LabMD Briefing Book

In re LabMD, Briefng Book Page 1
Power-Hungry FTC Bureaucrats:
Defending Small Business against Administrative Overreach
In the Matter of LabMD, Inc., FTC Docket No. 9357
On August 28, 2013, the Federal Trade Commission (FTC) issued a
complaint against LabMD, a small cancer-detection lab, accusing it of engag-
ing in unspecifed “unreasonable” data security that allegedly violate Section
5 of the FTC Act’s prohibition of “unfair” trade practices. FTC’s more-than
four year abusive administrative action forced LabMD to shif focus away from
running its business, and the company is now fghting for its life. On March 20,
2014, Cause of Action and LabMD fled suit in Georgia to stop FTC’s overreach.
Te FTC is attacking LabMD even though data-security practices for health
information are regulated by the Department of Health and Human Services
under the Health Insurance Portability and Accountability Act (HIPAA) and
the Health Information Technology for Economic and Clinical Health Act (HI-
TECH). Neither the FTC nor HHS has accused LabMD of violating these laws.
No court has ever ruled that FTC has this authority and FTC has issued no
regulations on data-security practices that apply to LabMD. However, the
agency is claiming the “administrative common law” of consent orders and
Internet postings allows it to go afer anyone, anytime with no prior notice.
Te FTC Retaliated Against LabMD when its Owner Exercised his First Amendment Rights and
Spoke Out About Teir Tainted Investigation.
Almost immediately afer LabMD’s CEO, Michael Daugherty, publicly criticized the FTC and posted the
trailer to his book, Te Devil Inside the Beltway, on his website, the FTC accused LabMD of committing an
“unfair” trade practice by engaging in “unreasonable” data-security and issued an administrative complaint.

Te FTC’s administrative complaint relies heavily on allegations concerning an accounts-receivable fle that a
third party, Tiversa, obtained from LabMD without the company’s knowledge or permission under highly
irregular circumstances, even though an FTC Commissioner had previously warned FTC staf that reliance on
that fle could create “the appearance of bias or impropriety.”

FTC Commissioners and other personnel have repeatedly criticized
LabMD in speeches, media interviews, blog posts and press releases.
FTC staf have asked Mr. Daugherty invasive, irrelevant questions
during depositions, including asking about the doors in his home and
layout of his basement.
Commissioner Julie Brill was forced to recuse herself afer she
made wholly inappropriate comments about LabMD, showing she had
already prejudged the outcome of the case.
BRIEFING BOOK
March 2014
In re LabMD, Briefng Book Page 2
Te FTC Violates Due Process Fair-Notice Requirements when it
Punishes Companies without Defning “Unreasonable” and
“Unfair” Data-Security Practices.
Even though Section 5 never mentions data security, the FTC claims the
statute’s text alone provides fair notice. FTC refuses to establish rules or
regulations explaining what data-security practices it thinks Section 5 forbids
or requires and refuses to issue advisory opinions or endorse industry
standards.
Instead, the FTC apparently thinks it can regulate through afer-the-fact
enforcement actions, “uncodifed standards of care,” and “unwritten rules.”
Even during an enforcement proceeding, the FTC claims “standards used to
enforce Section 5 are outside the scope of discovery.”
Te FTC’s Administrative Process—Where FTC Commissioners
Act as Prosecutors, Legislators, and Judges at the Same Time—Is
Rigged and Violates Due Process.
FTC Commissioner Joshua Wright’s empirical research demonstrates that
LabMD’s fate is already sealed. FTC enforcement staf have won literally
100% of FTC administrative cases for a period of nearly twenty years.
Commissioner Wright told Congress that, in light of “the agency’s admin-
istrative process advantages and the vague nature of the Section 5 authority[,]
. . . frms typically prefer to settle Section 5 claims rather than go through the
lengthy and costly administrative litigation in which they are both shooting
at a moving target and may have the chips stacked against them.”
Te FTC Relied Upon “False,” “Incomplete,” and “Inaccurate” Information
to Launch Its Investigation into LabMD. Congress is Now Prodding Both the
FTC and Tiversa, the Source of that Information
On June 11, 2014 Congress’s chief watchdog, the House Committee on
Oversight and Government Reform, advised the Federal Trade Commission
(FTC) that the information the FTC obtained from Tiversa, Inc. is “false,”
“incomplete” and “inaccurate.” Te Committee also said that it expected the
FTC to “cooperate fully” with any subsequent document requests or tran-
scribed interviews with FTC employees.
Te FTC obtained confdential LabMD patient information from Tiversa in
2009 by way of a sham corporation located in the home of Tiversa’s CEO’s
uncle. Although Tiversa had a strong commercial interest in the FTC’s
commencement of enforcement proceedings, there is no evidence that the
FTC took any steps to authenticate Tiversa’s claim that LabMD patient fles
had been found in multiple places on a peer-to-peer network. As the FTC
and Tiversa were both aware, the unauthorized taking of patient fles from
a Georgia workstation, by peer-to-peer sofware or by any other means, is a
crime under Georgia law. To date, the FTC has refused to make public the
“Tis has grown
from a classic
David-vs-Goliath
battle into a
dispute that
could shape the
future of federal
health privacy
regulation.”
— LabMD CEO
Michael Daugherty
In re LabMD, Briefng Book Page 3
full nature and extent of its relationship with Tiversa.
Te House Oversight Committee’s investigation should send a message to
federal agencies, the President and the courts that the arbitrary abuse of ad-
ministrative power will not go unchecked. Te Committee’s action, and the
record of testimony before the Administrative Law Judge and Judge Dufey
in the U.S. District Court in Georgia, all lead to a single conclusion: Tat the
FTC – including its commissioners and staf attorneys – must be stopped.
Case Files and Attachments
FTC Administrative Complaint against LabMD..................................................4
FTC Order Denying Motion to Dismiss..............................................................16
FTC Motion: “Standards Used to Enforce Section 5 Are
Outside the Scope of Discovery”........................................................................23
FTC Subpoena for Michael Daugherty Book Drafs.........................................25
Initial Pretrial Conference: FTC admits it has no Complaining
Witnesses or Regulations....................................................................................28
Excerpt from Michael Daugherty Deposition: Te Doors in
Your Basement......................................................................................................35
FTC Commissioner Tomas Rosch Dissent.......................................................38
FTC Commissioner Joshua Wright Critiques FTC Process.............................40
FTC Commissioner Joshua Wright Testifes before House Energy
and Commerce Committee................................................................................43
Going on Ofense: LabMD Sues FTC in Federal Court....................................48
Washington Legal Foundation: Te FTC at a Crossroads: Can it be
Both Prosecutor and Judge?..............................................................................66
National Law Journal: FTC Commissioner Julie Brill Forced to
Recuse Herself Afer Improper Statements......................................................70
Transcript from administrative proceedings before the FTC..........................72
Transcript from U.S. District Court hearing
before Judge William S. Dufey.......................................................................112
Letter from the House Oversight Committee to the FTC..............................210
LabMD’s Motion before the ALJ to Admit
the House Oversight Committee Letter as Evidence...................................213
In re LabMD, Briefng Book Page 4
Case: 13-15267 Date Filed: 11/18/2013 Page: 1 of 24
In re LabMD, Briefng Book Page 5
Case: 13-15267 Date Filed: 11/18/2013 Page: 2 of 24
In re LabMD, Briefng Book Page 6
Case: 13-15267 Date Filed: 11/18/2013 Page: 3 of 24
In re LabMD, Briefng Book Page 7
Case: 13-15267 Date Filed: 11/18/2013 Page: 4 of 24
In re LabMD, Briefng Book Page 8
Case: 13-15267 Date Filed: 11/18/2013 Page: 5 of 24
In re LabMD, Briefng Book Page 9
Case: 13-15267 Date Filed: 11/18/2013 Page: 6 of 24
In re LabMD, Briefng Book Page 10
Case: 13-15267 Date Filed: 11/18/2013 Page: 7 of 24
In re LabMD, Briefng Book Page 11
Case: 13-15267 Date Filed: 11/18/2013 Page: 8 of 24
In re LabMD, Briefng Book Page 12
Case: 13-15267 Date Filed: 11/18/2013 Page: 9 of 24
In re LabMD, Briefng Book Page 13
Case: 13-15267 Date Filed: 11/18/2013 Page: 10 of 24
In re LabMD, Briefng Book Page 14
Case: 13-15267 Date Filed: 11/18/2013 Page: 11 of 24
In re LabMD, Briefng Book Page 15
Case: 13-15267 Date Filed: 11/18/2013 Page: 12 of 24
In re LabMD, Briefng Book Page 16
UNITED STATES OF AMERICA
BEFORE THE FEDERAL TRADE COMMISSION
COMMISSIONERS: Edith Ramirez, Chairwoman
Julie Brill
Maureen K. Ohlhausen
Joshua D. Wright
In the Matter of
LabMD, Inc.,
a corporation.
)
)
)
)
)
)
DOCKET NO. 9357
PUBLIC
ORDER DENYING RESPONDENT LABMD’S MOTION TO DISMISS
By Commissioner Joshua D. Wright, for a unanimous Commission:
1
This case presents fundamental questions about the authority of the Federal Trade
Commission (“FTC” or “the Commission”) to protect consumers from harmful business
practices in the increasingly important field of data security. In our interconnected and data-
driven economy, businesses are collecting more personal information about their customers and
other individuals than ever before. Companies store this information in digital form on their
computer systems and networks, and often transact business by transmitting and receiving such
data over the Internet and other public networks. This creates a fertile environment for hackers
and others to exploit computer system vulnerabilities, covertly obtain access to consumers’
financial, medical, and other sensitive information, and potentially misuse it in ways that can
inflict serious harms on consumers. Businesses that store, transmit, and use consumer
information can, however, implement safeguards to reduce the likelihood of data breaches and
help prevent sensitive consumer data from falling into the wrong hands.
Respondent LabMD, Inc. (“LabMD”) has moved to dismiss the Complaint in this
adjudicatory proceeding, arguing that the Commission has no authority to address private
companies’ data security practices as “unfair . . . acts or practices” under Section 5(a)(1) of the
Federal Trade Commission Act (“FTC Act” or “the Act”), 15 U.S.C. § 45(a)(1). This view, if
accepted, would greatly restrict the Commission’s ability to protect consumers from unwanted
privacy intrusions, fraudulent misuse of their personal information, or even identity theft that
may result from businesses’ failure to establish and maintain reasonable and appropriate data
security measures. The Commission would be unable to hold a business accountable for its
conduct, even if its data security program is so inadequate that it “causes or is likely to cause
1
Commissioner Brill did not take part in the consideration or decision herein.
In re LabMD, Briefng Book Page 17
12
application of the FTC Act to that category of practices. Motion at 11-12. But HIPAA evinces
no congressional intent to preserve anyone’s ability to engage in inadequate data security
practices that unreasonably injure consumers in violation of the FTC Act, and enforcement of
that Act thus fully comports with congressional intent under HIPAA. LabMD similarly contends
that, by enacting HIPAA, Congress vested HHS with “exclusive administrative and enforcement
authority with respect to HIPAA-covered entities under these laws.” Id. at 11. That argument is
also without merit. To be sure, the Commission cannot enforce HIPAA and does not seek to do
so.
19
But nothing in HIPAA or in HHS’s rules negates the Commission’s authority to enforce
the FTC Act.
20
Indeed, the FTC Act makes clear that, when Congress wants to exempt a particular
category of entities or activities from the Commission’s authority, it knows how to do so
explicitly – further undermining LabMD’s claim to an implicit “carve-out” from the
Commission’s jurisdiction over HIPAA-covered entities or their “patient-information data
security practices.” Section 5(a)(2) specifically lists categories of businesses whose acts and
practices are not subject to the Commission’s authority under the FTC Act. These include banks,
savings and loans, credit unions, common carriers subject to the Acts to regulate commerce, air
carriers, and entities subject to certain provisions in the Packers and Stockyards Act of 1921.
15 U.S.C. § 45(a)(2). Congress could have added “HIPAA-covered entities” to that list, but it
did not. Similarly, the statute identifies certain types of practices that the Commission may not
address, such as commerce with foreign nations in certain circumstances. Id. § 45(a)(3). But it
provides no carve-out for data security practices relating to patient information, to which HIPAA
may apply.
LabMD relies on Credit Suisse Securities, LLC v. Billing, 551 U.S. 264 (2007), for the
proposition that industry-specific requirements in other statutes may trump more general laws
such as the FTC Act. See Motion at 13. Credit Suisse is clearly distinguishable. As LabMD
concedes, there was a “possible conflict between the [securities and antitrust] laws,” creating a
“risk that the specific securities and general antitrust laws, if both applicable, would produce
conflicting guidance, requirements, . . . or standards of conduct.” Id. By contrast, nothing in the
19
LabMD repeatedly – but incorrectly – asserts that “the FTC agrees that LabMD has not violated
HIPAA or HITECH.” See, e.g., Motion at 13; see also Reply at 4 (“a company FTC admits complied
with HIPAA/HITECH in all respects”) (emphasis in original); id. at 5 (“FTC admits LabMD has always
complied with all applicable data-security regulations”); id. at 12 (“FTC admits that LabMD, a HIPAA-
covered entity, always complied with HIPAA/HITECH regulations”) (emphasis in original). The
Commission does not enforce HIPAA or HITECH, and has never expressed any view on whether LabMD
has, or has not, violated those statutes.
20
Both HHS (pursuant to HIPAA and HITECH) and the FTC (pursuant to the American Recovery and
Reinvestment Act of 2009) have promulgated regulations establishing largely congruent requirements
concerning notification of data breaches involving consumers’ private health information, but they are
applicable to two different categories of firms. Compare 16 C.F.R. Part 318 (FTC rule) with 45 C.F.R.
Part 164, Subparts D & E (HHS rule). LabMD correctly notes that this FTC rule does not apply to
HIPAA-covered entities, see Motion at 12 & n.9, but the conclusion it draws from this fact is unfounded.
Significantly, the Complaint in the present proceeding alleges only statutory violations; it does not allege
violations of the FTC’s Health Breach Notification Rule.
In re LabMD, Briefng Book Page 18
16
enforcement proceeding, even though its “policy was developed in the course of an informal
adjudication, rather than during formal rulemaking.” 212 F.3d at 1350. See also Taylor v.
Huerta, 723 F.3d 210, 215 (D.C. Cir. 2013) (statute enabling agency to revoke pilot’s license
following administrative adjudicatory proceeding “represented nothing more than an ordinary
exercise of Congress’ power to decide the proper division of regulatory, enforcement, and
adjudicatory functions between agencies in a split-enforcement regime . . . . [Petitioner] cites no
authority, and presents no persuasive rationale, to support his claim that due process requires
more.”); RTC Transp., Inc. v. ICC, 731 F.2d 1502, 1505 (11th Cir. 1984) (rejecting contention
that agency’s “application of its policy . . . denied them due process because the policy was
announced in adjudicatory proceedings, . . . rather than being promulgated in rulemaking
proceedings with notice and opportunity for comment”); Shell Oil Co. v. FERC, 707 F.2d 230,
235-36 (5th Cir. 1983) (noting that parties in administrative adjudicatory proceedings are not
denied due process even when agencies establish new, binding standards of general application
in such proceedings, so long as affected parties are given meaningful opportunities to address the
factual predicates for imposing liability).
To be sure, constitutional due process concerns may arise if the government imposes
criminal punishment or civil penalties for past conduct (or unduly restricts expression protected
by the First Amendment) pursuant to a law that “fails to provide a person of ordinary intelligence
fair notice of what is prohibited, or is so standardless that it authorizes or encourages seriously
discriminatory enforcement.” FCC v. Fox Television Stations, Inc., 132 S. Ct. 2307, 2317 (2012)
(quoting United States v. Williams, 553 U.S. 285, 304 (2008)). But, as the D.C. Circuit held in
rejecting a constitutional due process challenge to the Commission’s implementation of the Fair
Credit Reporting Act,
[E]conomic regulation is subject to a less strict vagueness test
because its subject matter is often more narrow, and because
businesses, which face economic demands to plan behavior
carefully, can be expected to consult relevant legislation in
advance of action. The regulated enterprise . . . may have the
ability to clarify the meaning of the regulation by its own inquiry,
or by resort to an administrative process. Finally, the
consequences of imprecision are qualitatively less severe when
laws have . . . civil rather than criminal penalties.
Trans Union Corp. v. FTC, 245 F.3d 809, 817 (D.C. Cir. 2001) (quoting Village of Hoffman
Estates v. Flipside, Hoffman Estates, Inc., 455 U.S. 489, 498-99 (1982)).
Here, the three-part statutory standard governing whether an act or practice is “unfair,”
set forth in Section 5(n), should dispel LabMD’s concern about whether the statutory prohibition
of “unfair . . . acts or practices” is sufficient to give fair notice of what conduct is prohibited. In
enacting Section 5(n), Congress endorsed the Commission’s conclusion that “the unfairness
standard is the result of an evolutionary process . . . . [that] must be arrived at by . . . a gradual
process of judicial inclusion and exclusion.” Policy Statement on Unfairness, 104 F.T.C. at
1072. This is analogous to the manner in which courts in our common-law system routinely
develop or refine the rules of tort or contract law when applying established precedents to new
In re LabMD, Briefng Book Page 19
17
factual situations. As the Supreme Court has recognized, “[b]roadly worded constitutional
and statutory provisions necessarily have been given concrete meaning and application by a
process of case-by-case judicial decision in the common-law tradition.” Northwest Airlines,
Inc. v. Transp. Workers Union of Am., 451 U.S. 77, 95 (1981).
LabMD’s due process claim is particularly untenable when viewed against the backdrop
of the common law of negligence. Every day, courts and juries subject companies to tort liability
for violating uncodified standards of care, and the contexts in which they make those fact-
specific judgments are as varied and fast-changing as the world of commerce and technology
itself. The imposition of such tort liability under the common law of 50 states raises the same
types of “predictability” issues that LabMD raises here in connection with the imposition of
liability under the standards set forth in Section 5(n) of the FTC Act. In addition, when
factfinders in the tort context find that corporate defendants have violated an unwritten rule of
conduct, they – unlike the FTC – can normally impose compensatory and even punitive
damages. Even so, it is well-established that the common law of negligence does not violate due
process simply because the standards of care are uncodified. There is similarly no basis to
conclude that the FTC’s application of the Section 5(n) cost-benefit analysis violates due
process, particularly where, as here, the complaint does not even seek to impose damages, let
alone retrospective penalties.
III. LABMD’S ALLEGED PRACTICES ARE “IN OR AFFECTING COMMERCE”
UNDER THE FTC ACT
In Section III of the Motion to Dismiss, LabMD contends that the acts and practices
alleged in the Complaint do not satisfy the statutory definition of “commerce” set forth in
Section 4 of the FTC Act – i.e., “commerce ‘among’ or ‘between’ states.” See Motion at 28
(citing and paraphrasing 15 U.S.C. § 44, and asserting that LabMD’s principal place of business
is in Georgia; the alleged acts or practices were committed in Georgia; and its servers and
computer network are located in Georgia). This argument is frivolous. The Complaint plainly
alleges that LabMD “tests samples from consumers located throughout the United States.”
Complaint, ¶ 5; see also ¶ 2. Indeed, LabMD concedes in its Answer to the Complaint that it
“tests samples . . . which may be sent from six states outside of Georgia: Alabama, Mississippi,
Florida, Missouri, Louisiana, and Arizona.” Answer, ¶ 5. Thus, the complaint unquestionably
alleges that LabMD’s acts and practices “have been in or affecting commerce, as ‘commerce’ is
defined in Section 4[.]” Complaint, ¶ 2.
IV. THE ALLEGATIONS IN THE COMPLAINT STATE A PLAUSIBLE CLAIM
THAT LABMD ENGAGED IN “UNFAIR . . . ACTS OR PRACTICES”
We turn next to LabMD’s contention that “the Complaint does not state a plausible claim
for relief” on the ground that the “Complaint’s allegations are nothing more than inadequate
‘legal conclusions couched as factual allegations.’” Motion at 28-29 (quoting Bell Atlantic
Corp. v. Twombly, 550 U.S. 554, 555 (2007)).
That is incorrect. The Complaint quite clearly sets forth specific allegations concerning
LabMD’s conduct and other elements of the charged violation. In particular, it includes plausible
In re LabMD, Briefng Book Page 20
18
allegations that satisfy each element of the statutory standard for unfairness: that (1) the alleged
conduct caused, or was likely to cause, substantial injury to consumers; (2) such injury could not
reasonably have been avoided by consumers themselves; and (3) such injury was not outweighed
by benefits to consumers or competition. 15 U.S.C. § 45(n). We emphasize that, for purposes of
addressing LabMD’s Motion to Dismiss, we presume – without deciding – that these allegations
are true. But the Commission’s ultimate decision on LabMD’s liability will depend on the
factual evidence to be adduced in this administrative proceeding.
A. Causation or Likely Causation of Substantial Injury to Consumers
The Complaint contains sufficient allegations to satisfy the criterion that the respondent’s
acts or practices “cause[d], or [were] likely to cause, substantial injury to consumers.” Id. First,
the Complaint alleges that LabMD collected and stored on its computer system highly sensitive
information on consumers’ identities (e.g., names linked with addresses, dates of birth, Social
Security numbers, and other information), their medical diagnoses and health status, and their
financial transactions with banks, insurance companies, and health care providers. See
Complaint, ¶¶ 6-9, 19, 21.
Second, the Complaint contains allegations that LabMD implemented unreasonable data
security measures. These measures allegedly included (i) “acts of commission,” such as
installing Limewire, a peer-to-peer file sharing application, on a billing manager’s computer, see
id., ¶¶ 13-19, as well as (ii) “acts of omission,” such as failing to institute any of a range of
readily-available safeguards that could have helped prevent data breaches. See id., ¶¶ 10(a)-(g)).
Third, the Complaint alleges that LabMD’s actions and failures to act, collectively,
directly caused “substantial injury” resulting from both (i) actual data breaches, enabling
unauthorized persons to obtain sensitive consumer information, id., ¶¶ 17-21, as well as
(ii) increased risks of other potential breaches. Id., ¶¶ 11-12, 22. Notably, the Complaint’s
allegations that LabMD’s data security failures led to actual security breaches, if proven, would
lend support to the claim that the firm’s data security procedures caused, or were likely to cause,
harms to consumers – but the mere fact that such breaches occurred, standing alone, would not
necessarily establish that LabMD engaged in “unfair . . . acts or practices.” The Commission has
long recognized that “the occurrence of a breach does not necessarily show that a company failed
to have reasonable security measures. There is no such thing as perfect security, and breaches
can happen even when a company has taken every reasonable precaution.” See Comm’r
Swindle’s 2004 Information Security Testimony at 4.
23
Accordingly, we will need to determine
whether the “substantial injury” element is satisfied by considering not only whether the facts
alleged in the Complaint actually occurred, but also whether LabMD’s data security procedures
23
See also In re SettlementOne Credit Corp., File No. 082 3209, Letter to Stuart K. Pratt, Consumer Data
Industry Association, from Donald S. Clark, Secretary, by Direction of the Commission, at 2 (Aug. 17,
2011) (http://www.ftc.gov/sites/default/files/documents/cases/2011/08/110819lettercdia_1.pdf)
(affirming, in resolving three cases concerning data security practices alleged to violate the Fair Credit
Reporting Act, that it had “applied the standard that is consistent with its other data security cases – that
of reasonable security. This reasonableness standard is flexible and recognizes that there is no such thing
as perfect security.”)
In re LabMD, Briefng Book Page 21
19
were “unreasonable” in light of the circumstances. Whether LabMD’s security practices were
unreasonable is a factual question that can be addressed only on the basis of evidence to be
adduced in this proceeding.
Fourth, the Complaint alleges that the actual and potential data breaches it attributes to
LabMD’s data security practices caused or were likely to cause cognizable, “substantial injury”
to consumers, including increased risks of “identity theft, medical identity theft,” and “disclosure
of sensitive private medical information.” See Complaint, ¶ 12; see also id., ¶¶ 11, 21-22. These
allegations clearly refute LabMD’s contentions that the Complaint contains “no allegations of
monetary loss or other actual harm” nor “any actual, completed economic harms or threats to
health or safety.” Motion at 28-29. Moreover, occurrences of actual data security breaches or
“actual, completed economic harms” (id. at 29) are not necessary to substantiate that the firm’s
data security activities caused or likely caused consumer injury, and thus constituted “unfair . . .
acts or practices.” Accord Policy Statement on Unfairness, 104 F.T.C. at 949 n.12 (act or
practice may cause “substantial injury” if it causes a “small harm to a large number of people” or
“raises a significant risk of concrete harm”) (emphasis added); accord Neovi, 604 F.3d at 1157
(quoting Am. Fin. Servs., 767 F.2d at 972).
B. Avoidability
The Complaint contains plausible allegations that these harms could not reasonably be
avoided by consumers. Consumers allegedly did not have any “way of independently knowing
about respondent’s security failures,” let alone taking any action to remedy them or avoid the
resulting harm. Complaint, ¶ 12.
C. Countervailing Benefits to Consumers or Competition
Finally, the Complaint alleges that the alleged conduct did not even benefit LabMD,
much less anyone else (id., ¶ 20), and that LabMD could have remedied the risks of data
breaches “at relatively low cost” (id., ¶ 11). These allegations provide a plausible basis for
finding that the harms to consumers were not outweighed by other benefits to consumers or
competition. Again, Complaint Counsel will need to prove these allegations, and LabMD will
have the opportunity to refute them, on the basis of factual evidence presented at the upcoming
hearing.
* * * * *
For the reasons discussed above, we deny LabMD’s Motion to Dismiss.
In re LabMD, Briefng Book Page 22
20
Accordingly,
IT IS ORDERED THAT Respondent LabMD, Inc.’s Motion to Dismiss Complaint with
Prejudice IS DENIED.
By the Commission, Commissioner Brill recused.
Donald S. Clark
Secretary
SEAL:
ISSUED: January 16, 2014
In re LabMD, Briefng Book Page 23
UNITED STATES OF AMERICA
BEFORE THE FEDERAL TRADE COMMISSION
OFFICE OF ADMINISTRATIVE LAW JUDGES
____________________________________
)
In the Matter of ) PUBLIC
)
LabMD, Inc., ) Docket No. 9357
a corporation, )
Respondent. )
)
____________________________________)
COMPLAINT COUNSEL’S MOTION FOR PROTECTIVE ORDER
REGARDING RULE 3.33 NOTICE OF DEPOSITION
Pursuant to Rules 3.22, 3.31(d), and 3.33(b), 16 C.F.R. §§ 3.22, 3.31(d) & 3.33(b),
Complaint Counsel respectfully moves for a Protective Order to prevent Respondent from
proceeding with the deposition of designee(s) of the Commission’s Bureau of Consumer
Protection, as noticed in Respondent’s January 30, 2014 Notice of Deposition of the Bureau of
Consumer Protection. Respondent’s Notice is overbroad in seeking testimony regarding matters
outside the scope of fact discovery, failing to describe the matters on which it requests
examination with “reasonable particularity,” and attempting to reach members of the
Commission. Complaint Counsel conferred in good faith with Respondent in an effort to resolve
the dispute but was not able to reach an agreement. See Meet and Confer Statement, attached as
Exhibit A).
BACKGROUND
Commission staff opened a Part II investigation into the adequacy of LabMD, Inc.’s
(“LabMD”) information security practices in January 2010. Prior to initiating the investigation,
In re LabMD, Briefng Book Page 24
- 7 -
II. STANDARDS USED TO ENFORCE SECTION 5 ARE OUTSIDE THE SCOPE
OF DISCOVERY
Respondent’s Notice Topic 2 calls for the Bureau’s designee(s) to provide testimony
regarding “[a]ll data-security standards that have been used by the [Bureau] to enforce the law
under Section 5 of the Federal Trade Commission Act since 2005.” Ex. B at 4. The orders and
opinions of the Commission and of this Court preclude such discovery. The Commission’s
January 16, 2014 Order Denying Respondent LabMD’s Motion to Dismiss (“MtD Order”) and
this Court’s January 30, 2014 Order on Complaint Counsel’s Motion to Quash (“Quash Order”)
rejected Respondent’s assertions that: (1) the Commission has failed to give fair notice of “what
data-security practices the Commission believes Section 5 of the FTC Act forbids or requires”
(Fifth Affirmative Defense); and (2) the Commission’s actions have been “arbitrary, capricious,
an abuse of discretion, or otherwise not in accordance with law” (Third Affirmative Defense).
To this end, the Commission held that “the three-part statutory standard governing whether an
act or practice is ‘unfair,’ set forth in Section 5(n)” provides “fair notice of what conduct is
prohibited.” MtD Order at 16. Likewise, this Court held that evidence challenging the “bases
for the Commission’s commencement of this action” is “not relevant for purposes of discovery in
an administrative adjudication.” Quash Order at 6 and cases cited therein. Accordingly,
Respondent’s Notice Topic 2, which relates to “data-security standards,” does not correspond to
any permissible affirmative defense and is foreclosed by the MtD Order and the Quash Order.
III. INQUIRY REGARDING CONSUMERS HARMED BY RESPONDENT’S
PRACTICES CONSTITUES PREMATURE EXPERT DISCOVERY
Respondent’s Notice Topic 3 fails because it demands testimony that Complaint Counsel
will present through expert witnesses. Specifically, Respondent’s Notice Topic 3 requires that
In re LabMD, Briefng Book Page 25
In re LabMD, Briefng Book Page 26
In re LabMD, Briefng Book Page 27
In re LabMD, Briefng Book Page 28
In the Matter of:
LabMD, Inc.
September 25, 2013
Initial Pretrial Conference
Condensed Transcript with Word Index
For The Record, Inc.
(301) 870-8025 - www.ftrinc.net - (800) 921-5555
In re LabMD, Briefng Book Page 29
Initial Pretrial Conference
LabMD, Inc. 9/25/2013
(301) 870-8025 - www.ftrinc.net - (800) 921-5555
For The Record, Inc.
1 (Pages 1 to 4)
1
1 I N D E X
2
3
4 CASE OVERVIEW: PAGE:
5 BY MR. SHEER 8
6 BY MR. RUBINSTEIN 22
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
2
1 UNITED STATES OF AMERICA
2 FEDERAL TRADE COMMISSION
3
4
5 In the Matter of: )
6 LABMD, INC., ) Docket No. 9357
7 a corporation. )
8 ------------------------------)
9
10
11
12 INITIAL PRETRIAL CONFERENCE
13 SEPTEMBER 25, 2013
14 2:00 P.M.
15 PUBLIC SESSION
16
17
18
19 BEFORE THE HONORABLE D. MICHAEL CHAPPELL
20 Administrative Law Judge
21
22
23
24
25 Reported by: Susanne Bergling, RMR-CRR-CLR
3
1 APPEARANCES:
2
3 ON BEHALF OF THE FEDERAL TRADE COMMISSION:
4 ALAIN SHEER, ESQ.
5 LAURA RIPOSO VANDRUFF, ESQ.
6 MEGAN COX, ESQ.
7 MARGARET LASSACK, ESQ.
8 RYAN MEHM, ESQ.
9 Federal Trade Commission
10 Division of Privacy and Identity Protection
11 601 New Jersey Avenue, N.W.
12 Washington, D.C. 20001
13 (202) 326-2999
14 [email protected]
15
16 ON BEHALF OF RESPONDENT:
17 REED D. RUBINSTEIN, ESQ.
18 Dinsmore & Shohl LLP
19 801 Pennsylvania Avenue, N.W., Suite 610
20 Washington, D.C. 20004
21 (202) 372-9100
22 [email protected]
23
24 ALSO PRESENT:
25 Victoria Arthaud and Hillary Sloane Gebler
4
1 P R O C E E D I N G S
2 - - - - -
3 JUDGE CHAPPELL: Okay. Call to order Docket
4 9357, In Re: LabMD. Is there a space after the B or is
5 that one word, "LabMD"?
6 MR. RUBINSTEIN: It is one word, Your Honor.
7 JUDGE CHAPPELL: Okay. Thank you.
8 I will start with appearances of the parties,
9 and I will start with the Government. Go ahead.
10 MR. SHEER: Good afternoon, Your Honor. I'm
11 Alain Sheer representing the Commission.
12 MS. VANDRUFF: Good afternoon, Your Honor.
13 Laura VanDruff, Complaint Counsel.
14 JUDGE CHAPPELL: Okay.
15 And for Respondent?
16 MR. RUBINSTEIN: Your Honor, Reed Rubinstein
17 representing Respondent. If I could, I would like to
18 take this opportunity to thank you and to thank
19 government counsel for their accommodation of my
20 schedule. It is very much appreciated.
21 JUDGE CHAPPELL: You're welcome. I would expect
22 that request to come a little sooner next time.
23 MR. RUBINSTEIN: Yes, Your Honor.
24 JUDGE CHAPPELL: And also, just so everyone
25 knows, we do follow motions practice, and I will need a
In re LabMD, Briefng Book Page 30
Initial Pretrial Conference
LabMD, Inc. 9/25/2013
(301) 870-8025 - www.ftrinc.net - (800) 921-5555
For The Record, Inc.
2 (Pages 5 to 8)
5
1 motion from here out to deal with something.
2 MR. RUBINSTEIN: Thank you.
3 JUDGE CHAPPELL: I notice that we have got more
4 than two people listed at on least one side. Our office
5 will email courtesy copies of orders to the parties.
6 That's courtesy copies. Official service is made by the
7 Office of the Secretary. I will need each party to
8 designate no more than two individuals to receive
9 communications from my office. You can send an email to
10 my assistant, Dana Gross, or just to the OALJ Web site,
11 and give us the two people you want to receive courtesy
12 copies from my office.
13 I think for the first time in history we have no
14 modifications to the draft scheduling order. So, thanks
15 to both of you. I will issue that order by tomorrow or
16 Friday. I think I'm obligated to get it out by Friday
17 under the latest rules.
18 There's a limit to the amount of time we're in
19 trial. I don't anticipate us getting anywhere near the
20 limit. Does -- while we're here, how many witnesses do
21 you anticipate for the Government? I just need a
22 ballpark. I'm not holding you to anything.
23 MR. SHEER: Judge, I'm watching the monitor. We
24 expect that we will be putting on seven or eight
25 witnesses.
6
1 JUDGE CHAPPELL: Okay.
2 And for the Respondent?
3 MR. RUBINSTEIN: Approximately the same number.
4 JUDGE CHAPPELL: I'm thinking this is going to
5 move along fairly quickly. Any experts?
6 MR. SHEER: Yes, Your Honor. We are going to be
7 using experts on technical issues and also on consumer
8 injury.
9 JUDGE CHAPPELL: You need to stand up when you
10 speak. She needs to hear you. Use that microphone.
11 MR. SHEER: Sorry. We are expecting to use
12 technical experts and also experts for consumer injury.
13 JUDGE CHAPPELL: Okay.
14 MR. RUBINSTEIN: Your Honor, we also will be
15 using --
16 JUDGE CHAPPELL: If you -- if you use that
17 microphone -- just stand and use one of the microphones,
18 either one. You have got one over in the middle.
19 MR. RUBINSTEIN: This one works, if it works for
20 you.
21 We will also be presenting expert testimony,
22 rebuttal testimony to the Government's witnesses. We
23 anticipate there will be two, perhaps three, that will
24 go to harm and will also go to the technical issues
25 associated with the file theft.
7
1 JUDGE CHAPPELL: Okay. Under the current rules,
2 the hearing is limited to no more than 210 hours. So, I
3 need the parties to develop a system or mechanism to
4 keep track of that, although I don't see us stretching
5 those boundaries in this hearing.
6 Regarding -- one thing regarding the scheduling
7 order, let me talk about dispositive motions. I didn't
8 put a deadline on the scheduling order for summary
9 judgment motions. There is a rule that covers that, if
10 you intend to file a summary judgment, and if you don't
11 know, I'll tell you.
12 Summary judgments will be ruled on by the
13 Commission, the same body that voted to issue the
14 complaint in this case. With respect to motion to
15 dismiss or other substantive motion, the rules provide
16 that if they are filed before the start of the
17 evidentiary hearing, they will be ruled on by that same
18 Commission; however, motions to dismiss or substantive
19 motions filed after the start of the evidentiary hearing
20 will be decided by me, not the Commission.
21 Have there been any settlement discussions?
22 MR. SHEER: There were very, very preliminary
23 settlement discussions; that is to say that Respondent
24 LabMD had indicated they had interest in settlement at
25 one point long ago, but the parties did not pursue it,
8
1 and at this moment, there are no settlement discussions
2 on the table or ongoing.
3 JUDGE CHAPPELL: Any comment on that?
4 MR. RUBINSTEIN: That is correct, Your Honor.
5 JUDGE CHAPPELL: At this time, I allow each side
6 to present an overview of their case, and I limit it to
7 15 minutes, and I'll let the Government go first;
8 however, I'll let you know, if I ask questions, I will
9 add to your time, or take up any of your 15 minutes.
10 Go ahead.
11 MR. SHEER: Thank you, Your Honor. LabMD is a
12 medical laboratory that tests blood and tissue samples
13 that doctors take from consumers. In doing so, it's
14 collected very sensitive information about hundreds of
15 thousands of consumers, including names, Social Security
16 numbers, checking account information, and medical test
17 results.
18 JUDGE CHAPPELL: Hundreds of thousands. So,
19 you're saying they do a national business?
20 MR. SHEER: They do a national business.
21 LabMD exposes this treasure trove of information
22 to people who never should have had access to it by
23 failing to take reasonable and appropriate security
24 measures. Identity thieves use consumers' personal
25 information to impersonate them in a variety of ways,
In re LabMD, Briefng Book Page 31
Initial Pretrial Conference
LabMD, Inc. 9/25/2013
(301) 870-8025 - www.ftrinc.net - (800) 921-5555
For The Record, Inc.
3 (Pages 9 to 12)
9
1 depending on the information. For example, financial
2 information has been misused to open new -- to conduct
3 credit card fraud and to go into bank accounts; and
4 medical information has been misused to steal insurance
5 benefits. In each of the last ten years, identity theft
6 has been the number one complaint that the FTC has
7 received. There were 369,000 complaints in 2012.
8 The personal information that LabMD maintains is
9 information that identity thieves want. This was action
10 was brought under Section 5 of the FTC Act. Section 5
11 provides the Commission with broad authority to address
12 new areas and practices as they develop.
13 JUDGE CHAPPELL: Have you -- in that regard, has
14 the Commission issued guidelines for companies to
15 utilize to protect this information or is there
16 something out there for a company to look to?
17 MR. SHEER: There is nothing out there for a
18 company to look to. The Commission has entered into
19 almost 57 negotiations and consent agreements that set
20 out a series of vulnerabilities that firms should be
21 aware of, as well as the method by which the Commission
22 assesses reasonableness.
23 In addition, there have been public statements
24 made by the Commission, as well as educational materials
25 that have been provided. And in addition, the industry,
10
1 the IT industry itself, has issued a tremendous number
2 of guidance pieces and other pieces that basically set
3 out the same methodology that the Commission is
4 following in deciding reasonableness, with one
5 exception, and the exception is that the Commission's
6 process as to the calculation of the potential consumer
7 harm from unauthorized disclosure of information.
8 JUDGE CHAPPELL: Is there a rulemaking going on
9 at this time or are there rules that have been issued in
10 this area?
11 MR. SHEER: There are no -- there is no
12 rulemaking, and no rules have been issued, other than
13 the rule issued with regard to the Gramm-Leach-Bliley
14 Act. There is a safeguards rule there which is issued
15 for financial institutions. The way that rule reads and
16 the way it works, it basically --
17 JUDGE CHAPPELL: The FTC has jurisdiction in
18 that area?
19 MR. SHEER: It has jurisdiction over certain
20 types of financial institutions, such as --
21 JUDGE CHAPPELL: Is that expressed in that Act?
22 MR. SHEER: It is.
23 JUDGE CHAPPELL: Okay.
24 MR. SHEER: As I was saying, Your Honor,
25 information security, which is an essential part of our
11
1 economy now given the increasing reliance on and use of
2 computer networks, is one of the new areas that the
3 Commission is able to look into. The complaint alleges
4 that the company, LabMD, engaged in an unfair act or
5 practice in violation of Section 5 by collecting and
6 storing large amounts of very sensitive consumer
7 information and failing to use reasonable and
8 appropriate security measures to prevent the information
9 from being disclosed without authorization.
10 As set out in 15 USC 45(n), an act or practice
11 is unfair when it causes or is likely to cause
12 substantial consumer injury that is not -- and the
13 injury is not reasonably avoidable by consumers and not
14 offset by countervailing benefits to consumers or
15 competition. The complaint alleges that LabMD
16 systematically failed to practice what IT professionals
17 generally call -- quote unquote -- defense in depth.
18 Defense in depth is a general approach for
19 identifying the kinds of security measures that will be
20 reasonable under particular circumstances. It sets out
21 guiding principles that IT professionals and industry
22 have known and used for years. There are lots of
23 sources for the principles, such as materials published
24 by the National Institute of Standards and Technology,
25 continuing education for IT professionals, practical IT
12
1 experience, and lessons learned from publicized
2 breaches.
3 Some of these guiding principles are, first, do
4 not put all your eggs in one basket, because a single
5 security measure may fail or be vulnerable. For
6 example, if the only security measure for a company's
7 network were a firewall and the firewall were not set up
8 correctly, an outsider could exploit the mistake and
9 gain entry to the network, because there are no other
10 security measures in place. The outsider would have
11 free reign within the network and could find -- easily
12 find and export sensitive information.
13 Second, limit a computer user's control over the
14 computers and data to the lowest level the user needs to
15 perform their job. For example, users do not need to be
16 able to change security settings on their computers or
17 install programs on their computers without getting
18 prior approval.
19 Third, also use nontechnical measures, such as
20 providing security training for employees, a plan for
21 responding to security incidents, and maintaining
22 written security policies and procedures for IT
23 employees to follow.
24 The final step in identifying measures that will
25 provide reasonable defense in depth is a common sense
In re LabMD, Briefng Book Page 32
Initial Pretrial Conference
LabMD, Inc. 9/25/2013
(301) 870-8025 - www.ftrinc.net - (800) 921-5555
For The Record, Inc.
5 (Pages 17 to 20)
17
1 free.
2 I'd like to turn to the second failure, and that
3 is the failure to use appropriate measures to identify
4 commonly known or reasonably foreseeable risks to
5 personal information as set out in paragraph 10 of the
6 complaint. Because no single tool can identify all the
7 different security threats a company may face, IT
8 professionals tell us that identifying risks usually
9 requires a variety of measures or tools.
10 One such tool that's familiar to almost all of
11 us is an antivirus program. Another tool is called a
12 penetration test, which usually includes an automated
13 vulnerability scan and related activities. Pen tests,
14 as they're called, probe a company's defenses from the
15 outside looking for cracks, just like an intruder would.
16 A pen test might, again, by looking for a
17 vulnerability in a firewall, looking to test the
18 firewall for a vulnerability, looking for an opening,
19 basically, to get into the network. Once inside the
20 network, the test might test computers and applications
21 or programs, looking for vulnerabilities that could be
22 leveraged to get access to sensitive information.
23 We are told that antivirus programs can't
24 identify holes in firewalls and that pen tests can't
25 identify viruses. Both of them are needed to
18
1 effectively identify risks in networks that connect
2 online like LabMD's. Both are basic, foundational tools
3 that have been used by companies for years.
4 JUDGE CHAPPELL: You're talking about antivirus,
5 but if you have a P2P program, you've created the hole.
6 So, how is your antivirus going to stop something that
7 you've created? What's the point of that?
8 MR. SHEER: That's exactly the point. The point
9 is that the antivirus program is not going to identify
10 the P2P application or program that's on your network.
11 JUDGE CHAPPELL: It's like clicking on the link
12 on the email you shouldn't open. Your Norton Antivirus
13 isn't going to stop that because you clicked.
14 MR. SHEER: You're preaching to the choir, yes.
15 JUDGE CHAPPELL: Well, not necessarily. I'm
16 objective here. My point is, why would I pay for extra
17 antivirus software if I've decided to use P2P software
18 and I know the hole is there? What's the point in
19 telling me I needed to put antivirus on my computer?
20 MR. SHEER: Well, we're not making the argument
21 that they should have been putting an antivirus on their
22 computers, and I will say -- and I thought this was what
23 you said earlier -- that an antivirus program is not
24 going to identify a P2P program, because it's looking
25 for viruses, which are small, malicious programs that
19
1 operate in the background that you don't know about,
2 that you may get on your computer by what you just
3 described, media that comes in with a link that says
4 "Click on this link," you click on the link, and a
5 program -- a virus program is downloaded onto your
6 computer and operates in the background. But that's not
7 what we're alleging here was the problem in this
8 explanation.
9 What we're alleging here was the failure to have
10 a penetration test would not identify to the company
11 other risks that could not be identified by an antivirus
12 program. That's why the IT professionals tell us that
13 you really need to have a variety of tools to identify
14 risks, because there's no one tool that will identify
15 all the threats that a company faces.
16 JUDGE CHAPPELL: Okay. Now I follow why you're
17 talking about antivirus. Go ahead.
18 MR. SHEER: The complaint alleges that LabMD did
19 not use adequate measures, such as pen tests, to
20 identify commonly known or reasonably foreseeable risks.
21 As a result, it was blind to some risks and, therefore,
22 unlikely to effectively guard against them.
23 To sum up, the complaint alleges that LabMD's
24 security failures went beyond sharing a file with
25 sensitive information about 9300 people to a P2P
20
1 network. The company's security practices created
2 vulnerabilities an outsider could stitch together to
3 find a way into the network, to move around the network
4 and explore it, to find sensitive information, and then
5 to package up the information and export it from the
6 network without the company's noticing.
7 LabMD failed to implement reasonable security
8 measures, and that is an unfair act or practice because
9 it caused or is likely to cause substantial consumer
10 injury that's not offset by countervailing benefits to
11 consumers or competition and also not reasonably
12 avoidable by consumers. After all, how can a consumer
13 even know what LabMD's security practices were, let
14 alone assess how adequate or inadequate they might be?
15 One final point. Neither the complaint nor the
16 notice order prescribes specific security practices that
17 LabMD should implement going forward. They do not, for
18 example, require that a certain vulnerability scanning
19 product be used. Because security threats and responses
20 change so rapidly, the order leaves it to the company to
21 determine the particular security measures that, taken
22 together, will provide reasonable security at lowest
23 cost in its circumstances.
24 Although the Commission retains the right to do
25 so, under the notice order and all of the other
In re LabMD, Briefng Book Page 33
Initial Pretrial Conference
LabMD, Inc. 9/25/2013
(301) 870-8025 - www.ftrinc.net - (800) 921-5555
For The Record, Inc.
6 (Pages 21 to 24)
21
1 Commission information security consent orders, a strong
2 indication that security is reasonable is a security
3 certification from an independent IT professional who's
4 capable of balancing the costs and benefits and follows
5 protocols commonly used in the profession. These are
6 the same sorts of things that internal IT employees
7 commonly do for companies across the country. Frankly,
8 the order only asks LabMD to do what it should have been
9 doing anyway but didn't.
10 Thank you.
11 JUDGE CHAPPELL: I have one question. I heard
12 you refer to Section 5, but I also heard you refer to
13 various other rules, regulations, et cetera. Is it the
14 Government's position that whatever rule or regulation
15 or statute that you're alleging was violated is
16 contained within the four corners of this complaint?
17 MR. SHEER: What we're saying is that the
18 allegation is that the company failed to comply with
19 Section 5 in engaging an unfair act or practice by
20 failing to provide reasonable security for sensitive
21 information. We are saying that reasonableness is a
22 common sense balancing of cost and benefit and that
23 common sense is available from many, many sources,
24 including organizations -- government organizations,
25 such as the National Institute of Standards and
22
1 Technology, private entities, such as the SANS
2 Institute, and many others as well. So that we are
3 assessing reasonable -- reasonableness in much the same
4 way, following the same process that is commonly used
5 throughout the IT industry now. We add only one
6 additional factor, and that is take into account the
7 potential consumer harm from failing to have reasonable
8 security to protect that information.
9 JUDGE CHAPPELL: I'm not sure you answered my
10 question, Counselor. Are there any rules or regulations
11 that you're going to allege were violated here that are
12 not within the four corners of the complaint?
13 MR. SHEER: I misunderstood. I'm sorry. No.
14 JUDGE CHAPPELL: All right. Thank you.
15 MR. RUBINSTEIN: The facts in this case are
16 pretty simple and pretty clear. The billing manager,
17 the person responsible for handling LabMD's invoicing --
18 a small company, a very limited staff --
19 JUDGE CHAPPELL: Tell me more about what LabMD
20 does. Do you take blood samples?
21 MR. RUBINSTEIN: It's a pathology lab. The
22 customers -- LabMD's customers are doctors. You go in
23 to see a doctor -- and it's a very small specialty
24 business for particular kinds of cancer detection. You
25 go in to see a doctor. He will take a tissue sample for
23
1 biopsy or what have you. They don't do the work in the
2 lab, they send it out, and LabMD's market, which is
3 primarily Georgia and the states surrounding it, it
4 would do biopsies and give diagnoses to help with cancer
5 treatment.
6 JUDGE CHAPPELL: So, that work is actually done
7 in your company offices.
8 MR. RUBINSTEIN: That's correct.
9 JUDGE CHAPPELL: You have got the guys in the
10 white lab coats.
11 MR. RUBINSTEIN: That's correct.
12 JUDGE CHAPPELL: Are you doing blood tests, like
13 cholesterol?
14 MR. RUBINSTEIN: No. No, it's only -- and I
15 don't want to speculate, and we will put this in
16 obviously in the facts, but it's related to cancer
17 diagnoses, but only certain kinds of cancers, prostate
18 cancers, other sort of related maladies.
19 JUDGE CHAPPELL: So, generally a doctor takes a
20 biopsy; they send it to you.
21 MR. RUBINSTEIN: That's correct.
22 JUDGE CHAPPELL: Okay.
23 MR. RUBINSTEIN: So, the doctors are our
24 customers, technically.
25 JUDGE CHAPPELL: And the doctor sends the
24
1 patient data to you? Where does the data come from
2 that's alleged to have been released in this case?
3 MR. RUBINSTEIN: The data came from an internal
4 spreadsheet that was used by the billing manager, as I
5 understand it -- as we understand it, to keep track of
6 the accounts. She was in charge of making sure that the
7 insurance companies got billed for the work that LabMD
8 was doing. It was an internal spreadsheet. It was
9 never meant to be shared with anybody.
10 And actually, I would like to, if I could, just
11 take issue with the file that triggered this
12 investigation was not shared; it was stolen. A company
13 called Tiversa, under a government contract --
14 JUDGE CHAPPELL: Wait. I'd like to make sure I
15 understand the particulars, to get a grasp of the big
16 picture.
17 MR. RUBINSTEIN: Yes, sir.
18 JUDGE CHAPPELL: Somebody like INOVA Fairfax
19 sends their tissue samples to your lab, and they
20 probably have patient identifiable information on them,
21 but then someone in your office developed a spreadsheet
22 on their own, nothing to do with INOVA or Johns Hopkins
23 or any other hospital. That was done internally, this
24 spreadsheet.
25 MR. RUBINSTEIN: The spreadsheets were done
In re LabMD, Briefng Book Page 34
Initial Pretrial Conference
LabMD, Inc. 9/25/2013
(301) 870-8025 - www.ftrinc.net - (800) 921-5555
For The Record, Inc.
9 (Pages 33 to 36)
33
1 available publicly and we may be able to have a witness
2 who says they saw it.
3 JUDGE CHAPPELL: Do you have any complaining
4 witnesses who say their data was released or disclosed?
5 MR. SHEER: Not at this time.
6 JUDGE CHAPPELL: Okay.
7 MR. SHEER: We will develop that.
8 JUDGE CHAPPELL: All right. Thank you.
9 MR. RUBINSTEIN: There are some very significant
10 legal issues that are created by these facts. The first
11 is the ambit of the Commission's authority under Section
12 5, which we intend to test. The second is the extent to
13 which the file in question is within the Commission's
14 ambit under Article 1, Section 8. There are due process
15 issues, because notwithstanding counsel's discussions,
16 there are no fixed or ascertainable standards by which
17 LabMD, a small company, could judge the propriety of
18 what it was doing.
19 Proofs will show that the billing manager
20 downloaded Limewire and did it without the knowledge of
21 the company's upper management and contrary to the
22 company policy. This was not a shared file. This was
23 not a shared file at all. It was never meant for public
24 consumption. In fact, there's yet another issue here.
25 LabMD is subject to HIPAA, and the Department of Health
34
1 and Human Services determined that no action was
2 appropriate.
3 So, in effect, you have the Commission
4 overfiling the agency of the Government that Congress
5 designated with primary responsibility for management
6 and regulation of HIPAA.
7 JUDGE CHAPPELL: So, you're saying -- your
8 position is the data was not in a shared folder.
9 MR. RUBINSTEIN: It may have been in a -- it was
10 in a folder and obviously it was accessible to Tiversa.
11 The mechanics of how Tiversa accessed it and what kind
12 of folder it was in are things that we are not clear
13 about and we are going to, through discovery, better
14 ascertain.
15 Certainly, it was not supposed to be made
16 available to the public. That was not LabMD's policy,
17 certainly, and to the extent that the Limewire was
18 downloaded, it was done, as I said, without
19 authorization and contrary to LabMD's standard policies.
20 JUDGE CHAPPELL: I've heard you say a couple
21 times you're a small company. I mean, is that
22 confidential? I mean, are you 5 million, 10 million?
23 What kind of revenues? If it's not -- just ballpark.
24 How small or how large are you.
25 MR. RUBINSTEIN: I would rather not -- I will
35
1 make that information available to you in camera.
2 JUDGE CHAPPELL: That's okay. I'll see it in
3 the documents. I just thought, when you say small, you
4 know --
5 MR. RUBINSTEIN: I would rather not -- we will
6 say it is a small company with less than 50 employees,
7 is my understanding. We will make that available to
8 you, Your Honor.
9 JUDGE CHAPPELL: Less than 50, 5-0, or 15?
10 MR. RUBINSTEIN: I'm sorry, less than 50. But
11 for various reasons, it's a closely held corporation,
12 and I don't want to put the numbers out. But we are not
13 INOVA or Johns Hopkins.
14 JUDGE CHAPPELL: Labcorp?
15 MR. RUBINSTEIN: Not them either.
16 So, what we anticipate with this case, as I
17 said, we are going to have to find out Tiversa's role.
18 We are going to have to find out the extent to which it
19 was involved with and its relationship with the
20 Commission in the decision to move forward with this
21 investigation. And we're going to be filing a series of
22 dispositive motions very early on, because quite
23 frankly, we don't believe the Commission has the
24 authority to be doing what it's doing to LabMD. We
25 don't think that the information --
36
1 JUDGE CHAPPELL: Very early on?
2 MR. RUBINSTEIN: Very early on, within the -- I
3 mentioned this to counsel. We anticipate filing a
4 series of motions within the next two to three weeks.
5 JUDGE CHAPPELL: And you understand who will be
6 deciding those motions?
7 MR. RUBINSTEIN: We are well aware, Your Honor,
8 but we have an obligation to exhaust our remedies. So,
9 we're going to be raising a series of legal issues.
10 We're going to be raising a series of evidentiary
11 objections based on the circumstances, as we understand
12 them today, about how the Government came into
13 possession of the information in the first instance.
14 And then all of the other things that are laid
15 out in the complaint were the result of the knowing
16 acceptance from a government contractor of a stolen
17 file, files stolen, by the way, in contravention of
18 Georgia's law. There was a case in the Eleventh Circuit
19 which was dismissed for want of jurisdiction under the
20 Georgia long arm statute, but there is, you know, a
21 clear suggestion that what Tiversa did violate Georgia's
22 law.
23 JUDGE CHAPPELL: Who brought that case?
24 MR. RUBINSTEIN: LabMD against Tiversa.
25 JUDGE CHAPPELL: And, of course, LabMD didn't
In re LabMD, Briefng Book Page 35
In the Matter of:
LabMD, Inc.
February 10, 2014
Michael Daugherty
Condensed Transcript with Word Index
For The Record, Inc.
(301) 870-8025 - www.ftrinc.net - (800) 921-5555
In re LabMD, Briefng Book Page 36
Daugherty
LabMD, Inc. 2/10/2014
(301) 870-8025 - www.ftrinc.net - (800) 921-5555
For The Record, Inc.
11 (Pages 41 to 44)
41
1 stored in your basement now?
2 MS. HARRIS: Objection. Call for
3 speculation. Incomplete hypothetical. Lacks
4 foundation.
5 A No.
6 Q Where would they be?
7 MS. HARRIS: Calls for speculation.
8 A They would be at the corporate condo.
9 Q Did LabMD keep copies of Explanation of
10 Benefit reports?
11 A I believe so.
12 Q Where are they located now?
13 A The copies that we would have would be at
14 the corporate condo.
15 Q Did LabMD have communications with
16 patients, written communications with patients?
17 A By "written communications," you mean -- I
18 mean --
19 Q Did LabMD send patients letters saying you
20 owe us so many dollars for such and such a test?
21 A Billing invoices is what we would mail,
22 yes.
23 Q Yes. Did the company retain those
24 documents?
25 A No. We mailed them.
42
1 Q Did you keep -- did the company keep
2 copies of those documents?
3 A No.
4 Q You've testified that the Lytec billing
5 system is now located in the basement -- your
6 basement office, right?
7 A That's correct.
8 Q How many billing records does it contain?
9 A I don't know.
10 Q More than a million?
11 A I don't know.
12 Q More than half a million?
13 A I would assume so.
14 Q More than 750,000?
15 A I don't know.
16 Q We've discussed a variety of materials
17 from LabMD that have been moved to your home office,
18 right?
19 A Yes.
20 Q How are you protecting those materials
21 from unauthorized access?
22 MS. HARRIS: Objection. Overbroad.
23 A The house is locked. The location is
24 confidential. There are -- there's no Internet
25 access except through authorization for Lytec only.
43
1 They are password protected. I believe most of the
2 stuff is turned off. And that's all I can think of
3 right now.
4 Q What else is the basement used for?
5 A Nothing.
6 Q Is there air conditioning equipment down
7 there?
8 A Well, there is -- in the other -- I mean,
9 there's venting.
10 Q Is there a heating system down there?
11 A Well, it's a green system, so there's part
12 of it on the other side, but it's outside mostly.
13 Q Are there any utilities that are installed
14 in the basement? By "utilities" I mean heating,
15 cooling, plumbing system.
16 A Oh, yes. Okay. There's heating. There's
17 cooling. There's plumbing. There's electricity.
18 There's dehumidifying. I mean, there's, you know, a
19 humidity regulator, dehumidifier. I don't know the
20 exact term. Yes.
21 Q Is there a game room in the basement?
22 A No.
23 Q Is the basement one big room?
24 A No.
25 Q How is it subdivided?
44
1 A By two rooms and a bathroom.
2 Q Are the materials that we've been talking
3 about all located in one room?
4 A No.
5 Q Where are they located?
6 A In the two rooms.
7 Q How large are the two rooms?
8 A I don't know exactly.
9 Q How have you divided the material from
10 LabMD between the two rooms?
11 A All the electronic -- let's see. All the,
12 I guess you'd call it, technology is in one room, and
13 then the physical specimens are in both.
14 Q Are in both rooms? Is that what you said?
15 A Yes, that's correct.
16 Q Is there an outside entrance to the
17 basement?
18 A No.
19 Q Are there locks on the doors on the two
20 rooms inside the basement?
21 A I don't know.
22 Q Is there a lock to the door to the
23 basement? I assume there is a door --
24 A I don't know.
25 Q -- leading to the basement.
In re LabMD, Briefng Book Page 37
Daugherty
LabMD, Inc. 2/10/2014
(301) 870-8025 - www.ftrinc.net - (800) 921-5555
For The Record, Inc.
12 (Pages 45 to 48)
45
1 A I don't know.
2 Q Is there a door leading to the basement?
3 A Yes.
4 Q Do you know if it has a lock on it?
5 A I don't know.
6 Q Is the door leading to the basement as
7 sturdy as the front door to your house?
8 A Yes.
9 Q Is it a steel door?
10 A No.
11 Q Is it a wood door?
12 A Yes.
13 Q Is the basement door a hollow-core door?
14 A No.
15 Q Are there any other protections in place
16 to prevent unauthorized access to the information
17 stored in your basement besides the ones you've told
18 us about?
19 A I don't know.
20 Q Who would know?
21 A I don't know.
22 Q You've testified that in your basement
23 there is the laboratory information system and the
24 Lytec system, right?
25 A Yes.
46
1 Q Both of them operate, correct?
2 MS. HARRIS: Objection. Vague and
3 ambiguous.
4 A Define "operate."
5 Q If you sit at a workstation, the
6 workstation that you identified as available in the
7 basement, you would be able to access the LIS system,
8 right?
9 A With passwords and other security
10 measures, yes.
11 Q Understood.
12 A Okay. Okay.
13 Q But your answer is yes, right?
14 A Yes, uh-huh.
15 Q Is the information on that system
16 encrypted?
17 A I don't know.
18 Q Who would?
19 A Jeff Martin.
20 Q You've also testified that you can sit at
21 a workstation and access the Lytec billing system in
22 your home office, right?
23 A Correct.
24 Q Is the information on that system
25 encrypted?
47
1 A I don't know.
2 Q Who would know?
3 A Jeff Martin.
4 Q You mentioned just a moment or so ago that
5 there was Internet connectivity to the Lytec system,
6 right?
7 A Correct.
8 Q What is that?
9 A What is the Internet connectivity?
10 Q No. Where does it come from?
11 Let me phrase it differently.
12 A Okay.
13 Q That sounds like remote access into the
14 Lytec billing system in your basement, right?
15 A Oh, I'm sorry. Okay. Rephrase the
16 question then, please.
17 Q You stated earlier, a few moments ago,
18 that there was Internet access to the Lytec billing
19 system?
20 A Yes.
21 Q What did you mean?
22 A That there's Internet to that server, but
23 there's not Internet to the others.
24 Q How is the Internet to that server used?
25 A What do you mean by "used"? I mean --
48
1 Q Why is it connected to the Internet?
2 A So that whoever works at the corporate
3 condo on Lytec can come in remotely and operate the
4 future billing of the -- to wind that down.
5 Q I'm handing you CX 291. Take a moment to
6 have a look at it.
7 A Yes.
8 Q What is this?
9 A This is a letter that was sent out to
10 current customers of LabMD.
11 Q The signature on the bottom, is that
12 yours?
13 A Yes, it is.
14 Q In the second paragraph, in the second
15 sentence, it reads: While Internet access will be
16 closed, all reports and second opinion requests will
17 be available for the remainder of 2014 by faxing
18 requests and other communications to a 404 number.
19 Do you see that?
20 A Yes, I do.
21 Q Where is that 404 number?
22 A That's a remote -- that's a remote
23 service.
24 Q Where are the faxes received?
25 A To my -- to my e-mail.
In re LabMD, Briefng Book Page 38
Dissenting Statement of Commissioner J. Thomas Rosch
Petitions of LabMD, Inc. and Michael J. Daugherty
to Limit or Quash the Civil Investigative Demands
FTC File No. 1023099
June 21, 2012
I dissent from the Commission’s vote affirming Commissioner Brill’s letter decision,
dated April 20, 2012, that denied the petitions of LabMD, Inc. and Michael J. Daugherty to limit
or quash the civil investigative demands.
I generally agree with Commissioner Brill’s decision to enforce the document requests
and interrogatories, and to allow investigational hearings to proceed. As she has concluded,
further discovery may establish that there is indeed reason to believe there is Section 5 liability
regarding petitioners’ security failings independent of the “1,718 File” (the 1,718 page
spreadsheet containing sensitive personally identifiable information regarding approximately
9,000 patients) that was originally discovered through the efforts of Dartmouth Professor M. Eric
Johnson and Tiversa, Inc. In my view, however, as a matter of prosecutorial discretion under the
unique circumstances posed by this investigation, the CIDs should be limited. Accordingly,
without reaching the merits of petitioners’ legal claims, I do not agree that staff should further
inquire – either by document request, interrogatory, or investigational hearing – about the 1,718
File.
Specifically, I am concerned that Tiversa is more than an ordinary witness, informant, or
“whistle-blower.” It is a commercial entity that has a financial interest in intentionally exposing
and capturing sensitive files on computer networks, and a business model of offering its services
to help organizations protect against similar infiltrations. Indeed, in the instant matter, an
argument has been raised that Tiversa used its robust, patented peer-to-peer monitoring
technology to retrieve the 1,718 File, and then repeatedly solicited LabMD, offering
In re LabMD, Briefng Book Page 39
- 2 -
investigative and remediation services regarding the breach, long before Commission staff
contacted LabMD. In my view, while there appears to be nothing per se unlawful about this
evidence, the Commission should avoid even the appearance of bias or impropriety by not
relying on such evidence or information in this investigation.
In re LabMD, Briefng Book Page 40
In re LabMD, Briefng Book Page 41
In re LabMD, Briefng Book Page 42
In re LabMD, Briefng Book Page 43
1
RPTS MCCONNELL 
DCMN HERZFELD 
 
 
THE FTC AT 100: WHERE DO WE GO FROM HERE? 
TUESDAY, DECEMBER 3, 2013 
House of Representatives, 
Subcommittee on Commerce, Manufacturing, and Trade, 
Committee on Energy and Commerce,  
Washington, D.C. 
 
 
 
 
 
The subcommittee met, pursuant to call, at 10:05 a.m., in 
Room 2123, Rayburn House Office Building, Hon. Lee Terry [chairman 
of the subcommittee] presiding. 
Present:  Representatives Terry, Lance, Blackburn, Harper, 
Guthrie, Olson, Pompeo, Kinzinger, Bilirakis, Johnson, Long, 
Barton, Upton (ex officio), Schakowsky, Sarbanes, McNerney, Welch, 
Yarmuth, Dingell, Matheson, Barrow and Christensen. 
Staff Present:  Charlotte Baker, Press Secretary; Kirby 
Howard, Legislative Clerk; Nick Magallanes, Policy Coordinator, 
1
RPTS MCCONNELL 
DCMN HERZFELD 
 
 
THE FTC AT 100: WHERE DO WE GO FROM HERE? 
TUESDAY, DECEMBER 3, 2013 
House of Representatives, 
Subcommittee on Commerce, Manufacturing, and Trade, 
Committee on Energy and Commerce,  
Washington, D.C. 
 
 
 
 
 
The subcommittee met, pursuant to call, at 10:05 a.m., in 
Room 2123, Rayburn House Office Building, Hon. Lee Terry [chairman 
of the subcommittee] presiding. 
Present:  Representatives Terry, Lance, Blackburn, Harper, 
Guthrie, Olson, Pompeo, Kinzinger, Bilirakis, Johnson, Long, 
Barton, Upton (ex officio), Schakowsky, Sarbanes, McNerney, Welch, 
Yarmuth, Dingell, Matheson, Barrow and Christensen. 
Staff Present:  Charlotte Baker, Press Secretary; Kirby 
Howard, Legislative Clerk; Nick Magallanes, Policy Coordinator, 
2
CMT; Gib Mullan, Chief Counsel, CMT; Shannon Weinberg Taylor, 
Counsel, CMT; Michelle Ash, Democratic Chief Counsel, Consumer 
Protection; and William Wallace, Democratic Professional Staff 
Member.   
In re LabMD, Briefng Book Page 44
31

STATEMENT OF JOSHUA WRIGHT

Mr. Wright. Thank you, Chairman Terry, Ranking Member
Schakowsky, and distinguished members of the subcommittee, for
this opportunity to speak to you today about the FTC at 100. I
want to begin by discussing some of the unique institutional
advantages and expertise at the Federal Trade Commission.
As both an economist and a lawyer, I appreciate the unique
structure of the FTC and how its organization enhances our ability
to protect consumers. As you know, the FTC has three bureaus:
Competition, Consumer Protection, and Economics. The Bureau of
Competition endeavors to promote and protect free markets and
vigorous competition, and the Bureau of Consumer Protection works
to prevent fraud, deception, and unfair business practices in the
marketplace.
The FTC's dual missions complement each other in promoting
consumer welfare, encouraging the disclosure of accurate
information to consumers in the marketplace, which, in turn,
facilitates free and healthy competition. What is sometimes lost
in that discussion, however, is the vital role played by the
Bureau of Economics in achieving both of those missions.
The Bureau of Economics provides guidance and support to the
agency's antitrust and consumer protection activities. Working
with the Bureaus of Competition and Consumer Protection, the
In re LabMD, Briefng Book Page 45
32
Bureau of Economics participates in the investigation of mergers
and alleged anticompetitive, deceptive or unfair acts or
practices. The Bureaus provide an independent recommendation on
the merits of antitrust and consumer protection matters to the
Commission. The Bureau also integrates economic analysis into
enforcement proceedings and works with the Bureaus to divide
appropriate remedies.
The Bureau of Economics also conducts rigorous economic
analyses of various markets and industries. Some recent examples
include its consumer fraud survey, which provided insight into the
frequency of certain types of consumer fraud and how the incidence
of fraud has changed over time. The Bureau of Economics conducts
merger retrospectives that help the agency assess how a particular
transaction affected the market, and allows the agency to evaluate
enforcement decisions to improve future analysis and
decisionmaking.
Finally, the Bureau also analyzes the economic impact of
government regulation, and provides Congress, the executive
branch, and the public with policy recommendations relating to
competition and consumer protection issues. Recent examples
include the Bureau's work on children's online privacy and
protection rule and the endorsement and testimonials guides.
Analyzing the impact of regulations also is one of the main
components of the FTC's modernization efforts. To ensure the
Commission's regulations and compliance advice remain
In re LabMD, Briefng Book Page 46
33
costeffective, the agency has engaged in a systematic regulatory
review program for the last two decades. Pursuant to that
program, the Commission has rescinded 13 trade rules and 24
guides, and updated dozens of others since the early 1990s. The
FTC is committed to continuing its systematic regulatory review
program in order to reduce burdens on the business community,
while providing real benefits to consumers.
As the FTC enters its second century, it is an appropriate
time to reflect upon whether the agency's enforcement and policy
tools are being put to the best possible use to help the agency
fulfill its mission. One of these tools, the Commission's
authority to protect to prosecute unfair methods of competition
as standalone violations of Section 5 of the FTC Act, is
particularly suitable, in my view is a particularly suitable
candidate for evaluation. The historical record reveals an
unfortunate gap between the theoretical promise of Section 5 as
articulated by Congress and its application and practice by the
FTC.
The gap has grown large in part due to the persistent absence
of any meaningful guidance articulating what constitutes an unfair
method of competition. For at least the past 20 years,
Commissioners from both parties have acknowledged that a principal
standard for application of Section 5 would be a welcome
improvement and have called for formal guidelines. With that goal
in mind, I have offered a detailed policy statement articulating
In re LabMD, Briefng Book Page 47
34
my own views on how best to modernize the agency's Section 5
authority.
The fundamental problem with the Commission's Section 5
enforcement in the unfair methods context is caused by a
combination of the agency's administrative process advantages and
the vague nature of the Section 5 authority governing unfair
methods of competition. This combination gives the FTC the
ability in some cases to elicit a settlement even when the conduct
in question may benefit consumers. This is because firms
typically prefer to settle Section 5 claims rather than go through
the lengthy and costly administrative litigation in which they are
both shooting at a moving target and may have the chips stacked
against them.
Indeed, the empirical evidence documents a near perfect rate
at which the Commission rules in favor of FTC staff after
administrative adjudication. The evidence also reveals that the
FTC's own decisions are reversed by Federal courts of appeal at a
much greater rate than those of general district court judges with
little or no antitrust experience.
Formal guidelines would help the Commission's mission by
focusing the Commission's unfair methods enforcement upon plainly
anticompetitive conduct and provide businesses with important
guidance about what conduct is lawful and what conduct is unlawful
under Section 5. Indeed, the FTC has issued nearly 50 sets of
guidelines on a variety of topics, many of them much less
In re LabMD, Briefng Book Page 48
IN THE UNITED STATES DISTRICT COURT
FOR THE NORTHERN DISTRICT OF GEORGIA
ATLANTA DIVISION
LabMD, INC.,
Plaintiff,
v.
FEDERAL TRADE COMMISSION,
Defendant.
)
)
)
)
)
)
)
)
)
)
Civil Action No.: _______________
Related Case:
FTC v. LabMD et al.,
1:12-cv-3005-WSD
VERIFIED COMPLAINT
FOR DECLARATORY AND INJUNCTIVE RELIEF
Plaintiff LabMD, INC. (“LabMD”) hereby states its complaint for declaratory
and injunctive relief against the unconstitutional abuse of government power and ultra
vires actions by Defendant Federal Trade Commission (the “FTC” or “Commission”)
as follows:
PARTIES, JURISDICTION, AND VENUE
1. LabMD, 1250 Parkwood Circle, Unit 2201, Atlanta, GA 30339, is a
small medical cancer diagnostics business.
2. The FTC, 600 Pennsylvania Avenue N.W., Washington, D.C. 20580, is
a federal agency for purposes of the Administrative Procedure Act (“APA”), 5 U.S.C.
§ 551 et seq.
Case 1:14-cv-00810-WSD Document 1 Filed 03/20/14 Page 1 of 43
In re LabMD, Briefng Book Page 49
11
Nov. 26, 2012) (Duffy, J.). A true and correct copy of the foregoing order is attached
hereto as Exhibit 8.
II. LabMD Publicly Criticizes The FTC And The FTC Retaliates.
35. LabMD’s owner, Michael Daugherty decided to warn the public about
the FTC’s abuses through the press, social media, and a book. Mr. Daugherty used,
and continues to use, his website, http://michaeljdaugherty.com/, to criticize the
government.
36. For example, Mr. Daugherty was quoted in a September 7, 2012, Atlanta
Business Chronicle article as follows: “‘We are guilty until proven innocent with
these people . . . . They are on a fishing expedition. We feel like they are beating up on
small business.’” Amy Wenk, “Atlanta Medical Lab Facing Off Against FTC,”
Atlanta Business Chronicle (September 5, 2012). Ms. Wenk wrote that “Daugherty
contends his company is being unreasonably persecuted by FTC. He said he’s already
spent about $500,000 fighting the investigation.” Id.
37. On information and belief, FTC attorney Alain Sheer, who would later
serve as lead counsel for the FTC in an enforcement action against Plaintiff,
monitored Mr. Daugherty’s political speech and retaliated against him for it.
38. For example, on July 19, 2013, Mr. Daugherty posted the trailer to his
book, “The Devil Inside the Beltway,” on his website,
Case 1:14-cv-00810-WSD Document 1 Filed 03/20/14 Page 11 of 43
In re LabMD, Briefng Book Page 50
12
http://michaeljdaugherty.com/2013/07/19/the-devil-inside-the-beltway-book-trailer/.
The trailer called the FTC’s actions against LabMD an “abusive government
shakedown” and explained that his book would “blow the whistle” about how “the
Federal Trade Commission began overwhelming . . . [LabMD, a] small business, a
cancer detection center, with their abusive beltway tactics.” It criticized Commission
staff, including Mr. Sheer.
39. On July 22, 2013, Mr. Sheer told LabMD that Commission staff had
recommended that the FTC commence enforcement proceedings against LabMD.
40. On July 30, 2013, Janis Claire Kestenbaum, the Senior Legal Advisor to
the Chairwoman of the FTC, provided LabMD a draft complaint.
41. On August 28, 2013, the Commission commenced an enforcement
action (the “Enforcement Action”) by issuing a complaint and notice order. The
gravamen of its claim at that time was about the PHI accounts-receivable file
purloined by Tiversa. Mr. Sheer, who met with Tiversa and who was responsible for
the shell-game through which the FTC obtained the file, is lead Complaint Counsel.
42. The FTC’s Complaint in the Enforcement Action makes clear that
LabMD was a “health care provider” and subject to HIPAA, which comprehensively
regulates patient-information data-security, among other things.
Case 1:14-cv-00810-WSD Document 1 Filed 03/20/14 Page 12 of 43
In re LabMD, Briefng Book Page 51
13
43. The FTC did not allege that LabMD violated PHI data-security standards
and breach-notification requirements established by HIPAA and HITECH and HHS
regulations implementing those statutes.
44. Instead, the FTC’s Complaint solely alleged that LabMD violated
Section 5’s proscription against “unfair” trade practices. It said LabMD’s
“information security program” was not “comprehensive” and that LabMD did not
use “readily available measures” or “adequate measures” but did not specify what
those terms actually mean. See Ex. 4 ¶¶ 10-11.
45. The FTC did not name an individual complainant or allege direct harm
to any person.
46. The FTC did not cite any regulations, guidance, or standards for what
was “adequate,” “readily available,” “reasonably foreseeable,” “commonly known,”
or “relatively low cost.”
47. The FTC did not cite any regulations, guidance, or standards that
LabMD supposedly failed to comply with, or specify the combination of LabMD’s
alleged failures to meet the unspecified regulations, guidance, or standards that,
“taken together,” allegedly violated Section 5.
Case 1:14-cv-00810-WSD Document 1 Filed 03/20/14 Page 13 of 43
In re LabMD, Briefng Book Page 52
14
48. The FTC did not allege that LabMD’s data-security practices fell short
of meeting medical-industry data-security standards, such as those established by
HIPAA and HITECH for PHI data security.
49. Mr. Sheer of the FTC has admitted that “[n]either the complaint nor the
notice order prescribes specific security practices that LabMD should implement
going forward.” Initial Pretrial Conference Transcript, In the Matter of LabMD, Inc.,
Dkt. No. 9357, 10:11-15 (Sept. 25, 2013) (“Initial Pretrial Conf. Trans.”). He also
acknowledged that the FTC brought this action without any complaining witnesses
who say their data was released or disclosed. Id. 33:3-5. A true and correct copy of
that transcript is attached hereto as Exhibit 9.
50. No court has ever held the FTC may require firms to adopt information-
practice policies under Section 5’s “unfairness” prong. Hearing Trans. 16: 22-25,
FTC v. LabMD, Inc. et al., Case No. 1:12-cv-3005-WSD (Sept. 19, 2012) (Duffy, J.)
(emphasis added). A true and correct copy is attached hereto as Exhibit 10.
51. On September 17, 2013, LabMD filed an answer challenging the FTC’s
jurisdiction and violations of LabMD’s federal constitutional due process rights,
among other things.
Case 1:14-cv-00810-WSD Document 1 Filed 03/20/14 Page 14 of 43
In re LabMD, Briefng Book Page 53
15
52. In September 2013, HHS said that it decided against even investigating
LabMD’s alleged PHI data-security practices, noting that it had not received any
complaints.
53. On October 24, 2013, Mr. Sheer of the FTC served a subpoena duces
tecum on Mr. Daugherty, LabMD’s CEO and President, requesting the following
documents concerning Mr. Daugherty’s book:
• “All drafts of . . . [Mr. Daugherty’s book about the FTC] that
were reviewed by any third party prior to the Manuscript’s
publication.”
• “All comments received on drafts of” Mr. Daugherty’s book
about the FTC.
• “All documents related to the source material for drafts of”
Mr. Daugherty’s book about the FTC, “including documents
referenced or quoted in the” book.
• “All promotional materials related to” Mr. Daugherty’s book
criticizing the FTC, “including, but not limited to, documents
posted on social media, commercials featuring . . . [Mr.
Daugherty], and presentations or interviews given by” Mr.
Daugherty.
54. After over four years of investigation and litigation, LabMD still does
not know when or what it did “wrong” and cannot even determine what the elements
of a data-security “unfairness” offense are in this case.
Case 1:14-cv-00810-WSD Document 1 Filed 03/20/14 Page 15 of 43
In re LabMD, Briefng Book Page 54
16
55. For example, FTC enforcement staff have refused to substantively
respond to LabMD’s interrogatories regarding PHI data-security standards—including
“data-security standards, regulations, and guidelines the FTC seeks to enforce against
LabMD”—except to cross-reference their response to LabMD’s request that they
produce “[a]ll documents sufficient to show the standards or criteria the FTC used in
the past and is currently using to determine whether an entity’s data-security practices
violate Section 5 of the Federal Trade Commission Act from 2005 to the present.”
56. Indeed, Complaint Counsel even objected to LabMD’s interrogatory
inquiring what “data-security standards, regulations, and guidelines the FTC will use
to determine whether LabMD’s data-security practices were not reasonable and
appropriate” on the ground that it seeks opinions by undisclosed nontestifying experts
and “calls for expert opinions.”
57. The thousands of pages of materials that FTC enforcement staff have
produced to LabMD in response to the foregoing document request (most of which
was produced on March 3, 2014, two days before the close of fact discovery) consist
almost exclusively of: Power Point presentations; FTC staff reports; emails; FTC
Consumer Alerts, OnGuard posts, Guides for Business, FTC Office of Public Affairs
blog posts, and assorted other Internet postings; materials FTC staff employees
apparently use to prepare for presentations, including handwritten notes; copies of
Case 1:14-cv-00810-WSD Document 1 Filed 03/20/14 Page 16 of 43
In re LabMD, Briefng Book Page 55
17
FTC administrative complaints, draft administrative complaints, consent orders, and
related documents; letters the FTC has sent to various companies; documents related
to various FTC workshops; speeches given by various FTC Commissioners; assorted
congressional testimony; and other miscellaneous materials. Some of these materials
are of very recent vintage and dated after the events described in the FTC’s August
2013 administrative complaint allegedly occurred. Some of these materials are dated
after August 28, 2013, when the FTC issued this complaint. The only regulations that
FTC enforcement staff produced to LabMD do not apply to LabMD and implement
statutes that also do not apply to LabMD.
58. On March 3, 2014, FTC enforcement staff refused to admit, among other
things, that the FTC’s administrative complaint does not specifically reference any
industry standards for data-security practices, hardware or software necessary to avoid
a violation of Section 5, instead claiming that LabMD was asking for “an admission
irrelevant to any permissible claim or defense in this administrative proceeding and
outside of the scope of discovery” and, in the alternative, denying that they were
required to allege this.
59. FTC enforcement staff have even argued that “STANDARDS USED
TO ENFORCE SECTION 5 ARE OUTSIDE THE SCOPE OF DISCOVERY,”
saying that “[t]he orders and opinions of the Commission and of th[e ALJ] …
Case 1:14-cv-00810-WSD Document 1 Filed 03/20/14 Page 17 of 43
In re LabMD, Briefng Book Page 56
18
preclude such discovery.” Complaint Counsel’s Motion for Protective Order
Regarding Rule 3.33 Notice of Deposition, In the Matter of LabMD, FTC Dkt. No.
9357, at 7 (Feb. 14, 2014).
60. More recently, on March 18, 2014, FTC enforcement staff produced an
expert witness report that for the first time—after more than four years of
investigation and litigation—gave LabMD some notice as to what a FTC expert
thinks LabMD did wrong. But that report did not even purport to assess LabMD’s
PHI data-security practices against any objective, applicable medical-industry data-
security statute, regulation, custom, or standard.
III. LabMD Challenges The FTC’s Jurisdiction.
61. On November 12, 2013, LabMD filed a dispositive Motion to Dismiss
raising pure issues of law and questions of statutory interpretation in the FTC’s
administrative case. A true and correct copy is attached hereto as Exhibit 11. LabMD
requested oral argument. Under the FTC’s Rules of Practice, Commissioners (and not
the ALJ) rule on dispositive motions to dismiss complaints they recently voted to
issue in the first instance.
62. On November 14, 2014, LabMD also filed a Verified Complaint in the
U.S. District Court for the District of Columbia seeking solely injunctive and
Case 1:14-cv-00810-WSD Document 1 Filed 03/20/14 Page 18 of 43
In re LabMD, Briefng Book Page 57
19
declaratory relief. LabMD v. FTC et al., Case No. 1:13-cv-01787-CKK, Dkt. No. 1
(D.D.C. Nov. 14, 2013).
63. On November 18, 2013, LabMD filed a petition for review in the U.S.
Court of Appeals for the Eleventh Circuit, LabMD, Inc. v. FTC, Case No. 13-14267-F
(11th Cir. Nov. 18, 2013). Ex. 1.
64. On November 25, 2013, LabMD filed an administrative stay motion in
the FTC enforcement action.
65. On December 2, 2013, LabMD filed a reply in support of its
administrative motion to dismiss. A true and correct copy is attached hereto as Exhibit
12.
66. On December 13, 2013, the FTC issued an order denying LabMD’s stay
motion (“December 13 Order”). A true and correct copy is attached hereto as Exhibit
13. The December 13 Order states that no Article III court has jurisdiction over
LabMD’s claims until the FTC gives its permission.
67. On December 16, 2013, the Eleventh Circuit issued two jurisdictional
questions to the parties. Jurisdictional Questions, LabMD v. FTC, Case No. 13-
15267-F (Dec. 16, 2013).
Case 1:14-cv-00810-WSD Document 1 Filed 03/20/14 Page 19 of 43
In re LabMD, Briefng Book Page 58
20
68. On December 23, 2013, LabMD filed a stay motion in in the Eleventh
Circuit. Petitioner’s Motion for Stay Pending Review, LabMD v. FTC, Case No. 13-
15267-F (Dec. 23, 2013).
69. On January 16, 2014, the FTC denied LabMD’s administrative Motion
to Dismiss, rejecting LabMD’s jurisdictional and fair-notice due process challenges
without oral argument, thereby denying LabMD an opportunity to create a record (the
“January 16 Order”). Ex. 2.
70. On January 17, 2014, the FTC submitted the January 16 Order to the
Eleventh Circuit, via what it called a “notice of supplemental authority.”
71. FTC did the exact same thing on the exact same day in FTC v.
Wyndham Worldwide Corp. et al., Case No. 2:13-cv-01887-ES-SCM, Dkt. No. 151
(D. N.J. Jan. 17, 2014). The FTC claimed its order had the force of law and should be
given deference under “Chevron.” Ex. 3 at 6.
72. The FTC admits that it cannot and does not enforce HIPAA or HITECH.
Ex. 2 at 12 & n.19.
73. The FTC admits that its case against LabMD solely alleges statutory
Section 5 statutory “unfairness” violations, not “violations of the FTC’s Health
Breach Notification Rule.” Id. at 20 n.20.
Case 1:14-cv-00810-WSD Document 1 Filed 03/20/14 Page 20 of 43
In re LabMD, Briefng Book Page 59
21
74. The FTC admits that it has failed to establish any data-security standards
with the force of law that give notice as to what PHI data-security practices the
Commission and its enforcement staff believes Section 5 forbids or requires. Ex. 2 at
15.
75. The FTC admits that it did not claim data-security regulatory authority
until years after 1994, when Section 5 was last amended to add subsection (n). 15
U.S.C. § 45(n). Ex. 2 at 4, 8-9. Subsection (n) does not mention “data security,” let
alone explain what data-security practices the FTC believes Section 5 to forbid or
require.
76. Yet the FTC claims subsection (n) gives fair notice: “Here, the three-
part statutory standard governing whether an act or practice is ‘unfair,’ set forth in
Section 5(n) [15 U.S.C. § 45], should dispel LabMD’s concern about whether the
statutory prohibition of ‘unfair . . . acts or practices’ is sufficient to give fair notice of
what conduct is prohibited.” Ex. 2 at 16.
77. The FTC’s January 16 Order essentially asserts that constitutional fair-
notice due process requirements are somehow inapplicable here because, according to
the Defendant, the FTC is not pursuing “criminal punishment or civil penalties for
past conduct.” Ex. 2 at 16.
Case 1:14-cv-00810-WSD Document 1 Filed 03/20/14 Page 21 of 43
In re LabMD, Briefng Book Page 60
22
78. The FTC also claims it is not obligated to provide any fair notice at all of
the PHI data-security practices it believes Section 5 to forbid or require because
agencies have broad “discretion” to “address an issue by rulemaking or adjudication.”
Ex. 2 at 15.
79. For that matter, the FTC effectively claims that the standard for Section
5 “unfairness” PHI data-security liability is whether a company’s practices are
“unreasonable” according to it, while acknowledging that this is a case of first
impression as to what is “unreasonable.”
80. Elsewhere, the FTC admitted that there is no process through which
businesses could have obtained guidance or an advisory opinion from the
Commission regarding data-security practices. See Hearing Trans., FTC v. Wyndham
et al., Case No. 2:13-cv-01887-ES-SCM, 52:10-11 (Nov. 7, 2012). A true and correct
copy of an excerpt of the foregoing transcript is attached hereto as Exhibit 14 and is
incorporated herein by reference.
81. On February 18, 2014, the Eleventh Circuit dismissed LabMD’s Petition
for Review and denied all pending motions as moot because there was no cease and
desist order reviewable under 15 U.S.C. § 45(c). Instead, it ruled this Court has
original jurisdiction over LabMD’s ultra vires, statutory, and constitutional claims to
Case 1:14-cv-00810-WSD Document 1 Filed 03/20/14 Page 22 of 43
In re LabMD, Briefng Book Page 61
23
the extent that such claims could be asserted before a cease and desist order is entered.
Ex. 1.
82. Therefore, on February 19, 2014, LabMD filed a Notice of Voluntary
Dismissal Without Prejudice of LabMD v. FTC et al., Case No. 1:13-cv-01787-CKK,
Dkt. No. 20 (D.D.C.), because under D.C. Circuit law, which is different from the law
of this Circuit, only the U.S. Court of Appeals for the D.C. Circuit has jurisdiction
over those claims, yet the D.C. Circuit will never have jurisdiction under 15 U.S.C. §
45(c) because LabMD has not done business there.
83. The FTC has issued a final agency decision regarding jurisdiction, and
LabMD has exhausted all administrative remedies with respect to its jurisdictional and
constitutional fair-notice due process arguments.
IV. The FTC Denies LabMD Procedural Due Process.
84. To begin with, the FTC has never specified the PHI data-security
standards LabMD failed to meet, thereby denying LabMD an opportunity to
effectively defend itself and granting the Commission, Mr. Sheer, and other federal
bureaucrats unlimited discretion to decide what is “unreasonable” after the fact and to
regulate the entire health care industry based on their idiosyncratic whim, caprice, and
fancy.
Case 1:14-cv-00810-WSD Document 1 Filed 03/20/14 Page 23 of 43
In re LabMD, Briefng Book Page 62
24
85. In 2009, the FTC modified its Rules of Practice to deny respondents a
fair defense and to render motion practice futile. 74 Fed. Reg. 20,205 (May 1, 2009).
86. At the initial pretrial conference, the ALJ told LabMD’s counsel:
[L]et me talk about dispositive motions . . . . There is a rule that covers
that, if you intend to file a summary judgment, and if you don’t know,
I’ll tell you. Summary judgments will be ruled on by the Commission,
the same body that voted to issue the complaint in this case. With
respect to motion to dismiss or other substantive motion, the rules
provide that if they are filed before the start of the evidentiary hearing,
they will be ruled on by that same Commission . . . .
Ex. 9 at 18:11-15. The ALJ lacks power to even grant a continuance of the
evidentiary hearing or stay the proceedings pending adjudication of dispositive
motions before the Commission. See 16 C.F.R. §§ 3.22(b), 3.41(b).
87. The FTC was extensively warned about the constitutional implications
of its power-grab during the comment period.
88. The American Bar Association (ABA) Section of Antitrust Law
(“Antitrust Section”) said the revisions forced respondents to address prehearing
issues to the FTC without the benefit of a prior opinion authored by a party who was
not involved in crafting and approving a complaint. Comments of the ABA Section
of Antitrust Law in Response to the Federal Trade Commission’s Request for Public
Comment Regarding Parts 3 and 4 Rules of Practice Rulemaking—P072194, at 4
(Nov. 6, 2008).
Case 1:14-cv-00810-WSD Document 1 Filed 03/20/14 Page 24 of 43
In re LabMD, Briefng Book Page 63
25
89. The Antitrust Section explained that its “primary concern is that by
‘codifying’ the Commission’s right to interject itself into prehearing case
management, it may undermine the integrity of the process, compromise the ALJ, and
create an appearance of unfairness.” Id. at 12. The Antitrust Section also said the
FTC’s amendments “could reduce the quality of decision making, and may color the
perception of the fairness and impartiality of Commission proceedings—a particularly
important issue considering that when hearing an appeal, federal courts will give
deference to a final FTC decision.” Id. at 11.
90. The U.S. Chamber of Commerce added that “it appears that the
proposed changes are being rushed into place and for the purpose of giving the FTC
material, tactical, and procedural advantage . . . .” U.S. Chamber of Commerce,
Comment, Re: Parts 3 and 4 Rules of Practice Rulemaking—P072104, at 1 (Nov.
6, 2008). In fact:
The FTC’s proposed regulations work to effectively eliminate the role of
the independent Administrative Law Judge (ALJ) to manage and prepare
an initial decision for a case. This results in the elimination of a vital
check on potential unfairness inherent in the FTC’s administrative
procedure. Under the FTC’s process, the Commissioners act as both
prosecutor and judge in administrative trials. Thus, the same individuals
who decide to issue the complaint also decide the final appeal of the
administrative trial. With such a clear potential for unfairness or conflict
of interest at the forefront of FTC administrative adjudication, it is
necessary to preserve some sort of fairness check.
Id. at 2.
Case 1:14-cv-00810-WSD Document 1 Filed 03/20/14 Page 25 of 43
In re LabMD, Briefng Book Page 64
26
91. Under current Commission Rule 3.22(a), “[m]otions to dismiss filed
before the evidentiary hearing, motions to strike, and motions for summary decision
shall be directly referred to the Commission and shall be ruled on by the Commission
unless the Commission in its discretion refers the motion to the Administrative Law
Judge.”
92. In excess of their authority and in violation of the Constitution’s
guarantee of due process, the FTC has assumed for itself the power to legislate, to
prosecute, and to judge LabMD without even specifying in advance the elements of
the data-security offense LabMD has allegedly committed.
93. The empirical evidence demonstrates that the FTC’s administrative
process is a rigged exercise in futility for LabMD and others similarly situated.
94. According to Commissioner Wright:
The FTC has voted out a number of complaints in administrative
adjudication that have been tried by administrative law judges (“ALJs”)
in the past nearly twenty years. In each of those cases, after the
administrative decision was appealed to the Commission, the
Commission ruled in favor of FTC staff. In other words, in 100 percent
of cases where the ALJ ruled in favor of the FTC, the Commission
affirmed; and in 100 percent of the cases in which the ALJ ruled against
the FTC, the Commission reversed.
Joshua D. Wright, Comm’r, Fed. Trade Comm., Recalibrating Section 5: A Response
to the CPI Symposium, CPI Antitrust Symposium, at 4 (November 2013), available at
Case 1:14-cv-00810-WSD Document 1 Filed 03/20/14 Page 26 of 43
In re LabMD, Briefng Book Page 65
27
http://www.ftc.gov/sites/default/files/documents/public_statements/recalibrating-
section-5-response-cpi-symposium/1311section5.pdf (last visited Mar. 18, 2014).
95. Further administrative proceedings are exhausted and futile.
V. The Irreparable Harm Done By The FTC To LabMD.
96. FTC’s power-grab has destroyed LabMD’s customer relationships and,
in large measure, driven LabMD to cease accepting new specimen samples. But for
all of the time, attention, and money LabMD has been forced to devote to addressing
the FTC’s actions, the company would almost certainly be accepting new specimen
samples and providing cancer-diagnostic services to doctors to this day.
97. LabMD, and its doctors, have been denied insurance coverage as a direct
result of the FTC’s ongoing persecution of the company. For example, One Beacon
(a medical malpractice insurance company) recently denied LabMD, and its doctors,
coverage, saying: “[W]e are unable to offer ERP terms for the entity [LabMD], and
as a result, the individual physicians so I will be closing the file. The potential
volatility due to the FTC investigation is something we want to stay away from
particularly because it pertains to medical records.”
98. LabMD’s general liability insurance carrier is planning to non-renew its
insurance policy effective May 6, 2014.
Case 1:14-cv-00810-WSD Document 1 Filed 03/20/14 Page 27 of 43
In re LabMD, Briefng Book Page 66


David A. Balto is a partner with the Law Offices of David A. Balto PLLC. Mr. Balto was Policy Director of
the FTC’s Bureau of Competition (1998-2001) and attorney advisor to Chairman Robert Pitofsky (1995-1997). Mr.
Balto is grateful for the very capable assistance of Andrew Fick a student at the University of South Dakota law
school.

L egal B ack gr ou n der
Advocate for freedom and justice
®

2009 Massachusetts Avenue, NW
Washington, DC 20036
202.588.0302
Washington Legal Foundation
WLF
Vol. 28 No. 12 August 23, 2013

THE FTC AT A CROSSROADS:
CAN IT BE BOTH PROSECUTOR AND JUDGE?

by
David A. Balto

Nearly 100 years ago Congress established the Federal Trade Commission (FTC) to protect consumers
against unfair, deceptive, and anticompetitive practices. The goal of Congress was to create a single agency with
a broad range of powers to address these important policy goals. When it was established in 1914, the FTC was
designed to be an investigatory and adjudicative body empowered to clarify and enforce antitrust law. The agency
was tasked with identifying and stopping “unfair methods of competition.”
1
Part of the reason for the creation of
the FTC was the dissatisfaction with the ability of generalist courts to enforce the antitrust laws. To strengthen the
role of the FTC, Congress gave it the power to conduct studies, issue reports, and, most importantly,
administratively litigate—to bring enforcement actions and serve as an administrative tribunal.
The FTC has met the goals of Congress in many respects. But the role of administrative litigation seems
often unfulfilled. For years administrative litigation was criticized because of its glacial pace or the relatively
minor cases that were litigated. In the mid-1990s, the FTC adopted a series of carefully structured time limits and
other procedural reforms that have shortened and strengthened the litigation process and made it more like federal
court litigation. Some observers have noted that FTC administrative litigation is akin to a “rocket docket.” Not
surprisingly over the past decade, the FTC has concurrently increased the role of administrative litigation.
In one important respect, the administrative litigation role is particularly unsettling. The FTC acts as both
prosecutor and judge in administrative litigation. In the past, businesses, the American Bar Association, and
former FTC Commissioners have all raised concerns about this appearance of unfairness. Those concerns were
tempered in the past because administrative litigation was so slow that often the FTC’s five member Commission
would change in composition after an administrative trial was held. And more importantly, the Commission
frequently held that no law violation occurred. In the past 18 years, however, the Commission has found a law
violation in every administrative case. This trend is unprecedented.
This LEGAL BACKGROUNDER addresses the FTC’s administrative process and the problem of procedural
fairness. It highlights the recent history of the Commission’s decision-making and observes how some of the
most important decisions were rejected by the federal courts of appeal. Finally, it observes the problems that arise
from the appearance of unfairness and how those problems may undermine the FTC’s role in antitrust and
consumer protection enforcement.
The FTC Administrative Law Process. When the FTC has “reason to believe” an entity is engaged in an
“unfair method of competition” or an “unfair or deceptive act or practice,” the Commissioners vote to file a
complaint against that entity, which becomes known as the respondent. 15 U.S.C. § 45(b). The complaint lists
the unfair acts the respondent is accused of and informs the respondent of its opportunity to attend a hearing in

1
Federal Trade Commission Act of 1914, Pub. L. No. 63-203, 38 Stat. 717 (codified as amended at 15 U.S.C. §§ 41-58 (2006)).
In re LabMD, Briefng Book Page 67



Copyright 82013 Washington Legal Foundation ISBN 1056 3059 2
front of an administrative law judge (ALJ).
While the matter is under investigation the FTC Commissioners work closely with the staff in developing
the case and directing the investigation. Before a complaint is issued the respondent has the opportunity to meet
with the Commissioners and argue why no enforcement action is necessary. In developing the case and issuing
the complaint the Commissioners act as prosecutors. The Commissioners’ roles change once the complaint is
issued. They become adjudicators and there is a wall of separation between them and the staff prosecuting the
case (known as “complaint counsel”). There are strict rules preventing communications during the litigation.
Some members of the Office of General Counsel may assist the Complaint Counsel in prosecuting the case while
others may assist the Commission in its adjudicative function.
When a complaint is issued an administrative hearing is held where the respondent presents reasons why it
should not be required to “cease and desist” from its current conduct. Id. After the hearing, the ALJ makes an
initial determination of whether the respondent engaged in unfair methods of competition. The ALJ’s initial
decision becomes the decision of the Commission unless the initial decision is appealed. Either the respondent or
the FTC complaint counsel can appeal the decision. If upon appeal by the FTC Staff, the FTC Commissioners
disagree with the ALJ’s decision, the Commissioners may reverse the ALJ. The Commissioners are not required
to give any deference to the ALJ’s conclusions of law. Additionally, according to the Administrative Procedure
Act, the Commissioners are not required to give any deference to the ALJ’s findings of fact. 5 U.S.C. § 557(b).
The Commissioners retain the authority to decide the facts and law of each case as if the case was originally heard
before the FTC Commissioners instead of an ALJ. 16 C.F.R. § 3.54(a).
A respondent may appeal the Commission’s decision to any United States Court of Appeals where the
respondent’s conduct occurred or the respondent resides. 15 U.S.C. § 45(c). (If the Commission dismisses the
complaint the staff cannot appeal that decision). Unlike the Commissioners’ de novo standard of review for
factual findings, appellate courts must give deference to the FTC. The appellate courts may only disagree with the
FTC Commissioners’ findings of fact if there is “substantial evidence” that the Commissioners erred.
Appearance of Partiality. Because the FTC acts as both prosecutor and adjudicator, experts have
questioned the dual role of the Commissioners. For example, in a thoughtful article four decades ago, former
Commissioner Phil Elman noted the institutional and political pressures that make it difficult for the Commission
to dismiss a complaint. Dismissing a complaint could be viewed as “an admission of costly error—costly both in
time and taxpayer money.” Philip Elman, Administrative Reform of the Federal Trade Commission, 59 GEO. L. J.
777, 810 (1971). Commissioners may sustain a complaint because they want to keep “staff morale” high or
appear successful to the public. Id. Because the Commission’s dismissals are not subject to judicial review, the
Commission may sustain complaints to ensure the courts have an opportunity to weigh in on antitrust policy. Id.
Finally, the Commission may sustain complaints because they have effectively prejudged the matter – they already
believe the respondent violated the law. At a hearing in front of the Commissioners, the burden of proof may
“subtly shift[] to the respondent.” Id.
As a result of these perceived problems, the American Bar Association (ABA) in 1989 assessed whether
the FTC should continue to prosecute and adjudicate antitrust cases.
2
The ABA stated: “[N]o thoughtful observer
is entirely comfortable with the FTC’s . . . combining of prosecutory and adjudicatory functions. Whenever the
same people who issued a complaint later decide whether it should be dismissed, concern about at least the
appearance of fairness is inevitable.” However, the ABA concluded that the benefits and safeguards inherent in
the FTC’s adjudicatory process outweighed any need to separate the FTC’s ability to prosecute and adjudicate.
To support its findings, the ABA noted several factors that appeared to diminish the appearance of
conflict. One factor was the length of time an FTC adjudication took to complete. An FTC proceeding could take
as long as three years or longer, and by that time the Commissioners who approved the original complaint against
a respondent might not be the same Commissioners who would hear an appeal from the ALJ. Commissioner turn-
over created a greater likelihood of independence between the prosecutorial and adjudicative roles. Additionally,
the ABA took solace in the fact that the Commission regularly dismissed its own complaints. For example, in the
1980s the Commission dismissed over 40 percent of its complaints on the merits. (A recent study found that from

2
Report of the ABA Antitrust Section Special Committee to Study the Role of the Federal Trade Commission (1989).
In re LabMD, Briefng Book Page 68



Copyright 82013 Washington Legal Foundation ISBN 1056 3059 3
1950-2011 the Commission’s reversal rate was over 19%).
3

Under the leadership of Chairman Robert Pitofsky, the FTC began to address the problems of
administrative litigation. It began to reform the litigation process to root out delays and make it closer to federal
court litigation. It opted to not always pursue administrative litigation in merger cases where a preliminary
injunction was denied. And it dismissed complaints after administrative litigation, most prominently the 1995
R.R. Donnelley case—a prominent merger challenge that had been litigated for several years.
But neither of the reasons the ABA cited in 1989 seems to support deference to the FTC today. First, the
FTC to its credit has streamlined the administrative litigation process. In reforms instituted in the Bush
Administration the FTC set strict deadlines that include requiring the ALJ to issue a decision within 13 months
after a complaint is issued. Thus, the glacial pace of litigation no longer serves to protect the appearance of
conflict. (Of course, this may cut both ways for respondents: it means they get a decision sooner, but it can
also impose incredible burdens as an entire case has to be litigated from complaint to motions practice to
document and deposition discovery and through trial in less than a year. The costs can be significant and
daunting and in some cases may force respondents to settle claims that lack merit.)
Second, the FTC no longer appears as impartial in evaluating a case after an administrative trial. In fact
since the R.R. Donnelley decision the FTC has always found a violation. In over 20 cases it has never found for
the respondent and has reversed ALJ decisions that dismissed complaints. This FTC “winning streak” is simply
unprecedented. There could be several possible reasons for this trend. Perhaps the FTC has only brought cases
which are relatively strong and have high odds of success, but as explained below some of its most important
cases have been rejected by the appellate courts. Indeed, the Commission’s rulings in its own favor often do
not stand up on appeal. Studies demonstrate that the Commission is reversed by federal courts of appeals at
a far higher rate (over 20%) than district court antitrust decisions (under 5%). Or perhaps the agency may be
trying to establish new legal principles or explore new legal avenues. Or the decision-making by the ALJ is
inadequate. In any case the FTC’s almost two decade history of always ruling in its own favor creates a strong
impression of unfairness.
Treatment of FTC Administrative Decisions by Appellate Courts. The FTC’s administrative litigation
process has resulted in several important decisions that have helped develop antitrust jurisprudence. These cases
include Indiana Federation of Dentists and Polygram (on rule of reason analysis), Ticor (on state action), and
Hospital Corporation of America (merger law). But recently the appellate courts have been critical of the FTC’s
decision-making where it has substituted its fact finding for the ALJ. In those cases the Commission has reversed
the ALJ’s decision to dismiss a complaint, only to have its decision reversed by an appellate court.
For example, in 2005 the Eleventh Circuit reversed an FTC decision that a pharmaceutical patent
settlement was anticompetitive. Schering-Plough Corp. et al. v. Federal Trade Commission, 402 F.3d 1056, 1076
(11
th
Cir. 2005). The FTC challenged a patent settlement that allegedly kept generic versions of the drug K-Dur, a
widely prescribed potassium chloride supplement, off the market. The ALJ dismissed the complaint finding that
the FTC counsel did not “prove or properly define” the relevant product market; that Schering did not have
monopoly power in the relevant product market; and that the evidence did not prove “that the payments were not
to settle the infringement cases and for drugs licensed to Schering” or that the agreements served to delay the
entry of generic competition. Schering-Plough Corp., (F.T.C. July 2, 2002) (No. 9297).
FTC complaint counsel appealed to the Commission, which overturned the ALJ’s decision. In doing so
the Commission rejected some of the ALJ’s interpretation of the facts. The respondents appealed to the Eleventh
Circuit, which rejected the Commission’s conclusion. In doing so the court noted that “[i]t would seem as though
the Commission clearly made its decision before it considered any contrary conclusion.” Schering-Plough Corp.
v. FTC, 402 F. 3d 1056, 1065 (11th Cir. 2005). The opinion is largely derisive of the FTC’s findings, stating that
“the Commission relied on somewhat forced evidence” and questioning the Commissions rejection of the ALJ’s
credibility findings, “instead rel[ying] on information that was not even in the record.” Id. at 1070.

3
Nicole Durkin, Comment, Rates of Dismissal in FTC Competition Cases from 1950-2011 and Implications for Fairness, 81 GEO.
WASH. L. REV. 101 (2013) (on file with the author). In the 1980s, the period examined by the ABA, the rate was significantly higher,
perhaps because of the skepticism of the Reagan Administration FTC to cases brought by the Carter Administration FTC.
In re LabMD, Briefng Book Page 69



Copyright 82013 Washington Legal Foundation ISBN 1056 3059 4
In another case in 2008, the D.C. Circuit reversed an FTC decision that Rambus, a maker of high-tech
computer memory, had “deliberately engag[ed] in a pattern of anticompetitive acts and practices that served to
deceive an industry-wide standard-setting organization, resulting in adverse effects on competition and
consumers.” FTC Issues Complaint Against Rambus, Inc., Federal Trade Commission, at
http://www.ftc.gov/opa/2002/06/rambus.shtm. After 18 months of litigation the ALJ dismissed the FTC’s
complaint, finding no anticompetitive effects resulting from the challenged conduct. Rambus Inc., (F.T.C. Feb.
24, 2004) (No. 9302). The complaint counsel appealed the decision and in 2006 the Commission reversed the
ALJ’s decision after engaging in its own fact finding, which included reopening the record after the ALJ’s
decision to admit supplemental evidence.
Rambus appealed the Commission’s decision to the D.C. Circuit, which overturned the Commission,
finding that Rambus’ conduct did not “constitute monopolization” and “express[ing] our serious concerns about
the sufficiency of the evidence” the Commission relied upon. Rambus Inc. v. FTC, 522 F. 3d 456, 459 (D.C. Cir.
2008). In questioning the Commission’s reliability, the court specifically noted that “once again, the Commission
has taken an aggressive interpretation of rather weak evidence.” Id. at 469. The court raised “serious concerns
about the breadth the Commission ascribed” to disclosure policies, id. at 462, without any formal findings in the
record that the policies were so broad. Id. at 467.
This is not to suggest that the Commission was misguided in bringing these cases. Indeed, Congress
envisioned that the FTC would tackle the truly challenging cases and develop new areas of law. But the
perception of prejudgment and the Commission’s treatment of the facts severely undermined their decisions.
Why Impartiality Matters. There are five reasons why this appearance of fairness raises substantial
concerns. First, it brings into question whether respondents are afforded the right to due process and fundamental
fairness. The legal process only works if parties receive the process rights that they are due.
Second, if it appears the outcome is pre-determined, that may force respondents to settle even weak cases.
It may also have a broader chilling effect on companies whose conduct may (or may not) have beneficial
consumer effects if the company believes that its conduct could get challenged by the Commission—and if it does,
it will lose with certainty.
Third, the administrative process is credible only to the extent that it is impartial and there is a sense of
fairness. FTC adjudication is not only important for an individual case, but also for interpreting the law and
establishing precedent. These functions are diminished when the FTC is seen to lack credibility. For example, in
a private case brought while the FTC Rambus decision was on appeal, a district court specifically rejected the
FTC’s findings because of “the FTC’s lack of independence given the fact that the FTC essentially acts as both the
complainant and the decision maker.”
4

Fourth, the FTC adjudicative process is tremendously expensive. Fundamentally, if businesses know that
they will not be able to appear before a truly independent adjudicator until they can appeal an FTC decision to a
court of appeals, this will significantly raise the cost of the FTC process and often force settlement.
Finally, the Antitrust Division of the Justice Department must bring its cases in federal court. This creates
a fundamental unfairness between those companies who are subject to the jurisdiction of the Justice Department
and those companies that are subject to FTC jurisdiction, since those companies subject to DOJ enforcement can
have their day in court sooner.
Conclusion. Because the FTC acts as a prosecutor and an adjudicator, the agency must ensure its
procedures are fair and impartial. In the adjudication process the Commission must be willing to admit error and
dismiss complaints where appropriate. Without a balanced approach the adjudicative process will be diminished
and its enforcement powers undermined.


4
Order Denying Manufacturers’ Motion for Prima Facie Effect and Denying Manufacturers’ Motion for Collateral Estoppel, Hynix
Semiconductor Inc. v. Rambus Inc., No. C-00-20905 RMW, 2009 WL 440473 – 2009 at *7.
In re LabMD, Briefng Book Page 70
nat ionallawjournal.com http://www.nat ona awjourna .com/ d=1202635953634?s return=20140029091405
FTC's Winning Streak Provokes Questions About Process
FTC commissioner Julie Brill Photo: Diego M. Radzinschi / NLJ
It's not just Las Vegas where the house always wins.
For nearly two decades, the Federal Trade Commission has come out on top in every administrative lawsuit
involving allegations of unf air methods of competition — a winning streak now being challenged by lawyers and
members of Congress, who question whether the f orum is f air.
The latest skirmish came on Christmas Eve, when Commissioner Julie Brill agreed to recuse herself in a
pending case involving medical testing company LabMD Inc.'s patient inf ormation data-security practices.
The "FTC's administrative process appears to be rigged against respondent," argued the company's counsel
f rom Dinsmore & Shohl and Cause of Action, a nonprof it government accountability group. Brill's "public
statements show she has prejudged the f acts of LabMD's case," they said, citing pretrial speeches that
included ref erences to the company.
Brill, a Democrat with a reputation as a tough public interest advocate, said the motion to disqualif y her was
"without merit," but agreed to step aside to avoid "an undue distraction."
In another pending case involving anticompetitive conduct in the iron pipe f ittings market, the FTC's f our
politically appointed commissioners are now weighing whether to reverse a 464-page decision by the agency's
chief administrative law judge. The judge, D. Michael Chappell, in a split decision f ound in f avor of pipef itter
McWane Inc. on a crucial point. If the commissioners allow the decision to stand, it will be the FTC's f irst loss in
such a case since 1995.
In re LabMD, Briefng Book Page 71
Concerns about the FTC's administrative process have percolated up to members of
Congress as well. "With this kind of record and an unbeaten streak that Perry Mason
would envy, a company might wonder whether it is worth putting up a def ense at all," said
House antitrust subcommittee chairman Spencer Bachus (R-Ala.) during a November 2013
hearing.
FTC Commissioner Joshua Wright, who has bluntly criticized aspects of the process,
agreed. Most companies f acing an in-house FTC trial opt to settle "rather than going
through lengthy and costly administrative litigation in which they are both shooting at a moving target and have
the chips stacked against them," he wrote in a recent antitrust journal article.
Still, the FTC does not have the f inal word — agency decisions can be appealed to the relevant f ederal circuit
courts of appeals. But according to Wright, a Republican who was previously a prof essor at George Mason
University School of Law, " The FTC's own decisions are reversed by f ederal courts of appeal at a much
greater rate than those of generalist district court judges with little or no antitrust expertise."
A Federal Trade Commission spokesman declined to comment on the agency's administrative litigation because
it is at issue in the pending LabMD suit.
'UNDUE DISTRACTION'
The ability to bring complex administrative cases was "a f ounding purpose" of the FTC, said D. Bruce Hof f man,
a f ormer FTC senior of f icial who now heads the global competition practice at Hunton & Williams. "It's not
something the commission has taken onto itself . It's supposed to be a very important part of its role." But he
added that the "track record of unbroken losses f or respondents is not encouraging."
Part of the problem lies in the statute itself , which calls f or the FTC to act as both prosecutor and judge. The
commissioners vote to sue a company f or suspected misconduct, and the case is heard by an administrative
law judge — proceedings similar to a bench trial in f ederal court. Either side can appeal the judge's decision to
the commissioners, who conduct an all-new review of the f acts and law and issue a f inal decision.
Over the past 19 years, when a judge has f ound f or the FTC, the commissioners have upheld the decision. But
when the judge f ound f or the respondent, the commissioners have overruled the decision in the FTC's f avor,
according to David Balto, a public interest antitrust lawyer and f ormer FTC of f icial.
One of the most notable missteps came in a case against Rambus Inc. involving standard-setting patents.
Af ter a massive trial, administrative law judge Stephen McGuire in 2006 dismissed all the charges. The
commissioners reversed his decision, f inding that Rambus unlawf ully monopolized markets f or computer
memory technologies — only to be reversed in turn by the U.S. Court of Appeals f or the D.C. Circuit in 2008.
In re LabMD, Briefng Book Page 72
0001
1 THIS IS AN
2 UNCERTIFIED ROUGH DRAFT
3 OF IN RE LABMD, INC. TRIAL VOLUME 8,
4 TAKEN JUNE 12, 2014.
5
6 THE FINAL TRANSCRIPT MAY VARY
7 WITH REGARD TO PAGE/LINE NUMBERING
8 AS WELL AS SUBSTANTIVE CONTENT.
9
10 THE COURT REPORTER RESERVES THE
11 RIGHT TO MAKE ANY AND ALL CHANGES
12 NECESSARY TO PROVIDE AN ACCURATE
13 FINAL TRANSCRIPT.
14
15 THEREFORE, THIS DRAFT IS FOR
16 INTERNAL LAW FIRM PREPARATION ONLY
17 AND SHOULD NOT BE CITED TO THE COURT,
18 COUNSEL, OR OTHER WITNESSES WITHOUT
19 APPROPRIATE DISCLOSURES.
20
21 ACCEPTANCE OF THIS DRAFT TRANSCRIPT
22 CONSTITUTES A FINAL TRANSCRIPT ORDER.
0002
1 P R O C E E D I N G S
In re LabMD, Briefng Book Page 73
2 - - - - -
3 JUDGE CHAPPELL: Let me call to order or recall
4 Docket 9357. And actually we're reconvening after our
5 recess.
6 All right. Hit me with it. What have you got?
7 MR. SHERMAN: Good morning, Your Honor.
8 JUDGE CHAPPELL: Good morning.
9 MR. SHERMAN: When we were last here, the court
10 graciously granted a recess to let certain things
11 transpire. I think the main issue was whether or not a
12 witness which respondent had called would receive
13 immunity for his testimony between now and the time of
14 break. He has not at this particular point,
15 Your Honor.
16 To that issue specifically, it would be our
17 position to ask the court for an additional week based
18 on information that we've received from the oversight
19 committee with regard to them further proceeding with
20 their investigation.
21 JUDGE CHAPPELL: Is that the same information
22 source that said it would only be two weeks?
23 MR. SHERMAN: That is the exact same source,
24 Your Honor. And I do recall your statement on the
25 record that ofttimes that source does not move as
0003
In re LabMD, Briefng Book Page 74
1 quickly as they promise, and you've been proven right.
2 JUDGE CHAPPELL: Unfortunately.
3 So we have no witness today.
4 MR. SHERMAN: We do have a witness today,
5 Your Honor.
6 JUDGE CHAPPELL: Who is that?
7 MR. SHERMAN: Mr. Rick Wallace. And we're
8 prepared to proceed, should this court deem it
9 appropriate for us to proceed, to put him on the stand.
10 His attorney of course is here. It's my understanding
11 that he will invoke his Fifth Amendment rights.
12 JUDGE CHAPPELL: For everything or certain
13 areas?
14 MR. SHERMAN: For everything other than I
15 believe his name, his previous place of employment.
16 JUDGE CHAPPELL: Do you intend to request that I
17 go through the attorney general, that we invoke our
18 process for immunity?
19 MR. SHERMAN: I do not, Judge. I believe that
20 if put on the stand and asked the questions in the
21 manner that I intend to ask, we would then request that
22 the court make whatever inferences the court may make
23 under these circumstances.
24 JUDGE CHAPPELL: Well, if all he's going to give
25 us is his name, that's a lot of inferencing.
In re LabMD, Briefng Book Page 75
0004
1 MR. SHERMAN: I understand that, Your Honor.
2 Your Honor, while you consider that, it may be
3 appropriate for me to move on to the other issue which I
4 think the court should be advised of.
5 The court recalls that the issue of the
6 testimony of Mr. Robert Boback was raised the last time
7 we were before the court, and Mr. Boback was unavailable
8 to come back and give live testimony. At least
9 according to his attorney, his trip to Africa was to
10 begin on June 8 and end on June 24.
11 Given those factors, there was an agreement
12 amongst the parties, with the court's permission, to
13 take the deposition of Mr. Boback for what I believed to
14 be hearing testimony purposes.
15 We set that deposition for June 7, which was a
16 Saturday, in Pittsburgh. We traveled to Pittsburgh, and
17 we took testimony from Mr. Boback.
18 It was my position -- and I stated it on the
19 record -- that this deposition was taken for trial
20 testimony purposes only and that the rules that apply to
21 trial testimony or hearing testimony in this case should
22 apply to that particular deposition.
23 JUDGE CHAPPELL: If you have a motion, it should
24 have been made in writing. You shouldn't have waited
In re LabMD, Briefng Book Page 76
25 until today if you're intending to make a motion right
0005
1 now on the record, if that's where you're going. It
2 should have been done in writing because we're up to
3 June 12 and you're referring to June 7.
4 MR. SHERMAN: I'm not making a motion,
5 Your Honor. I'm just bringing the court's attention to
6 several objections that were raised during that
7 testimony.
8 We intend to present that particular deposition
9 transcript as an exhibit, Exhibit CX 541, which would be
10 the next exhibit we would present, in lieu of Mr. Boback
11 coming in here and testifying live.
12 What I am making the court aware of is that
13 complaint counsel and counsel for Mr. Boback decided
14 that they were going to treat that deposition as a
15 discovery deposition, which I thought was outside the
16 scope of what the court had permitted us to do for those
17 purposes on that day. And in doing so, Mr. Boback's
18 attorney made objections on the record which he
19 obviously would not have been able to do in this forum.
20 Complaint counsel attempted to bring in precisely the
21 evidence which you and complaint counsel discussed on
22 the record, which you said was not going to happen, and
23 so --
In re LabMD, Briefng Book Page 77
24 JUDGE CHAPPELL: I believe what I said was not
25 going to happen was I wasn't going to allow a deposition
0006
1 for that purpose. However, if the man came here and
2 took the stand, he would be allowed to ask the
3 questions -- he's a fact witnesses. They would be
4 allowed to ask him certain things.
5 So my standard will be was he asked something at
6 that deposition that he could not have been asked under
7 our rules had he taken the stand. That will be the
8 standard I apply.
9 MR. SHERMAN: I believe he was. I believe he
10 was asked questions that were outside of the scope of
11 the cross-examination that I conducted in that
12 particular deposition.
13 JUDGE CHAPPELL: Well, there you go. If you're
14 correct, then that testimony will not be considered.
15 MR. SHERMAN: I'm alerting the court to those
16 issues.
17 JUDGE CHAPPELL: And I can't make a prospective
18 ruling without seeing anything, but had he been here and
19 had an objection been made outside the scope, I would
20 have dealt with that. And you know the rule in this
21 court. Everybody should know by now. You don't go
22 outside the scope of direct.
In re LabMD, Briefng Book Page 78
23 MR. SHERMAN: I understand, Your Honor. But I'm
24 simply raising that that when the exhibit comes in the
25 court would be aware that these issues exist there.
0007
1 JUDGE CHAPPELL: Do you want to respond?
2 MS. VANDRUFF: I do, Your Honor. Thank you.
3 JUDGE CHAPPELL: I want to hear the government's
4 response to everything, the delay, the deposition
5 tactics, whatever. Let's go.
6 MS. VANDRUFF: Well, with respect to the delay,
7 Your Honor, we believe that it's appropriate if
8 respondent intends to call Mr. Wallace as a witness that
9 they invoke the commission's rules pursuant to rule 3.39
10 because that relief has been available to respondent
11 since the first notice that they received that
12 Mr. Wallace would be invoking his constitutional rights.
13 I don't know when that was, but it was at some point
14 prior to our last appearance before Your Honor on
15 May 30. And we think that certainly that at this time
16 there's no reason to not for respondent to not avail of
17 itself of that provision of the commission's rules. And
18 any inference -- Mr. Sherman's suggestion that the
19 court --
20 JUDGE CHAPPELL: Wait, wait, wait.
21 So it's the government's position that on a
In re LabMD, Briefng Book Page 79
22 representation that a witness will take the Fifth, you
23 expect the attorney calling the witness to invoke the
24 burdensome machinery to apply for immunity? And I do
25 mean burdensome.
0008
1 We don't have a witness who's taken the stand
2 and asked for Fifth Amendment immunity. That's not
3 happened or Fifth Amendment protection or an immunity
4 request. We're not there yet.
5 MS. VANDRUFF: Your Honor, where we are, it's my
6 understanding anyway, is that counsel for Mr. Wallace
7 has advised both counsel for respondent and complaint
8 counsel that if he were to be called to the stand that
9 he would invoke his constitutional privileges and would
10 provide testimony only regarding his name and his former
11 place of employment.
12 JUDGE CHAPPELL: You said his attorney said
13 that. We don't know what Mr. Wallace is saying, do we?
14 MS. VANDRUFF: That's correct, Your Honor. I
15 have not received any testimony from Mr. Wallace.
16 JUDGE CHAPPELL: Go ahead.
17 MS. VANDRUFF: So with respect to our proceeding
18 today, to the extent that Mr. Sherman and I are both
19 correct that Mr. Wallace intends to invoke his
20 constitutional rights, we believe that it's appropriate
In re LabMD, Briefng Book Page 80
21 at this time for respondent to invoke the provision of
22 rule 3.39 and we would today is the first indication
23 that we've received of any sort that respondent is
24 asking this court to draw inferences from Mr. Wallace's
25 invocation of the Fifth Amendment. We would oppose that
0009
1 and ask that we be given an opportunity to brief it. I
2 think that that is contrary to the law with respect to
3 the circumstances under which any inference could be
4 drawn. He's not a party to this matter. He's a third
5 party and his relationship to the parties -- well, I
6 think that any inference would be inappropriate. But we
7 would like the opportunity to understand exactly what
8 respondent is asking this court, what inferences the
9 respondent is asking this court to draw and to be
10 provided with the opportunity to brief that.
11 JUDGE CHAPPELL: All right. First of all, I
12 understand the video depo was taken?
13 MR. SHERMAN: That's correct, Your Honor.
14 JUDGE CHAPPELL: Then the court is going to
15 require the video as well as the transcript if that's
16 offered into evidence.
17 MR. SHERMAN: Yes, sir.
18 JUDGE CHAPPELL: In case any credibility
19 findings are needed to be supported on appeal.
In re LabMD, Briefng Book Page 81
20 Let's talk about Mr. Wallace. Is his attorney
21 here today?
22 MS. DICKIE: Yes, Your Honor.
23 JUDGE CHAPPELL: All right. Update me.
24 MS. DICKIE: Good morning, Your Honor. I'm
25 Lauren Dickie with Quinn Emanuel on behalf of
0010
1 Rick Wallace.
2 The representations by both parties today are
3 correct. If Mr. Wallace was called to the stand, he
4 would indeed invoke his Fifth Amendment rights and
5 assert his Fifth Amendment rights and stand on those
6 grounds and not answer questions.
7 JUDGE CHAPPELL: Did you attend the deposition
8 of Mr. Boback?
9 MS. DICKIE: I did not, Your Honor.
10 JUDGE CHAPPELL: Are you aware of what happened
11 that day?
12 MS. DICKIE: Some of it.
13 JUDGE CHAPPELL: Mr. Sherman, did anyone invoke
14 the Fifth Amendment rights at that deposition of
15 Mr. Boback?
16 MR. SHERMAN: No, sir.
17 JUDGE CHAPPELL: Are you intending to go into
18 any areas with Mr. Wallace that were not covered with
In re LabMD, Briefng Book Page 82
19 Mr. Boback?
20 MR. SHERMAN: That were not covered?
21 JUDGE CHAPPELL: Right.
22 MR. SHERMAN: I do not believe so.
23 JUDGE ^ CHAPPELL: Is Mr. Wallace in the
24 building.
25 MS. DICKIE: He's not, Your Honor, but he's very
0011
1 close, within five minutes.
2 JUDGE CHAPPELL: What's the status of his
3 immunity deal.
4 MS. DICKIE: Yes, Your Honor there's some things
5 I can represent publicly and there's sores that if
6 Your Honor requests more detail we would request an
7 in camera discussion.
8 JUDGE CHAPPELL: Let's have the public version
9 first we have a room full of spectators.
10 MS. DICKIE: Congress is investigating Tiversa
11 and as part of that they are interviewing individuals
12 and considering immunity for one or more individuals.
13 JUDGE CHAPPELL: Are you aware of whether they
14 have requested Mr. Boback's -- his attendance at these
15 hearings? Has Mr. Boback gotten a letter.
16 MS. DICKIE: My understanding is yes. I have
17 not had a direct discussion with Mr. Boback's attorney
In re LabMD, Briefng Book Page 83
18 or Mr. Boback, but my understanding is that yes and that
19 he's had discussions he or his attorneys have had
20 discussions with the committee.
21 JUDGE CHAPPELL: But we know, Mr. Boback even
22 having gotten the letter did not invoke his
23 Fifth Amendment rights.
24 MS. DICKIE: I have not heard that he did but
25 again I have not had direct conversations with limb or
0012
1 his attorney about that.
2 JUDGE CHAPPELL: I think we just heard that we
3 did not. You heard that; correct?
4 MS. DICKIE: I did.
5 JUDGE CHAPPELL: What is Mr. Wallace's position
6 with Tiversa?
7 MS. DICKIE: He's not currently working at
8 Tiversa. He's no longer employed there.
9 JUDGE CHAPPELL: When did he work there and what
10 was his title.
11 MS. DICKIE: He worked there my understanding is
12 he worked there from about 2008 to 2014. He had various
13 titles within that, but the most recent one was director
14 of special operations.
15 JUDGE CHAPPELL: Special ops?
16 MS. DICKIE: Yes.
In re LabMD, Briefng Book Page 84
17 JUDGE CHAPPELL: Interesting.
18
19 MS. DICKIE: Your Honor, I can also represent
20 that the committee of oversight sent a letter to the FTC
21 yesterday ceasing several parties here today about the
22 investigation and informing them that it was going on
23 and the steps that were being taken. I can make
24 additional in camera representations about specifically
25 Mr. Wallace's participation and where we expect and what
0013
1 we expect to be doing in the next week in the coming
2 weeks on this process.
3 JUDGE CHAPPELL: Did not anyone think I would be
4 interested in seeing this letter? I'm asking you.
5 You're representing the government. I just heard that
6 you got a letter regarding this witness. Why don't I
7 see the letter.
8 MS. VANDRUFF: I'm sorry, Your Honor. The
9 witness about whom the letter relates the Mr. Boback. I
10 received a copy from our office of congressional
11 relations and from Ms. Dickie last evening after 5:30
12 and I would be happy to hand up a copy. We think,
13 though, that this is not admissible for any purpose in
14 this matter.
15 JUDGE CHAPPELL: Does it regard Mr. Wallace at
In re LabMD, Briefng Book Page 85
16 all.
17 MS. VANDRUFF: It does not regard Mr. Wallace or
18 I should say there is no reference to Mr. Wallace in
19 this letter.
20 JUDGE CHAPPELL: Did you not tell me it regarded
21 Mr. Wallace?
22 MS. DICKIE: I don't believe those were the
23 words I used. I believe I said the committee had sent a
24 letter to the FTC.
25 JUDGE CHAPPELL: Forget what words you used. I
0014
1 can go back and read them, but I don't have time.
2 So is your position this letter has anything to
3 do with Mr. Wallace?
4 MS. DICKIE: The letter states that Tiversa is
5 being investigated by the committee and I can make ex
6 parte representations about Mr. Wallace's participation
7 in that and that is what I was trying to convey to the
8 court. But no, the letter does not specifically
9 reference Mr. Wallace.
10 MR. SHERMAN: Your Honor, if I may.
11 The letter does specifically, based on my
12 knowledge of the case, I believe the letter does
13 specifically reference interaction between Mr. Wallace
14 and Mr. Boback to which Mr. Boback testified at a
In re LabMD, Briefng Book Page 86
15 recorded statement that he gave to the oversight
16 committee. There are some issues with the consistency
17 of that information as it was testified to by Mr. Boback
18 previously and as it was testified to or given to the
19 committee when Mr. Boback appeared before the committee.
20 JUDGE CHAPPELL: And the last time we were here
21 Mr. Wallace was supposed to testify on June 5, did that
22 occur?
23 MS. DICKIE: It was not testimony, Your Honor.
24 He has had a meeting with the committee.
25 JUDGE CHAPPELL: And has that occurred.
0015
1 MS. DICKIE: That meeting has occurred.
2 JUDGE CHAPPELL: And to your knowledge, is
3 anything pending with that committee regarding
4 Mr. Wallace.
5 MS. DICKIE: Yes, we are still in the process of
6 working with the committee. We don't have any promises
7 or letters stating that he is going to get immunity. We
8 are working with them. We have additional participation
9 planned that I can make additional representations to
10 the court in camera if allowed, but this process is
11 ongoing and we're actively participating with the
12 committee.
13 JUDGE CHAPPELL: So he was not questioned under
In re LabMD, Briefng Book Page 87
14 oath.
15 MS. DICKIE: He's not been questioned under
16 oath.
17 JUDGE CHAPPELL: He didn't invoke his right to
18 Fifth Amendment protection at this meeting?
19 MS. DICKIE: All of the meetings have been
20 protected by an attorney proffer.
21 JUDGE CHAPPELL: And is there any indication
22 Mr. Wallace is going to be recalled in front of this
23 committee?
24 MS. DICKIE: Yes.
25 JUDGE CHAPPELL: Let me see the letter.
0016
1 MS. DICKIE: Yes, Your Honor. May I approach?
2 JUDGE CHAPPELL: Yes.
3 (Pause in the proceedings.)
4 JUDGE CHAPPELL: Ms. VanDruff, what part of this
5 letter do you think is not relevant to this proceeding?
6 Stand up and address that question immediately. I just
7 read paragraph 2. I want to hear from you.
8 MS. VANDRUFF: Your Honor, I didn't say it
9 wasn't relevant, Your Honor. And Mr. Sherman is also
10 copied on this letter and it is Mr. Sherman who raised
11 the issue of Mr. Wallace this morning. To the extent
12 that Mr. Sherman believed that this letter was relevant
In re LabMD, Briefng Book Page 88
13 to Your Honor's --
14 JUDGE CHAPPELL: You would agree this letter
15 refers to the 1718 File.
16 MS. VANDRUFF: Absolutely, Your Honor.
17 JUDGE CHAPPELL: In black-and-white, it's right
18 there. You would agree it refers to testimony being
19 accurate or not regarding this case.
20 MS. VANDRUFF: Yes, Your Honor. I made no
21 representation to the contrary.
22 JUDGE CHAPPELL: Yet you didn't talk about the
23 letter until I asked you; is that correct?
24 MS. VANDRUFF: Your Honor.
25 JUDGE CHAPPELL: Until this lady brought it up.
0017
1 MS. VANDRUFF: The issue that Your Honor --
2 JUDGE CHAPPELL: Were you going to sit there and
3 not tell me about this letter? Were you going to do
4 that if I hadn't asked you? That's what I want to know.
5 MS. VANDRUFF: Your Honor, I was prepared to
6 address this letter today. Mr. Wallace is not our
7 witness, nor is Mr. Boback, and so if it was in the
8 interest of -- I don't know.
9 JUDGE CHAPPELL: You don't think in the interest
10 of truth this information should be disclosed to this
11 court in this proceeding?
In re LabMD, Briefng Book Page 89
12 MS. VANDRUFF: I was not withholding the
13 information, Your Honor.
14 JUDGE CHAPPELL: We're trying to get to the
15 truth here, aren't we?
16 MS. VANDRUFF: Of course we are.
17 JUDGE CHAPPELL: You don't think this letter
18 touches on this matter in truth on this matter that
19 we're having a trial. You were not going to bring up
20 this letter; is that correct?
21 MS. VANDRUFF: No, Your Honor, that is not what
22 I said. No. That is not the position of the
23 government, of course not.
24 JUDGE CHAPPELL: Then you had plans to offer
25 this letter because it's relevant? Is that what you're
0018
1 doing?
2 MS. VANDRUFF: Excuse me, Your Honor?
3 JUDGE CHAPPELL: You had plans to offer this as
4 an exhibit?
5 MS. VANDRUFF: Your Honor, I don't think that it
6 is admissible for any purpose in this matter because it
7 is hearsay. Nonetheless, I think it's appropriate in
8 the context of Ms. Dickie's representations to the court
9 regarding Mr. Wallace and the conduct of the committee
10 for Your Honor to have been advised about the current
In re LabMD, Briefng Book Page 90
11 state of the committee's investigation.
12 JUDGE CHAPPELL: This is a letter to the head of
13 the FTC.
14 MS. VANDRUFF: Correct.
15 JUDGE CHAPPELL: Talking about fundamental
16 matters in this proceeding about truth or veracity,
17 fundamental matters of a source that's been very helpful
18 to the government I might add in its case based on what
19 I've heard. I'm very disappointed this was not brought
20 to my attention by the government. Go ahead.
21 MS. VANDRUFF: I apologize, Your Honor.
22 Thank you.
23 MS. DICKIE: Yes, Your Honor. I believe that we
24 were talking about the status of the investigation and
25 where Mr. Wallace stood and from the letter you can see
0019
1 that there's an active investigation going on and I can
2 represent that Mr. Wallace is -- has participated and
3 will continue to participate and I can provide any
4 further details the court might want in camera.
5 JUDGE CHAPPELL: Mr. Sherman, what's your
6 position on this letter?
7 MR. SHERMAN: Your Honor, my position on this
8 letter is that it comports with the representations that
9 I made on very limited factual evidence last time we
In re LabMD, Briefng Book Page 91
10 were before this court, that in fact there are some
11 serious, serious misgivings about the quality of the
12 evidence which is central to the FTC's case. What we
13 now have is a letter from the oversight committee.
14 JUDGE CHAPPELL: Remember, we are in public
15 session.
16 MR. SHERMAN: What we now have is a letter from
17 the oversight committee questioning just that. And so
18 my position on the letter, Your Honor, as it relates to
19 this proceeding, is that we are in a position either to
20 call Mr. Wallace today, put him on the stand and let him
21 invoke his Fifth Amendment privileges. We have
22 requested this court to stay or continue the matter so
23 that this committee can continue its work and decide
24 what we think would be in short order to give
25 Mr. Wallace the immunity necessary for him to come here
0020
1 and in the public interest tell what he knows.
2 We have no idea what the 3.39 procedures are
3 past making the application or requesting this court to
4 do so.
5 JUDGE CHAPPELL: Well, I can't imagine that
6 procedure or process is quicker than anything that's
7 going to happen with Congress.
8 MR. SHERMAN: That's the point I was getting
In re LabMD, Briefng Book Page 92
9 ready to make, Your Honor.
10 MS. VANDRUFF: And if I may, Your Honor, the
11 statute under which Congress can seek immunity is
12 18 U.S.C. 6005 which is referenced in the letter that's
13 before Your Honor. By my read of the statute, the
14 Congress can only get a grant of use immunity and I'm
15 not confident that it would extend to Mr. Wallace's
16 testimony before this tribunal. To the extent that
17 Mr. Wallace does seek immunity in this tribunal, I
18 believe that he must do so -- excuse me -- that
19 respondent must seek that immunity through rule 3.39.
20 MR. SHERMAN: It's my understanding, however,
21 Your Honor, that part of the process with the oversight
22 committee is that once that vote is taken, it is
23 reviewed by the Department of Justice, such that if the
24 Department of Justice reviews and approves and if
25 Ms. VanDruff is correct, it seems to me that that would
0021
1 speed up the process under 3.39 if they have already
2 approved the immunity through some other process.
3 JUDGE CHAPPELL: That would appear logical, sir,
4 but as we all know, sometimes logic doesn't dictate
5 things in these proceedings.
6 Regarding your request for immunity, are you
7 attempting to include this proceeding?
In re LabMD, Briefng Book Page 93
8 MS. DICKIE: Your Honor, we are not that far in
9 the process to be able to speak to the scope of the
10 immunity that.
11 JUDGE CHAPPELL: After two weeks?
12 MS. DICKIE: No, Your Honor. It's quite
13 extensive the amount of work that we've had to do and
14 the discussions have been quite comprehensive, but we
15 are not at a place where I can speak to the scope that
16 Congress would be willing or what under the law we would
17 be allowed to even ask for. We're not there yet.
18 JUDGE CHAPPELL: I would expect that this letter
19 would be a joint exhibit by the parties.
20 MR. SHERMAN: I have no objection.
21 JUDGE CHAPPELL: And I'll entertain whether or
22 not it should be in camera. What's your position on
23 that.
24 MS. VANDRUFF: Your Honor, we don't object to
25 the court receiving this document, but I don't believe
0022
1 it's admissible for any permissible purpose. It is
2 hearsay. It is statements by the chair of on.
3 JUDGE CHAPPELL: This is what we're going to do.
4 Do I have an offer of this letter as an exhibit.
5 MR. SHERMAN: Your Honor, I move that the
6 exhibit be offered as an exhibit.
In re LabMD, Briefng Book Page 94
7 JUDGE CHAPPELL: What's your legal basis?
8 MR. SHERMAN: My legal basis, Your Honor, is
9 that it is relevant to the heart of this matter and that
10 the court can give it whatever weight the court deems
11 necessary. It is relevant.
12 JUDGE CHAPPELL: Okay. And what's the exhibit
13 number, RX what?
14 MR. SHERMAN: If it's going to be an RX exhibit,
15 it would be a CX exhibit if we are offering it,
16 Your Honor.
17 MS. VANDRUFF: Your Honor, no. It would be an
18 RX exhibit.
19 MR. SHERMAN: Or it would be a joint exhibit,
20 Joint Exhibit.
21 JUDGE CHAPPELL: If she's not offering it,
22 you're offering it, it's an RX. It won't be a JX unless
23 both parties agree and I don't hear that.
24 MR. SHERMAN: That's correct. So it would be
25 RX 542, Your Honor.
0023
1 JUDGE CHAPPELL: All right. Here's what I'm
2 going to do I have an offer of RX 542. I wanted that to
3 be in writing. I want to know your positions in
4 writing.
5 MS. VANDRUFF: Will we have an opportunity to
In re LabMD, Briefng Book Page 95
6 respond, Your Honor?
7 JUDGE CHAPPELL: Of course.
8 MS. VANDRUFF: Thank you, Your Honor.
9 JUDGE CHAPPELL: In writing versus in writing.
10 That's the way we do things.
11 MS. VANDRUFF: Thank you, Your Honor.
12 JUDGE CHAPPELL: Is this my copy?
13 MS. DICKIE: Yes, Your Honor.
14 JUDGE CHAPPELL: Thank you.
15 JUDGE CHAPPELL: Mr. Sherman, I want to make
16 sure that you or your staff or the ones doing all the
17 work have adequate time to file a motion regarding
18 admitting this exhibit. How much time do you think you
19 need? Do you want to confer?
20 MR. SHERMAN: Your Honor, if we could have until
21 Wednesday of next week is.
22 JUDGE CHAPPELL: All right. Before I deal with
23 that, Ms. VanDruff, I have an offer of RX 542. State on
24 the record what your objection is.
25 MS. VANDRUFF: I'm sorry, Your Honor, because I
0024
1 must confess I've gotten lost, RX 542 was the letter.
2 Your Honor, it's complaint counsel's position
3 and we object to the admission of RX 542 because it is
4 hearsay. The substance of Chairman Issa's comments to
In re LabMD, Briefng Book Page 96
5 the --
6 JUDGE CHAPPELL: That's all I need to know.
7 Your basis is hearsay, and that's all I want briefed,
8 why it's not hearsay or it is hearsay.
9 MS. VANDRUFF: And Your Honor, there's also the
10 issue of hearsay within hearsay.
11 JUDGE CHAPPELL: Well, that's covered by
12 hearsay.
13 MS. VANDRUFF: It is indeed.
14 JUDGE CHAPPELL: That way, we can make it more
15 efficient. We deal with the objection that's pending.
16 MS. VANDRUFF: And Your Honor, if respondent is
17 going to file a motion on Wednesday, when would you like
18 complaint counsel's response?
19 JUDGE CHAPPELL: Do you need until Wednesday to
20 address the hearsay aspect only?
21 MR. SHERMAN: I think it can be done earlier if
22 the court would like it. We have tomorrow is Friday;
23 correct?
24 JUDGE CHAPPELL: I believe. Yes.
25 MR. SHERMAN: We could have it to the court by
0025
1 end of business on Monday.
2 JUDGE CHAPPELL: And how much time do you need
3 to respond keeping in mind you can be working on it the
In re LabMD, Briefng Book Page 97
4 whole time. We know what the issue is.
5 MS. VANDRUFF: Certainly, Your Honor. We will
6 respond on Tuesday.
7 JUDGE CHAPPELL: Is Tuesday close of business
8 adequate?
9 MS. VANDRUFF: Close of business Tuesday we will
10 respond, yes, Your Honor.
11 JUDGE CHAPPELL: Then I will take this offer of
12 RX 542 under advisement.
13 MS. VANDRUFF: Thank you, Your Honor.
14 JUDGE CHAPPELL: Now what we have to deal with
15 is what to do about Mr. Wallace.
16 I'm not sure it's going to expedite anything to
17 have him take the stand and invoke the Fifth but I also
18 don't like to hold this proceeding open for one witness.
19 It's your position, Mr. Sherman, his testimony is
20 crucial to your case?
21 MR. SHERMAN: We absolutely believe it is
22 crucial to our defense, Your Honor.
23 JUDGE CHAPPELL: What do you propose, we
24 reconvene once a week because of Mr. Wallace?
25 MR. SHERMAN: Given these circumstances,
0026
1 Your Honor, and I'm going to speak generally -- at the
2 beginning of the case in my opening statement I
In re LabMD, Briefng Book Page 98
3 indicated that what I believe that the government would
4 fail to prove is likely to cause substantial consumer
5 injury.
6 If Mr. Wallace's testimony as I believe it to be
7 comes into evidence and he is allowed to state it given
8 immunity, I believe that it will eliminate a core
9 section of the government's evidence.
10 JUDGE CHAPPELL: Well, based on the evidence
11 I've heard, what can he address other than how the
12 government got the information from Tiversa? And am I
13 correct, that's the issue he's supposed to testify
14 regarding?
15 MR. SHERMAN: That's correct. How he got the
16 information. And I think he can also address the
17 veracity of that information, whether or not in fact
18 that information is what it purports to be. And without
19 that information and without that piece of evidence, I
20 would submit that the government has a very slim chance
21 of proving that LabMD participated in an unfair
22 practice, that being its data security, and that the
23 state of LabMD's data security was likely to cause
24 substantial consumer injury.
25 JUDGE CHAPPELL: Tiversa was responsible for the
0027
1 1718 File; is that correct?
In re LabMD, Briefng Book Page 99
2 MR. SHERMAN: They were responsible for
3 providing it to the FTC. They in fact were the ones who
4 possessed it prior to giving it to the FTC.
5 JUDGE CHAPPELL: Ms. VanDruff.
6 MS. VANDRUFF: Yes, Your Honor.
7 JUDGE CHAPPELL: Your case is based on what
8 physical evidence other than the 1718 File?
9 MS. VANDRUFF: Physical evidence. I'm not sure
10 how to address that question, Your Honor.
11 JUDGE CHAPPELL: Documents.
12 MS. VANDRUFF: Pardon me?
13 JUDGE CHAPPELL: Documents.
14 MS. VANDRUFF: We have presented substantial
15 proofs on the state of LabMD's security.
16 JUDGE CHAPPELL: I'm not asking for a closing
17 argument.
18 MS. VANDRUFF: No.
19 JUDGE CHAPPELL: I'm asking what documents your
20 case is based on. We got the 1718 File. We all know
21 what that is, we do among us. What other documents
22 regarding information about customers that was released?
23 MS. VANDRUFF: So if you're asking specifically
24 about the unauthorized disclosure of information.
25 JUDGE CHAPPELL: That's right.
0028
In re LabMD, Briefng Book Page 100
1 MS. VANDRUFF: Is that Your Honor's question?
2 Because there are certainly many other documents that
3 are probative of the elements in our case.
4 But with respect to specific unauthorized
5 disclosures, there are two known specific unauthorized
6 disclosures. The first is of the 1718 File, which
7 Mr. Boback testified at his deposition was found at four
8 IP locations and more recently provided --
9 JUDGE CHAPPELL: I don't need to know any of the
10 details.
11 MS. VANDRUFF: I understand. I know.
12 JUDGE CHAPPELL: Just give me the documents.
13 MS. VANDRUFF: And that is the 1718 File. And
14 the other unauthorized disclosure about the -- that is
15 known is the unauthorized disclosure of the information
16 that was found by the Sacramento Police Department.
17 JUDGE CHAPPELL: And the Sacramento police
18 information we'll call that, was that information that
19 was included in the 1718 File?
20 MS. VANDRUFF: It was not coextensive,
21 Your Honor, no.
22 JUDGE CHAPPELL: All right. You may have told
23 me this already, but do you think you'll know something
24 in a week?
25 MS. DICKIE: Your Honor, I believe that we will
In re LabMD, Briefng Book Page 101
0029
1 be able to make additional representations about the
2 progress and we hope that we will have a more final
3 determination by next week. However, based on how
4 things have gone and how Congress moves and the fact
5 that immunity requires a two-thirds vote of the full
6 committee, I think it would be prudent to give a little
7 more time than a week, so that we are not back in this
8 same position next week, or a process by which the
9 parties could inform the court where we are next week.
10 JUDGE CHAPPELL: We're going to take a short
11 recess, and I'm going to ponder these issues. But I
12 want you to consider this, a status update every
13 Wednesday so we don't have to have this whole dog and
14 pony show going here with all these people expecting to
15 hear a trial and there isn't one, so think about that.
16 We're going to take a break. We're going to
17 reconvene at 10:30.
18 We're in recess.
19 (Recess)
20 JUDGE CHAPPELL: Let's go back on the record.
21 Call your next witness, Mr. Sherman.
22 MR. SHERMAN: Mr. Rick Wallace, please.
23 MS. VANDRUFF: Your Honor, if I may inquire, I
24 understand that Your Honor has asked that Mr. Wallace be
In re LabMD, Briefng Book Page 102
25 prepared to take the stand. Are you -- were you
0030
1 planning to let Mr. Sherman conduct his full
2 examination.
3 JUDGE CHAPPELL: It's his witness.
4 MS. VANDRUFF: Okay. And Your Honor, in that
5 respect, Mr. Sherman and I conferred prior to gaveling
6 in. May we approach, Your Honor? There is an issue on
7 which I that the court would benefit from having some
8 additional information.
9 JUDGE CHAPPELL: All right.
10 MS. VANDRUFF: Thank you, Your Honor.
11 (Discussion at the bench, off the public
12 record.)
---
2 (End off off-the-public-record discussion.)
3 (Sidebar discussion off the record.)
4 JUDGE CHAPPELL: The parties' attorneys and I
5 just had a discussion regarding the testimony of this
6 witness and how we think we should proceed to serve the
7 best interest of the public. Those of you sitting out
8 here, you didn't miss anything. Mr. Wallace, if you
9 would take the stand. Is there a motion regarding this
10 witness, Mr. Sherman.
11 MR. SHERMAN: Yes, Your Honor. After conferring
In re LabMD, Briefng Book Page 103
12 with complaint counsel and conferencing with His Honor,
13 there's a joint motion that upon the invoking of
14 Mr. Wallace's Fifth Amendment protections that we would
15 cease our questioning at that time and delay any further
16 questioning until such time as Mr. Wallace is either
17 granted or not granted immunity so that he can come in
18 and within the public interest testify fully to what his
19 knowledge is.
20 JUDGE CHAPPELL: Is that correct, Mr. VanDruff?
21 MS. VANDRUFF: Thank you, Your Honor.
22 Consistent with the bench conference that we had with
23 Your Honor, that is correct.
24 JUDGE CHAPPELL: And I'll grant that motion.
25 And should the /-PB witness invoke, we will then hold
0039
1 all testimony until we reconvene with a grant of
2 immunity if we get to that point.
3 MR. SHERMAN: Thank you, Your Honor.
4 MS. VANDRUFF: Thank you.
5 MS. DICKIE: May I make two representations on
6 behalf of my client.
7 JUDGE CHAPPELL:
8 MS. DICKIE: First that he doesn't hear that
9 well through his right ear to the extent the parties can
10 keep their voices up and be aware of that and
In re LabMD, Briefng Book Page 104
11 Mr. Wallace if you can't hear, just let me know and the
12 second is his counsel has provided with him with a sheet
13 of paper Fifth Amendment rights to the extent he pulls
14 that piece of paper out and reads from it we wanted the
15 court and the parties to know what that was.
16 JUDGE CHAPPELL: And based on the motion I just
17 granted, the joint motion, once he does invoke, if he
18 does, that will end the questioning for today.
19 MS. DICKIE: Understood, Your Honor.
20 JUDGE CHAPPELL: Josett, have you sworn the
21 witness.
22 Whereupon --
23 ^ ^ ^ Name name
24 a witness, called for examination, having been first
25 duly sworn, was examined and testified as follows:
0040
1 DIRECT EXAMINATION
2 BY MR. SHERMAN:
3 Q. Good morning, Mr. Wallace.
4 A. Good morning.
5 Q. My name is William Sherman. I represent the
6 respondent LabMD in this matter. For the record, could
7 you state and spell your full name, please?
8 A. Sure. Richard Wallace. It's R I C H A are D W
9 A L LA CE.
In re LabMD, Briefng Book Page 105
10 Q. Mr. Wallace, were you at one time employed by a
11 company known as Tiversa?
12 A. Yes.
13 Q. What was the length of time starting with your
14 start date to your end date of your employment with
15 Tiversa?
16 A. I started with Tiversa in July of 2007 and was
17 employed through February of this year.
18 Q. Mr. Wallace, what was your job title at Tiversa?
19 A. Per my counsel, I respectfully invoke the
20 Fifth Amendment.
21 JUDGE CHAPPELL: Sir, is it your intent not to
22 answer any further questions you're invoking your
23 protection under the Fifth Amendment.
24 THE WITNESS: I didn't hear, I'm sorry.
25 JUDGE CHAPPELL: Josett, would you read the
0041
1 question?
2 (The record was read as follows:)
3 "QUESTION: ^"
4 THE WITNESS: Yes, ma'am.
5 JUDGE CHAPPELL: All right. Thank you, sir.
6 You're excused.
7 Ms. Dickie, hold on, please.
8 MS. DICKIE: Yes, Your Honor.
In re LabMD, Briefng Book Page 106
9 MR. SHERMAN: She was going to walk her client
10 out and come right back in, Judge.
11 JUDGE CHAPPELL: All right.
12 All right. Under commission rule 3.39, should
13 respondent's counsel request an order requiring
14 Mr. Wallace to testify and grant immunity, I will need a
15 written motion from respondent demonstrating that the
16 testimony sought from Mr. Wallace may be necessary to
17 the public interest. Do you intend to make such a
18 motion?
19 MR. SHERMAN: I do, Your Honor. And we will
20 make such motion at such time that it is in the best
21 interest of our client and also in the best interest of
22 justice in this case.
23 JUDGE CHAPPELL: All right. And does the
24 government oppose the motion? When it is filed will the
25 government oppose?
0042
1 MS. VANDRUFF: Your Honor, the government does
2 not intend to oppose the motion. Complaint counsel
3 believes, however, that the appropriate time to file
4 that motion is at present.
5 JUDGE CHAPPELL: All right. Thank you.
6 MS. VANDRUFF: Thank you, Your Honor.
7 JUDGE CHAPPELL: And when those filings are
In re LabMD, Briefng Book Page 107
8 made, if and when they are, I'll consider those, I'll
9 consider the filings and whether to request through the
10 commission's liaison officer approval by the
11 United States attorney general for the issuance of a
12 order requiring Mr. Wallace to testify and granting
13 Mr. Wallace immunity.
14 And since the respondent has requested the
15 testimony of Mr. Wallace and also requested that we
16 recess or delay this proceeding so they can elicit that
17 testimony, I have no idea what Mr. Wallace is going to
18 say, but I believe in the interest of justice respondent
19 has the right to have this testimony presented and I
20 believe the interest of the truth which we're all trying
21 to get to the bottom of here, what is the truth, we need
22 to hear this gentleman's testimony in the event he can
23 get immunity and decides to testify. And regarding
24 that, I'm going to ask the parties to give me a status
25 report every Wednesday no later than 5:00 p.m. and
0043
1 Ms. Dickie, I'm going to ask you to coordinate with
2 Ms. VanDruff and Mr. Sherman so that they will know,
3 which is the main reason we want a status report, I need
4 to know what's going on with Mr. Wallace down the
5 street, whether he has immunity through the committee
6 and indeed whether that immunity extends to this
In re LabMD, Briefng Book Page 108
7 proceeding.
8 MS. DICKIE: Yes, Your Honor. That's fine.
9 JUDGE CHAPPELL: What's the status of the Boback
10 deposition? Has that been offered?
11 MR. SHERMAN: Your Honor, I did want to address
12 that. I believe that I might have labeled that CX 541,
13 and it should be RX 541. And with that housekeeping
14 matter, I would request that it be admitted into
15 evidence.
16 MS. VANDRUFF: And Your Honor, complaint counsel
17 doesn't oppose the admission of Mr. Boback's deposition
18 testimony. However, there is sensitive both sensitive
19 personal information and sensitive health information
20 addressed in the transcript. At the time of the
21 deposition, I asked for Mr. Sherman's consent to file an
22 in camera motion and it wasn't clear what respondent's
23 position would be with respect to that and so prior to
24 its admission, I would either ask again for respondent's
25 consent or complaint counsel move unilaterally that the
0044
1 testimony be treated in camera because of the sensitive
2 nature of certain answers to questions.
3 JUDGE CHAPPELL: You're saying that parts of the
4 testimony should be in camera.
5 MS. VANDRUFF: That's correct, Your Honor.
In re LabMD, Briefng Book Page 109
6 JUDGE CHAPPELL: Then I will wait to get your
7 motion for in camera treatment and then we'll.
8 MS. VANDRUFF: Prior to admitting the document.
9 JUDGE CHAPPELL: I'm going to admit the
10 document.
11 MS. VANDRUFF: Okay.
12 JUDGE CHAPPELL: But it's not going to be made
13 public. I'm giving /EUFT provisional grant of in camera
14 treatment which gives us twenty days.
15 MS. VANDRUFF: Thank you, Your Honor.
16 JUDGE CHAPPELL: And also regarding JX 3 which
17 was a previous letter from the House committee, I gave
18 that document provisional in camera treatment. Then I
19 understand the party that offered it stated on the
20 record he didn't care if it was public, so I want the
21 parties to know that as of June 23, it will be made part
22 of the public record unless I get a motion for in camera
23 treatment. That's JX 3.
24 MS. VANDRUFF: Your Honor, will there be an
25 opportunity for complaint counsel to receive a copy of
0045
1 that document? I still don't have it. You permitted me
2 to approach and read the document, but I don't have a
3 copy of the document.
4 JUDGE CHAPPELL: Do you have it, Mr. Sherman?
In re LabMD, Briefng Book Page 110
5 Ms. Dickie, would you provide a copy of that letter to
6 the parties' attorneys.
7 MS. DICKIE: Yes.
8 JUDGE CHAPPELL: Thank you.
9 MS. VANDRUFF: Thank you, Your Honor. And I
10 don't know that we have a motion, but we will evaluate
11 it on the basis of receiving the document.
12 JUDGE CHAPPELL: It is a joint exhibit. It's
13 JX 3.
14 MS. VANDRUFF: Yes, Your Honor. Thank you.
15 JUDGE CHAPPELL: Anything further?
16 MR. SHERMAN: Nothing further at this time,
17 Your Honor.
18 MS. VANDRUFF: Nothing further, at this time,
19 Your Honor.
20 JUDGE CHAPPELL: All right. We will.
21 JUDGE CHAPPELL: What was the exhibit number of
22 the Boback depo?
23 MR. SHERMAN: RX 541.
24 JUDGE CHAPPELL: RX 541 is admitted and again at
25 this time with provisional in camera treatment until I
0046
1 get a motion.
2 (RX Exhibit Number number was admitted into
3 evidence.)
In re LabMD, Briefng Book Page 111
4 JUDGE CHAPPELL: All right. We will await the
5 status report and eventually I will need to make a
6 determination when we will reconvene. I'm unaware at
7 this time when that will be. The public has a right to
8 take part in these proceedings. I haven't decided for
9 /SHAOURBGS but I may well issue an order on the public
10 record for the date and time we will reconvene this
11 hearing. Anything further?
12 MR. SHERMAN: Nothing further, Your Honor.
13 MS. VANDRUFF: Nothing further, Your Honor.
14 JUDGE CHAPPELL: Until we meet again we're in
15 recess.
16 *****END OF ROUGH DRAFT*****
17
In re LabMD, Briefng Book Page 112
1 IN THE UNITED STATES DISTRICT COURT
FOR THE NORTHERN DISTRICT OF GEORGIA
2 ATLANTA DIVISION
3 LabMD, INC. )
)
4 Plaintiff, ) CIVIL ACTION FILE
) NO. 1:14-CV-810-WSD
5 v. )
) ATLANTA, GEORGIA
6 FEDERAL TRADE COMMISSION )
)
7 Defendant. )
___________________________________)
8
9 TRANSCRIPT OF PROCEEDINGS
BEFORE THE HONORABLE WILLIAM S. DUFFEY, JR.,
10 UNITED STATES DISTRICT JUDGE
11 Wednesday, May 7, 2014
12
13 APPEARANCES OF COUNSEL:
14 For the Plaintiff: KILPATRICK TOWNSEND & STOCKTON LLP
(By: Ronald L. Raider
15 William D. Meyer)
Burleigh Lavisky Singleton)
16
DINSMORE & SHOHL LLP
17 (By: Reed D. Rubinstein)
18 For the Defendant: U.S. DEPARTMENT OF JUSTICE
(By: Lauren Fascett
19 Perham Gorji
Joel Marcus)
20
21
22 Proceedings recorded by mechanical stenography
and computer-aided transcript produced by
23 NICHOLAS A. MARRONE, RMR, CRR
1714 U. S. Courthouse
24 75 Spring Street, S.W.
Atlanta, GA 30303
25 (404) 215-1486
United States District Court
Northern District of Georgia
1
In re LabMD, Briefng Book Page 113
1 I N D E X
2 Witness Page
3 MICHAEL JOHN DAUGHERTY
Direct (By Mr. Raider) 5
4 Cross (By Mr. Gorji) 32
Redirect (By Mr. Raider) 57
5
CLIFF BAKER
6 Direct (By Mr. Meyer) 58
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
United States District Court
Northern District of Georgia
2
In re LabMD, Briefng Book Page 114
1 Wednesday Morning Session
2 May 7, 2014
3 9:44 a.m.
4 -- -- --
5 P R O C E E D I N G S
6 -- -- --
7 (In open court:)
8 THE COURT: Good morning, everybody.
9 This is the hearing that is scheduled pursuant to
10 my amended scheduling order which is dated April 9th this
11 year. It's a hearing on the motion for preliminary
12 injunction that's been requested by LabMD.
13 And absent anything that you want to discuss before
14 we start, I would say let just get started. Any objection to
15 doing that?
16 MR. RAIDER: No, Your Honor.
17 MS. FASCETT: No, Your Honor.
18 THE COURT: All right. And, LabMD, this is your
19 hearing. You may begin.
20 MR. RAIDER: Thank you, Your Honor.
21 We would like to start by presenting some live
22 testimony from Mr. Daugherty.
23 THE COURT: That would be fine.
24 MR. RAIDER: We also have Mr. Baker here.
25 Is it okay that he sits in the back or do you want
United States District Court
Northern District of Georgia
3
In re LabMD, Briefng Book Page 115
1 him out in the witness room?
2 THE COURT: Do you want him sequestered?
3 MS. FASCETT: I don't think that's necessary,
4 Your Honor.
5 THE COURT: I agree.
6 Okay. Let's begin, then.
7 (The oath is given by the Courtroom Deputy Clerk.)
8 MR. RAIDER: Your Honor, just as Mr. Daugherty is
9 getting some water, we have presented a notebook with all of
10 the exhibits that plaintiff has on its exhibit list, and we
11 will be using some of those in his examination.
12 So the witness has a copy, government counsel has a
13 copy, and I think a copy has been made available to you.
14 THE COURT: I have got it.
15 And let's make sure all the appearances are noted
16 on the record.
17 I guess we have Mr. Rubinstein, Mr. Singleton,
18 Mr. Meyer, Mr. Raider for LabMD; is that correct?
19 MR. RAIDER: Yes.
20 THE COURT: And for the FTC, Ms. Fascett, Mr. Gorji
21 is it?
22 MR. GORJI: Correct, Your Honor.
23 THE COURT: And Mr. Marcus, who I don't think has
24 made an appearance in the case.
25 MR. MARCUS: That's correct. For the FTC, I am
United States District Court
Northern District of Georgia
4
In re LabMD, Briefng Book Page 116
1 just serving as of counsel here. I would be happy to enter
2 an appearance if you would like.
3 THE COURT: Well, I mean, if you are just sitting
4 there because you are an observer and not in the case, that's
5 fine. But if you are in the case, you need to make an
6 appearance.
7 MR. MARCUS: I will do that, Your Honor.
8 THE COURT: And please do that today.
9 All right. Let's begin.
10 MR. RAIDER: And, Your Honor, just to introduce
11 myself as counsel for LabMD, I am Mr. Raider.
12 THE COURT: All right.
13 -- -- --
14 MICHAEL JOHN DAUGHERTY
15 being first duly sworn by the Courtroom Deputy Clerk,
16 testifies and says as follows:
17 -- -- --
18 DIRECT EXAMINATION
19 BY MR. RAIDER:
20 Q. Would you please state your name for the record?
21 A. Michael John Daugherty.
22 Q. What is your role at plaintiff LabMD?
23 A. I'm the founder and CEO of LabMD.
24 Q. How long have you been CEO of LabMD?
25 A. Since 1996.
United States District Court
Northern District of Georgia
5
In re LabMD, Briefng Book Page 117
1 Q. What services has LabMD offered?
2 A. We are a medical laboratory doing cancer detection,
3 tumor markers, bacterial detection in the urology
4 marketspace.
5 Q. What services are you currently offering?
6 A. Currently we are billing services for prior specimens
7 that were tested and access to medical records for the
8 physicians and -- physicians that need to still have access.
9 Q. And when did you stop offering cancer detection testing
10 services?
11 A. Our last specimen I believe was taken around the 9th of
12 January of 2014 and our last result was released around
13 January 15th, 2014.
14 Q. And what caused LabMD to stop offering cancer detection
15 services?
16 A. The overriding cloud and draining ongoing investigation
17 by the Federal Trade Commission.
18 Q. Could you turn to Tab 14 in your notebook?
19 A. Okay, I am in front of 14.
20 Q. And what is Exhibit 14?
21 A. 14 is the letter that I sent out to physicians,
22 administrators, nurses and support staff of our client base
23 on the 6th of January, 2014, letting them know we would no
24 longer be accepting specimens so that they could make
25 arrangements for other -- for their patients for future
United States District Court
Northern District of Georgia
6
In re LabMD, Briefng Book Page 118
1 medical testing.
2 Q. And if you would look at the third paragraph, could you
3 please explain the reasons you provided to your clients for
4 your business reason?
5 A. I said that FTC has subjected LabMD to years of
6 debilitating investigation and litigation regarding an
7 alleged patient information data security vulnerability
8 without standards, information or congressional approval and
9 without a consumer victim from the alleged breach, which is
10 in quotations.
11 The FTC has taken upon itself to spend your tax dollars
12 to ruin LabMD and regulate medical data security over and
13 above HIPAA.
14 THE COURT: And do you intend to introduce this?
15 MR. RAIDER: Yes.
16 THE COURT: Well, before you publish it, don't you
17 think you should do that?
18 MR. RAIDER: We were going to offer to tender the
19 exhibits at the end unless there was an objection made to the
20 exhibit.
21 THE COURT: Well, have you worked that out with the
22 FTC?
23 MR. RAIDER: We have not.
24 THE COURT: All right. Well, you probably
25 shouldn't publish anything until it's been introduced in
United States District Court
Northern District of Georgia
7
In re LabMD, Briefng Book Page 119
1 evidence, and basically that's what Mr. Daugherty has
2 done. So you can either see if there is an objection, and if
3 there is --
4 MS. FASCETT: There is no objection, Your Honor.
5 THE COURT: Then it's admitted. But you need to do
6 that for each of the exhibits.
7 MR. RAIDER: Okay. Thank you, Your Honor. We
8 will.
9 BY MR. RAIDER:
10 Q. Where are LabMD's records today?
11 A. LabMD's records are in the cooperate condominium and the
12 basement of my residence.
13 Q. What outside sources have access to your servers in the
14 condo?
15 A. There is a support volunteer that's helping who has had
16 years of experience in medical urology office space. He's
17 helping with the billing and winding down and answering
18 questions. And then myself.
19 Q. Is there remote access to the servers?
20 A. There is no remote access except to the billing
21 software. There is no remote access to any of the vast
22 majority of electronic records in the laboratory information
23 system.
24 Q. The FTC has issued a proposed order addressing LabMD's
25 future conduct. What are the obligations the FTC has
United States District Court
Northern District of Georgia
8
In re LabMD, Briefng Book Page 120
1 proposed to be imposed against LabMD?
2 A. They wanted a consent decree that wanted twenty years of
3 biannual audits from an outside source at our expense. It
4 would also open us up to additional penalties and/or fines.
5 MR. GORJI: Your Honor, I'm going to object. It's
6 not something that -- negotiations are not something that
7 would be held against the FTC at this point. There is an
8 administrative complaint that's been filed, but a consent
9 decree is a negotiation.
10 THE COURT: Well, have you offered -- have you
11 shown them a consent decree with a proposal that that would
12 resolve the matter?
13 MR. GORJI: There have been negotiations,
14 Your Honor, in the past.
15 THE COURT: Well, is it -- would the FTC ever agree
16 not to resolve this case without an ongoing consent decree
17 subjecting them to monitoring over a long period of time,
18 which is my experience with the FTC?
19 MR. GORJI: Your Honor, my understanding is that
20 negotiations are no longer occurring. There is an
21 administrative complaint and an ongoing administrative
22 process that doesn't necessarily request the exact same
23 relief.
24 THE COURT: Well, you can cross-examine him on
25 that, and once the cross-examination is done, I will
United States District Court
Northern District of Georgia
9
In re LabMD, Briefng Book Page 121
1 determine whether or not that's something that would go into
2 my consideration.
3 MR. GORJI: Sure, Your Honor.
4 Your Honor, if I may? I plan on handling the
5 cross-examination, Ms. Fascett plans on handling the argument
6 today, if that's all right with the Court?
7 THE COURT: That's fine.
8 MR. GORJI: Thank you.
9 BY MR. RAIDER:
10 Q. Is it your understanding that the fact that LabMD is
11 merely archiving its records today would change the relief
12 the FTC is seeking against LabMD?
13 A. No, it's not. That's not my understanding.
14 Q. Let's go back a step and discuss LabMD when it was
15 providing cancer detection services in 2013 and the years
16 before.
17 How much revenue did LabMD generate each year roughly?
18 A. It ranged between three and a half to seven and a half
19 to eight million approximately.
20 Q. And how much revenue has LabMD generated in calendar
21 year 2014?
22 A. Approximately fifty thousand dollars.
23 Q. And how much revenue has LabMD projected to generate in
24 the second half of 2014?
25 A. Probably another fifty to seventy-five thousand
United States District Court
Northern District of Georgia
10
In re LabMD, Briefng Book Page 122
1 dollars.
2 Q. And how much profit did LabMD generate in the years it
3 was generating millions of dollars in revenue?
4 A. With the exception of 2013, our profit margin was
5 approximately 25 percent. In 2013 we lost approximately half
6 a million dollars.
7 Q. How much profit has LabMD generated so far in calendar
8 year 2014?
9 A. None.
10 Q. And looking to the second half of calendar year 2014,
11 how much profit is LabMD expected to generate?
12 A. Zero.
13 Q. How many employees did LabMD have on its payroll in
14 2013?
15 A. Between 25 and 30.
16 Q. And how many employees does LabMD have today?
17 A. One.
18 Q. I want to shift topics again and talk a little bit about
19 LabMD's insurance program.
20 A. Okay.
21 Q. What types of insurance did LabMD have when it was
22 offering cancer detection services?
23 A. We had medical malpractice for the company, we had
24 malpractice for the physicians, we had directors and officers
25 insurance, we had general liability insurance, we had medical
United States District Court
Northern District of Georgia
11
In re LabMD, Briefng Book Page 123
1 insurance, dental insurance, workmen's comp and vision.
2 I think that's everything.
3 Q. Which of these policies does LabMD currently have?
4 A. We have a COBRA for medical and dental, and that is
5 all.
6 Q. In the years 2013 and before, what issues did LabMD
7 encounter in obtaining insurance?
8 A. We never had problems getting insurance prior to 2013.
9 Q. Were you told why your insurance -- why LabMD's
10 insurance policies would not be renewed?
11 A. Yes. Because of the -- the claims that weren't renewed,
12 is was because of the FTC investigation, the ongoing cloud,
13 and the fact that it involved medical records. So that even
14 the policy that wasn't even covering a claim of that type was
15 refused for that reason, meaning the medical malpractice
16 insurance.
17 Q. And let me refer you to Exhibit 15 in your notebook.
18 A. Yes.
19 Q. And let me ask you some --
20 MR. RAIDER: Your Honor, I would like to show this
21 to the witness and establish a foundation.
22 BY MR. RAIDER:
23 Q. What is this document?
24 A. This is an e-mail string from our broker that was sent
25 to me between I believe our broker and one of his staff
United States District Court
Northern District of Georgia
12
In re LabMD, Briefng Book Page 124
1 members and an underwriter for OneBeacon Pro.
2 Q. And how did you receive a copy of this?
3 A. Because the broker sent it to me to show me that the
4 company wasn't going to be interested in insuring --
5 MR. GORJI: Objection, Your Honor. Hearsay.
6 THE COURT: Is there any objection to this e-mail?
7 MR. GORJI: Your Honor, I can get into it on cross.
8 THE COURT: Pardon me?
9 MR. GORJI: I can get into it on cross.
10 THE COURT: So is there any objection to the
11 introduction of the e-mail?
12 MR. GORJI: No, Your Honor.
13 THE COURT: It's admitted.
14 BY MR. RAIDER:
15 Q. Who is Mr. Coscarelli?
16 A. Mr. Coscarelli is an underwriter at OneBeacon Pro who
17 communicated with my broker.
18 Q. Who is Mr. Seilkop?
19 A. Fred Seilkop is the owner of -- I believe of Healthcare
20 Professional Services and my broker.
21 Q. And who is Ms. Garrido?
22 A. Betsy Garrido is an assistant that works for Mr. Seilkop
23 at Healthcare Professional Services.
24 Q. What insurance policies are being discussed in this
25 e-mail thread?
United States District Court
Northern District of Georgia
13
In re LabMD, Briefng Book Page 125
1 A. This is the facility, what we call tail coverage or ERP,
2 which is extended reporting period coverage. After a
3 practitioner, a medical facility, ceases practicing their
4 operations in that manner, then you have to get coverage to
5 extend any claims that come for that reporting period where
6 they were working there.
7 Q. What reason is Mr. Coscarelli offering for declining to
8 offer insurance to LabMD?
9 A. He says, The potential volatility due to the FTC
10 investigation is something we want to stay away from,
11 particularly because it pertains to medical records.
12 Q. Has LabMD been able to obtain an offer for an extended
13 reporting period after January 2014?
14 A. I split the search. We had almost everyone say no.
15 I did have -- I found a company in Florida who offered
16 tail coverage to the physicians, so I split them off and got
17 their own tail coverage, and we don't have any medical
18 coverage, medical malpractice coverage.
19 Q. You mentioned having comprehensive general liability
20 insurance. What is the status of your efforts to renew that
21 policy?
22 A. They nonrenewed effective May 5th of this year -- that
23 was Hartford -- because of the Federal Trade Commission
24 claims history.
25 Q. And what impact does that have on LabMD's ability to
United States District Court
Northern District of Georgia
14
In re LabMD, Briefng Book Page 126
1 offer cancer detection services?
2 A. Well, to offer cancer detection services, you obviously
3 have to have a facility where you can offer that, and we are
4 required to have general liability insurance in our facility
5 and under our lease or anywhere else where we want to open up
6 space.
7 So without being able to get general liability
8 insurance, we can't function.
9 Q. I want to switch topics again and talk a little bit
10 about the regulatory oversight of LabMD as an ongoing
11 provider of cancer detection services.
12 Separate from the FTC, was LabMD subject to government
13 regulation?
14 A. Yes.
15 Q. By whom?
16 A. By the federal -- the U.S. government and the State of
17 Georgia under CLIA and DHR has a -- there is a laboratory
18 oversight group within the Department of Human Resources in
19 the State of Georgia.
20 Q. And in years 2013 and before, how many times has HHS
21 raised concerns about LabMD's compliance with HHS
22 regulations?
23 A. We never had a problem.
24 Q. And what about as to the State of Georgia?
25 A. No, no problems.
United States District Court
Northern District of Georgia
15
In re LabMD, Briefng Book Page 127
1 Q. If you could turn to Exhibit 23 in your notebook?
2 A. Okay.
3 Q. What is this document, just at a high level so we can
4 get it introduced into evidence?
5 A. It is a -- we are required to submit specimens to an
6 independent source that reports to the government our testing
7 and accuracy, and so that's what that is.
8 Q. Is this a business record of LabMD?
9 A. Yes, it is.
10 MR. RAIDER: We tender this into evidence,
11 Your Honor.
12 THE COURT: Any objection?
13 MR. GORJI: No objection, Your Honor.
14 THE COURT: It's admitted.
15 BY MR. RAIDER:
16 Q. What does it mean to have a rating of 100 percent
17 compliance?
18 A. That means that all the tests came within 100 percent of
19 the acceptable range of the independent agency on the
20 testing -- on the results we reported. So it's an accuracy
21 of test reporting reports.
22 Q. The certificate indicates a November 2013 expiration
23 date. What was the status as of January 2014?
24 A. I'm sorry, can you point the certificate out? I'm not
25 seeing it.
United States District Court
Northern District of Georgia
16
In re LabMD, Briefng Book Page 128
1 Are you on 23?
2 Q. Yes. I'm looking at the --
3 A. I'm on a different 23.
4 Q. -- expiration date on the right?
5 A. My 23 is not the same as your 23.
6 THE WITNESS: Can he show me --
7 THE COURT: This is not my hearing. This is your
8 lawyer's.
9 THE WITNESS: Okay. That's my 23.
10 THE COURT: Why don't we do this. Since you have
11 three other lawyers here with you, maybe they could find this
12 for you and we can move on.
13 MR. RAIDER: Okay, we will.
14 MR. GORJI: Your Honor, I would also like to make
15 sure the government has the correct 23 as well.
16 MR. RAIDER: Yes. I apologize for that.
17 THE COURT: My understanding is that Exhibit 23 is
18 a one-page document that is sent by the American Proficiency
19 Institute and it's dated March 5th of 2014.
20 MR. RAIDER: Yes.
21 THE COURT: Is that Exhibit 23?
22 THE WITNESS: No.
23 MR. RAIDER: That's what we are asking to have
24 admitted.
25 THE COURT: Well, that one-page document has been
United States District Court
Northern District of Georgia
17
In re LabMD, Briefng Book Page 129
1 admitted.
2 MR. RAIDER: Yes. And I will move on.
3 BY MR. RAIDER:
4 Q. You said that HHS has not raised any concerns about
5 LabMD's compliance with HHS regulations. What issues
6 specifically, if any, has HHS raised concerning LabMD's data
7 security program?
8 A. None.
9 Q. Has HHS launched an enforcement action against LabMD
10 because of concerns over its data security program?
11 A. No.
12 Q. Have they, to your knowledge, instituted an
13 investigation?
14 A. No.
15 Q. Have they issued notices of violation or documents to
16 that effect?
17 A. No, sir.
18 Q. Okay. I want to switch topics one more time and talk
19 about your website and your blog.
20 Have you created a blog?
21 A. Yes.
22 Q. And what is the website that hosts that blog?
23 A. MichaelJDaugherty.com.
24 Q. And on your blog, have you posted opinions about the
25 FTC?
United States District Court
Northern District of Georgia
18
In re LabMD, Briefng Book Page 130
1 A. Yes, I have.
2 Q. And could you describe what you have said about the
3 FTC?
4 A. I have -- I'm very opinionated about the overreach and
5 lack of standards for rules or clarification and yet still
6 the exhaustive investigation. So I have posted what
7 I consider to be my opinion and First Amendment right
8 speech about how they have conducted themselves throughout
9 this.
10 Because we have never known what we have done wrong, and
11 that's been a huge frustration, and it's so damaged the
12 organization that I have spoken about that in several blogs.
13 Q. In your dealings with FTC employees as part of this
14 LabMD enforcement action, what did you perceive to be the
15 reaction to your blog posts criticizing the FTC?
16 A. My perception is that they are very upset and unhappy
17 about it. They don't like any public criticism.
18 Q. Is it your opinion that the FTC has retaliated against
19 LabMD because of your blog criticizing the FTC?
20 MR. GORJI: Objection.
21 THE COURT: Overruled.
22 A. Yes, it's my opinion that they retaliated.
23 Q. Has the FTC monitored your website with the blogs?
24 A. Yes, they have.
25 Q. Okay. I want to discuss Google Analytics. What is
United States District Court
Northern District of Georgia
19
In re LabMD, Briefng Book Page 131
1 Google Analytics?
2 A. Google Analytics is a tool provided by Google to analyze
3 the traffic and effectiveness of --
4 MR. GORJI: Objection, Your Honor, to the basis for
5 his knowledge. There is no foundation here. He does not
6 work for Google.
7 The attachments that he's provided to his
8 declarations he has no basis for authenticating. We are
9 objecting on those grounds, Your Honor.
10 THE COURT: Are you denying that the FTC has
11 monitored his blog?
12 MR. GORJI: No, I'm not denying that. But,
13 Your Honor, the specificity of representations made in the
14 declaration have no foundation.
15 THE COURT: All right. Well, maybe we could bring
16 somebody in from Google and extend this hearing, if you would
17 like.
18 It seems odd that if you are an enforcement
19 regulatory body, that rather than doing your regulatory
20 activity, that you would be monitoring somebody's blog that
21 is criticizing the FTC, unless you are thin-skinned about
22 that.
23 MR. GORJI: Your Honor --
24 THE COURT: You have just acknowledged that the FTC
25 is monitoring his blog. Are you doing that in connection
United States District Court
Northern District of Georgia
20
In re LabMD, Briefng Book Page 132
1 with your regulatory investigation or are you doing that for
2 your interest in his company and what they are saying about
3 it, about the FTC?
4 MR. GORJI: Your Honor, the government and agencies
5 monitor individuals' websites on a routine basis. In
6 addition, here, Your Honor --
7 THE COURT: Why?
8 MR. GORJI: To determine whether or not there is
9 any information that they might be able to add to their
10 case.
11 THE COURT: So are you doing that in connection
12 with your regulatory activities and responsibilities in
13 connection with this investigation of LabMD?
14 MR. GORJI: Your Honor, I would have to confer with
15 the FTC officials on the exact reason. I haven't been
16 provided an exact reason.
17 And, again, the suggestion that it's for
18 retaliatory purposes is purely speculative. There hasn't
19 been any --
20 THE COURT: Well, under the Federal Rules of
21 Evidence, somebody who has an experience that would provide a
22 foundation for an opinion is admissible as a lay opinion.
23 He has now gone through this investigation
24 beginning with the FTC's investigative activity beginning in
25 2010, which is now four years ago, and it would seem to me
United States District Court
Northern District of Georgia
21
In re LabMD, Briefng Book Page 133
1 that if he is able to establish when he began these public
2 criticisms of the FTC and compare that with the investigative
3 activity of the FTC and its various responses to actions that
4 he's taken, that he could reach an opinion about whether or
5 not he believed it to be or that it was his opinion that they
6 were acting in a retaliatory manner, and, therefore, I'm
7 going to overrule the objection.
8 MR. RAIDER: Your Honor, as to the specific
9 reports, I just want to make clear that those also, I mean,
10 if we establish a foundation, they would be admissible at
11 this point. Is that part of your --
12 THE COURT: Probably not through him.
13 MR. RAIDER: Well, we would argue under Federal
14 Rule 807 that there is sufficient reliability, that this is a
15 service Google makes available to website owners to pull down
16 information about traffic on their website.
17 THE COURT: Yeah, but the question would be the
18 reliability of the information being provided by Google, and
19 I don't think he has a basis to express that opinion.
20 MR. RAIDER: Understood, Your Honor.
21 BY MR. RAIDER:
22 Q. Just to go back and make sure, what is Google
23 Analytics?
24 A. Google Analytics is a service or/and a tool that Google
25 provides to website users, owners, to analyze and pull
United States District Court
Northern District of Georgia
22
In re LabMD, Briefng Book Page 134
1 reports down from Google's data of who is looking at the
2 website, how long they stay, how deep they go, who they are,
3 and so you can -- as a website owner, you can assess the
4 effectiveness of reaching the audience you want to reach and
5 you can see what audience you are pulling in.
6 Q. Have you generated website visit reports for your web --
7 for your blog post website?
8 A. I have, yes.
9 Q. What type of reports did you generate?
10 A. I generated the reports that would show who the top
11 users were and what dates they were on and what ranges, and
12 coincided those to some blog posts.
13 Q. What type of blog posts were you focusing on?
14 A. Well, as an example, there was a blog post when I first
15 really announced that the FTC was suing me, which came out
16 approximately September 17th, 2012.
17 And while I noted the Federal Trade Commission up until
18 September 1, 2012, had never looked at my site one time, on
19 that day or approximately that day or the day after the
20 Federal Trade Commission had looked at that blog 75 times.
21 MR. GORJI: Objection, Your Honor. Again, there is
22 no reliability for this testimony.
23 THE COURT: Is that true, that after this blog
24 post, that there were 75 hits by the FTC in response to his
25 criticism?
United States District Court
Northern District of Georgia
23
In re LabMD, Briefng Book Page 135
1 MR. GORJI: I don't know the answer to that,
2 Your Honor. I haven't --
3 THE COURT: Will you find that out for me? Will
4 you?
5 MR. GORJI: Your Honor --
6 THE COURT: Will you find that out for me?
7 MR. GORJI: I could contact Google and have FTC
8 experts --
9 THE COURT: Why don't you contact your agency and
10 find out if anybody in response to a critical blog post 75
11 times the next day accessed the blog?
12 MR. GORJI: Well, Your Honor --
13 THE COURT: And explain to me what was on the blog
14 post that was of interest to your investigation of this
15 company.
16 MR. GORJI: Your Honor, one --
17 THE COURT: Will you do that?
18 MR. GORJI: I can have FTC provide an explanation
19 for that.
20 Your Honor, one aspect of this case is that there
21 is retaliation, and in order to demonstrate retaliation,
22 there has to be that his freedom of speech has been adversely
23 affected. So it would make sense, Your Honor, for the
24 government to continue to monitor whether or not he's still
25 continuing to express his speech.
United States District Court
Northern District of Georgia
24
In re LabMD, Briefng Book Page 136
1 And I believe he is still effectively expressing
2 his speech, and, therefore, there is a legitimate reason.
3 THE COURT: Are you telling me as an officer of the
4 court that after a critical blog post, that somebody at the
5 FTC, in order to make sure that he was -- that he was not
6 impeded in his First Amendment rights, decided the next day
7 to 75 times make sure that the same post was up there and,
8 therefore, it could come in and make an argument like you
9 have just made, that the purpose of that access was to make
10 sure that he was unimpeded in the exercise of his First
11 Amendment rights?
12 MR. GORJI: Your Honor --
13 THE COURT: Is that what you are saying?
14 MR. GORJI: Your Honor, that is not the sole
15 explanation.
16 THE COURT: Is that what -- is that one of your
17 explanations?
18 MR. GORJI: I believe that is a legitimate reason
19 for --
20 THE COURT: And is that why the -- is that why you
21 are representing to me that the FTC accessed his blog, was to
22 make sure that his First Amendment rights were not being
23 impeded?
24 MR. GORJI: No, I'm not making that representation,
25 Your Honor, that that is the sole reason.
United States District Court
Northern District of Georgia
25
In re LabMD, Briefng Book Page 137
1 THE COURT: So you are backing from what you just
2 told me?
3 MR. GORJI: No, no, Your Honor. I believe that one
4 legitimate basis for --
5 THE COURT: Was that a legitimate basis on behalf
6 of your client, the FTC, the reason why they accessed the
7 blog post 75 times the day after the post was made?
8 MR. GORJI: Your Honor, I would have to get FTC to
9 provide an explanation as to why they accessed it. I can --
10 THE COURT: You just told me twice that's one of
11 the reasons they accessed it. Is that one of the reasons why
12 they accessed it?
13 MR. GORJI: Well, Your Honor, I know that's one of
14 the reasons why I accessed it, for example, during the course
15 of this litigation.
16 THE COURT: Did you access it on September 17th or
17 September 18th?
18 MR. GORJI: No, Your Honor.
19 THE COURT: How many times have you accessed it?
20 MR. GORJI: Maybe a handful, Your Honor. But --
21 and that was my motivation.
22 But I can also surmise, Your Honor, that a
23 government agency might think that there is possibility of
24 statements related to the conduct -- to the conduct that FTC
25 is trying to regulate on his postings and looking for that
United States District Court
Northern District of Georgia
26
In re LabMD, Briefng Book Page 138
1 reason.
2 Now, whether or not that is the actual motivation
3 here, Your Honor, I can't attest to that. I can ask FTC to
4 provide you with their explanation.
5 THE COURT: This is taking an interesting and
6 troubling turn which I never expected, for an admission by an
7 FTC lawyer that they monitor blogs routinely of companies for
8 whatever purposes, and you don't even know the purposes
9 except for this purpose, that the only purpose that you have
10 expressed, which I find incredible, is that you stated on
11 behalf of your agency that the day after this blog posting
12 was made, that the 75 times -- assuming that's true, but even
13 if it was seven times, that they monitored it to make sure
14 that his First Amendment rights were not being impeded, is
15 incredible.
16 MR. GORJI: Your Honor, that's not my sole
17 explanation. My other explanation --
18 THE COURT: But it's one of your explanations,
19 isn't it?
20 MR. GORJI: Your Honor --
21 THE COURT: Isn't it?
22 MR. GORJI: Your Honor, I think perhaps that is
23 probably an explanation as to why I personally did it. With
24 respect to the FTC, I don't know whether or not that
25 motivated --
United States District Court
Northern District of Georgia
27
In re LabMD, Briefng Book Page 139
1 THE COURT: Was my question unclear about the
2 accessing of the website the day after the posting? Did you
3 not understand that?
4 MR. GORJI: Your Honor, your question was
5 not unclear. I perhaps was confused, but not because of the
6 lack of clarity of your question. I apologize to the
7 Court.
8 Again, I can have the FTC provide an explanation as
9 to why they are monitoring, and my explanation is again what
10 I surmise, but it may not be sufficient here. And,
11 Your Honor, if Your Honor would like, we could have FTC
12 provide an explanation to the Court.
13 THE COURT: Well, let's have this rule between you
14 and me at least. This is a hearing. I am a judicial
15 officer, and you are an officer of the court. When I ask you
16 a question, don't duck and cover the question. Answer the
17 question so that I know that what you are telling me is
18 accurate and I can rely upon it. Is that fair?
19 MR. GORJI: That's fair, Your Honor. I didn't
20 intend to give the impression that I knew what the reason
21 was. I was providing an explanation as to why I think it
22 might be reasonable.
23 THE COURT: Well, that's not what you said, and the
24 record will be clear that in answer to my two questions, that
25 is not what you said.
United States District Court
Northern District of Georgia
28
In re LabMD, Briefng Book Page 140
1 MR. GORJI: I apologize.
2 THE COURT: Instead you were coming up with a
3 defense for the conduct. And that's a problem that lawyers
4 have when they are unarmed with the facts.
5 MR. GORJI: I agree, Your Honor, I do not have the
6 facts with respect to what their specific reasoning was.
7 THE COURT: Then the next time you answer a
8 question, tell me that.
9 MR. GORJI: I apologize that I gave a misimpression
10 to the Court, Your Honor.
11 THE COURT: Well, that's not a misimpression. You
12 apologized for making an inaccurate statement in response to
13 a question from the bench.
14 MR. GORJI: I apologize, Your Honor.
15 THE COURT: Thank you.
16 BY MR. RAIDER:
17 Q. Mr. Daugherty, if you could turn to Tab 31. Hopefully
18 these numbers are correct.
19 A. I'm at 31, sir.
20 Q. Are those the Google Analytic reports that you
21 generated?
22 A. Let me just review them, please.
23 Yes, sir. I believe those are all of them, yes, sir.
24 Q. And did you generate those reports?
25 A. Yes, I did.
United States District Court
Northern District of Georgia
29
In re LabMD, Briefng Book Page 141
1 Q. And how did you go about generating those reports?
2 A. I just signed onto my account or my password and ID
3 that's hooked up to the website and started using the tool.
4 Q. I want to turn to the report. And I have the single
5 pages in my notebook, unfortunately. I'm not sure how far
6 into the exhibit it is. January 1 --
7 MR. RAIDER: Well, Your Honor, we tendered these
8 reports for Mr. Daugherty to explain the information on them
9 that he received.
10 THE COURT: So what does that mean, tendered to
11 what?
12 MR. RAIDER: We would like to admit these reports
13 into evidence.
14 THE COURT: Any objection?
15 MR. GORJI: Again, Your Honor, the government
16 objects based on reliability.
17 THE COURT: Sustained.
18 BY MR. RAIDER:
19 Q. Was there information posted to your blog website that
20 would shed light on the adequacy of LabMD's data security
21 practices?
22 A. No, sir.
23 Q. Were you surprised by the number of times the FTC
24 visited your website?
25 A. Very.
United States District Court
Northern District of Georgia
30
In re LabMD, Briefng Book Page 142
1 Q. Was there any reason that you are aware of why the FTC
2 employees would have to view your blog website so many
3 times?
4 A. As involved the investigation, no.
5 Q. I want to switch topics one last time. What is LabMD
6 asking from the Court?
7 A. We are asking the Court to stop or pause the
8 investigation so that we can try to recover from the cloud
9 and loss of business revenue and loss of employees and loss
10 of insurance and loss of reputation and revenue and we can
11 try to start to recover.
12 Since they don't have standards and rules and won't tell
13 us what we have done, they just point to consent decrees that
14 say no wrongdoings in them and we have -- we just have --
15 it's been ongoing for years of not knowing what we are
16 supposed to do or what we did wrong, and we have just been
17 torpedoed.
18 Q. If the Court were to stop the FTC's enforcement
19 proceedings against LabMD, would you restart the business to
20 begin offering cancer detection testing services?
21 A. It would -- I would start the attempt to. We can't get
22 insurance with this over our head. That's the first thing.
23 And we have to -- and we are also being sued by the
24 landlord. So we have a long stretch to get back.
25 And our key employees have left to other labs. Our
United States District Court
Northern District of Georgia
31
In re LabMD, Briefng Book Page 143
1 clients have left to other labs. Our landlord is suing us
2 because we had to leave the lease earlier -- early.
3 We have -- the insurance is not there.
4 And all that healing has to happen. So that will be
5 able to start that, and also prevent us from going deeper in
6 the hole by having no longer -- no longer having access for
7 the physicians for the records they need now, which are
8 required by us to keep, depending on the record, from five to
9 ten years.
10 MR. RAIDER: Thank you, Mr. Daugherty. I have no
11 further questions.
12 THE COURT: All right. Cross?
13 MR. GORJI: Yes, Your Honor.
14 -- -- --
15 CROSS-EXAMINATION
16 BY MR. GORJI:
17 Q. Good morning, Mr. Daugherty. How are you?
18 A. Good morning.
19 Q. I have got a question about the investigation and your
20 speech. You agree that the investigation was already
21 underway before you started critizing the FTC's conduct
22 here?
23 A. Well, in January of 2010 they started a nonpublic
24 inquiry. If you consider that an investigation, yes.
25 Q. And you began your criticism in early 2012; is that
United States District Court
Northern District of Georgia
32
In re LabMD, Briefng Book Page 144
1 correct?
2 A. My public criticism?
3 Q. Yes, your public criticism.
4 A. That was my blog. Yeah, I think the public criticism
5 started with the Atlanta Business Chronicle interviewing me,
6 and I believe that came out in September approximately 7th of
7 2012.
8 And that was because I had to do it because the Federal
9 Trade Commission had filed suit for me to -- let me think.
10 Let me just think here.
11 I mean, in August of '12, I believe that's when they
12 sued for the CID, and that's when people started noticing and
13 contacting me. Up until that point no one had known and
14 I hadn't told anyone. But I was really forced to respond at
15 that point.
16 Q. And your understanding is that the company Triversa
17 found information about your patients, your customers? That
18 was in 2008, is that correct, that you learned of Triversa
19 finding that information?
20 A. Tiversa was contacted -- contacted me or my company
21 LabMD in May of 2008.
22 Q. And the CID, the subpoena for information and documents
23 from FTC to your company, that was in December 2011; is that
24 right?
25 A. I'm sorry, yeah. You know, that's why my memory -- I
United States District Court
Northern District of Georgia
33
In re LabMD, Briefng Book Page 145
1 believe they filed the CID in December of 2011, and then the
2 Department of Justice filed in August of 2012 to have the
3 Court decide whether I had to sit for a CID.
4 Q. So your public criticisms began well after the CID was
5 served on the company; is that right?
6 A. Well, it didn't -- the CID service from 2012 -- 2011, I,
7 believe that was. Okay, I'm getting my years mixed up. Yes,
8 yes.
9 So '11 they served right at Christmas, and no one picked
10 it up publicly. And then when the DOJ I believe filed to
11 have the Court decide whether I was required to, that's when
12 the public started to come to me. That was the first
13 time. So that's --
14 Q. So just so we are clear, and without focusing on dates,
15 the CID came first, and then you started publicly
16 criticizing?
17 A. Yeah, the CID -- I mean, yeah, the CID came in December
18 23rd, 2011, and the criticism was in September 2012.
19 Q. During the course of that time frame, between the CID
20 coming and your public criticism, were there any depositions
21 that took place with respect to employees of your company?
22 Were there any other investigative things that occurred that
23 impacted your company before you started publicly
24 criticizing?
25 A. Well, yeah. The Federal Trade Commission was repeatedly
United States District Court
Northern District of Georgia
34
In re LabMD, Briefng Book Page 146
1 demanding more and more and more and more information,
2 totally side-swiping my management team. Because we were in
3 a house of mirrors, never-never land, not knowing what they
4 wanted, and they wouldn't tell us what we did wrong, and it
5 was relentless.
6 So it was -- and you are talking a company of like
7 thirty people that diagnose cancer with one VP of
8 operations.
9 Q. So the FTC was actively investigating before you started
10 your public criticism?
11 A. Yes.
12 Q. I want to draw your attention to the FTC administrative
13 complaint. Have you had a chance to look at that document?
14 A. Can you refresh my memory or bring it to me, please?
15 MR. GORJI: One moment, Your Honor.
16 THE WITNESS: I assume I can close this?
17 MR. GORJI: You should have it --
18 THE WITNESS: Oh, it's in the book?
19 MR. GORJI: You should have it as your Exhibit 8.
20 THE WITNESS: Okay.
21 BY MR. GORJI:
22 Q. Okay. Are you familiar with this document?
23 A. Yes, sir, I am.
24 Q. Okay. To date, has the FTC ordered you to do anything
25 that would change your business conduct with respect to
United States District Court
Northern District of Georgia
35
In re LabMD, Briefng Book Page 147
1 managing patient-protected information?
2 A. No.
3 Q. Now, in your verified complaint in your declaration, you
4 say that the cause of your company having to essentially wind
5 down its business is a result of the FTC investigation?
6 A. That's correct.
7 Q. But it's not a result of anything that FTC has actually
8 ordered you to do with respect to how to manage your
9 patients', customers' protected information, is it?
10 A. We would have liked to have known that long ago. No, we
11 haven't gotten that answer.
12 Q. Would you say that that is the primary reason why?
13 A. Yes.
14 Q. Have you ever given a contrary reason as to why your
15 company had to wind down?
16 A. Contrary?
17 Q. Yes.
18 A. I have given additional. I wouldn't say contrary.
19 Q. What reason would you say?
20 A. I said that the Federal Trade Commission set the stage
21 for our having to wind down operations because as a small
22 company this was an overarching fishing expedition that never
23 gave us standards, rules, reasons, and that just unspeakably
24 slowed down a cancer detection center.
25 Because we only have so much energy, and so we had to
United States District Court
Northern District of Georgia
36
In re LabMD, Briefng Book Page 148
1 focus on this, and the only answers we were getting back was
2 look at this consent decree, which was vague at best with
3 fine print about no wrongdoing is admitted.
4 So we were in a never-never land. So we had to shoot --
5 we don't know where we had to shoot, so we felt the only way
6 to get in a safe place would be to shoot for perfection.
7 So I had, you know, the management staff, especially the
8 IT and my VP of operations, just spending so much time on
9 that, and that energy was taken away from prepping for what
10 we knew what was coming, which was Obamacare.
11 And so when we had plans to go into molecular science or
12 into breast pathology, we couldn't get off the ground because
13 we were getting diverted over here.
14 Because as a cancer detection center in a niche market,
15 you specialize in just one area, and the expertise is just --
16 or the differentiation in the market is our expertise by our
17 pathologists because they just read that kind of cancer, and
18 that is something that physicians around the country want and
19 patients benefit from, because practice makes perfect.
20 With Obamacare it was coming that that priority was
21 fading away, and we were aware of that, and we were going to
22 have to diversify our base.
23 And the Federal Trade Commission tied our feet
24 together. We only have so much energy and time, and it was
25 just overpounding for this small company.
United States District Court
Northern District of Georgia
37
In re LabMD, Briefng Book Page 149
1 So I have said several times that the Federal Trade
2 Commission set the stage during this time so that we could
3 not function and deal with what came with Obamacare.
4 And then with four weeks' notice due to sequestration,
5 which usually it's more, we found out that our 2013
6 reimbursement was cut 30-something percent for pathology, and
7 we started bleeding cash like crazy. And we were just so
8 overwhelmed. It was like too many spinning plates.
9 And so -- and then that's just -- that's just the
10 business model. Then you go into the specific knowledge that
11 the VP of operations especially had and the IT guys, and
12 really just how the fear and the unknown and the uncertainty,
13 and eventually it just wore them down, and my VP left and he
14 moved to Denver in August. And when that happened, that was
15 just it.
16 And so we started losing, losing money. And then by --
17 I didn't want to ruin everyone's Christmas, but around
18 December I knew this is just not looking good. It was just
19 reality. We just were overwhelmed with reality.
20 So the FTC is not going away, we are not going to get
21 more money, our reputation has been hashed, people that are
22 employees are just afraid and so they are just leaving.
23 And I couldn't give answers.
24 And so, you know, the ship just went down.
25 Q. Well, how would you say Obamacare itself impacted your
United States District Court
Northern District of Georgia
38
In re LabMD, Briefng Book Page 150
1 business?
2 A. Because CMS starts cutting costs for costs containment,
3 and ancillary services went first. And so, you know, for
4 cost containment those fee schedules were cut.
5 Q. And how about customers that you previously had, were
6 they going to be referred to you for services under
7 Obamacare?
8 A. Well, no, because what happened was what Obamacare does
9 is it really forces a marketplace consolidation, and so
10 physicians in the short term to survive were going to have
11 to -- the physicians that we had -- I mean, this is not all
12 physicians, period. I mean, this is just urologists and
13 office-based urologists. So that's another reason why we've
14 got to diversify.
15 But they were forced to either -- they either get huge
16 and merge together, they either sell their practice to
17 hospitals, or they retire.
18 And so we saw people having to basically survive for a
19 consolidation reason, and so the purchasing -- you know, we
20 knew that physicians were going to have to have economies of
21 scale, so we were going to have to broaden who our customers
22 could be to be able to get enough customers to survive
23 because reimbursement was going down.
24 Q. So as a result of Obamacare, you lost a considerable
25 amount of business?
United States District Court
Northern District of Georgia
39
In re LabMD, Briefng Book Page 151
1 A. No, we didn't -- well, we didn't lose business. We lost
2 the revenue for the business we performed, and we were
3 prevented because of the FTC action from building the
4 business to survive. We could only handle one tidal wave at
5 a time. We had two coming at us.
6 Q. Well, isn't it true that physicians and customers were
7 not -- under Obamacare were no longer going to be able to
8 refer to you for services?
9 A. In the urology marketspace, no.
10 MR. GORJI: One moment, Your Honor.
11 Your Honor, at this time I would like to
12 cross-examine Mr. Daugherty with material that comes from the
13 FTC administrative proceedings. It involves a deposition
14 transcript.
15 Under FTC regulations it is protected and
16 confidential, but there is a provision under the regulations
17 that allows for its disclosure provided that we give
18 notice. We did so last week, Your Honor.
19 But because it was previously confidential, I would
20 like to give counsel an opportunity to take whatever measures
21 they think necessary before I present it in open court.
22 THE COURT: And is this related to his direct
23 testimony?
24 MR. GORJI: Your Honor, it addresses specifically
25 whether or not Obamacare was the cause of loss of revenue and
United States District Court
Northern District of Georgia
40
In re LabMD, Briefng Book Page 152
1 the winding down of the company.
2 THE COURT: It is being offered as a prior
3 inconsistent statement?
4 MR. GORJI: Yes, Your Honor.
5 THE COURT: So, Mr. Raider, what do you say about
6 that?
7 MR. RAIDER: Your Honor, we would ask that a
8 protective order apply and it be sealed at least for now
9 until we see where it's going consistent with its status in
10 the administrative proceeding.
11 THE COURT: I mean, can you introduce as a prior
12 inconsistent statement a statement that you elicited in his
13 examination?
14 Because he didn't say anything about Obamacare on
15 direct examination. So you elicited the explanation on cross
16 regarding Obamacare, and now you want to impeach the
17 statement that you elicited with a prior inconsistent
18 statement? And if so, how can you do that?
19 MR. GORJI: Well, Your Honor, he testified on
20 direct that FTC's actions are the reason why his company had
21 to wind down.
22 I asked him here whether or not he believes
23 Obamacare is what caused it, and he says no, but I would like
24 to point him to his testimony where he says the opposite in a
25 deposition, sworn statement.
United States District Court
Northern District of Georgia
41
In re LabMD, Briefng Book Page 153
1 THE COURT: I know, but it's still testimony that
2 you elicited on cross, and now you want to -- can you offer a
3 prior inconsistent statement to rebut a statement that you
4 elicited?
5 MR. GORJI: Your Honor, I think I can impeach him
6 if he says something that's inaccurate. I can't bring in
7 rebuttal evidence, bring somebody else in to impeach him, but
8 I have a deposition, a sworn deposition.
9 THE COURT: Right. So what's your authority for
10 that? Since you have been laying in wait to do this, so you
11 must have a case or two for me to support the admissibility
12 of --
13 MR. GORJI: Your Honor, I do not have any case law
14 with me, and I wasn't at this moment seeking to introduce the
15 exhibit. I was simply seeking to make use of it in open
16 court to contradict the testimony here.
17 THE COURT: And do you have any authority that this
18 protected material that I assume you got through this
19 deposition under these circumstances should be allowed?
20 MR. GORJI: Your Honor, there is a provision, a
21 regulation, 16 CFR Section 410 (g), that allows for its use
22 upon notice to the party who has given the testimony in the
23 deposition.
24 THE COURT: Of course, nobody ever told me you had
25 done that. I had no idea this was coming up. I would like
United States District Court
Northern District of Georgia
42
In re LabMD, Briefng Book Page 154
1 to say I'm a pretty diligent fellow, but because nobody told
2 me about these regulations, I will admit I haven't gone to
3 look at them and I haven't memorized them.
4 So I do like to make careful rulings, and, you
5 know, maybe there is another way of doing this, that you
6 could submit after the hearing those portions that you claim
7 are prior inconsistent statements, and the lawyer for LabMD
8 can weigh in on whether or not it is or not, and then I can
9 consider it after that.
10 But it seems to me fundamentally unfair that, one,
11 you knew this was coming; two, you don't have any authority
12 for me; and that you now want to disclose because you have
13 given notice in this very public setting something which
14 I think you know is not going to be favorable to this man
15 individually and reputationally and in the lawsuit.
16 MR. GORJI: Your Honor, we did provide notice last
17 week that we were going to make use of this transcript, so it
18 wasn't trying to ambush anybody here.
19 THE COURT: Well, make use of it? Did you tell
20 them in what specific way?
21 MR. GORJI: Actually, our filing from last week
22 indicated that it would be to cross-examine him.
23 THE COURT: For whatever happens to be in that,
24 without focusing on specifically what it is that you were
25 going to use it for?
United States District Court
Northern District of Georgia
43
In re LabMD, Briefng Book Page 155
1 MR. GORJI: Well, we didn't identify the specific
2 topic.
3 THE COURT: But you knew that's the topic that you
4 were going to use, didn't you?
5 MR. GORJI: Yes, Your Honor.
6 THE COURT: Did you even have a communication with
7 opposing counsel to say, look, this is why we want to use it,
8 we don't -- our contention is that there were various and
9 sundry reasons why the business failed, and we have this and
10 you were there, and I just want you to know with respect to
11 this notice that that's the purpose?
12 MR. GORJI: Your Honor, I didn't believe that
13 providing an additional layer of specificity as to exactly
14 what from the transcript we were planning on using was
15 something that was necessary, and in light of the fact that
16 we told them we were planning on using it and that would
17 alert them as to whether or not their confidentiality
18 interests were going to be implicated, the use of the
19 transcript or not, not what the specific content of what I
20 was about to say in court would implicate --
21 THE COURT: Let me just make this observation.
22 There is a lot of acrimony in this case, and that impedes the
23 sort of professionalism that I expect at a hearing that
24 allows me to make a decision on a motion. I believe that
25 that is impeding and affecting your judgments as to the
United States District Court
Northern District of Georgia
44
In re LabMD, Briefng Book Page 156
1 fairness of this hearing.
2 And, you know, I preside over very difficult
3 criminal cases all the time where people's liberty is at
4 stake, and I find more cooperation between lawyers in those
5 on much more difficult issues, including evidentiary issues,
6 than I see in this proceeding, which is the government coming
7 in, which -- and I think it's the responsibility of the
8 government to be fundamentally fair to the people that it's
9 regulating, and that it would be in your interest and I would
10 hope your motivation as an employee of the government to say
11 here is what -- here is our position, here is how we are
12 going to advocate it, because we want the Judge to have a
13 clean record to make a decision.
14 So your explanation that you didn't think the
15 additional level of specificity may be technically correct --
16 I don't know, because I haven't looked at the -- at what the
17 requirement is with respect to disclosure -- but I will say
18 this, it's now interrupted the proceeding, it's made it more
19 difficult for me to understand the position of the parties,
20 and I think it abrogates your responsibility as an employee
21 and representative of the United States government and
22 particularly this agency.
23 But that's sort of the theme I see in this whole
24 investigation.
25 MR. GORJI: Your Honor, if I may address that? I
United States District Court
Northern District of Georgia
45
In re LabMD, Briefng Book Page 157
1 apologize if that is what has occurred in this case.
2 THE COURT: You know what my mother used to say?
3 My mother, bless her heart, who is now dead, used to say when
4 I apologized, she said you can't live a life of I'm
5 sorries. Now you are living through a hearing of I'm sorries
6 because this is now your third apology.
7 But it comes from the fundamental refusal of you
8 and your colleagues with candor and with transparency to say
9 here is where we are going on this.
10 Your whole position on this is that I don't have
11 jurisdiction to do this, and that has -- and that's all you
12 briefed is that I am not authorized to review the authority
13 of your agency under Section 5 to conduct this
14 investigation.
15 And so you are relying upon those what you think
16 are bright line rules about a section, which in my course of
17 doing this for for ten years is fairly ambiguous to me.
18 But this is the first time where it hasn't been a direct
19 consumer action, and I frankly think there is a legal
20 question.
21 Now, the question for me is whether or not I have
22 the authority to decide that or whether there is some other
23 process that has to first be exhausted or however you want to
24 advocate it through in order to get a final opinion that can
25 be appealed to a court.
United States District Court
Northern District of Georgia
46
In re LabMD, Briefng Book Page 158
1 MR. GORJI: Your Honor, the jurisdictional
2 arguments are the primary arguments we do make. We do also
3 make the 12 (b) (6) arguments, Your Honor, that do not deny
4 your authority but that we believe the causes of action fail
5 to state a claim.
6 But I would just like to put something in
7 perspective on behalf of the government here, Your Honor,
8 which is the history of acrimony that you perceive, this is a
9 case that I was just very recently assigned to along with
10 co-counsel here. Counsel who was on this case is no longer
11 with the Department of Justice.
12 And so I just became aware of this transcript last
13 week, Your Honor. And so there certainly wasn't any --
14 THE COURT: That's not the defendant's or my fault
15 or my problem. That's your problem. If you want to switch
16 lawyers, you switch lawyers.
17 And if you are talking about the fellow who was
18 here on the CID, I could tell you as a result of that hearing
19 that there was already a history of acrimony and I think on
20 behalf of the agency the exertion of authority in a
21 mean-spirited way.
22 MR. GORJI: Well, Your Honor, I can just say
23 that --
24 THE COURT: And you might -- you know, I'm
25 not saying that -- if you are just new to this case, which
United States District Court
Northern District of Georgia
47
In re LabMD, Briefng Book Page 159
1 I think is the reason why I put this off, to allow you time,
2 that I would hope that change in lawyers would change
3 atmosphere.
4 MR. GORJI: Your Honor, there was no intention to
5 hide anything from plaintiff here. We disclosed this in our
6 filing, and, you know, if counsel had asked me what part
7 exactly of the transcript are you hoping to make use of,
8 I certainly would have answered that question.
9 THE COURT: Well, I know, but they are not used to
10 you. They are used to the people who preceded you.
11 And it's hard for you to say this is a new day, and
12 I suspect you didn't call them and say, look, we have got to
13 change the atmosphere in this case, I understand that it
14 hasn't gone well, we understand what your complaints are --
15 and I would hope that you would understand their
16 complaints -- but we want to get on a platform that allows
17 whoever hears this in whatever forum, that would facilitate
18 the communication and entry into the record of information
19 that would allow a thoughtful, just decision on a case that
20 I think needs a thoughtful, just decision.
21 And I think especially when lawyers change, that
22 it's the responsibility of the new lawyers to reach out and
23 say we are going to handle this in the way that, one,
24 advocates on behalf of our client, but at the same time, we
25 recognize we are the government and we do want to be fair,
United States District Court
Northern District of Georgia
48
In re LabMD, Briefng Book Page 160
1 and we want to go down to Atlanta on this hearing that has
2 been put off at our request, which I did because of people's
3 personal commitments, and while my schedule is not very fluid
4 or is not fluid at all anymore and it has very little
5 capacity, it made sense to do that, and I did.
6 MR. GORJI: Well, we appreciate that.
7 THE COURT: But I expected this to go a lot better
8 than it is.
9 MR. GORJI: Again, Your Honor, there was no
10 intention to hide anything. By bringing the fact that we
11 were going to use this transcript to counsel's attention,
12 I thought that we had taken care of our obligations to alert
13 them to the fact that we potentially --
14 THE COURT: Well, I don't know, because, one,
15 nobody has told me what the obligation is, nobody told me
16 that there was going to be a dispute about this.
17 And you didn't either, Mr. Raider. You were on
18 notice. You didn't say, by the way, we are going to have a
19 problem with that, let me give you a heads-up that that's
20 going to happen. But you haven't said that.
21 In fact, I think you are kind of shooting from the
22 hip to say, well, we don't want it to come in now, not even
23 really understanding what they want to come in, even though
24 there are four of you here today.
25 I hope you are not paying them all, because if you
United States District Court
Northern District of Georgia
49
In re LabMD, Briefng Book Page 161
1 are, no wonder you are going broke.
2 MR. RAIDER: Your Honor, the basic points, really,
3 have already been made without the use of the transcript
4 that --
5 THE COURT: Well, you know, this is -- you don't
6 get to try the case for them, as much as you would like to.
7 MR. RAIDER: No, I'm not -- I understand.
8 THE COURT: The question is what -- and I don't
9 want to waste any more time. We spent half an hour on
10 this.
11 Is there some way for you to draw to my attention
12 that would not disclose in this public forum information that
13 you all agree at the time it was taken was deemed to be
14 confidential or protected, that you could get whatever --
15 there can't be that much in this transcript that relates to
16 that, that you could highlight those for me? And you can
17 even do it today, and say here is what we would show him, and
18 I would determine whether or not it is or is not consistent,
19 and we can move on?
20 MR. GORJI: Your Honor, there really is only about
21 two pages of text, and we could confer with counsel to decide
22 if they are -- to come up with a proposal for Your Honor, if
23 that's --
24 THE COURT: Why don't we do that now? Because
25 I don't want this hanging over my head any longer than it has
United States District Court
Northern District of Georgia
50
In re LabMD, Briefng Book Page 162
1 been.
2 (Counsel confer.)
3 MR. RAIDER: Your Honor, we have no objection to
4 the pages pointed out to us.
5 MR. GORJI: Your Honor, if I may approach the
6 witness and provide him with this transcript?
7 THE COURT: You may.
8 BY MR. GORJI:
9 Q. Showing you your transcript from the FTC administrative
10 proceeding on February 10th, 2014, it has your name on
11 it. Do you recall giving testimony in that proceeding?
12 A. Yes, I do.
13 Q. And the attorney who asked the questions was
14 Alain Sheer?
15 A. Correct.
16 Can you point out what testimony we are talking about?
17 Q. Yes, I'm going to draw your attention to page 130, line
18 25.
19 A. Can I read -- can I read this first?
20 Q. Yes.
21 A. What is the two pages? Can you tell me the beginning
22 and the end, please?
23 Q. Yes, I am going to tell you. Starting on page 130, line
24 25, through 131, which is this page, line 12. If you would
25 take a look at that?
United States District Court
Northern District of Georgia
51
In re LabMD, Briefng Book Page 163
1 A. That is the whole part of the two pages are these two
2 things? Okay, so you don't mean pages of this; you mean
3 transcript pages, okay.
4 Okay. So you are ending -- I'm sorry, you are ending on
5 131, line what?
6 Q. Line twelve.
7 A. Line twelve, okay. I'm sorry, thanks.
8 Okay, I have read it. Thank you.
9 Q. Was it your testimony there that you were asked, How
10 does Obamacare fit into the decision to wind down LabMD?
11 Answer: It's creating huge anxiety, destruction,
12 consolidation to our customer base.
13 Question: What does that mean for LabMD?
14 Answer: That means our customers are in survival mode
15 and, therefore, are having to either sell their practices or
16 merge with others and send their specimens to where they are
17 told to send them, not where they want to send them.
18 Question: Is LabMD one of the laboratories to which
19 your clients are told to send their specimens?
20 Answer: No.
21 A. Okay.
22 Q. Is it that your testimony there?
23 A. That was my testimony, yes.
24 Q. Also I'm going to draw your attention to page 60.
25 THE WITNESS: Okay. So did you look at this
United States District Court
Northern District of Georgia
52
In re LabMD, Briefng Book Page 164
1 additional? Okay.
2 BY MR. GORJI:
3 Q. I'm going to draw your attention to page 60 --
4 THE WITNESS: And my lawyers were okay with that
5 other part?
6 MR. RUBINSTEIN: Yes.
7 THE WITNESS: Okay. Thank you.
8 MR. GORJI: I believe your lawyers do not object.
9 MR. RUBINSTEIN: No objection.
10 THE WITNESS: Okay.
11 BY MR. GORJI:
12 Q. I will point you to page 60, and if you start with line
13 nine and go through line eleven?
14 A. Uh-huh.
15 Q. Was that your testimony there?
16 A. At that moment, yes.
17 Q. When you say that moment, that was on February --
18 A. -- 10th, 2014.
19 I mean, this is like out of context here, so let me just
20 see what else is going on here.
21 Other than that, I don't know at the moment. It depends
22 on -- other than that I didn't know at the moment, I didn't
23 know the future plan -- I didn't know the factors of the
24 future plan pertaining to Obamacare, and other than that,
25 I didn't know other factors. I --
United States District Court
Northern District of Georgia
53
In re LabMD, Briefng Book Page 165
1 Q. So you agreed you were asked on line nine: What's your
2 future plan for LabMD?
3 Answer: It depends on Obamacare, and other than that,
4 I don't know.
5 A. And then, I didn't know what the future plan was. But
6 I didn't say it was the only Obamacare. Okay.
7 Q. You can hold on to that.
8 A. Okay, thanks. Are we done for now? No? All
9 right. Excuse me.
10 Q. Now, you mentioned that your VP of operations left the
11 company?
12 A. Correct.
13 Q. Did he indicate whether or not Obamacare impacted his
14 decision to leave?
15 A. No.
16 Q. And you haven't provided an affidavit from your vice
17 president of operations, have you?
18 A. Well, he's no longer the vice president of operations.
19 Q. You haven't provided an affidavit from your former vice
20 president of operations; is that correct?
21 A. You deposed him.
22 Q. You also claim that you have not been able to obtain
23 insurance as a result of the FTC investigation. Did you
24 inquire to the insurance providers whether or not it was the
25 fact that there was an investigation or the fact that
United States District Court
Northern District of Georgia
54
In re LabMD, Briefng Book Page 166
1 customers' personal information was found in places that it
2 shouldn't have been that gave them pause?
3 A. Well --
4 Q. Did you ask them that question?
5 A. I wouldn't have asked that question because that's an
6 allegation about customers' information found in places other
7 than it should have been. That's not a question I would have
8 asked.
9 And whether that's true or not, when things are found in
10 other places, that does not incite a government
11 investigation. There are breaches that are hundreds of times
12 greater than mine that have gone on, if mine had a breach,
13 which we don't think it did.
14 So, no, that is not a question I would have asked. And
15 because I was -- well, first of all, they won't speak to me
16 directly. They tend to go through my broker. These
17 insurance underwriters don't want to talk directly to the
18 customer. They are going to go through the broker.
19 So this is why the broker sent me the e-mail and conveyed
20 information to me.
21 But according to the broker, it was the FTC
22 investigation and the costs they are looking at. They are
23 looking at risks and dollars.
24 Q. Certainly one of the risks that they would probably be
25 interested in is whether or not your protected information is
United States District Court
Northern District of Georgia
55
In re LabMD, Briefng Book Page 167
1 adequately protected; is that correct?
2 A. No, because it's not a cyber security policy. They are
3 interested in -- well, I would say they are interested in
4 whatever can cost them, and whenever there is -- nothing
5 scares an underwriter greater than the unknown or nothing
6 scares a medical underwriter than a chronic disease.
7 And so I'm assuming since the only response that came
8 from them -- and I didn't have direct conversations with them
9 other than talking to my broker -- was that it was the
10 unknown of the FTC investigation.
11 Q. Did you get an affirmative statement from the insurance
12 company that they would cover you if the FTC investigation
13 was enjoined?
14 A. No, I didn't.
15 Q. How many insurance companies have you contacted to
16 obtain insurance coverage?
17 A. Well, I contacted brokers. They contacted insurance
18 companies.
19 Q. Do you know how many insurance companies?
20 A. Approximately -- I think approximately a dozen,
21 approximately. I am not quite sure. At least, at least
22 seven or eight. But, you know, the brokers don't want to
23 name names.
24 Q. And you don't have an affidavit from any of your brokers
25 explaining why you have been denied coverage?
United States District Court
Northern District of Georgia
56
In re LabMD, Briefng Book Page 168
1 A. No, I don't have an affidavit from them.
2 MR. GORJI: One moment, Your Honor.
3 Nothing else, Your Honor.
4 Thank you, Mr. Daugherty.
5 THE WITNESS: Did you want this back?
6 MR. GORJI: You can keep it.
7 THE WITNESS: Okay. Thank you.
8 THE COURT: Any redirect?
9 MR. RAIDER: Just one quickly on redirect,
10 Your Honor.
11 -- -- --
12 REDIRECT EXAMINATION
13 BY MR. RAIDER:
14 Q. Your deposition was February 10, 2014. What was the
15 status of LabMD's cancer detection testing services on that
16 date?
17 A. We were doing no more. That was about three and a half
18 weeks out from our last report out.
19 MR. RAIDER: Thank you. No further questions.
20 THE COURT: All right. Thank you. You may return
21 to counsel table.
22 THE WITNESS: Thank you.
23 THE COURT: Call your next witness, please?
24 THE WITNESS: Should I leave this here?
25 MR. RAIDER: Thank you, Your Honor. We call
United States District Court
Northern District of Georgia
57
In re LabMD, Briefng Book Page 169
1 Mr. Cliff Baker. And Mr. Meyer will handle that
2 examination.
3 -- -- --
4 CLIFF BAKER
5 being first duly sworn by the Courtroom Deputy Clerk,
6 testifies and says as follows:
7 -- -- --
8 DIRECT EXAMINATION
9 BY MR. MEYER:
10 Q. Mr. Baker, could you state your full name and address
11 for the record?
12 A. Cliff Baker, 4850 Topeka Court, Dunwoody, Georgia.
13 Q. And where are you employed?
14 A. A company called Meditology Services based in Atlanta.
15 Q. In what capacity?
16 A. I'm the CEO and founder of the company.
17 Q. And what exactly is your role as the CEO?
18 A. Obviously oversee the running of the company, but I also
19 lead a practice that focuses on privacy and security in
20 healthcare, consulting with companies around privacy and
21 security in healthcare.
22 Q. And when you say consulting about privacy and security,
23 what exactly do you mean?
24 A. My career has been focused on helping primarily
25 healthcare organizations adopt security practices that first
United States District Court
Northern District of Georgia
58
In re LabMD, Briefng Book Page 170
1 and foremost align with the security rule and then generally
2 good practices to have a place to protect information.
3 Q. What were you asked to do in this case?
4 A. I was asked by counsel to review Dr. Hill's report and
5 compare it to my understanding of the HIPAA obligations for
6 companies in the healthcare industry.
7 Q. And what additional experience do you have to make such
8 an analysis?
9 A. As I mentioned, I spent almost twenty years now helping
10 organizations in the healthcare industry implement security
11 controls to comply with HIPAA.
12 Prior to starting Meditology Services, I spent about
13 fourteen years at a company called PriceWaterhouseCoopers
14 primarily in the healthcare -- leading their healthcare
15 security practice and consulting with their clients around
16 implementing security practices.
17 After I left PriceWaterhouseCoopers in 2008, I was the
18 chief strategy officer and architect for a framework called
19 the High Trust Security Alliance, which essentially was a
20 number of organizations across the healthcare industry that
21 came together to try and define a reasonable and appropriate
22 standard for the industry so the industry could proactively
23 implement controls for the healthcare industry.
24 Q. And based on that experience, could you briefly state
25 any opinions you reached regarding the standards articulated
United States District Court
Northern District of Georgia
59
In re LabMD, Briefng Book Page 171
1 in Dr. Hill's report?
2 A. The most troubling aspect of the report is that Dr. Hill
3 doesn't take into consideration any aspects of scalability in
4 terms of what's reasonable and appropriate for an
5 organization of the size of LabMD to implement security to
6 comply with HIPAA security requirements, which has really
7 been the primary driver for security requirements for the
8 industry.
9 And so when I read Dr. Hill's report, it is out of line
10 with the expectations of organizations of the size of LabMD.
11 Q. Is it your understanding that LabMD is a HIPAA-covered
12 entity?
13 A. It is my understanding that they are a HIPAA-covered
14 entity.
15 Q. And based on your experience, do you have any reason to
16 believe that the standard articulated by Dr. Hill would
17 create confusion amongst HIPAA-covered companies?
18 A. Absolutely. The industry continuously is looking for
19 clarification and specificity from the regulators to make
20 sure that they understand what their obligations are, and
21 when a regulating body makes a judgment based on some
22 standard, the industry reacts and the industry tries to
23 understand what their obligations will be as a result of that
24 ruling.
25 So I think the position that Dr. Hill takes is
United States District Court
Northern District of Georgia
60
In re LabMD, Briefng Book Page 172
1 contradictory to the ten years of experience we have had with
2 HHS and understanding their expectation of the industry.
3 Q. And following up on that, I want to go through some
4 particular topics. What is scalability?
5 A. In the creation of the HIPAA rule, a key tenet of the
6 HIPAA rule was to implement controls that were reasonable and
7 practical for the resources, capacity, skills of an
8 organization.
9 HIPAA recognizes that the healthcare industry ranges
10 from large multinational companies to one-physician practices
11 with no IT resources -- probably no IT resources on staff,
12 maybe an office manager at best. And so HIPAA had to be able
13 to specify requirements that would be adopted for the largest
14 companies and the smallest companies.
15 Obviously specifying specific requirements for each of
16 those extremes is difficult, and so HIPAA created this
17 concept of a risk assessment which allowed organizations to
18 analyze their exposures and to make decisions that related to
19 the security controls that were appropriate and that they
20 could really have the resource, capacity and skills to
21 implement.
22 Q. And how does Dr. Hill address scalability?
23 A. Her primary considerations for scalability is the number
24 of records that LabMD holds. And, candidly, the number of
25 records at LabMD is minute compared to larger organizations
United States District Court
Northern District of Georgia
61
In re LabMD, Briefng Book Page 173
1 that offer similar services.
2 And then she doesn't really ever consider the type of
3 organization they are in the industry, the number of
4 employees that they have, the number of resources that they
5 have hired from an IT and security perspective. None of
6 those considerations come into her -- the basis of her
7 opinion in her report.
8 Q. How significant is the difference between the standard
9 Dr. Hill articulates and what HIPAA requires?
10 A. From my perspective, it's significant. Imposing
11 requirements on an industry that are not practical and
12 reasonable, you know, really have a contrary impact to what I
13 believe the regulators are trying to do, which is to make
14 sure that appropriate security controls are in place.
15 And so imposing requirements that don't address this
16 kind of scalability aspect will distract the industry in
17 large part because now they have to interpret and figure out
18 how they are going to implement requirements that are
19 misaligned with expectations that have been set for them for
20 the past ten years.
21 Q. How important is scalability for a company the size of
22 LabMD?
23 A. It's extremely important. Textbook security
24 requirements or controls, if you read textbook requirements
25 and you put the same requirements in front of a large
United States District Court
Northern District of Georgia
62
In re LabMD, Briefng Book Page 174
1 multinational company, you know, they have more security
2 resources than LabMD has employees. And so the skills and
3 investments that they will make around security would
4 probably exceed the total revenue that LabMD probably pulled
5 in its entire existence.
6 So it's incredibly important, because if the regulators
7 want real controls to be implemented, they have to make them
8 practical and they have to make them reasonable and they have
9 to impose expectations that small organizations can actually
10 achieve.
11 Q. What is integrity monitoring?
12 A. Dr. Hill refers to this concept called file integrity
13 monitoring, and it is essentially technology used to monitor
14 any change to files on an issue.
15 So it essentially looks for any change, whether you save
16 a file or you implement a new file or put a new file on a
17 computer, it will send off an alert to somebody. And
18 somebody will have to read that alert, investigate it and
19 respond to it.
20 Q. Does HIPAA require file integrity monitoring?
21 A. It doesn't specifically require file integrity
22 monitoring at all.
23 Q. And what does Dr. Hill say in her report?
24 A. This is one of the key controls that she says LabMD
25 should have had in place. And I think it's a classic example
United States District Court
Northern District of Georgia
63
In re LabMD, Briefng Book Page 175
1 of where her report is out of alignment with the expectations
2 that HHS sets for the industry.
3 As an example, Dr. Hill often in her report refers to
4 free software or inexpensive software that can be implemented
5 to achieve some of these controls. What she doesn't consider
6 is the resource requirements to follow up, investigate,
7 configure, implement those tools.
8 And file integrity monitoring particularly has a
9 significant resource impact on an organization because it's
10 constantly sending out alerts that need to be investigated.
11 Furthermore, Dr. Hill recommends that file integrity
12 monitoring be implemented on a workstation. So on occasion
13 for large organizations you will see it on servers.
14 The reason I'm making that distinction is when a user is
15 on a workstation, they are often changing files. You are
16 opening Word documents, you are opening Excel documents, you
17 are opening and closing files.
18 With that kind of software, there is a potential for an
19 alert to be sent out every time a file is changed, and you
20 can imagine the resource impact that that's going to have on
21 the resources of a particularly small organization.
22 Q. For a company the size of LabMD, what would you
23 recommend with respect to file integrity monitoring in order
24 to be in compliance with HIPAA?
25 A. HIPAA is based on a risk assessment first.
United States District Court
Northern District of Georgia
64
In re LabMD, Briefng Book Page 176
1 Fundamentally HIPAA requires risk assessment. And so
2 we'd work with a company the size of LabMD, understand their
3 exposures, and essentially put a measured program in place to
4 implement security over time.
5 We would start with some limited monitoring that would
6 be in place probably on the servers versus their workstations
7 and then evolve that over time.
8 The primary reason we would not start with file
9 integrity monitoring is we know that it would overwhelm their
10 resources and that the net impact would be that security
11 would not be implemented, information would not be well
12 protected because the resources would not have enough
13 capacity to actually focus on the things that matter.
14 Q. All right. What is encryption?
15 A. Encryption is a process of turning readable information
16 into unreadable information that is only accessible or
17 unlocked for the individuals that have keys to unlock that
18 information, in laymen's terms.
19 Q. Does HIPAA address encryption?
20 A. It does address encryption.
21 Q. How?
22 A. It's an addressable requirement.
23 And there is a distinction, an important distinction in
24 the rule. There are required items and addressable items in
25 the rule.
United States District Court
Northern District of Georgia
65
In re LabMD, Briefng Book Page 177
1 And HHS guidance for addressable items is that the
2 decision around how to achieve those requirements,
3 addressable requirements, should be based on the risk
4 assessment, and then HHS essentially provides options.
5 If the organization does a risk assessment and believes
6 that there is an exposure, believes that they have ways that
7 cost and impact from a resource capacity on the organization
8 in terms of implementing that control to mitigate the
9 exposure, they should go ahead and do it.
10 On the other hand, in evaluating the exposure against
11 the cost and resource capacity to achieve that control, if
12 that cost and resource capacity exceeds the capabilities,
13 they can explore alternate options.
14 If no alternate options exist, then they don't have to
15 implement that control.
16 Q. What is Dr. Hill's opinion with respect to encryption?
17 A. Dr. Hill's opinion is pretty black and white, that
18 encryption should be implemented.
19 Most troubling I think about her report is that she
20 makes reference to encryption and risk. What I mean by that
21 encryption stored in databases on servers.
22 And candidly, you know, across all industries, that is
23 not generally an adopted practice, primarily because it has
24 an impact on the processing speed and performance of
25 systems. We are starting to see more and more of that kind
United States District Court
Northern District of Georgia
66
In re LabMD, Briefng Book Page 178
1 of control implemented, but mostly for large organizations
2 that have the resource capacity to implement those kind of
3 controls.
4 It's very unusual -- I have never seen an organization
5 the size of LabMD implement encryption and risk.
6 Q. What would you recommend to an organization the size of
7 LabMD with respect to encryption in order to comply with
8 HIPAA?
9 A. Again, it would be based on the risk assessment, and
10 I would recommend implementing controls where I know they can
11 achieve the objectives required for encryption.
12 So for example, for any access to their website, if
13 there was particular health information exchanged, I would
14 expect that information is encrypted.
15 Q. You mentioned the risk assessment throughout your
16 testimony now. Does Dr. Hill have an opinion regarding risk
17 assessment?
18 A. She certainly does.
19 Q. And what is it?
20 A. You know, interestingly, we both refer to the same
21 standard reference for risk assessment, which is the NIST
22 Security Series Reference 800-30, which is a
23 government-published approach for performing a risk
24 assessment.
25 Where Dr. Hill and I have a departure in kind of
United States District Court
Northern District of Georgia
67
In re LabMD, Briefng Book Page 179
1 methodology, she immediately will go in her report to
2 suggesting that the organization implement technical tools to
3 achieve the risk assessment.
4 And again I think this is based on her experience in
5 kind of, you know, she seems to have a very technically kind
6 of focused career, technology focused career, and so her
7 immediate response in terms of this risk assessment is to
8 implement a number of technology solutions.
9 As I mentioned to you before, the license cost for those
10 solutions may not be high. The resource cost to actually
11 manage and implement those solutions is significant.
12 And when you look at the way HIPAA and HHS guides the
13 industry in terms of doing a risk assessment, it's certainly
14 not starting with implementing tools. It's with a process
15 and a mind-set and a methodology, candidly mostly relying on
16 manual methods to assess risk.
17 I think that kind of highlights the fundamental
18 distinction between Dr. Hill's report and generally where HHS
19 is guiding the industry.
20 Q. In offering those opinions, does Dr. Hill rely on any
21 published materials from FTC?
22 A. She doesn't, which I found interesting.
23 I would have thought that the expert -- the expert
24 witness for the FTC would have been referencing FTC guidance
25 for security requirements. She did not reference that in her
United States District Court
Northern District of Georgia
68
In re LabMD, Briefng Book Page 180
1 report, that I recall.
2 Q. Are you aware of the FTC publishing data security
3 standards for medical service providers other than what's in
4 Dr. Hill's report?
5 A. I am not aware. In my line of business, I don't rely on
6 FTC guidance for security requirements for my client base.
7 Q. And you have been in that line of business for almost
8 twenty years; right?
9 A. That's correct.
10 Q. And in that time, are you aware of any statements made
11 by the FTC expressing their authority to impose requirements
12 on protected health information in excess of HIPAA?
13 A. I am not aware of those requirements.
14 MR. MEYER: No further questions, Your Honor.
15 THE COURT: I want some clarification to make sure,
16 see if my understanding about this is correct. That -- and
17 I guess this is an allegation.
18 The allegation is that the security breach here was
19 the disclosure of certain patient records. And I don't know
20 the quantity of the patient records that are alleged to have
21 been disclosed, but apparently it was some patient
22 information; is that right?
23 MR. RUBINSTEIN: Your Honor, Reed Rubinstein. If
24 I might?
25 It's not clear. We have heard different things in
United States District Court
Northern District of Georgia
69
In re LabMD, Briefng Book Page 181
1 the course of the administrative hearing. Originally there
2 was a focus --
3 THE COURT: Well, what's your understanding about
4 what went from LabMD outside of the company to others, or are
5 you claiming that nothing did?
6 MR. RUBINSTEIN: There are allegations that --
7 THE COURT: No, what's your understanding? Have
8 you reached a conclusion that certain patient information was
9 disclosed outside the company?
10 MR. RUBINSTEIN: Our understanding, based on the
11 testimony that's been taken to date --
12 THE COURT: Well, you are the lawyers for the
13 company.
14 MR. RUBINSTEIN: That's correct, but --
15 THE COURT: Have you reached any conclusion that
16 information that was private for patients that was delivered
17 to you by these people that were hiring LabMD got disclosed
18 outside the company?
19 MR. RUBINSTEIN: We do not believe that
20 information -- patient PHI has been disclosed outside the
21 company based on what we have learned on discovery.
22 And the reason for that, among other things,
23 testimony of the FTC's experts with respect to the expected
24 rate of identity theft. In this case, there is no single
25 plaintiff, no single person who has alleged --
United States District Court
Northern District of Georgia
70
In re LabMD, Briefng Book Page 182
1 THE COURT: All right. My question was do you
2 know. You are saying there is not.
3 Second, did somebody load a file-sharing program on
4 any LabMD computer?
5 MR. RUBINSTEIN: Yes.
6 THE COURT: And did you do any investigation to see
7 whether or not any information was accessed through the use
8 of that file-sharing program from somebody outside the
9 company?
10 MR. RUBINSTEIN: I believe in approximately 2008,
11 LabMD was informed that file-sharing software was on the
12 computer. LimeWire, which is used primarily for audio
13 files.
14 There was an investigation done by the company.
15 This was contrary to the company's policies, and it was
16 removed.
17 The FTC investigation began two years --
18 approximately two years thereafter, and there are allegations
19 with respect to two specific alleged data breaches.
20 The first related to an insurance agent file, a
21 1718 file. A second related to certain day sheets, which
22 were actually printed forms. They had nothing to do with
23 data security in the sense that we are using it.
24 It is not clear to us still today and there is no
25 evidence in the record that demonstrates how exactly the 1718
United States District Court
Northern District of Georgia
71
In re LabMD, Briefng Book Page 183
1 file, if it did, got out. That's one of the things that's
2 still, frankly, developing.
3 But as I said, to our knowledge and as far as we
4 can tell to the government's knowledge, there is not a single
5 case of identity theft attributable to the alleged data
6 breach.
7 THE COURT: Well, what is it that the FTC claims
8 was the data security breach?
9 MR. GORJI: Your Honor, there are two instances,
10 one being that the Sacramento, California, Police Department
11 found information belonging to LabMD's customers in the hands
12 of identity thieves.
13 Now, that was reported to LabMD. My understanding
14 is LabMD actually informed customers that there had been
15 a --
16 THE COURT: And when was that?
17 MR. GORJI: That was October 2012. I don't know
18 when LabMD actually informed their customers or there was a
19 disclosure.
20 THE COURT: And how did the police department know
21 that it originated from LabMD, and in what form did they have
22 it?
23 MR. GORJI: Your Honor, there was documentation
24 that indicated it pertained to LabMD, I believe.
25 THE COURT: You mean papers?
United States District Court
Northern District of Georgia
72
In re LabMD, Briefng Book Page 184
1 MR. GORJI: Documents, papers.
2 THE COURT: All right. So -- and where did the
3 police department claim that the papers -- how were the
4 papers obtained?
5 By papers, you mean paper documents, that somehow
6 they got hold of some paper documents with some patient
7 information on it? Is that what the allegation is?
8 MR. GORJI: Yes, Your Honor. My understanding is
9 they were in possession of the individuals who pled no
10 contest to the state charges of identity theft.
11 THE COURT: Well, if they pled no contest, they
12 probably cooperated. Did they tell you where they got the
13 papers?
14 MR. GORJI: Your Honor, if I might inquire?
15 Your Honor, I don't have information as to how the
16 documents and the information was obtained by the identity
17 thieves.
18 THE COURT: Well, has anybody from the FTC gone out
19 and interviewed the people who pled nolo to that to find out
20 where it came from, to see whether or not there was indeed a
21 security breach?
22 Let me tell you something, these are the most
23 simple questions of this investigation. That you are
24 claiming that some police department prosecuted some people
25 for having possession of information which you are now
United States District Court
Northern District of Georgia
73
In re LabMD, Briefng Book Page 185
1 claiming wrongfully was not protected by LabMD, and you can't
2 even tell me whether or not you have interviewed the people
3 who had the data to find out where they got it to see whether
4 or not there was a security breach or not? And yet you have
5 implemented and instituted this investigation?
6 And this is your case. You are new -- I know you
7 might be new on it, but for heaven's sakes, you are arguing
8 to me that there is a hearing on May 20th and you don't even
9 know.
10 MS. FASCETT: Your Honor, if I may just explain,
11 just for clarity, not as an excuse. The FTC attorneys that
12 are handling the administrative proceeding in that hearing,
13 they I'm assuming definitely know these details. They are
14 not present. They are not here today.
15 We are just -- we were just brought in from DOJ to
16 represent this complaint in this action. So that's part of
17 why we don't have these facts. But we represent the FTC here
18 and we can get these facts for you.
19 MR. RUBINSTEIN: Your Honor, if I could?
20 THE COURT: I'm not --
21 MR. RUBINSTEIN: I --
22 THE COURT: Sit down.
23 MR. GORJI: Your Honor, my --
24 THE COURT: So where are those lawyers? Are they
25 too busy to come to Atlanta today?
United States District Court
Northern District of Georgia
74
In re LabMD, Briefng Book Page 186
1 MS. FASCETT: Well --
2 THE COURT: Is that one of them sitting back there
3 in the gallery?
4 MS. FASCETT: No, she's a U.S. Attorney here in
5 Atlanta, unrelated.
6 THE COURT: How about this other fellow back there,
7 is he an FTC lawyer too?
8 MR. MARCUS: Your Honor, we have a gentleman here
9 from the FTC.
10 THE COURT: Are you involved in this
11 investigation?
12 MR. MARCUS: I am personally not involved in the
13 investigation.
14 THE COURT: Okay. So you are off the hook.
15 So far I have got four lawyers here and none of
16 them are involved in the investigation. How about --
17 MR. MARCUS: We do have are a lawyer who is
18 involved in the investigation.
19 THE COURT: And what's your name?
20 MR. SCHOSHINSKI: Good morning, Your Honor.
21 Robert Schoshinski. I'm assistant director in the Division
22 of Privacy and Identity Protection.
23 THE COURT: All right. So in this case, what
24 investigation has been made as to the source of the documents
25 that the police department out in California found?
United States District Court
Northern District of Georgia
75
In re LabMD, Briefng Book Page 187
1 MR. SCHOSHINSKI: Your Honor, the complaint
2 counsel, so that is the FTC counsel who is litigating the
3 complaint in the administrative action, noticed the
4 depositions of the two individuals who pled no contest to
5 identity theft.
6 One they could not serve because she was just
7 simply not findable. The other one was in jail. We --
8 THE COURT: Did you try to find her?
9 MR. SCHOSHINSKI: Yes, we did, Your Honor. We
10 hired several process servers. They made many attempts to
11 try to find her but were unable to serve her.
12 THE COURT: And when did you first try to serve
13 her?
14 MR. SCHOSHINSKI: Your Honor, I don't have the
15 exact dates, but --
16 THE COURT: Well, give me an approximation.
17 MR. SCHOSHINSKI: Your Honor, I would say late
18 2013, early 2014.
19 THE COURT: So really late in the game, you finally
20 decided that it made sense to go and find out with respect to
21 one of the allegations that's the basis of your investigation
22 that's been ongoing for months, because the CID was something
23 I dealt with some months ago, that you finally decided -- or
24 not you, but your lawyers finally decided that maybe it would
25 be good to try to find the people who actually had the
United States District Court
Northern District of Georgia
76
In re LabMD, Briefng Book Page 188
1 information to determine where they got it?
2 MR. SCHOSHINSKI: Yes, Your Honor.
3 THE COURT: Does that strike you as odd?
4 MR. SCHOSHINSKI: Your Honor, it doesn't strike me
5 as odd. It's what --
6 THE COURT: Does it strike you as late?
7 MR. SCHOSHINSKI: Your Honor, it strikes me as the
8 normal course of the investigation.
9 THE COURT: Boy, that's a sad comment on your
10 agency, that you would wait until months before a hearing and
11 months after you instituted an investigation on a principal
12 claim that you are asserting, that you have not even taken
13 any effort to interview the people that you claim had the
14 documents that underlie the charge of a security
15 breach. That strikes me as almost being unconscionable.
16 And how much money -- how much activity was there
17 before you served those subpoenas trying to get the
18 information from LabMD with respect to a security breach that
19 you don't even know how it occurred? How much activity?
20 MR. SCHOSHINSKI: Your Honor, how would you like me
21 to estimate?
22 THE COURT: Let's start in months.
23 MR. SCHOSHINSKI: Well, Your Honor, I believe the
24 investigation began in January of 2010.
25 THE COURT: Okay. So three years before you tried
United States District Court
Northern District of Georgia
77
In re LabMD, Briefng Book Page 189
1 to subpoena them?
2 MR. SCHOSHINSKI: Your Honor --
3 THE COURT: I'm sorry, two and a half years.
4 MR. SCHOSHINSKI: Your Honor, the knowledge of this
5 incident didn't occur until after the CID enforcement hearing
6 up here in Atlanta. That's when we were notified that this
7 incident had occurred, in October of 2012.
8 THE COURT: So you found out about the -- the
9 incident you are talking about is the California police
10 incident?
11 MR. SCHOSHINSKI: That's correct, Your Honor.
12 THE COURT: All right. And how soon after you
13 found out about the incident did you try to contact the
14 police authorities in California to find out what they knew
15 about the source of the information?
16 MR. SCHOSHINSKI: Immediately.
17 THE COURT: And what did they tell you?
18 MR. SCHOSHINSKI: They told us that they did not
19 know.
20 THE COURT: And then what did you do next, and how
21 soon did you do it?
22 MR. SCHOSHINSKI: We shared the information with
23 LabMD concerning the -- what we found out once we were able
24 to confirm that it was LabMD's information, and we then
25 attempted to find out further from the California police
United States District Court
Northern District of Georgia
78
In re LabMD, Briefng Book Page 190
1 department what they knew about the source of this
2 information.
3 THE COURT: And what did they tell you they knew
4 about the source?
5 MR. SCHOSHINSKI: They told us they were not able
6 to get the source from the defendants in the case.
7 THE COURT: Did you talk to the prosecutor of the
8 case as well?
9 MR. SCHOSHINSKI: I don't believe so, Your Honor.
10 THE COURT: And so you tried to track down one of
11 the two defendants. Did you try to track down the second of
12 the two defendants?
13 MR. SCHOSHINSKI: Yes, Your Honor. We actually
14 obtained service on the second defendant, who was in
15 jail. We noticed his deposition in the action, went to take
16 his deposition, and he pleaded the Fifth Amendment and
17 refused to answer questions.
18 THE COURT: So sitting here today, you have no idea
19 where the documents came from, whether they came from LabMD
20 or some other source? Is that a fair thing to say?
21 MR. SCHOSHINSKI: No. We believe they were LabMD's
22 documents.
23 THE COURT: Well, they might have been LabMD's
24 documents, but you don't know how they got into the
25 possession of the two individuals that you tried to contact
United States District Court
Northern District of Georgia
79
In re LabMD, Briefng Book Page 191
1 that pled guilty to this offense?
2 MR. SCHOSHINSKI: That's correct, Your Honor.
3 THE COURT: So you have no information to establish
4 how those documents were obtained; is that right?
5 MR. SCHOSHINSKI: That's correct, Your Honor.
6 THE COURT: And you are still proceeding on this
7 claim?
8 MR. SCHOSHINSKI: Yes, Your Honor, because the
9 claim is not concerning that incident alone. It's
10 concerning --
11 THE COURT: All right. But are you still
12 proceeding on that claim?
13 MR. SCHOSHINSKI: We are proceeding on that
14 evidence, Your Honor.
15 THE COURT: And that evidence relates to other
16 claims, because you have other documents that were found in
17 other places?
18 MR. SCHOSHINSKI: That evidence relates to the
19 potential injury suffered by consumers as a result of
20 exposure of this information.
21 THE COURT: Are you serious about that last
22 response?
23 MR. SCHOSHINSKI: Yes, Your Honor, I am.
24 THE COURT: So you don't know where the documents
25 came from, you don't know how these people got the possession
United States District Court
Northern District of Georgia
80
In re LabMD, Briefng Book Page 192
1 of it, you don't know whether they originated from LabMD or
2 some other place, but you are going to use that to show that,
3 because they committed identity theft, that certain
4 individuals were damaged by documents, the source of which
5 you don't even know?
6 MR. SCHOSHINSKI: Yes, Your Honor.
7 THE COURT: Holy cow.
8 So what's the other incident that you are relying
9 on?
10 MR. SCHOSHINSKI: The other incident is the
11 exposure of the insurance agent file of several thousand
12 consumers.
13 THE COURT: And when was that?
14 MR. SCHOSHINSKI: That was in 2008, Your Honor.
15 THE COURT: And that was through the file-sharing
16 program?
17 MR. SCHOSHINSKI: That's correct, Your Honor.
18 THE COURT: And how do you know that they came
19 through the file-sharing program?
20 MR. SCHOSHINSKI: We know because third parties
21 found the file on file-sharing programs.
22 THE COURT: Well, I accept that. How do you know
23 that they came through the file-sharing program that was
24 loaded on a computer at LabMD?
25 MR. SCHOSHINSKI: Based on the evidence we obtained
United States District Court
Northern District of Georgia
81
In re LabMD, Briefng Book Page 193
1 about the file-sharing program, evidence provided by LabMD
2 that showed that certain files, including this file, were
3 shared on the file-sharing program, we believe that it was
4 exposed through the file-sharing program.
5 THE COURT: And how many records were shared?
6 MR. SCHOSHINSKI: Your Honor, I don't have the
7 exact number. I believe it was nine thousand, but I'm not
8 entirely sure.
9 THE COURT: So are you aware that nine thousand
10 files ended up in some somebody else's hands that were
11 LabMD's files?
12 MR. RUBINSTEIN: Your Honor, it would be nine
13 thousand individuals. It was one file.
14 THE COURT: Well --
15 MR. RUBINSTEIN: And we --
16 THE COURT: So are you going to dance on the head
17 of a pin now too?
18 MR. RUBINSTEIN: I'm not dancing on the head of a
19 pin, Your Honor. I appeared before the administrative law
20 judge and --
21 THE COURT: You can sit down until I'm ready for
22 you.
23 MR. SCHOSHINSKI: Thank you, Your Honor.
24 MR. RUBINSTEIN: -- I told him because the FTC said
25 that the files had been shared, our position was then and it
United States District Court
Northern District of Georgia
82
In re LabMD, Briefng Book Page 194
1 remains to date that the file was taken by this third party,
2 Tiversa.
3 As you may recall, there was quite a controversy
4 with respect to the government's ability to rely on that
5 file.
6 THE COURT: It was taken by use of an
7 improperly-loaded file-sharing program.
8 MR. RUBINSTEIN: It was taken by use of a patented
9 program that Tiversa uses as part of their business model to
10 go from company to company taking files and then coming to
11 the company and saying: Nice business you have here. It
12 would be a shame if anything happened to it. Why don't you
13 hire us to remediate?
14 In fact, that's what happened here. And part of
15 this was put before --
16 THE COURT: Was that enabled by the file-sharing
17 program that was loaded by an employee on the computers at
18 LabMD?
19 MR. RUBINSTEIN: For them to be able to gain
20 access, I don't know.
21 THE COURT: Why don't you know that?
22 MR. RUBINSTEIN: Because we don't fully understand
23 the nature and extent of Tiversa's technology.
24 We attempted to ask them in deposition, and we were
25 met with objections because this is a protected confidential
United States District Court
Northern District of Georgia
83
In re LabMD, Briefng Book Page 195
1 and highly proprietary piece of software. So we still don't
2 understand to this day.
3 THE COURT: Well, you can get a protective order in
4 order to access that. Have you asked for that?
5 MR. RUBINSTEIN: I don't recall. It would be easy
6 enough to check. I can get that for you. I just don't
7 recall whether we did that in the administrative hearing or
8 not. I am certain the question was asked, and I'm certain
9 objections were interposed.
10 And we had asked -- we actually -- it is very
11 possible that we did, because we filed a motion asking for
12 discovery into the circumstances under which there was a
13 sharing of this information between Tiversa and the FTC.
14 We discovered that the FTC had worked with
15 Tiversa. In fact, Tiversa gave LabMD's file to another third
16 party.
17 THE COURT: Well, look, I'm not trying this case,
18 although I am getting a lot of information about the
19 respective positions which also is troubling on both sides.
20 But I will say --
21 MR. RUBINSTEIN: The --
22 THE COURT: So their position, which I guess they
23 are going to present somebody under oath to say that they
24 have traced information through a file-sharing program that
25 allowed some outside source, whether it's Triversa or
United States District Court
Northern District of Georgia
84
In re LabMD, Briefng Book Page 196
1 somebody else, to wrongfully access information that was on
2 LabMD's computers?
3 MR. RUBINSTEIN: I don't believe they have done any
4 independent investigation to verify what type of --
5 THE COURT: I'm not saying that. I'm saying they
6 have got an obligation to present somebody under oath to
7 testify with respect to that, and that's what the deputy
8 director's position -- you are a deputy director; is that
9 right?
10 MR. SCHOSHINSKI: Your Honor, assistant director.
11 THE COURT: All right. I would love to promote you
12 if I could, but I can't, so you are still an assistant
13 director.
14 MR. SCHOSHINSKI: It's the lowest form.
15 THE COURT: I understand. I know titles are big in
16 agencies. I have been there and played that game for a
17 while.
18 But the assistant director has just said that there
19 will be evidence presented before a judicial officer, I guess
20 an administrative law judge, in which somebody will state
21 these nine thousand individuals -- information about
22 individuals in a single record was accessed by an outside
23 source through a file-sharing program that had been installed
24 on WebMD's computers.
25 You are going to say that there is no evidence of
United States District Court
Northern District of Georgia
85
In re LabMD, Briefng Book Page 197
1 that --
2 MR. RUBINSTEIN: That's correct.
3 THE COURT: -- that that ever happened, and you are
4 going to believe that you are right, and the FTC, although
5 sometimes I wonder if they are -- just how compelling their
6 evidence is, that they are going to claim that they are
7 right, and somebody will make a determination of whether
8 there has been a breach or not.
9 Then the question is -- and I do find this -- and
10 I think I know enough about this, and I learned a lot from
11 the CID hearing -- is that the FTC is going to go into the
12 business of monitoring and investigating and regulating
13 security breaches and that they have decided I think to do
14 that within what they believe is their administrative
15 authority, because I think they went to Congress and Congress
16 wouldn't authorize that for whatever reason, whether it's
17 politics or not.
18 But I think there has been no amendment to Section
19 5 to specifically allow that. But they are taking the
20 position that they have the authority to do that.
21 MR. RUBINSTEIN: That is correct.
22 THE COURT: I think that there is a significant
23 question about whether Section 5 allows that, but I'm not
24 sure I can decide that based upon my jurisdictional
25 limitations, perhaps.
United States District Court
Northern District of Georgia
86
In re LabMD, Briefng Book Page 198
1 But I think that's what's going on here is the FTC
2 has staked out a position of regulatory authority and that
3 they are going to advocate that and they are going to advance
4 it to the greatest extent that they can.
5 You are somebody who is the -- is somebody who has
6 fallen within that ambit of claimed authority, and you claim
7 that you didn't do it. They are going to claim that you did
8 do it.
9 So there is going to be a factual question of
10 whether or not you did or did not, and then there is going to
11 be a legal question of whether or not they have the authority
12 to do what they have done.
13 MR. RUBINSTEIN: That's correct. And we are not
14 asking you to decide factual questions today.
15 THE COURT: I know, but you are asking me to take
16 jurisdiction of this, and I'm not sure I can.
17 MR. RUBINSTEIN: Well, and I'm happy to do argument
18 with respect to that.
19 THE COURT: Look, I have spent more time looking at
20 cases than you have on this, so I don't need any more
21 argument on the jurisdictional issue.
22 MR. RUBINSTEIN: Fair enough.
23 THE COURT: I mean, I do think it's strange that a
24 judge in New Jersey gets to decide the jurisdictional issue
25 because the posture of the FTC was different in that case
United States District Court
Northern District of Georgia
87
In re LabMD, Briefng Book Page 199
1 than it is in this case, and then they are arguing that,
2 although I'm co-equal to the judge in New Jersey, that
3 because it came to me a different way, that I can't.
4 I suspect that they would love to travel forward on
5 the New Jersey decision because it favors them and that they
6 will try to deny the opportunity for another judge to weigh
7 in.
8 But I think it's a significant -- you ought to find
9 a way, unless you are so hell bent on expanding this
10 jurisdiction or advocating this jurisdiction, to find some
11 way to decide this legal issue.
12 And I understand why you are doing what you are
13 doing. I have been alive long enough to understand how
14 government and their agencies work. I have been a member of
15 an agency and I understand its impact on defendants or in
16 this case on parties that are under investigation. I
17 understand that too because I have done that as well.
18 But I think that there is a fundamental
19 jurisdictional legal issue, and there ought to be some way of
20 getting a more definitive ruling than what you have right
21 now.
22 Because I would hope that you would think that in
23 this current healthcare environment, that the more
24 competition and providers there are for medical detection
25 devices or processes like those offered by LabMD, that the
United States District Court
Northern District of Georgia
88
In re LabMD, Briefng Book Page 200
1 better off the consuming public is and the better off
2 patients will be. But by your conduct, you have taken one
3 out of the market it looks like.
4 And if I was an agency head, I would say there has
5 got to be some way of being satisfied that this doesn't
6 happen again, however it happened, and to make sure that we
7 have as many providers as possible out there determining
8 whether or not people do or do not have cancer.
9 And that that would mean a good faith, transparent,
10 authentic discussion about what your concerns are, and trying
11 to get those allayed by some process which would not be a
12 twenty-year monitoring.
13 You know, I have defended people that had
14 twenty-year monitoring responsibilities by an agency, big
15 companies, and it's very, very expensive, and it's really
16 intrusive, and in my personal opinion, having been on both
17 sides, they generally are not necessary.
18 But there is never a middle ground. There should
19 be.
20 But I would think that it would be in the benefit
21 of all the parties here to say whatever happened, it can't
22 happen again, but whatever you are doing ought to continue to
23 be done, because it benefits the consuming public, which I
24 think is who you are supposed to be protecting under
25 reasonable certainties, that the consuming public would be
United States District Court
Northern District of Georgia
89
In re LabMD, Briefng Book Page 201
1 treated fairly.
2 And it's interesting the two people that didn't
3 treat the consuming people fairly are two people in jail that
4 won't even cooperate with you and one of whom you can't even
5 find.
6 But I don't think that even the FTC thinks that
7 they intentionally wanted this information to get out,
8 because they are subject to HIPAA regulations.
9 And I will say I have gone into enough doctors'
10 offices and nobody has ever had me sign a statement saying
11 that whatever the obligations are, the rights that I have
12 under the FTC are rights that I have to acknowledge and in
13 some cases give up. It's always HIPAA.
14 And I think that's what happens when you try to
15 extend into an area where you might be allowed or be
16 permitted to extend, but that assumes, especially on behalf
17 of the government, that they act reasonably.
18 And here we are, having spent now about an hour and
19 a half, not getting to the fundamental issue here, which I
20 think is how can your interest be accommodated.
21 And, Mr. Gorji, if you submitted to them a consent
22 order -- and I'm not going to consider that; I don't think
23 it's important -- but it does tell me something about your
24 agency if you say we want twenty years' worth of monitoring
25 and even suggested that was reasonable concerning this
United States District Court
Northern District of Georgia
90
In re LabMD, Briefng Book Page 202
1 company. No wonder you can't get this resolved, because if
2 that's the opening salvo, even I would be outraged, or at
3 least I wouldn't be very receptive to it if that's the
4 opening bid.
5 I don't think you believe that this is a company
6 that willy-nilly allows information to be disclosed. I also
7 believe that you don't think, if you remove yourself from the
8 nits and gnats of this dispute, that you would say it was a
9 good idea to make this provider unavailable to patients.
10 There aren't that many people doing this work as it
11 is. I have another case involving cancer detection
12 processes, and so I know just a little bit about the
13 industry, and one of the regrets of the industry is that
14 there are so few people providing these services. And
15 I think in the current healthcare environment, there will be
16 fewer.
17 It doesn't serve any of us very well. Some day you
18 are going to need one of those services. I hope it's
19 available.
20 You have been completely unreasonable about
21 this. And even today you are not willing to accept any
22 responsibility that whatever needs to be done, even if you
23 can't confirm it, that your position is going to be a
24 litigating position, and you will drag four lawyers to a
25 hearing like this.
United States District Court
Northern District of Georgia
91
In re LabMD, Briefng Book Page 203
1 I mean, I was in a big firm, but on a hearing like
2 this, we wouldn't have four lawyers here. So I don't know
3 what you are trying to accomplish, but I will tell you this,
4 you haven't.
5 And I have a firm belief that it takes two
6 unreasonable people to create an unreasonable atmosphere that
7 prohibits a reasonable result, and that's where we are.
8 Your interest is protecting the American public.
9 That's your responsibility.
10 Your interest is to help a client who I think is
11 providing a good service survive.
12 And I am confident -- I haven't been in all these
13 depositions. I know this, it's always hard to deal with
14 somebody who is changing lawyers all the time. But to the
15 extent that any of that has irritated you, Mr. Daugherty, you
16 need to settle down. I know you are upset down this, but you
17 are poisoning the atmosphere personally.
18 And if I was a lawyer representing you, the first
19 thing I would say is you have got to stop the public
20 stuff. If you want to get this resolved and do something
21 well, no government agency is ever going to treat somebody
22 who's advocating publicly and criticizing publicly. They are
23 going to be less accommodating to them. And I have told that
24 to clients over and over and over when I was a lawyer. Now
25 I get to see it from the other end, and now I'm convinced
United States District Court
Northern District of Georgia
92
In re LabMD, Briefng Book Page 204
1 that's the case.
2 So to the extent that you have gotten some
3 therapeutic value out of all this, it ought to stop, because
4 your criticism hasn't gotten you to where you want to be, has
5 it? It's gotten you where you don't want to be.
6 So I understand the legal issues. I thought as
7 I enter my sixties, one of the values I can do is give you
8 some perspective.
9 Are you a Fiske Scholar? Did you go to the
10 University of Michigan? Did one of you go to Michigan and
11 are a Fiske Scholar?
12 MR. RUBINSTEIN: I did, Your Honor.
13 THE COURT: Yeah. Are you a Fiske Scholar?
14 MR. RUBINSTEIN: Not a Fiske Scholar. I was an
15 Angell Scholar.
16 THE COURT: All right. Well, never mind. Although
17 I will tell you that the story that if one of you had been
18 that I have is working with Bob Fiske, who I think is one of
19 the finest lawyers in America, that we were once granted
20 jurisdiction, and we always, whenever somebody brought a
21 claim to us to try to request us to expand our jurisdiction,
22 we would have a roundtable discussion to say where within the
23 grant of authority to us is our jurisdiction specifically,
24 and, if not, it needs to go back to the people who are
25 entitled to grant jurisdiction, which we believe was
United States District Court
Northern District of Georgia
93
In re LabMD, Briefng Book Page 205
1 Congress, and we turn things down.
2 I think good lawyers -- and he was an agency lawyer
3 for a long time and ran the Southern District for a long time
4 as United States Attorney -- that that lesson has always
5 stuck with me.
6 So where we are now is I have given you my insights
7 about this. I understand there is no more evidence to be
8 presented.
9 I don't need any more -- I guess you can
10 cross-examine him if you want. All I hear him saying is that
11 he doesn't like your expert's report and he would have done
12 something differently and he's claimed that HIPAA is what
13 should be, because there are specific standards there --
14 I think that you will admit that there are no security
15 standards from the FTC. You kind of take them as they come
16 and decide whether somebody's practices were or were not
17 within what's permissible from your eyes.
18 I too find how does any company in the
19 United States operate when they are trying to focus on what
20 HIPAA requires and to have some other agency parachute in and
21 say, well, I know that's what they require, but we require
22 something different, and some company says, well, tell me
23 exactly what we are supposed to do, and you say, well, all we
24 can say is you are not supposed to do what you did.
25 And if you want to conform and protect people, you
United States District Court
Northern District of Georgia
94
In re LabMD, Briefng Book Page 206
1 ought to give them some guidance as to what you do and do not
2 expect, what is or is not required. You are a regulatory
3 agency. I suspect you can do that.
4 But I think that's what happens when you jump too
5 quickly into something that you want to do, and whether
6 that's circumstances or whether that's agency motivation, I
7 don't know. But it seems to me that it's hard for a company
8 that wants to -- even a company who hires people from the
9 outside and says what do we have to do, and they say you have
10 to do this, but I can't tell you what the FTC rules are
11 because they have never told anybody.
12 Again, I think the public is served by guiding
13 people beforehand rather than beating them after they --
14 after-hand. But the assistant director doesn't have the
15 authority to do that. He reports to the deputy director, who
16 reports to the director, who reports to the commission. So
17 he's way down in the pecking order.
18 So I understand what this witness said.
19 I suspect that this witness will say that he never
20 consulted with LabMD before about their security
21 processes. He's just come in to opine on the opinions
22 offered by Ms. Hill. Is that correct?
23 THE WITNESS: Correct.
24 THE COURT: I kind of wish he had been there
25 before.
United States District Court
Northern District of Georgia
95
In re LabMD, Briefng Book Page 207
1 One thing I do know is agencies that say you pay
2 for somebody to come in to look at your security practices
3 and this is what an expert said we had to do and needed to
4 do, that they have a different approach, because that's a
5 defense.
6 But if you want to cross-examine him, now is your
7 time. I had my say.
8 MR. GORJI: Your Honor, the government has no
9 cross.
10 THE COURT: So nothing further from Mr. Baker?
11 We appreciate your testimony.
12 THE WITNESS: Thank you very much.
13 THE COURT: You may step down.
14 Do you have any other witnesses or evidence you
15 want to present?
16 MR. RAIDER: Not at this time, Your Honor, no.
17 THE COURT: Anything the FTC wants to present?
18 MS. FASCETT: Assuming that you are not asking for
19 any argument on the jurisdictional issues, no, nothing
20 further to present. Thank you.
21 THE COURT: Anything else that LabMD wants to say?
22 MR. RUBINSTEIN: Your Honor, it's been extensively
23 briefed. If you have any questions, we are glad to answer
24 them. Other than that, we have nothing further.
25 THE COURT: All right. I will take it under
United States District Court
Northern District of Georgia
96
In re LabMD, Briefng Book Page 208
1 advisement.
2 And if there is nothing else to cover today or to
3 present, we will be in recess.
4 MR. RAIDER: Your Honor, just one quick point
5 before we go to recess?
6 Was Exhibit 14 admitted into evidence? That's the
7 Monday, January 6th, 2014, letter? If so, we would like to
8 tender it into evidence.
9 THE COURT: Well, did you tender it?
10 MR. RAIDER: I thought I did.
11 THE COURT: Did you object to it?
12 MR. GORJI: We didn't object, Your Honor.
13 THE COURT: I guess it's in.
14 MR. RAIDER: Thank you, Your Honor.
15 THE COURT: Which is, by the way, what my records
16 reflect was that it was tendered and not objected to and it
17 had been admitted, so you didn't really need to do that. But
18 now it's clear to everybody.
19 MR. RAIDER: Thank you.
20 THE COURT: All right. Now we will be in
21 recess.
22 (Proceedings adjourn at 11:46 a.m.)
23
24
25
United States District Court
Northern District of Georgia
97
In re LabMD, Briefng Book Page 209
1 C E R T I F I C A T E
2
3 UNITED STATES OF AMERICA :
:
4 NORTHERN DISTRICT OF GEORGIA :
5
I, Nicholas A. Marrone, RMR, CRR, Official Court
6
Reporter of the United States District Court for the Northern
7
District of Georgia, do hereby certify that the foregoing 98
8
pages constitute a true transcript of proceedings had before
9
the said Court, held in the city of Atlanta, Georgia, in the
10
matter therein stated.
11
In testimony whereof, I hereunto set my hand on
12
this, the 7th day of May, 2014.
13
14
15
16
/s/ Nicholas A. Marrone
17 _________________________________________
NICHOLAS A. MARRONE, RMR, CRR
18 Registered Merit Reporter
Certified Realtime Reporter
19 Official Court Reporter
Northern District of Georgia
20
21
22
23
24
25
United States District Court
Northern District of Georgia
98
In re LabMD, Briefng Book Page 210
In re LabMD, Briefng Book Page 211
In re LabMD, Briefng Book Page 212
In re LabMD, Briefng Book Page 213
 
 
UNITED STATES OF AMERICA
BEFORE THE FEDERAL TRADE COMMISSION
OFFICE OF ADMINISTRATIVE LAW JUDGES
____________________________________
)
In the Matter of ) PUBLIC
)
LabMD, Inc., ) Docket No. 9357
a corporation, )
Respondent. )
)
___________________________________ )
RESPONDENT’S MOTION TO ADMIT RX-542
Pursuant to Additional Provision 16 to this Court’s Scheduling Order, and Commission
Rule 3.43 (16 C.F.R. § 3.43), Respondent LabMD, Inc. (“LabMD”) moves for admission of RX-
542 into evidence.
RX-542 is a relevant and probative June 11, 2014 letter from Chairman Darrell Issa of the
U.S. House of Representatives, Committee on Oversight and Government Reform (“OGR”), to
Chairwoman Edith Ramirez of the Federal Trade Commission (“FTC”) (Ex. 1; the “OGR
Letter”).
1
Citing testimony given to OGR by Robert Boback, the CEO of Tiversa, the OGR
Letter states that evidence given to FTC by Tiversa, including evidence regarding the origin of
the 1718 File, is “incomplete and inaccurate.” Id. It also states that Tiversa “may not have been
truthful” with federal agencies. It concludes that OGR expects FTC to “cooperate fully with any
subsequent requests for documents or transcribed witness interviews [of FTC employees].” Id.
FTC admits that the 1718 File’s supposed exposure on peer-to-peer (“P2P”) networks is
the reason for its three year, eight month investigation of LabMD and the lynchpin of this
                                                           
1
The OGR Letter was brought to the attention of this Court by counsel for Richard Wallace, a
former Tiversa, Inc. (“Tiversa”) employee who is negotiating immunity with OGR in connection
with its investigation of Tiversa’s activities. Rough Trial Tr. at 13 (June 12, 2014).
In re LabMD, Briefng Book Page 214
    PUBLIC 
2 
enforcement case. See Trial Tr. at 31 (May 20, 2014); Hill Expert Rep. at 15 ¶¶ 43-44; Hill Trial
Tr. at 218-20; Van Dyke Trial Tr. at 643, 679; Shields Expert Rep. at 11; Kam Expert Rep. at 6.
2
Although Mr. Boback may now state otherwise, sometime in 2009, FTC and Tiversa cut a deal
under which Tiversa funneled the 1718 File to FTC after FTC sent a civil investigative demand
to Tiversa’s sham corporation, “The Privacy Institute.” See CX-703 at 142-43; RX-526 at 16
(FTC’s Amended Response to RFA No. 20).
From the outset, LabMD has vigorously contended that Tiversa took the 1718 File
directly from a LabMD workstation. If Tiversa did so, whether through LimeWire or otherwise,
then the 1718 File was obtained illegally. See O.C.G.A. §§ 16-9-93(a), (c). And if the 1718 File
was acquired illegally or improperly, then it and all derivative evidence including the Day Sheets
and everything else from FTC’s investigation should be excluded, and the case dismissed. See
Atlantic Richfield Co. v. FTC, 546 F.2d 646, 651 (5th Cir. 1977) (“[I]f the FTC act[ed]
improperly or illegally in obtaining evidence for the adjudicative proceeding … [Respondent]
should be entitled to have any evidence so obtained -- as well as its ‘fruits’ -- excluded from the
proceeding or to obtain a reversal of any adverse judgment founded upon improperly admitted
‘tainted’ evidence.”); Knoll Associates v. FTC, 397 F.2d 530, 537 (7th Cir. 1968) (remanding
case to FTC with instruction to reconsider evidence without documents and testimony given or
produced by or through witness who stole materials from respondent); see also Rochin v.
California, 342 U.S. 165, 172-74 (1952).
Although FTC’s case is premised on Tiversa’s claim that the 1718 File was found on P2P
networks, FTC has offered no evidence of authentication. CX-19, the only document “proving”
                                                           
2
Among other things, FTC’s 1718 File investigation was the reason the Sacramento police called
Complaint Counsel when police officers discovered, during the arrest of municipal-utility-fraud-
suspects, that approximately 40 LabMD Day Sheets had been dropped in the spare bedroom of a
house. See CX-720 at 27 (Dec. 17, 2013); CX-90; CX-94 at 2; see also RX-468; RX-472.  
In re LabMD, Briefng Book Page 215
    PUBLIC 
3 
that the 1718 File was found on a P2P network, is a one-page document obtained by FTC from
Tiversa and cited as “evidence” without any foundation or authentication. See CX-19. In fact,
this document supposedly was prepared by Richard Wallace, who has asserted his Fifth
Amendment privilege against self-incrimination and is awaiting an immunity grant before
testifying in this action. See RX-541 at 29 (Boback testifying that Rick Wallace “could have”
“made up” CX-19). Critically, at all times relevant, FTC knew that Tiversa had a commercial
interest in FTC enforcement actions.
3
But it appears FTC never “checked” Tiversa’s work.”
4
FTC’s case therefore depends, as a threshold matter, on Robert Boback’s credibility and
the veracity of his story about the origin of the 1718 File. Yet Boback has testified
                                                           
3
See Dissenting Statement of Commissioner J. Thomas Rosch, Petitions of LabMD, Inc. and
Michael J. Daugherty to Limit or Quash the Civil Investigative Demands, FTC File No. 1023099
(June 21, 2012) (stating “Tiversa … is a commercial entity that has a financial interest in
intentionally exposing and capturing sensitive files on computer networks, and a business model
of offering its services to help organizations protect against similar infiltrations”); see also
Jaikumar Vijayan, FTC seeks extensive information from firms being investigated for p2p
breaches, ComputerWorld (Feb. 25, 2010), available at http://www.computerworld.com/s/
article/9162560/FTC_seeks_extensive_information_from_firms_being_investigated_for_P2P_br
eaches?pageNumber=2 (concluding, after interview of Boback regarding FTC’s investigation
into P2P breaches, that a “crackdown by the FTC against those involved in such breaches could
benefit companies such as Tiversa, which help businesses figure out if they are leaking protected
data on P2P networks”).  
4
FTC’s investigation of LabMD was harshly criticized by Judge Duffey in the U.S. District
Court for the Northern District of Georgia. See generally LabMD v. FTC, No. 1:14-cv-810,
Hr’g. Tr. at 77, 80-81 (May 9, 2014) (Court exclaiming “holy cow” in response to FTC’s failure
to prove chain of custody with respect to Day Sheets, and “Boy, that’s a sad comment on your
agency,” in response to FTC’s failure to interview the people who had the Day Sheets). FTC’s
apparent failure to authenticate Tiversa’s claims regarding the exposure of the 1718 File on P2P
networks is even more troubling given that FTC has the burden of proof and that federal lawyers
with prosecutorial powers have heightened responsibilities. See, e.g., James E Moliterno, The
Federal Government Lawyer’s Duty to Breach of Confidentiality, 14 TEMP. POL. & CIV. RTS. L.
REV. 633, 639 (2006) (“Courts expect that when dealing with a government lawyer, they get a
more candid picture of the facts and the legal principles governing the case.”). FTC’s
prosecutorial power should have been treated as a responsibility, not a license. Given that FTC
obtained the 1718 File in 2009 (see CX-703 at 142-43), it strains credulity to suggest that the
FTC never independently verified where Tiversa “found” the 1718 File and that this matter never
came up again until the eve of Mr. Boback’s testimony in November, 2013 or on May 30, 2014.  
In re LabMD, Briefng Book Page 216
    PUBLIC 
4 
inconsistently, telling any number of different origin stories without any competent,
authenticated documentary evidence backing up any of his various claims.
5
Unless one of Mr. Boback’s many stories about the 1718 File’s origin is to be believed,
FTC’s case against LabMD is based on a crime (Tiversa’s take of the 1718 File from LabMD’s
workstation) and a lie (the claim that the 1718 File was found on a P2P network). Consequently,
the OGR Letter is highly relevant and probative, and it has a direct bearing on the very
foundation of FTC’s case.
FTC argues only that the OGR Letter should be excluded from evidence on the ground of
hearsay. Rough Trial Tr. at 18, 22, 24 (June 12, 2014). However, in doing so it ignores 16
C.F.R. § 3.43(b), which provides that “if otherwise meeting the standards for admissibility
described in this paragraph, depositions, investigational hearings, prior testimony in Commission
or other proceedings, expert reports, and any other form of hearsay, shall be admissible and shall
not be excluded solely on the ground that they are or contain hearsay.”
6
See also in re Polypore
Int’l, Inc., 2010 FTC LEXIS 62, at *6-7 (July 10, 2010) (noting that hearsay evidence may be
received in FTC proceedings).
                                                           
5
Compare, respectively, CX-703 (excerpts of Deposition Testimony of Robert Boback dated
Nov. 21, 2013) at 50-51, 60-64; 40; 73; 9; 42; 112-15; 50; with RX-541 (excerpts of Deposition
Testimony of Robert Boback dated June 7, 2014) at 22, 29; 42; 67, 74, 80; 82; 61-62; 29; 81
(offering different testimony regarding how CX-19 was prepared; whether Tiversa searched for
File 1718’s hash; whether Tiversa downloaded files to find the 1718 File; whether Tiversa
searched P2P networks or its own system to find the 1718 File; whether Tiversa spoke with FTC
specifically about LabMD; whether the 1718 File escaped via a thumb drive or if Wallace made
up the IP addresses; whether Tiversa found the 1718 File at four IP addresses). Tellingly, FTC
has not identified a single consumer “victim” in this case. Yet, FTC’s experts testified that at
least 3,000 people should have suffered identity theft from the 1718 File and 164 people from the
Day Sheets. See Kam Trial Tr. at 522-24; Van Dyke Trial Tr. at 619. Therefore, either FTC’s
experts’ analyses are terribly wrong or the 1718 File was taken from LabMD’s workstation by
Tiversa and not “found” on P2P networks, precisely as LabMD has contended all along.
6
FTC did not claim admission of the OGR Letter would be duplicative, present hardship to a
party or delay the proceedings. See 16 C.F.R. § 3.43(b).
In re LabMD, Briefng Book Page 217
    PUBLIC 
5 
Under this relaxed standard, the sworn testimony quoted in the OGR Letter – which
directly relate to the credibility of prior statements made by Tiversa and Mr. Boback – are
admissible. See 16 C.F.R. §§ 3.43(b), (d)(1). Furthermore, OGR’s statements in the letter are
admissible as part of a congressional investigation, where the circumstances do not indicate a
lack of trustworthiness. See F.R.E. 803(8) (exception to hearsay for public records).
Therefore, Respondent respectfully requests that the Court admit RX-542.
Dated: June 16, 2014
Respectfully submitted,
/s/ Reed D. Rubinstein
Reed D. Rubinstein
William A. Sherman, II
Sunni R. Harris
Dinsmore & Shohl, L.L.P.
801 Pennsylvania Ave., NW, Suite 610
Washington, D.C. 20006
Telephone: 202.372.9120
Fax: 202.372.9141
Email: [email protected]
/s/ Daniel Z. Epstein
Daniel Z. Epstein
Kent G. Huntington
Patrick J. Massari
Cause of Action
1919 Pennsylvania Ave., NW, Suite 650
Washington, D.C. 20006
Phone: 202.499.4232
Fax: 202.330.5842
Counsel for Respondent
In re LabMD, Briefng Book Page 218
EXHIBIT
1
In re LabMD, Briefng Book Page 219
In re LabMD, Briefng Book Page 220
In re LabMD, Briefng Book Page 221
In re LabMD, Briefng Book Page 222
UNITED STATES OF AMERICA
BEFORE THE FEDERAL TRADE COMMISSION
OFFICE OF ADMINISTRATIVE LAW JUDGES
____________________________________
)
In the Matter of )
)
LabMD, Inc., ) Docket No. 9357
a corporation, )
Respondent. )
)
____________________________________)
[PROPOSED] ORDER GRANTING RESPONDENT LABMD, INC.’S
MOTION TO ADMIT RX-542
Having considered Respondent LabMD, Inc.’s Motion to Admit RX-542 and all
supporting and opposition papers, and good cause appearing, it is hereby ORDERED that
Respondent’s Motion is GRANTED and RX-542 is admitted into evidence.
ORDERED:
D. Michael Chappell
Chief Administrative Law Judge
Date:
In re LabMD, Briefng Book Page 223
CERTIFICATE OF SERVICE
I hereby certify that on June 16, 2014, I filed the foregoing document electronically using
the FTC’s E-Filing System, which will send notification of such filing to:
Donald S. Clark, Esq.
Secretary
Federal Trade Commission
600 Pennsylvania Ave., NW, Rm. H-113
Washington, DC 20580
I also certify that I delivered via electronic mail and first-class mail a copy of the
foregoing document to:
The Honorable D. Michael Chappell
Chief Administrative Law Judge
Federal Trade Commission
600 Pennsylvania Ave., NW, Rm. H-110
Washington, DC 20580
I further certify that I delivered via electronic mail and first-class mail a copy of the
foregoing document to:
Alain Sheer, Esq.
Laura Riposo VanDruff, Esq.
Megan Cox, Esq.
Margaret Lassack, Esq.
Ryan Mehm, Esq.
Jarad Brown, Esq.
John Krebs, Esq.
Division of Privacy and Identity Protection
Federal Trade Commission
600 Pennsylvania Ave., N.W.
Mail Stop NJ-8122
Washington, D.C. 20580
In re LabMD, Briefng Book Page 224
    PUBLIC 
2
 
CERTIFICATE OF ELECTRONIC FILING
I certify that the electronic copy sent to the Secretary of the Commission is a true and
correct copy of the paper original and that I possess a paper original of the signed document
that is available for review by the parties and the adjudicator.
Dated: June 16, 2014 By: /s/ Michael D. Pepson