committee’s subpoena as well