UNITED STATES OF AMERICA BEFORE THE FEDERAL TRADE COMMISSION 06 19 2015 OFFICE OF ADMINISTRATIVE LAW JUDGES ___________________________________ 577890 ) In the Matter of ) PUBLIC ) LabMD, Inc., a corporation ) Docket No. 9357 Respondent. ) UNOPPOSED MOTION ___________________________________ ) RESPONDENT LABMD, INC.’S UNOPPOSED MOTION TO REFER TIVERSA, INC., TIVERSA HOLDING CORP., AND ROBERT BOBACK FOR INVESTIGATION REGARDING POTENTIAL CRIMINAL VIOLATIONS OF 42 U.S.C. § 1320D-6(a), 18 U.S.C. §§ 371, 1001, 1030, 1505, AND 1519 Respondent, LabMD, Inc. (“LabMD”), pursuant to 16 CFR § 3.42(c), moves to refer Tiversa, Inc. and Tiversa Holding Corp. (collectively “Tiversa”), and Tiversa CEO Robert Boback (“Boback”), to the United States Department of Justice for an investigation of potential perjury and criminal violations of 42 U.S.C. § 1320D-6(a) (knowingly obtaining or disclosing individually identifiable health information maintained by a covered entity without authorization and for commercial gain), 18 U.S.C. §§ 371 (conspiracy), 1001 (false statements/perjury), 1030 (computer crimes), 1505 (obstruction), and/or 1519 (falsification of records) in and as a result of their conduct with respect to this proceeding. Complaint Counsel has advised that it will not join Respondent’s Motion but that it does not oppose the relief sought by LabMD herein. Undisputed Facts 1. On May 15, 2015, Congressman Darrell E. Issa released a Staff Report from the House Oversight and Government Reform Committee (“OGR”) entitled, “Tiversa, Inc.: White Knight or High-Tech Protection Racket?” that was prepared on January 2, 2015 (the “OGR Report”). See Exhibit 1, STAFF OF H. COMM. ON OVERSIGHT & GOV’T REFORM, 113th Cong., Tiversa, Inc.: White Knight Or High-Tech Protection Racket?, 1-99 (Jan. 2, 2015) (PREPARED FOR CHAIRMAN PUBLIC DARRELL E. ISSA). The OGR Report supports the need for a robust investigation by an impartial entity. See infra ¶¶ 5-8, 10-17; see also Ex. 1 at 39-42, 61-72. 2. Tiversa, in the ordinary course of its business, willfully and knowingly stole the 1718 File containing individually identifiable health information from LabMD for purposes of commercial gain and in violation of Georgia and federal law. See Exhibit 2, Richard E. Wallace Tr., at 1367-1396, 1399-1403, 1409-11 (May 5, 2015) (Vol. IX) (PUBLIC); see also Off. Code of Ga. Ann. § 16-9-93 (2010) (Georgia Computer Crimes Statute); 42 U.S.C. § 1320D-6(a); 18 U.S.C. § 1030. At all times relevant, LabMD was a “covered entity.” See 45 CFR § 160.103. 3. Boback approved and ratified the theft. See Ex. 2 at 1372-1380. 4. Tiversa routinely manufactured false evidence of “spread” or proliferation to generate business and it did so in this case. Id. at 1380; id. at 1361-1391. 5. Tiversa and/or Boback directed Richard Wallace to manufacture false evidence for this case, including CX19, which was introduced by Complaint Counsel to “prove” that the 1718 File proliferated across peer-to-peer networks and had been found outside of LabMD’s Atlanta, Georgia workstation. Id. at 1361-1411. 6. Tiversa routinely manufactured false reports to its clients to generate business and it did so in this case. Id. at 1390-91; see also CX19; Exhibit 3 (Letter from Chairman Darrell Issa, House Oversight and Government Reform Committee, to FTC Chairwoman Edith Ramirez, at 1-8 (Dec. 1, 2014) (RX543). 7. Tiversa included LabMD on a list of companies it submitted to the Federal Trade Commission (“FTC”) because LabMD refused to pay Tiversa. Ex. 2 at 1365-66. 8. To obstruct and prejudice judicial proceedings in the Eleventh Circuit, Tiversa falsely represented to that Court that it downloaded the 1718 File “without knowledge of the file’s PUBLIC location” and that it did not “know where LabMD and its servers (if it even had servers) were located when it downloaded” the 1718 File. See Brief of Appellee Tiversa, Inc., LabMD, Inc. v. Tiversa, Inc., et al., No. 12-14504, at 15, 29 (11th Cir. Nov. 16, 2012). At all times relevant, Tiversa knew precisely where it had stolen the 1718 File. See Ex. 2, at 1441-44; see also Ex. 3; Exhibit 4, Gormley Dep. Tr., at 25 (Mar. 31, 2014) (“The system determined the IP address of the origination of the file. To determine the precise owner of the file by name, address, the company was sometimes inexact; however, the IP address was exact.”). 9. Contrary to Tiversa’s direct testimony and to documents produced by Tiversa in response to a valid subpoena from Complaint Counsel (and LabMD), the 1718 File was never found anywhere other than the 64.180.92.42 IP address associated with LabMD. See Exhibit 5, Robert Boback Dep. Tr., at 24-25, 41, 72-73; CX19; Ex. 3; see also Ex. 2 at 1443-44; Exhibit 6 (E-mail from Robert Boback, CEO, Tiversa, to Dan Kopchak & Molly Trunzo (Sept. 5, 2013))1 (“In 2008, while doing work for a client, our systems downloaded a file (1,718 page pdf) that contained sensitive information including SSNs and health information for over 9000 people. The file had the name ‘LabMD’ in both the header of the file and the metadata. The IP of the download was found to be in Georgia, which after a Google search, is where we found LabMD’s office to be located.”) (emphasis added). 10. On November 21, 2013, Boback, Tiversa’s designated deponent, knowingly and willfully testified falsely in this proceeding regarding, inter alia: (a) how CX19 was prepared (compare CX703 (excerpts of Deposition Testimony of Robert Boback dated Nov. 21, 2013) at 1 Exhibit 6 was initially proffered as RX547, and is the subject of a pending motion to admit (as RX630, renumbered because of how the exhibit is compiled). It should be admitted into evidence because it is a business record of Tiversa and contains the present sense impression of Boback as of Sept. 5, 2013 concerning the true source of the 1718 File download. See Rule 3.43(b); Fed. R. Evid. 803(1), Fed. R. Evid. 803(6), Fed. R. Evid. 801(d)(1), (d)(3). Moreover, Exhibit 6 is “[r]elevant, material, and reliable” and, as such, should be admitted. See Rule 3.43(b). PUBLIC 50-51, 60-64, with RX541 (excerpts of Deposition Testimony of Robert Boback dated June 7, 2014) at 22, 29, and Ex. 2 at 1441-44); (b) whether Tiversa searched for File 1718’s hash (compare CX703 at 40, with RX541 at 94, and Ex. 2 at 1411); (c) whether Tiversa downloaded files to find the 1718 File (compare CX703 at 73, with RX541 at 67, 74, 80); (d) whether Tiversa searched P2P networks or its own system to find the 1718 File (compare CX703 at 9, with RX541 at 82); (e) whether Tiversa spoke with FTC specifically about LabMD (compare CX703 at 141- 42, with RX541 at 61-62); and (f) whether Tiversa found the 1718 File at four IP addresses (compare CX703 at 50, with RX541 at 81-82). 11. Tiversa/Boback falsified and withheld documents relevant to this case. See Ex. 2 at 1361-1444. 12. Documents given by Tiversa to OGR but withheld from FTC and LabMD contradict Tiversa/Boback’s testimony in this proceeding. Compare RX543 at 4-6, with CX19. 13. A document created in or about June 2014, and offered during Tiversa’s deposition of June 7, 2014, is contradicted by an August 2008 Tiversa report. See Ex. 3 at 6. 14. Tiversa did not produce to FTC, LabMD, or Congress the two 2012 e-mails it offered as proof in a November 2014 pleading that was stricken by this Court, which provided that Richard Wallace could not have fabricated the IP addresses on CX19 in October 2013. See RX543 at 7. 15. A document submitted to OGR, an Incident Report to CIGNA, shows that Tiversa told CIGNA that the 1718 File was first found on April 18, 2008. RX543 at 9, 10, 13. Wallace testified that the 1718 File was stolen on February 25, 2008. See Ex. 2 at 1441-42. However, Tiversa provided documents in this case showing that between January 4, 2008 and PUBLIC January 18, 2008, but no later than January 30, 2008, Tiversa searched P2P networks for Eric Johnson using medical search terms that matched the 1718 File. See RX389; RX368. Discussion 16. It is a crime under 42 U.S.C. § 1320D-6(a) for a person to knowingly obtain or disclose individually identifiable health information relating to an individual if the information is maintained by a covered entity and the person obtained or disclosed such information without authorization. 42 U.S.C. § 1320D-6(b)(3) provides that if the offense is committed with intent to use individually identifiable health information for commercial advantage, the offender should be fined not more than $250,000, imprisoned not more than 10 years, or both. 17. It is a crime under 18 U.S.C. § 1030(a) to intentionally enter a computer used in or affecting interstate commerce and obtain without proper authorization computer files or data belonging to another, and a felony to do so for commercial advantage or private commercial gain. 18. It is a crime under 18 U.S.C. § 1001 to knowingly and willfully falsify, conceal or cover up “by any trick, scheme, or device a material fact”; to make “any materially false, fictitious, or fraudulent statement or representation”; or to make or use “any false writing or document knowing the same to contain any materially false, fictitious, or fraudulent statement or entry” in “any matter within the jurisdiction of the executive, legislative, or judicial branch of the Government of the United States.” 19.