U.S. GOVERNMENT PRINTING OFFICE

WASHINGTON : 

For sale by the Superintendent of Documents, U.S. Government Printing Office

Internet: bookstore.gpo.gov Phone: toll free (866) 512–1800; DC area (202) 512–1800

Fax: (202) 512–2104 Mail: Stop IDCC, Washington, DC 20402–0001

87–176 PDF 2014

LIMITLESS SURVEILLANCE AT THE FDA: PROTECTING THE RIGHTS OF FEDERAL WHISTLEBLOWERS 

HEARING 

BEFORE THE

COMMITTEE ON OVERSIGHT 

AND GOVERNMENT REFORM 

HOUSE OF REPRESENTATIVES 

ONE HUNDRED THIRTEENTH CONGRESS 

SECOND SESSION 

FEBRUARY 26, 2014 

Serial No. 113–88 

Printed for the use of the Committee on Oversight and Government Reform 

( 

Available via the World Wide Web: http://www.fdsys.gov 

http://www.house.gov/reform 

(II) 

COMMITTEE ON OVERSIGHT AND GOVERNMENT REFORM 

DARRELL E. ISSA, California, Chairman 

JOHN L. MICA, Florida 

MICHAEL R. TURNER, Ohio 

JOHN J. DUNCAN, JR., Tennessee 

PATRICK T. MCHENRY, North Carolina 

JIM JORDAN, Ohio 

JASON CHAFFETZ, Utah 

TIM WALBERG, Michigan 

JAMES LANKFORD, Oklahoma 

JUSTIN AMASH, Michigan 

PAUL A. GOSAR, Arizona 

PATRICK MEEHAN, Pennsylvania 

SCOTT DESJARLAIS, Tennessee 

TREY GOWDY, South Carolina 

BLAKE FARENTHOLD, Texas 

DOC HASTINGS, Washington 

CYNTHIA M. LUMMIS, Wyoming 

ROB WOODALL, Georgia 

THOMAS MASSIE, Kentucky 

DOUG COLLINS, Georgia 

MARK MEADOWS, North Carolina 

KERRY L. BENTIVOLIO, Michigan 

RON DESANTIS, Florida 

ELIJAH E. CUMMINGS, Maryland, Ranking 

Minority Member 

CAROLYN B. MALONEY, New York 

ELEANOR HOLMES NORTON, District of 

Columbia 

JOHN F. TIERNEY, Massachusetts 

WM. LACY CLAY, Missouri 

STEPHEN F. LYNCH, Massachusetts 

JIM COOPER, Tennessee 

GERALD E. CONNOLLY, Virginia 

JACKIE SPEIER, California 

MATTHEW A. CARTWRIGHT, Pennsylvania 

TAMMY DUCKWORTH, Illinois 

ROBIN L. KELLY, Illinois 

DANNY K. DAVIS, Illinois 

PETER WELCH, Vermont 

TONY CARDENAS, California 

STEVEN A. HORSFORD, Nevada 

MICHELLE LUJAN GRISHAM, New Mexico 

Vacancy 

LAWRENCE J. BRADY, Staff Director 

JOHN D. CUADERES, Deputy Staff Director 

STEPHEN CASTOR, General Counsel 

LINDA A. GOOD, Chief Clerk 

DAVID RAPALLO, Minority Staff Director 

(III) 

C O N T E N T S 

Page 

Hearing held on February 26, 2014 ....................................................................... 1 

WITNESSES 

The Hon. Charles E. Grassley, A U.S. Senator from the State of Iowa 

Oral Statement ................................................................................................. 9 

Written Statement ............................................................................................ 13 

Mr. Walter Harris, Chief Operating Officer and Acting Chief Information 

Officer, U.S. Food and Drug Administration, Accompanied by Jeffrey 

Shuren, M.D., Director, Center for Devices and Radiological Health, U.S. 

Food and Drug Administration, and Ruth McKee, Associate Director for 

Management, Center for Devices and Radiologic Health, U.S. Food and 

Drug Administration 

Oral Statement ................................................................................................. 21 

Written Statement ............................................................................................ 24 

Ms. Angela Canterbury, Director of Public Safety, Project on Government 

Oversight 

APPENDIX 

HHS Office of IG Report, Submitted by Rep.Issa ................................................. 88 

Joint Staff Report, Submitted by Rep. Issa ........................................................... 119 

Letter to Rep. Cummings from Rep. Issa, Submitted by Rep. Issa ..................... 271 

(1) 

LIMITLESS SURVEILLANCE AT THE FDA: PROTECTING THE RIGHTS OF FEDERAL WHISTLEBLOWERS 

Wednesday, February 26, 2014 

HOUSE OF REPRESENTATIVES, COMMITTEE ON OVERSIGHT AND GOVERNMENT REFORM, WASHINGTON, D.C. 

The committee met, pursuant to call, at 10:00 a.m., in Room 

2154, Rayburn House Office Building, Hon. Darrell E. Issa [chairman of the committee] presiding. 

Present: Representatives Issa, Mica, Turner, Duncan, Jordan, 

Walberg, Lankford, Amash, Farenthold, Woodall, Massie, Collins, 

Meadows, Bentivolio, Cummings, Maloney, Lynch, Connolly, 

Speier, Kelly, and Lujan Grisham. 

Staff Present: Alexia Armstrong, Legislative Assistant; Molly 

Boyl, Deputy General Counsel and Parliamentarian; Lawrence J. 

Brady, Staff Director; Ashley H. Callen, Deputy Chief Counsel for 

Investigations; Sharon Casey, Senior Assistant Clerk; John 

Cuaderes, Deputy Staff Director; Lamar Echols, Counsel; Adam P. 

Fromm, Director of Member Services and Committee Operations; 

Linda Good, Chief Clerk; Caroline Ingram, Professional Staff Member; Mark D. Marin, Deputy Staff Director for Oversight; Ashok M. 

Pinto, Chief Counsel, Investigations; Krista Boyd, Minority Deputy 

Director of Legislation/Counsel; Aryele Bradford, Minority Press 

Secretary; Jennifer Hoffman, Minority Communications Director; 

Elisa LaNier, Minority Director of Operations; Una Lee, Minority 

Counsel; Juan McCullum, Minority Clerk; and Dave Rapallo, Minority Staff Director. 

Chairman ISSA. The committee will come to order. 

The Oversight Committee’s mission statement is that we exist to 

secure two fundamental principles: First, Americans have a right 

to know that the money Washington takes from them is well spent; 

and, second, Americans deserve an efficient, effective government 

that works for them. 

Our duty on the Oversight and Government Reform Committee 

is to protect these rights. Our solemn responsibility is to hold government accountable to taxpayers, because taxpayers have a right 

to know what they get from their government. 

It is our job to work tirelessly in partnership with citizen watchdogs and whistleblowers to deliver the facts to the American people 

and bring genuine reform to the Federal bureaucracy. 

Before I deliver my opening statement, because we have Senator 

Grassley here, I am going to ask unanimous consent that the IG 

report released last night entitled Department of Health and 

2 

Human Services IG Report, ‘‘Review of the Food and Drug Administration’s Computer Monitoring of Certain Employees in Its Center 

for Devices and Radiological Health’’ be placed in the record. Without objection, so ordered. 

Additionally, I ask that the joint staff report entitled ‘‘Limitless 

Surveillance at the FDA: Protecting the Rights of Federal Whistleblowers,’’ be placed in the record. 

Mr. CUMMINGS. Mr. Chairman? 

Chairman ISSA. Yes. 

Mr. CUMMINGS. I have no objections, but I just want to make 

sure it is clear that that is the staff report of the Republicans. Is 

that right? 

Chairman ISSA. It is a joint report of the House and Senate Republicans. 

Mr. CUMMINGS. House and Senate. So the Senate Democrats 

were not involved. In this report, the Senate Democrats—— 

Chairman ISSA. This report is a result of an investigation in 

which all your Democrats’ staff were in there, but we did not ask 

for or provide a long comment period to your people. You are entitled to place a minority staff report at your convenience. You have 

the same information. 

Mr. CUMMINGS. We will definitely do that. I just wanted to make 

it clear on the record. 

Chairman ISSA. Absolutely. 

Without objection, so ordered. They are both in the record. 

And I will place my entire opening statement in the record and 

be brief. 

Today’s hearing is about a questionable practice at the FDA, one 

that has been under investigation for over 2 years—or almost 2 

years, July of 2012, by the Inspector General, one that we do not 

consider to be political in any way, shape, or form, or partisan in 

any way, shape, or form. 

We consider it to be questionable, if not despicable, that whistleblowers, a known whistleblower and others, appear to have been 

targeted for an investigation proactively monitoring, effectively a 

wiretap on their computers, in order to see if they could get the 

dirt on employees so that they could take action. 

The FDA justified this based on a leak to the New York Times. 

However, to the best of our investigation, rather than working retrospectively to see if they could discover who had in the past 

leaked, they began a practice of monitoring computers, one that 

captured all information, forwarded all information, including, at a 

minimum, correspondence as whistleblowers with three members of 

Congress’s staff, Senator Grassley’s, our staff, and Chris Van 

Hollen of Maryland. 

It does not matter whether it is one or all. It does not matter 

whether it is a Republican or a Democrat. This committee believes 

in whistleblowers, encourages whistleblowers, and particularly believes that communications with members of Congress, the other 

branch, Article 1, are, in fact, off limits to that kind of monitoring. 

It appears as though no protections were placed on that, but, 

rather, this was an attempt at ‘‘gotcha.’’ There may have been good 

reason to be concerned. An investigation into leaks may have been 

very justified. In this case, we are not questioning whether or not 

3 

an investigation should have occurred, but, rather, the tactics and 

the lack of protection there. 

Today we are holding this hearing, and we are pleased to welcome Senator Grassley, whose investigation really kicked this off 

and whose staff has worked hand in hand, along with the Democratic members of this committee’s staff, on hearing all of the witnesses. 

I might note, during the period of July 2012, when this began, 

until now, whistleblowers involved in this have been reticent to go 

on the record. They have wanted to deliver with as few people 

hearing what they have to say as possible and then let the facts 

speak for themselves. 

In the purest sense, that is what whistleblowers should do. In 

the purest sense, we should have an independent investigation that 

discovers the facts with limited testimonial by the whistleblowers. 

Their concern when they are reporting, essentially, whistleblower 

retaliation is certainly understandable. 

Neither the IG nor the minority on this committee has had an 

opportunity to speak to those whistleblowers. I will continue to encourage them to speak to both the IG and minority staff, but it is 

their decision. 

A whistleblower may come to one member of Congress, any one 

member of Congress, in my opinion, and that member of Congress 

should proceed on his constitutional or her constitutional responsibility and protect the whistleblower to the greatest extent possible. 

This committee will also always support that protection. 

The misconduct that we are looking at is not just overreach. It 

mirrors a famous book and movie ripped from the pages of George 

Orwell’s ‘‘1984.’’ Constant monitoring of your screens. The only 

thing that was missing, of course, was a camera looking both ways. 

I am here to say that the Federal employees know that every 

communication they do on government property, on government 

time, or using government assets, or doing government business is 

subject to the Federal Government looking at it. There is no expectation of privacy. 

But that is not to say that targeting is appropriate. It is not to 

say that these five scientists’ and doctors’ concerns are not reasonable. They are. 

If there is a reason on behalf of the government to look at the 

use of government assets, government communication, of course, 

we expect the Executive Branch to do that. 

However, if there is going to be use of products such as Spector 

360, a product that captured every 5 seconds the screens of the 

computers being used and the keystrokes, then, quite frankly, it 

has to be done for all at every moment and then there have to be 

rules on how it can be used. 

I am not suggesting that. Just the opposite. The Federal workforce is a highly trusted force, and trust is what we depend on. At 

times, it is clear that that trust is broken and, when it is, there 

are appropriate remedies. 

But until that trust is broken, we depend on a skilled and motivated workforce that believes, as they should, that they are not 

working for Big Brother, that, in fact, they are trusted in their 

4 

roles and not being unreasonably spied on or targeted for disciplinary action. 

For that reason, we are holding this hearing today not as just an 

indictment of the FDA, which I think Senator Grassley will speak 

to, but as a recognition that all Federal employees need to be protected from an unreasonable activity, which, at least in this chairman’s opinion, is part of what went on at the FDA in targeting 

these five whistleblowers. 

Again, I will put the rest of my opening statement in the record. 

And I yield to the ranking member. 

Mr. CUMMINGS. Thank you very much, Mr. Chairman. 

Today we examine two distinct, but related, issues. First, we will 

review allegations that the FDA employees leaked trade secret and 

other confidential business information from companies seeking 

FDA approval of medical device applications. 

We will also review allegations by these employees that they 

were whistleblowers concerned about the safety of these medical 

devices and that the FDA retaliated against them by monitoring 

their computers. 

Whistleblowers play a critical role in rooting out waste, fraud, 

and abuse at Federal agencies and making our government more 

effective and efficient. They sometimes risk their careers. They 

sometimes risk their reputations to challenge the abuse of power. 

Our committee must take every allegation very seriously with regard to retaliation. I have said it before and I will say it again. We 

must at every point protect our whistleblowers. I am committed to 

that, and we are all committed to that. 

Unfortunately, the majority has taken a traditionally bipartisan 

issue, something that all committee members should be investigating together, and turned it into another partisan spectacle for 

which our committee has become well known. 

One of the most basic steps that our committee should have 

taken was to interview the FDA employees who had concerns. I remind all of us that everybody on this side of the aisle and everybody on that side of the aisle represents 700,000 people each, every 

one of us, the 435 members of our Congress. 

As the foundation for a responsible investigation, we should have 

met with them, asked them questions, learned about their concerns, and given them an opportunity to address evidence that may 

contradict their accounts. 

Instead, despite multiple requests from the Democratic side over 

the past year, the chairman declined to hold interviews with these 

employees, although he and Senator Grassley apparently have been 

communicating with them directly. 

These employees were never called in for standard committee 

interviews. And I heard what the chairman said. But at the same 

time, as I have said, we need to have an opportunity, just as Senator Grassley has, to talk to these folks, just as the chairman has. 

As a result, most committee members have no opportunity to 

talk to these employees and will not have the benefit of their input 

as we proceed. Again, we are talking about effectiveness and efficiency. We are talking about transparency with regard to the members of the committee. 

5 

The chairman also chose to issue a highly partisan Republican 

staff report this morning. Just to be clear, this is not an official 

committee report. It did not follow committee rules for an official 

committee report. It was not vetted for accuracy by the committee. 

Also unfortunate was the timing of today’s hearing. Over the 

past month, the Inspector General was finishing his own investigation and was poised to issue his report on this issue. 

Rather than wait a week or two so the committee could hear directly from the IG, the committee rushed to hold today’s hearing, 

apparently trying to beat the IG to the press. 

As a matter of fact, the press got the report before we did, their 

report. It is interesting that we have a situation where the IG was 

able to complete his report, and he provided it to the committee 

last night. 

Now, let us look at what the IG found, first, ‘‘The FDA’’—this is 

the IG—‘‘had reasonable concern that confidential information, including possibly trade secrets and/or CCI, had been disclosed by 

agency employees without authorization.’’ 

Companies that submitted applications had asked the FDA to investigate which employees leaked their trade secret and confidential commercial information in violation of the law. 

The IG found, ‘‘The FDA had provided notice to its scientists and 

all other users of the network through a network log-on banner 

that there was no right to privacy on the FDA computer network 

and that all data on the network was subject to interception by the 

FDA.’’ 

The committee’s investigation has identified no evidence that the 

FDA monitored employees to retaliate against them. The agency 

had a reasonable basis for initiating the monitoring, since the disclosure of proprietary information is prohibited by law and subject 

to criminal penalties. 

The IG also found that, regardless of whether the computer monitoring was allowable under the law, the FDA did not have sufficient safeguards to ensure that monitoring would avoid collecting 

communications with Congress, the Office of Special Counsel, or 

the IG. 

As I close, despite the reasonableness of the FDA’s concerns and 

its explicit warnings that employee computers could be monitored, 

the IG found that, ‘‘The FDA’’ ‘‘should have assessed beforehand 

and—with the assistance of legal counsel, whether potentially intrusive EnCase and Spector monitoring would be the most appropriate investigative tools and how to ensure that the use of these 

tools would be consistent with constitutional and statutory limitations on government searches.’’ 

The FDA has now implemented new policies that require written 

authorization from the chief operating officer to initiate monitoring 

and a legal review of the proposed monitoring by the chief counsel, 

including a determination that proposed monitoring is consistent 

with the Whistleblower Protection Act. 

Protecting the rights of whistleblowers is an issue we should all 

be working on together, and our committee has done so in the past. 

In 2012, this committee passed the Whistleblower Protection Enhancement Act, which was signed into law on November 27, 2012. 

6 

This is strong evidence that, when the committee operates on a 

bipartisan basis, we can accomplish very important and even 

groundbreaking accomplishments. I hope we can return to that 

type of bipartisanship in the future. I look forward to hearing from 

the witnesses. 

Mr. Chairman, I thank you for your indulgence. 

Chairman ISSA. Of course. 

I now ask unanimous consent the letter dated February 25th by 

me to the ranking member be placed in the record. Without objection, so ordered. 

Mr. Cummings, I might note that the IG report which came out 

at 4:30 last night was preceded by the staff report being given to 

your staff, which contained substantially all of the same information as the IG report, and we noticed on January 14th the FDA of 

our plan to have today’s hearing. 

At that time, we had no expectation that the IG was going to 

conclude. And, in fact, in a Herculean way, the administration 

managed to respond to the IG’s comments in two days, and the IG 

managed to get it out last night. We are proud of the fact that that 

report would not have been in our hands today had we not been 

scheduling this hearing. 

Mr. CUMMINGS. Well, Mr. Chairman, would the gentleman yield? 

Chairman ISSA. Of course. 

Mr. CUMMINGS. I think the IG and the administration wanted— 

the administration wanted to get that report out because it felt 

that it would be significant with regard to any hearing that we 

might hold. 

And so, therefore, those who might have commented from the administration reserved comment so that they could get the report 

out because we know that all of us have tremendous confidence in 

the IG. 

And I guess, going back to efficiency and effectiveness, that, if we 

have an IG report, an independent agency that has looked at these 

things very carefully, it would be nice to have that report before 

the hearing. To me, that is effectiveness and efficiency. 

Chairman ISSA. And the good news is we do have it. 

I might note, by the way, that I never spoke to any whistleblower. We can certainly ask Senator Grassley. I never spoke to 

them directly. 

Mr. CUMMINGS. Did your staff? 

Chairman ISSA. As you have said so many times, Mr. Cummings, 

the book ‘‘The Speed of Trust’’ is about trust being earned. 

The whistleblowers were unwilling to meet with members of your 

staff because they did not trust that this would not turn into retaliation. That is through their attorneys. And they are represented 

by counsel, what we have been told. 

So my staff encouraged them and has in no way dissuaded them 

from talking to your staff, and I openly this morning encourage 

them once again to come and meet with them. 

But, quite frankly, since this hearing is about inappropriate— 

now determined by the IG to be inappropriate targeting of whistleblowers using questionable tactics, you can understand why the 

whistleblowers, who, to my knowledge—I do not know, but they 

may or may not be some of the people targeted here—are reluctant 

7 

to be prosecuted, persecuted, and triggered again by an agency that 

they do not personally believe in. 

They do not trust their agency, and they do not trust those who 

would report back to their agency. That is not my fault. That is not 

your fault. But that is the reality that the whistleblowers have. 

Mr. CUMMINGS. Could we not have brought them in for interviews? 

Chairman ISSA. Yes. I could haul in whistleblowers and expose 

them to the—— 

Mr. CUMMINGS. We haul in people all the time. 

Chairman ISSA. I could expose them to the administration knowing about them and then retaliating against them. I could do that. 

But I will protect whistleblowers’ right to give us information. 

Without their testimony, we have independently—and the IG has 

independently reached the conclusions which we will see today. So 

I think the record speaks for itself. 

Whistleblowers made Senator Grassley and his staff aware of a 

problem, but independent investigation by the IG and by this committee—bipartisan investigation—have led us to the conclusions we 

will hear today. 

And, by the way, the hearing is not about the leak of information. It is about the unreasonable retaliation. I might caution you 

that we did not investigate the specifics of the leak of this material. 

It is certainly a knowledgeable fact. But our investigation began in 

the retaliation, not in that—— 

Mr. CUMMINGS. Just one more inquiry. 

Chairman ISSA. Of course. 

Mr. CUMMINGS. I know Senator Grassley is—— 

Chairman ISSA. He has been patient, and his time is limited. 

Mr. CUMMINGS. Thank you. 

This is a question. You know, life is short. And so you just said 

that you did not look at the allegations made by the whistleblowers. Is that what you are trying to say? 

Chairman ISSA. No. The whistleblowers made allegations that 

led to an investigation. Senator Grassley, I am sure, will cover this. 

The investigation independently determined what they had said. 

We are not relying on their allegations. They are not fact witnesses for purposes of the IG, Senator Grassley’s staff, or my staff. 

The result of both the pieces of paper, the package you have, are 

the results of independent—the IG and your staff and my staff and 

Senator Grassley’s staff—interviews. We did not need the whistleblowers except to be aware of a problem. 

The investigation is complete and does not need further testimony. In other words, there was no reason to expose the whistleblowers to the possibility of retaliation because their allegations 

have been confirmed independently. 

You believe it, and I believe it, and the IG believes it, that this 

retaliation that was done against these five people was, in fact, 

done. 

Mr. CUMMINGS. If the gentleman will yield. 

Chairman ISSA. Of course. 

Mr. CUMMINGS. The only thing I am getting to is that—and Senator Grassley, I am sure, will address this—if there is equipment 

being used in hospitals that is defective, that people are getting 

8 

diseases from, I mean, that’s—I mean, we got two issues here. I 

want to make sure that we deal with that. 

Because we can get so caught up in the political stuff that we 

forget the people who are the victims of some of this, one of 

which—and I don’t know whether it was from equipment, but I just 

had a constituent to die after giving birth to twins from disease 

that was contracted in the hospital this week. 

So I am trying to figure out will we—are we going—I mean, we 

got two parts here. We got the whistleblowers. And I think the reason why the whistleblowers bring information to us is so that we 

can do some reform—remember, that’s a part of our title—and try 

to make sure that the constituents that we serve are safe. 

So you are saying that we will not get to that piece of it? 

Chairman ISSA. No. Not at all. I am saying that the investigation 

was as to the retaliation. 

Dr. Smith, who was a qualified whistleblower, had deep concerns 

about the FDA’s process and validity of medical devices they certified, and he made allegations that the FDA was not doing their 

job properly. That’s the initial whistleblower activity, which was 

not disputed. 

The leak, justified in the FDA general counsel’s mind, which 

makes me question whether or not these reforms are any good 

when the general counsel was receiving the information, made 

them believe that they could monitor five employees prospectively 

on everything, including their communications with Congressman 

Van Hollen, Senator Grassley, and my staff. That is what we are 

researching today. 

I am not qualified, quite frankly, to look at the allegations of 

medical device effectiveness, and I don’t believe his initial claim 

came to our committee on the invalidity of the medical devices. 

But Dr. Smith, who is not a witness here today and is not part 

of it, was a qualified whistleblower. He had complaints, and he was 

making them. 

The investigation was not—supposedly not about his whistleblowing, but he became the target when they said that there had 

been a leak, which apparently there had. 

And I am perfectly happy to have people drift off onto the question of the leak in the New York Times. But what we do know is, 

although leaks to the New York Times occur all the time, we have 

whistleblower retaliation in the unreasonable, if you will, activities, 

in the opinion of the IG and in the opinion of this committee staff 

report. 

And that’s what the primary reason for the hearing is, is we do 

not want to have a chilling effect on potential whistleblowers. 

But, more importantly, you and I know that we have to and we 

had better trust our Federal employees and not be spying on them 

24/7, even though we have a right to look at the material on which 

they work, if necessary. 

Mr. CUMMINGS. As I close, let me just say this. You talk about 

‘‘The Speed of Trust.’’ And I don’t want anybody watching this or 

hearing this to be left with the impression that folks on this side 

of the aisle, including our staffs, in some kind of way are not protective of whistleblowers. I don’t want that getting out into the universe because it’s simply not true. I would never say that. 

9 

Chairman ISSA. And, Mr. Cummings, I am not asserting that you 

are not trustworthy. What I am asserting—— 

Mr. CUMMINGS. And my staff. 

Chairman ISSA. —is that the whistleblowers were unwilling to. 

And I have been corrected on one thing. In 2009, under Chairman Towns, Dr. Smith provided thousands of pages to this committee in support of his whistleblower allegation. So that is really 

the beginning of Dr. Smith’s activity, as far as this committee goes. 

And he was a qualified whistleblower, having come to Chairman 

Towns and this committee with his concerns—and I think other 

committees—with his concerns about the FDA’s activity. 

And, again, even though I also serve on Energy and Commerce, 

I am not claiming that I can understand the details of his allegations. 

And I would like, to the greatest extent possible, to caution all 

Members to primarily look at the question of whether the activities 

at the FDA, pursuant to their trying to find a leak, crossed a line 

and interrupted and would have a chilling effect on whistleblowers, 

which I think is what our committee’s primary jurisdiction is. 

Mr. CUMMINGS. And, Mr. Chairman, which is my primary concern, also. 

Chairman ISSA. Okay. Senator Grassley, you have been incredibly patient. You have heard more testimony than you planned to. 

And, with that, such time as you may consume. 

WITNESS STATEMENTS 

STATEMENT OF THE HON. CHARLES E. GRASSLEY, A UNITED 

STATES SENATOR FROM THE STATE OF IOWA 

Senator GRASSLEY. Before I read, I would like to say a couple 

things. 

Chairman ISSA. Our mics on this side don’t amplify as well. They 

need to be much closer. They are House mics. 

Senator GRASSLEY. Two things I would like to say before I read, 

one, generally about whistleblowing. In 33 years, under both Republicans and Democrats, I found the problem the same, whatever 

bureaucracy you are talking about. Whistleblowers are about as 

welcome in a bureaucracy as skunks at a picnic. There is a great 

deal of peer pressure to go along to get along. 

And then, specifically in regard to the FDA, just so everybody 

knows, we have a Democrat President, but going back to 2003, 

when I first got involved with whether or not the scientific process 

was being respected within the FDA and respected scientists coming forward—first was Vioxx and then several things since then— 

we have found problems with the respect of scientists and the respect of the scientific process within that agency, regardless of who 

was President. 

Thank you, Chairman Issa, for calling this important hearing 

and for the great work that you and your staff have done. Together, we have conducted a detailed investigation into the FDA 

aggressive surveillance of whistleblowers. 

A group of FDA scientists expressed concern about the safety of 

certain devices under review by the agency. They expressed their 

concern to the President’s transition team and to Congress. They 

10 

also contacted the Office of Special Counsel, which is an agency, as 

you know, created by Congress to receive whistleblower complaints 

and protect whistleblowers from retaliation. 

The FDA knew that contacts between whistleblowers and the Office of Special Counsel are confidential and protected by law. However, the FDA was intently spying on whistleblowers. There was no 

effort to avoid snooping on legally protected communications. 

This surveillance was much more intense than routinely monitoring of government employees on government computers. It was 

far more invasive than what would be necessary to detect inappropriate use of computer systems. 

The agency captured a picture of whatever was on the screen 

every 5 seconds, as you have said, and recorded every keystroke 

typed. Again, the FDA did not monitor every FDA employee this 

aggressively, just the whistleblowers. 

When we were—first spoke to the FDA in January 2012, they 

tried to dodge the issue. When I started asking questions, FDA officials seemed to suffer from a sudden case of collective amnesia. 

It took the FDA more than 6 months to answer my letter asking 

about its surveillance of its own employees. When I finally received 

a response, it didn’t even answer the simplest of questions, such as 

who authorized the targeted operation. Worse than that, it was 

misleading in its denials about intentionally intercepting communications with Congress. 

When I asked them why they couldn’t just answer some simple 

questions, they told my staff that the response was under review 

by, ‘‘the appropriate authorities in the administration.’’ The FDA’s 

non-answers and doublespeak would have fit right into some 

George Orwell novel. 

The work our staffs have done together uncovered answers to 

many of those initial questions. Today we will hear from some of 

the FDA employees involved in the surveillance. 

There can be legitimate reasons to monitor the use of government computers by government employees; however, as our joint 

report shows, FDA officials gave little, if any, thought to the legal 

limits that might restrict their power to monitor their employees. 

No one at the FDA made any attempt to limit the collection of 

legally protected communications with attorneys, with the Office of 

Special Counsel, or with Congress. The FDA trampled on the privacy of its employees and their right to make legally protected disclosures of waste, fraud, and abuse. 

These whistleblowers thought the FDA was caving to pressure 

from the companies that were applying for FDA approval. I don’t 

know whether they were right. But they have a legal right to express those concerns. 

After expressing their safety concerns, two whistleblowers were 

fired, two more were forced to leave FDA, and five of them were 

subjected to an intense spying campaign. 

At the beginning of FDA Commissioner Hamburg’s term, she 

said that whistleblowers exposed critical issues within the FDA. 

She vowed to create a culture that values whistleblowers. 

By the way, that is a promise I have had from several people 

predecessor to her coming to my office, wanting confirmation, making those same promises. 

11 

In fact, in 2009, Commissioner Hamburg said ‘‘I think whistleblowers serve an important role.’’ 

I wanted to believe Commissioner Hamburg when she testified 

before the Senate during her confirmation. I wanted to believe her 

when she said she would protect whistleblowers at the FDA. However, in this case, the FDA was certainly not a whistleblowerfriendly place to work, and I have spoken about how that’s been 

the case since at least my involvement since 2003. 

The FDA managers believed that the whistleblowers were leaking confidential information improperly, but the managers who— 

claimed that there were many other problems with the job performance of the targeted employees. 

Performance issues, of course, should be handled by directly supervising and managing employees. Instead, the FDA asked the 

HHS Office of Inspector General to investigate whether the employers had violated the law. 

The Inspector General declined on multiple occasions, but FDA 

managers kept asking for a criminal inquiry. Rather than simply 

managing its employees, the FDA then started spying on them. 

The managers kept looking for information that would convince 

the Inspector General to seek criminal prosecution. It was sort of 

management by investigation. And, of course, that’s no way to run 

an agency. 

According to the OIG, and later the Department of Justice, the 

FDA had no evidence of any criminal wrongdoing by the whistleblowers. None whatsoever was ever found. 

The FDA spent months using intrusive realtime surveillance of 

their employees’ computers looking for evidence of a crime. That 

time and effort would have been better spent supervising and managing the employees directly and making sure the employees were 

doing their job and not bothered from doing their job. 

The FDA claimed that their employees had no expectation of privacy on their FDA computers. However, when interviewed by congressional investigators, none of the FDA officials were willing to 

accept full responsibility for authorizing the surveillance. Apparently, no one was properly supervising this invasive surveillance 

program. 

The monitoring software used was so comprehensive it took 

countless hours just to review all the material. It was a detailed 

record of everything each of the scientists did all day, every day, 

for months. Hundreds of thousands of screen images had to be reviewed by FDA contractors, all at taxpayers’ expense. 

So what kind of legal guidance was provided to these contractors 

about what they could capture? None. We would not have known 

the full extent of the spying today if the FDA had not accidentally 

released 80,000 pages of fruits of its spying on the Internet. 

Talk about adding insult to injury. After collecting all of this information, in an effort to supposedly prevent leaks, the same agency ends up posting all of those documents online for the world to 

see. 

In these internal documents that FDA never wanted the public 

to see, it referred to the whistleblowers as ‘‘collaborators.’’ So you 

understand what I mean when I say whistleblowers are about as 

welcome in an agency as a skunk at a picnic. 

12 

FDA referred to our staffers as ‘‘ancillary actors.’’ And they happened to refer to newspaper reporters as ‘‘media outlet actors.’’ 

Let me tell you, you wouldn’t be doing any congressional investigation—well, you might do a little bit, because we could obviously 

ferret out some—but we wouldn’t be doing 90 percent of what we 

do on protecting whistleblowers and congressional oversight if it 

wasn’t enterprising newspaper or media people or whistleblowers 

coming forth with some things that they find wrong that we don’t 

even know where the skeletons are buried in the bureaucracy of 

this big government of ours. But, anyway, so they are collaborators, 

they are ancillary actors, or they are media outlet actors. 

The FDA claimed it was a mistake made by the company it hired 

to convert surveillance records for legal review. And, of course, that 

wasn’t true. The FDA incorrectly filled out a purchase order for the 

work. The FDA did not mark the documents as confidential or sensitive. It didn’t even fill out the form until after the work had been 

done. 

Our inquiry uncovered no record that the private contractors 

were told that the documents were sensitive. So, the FDA failed to 

classify these documents as sensitive and then tried to blame the 

small business company that it hired to convert the documents. 

This is the scene that comes up time and time again in this entire 

story that you are looking into today. 

The FDA has failed to accept responsibility for its actions or impose accountability. This is from an agency that purportedly wants 

to foster a culture where whistleblowers are valued, based upon Director Hamburg’s testimony to our committee. 

The FDA’s actions are, of course, disappointing, not just disappointing because of the history that we are now—of this history, 

but over a long period of time. And it was supposed to change when 

this commissioner was appointed. 

But it would be even worse if that agency fails to learn from its 

mistakes. And since 2003, I—and maybe people before me would 

say the same thing—would say that they have been looking for 

learning from the mistakes of the past. It doesn’t seem to happen. 

And most of these are just simple respect for the scientific process because, if you leave the politics out of it and let scientists do 

it, the scientific process of one scientist checking on another scientist’s work will prove itself, or that scientist isn’t going to be 

worth anything. 

These policies need to ensure that any monitoring is limited to 

achieving only the legitimate purpose. Watching on employees 

every minute leads to a culture of intimidation and fear, which not 

just the FDA, but bureaucracies generally, want whistleblowers to 

know about so that they don’t tell what they know is wrong. And, 

of course, that’s no way to encourage whistleblowers or it’s no way 

to show that you value their concerns. 

I thank you very much. 

Chairman ISSA. Thank you. 

[Prepared Statement of Senator Grassley follows:] 

13 


Insert offset folio 1 here 87176.001

Statement of Senator Charles E. Grassley 

Before the United States House of Representatives 

Committee on Oversight and Government Reform 

Hearing, "Limitless Surveillance at the FDA: Protecting the Rights of Federal Whistleblowers" 

February 26, 2014 

Thank you, Chairman Issa, for calling this important hearing and for the great work you and your 

staff have done. 

Together, we have conducted a detailed investigation into the Food and Drug Administration's 

(FDA) aggressive surveillance of whistle blowers. 

A group of FDA scientists expressed concerns about the safety of certain devices under review 

by the agency. 

They expressed their concerns to the President's transition team and to Congress. 

They also contacted the Office of Special Counsel, which is an agency created by Congress to 

receive whistleblower complaints and protect whistleblowers from retaliation. 

The FDA knew that contacts between whistleblowers and the Office of Special Counsel are 

confidential and protected by law. 

However, the FDA was intently spying on the whistleblowers. 

There was no effort to avoid snooping on legally protected communications. 

This surveillance was much more intense than the routine monitoring of government employees 

on government computers. 

It was far more invasive than what would be necessary to detect inappropriate use of the 

computer systems. 

The agency captured a picture of whatever was on the screen every five seconds, and recorded 

every keystroke typed. 

Again, the FDA did not monitor every FDA employee this aggressively -- just the 

whistleblowers. 

When we first spoke to the FDA in January 2012, they tried to dodge the issue. 

When I started asking questions, FDA officials seemed to suffer from a sudden case of collective 

amnesia. 
14 


Insert offset folio 2 here 87176.002

It took the FDA more than six months to answer my letter asking about its surveillance of its 

own employees. 

When I finally received the response, it didn't even answer the simplest of questions, such as 

who authorized this targeted operation. 

Worse than that, it was misleading in its denials about intentionally intercepting communications 

with Congress. 

When I asked them why they couldn't just answer some simple questions, they told my staff that 

the response was under review by the "appropriate officials in the Administration." 

The FDA's non-answers and double-speak would have fit right into a George Orwell novel. 

The work our staffs have done together uncovered answers to many of those initial questions. 

Today, we will hear from some of the FDA employees involved in the surveillance. 

There can be legitimate reasons to monitor the use of government computers by government 

employees. 

However, as our joint report shows, FDA officials gave little, if any, thought to the legal limits 

that might restrict their power to monitor employees. 

No one at the FDA made any attempt to limit the collection of legally protected communications 

with attorneys, with the Office of Special Counsel, or with Congress. 

The FDA trampled on the privacy of its employees and their right to make legally protected 

disclosures of waste, fraud, or abuse. 

These whistleblowers thought the FDA was caving to pressure from the companies that were 

applying for FDA approval. 

I don't know whether they were right, but they have a legal right to express those concerns. 

After expressing their safety concerns, two whistleblowers were fired. 

Two more were forced to leave the FDA. 

And five of them were subjected to an intense spying campaign. 

At the beginning of FDA Commissioner Hamburg's term, she said that whistle blowers exposed 

critical issues within the FDA. 

She vowed to create a culture that values whistleblowers. 
15 


Insert offset folio 3 here 87176.003

In fact, in 2009, she said, and I quote, "I think whistle blowers serve an important role." 

I wanted to believe Commissioner Hamburg when she testified before the Senate during her 

confirmation. 

I wanted to believe her when she said she would protect whistleblowers at the FDA. 

However, in this case, the FDA was certainly not a whistleblower-friendly place to work. 

FDA managers believed that the whistleblowers were leaking confidential information 

improperly. 

But the managers also claimed that there were many other problems with the job performance of 

the targeted employees. 

Performance issues should be handled by directly supervising and managing employees. 

Instead, the FDA asked the HHS Office of Inspector General to investigate whether the 

whistleblowers had violated the law. 

The Inspector General declined on multiple occasions, but FDA managers kept asking for a 

criminal inquiry. 

Rather than simply managing its employees, the FDA started spying on them. 

The managers kept looking for information that would convince the Inspector General to seek a 

criminal prosecution. 

It was a sort of management by investigation. 

That's no way to run an agency. 

According to the 010 and later the Department of Justice, the FDA had no evidence of any 

criminal wrongdoing by the whistleblowers. 

None would ever be found. 

The FDA spent months using intrusive real-time surveillance of their employees' computers, 

looking for evidence of a crime. 

That time and effort would have been better spent supervising and managing the employees 

directly. 

FDA claimed that their employees had no expectation of privacy on their FDA computers. 
16 


Insert offset folio 4 here 87176.004

However, when interviewed by congressional investigators, none of the FDA officials were 

willing to accept full responsibility for authorizing the surveillance. 

Apparently, no one was properly supervising this invasive surveillance program. 

The monitoring software used was so comprehensive, it took countless hours just to review all of 

the material. 

It was a detailed record of everything each of the scientists did, all day, every day, for months. 

Hundreds of thousands of screen images had to be reviewed by FDA contractors, all at taxpayer 

expense. 

So what kind oflegal guidance was provided to these contractors about what they could capture? 

None. 

We would not have known the full extent of the spying today if the FDA had not accidently 

released 80,000 pages of the fruits of its spying on the Internet. 

Talk about adding insult to injury. 

After collecting all of this information in an effort to supposedly prevent leaks, the same agency 

ends up posting all those documents online for the world to see. 

In these internal documents that FDA never wanted the public to see, it refers to the 

whistleblowers as "collaborators." 

FDA refers to congressional staff as "ancillary actors." 

FDA refers to the newspaper reporters as "media outlet actors." 

The FDA claimed it was a mistake made by the company it hired to convert surveillance records 

for legal review. 

That wasn't true. 

The FDA incorrectly filled out a purchase order for the work. 

The FDA did not mark the documents as confidential or sensitive, and it didn't even fill out the 

form until after the work had been done. 

Our inquiry uncovered no record that the private contractor was told that the documents were 

sensitive. 
17 


Insert offset folio 5 here 87176.005

So, the FDA failed to classify these documents as sensitive and then tried to blame the small 

business it hired to con vert the documents. 

This is the theme that comes up time and again in this story. 

The FDA has failed to accept responsibility for its actions or impose accountability. 

This is from an agency that purportedly wants to foster a culture where whistleblowers are 

valued. 

The FDA's actions are disappointing. 

But, it would be even worse ifit fails to learn from its mistakes. 

All agencies need to learn from these mistakes. 

There need to be more comprehensive, policies on employee computer monitoring across the 

entire government. 

These policies need to ensure that any monitoring is limited to achieve only a legitimate purpose. 

Watching an employee's every move leads to a culture of intimidation and fear. 

That's no way to encourage whistleblowers or value their concerns. 

Thank you for inviting me to testify today. 
18 

Chairman ISSA. And if you would take a few questions from the 

ranking member, I would appreciate it. 

Senator GRASSLEY. Yes. 

Chairman ISSA. Mr. Cummings. 

Mr. CUMMINGS. Thank you very much, Senator Grassley. And I 

really do thank you for being here today. Thank you for your patience. 

I have the utmost respect for you and your legacy as a champion 

of whistleblowers and whistleblower protections, and I really—on 

behalf of the American people, I thank you. 

Senator GRASSLEY. Thank you. 

Mr. CUMMINGS. As I said earlier, this has not traditionally been 

a partisan topic, I don’t think. You and Senator Akaka both sponsored the Whistleblower Protection Enhancement Act, and Chairman Issa and I sponsored the House version of that bill. I assume 

you agree that we accomplish much more when we are working together. 

Would you agree with that? 

Senator GRASSLEY. I have found—— 

Mr. CUMMINGS. I heard what you said about the skunk and all 

that. 

Senator GRASSLEY. Well, listen. I think your question is trying to 

put me between you two people, and I don’t relish being there. 

But I have found in the United States Senate—I don’t want to 

talk about the House of Representatives—I have found in the 

United States Senate that not a whole lot gets done if it’s not done 

in a bipartisan way. 

But that’s because our two institutions are different. We function 

under a 60-vote rule that requires, when you have 55 of one party, 

45 of the other, you have got to do something in a bipartisan way. 

And I have also found, as a member of the minority, that it 

makes a real difference who is chairman of the committee. When 

I was working with Senator Baucus on the Finance Committee and 

he was in the majority, I didn’t get much response from any administration without the help of the chairman. 

Mr. CUMMINGS. Have you had an opportunity to talk to the whistleblowers? 

Senator GRASSLEY. We have only talked to their attorneys. 

Mr. CUMMINGS. I see. 

Chairman Issa and I had a good discussion this morning prior 

to the hearing. And one of the things that he raised—and I 

agreed—it seems like this—and I want the witnesses to hear this— 

it seems to me that the issue comes down to this: When—first of 

all, there was a situation which screamed out for somebody to look 

into it. In other words, New York Times writing articles with trade 

secrets, it seems like the agency had a duty to at least look into 

it. 

Would you agree with that? 

Senator GRASSLEY. Would you please ask your question again. 

Mr. CUMMINGS. In other words, the way this whole thing started, 

apparently, are some stories in the New York Times with trade secrets in the New York Times that weren’t supposed to be there. 

Senator GRASSLEY. Okay. 

19 

Mr. CUMMINGS. And so I think it started off legitimately saying, 

‘‘Okay. We have got a problem here because this information is not 

supposed to be in the New York Times.’’ 

So would you agree that, at least starting, they had something 

that they needed to look into? Now, I am not saying they did it 

right. I am just asking you—— 

Senator GRASSLEY. Okay. I am not sure that I can answer your 

question. 

Mr. CUMMINGS. Okay. 

Senator GRASSLEY. But let me see if I can speak to it and give 

you some satisfaction. 

I think it gets down to a point of whether or not the information 

was accurate or not that these whistleblowers were talking about. 

We have not looked into the accuracy of that information. We have 

only looked into it from the standpoint that some people say there 

is some problems. 

And that’s where you get back to the point that I have made a 

couple times, not about the skunk, but about the scientific process, 

that we want an environment within the FDA where the scientific 

process works its way out and is not interfered by people that 

aren’t scientists or involved in that process. 

And I will only go back to one other instance a long time ago. 

But we have found that—in one instance years ago, we found email 

from industry that said, ‘‘Well, if you have got a problem with our 

product, talk to us.’’ 

Well, the point is that the FDA should not consider a manufacturer or a company across the table from them. The only people 

that should be across the table from the FDA scientists or regulators are the John Q. Public. 

Mr. CUMMINGS. Okay. And so, in this case, a group of FDA employees alleged that certain medical devices may have safety problems. 

Now, if their allegations are correct, that is obviously a huge 

problem for everyone who relies on these types of medical devices 

when they become ill or get in an accident. 

On the other hand, if these allegations are not correct, these 

FDA employees could be doing damage. They could be keeping safe 

medical devices off the market and out of the hands of doctors who 

use them to help people. 

And I think that you would agree that we—if devices should be 

on the market to save people’s lives and make them better, they 

ought to be there. Would you agree with that? 

Senator GRASSLEY. Well, the answer to that is ‘‘yes.’’ But how do 

you—how is that decision made? It’s not going to be made by us 

in Congress. 

Mr. CUMMINGS. I got that. 

Senator GRASSLEY. It’s going to be made by the scientific approach in the FDA. 

Mr. CUMMINGS. Just one more question, Mr. Chairman. 

Let me just get to this—the key question that the chairman and 

I were discussing this morning. 

It seems to me that, if they had done this—the investigative folk 

had done this in a retrospective way as opposed to a prospective 

20 

way, we probably would not have the issues—as many issues as we 

have today. Do you think? 

Senator GRASSLEY. Well, yes. But I have to surmise—because I 

can’t answer your question. But I have to surmise the reason it 

worked out the way it worked out is people weren’t getting the 

proper respect within the agency for their opinion. 

Mr. CUMMINGS. I see. 

Senator GRASSLEY. And their opinion could be wrong. But the 

scientific process is going to prove whether or not they were right 

or wrong. 

Mr. CUMMINGS. Well, again, I want to thank you for being here. 

I really appreciate it. 

Senator GRASSLEY. Thank you. 

Mr. CUMMINGS. And I look forward to working with you. 

Senator GRASSLEY. Please do. 

Mr. CUMMINGS. We need to get together and meet sometime. 

Senator GRASSLEY. I will take you to eat in the Members’ dining 

room, and I will pay for it, if you want to take me up on that. 

Mr. CUMMINGS. All righty. Thank you. 

Chairman ISSA. Senator Grassley, we know how hard it was for 

you to say that. 

Senator GRASSLEY. And it hurt. But since I said it, I will have 

to do it. 

Mr. CUMMINGS. I will hold you to it, too. 

Chairman ISSA. Thank you. We are going to take just a quick recess to set up the table. Thank you, Senator. 

[Recess.] 

Chairman ISSA. We now welcome our second panel. 

Dr. Jeffrey Shuren is the Director of the Center for Devices and 

Radiological Health at the FDA. Ms. Ruth McKee is the Associate 

Director for Management and the Executive Officer of the Center 

for Devices and Radiological Health. Mr. Walter Harris is Chief 

Operating Officer and Acting Chief Information Officer for the FDA 

and, presumably, the person that would approve such an activity 

in the future under the rules. And Ms. Angela Canterbury is the 

Director of Public Policy for the Project on Government Oversight, 

or POGO. 

And we welcome all of you. 

Pursuant to the committee’s rules for any non-Senators or House 

Members, would you please rise and take the oath. And please 

raise your right hands. 

Do you solemnly swear or affirm the testimony you are about to 

give will be the truth, the whole truth, and nothing but the truth? 

Please be seated. 

Let the record reflect that all witnesses answered in the affirmative. 

In order to allow time for questions, I would ask that you be as 

close to 5 minutes as possible in your opening statements. Your entire written opening statement will be placed in the record. 

And, Dr. Shuren, I understand you do not have an opening statement. Is that correct? 

Dr. SHUREN. That is correct. 

Chairman ISSA. Okay. In that case, we go to Ms. McKee. 

Ms. MCKEE. I don’t have one either. Mr. Harris is speaking. 

21 

Chairman ISSA. Okay. 

Mr. Harris? 

STATEMENT OF WALTER HARRIS 

Mr. HARRIS. Good morning, Chairman. 

Chairman Issa, Ranking Member Cummings, and members of 

the committee, I am Walter Harris, the Deputy Commissioner of 

Operations, Chief Operating Officer, and Acting Chief Information 

Officer at FDA. 

With me is Dr. Jeff Shuren, the Director of FDA’s Center for Devices and Radiological Health, and Ruth McKee, CDRH Associate 

Director for Management. 

I am pleased to be here today to discuss issues related to the 

monitoring of FDA’s personnel’s use of the agency’s IT systems. 

Safeguarding the confidential information that regulated entities 

share with FDA is critical to our ability to carry out FDA’s public 

health mission. 

FDA routinely receives and reviews trade secrets and confidential commercial information from medical product sponsors. This 

information is central to FDA’s determination of a medical product’s safety and efficacy. Without the ability to fully access and secure this proprietary information, FDA cannot accomplish its public 

health mission. 

FDA employees secure the controls throughout our IT enterprise, 

including the monitoring of FDA personnel’s use of governmentowned equipment. This and other IT controls supports protections 

of intellectual property entrusted to FDA from theft or sabotage. 

Unauthorized disclosures of information not only violates Federal 

law and regulations and undermines the integrity of FDA programs, they also can result in civil suits against FDA. 

So it’s critically important that FDA protects against unauthorized disclosure of such information by agency personnel and for the 

FDA to appropriately investigate any suspected incidents of unauthorized disclosure. 

FDA personnel are regularly advised that they have no reasonable expectation of privacy when using FDA computer networks 

and that any use of agency IT resources, including email, may be 

monitored. This notice is provided by a variety of means, including 

a warning banner that an employee must acknowledge every time 

he or she logs on to the FDA network, which clearly states that, 

by logging onto the system, the user consents to having no reasonable expectation of privacy regarding any communications or data 

in transit or stored on that system. 

All FDA users are also made aware of HHS policy that any use 

of HHS email may not be secure, it is not private, it is not anonymous, it may be subject to disclosure, and that employees do not 

have the right to, nor expectation, of privacy at any time while 

using HHS IT resources. 

Although FDA has clear legal responsibility and authority to 

monitor personnel use of agency IT resources, we must carry out 

such monitoring in a way that recognizes employees’ interests and 

legal protections. 

In 2010, FDA suspected that five CDRH employees were using 

FDA IT systems to send trade secrets or confidential commercial 

22 

information outside of FDA, in possible violation of FDA regulations and criminal laws. 

To investigate the suspected leaks, FDA employed computermonitoring software on those employees’ government-issued FDA 

computers, the computer surveillance that is currently the subject 

of ongoing litigation. 

In 2012, the HHS Office of Inspector General, or OIG, was asked 

to assess whether that monitoring was appropriate and to provide 

recommendations on how FDA should investigate allegations of improper dissemination of confidential information. 

Yesterday the OIG issued its report. Significantly, the OIG found 

that the CDRH had reasonable concerns that confidential information had been disclosed by the monitored employees without authorization. 

The OIG also found that FDA had provided notice through the 

network log-in banner to those employees that the use of their FDA 

computers would be monitored. 

The OIG found no evidence that FDA obtained or used passwords 

of any employees’ private email accounts, and the OIG found that 

there were no evidence suggesting that FDA monitoring was designed to capture communications with any particular person, 

group, including Congress. 

Yet, we understand that we must have adequate procedures in 

place when conducting such monitoring. Indeed, since 2012, we 

have been reviewing and evaluating our policies for monitoring the 

use of government-owned computers to ensure they are consistent 

with the law and with Congress’s intent to provide a secure channel for protected disclosures. 

In September 2012, Commissioner Hamburg directed FDA leadership to adopt policies for requests to monitor FDA computers to 

make sure that any monitoring is justified, narrowly tailored and 

duly authorized, that data derived from monitoring is appropriately 

stored and controlled, and that monitoring is used for appropriate 

purposes and takes place for no longer than necessary. 

Last September, we issued our interim computer-monitoring policy. This policy provides standards when employee computer monitoring takes place. 

It established a special committee to review monitoring requests. 

It requires that monitoring requests be narrowly tailored in time, 

scope, and degree. It requires that all requests identify the least 

invasive approach. 

It also requires considerations of alternative methods to address 

the potential risk, provide documentation standards, and states 

that no computer monitoring may target communications with law 

enforcement, the Office of Special Counsel, members of Congress, 

union officials, or private attorneys. 

Notably, yesterday’s OIG report acknowledges that our September 2013 interim computer-monitoring policy addresses all of 

the OIG’s recommendations. 

In order for FDA to effectively carry out its public health mission, we must be vigilant to protect against the misuse or unauthorized disclosure of confidential information that is regularly entrusted to the agency. 

23 

We believe that the policies and procedures we have in place appropriately and effectively balance the individual interests of employees with FDA’s critical needs to safeguard the security and integrity of data and IT systems that the agency is entrusted to manage. 

Thank you for your commitment to FDA’s mission and for the opportunity to testify today about the monitoring of FDA employees’ 

use of agency IT resources and FDA’s responsibilities to secure 

medical product sponsors’ confidential information. 

I am pleased to answer any questions. 

Chairman ISSA. Thank you. 

[Prepared statement of Mr. Harris follows:] 

24 


Insert offset folio 6 here 87176.006

/-, 

{~~ DEPARTMENT OF HEALTH AND HUMAN SERVICES Public Health Service 

STATEMENT 

OF 

WALTER S. HARRIS 

Food and Drug Administration 

Sillier Spring, MD 20993 

DEPUTY COMMISSIONER FOR OPERATIONS AND CHIEF OPERATING OFFICER 

FOOD AND DRUG ADMINISTRATION 

DEPARTMENT OF HEAL TH AND HUMAN SERVICES 

BEFORE THE 

COMMITTEE ON OVERSIGHT AND GOVERNMENT REFORM 

U.S. HOUSE OF REPRESENTATIVES 

MONITORING FDA PERSONNEL'S USE OF AGENCY INFORMATION 

TECHNOLOGY SYSTEMS 

February 26, 2014 

Release Only On Delivery 
25 


Insert offset folio 7 here 87176.007

INTRODUCTION 

Chainnan Issa, Ranking Member Cummings, and Members of the Committee, I am Walter S. 

Harris, Deputy Commissioner for Operations and Chief Operating Officer (COO), and Acting 

Chieflnfonnation Officer (CIO) of the Food and Drug Administration (FDA or the Agency), 

which is part of the Department of Health and Human Services (HHS). I am pleased to be here 

today to discuss issues related to the monitoring of FDA personnel's use of Agency infonnation 

technology (IT) systems. 

As FDA's COO, my role is to provide executive direction, leadership, coordination, and 

guidance for the overall day-to-day administrative operations of FDA, in order to ensure the 

timely and effective implementation and high-quality delivery of services across the Agency. 

am also currently serving as FDA's Acting CIO. As such, I am responsible for establishing and 

implementing the Agency's incident response plan for responding to the detection of computer 

security incidents involving FDA infonnation systems and ensuring that appropriate action is 

taken to minimize the consequences of such incidents. I coordinate with FDA's Office of Chief 

Counsel (OCC), Office of Criminal Investigations (OCI), and Office of Security 

Operations (OSO), and with other law enforcement authorities, on actions and activities 

involving computer monitoring of use of FDA's IT resources and the retrieval of electronic 

records, where appropriate. 

2 
26 


Insert offset folio 8 here 87176.008

FDA's IT Security (IS) Program, headed by the Agency's Chieflnformation Security 

Officer (CISO), directs and implements the IT security program to ensure that adequate and 

appropriate controls are applied to FDA systems for the protection of privacy, and to ensure 

confidentiality, integrity, and availability of information. The CISO employs security policies 

and standards for FDA information systems enterprise-wide in accordance with FDA, HHS, 

Office of Management and Budget (OMB), National Institute of Standards and Technology 

(NIST) and other Federal security requirements. Key activities of FDA's IS Services staff 

include: cyber security and insider-threat detection; IT security operations; security 

authorization and audit management; policy, awareness, and training; Information Systems 

Security Officer (ISSO) support; and contingency planning. 

Cyber threats, vulnerabilities, and risks to FDA's IT infrastructure of over 18,000 end users, 83 

production systems, and 379 applications are on the rise. These threats, vulnerabilities, and risks 

to the FDA IT infrastructure include, but are not limited to: external threats (i.e., transnational 

criminal organizations, hackers) and end users leveraging computer access to advance 

inappropriate activities; 1 the exploitation of sensitive information, which could negatively impact 

FDA's mission and U.S. national and economic security; and direct threats to FDA critical assets 

(including the Agency's personnel, processes, programs, and computer systems). 

As described further in this testimony, FDA personnel are permitted access to information 

provided to the Agency by medical product sponsors and others and are required to maintain the 

I Other insider-related threats include new, sophisticated phishing techniques such as "Vishing," "Tabnabbing," and 

"Evil Twinning." 
27 


Insert offset folio 9 here 87176.009

strict confidentiality of that information. However, security breaches involving FDA personnel 

have occurred in the past. 

For example, in March 2012, Cheng Yi Liang, a former FDA chemist, was sentenced to 60 

months in prison2 for engaging in insider trading on mUltiple occasions based on material, nonpublic information he obtained in his capacity as an FDA scientist. 3 Liang had been employed 

as a chemist for more than 15 years by FDA's Office of New Drug Quality 

Assessment (NDQA), and through his work at NDQA, had access to FDA's password-protected 

internal tracking system for new drug applications. Much of the information accessible on that 

computer tracking system, "Document Archiving, Reporting, and Regulatory Tracking System," 

known as DARRTS, constitutes proprietary, non-public information regarding pharmaceutical 

companies that submit their experimental drugs for FDA review. 

In his plea, Liang admitted that between 2006 and 2011, using non-public information from 

DARRTS and other sources, he traded in the securities of pharmaceutical companies in violation 

of the duties of trust and confidence that he owed FDA as an employee. As stated in FDA's 

post-conviction Proposal to Debar Liang: 

2 Liang's sentence was announced by the u.s. Department of Justice, the u.s. Attorney for the District of Maryland, 

the Federal Bureau oflnvestigation, and the HHS Office of the Inspector General (OIG). See U.S. Department of 

Justice, "Former FDA Chemist Sentenced to 60 Months in Prison for Insider Trading" (March 5, 2012), available at 

hltp:llwww.fbi.govlwashingtondclpress-re/easesI20J 21{ormer-!da-chemist-sentenced-to-60-months-in-prison-!orinsider-trading. "Mr. Liang violated his duty of loyalty to the FDA and profited from inside information," said U.S. 

Attorney for the District of Maryland Rod J. Rosenstein. "Liang brazenly sought to profit based on sensitive, insider 

information. What he didn't know is that investigators have been utilizing sophisticated technical tools to identifY 

and track criminal behavior. We will continue to insist that Federal Government employee conduct be held to the 

highest of standards," said Elton Malone, Special Agent in Charge, HHS, OIG Office ofInvestigations, Special 

Investigations Branch. "Mr. Liang breached the trust of his employment by obtaining sensitive information and 

using it for his own profit," said James W. Mcjunkin, former Assistant Director in Charge ofFBrs Washington 

Field Office. 

J Liang was also ordered to forfeit $3.7 million, representing the proceeds of the insider-trading scheme. 

4 
28 


Insert offset folio 10 here 87176.010

"As an FDA employee who worked in CDER's Office of New Drug Quality 

Assessment, you had access to the DARRTS database containing non-public 

information about the status of approvals for new drugs. FDA is required by 

statute and its regulations to keep certain information relating to drug approvals 

confidential. You exploited the position with which you were entrusted as a 

scientist at FDA to access confidential information in the DARRTS database ... , 

and you used that information in a scheme for personal gain. You accessed 

confidential information ... repeatedly as part of your scheme, and set up 

brokerage accounts in the names of others in furtherance of that scheme. * * * 

The Standards of Ethical Conduct for Employees of the Executive Branch require 

that all employees shall not engage in a financial transaction using nonpublic 

information, nor allow the improper use of nonpublic information to further his 

own private interest or that of another, whether through advice or 

recommendation, or by knowing unauthorized disclosure. You were aware of 

your responsibility to comply with this requirement, and you violated that 

responsibility. ,,4 

In addition to the criminal conviction, Liang was ultimately debarred from providing services in 

any capacity to a person that has an approved or pending drug product application, 5 based on a 

finding that he had been convicted of a felony under Federal law for conduct relating to the 

development or approval of a drug product. 

Public service is a public trust. Each and every employee of FDA and HHS has a responsibility 

to the United States Government and its citizens to place loyalty to the Constitution, laws, and 

ethical principles above private gain. To ensure that every citizen can have complete confidence 

in the integrity of the Federal Government, all executive branch employees are required to 

respect and adhere to principles of ethical conduct set forth by applicable Federal law and 

regulations. 6 

4 See FDA, "Proposal to Debar, Notice of Opportunity for Hearing," Docket No. FDA-20l2-N-0783 (Nov. 6, 2012), 

available at hltp:/lwww.jda.govlregulatoryinformationl[oilelectronicreadingroomlucm334415.htm. 

'See FDA, "Cheng Yi Liang: Debannent Order," 78 Fed. Reg. 14556, Docket No. FDA-201 2-N-0783 (March 6, 

2013), available at http://www.gpo.govl[dsys/pkgIFR-2013-03-06IhtmI/2013-05160.htm. 

6 See U.S. Office of Government Ethics, "Standards of Ethical Conduct for Employees of the Executive Branch" 

(June 2009), available at 
29 


Insert offset folio 11 here 87176.011

As FDA employees work to advance the health and welfare ofthe public, we seek to maintain 

the highest standards of ethical conduct: the essence of good government is the personal 

responsibility that each public servant feels for the public trust that he/she holds. FDA 

employees are expected to be people of integrity and to observe the highest standards of conduct. 

Because ofFDNs special regulatory responsibilities, its personnel must carry on the Agency's 

business effectively, objectively, and without even the appearance of impropriety, and Agency 

personnel may not use, or permit others to use, official information not available to the general 

public for gain or to advance a private interest. 7 

The scope, breadth, and extent of risks faced by FDA in the event of information security 

breaches are significant and require the utmost vigilance on the part of the Agency and all of its 

personnel to ensure that the valuable data entrusted to FDA is protected from both internal and 

external threats and vulnerabilities. As described in this testimony, safeguarding the confidential 

information that regulated entities share with FDA is critical to the Agency's ability to carry out 

its public health mission, and FDA has adopted policies and procedures to preserve the data 

security of its confidential information. 

http://www.oge.gov/displaytemplates/',tatutesregulationsdetail. a,lpx? id=293&langtype= J 03 3, and the statutes and 

regulations cited therein. 

7 See, e.g., FDA, "Investigations Operations Manual," Subchapter 1.6, "Public Relations, Ethics and Conduct," 

available at http://www/da.govIICECfllnspectionsIIOMlucmI22505.htm. 

6 
30 


Insert offset folio 12 here 87176.012

FDA's Responsibility to Protect Confidential Information 

FDA protects and promotes the public health by ensuring the safety, efficacy, and security of 

human and veterinary drugs, biological products, and medical devices; by ensuring the safety 

and security of our nation's food supply, cosmetics, and products that emit radiation; and by 

regulating tobacco products. The Agency also helps to advance the public health by helping to 

speed innovations and by helping the public get the accurate, science-based information that it 

needs to properly use medicines and medical devices in a way to maintain and improve their 

health. 

FDA's ability to fulfill the Agency's public health mission is closely tied to our ability to protect 

and safeguard confidential information that is submitted by regulated entities and others, and is 

entrusted to FDA. The Agency routinely receives and reviews trade secrets and confidential 

commercial information. For example, medical product sponsors, including manufacturers, are 

expected to provide FDA with detailed and complete information about how a product works, 

how it is made, and what materials or ingredients are used to make it. This information is central 

to the Agency's full and adequate evaluation of the data and determination of a medical 

product's safety and efficacy. Without the ability to fully access-and to secure-this 

proprietary information, the Agency cannot accomplish its public health mission. 

In many instances, the mere fact that a firm has made a submission to FDA is itself confidential. 

Similarly, details about a company's product in development, or the data and information 

7 
31 


Insert offset folio 13 here 87176.013

concerning a product's safety and effectiveness, could give the company's competitors an 

advantage by providing otherwise unavailable insights into the development process, and 

disclosure of such details could undermine incentives for innovation and competition in the 

commercial market. FDA's ability to carry out its responsibilities effectively depends on its 

ability to have timely access to this highly sensitive information, and improper disclosure could 

hamper FDA's ability to obtain such information. 

The E-Govemment Act of 2002 8 recognizes the importance of information security to the 

economic and national security interests of the United States. Title III of the E-Govemment Act, 

entitled the "Federal Information Security Management Act" (FISMA), requires each Federal 

agency to develop, document, and implement an agency-wide program to provide information 

security for the information and information systems that support its operations and assets, 

including those provided or managed by another agency, contractor, or other source. 

HHS has developed policies to comply with FISMA, including the HHS Office of the Chief 

Information Officer's (OCIO) "HHS-OCIO Policy for Information Systems Security and 

Privacy" (the HHS-OCIO Policy for ISSP), 9 which provides direction to the IT security 

programs of the Department's Operating Divisions (OPDrY s) and Staff Divisions (STAFFDrY s) 

for the security and privacy of HHS data. 

• Pub. L. 107·347, 116 Stat. 2899 (Dec. 17,2002), available at http://www.gpo.gov((dvyslpkg/PLAW-

/ 07pub1347lpdflPLA W- /07pub1347,pdf 

9 HHS, "HHS-OCIO Policy for Information Systems Security and Privacy," HHS-OCIO-20 11-0003 (rev. July 7, 

2011), available at hllp:llwww.hhs.govlociolpolicylhhs-ocio-201 I-0003.hlm/. The HHS-OCIO Policy establishes 

comprehensive IT security and privacy requirements for the IT security programs and information systems ofHHS 

OPDlVs and STAFFDlVs, including FDA. 
32 


Insert offset folio 14 here 87176.014

FDA employees are subject to monitoring of their use of government-owned equipment in 

accordance with policies developed to comply with FISMA. 10 

As required under FISMA, FDA employs IT security controls throughout the Agency's IT 

Enterprise. These IT controls are employed to ensure the confidentiality, integrity, and 

availability of FDA data and are consistent with the management, operational, and technical 

controls outlined in NIST Special Publication 800-53, "Recommended Security Controls for 

Federal Infonnation Systems and Organizations," as amended. II These IT controls broadly 

include logging of all system events, monitoring of data entering and leaving the FDA IT 

Enterprise, and ensuring authorized access to systems. The security controls are further 

employed to support the protection of intellectual property entrusted to FDA from theft or 

sabotage. 

In addition to FISMA, there are other laws that expressly prohibit FDA personnel from 

disclosing trade secrets and confidential commercial infonnation unless authorized by law. For 

example, section 1905 of title 18 of the Federal criminal code states: 

"Whoever, being an officer or employee of the United States or of any department 

or agency thereof, ... publishes, divulges, discloses, or makes known in any 

manner or to any extent not authorized by law any infonnation coming to him in 

the course of his employment or official duties or by reason of any examination or 

investigation made by, or return, report or record made to or filed with, such 

department or agency or officer or employee thereof, which infonnation concerns 

or relates to the trade secrets, processes, operations, style of work, or apparatus, or 

to the identity, confidential statistical data, amount or source of any income, 

profits, losses, or expenditures of any person, finn, partnership, corporation, or 

association; or penn its any income return or copy thereof or any book containing 

any abstract or particulars thereof to be seen or examined by any person except as 

\0 In addition, FDA may monitor FDA e-mail accounts and other IT resources, when appropriate, such as in support 

of authorized personnel investigations or law enforcement activities. 

\I Available at htlp:!/csrc.nist.gov/publicalions/PubsSPs.html. 

9 
33 


Insert offset folio 15 here 87176.015

provided by law; shall be fined under this title, or imprisoned not more than one 

year, or both; and shall be removed from office or employment." 12 

The Federal Food, Drug, and Cosmetic Act (FD&C Act) also includes provisions specifically 

prohibiting Federal employees from disclosing proprietary information. For example, 

section 3010) ("Prohibited Acts") ofthe FD&C Act expressly prohibits "[t]he using by any 

person to his own advantage, or revealing, other than to the Secretary or officers or employees of 

the Department, or to the courts when relevant in any judicial proceeding under this Act, any 

information acquired under authority of section 404, 409, 412, 414,505,510,512,513,514,515, 

516,518,519,520,571,572,573,704, 708, 721,904,905,906,907,908,909,or920(b) 

concerning any method or process which as a trade secret is entitled to protection .... " 13 

FDA has promulgated numerous regulations implementing the protections provided by the 

FD&C Act and other statutes for confidential information. For example, FDA's principal 

regulation regarding non-disclosure of trade secrets and confidential commercial information 

states that "[ d]ata and information submitted or divulged to [FDA] which fall within the 

definitions of a trade secret or confidential commercial or financial information are not available 

for public disc!osure.,,14 The Agency also has several product-specific regulations. For 

example, under 21 CFR 314.430, 601.51, and 814.9, FDA is prohibited, with limited exceptions, 

from disclosing the existence of a marketing application for a drug or biological product, or a 

premarket approval application for a device, unless the existence ofthe application has been 

previously publicly disclosed or acknowledged by the sponsor. There are similar restrictions 

12 18 U.S.C. § 1905, "Disclosure of Confidential lnfonnation Generally," available at 

httl.://www.gl.o.gov/jd.ys/pkg/USCODE-20 12-litle I8/pdjlUSCODE-20 I2-title I8-partl-chap93-sec I905.pdj 

13 21 U.S.C. 331(j), available at http://www.gI.0.govlfdsysll.kgIUSCODE-2012-litle21IpdjlUSCODE-20I2-title21-

chap9-slIbchap!lf-sec3 31.l'df 

10 
34 


Insert offset folio 16 here 87176.016

regarding disclosing the existence of a premarket notification submission ("51 O(k)") for a 

device, 15 and the same regulations generally prohibit FDA from releasing any information from 

or about a pending application or 51 O(k). 

Unauthorized disclosures of information not only violate Federal laws and regulations and 

undermine the integrity of FDA programs, they also can result in civil suits against FDA. 

Accordingly, it is critically important that FDA protect against unauthorized disclosure of such 

information, including by Agency personnel, and for FDA to appropriately investigate suspected 

incidents of unauthorized disclosure of such information. 

FDA Staff Awareness of Privacy Limitations and IT System Monitoringl6 

Because, as described above, FDA personnel are subject to monitoring of their use of Agency IT 

systems, resources, and equipment, Agency personnel are regularly advised that they have no 

reasonable expectation of privacy when making use of the FDA computer network, and that any 

use of Agency IT resources, including e-mail, may be monitored. Such notice is provided to 

FDA personnel by variety of means. 

LOG-IN BANNER: Since September 2010, all users of the FDA computer network have 

received notice upon logging into an FDA computer that they should have no reasonable 

14 21 CFR 20.61, available at http://www.accessdata./da.govlscl'iptslcdrh!cJdocsIcJcjiiCFRSearch.cJm.?fr=20.61. 

"21 CFR 807.95, available al http://www.accessdata./da:gov/..criptslcdrhlcJdocslcJcJrlcji·searchcJm?Jr=807. 95. 

16 There is an active Federalliligalion, styled Hardy ef al. v. Hamburg. ef al .. Civ. No. 1:II-cv-01739-RBW 

(D.D.C. filed Sept. 28, 2011), thaI involves some of the issues discussed here. The litigalion's constraints with 

respect to the rights of individuals and govemmentallegal prerogatives will limit the Agency's responses to 

questions related to matters involved in the litigation. 

11 
35 


Insert offset folio 17 here 87176.017

expectation of privacy when utilizing the FDA computer system. Upon logging on to the FDA 

network, users immediately receive the following warning message: 

•••• WARNING·· WARNING·· WARNING·· WARNING·· WARNING·· -. 

Vou are accessing a U.S, Government Information system, which includes (1) this computer. (2) this 

computer network, (3) all computers connected to this network. and (4) all devices and storage media 

attached to this network or to a computer on this network.. 

This informadon system Is provided for U.S. Government·authorlzed use only. Unauthorized or improper 

use of this system may result In disciplinary aetton. as wen as dvU and criminal penalties. 

By using this tnfonnation system, you understand and consent to the following: 

• You have no reasonable expectation of privacy regarding any communications or data transiting or stored 

on this information system. At any time, and for any lawful government purpose, the government may 

monitor, intercept. and search and seize any communication or data transiting or stored on this 

information system . 

• Any communications or data transiting or stored on this information system may be disclosed or used for 

any lawful government purpose. 

Prior to August 30, 2010, a similar, but not identical, banner was used. 17 

FDA's deployment of the warning banner is in accordance with applicable HHS policy, which 

requires the use of a warning banner on all Department IT systems. 18 The warning banner must 

17 The prior Jog~in banner read as follows: "This is a Food and Drug Administration (FDA) computer system and is 

provided for the processing of official u.s. Government information only. All data contained on this computer 

system is owned by the FDA and may, for the purpose of protecting the rights and property of the FDA, be 

monitored, intercepted, recorded, read, copied, or captured in any manner and disclosed by and to authorized 

personnel. USE OF THIS SYSTEM BY ANY USER, AUTHORIZED OR UNAUTHORIZED, CONSTITUTES 

CONSENT TO THIS MONITORING, INTERCEPTION, RECORDING, READING, COPYING, OR 

CAPTURING AND DISCLOSURE. THERE IS NO RIGHT OF PRIVACY IN THIS SYSTEM. Authorized 

personnel may give to law enforcement officials any potential evidence of crime found on FDA computer systems. 

Unauthorized access or use of this computer system and software may subject violators to criminal, civil, andlor 

administrative action. The standards for ethical conduct for employees of the Executive Branch (5 CFR 2635.704) 

do not pennit the USe of government property, including computers, for other than authorized purposes." 

" For example, Section 4.1.3 of the HHS-OCIO Policy for ISSP requires HHS OPDIVs and STAFFDIVs to ensure 

that infonnation systems provide adequate, risk-based protection in certain control areas by using the appropriate 

baseline security controls as established in NIST Special Publication 800-53, Rev. 3, "Recommended Security 

Controls for Federal Infonnation Systems" (August 2009). Control AC-8 ofNIST SP 800-53 states: "The 

infonnation system: (a) Displays an approved system use notification message or banner before granting access to 

the system that provides privacy and security notices consistent with applicable Federal laws, Executive Orders, 

directives, policies, regulations, standards, and guidance and states that: (i) USers are accessing a U.S. Government 

12 
36 


Insert offset folio 18 here 87176.018

state that, by accessing an HHS IT system (e.g., logging onto a Department computer or 

network), the user consents to having no reasonable expectation of privacy regarding any 

communication or data transiting or stored on that system, and the user understands that, at any 

time, the Department may monitor the use ofHHS IT resources. 

ANNUAL FDA SECURITY AWARENESS TRAINING: All FDA users are required to complete 

Computer Security Awareness Training (CSAT) annually, and new hires are required to 

complete security awareness training within two weeks of their hire date. Computer accounts are 

disabled for any individuals who do not complete the annual training, and access is not restored 

until completion of the CSA T for the previous year is confirmed. Current topics of the Security 

Awareness Training include: security risk awareness and threat sources, protecting sensitive 

information, portable devices, Internet threats, access control, remote access, reporting incidents, 

and user responsibilities. The Security Awareness Training also includes the reminder that all 

network activities may be monitored. All users must also acknowledge the HHS Rules of 

Behaviorl9 to receive the certificate of completion for the FDA Security Awareness Training. 

Among other things, the acknowledgement of the HHS Rules of Behavior reminds the user that 

they have no expectation of privacy while accessing HHS computers, networks, or e-mail and 

that they must not "conduct official government business or transmit/store sensitive HHS 

information using non-authorized equipment or services." 

infonnation system; Oi) system usage may be monitored, recorded, and subject to audit; (iii) unauthorized use of the 

system is prohibited and subject to criminal and civil penalties; and (iv) use of the system indicates consent to 

monitoring and recording." See http://csrc.nist.gov/publications/nistpubs/80U.53-Rev3/sp800·53·rev3· 

final_ updated. errata _05·0 J -20 J a.pdf 

" HHS, Office of the CIO, "Rules of Behavior for Use of HHS Information Resources," Doc. No. HHS·OClO20 13-0003S (Sept. 24, 2013), available at http://wwwhhs.gov/ocio/policy/hhs.rob.html.Prior to 2013, there existed 

13 
37 


Insert offset folio 19 here 87176.019

HHS POLlCY ON PERSONAL USE OF AGENCY IT RESOURCES: All FDA personnel are 

subject to the HHS Information Resources Management (IRM) "Policy for Personal Use of 

Information Technology Resources," which states: 

"5.7 Any use ofHHS IT resources, including e-mail, is made with the 

understanding that such use may not be secure, is not private, is not anonymous 

and may be subject to disclosure under the Freedom ofInformation Act (FOIA). 

HHS employees do not have a right to, nor shall they have an expectation of, 

privacy while using HHS IT resources at any time, including accessing the 

Internet through HHS gateways and using e-mail, which may be subject to release 

pursuant to the Freedom ofInformation Act. To the extent that employees wish 

that their private activities remain private, they shall avoid making personal use of 

HHS IT resources. 

5.8 Electronic data communications may be disclosed within the Department to 

employees who have a need to know in the performance of their duties (such as, 

with manager approval technical staff may employ monitoring tools in order to 

maximize the utilization of their resources, which may include the detection of 

inappropriate use ).,,20 

HHS RULES OF BEHAVIOR FOR USE OF INFORMATION RESOURCES: The Department's 

"Rules of Behavior for Use ofHHS Information Resources,,21 (Rules of Behavior), which is 

issued under the authority of the HHS-OCIO Policy for ISSP, provides the rules that govern the 

appropriate use of all HHS information resources for Department users, including Federal 

employees, contractors, and other systems users. The Rules of Behavior require HHS personnel 

a 2010, and 2008, version of the HHS Rules of Behavior; each of those versions included a similar certification 

regarding HHS personnel's consent to having no expectation of privacy while accessing HHS IT systems. 

20 "HHS IRM Policy for Personal Use ofinformation Technology Resources," HHS-OCIO-2006-0001 (Feb. 17, 

2006), available at hup:/lwww.hhs.govlociolpolicyI2006-(){)OI.hlml. 

21 HHS, Office of the CIO, "Rules of Behavior for Use ofHHS Information Resources," Doc. No. HHS-OCIO2013-0003S (Sept. 24, 2013), available at http://www.hhs.govlociolpolicylhhs-roh.html. All new users of HHS 

information resources must read the HHS Rules of Behavior and sign the accompanying acknowledgement form 

before accessing Department data or other information, systems, and/or networks. This acknowledgement must be 

completed annually thereafter, which may be done as part of annual HHS Information Systems Security Awareness 

Training. By signing the form, users reaffirm their knowledge of, and agreement to adhere to, the HHS Rules of 

Behavior. 

14 
38 


Insert offset folio 20 here 87176.020

to certify, among other things, that they "[u]nderstand and consent to having no expectation of 

privacy while accessing HHS computers, networks, or e_mail.,,22 

As detailed above, FDA advises all of its personnel on a regular and frequent basis that, as 

required by Federal law and in accordance with well-established Department and Agency 

policies, FDA personnel have no reasonable expectation of privacy when using FDA's IT 

resources, and that any use of such resources, including e-mail, may be monitored. 

FDA's Policies to Appropriately Balance Employee Interests and Data Security 

Although, as described above, FDA has clear legal responsibility and authority to monitor 

personnel use of the Agency's IT resources, FDA also has a responsibility to carry out any such 

computer monitoring in a manner that recognizes employee interests and relevant legal 

protections. Therefore, HHS and FDA have put in place a number of policies and procedures to 

appropriately balance the interests of individual employees and the Agency's need to preserve 

the integrity of its IT resources and the security of confidential information. 

For example, FDA has put in place appropriate oversight and controls to ensure that any 

monitoring is justified, reasonable in scope, and duly authorized; that data derived as a result of 

monitoring is appropriately stored and controlled; and that monitoring is utilized for appropriate 

purposes and takes place for no longer than necessary. The Agency complies with all applicable 

Federal laws that protect employee interests, including (but not limited to) the 

22 HHS Rules of Behavior at p. 3. 

15 
39 


Insert offset folio 21 here 87176.021

Privacy Act of 1974, the privacy and FISMA provisions of the E-Governrnent Act of 2002,23 the 

Notification and Federal Employee Antidiscrimination and Retaliation Act of2002 (NO FEAR 

Act),24 and the Whistleblower Protection Enhancement Act of201225 (the Whistleblower 

Protection Act or WPA), as well as all administration policy directives issued in furtherance of 

those Acts. 

Under the NO FEAR Act,26 employees are required to undergo training every two years on their 

rights and protections under the antidiscrimination and whistleblower laws. FDA offers an 

online training course on the NO FEAR Act to all new hires and current employees. 

In addition, FDA leadership has reminded Agency staff regarding the legal protections under the 

WPA. In February 2009, then-acting FDA Commissioner Dr. Frank Torti issued an Agencywide memorandum detailing whistleblower protections for FDA employees. Again, in 

January 2010, FDA Commissioner Dr. Margaret Hamburg issued an "all-hands" memo to all 

FDA employees affirming the Agency's strong support for the Whistleblower Protection Act of 

1989, which affords employees the legal protection to make a protected disclosure without fear 

of reprisal. In that memo, Dr. Hamburg reminded employees of the U.S. Office of Special 

Counsel's (OSC) process for addressing complaints of whistleblower retaliation, stating that 

"[r]eprisal against individuals will not be tolerated for disclosure of information in which the 

employee believes there is reasonable evidence of violation of any law, rule or regulation ... or a 

13 Pub. L. 107-347, 116 Stat, 2899 (Dec. 17,2002), available at http://www,gpo,gov/fdsyslpkgIPLAWI07publ347!pdf/PLA W-l 07pub1347.pdJ 

"Pub, L. 107-174, codified at 5 U.S.C, § 2301 note (2011). 

"Whistleblower Protection Act of 1989 (Pub. L. 101-(2), codified at5 U,S,C, § 2302 (201 I», 

"Pub, L. 107-174, codified at 5 U,S,C. § 2301 note (2011), 

16 
40 


Insert offset folio 22 here 87176.022

substantial and specific danger to public health or safety." Dr. Hamburg further directed 

employees to an online training course and provided OSC's web address and phone number. 

In June 2012, Federal agencies, induding FDA, received two memoranda from OMS and OSC 

relating to legal restrictions and guidelines for the monitoring of employee communications, 

induding electronic mai1.27 Since then, FDA has continued to review and evaluate the Agency's 

policies and practices for monitoring the use of government-owned computers issued to FDA 

personnel to ensure that they are consistent with the law and with Congress' intent to provide a 

secure channel for protected disclosures. 

In August 2012, Dr. Hamburg directed FDA's Office ofInformation Management not to deploy, 

without written approval by the Agency's Chief Counselor her delegate, certain software that 

enables the prospective collection of data on the use of the specific computer onto which it is 

installed. 

In September 2012, Dr. Hamburg directed FDA's CIO to put into place procedures to strengthen 

the Agency's ability to effectively analyze, authorize, and document requests for monitoring of 

Agency personnel's FDA computers to ensure that any such monitoring would continue to be 

conducted in an appropriate manner. FDA's CIO and Chief Counsel were directed to develop a 

written policy for contemporaneous monitoring of individual FDA computers that would require 

express written authorization of such monitoring by the Commissioner, a Deputy Commissioner, 

or the COO, with documentation of the reason for the monitoring. The policy would authorize 

270MB, "Memorandum for Chiefinformation Officers and General Counsels" (June 20, 2012); OSC, 

"Memorandum for Executive Departments and Agencies" (June 20, 2012). 

17 
41 


Insert offset folio 23 here 87176.023

computer monitoring only pursuant to a request from outside law enforcement or the HHS 

Inspector General, or in the event that there were reasonable grounds to believe that the 

individual being monitored was responsible for unauthorized disclosure of legally protected 

information or had violated Department or Agency personnel, administrative, or IT policy. Any 

authorized monitoring would be required to be as narrow, time-limited, and non-invasive as 

appropriate to accomplish the stated information-gathering objective. Legal review would be 

required to determine whether the monitoring is legally supportable, including consideration of 

whether the proposed monitoring is consistent with all applicable legal requirements, including 

the WPA. The CIO would be required to review any authorized computer monitoring on a 

monthly basis to assess whether it remains justified or must be discontinued, and if continued, 

that decision would be required to be explained in writing. 

In June 2013, the HHS Assistant Secretary for Administration directed each HHS OPDIV and 

STAFFDIV Head, working with their respective OPDIV CIO, to establish policies and 

procedures to strengthen the ability to effectively document, analyze, authorize, and manage 

requests for monitoring personnel use of HHS IT resources. 28 In addition to the elements 

described above, the June 2013 directive specifically stated that no monitoring may target 

communications with law enforcement entities, the OSC, members of Congress or their staff, 

employee union officials, or private attorneys, and that if such communications were 

inadvertently collected (or inadvertently identified from more general searches), they may not be 

28 Memorandum from E. J. Holland, Jr., HHS Assistant Secretary for Administration, to HHS Operating Division 

and Staff Division Heads, "Policy for Monitoring Employee Use ofHHS IT Resources" (June 26, 2013). The June 

2013 HHS directive states that although the IT warning banner-which states that the employee consents to having 

no reasonable expectation of privacy regarding any communication or data transiting or stored on the HHS IT 

system and that the employee understands that the Department may monitor the use ofHHS IT resources for lawful 

government purposes-gives the OPDlVs the authority to monitor employee use oflT resources, "it is each 

18 
42 


Insert offset folio 24 here 87176.024

shared with a non-law-enforcement party who requested the monitoring, or anyone else, without 

express written authorization from the Office of General Counsel (OGC) and other appropriate 

Department officials. 

In September 2013, as FDA's COO, I proposed a Staff Manual Guide (SMG) establishing 

interim policies and procedures that will strengthen the Agency's ability to effectively document, 

analyze, authorize, and manage requests to monitor use of HHS and FDA IT systems and 

resources. Among other things, this proposed SMG would: (1) provide standards for when 

employee computer monitoring may take place; (2) establish a Review Committee, consisting of 

a representative from FDA's OCC, a representative from the Office ofInformation Management 

with systems administration expertise, and a representative from the Office of Human Resources 

with human capital expertise, to review requests for monitoring and to develop procedures for 

such review; (3) state that requests for computer monitoring shall be narrowly tailored in time, 

scope, and degree of monitoring; (4) require that all requests to monitor shall identify the leastinvasive approach to accomplish the monitoring objectives, and that when reviewing requests for 

monitoring, authorizing officials shall also consider whether there are alternative informationgathering methods available that can be utilized to address the potential risk, without 

jeopardizing the Agency's objectives; (5) provide standards for documenting written 

authorizations for computer monitoring; and (6) state that no computer monitoring authorized or 

conducted may target communications with law enforcement entities, the OSC, members of 

Congress or their staff, employee union officials, or private attorneys. FDA is currently in the 

OPDlV's responsibility to carry out monitoring in a fashion that protects employee interests and ensures the need for 

monitoring has been thoroughly vetted and documented," 

19 
43 


Insert offset folio 25 here 87176.025

process of developing processes and procedures to fully implement the HHS policy on computer 

monitoring. 

CONCLUSION 

In accordance with Federal law, and in order to ensure that FDA can effectively carry out its 

mission, the Agency must be vigilant to protect against the misuse or unauthorized disclosure of 

the confidential information that is regularly entrusted to it. FDA believes that the policies and 

procedures that HHS and the Agency have put in place appropriately and effectively balance the 

individual interests of employees and the critical need to safeguard the security and integrity of 

the data and information systems that FDA has been entrusted to manage. 

Thank you for your commitment to the mission of FDA and for the opportunity to testify today 

about issues related to the monitoring of FDA employees' use of Agency IT resources. I am 

happy to answer any questions you may have. 

20 
44 

Chairman ISSA. Ms. Canterbury? 

STATEMENT OF ANGELA CANTERBURY 

Ms. CANTERBURY. Thank you. 

And good day, Chairman Issa, Ranking Member Cummings, 

members of the committee. 

The FDA spied on whistleblowers, which set off a firestorm that 

led us to this hearing today. But the public story of whistleblowers 

began in 2008, when FDA physicians and scientists warned Congress, and shortly thereafter the President, that the process for approving medical devices was broken, allowing potentially ineffective 

and unsafe products to be marketed. And as Senator Grassley 

noted, there has long been problems with bureaucrats at the FDA 

respecting the scientific process. 

The report released today by Chairman Issa and Senator Grassley and the HHS IG report document how FDA surveillance of 

whistleblowers was reckless and heedless of legal limits and whistleblower protections. Certainly security concerns and available 

technology will outstrip constitutional rights and whistleblower 

protections unless Congress works to balance those goals. 

To be frank, we question why FDA should be in the surveillance 

business in the first place. The FDA’s mission is to ensure our food 

and drugs and devices are safe. 

Any suspicion of unlawful disclosures of information or criminal 

misconduct should be investigated by law enforcement. Federal 

agencies cannot be allowed to police themselves. That is why we 

have IGs, the OSC, the FBI, and Congress. 

Ms. CANTERBURY. Even with just cause and proper controls, it 

will be difficult, if not impossible, to protect whistleblowers if agencies are allowed to gather electronic evidence without limits or 

oversight. And to what end? The Issa-Grassley report shows the 

leaks of confidential information to the press were not confirmed by 

this pervasive, invasive electronic surveillance. And so, as with the 

NSA domestic surveillance, the risks to our rights may be greater 

than the ability of surveillance to protect against risks to security, 

much less claims of harm to trade secrets or harm to profits. 

No doubt the FDA is in a tough spot: attempting to put into 

place a process that is more proscribed for surveillance critics, but 

also placating the lawyers for drug and device companies that demand that information be kept confidential. Needless to say, the 

FDA does not have it right yet. Rather than protect whistleblowers 

from unwarranted FDA surveillance, its interim policy protects the 

FDA from whistleblowers. It shields it from accountability. Nothing 

in the FDA’s interim policy would prevent FDA managers from 

using information collected by the surveillance as retaliation for 

whistleblowing. Thus, this policy does little to lift the chilling effect 

that fosters wrongdoing. How can the FDA ensure the public’s 

health and safety if the scientists and physicians are too afraid to 

come over when deadly mistakes are made? 

And far too many mistakes are made. Inadequately tested metalon-metal hip replacements cause crippling disability. Defective cardiac defibrillators, unclean syringes containing deadly bacteria, oldfashioned pediatric feeding tubes cause fatalities because they lack 

the well-known, inexpensive safeguard. And these are just the 

45 

medical devices that the FDA allowed on the market, not to mention the food and drug approval disasters. 

And if the FDA isn’t doing its job and lives are at risk, we have 

to ask why. The FDA whistleblowers warned us that corners were 

being cut and scientists were being overruled by the bureaucrats. 

We need whistleblowers. However, it is worth noting that 

throughout Mr. Harris’ testimony there was no acknowledgment of 

the public interest in protecting whistleblowers, only of employee 

protections, yet it is well known that whistleblowers save lives and 

taxpayer dollars and are among the best partners in crime fighting. 

Congress protected public whistleblowing so that waste, fraud, and 

abuse, and threats to public health and safety would be known. 

As Senator Grassley said, you couldn’t do the majority of the 

oversight this body does without whistleblowers and without the 

media, but the FDA policies do nothing to encourage or safeguard 

public whistleblowing, which is protected so long as the disclosure 

of information is not prohibited under law. They claim to exclude 

from surveillance in their interim policy the targeting of disclosures 

to Congress, the OSC, and others, but this is not enough. A legal 

review at the front end will not prevent legal public whistleblowing 

collected through spying from falling into the hands of those in a 

position to retaliate. 

Clearly, the FDA and other agencies will not get this right on 

their own. Congress and the President must mandate a government-wide policy to prevent future surveillance abuses. Of course, 

interfering with communications to Congress and retaliating for 

whistleblowing is already against the law, and there are some protections for the identities of whistleblowers in other laws, but Congress should consider specifically protecting the identity of a whistleblower in any surveillance that is done by an agency. 

Today, we don’t nearly know enough about the scope of surveillance across the government. I encourage you to order a report, a 

study looking at this issue. I encourage you to conduct oversight 

over other concerns with national security and insider threat programs that might threaten whistleblowers. But importantly, we 

must not forget what brought us here today, which is the FDA 

whistleblowers. They were concerned about the device approval 

process they believed might put lives at risk. 

FDA officials should not be held accountable for approving—they 

should be held accountable for approving ineffective and unsafe 

products, and flawed devices must be taken off the market. There 

must be more transparency and less deference to the demands for 

confidentiality by drug and device companies. Seriously, I wonder 

how much time and taxpayer dollars is spent protecting so-called 

confidential commercial information. 

Finally, please do all you can to ensure that FDA managers are 

held accountable for any violations of the rights of the scientists 

and physicians who sought to make medical devices more safe and 

more effective. Thank you. 

Chairman ISSA. Thank you. 

[Prepared statement of Ms. Canterbury follows:] 

46 


Insert offset folio 26 here 87176.026

Expos!ny CorruptlOfl, Exploring Solutions. 

PROJECT ON 

GOVERNMENT OVERSIGHT 

Testimony by Angela Canterbury, Director of Public Policy, 

Project On Government Oversight, 

before the House Oversight and Government Refonn Committee regarding 

"Limitless Surveillance at the FDA: Protecting the Rights of Federal Wbistleblowers" 

February 26,2014 

Chairman Issa, Ranking Member Currnnings, and Members of the Connnittee, thank you for 

your oversight of protections for whistleblowers and for inviting me to testifY today. 

I am the Director of Public Policy at the Project On Government Oversight (POGO). Founded in 

1981, POGO is a nonpartisan independent watchdog that champions good government reforms. 

POGO's investigations into corruption, misconduct, and conflicts of interest achieve a more 

effective, accountable, open, and ethical federal government. Thus, POGO has a keen interest in 

protecting whistleblowers who assist in uncovering and deterring government waste, fraud, 

abuse, mismanagement, and threats to public health and safety. 

Today I also am speaking as a member of the steering connnittee of the Make It Safe Coalition, a 

nonpartisan, trans-ideological network of organizations dedicated to strengthening protections 

for public and private sector whistJeblowers. More than 400 groups have endorsed our efforts to 

strengthen whistleblower legislation, on behalf of millions of Americans.' Our coalition is deeply 

concerned with how surveillance of government and federal contractor employees threatens civil 

service rights, whistleblower protections, and taxpayer accountability. 

The Food and Drug Administration (FDA) spied on whistleblowers-resulting in this hearing 

after significant media attention, statements and letters from concerned members of Congress, 

reports by my organization, lawsuits, and investigations by the Office of Special Counsel, the 

Health and Human Services (HHS) Inspector General, as well as the staff report for Chairman 

[ssa and Senator Grassley, anticipated to be released in conjunction with this hearing. 

The FDA Wbistleblowers 

The history of contention between FDA whistle blowers and the agency has been well 

documented. Thus, I will not delve into every detail, but instead will summarize and then 

highlight some of the more important facts. FDA physicians and scientists made whistleblower 

disclosures of their reasonable belief that the process for approving medical devices was broken, 

allowing potentially ineffective and unsafe products to be marketed. At a minimum, this resulted 

1 Open letter from Project On Government Oversight et aI., to President Barack Obarn. and Members of the III th 

Congress, regarding strong and comprehensive mustleblo",,"r rights, September 23, 2011. 

www.makeitsafecarnpaign.org/"P-content/uploads/20 13/11 fWP A-Sign-On-Letter .pdf(Downloaded November 15, 

2013) 

1 )OOG Stfe€-t NW SU!te 500· WashIngton DC 20005- (p) 202 347 t 122· P,-)go"ipogo orq' wwwpoCjoor9'SOl\()13, 
47 


Insert offset folio 27 here 87176.027

in reprisal for whistleblowing, allegations ofleaks of confidential information, and inappropriate 

surveillance of FDA whistleblowers by the FDA-basically, a federal maelstrom of misconduct. 

On October 14,2008, a group of eight FDA physicians and scientists wrote to Representative 

John Dingell, then-Chairman of the House Committee on Energy and Commerce/ as reported by 

The New York Times about five weeks later. J In the letter, the whistleblowers described serious 

wrongdoing by mid-level and senior FDA officials involved in approving medical devices before 

they are marketed through the 51 O(k) program Specifically, the whistleblowers stated that 

managers in the FDA's Center for Devices and Radiological Health (CDRH) had "failed to 

follow the laws, rilles, regu1ations, and Agency Guidance to ensure the safety and effectiveness 

of medical devices and consequently, they have corrupted the scientific review of medical 

devices. This misconduct reaches the highest levels of CDRH management including the Center 

Director and Director of the Office of Device Evaluation" 

The whistleblowers also asserted that "to avoid accolUltability, these managers at CDRH have 

ordered, intimidated and coerced FDA experts to modifY their scientific reviews, conclusions and 

recommendations in violation of the law [and] ... to make safety and effectiveness 

determinations that are not in accordance with scientific regu1atory requirements, to use lUlSolUld 

evaluation methods, and accept clinical and technical data that is not scientifically valid nor 

obtained in accordance with legal requirements, such as obtaining proper informed consent from 

human subjects." 

The FDA whistle blowers also stated that when physicians and scientists objected to these 

practices by CDRH managers, the managers engaged in reprisals. The whistleblowers stated that 

they had then contacted top FDA officials, including FDA Commissioner Andrew von 

Eschenbach, but following this there was little or no change in the practices of CDRH managers. 

The writers concluded their letter to Representative Dingell: "As the Branch of government 

responsible for oversight of the FDA, we urgently seek your intervention and help." 

Energy and Commerce Chairman Dingell and Subcommittee on Oversight and Investigations 

Chairman Bart Stupak subsequently wrote to FDA Commissioner von Eschenbach on November 

17,2008, summarizing the statements of the FDA employees and reviewing some of the federal 

laws on retaliation against whistleblowers. 4 

On January 7,2009, the FDA whistleblowers wrote to John Podesta, head of the Obarna 

presidential transition tearn, raising these concerns and listing medical devices that the FDA had 

2 Letter from FDA Whistleblowers to Representative John Dingell, regarding misconduct by FDA managers at the 

Center for Devices and Radiological Heath, October 14,2008. 

http://wmv.lasikcompiications.comlCDRHscientists(Oct08).pdf (Domlioaded February 24, 20 14) 

l Gardiner Harris, "F.D.A Scientists Accuse Agency Officials of Misconduct," The New York Times, November 

17,2008. http://wmv.nytimes.coml2008111/18Ihealth/oolicylI8fdahtmi? r=O (Domlioaded February 24, 20 14) 

4 Letter from Representative John Dingel!, Chairman oflhe Committee on Energy and Commerce and 

Representative Bart Stupak, Chairman of the Subcommittee on Oversight and investigations, to the Honorable 

Andrew von Eschenbach, Commissioner of the U.S. Food and Drug Administration, regarding the FDA 

whistle blowers and federal whistleblower laws, November 17,2008. 

http://wmv.pharmarnedtechbi.coml-/medial AJA72512AC214BDF AF7979622DCF A28C (Domlioaded February 

24,2014) 

2 
48 


Insert offset folio 28 here 87176.028

approved for marketing over the whistleblowers' objection that there was a lack of sufficient 

evidence of efficacy or safety-an objection that they had expressed to the managers. 5 For 

example, the scientists had objected to the FDA approval process for computer-aided detection 

devices (CAD) used in breast and colon cancer detection because the scientists considered them 

not to be safe or effective. The FDA whistle blowers wrote a similar letter to President Obama on 

April 2, 2009.6 

On January 15,2009, Senator Grassley sent a letter to FDA Commissioner von Eschenbach 

echoing the concerns of the whistleblowers and emphasizing the right of the whistleblowers to 

communicate with Congress without interference. 7 

In February 2009, POGO issued a report authored by Dr. Ned Feder that additionally exposed 

misconduct and flaws in the medical device approval process. 8 Based on internal FDA 

docwnents obtained by POGO, The FDA's Deadly Gamble with the Safety of Medical Devices 

shows that senior FDA officials in CDRH decided not to enforce a regulation-the Good 

Laboratory regulation or GLP-that helps protect patients from unsafe devices. The officials did 

this over the protests of CDRH scientists. Our report describes this and other serious problems in 

the FDA. 

There was considerable coverage of the whistleblowing in print and broadcast media.9 Some 

reports referred to the group of FDA scientists and physicians as the FDA whistleblowers or as 

the "FDA Nine."JO On March 13,2009, FDA employees received an email from FDA Acting 

Commissioner Frank Torti informing them that "FDA must comply with its obligations to keep 

certain information in its possession confidential .... Violation of these provisions can result in 

5 Letter from FDA Whistleblowers to John Podesta, Presidential Transition Team, regarding concerns and objections 

about FDA approved medical devices, January 7,2009. 

http://v,ww.\\11istleblowers.org!storage/whistleblowers/documentslFDA\\11istleblowerslletter2transitionteam.pdf 

~Downloaded February 24,2014) 

Letter from FDA Whistle blowers to President Barack Obama, regarding their concerns about FDA misconduct, 

April 2,2009. http://''WW.fi nance.senate.gov/imo/mediaidoclprg040209a.pdf (Downloaded February 24, 20 14) 

7 Letter from Senator Charles Grassley, Ranking Member Committee on Finance, to Honorable Andrew van 

Eschenbach, Commissioner ofthe U.S. Food and Drug Administration, regarding FDA \\11istleblowers and the right 

to communicate with Congress, January 15,2009. http://www.grassley.senate.gov/about/uploadlFDApdf 

\Downloaded February 25, 20 14) 

Project On Government Oversight, The FDA's Deadly Gamble with the Softly a/Medical Devices, February IB, 

2009. http://v,ww.pogo.orgiour-workireports/2009/ph-fda-20090218.html. 

9 ''FDA scientists allege mismanagement at agency," January 9,2009. Video clip. Accessed February 24, 20 14. 

CNN.com. http://v,ww.cnn.com/2009/POLITICS/01/09/fda.scientists/#cnnSTCVideo (Downloaded February 24, 

2014); Ricardo Alonso-Zaldivar, ''FDA scientists complain to Obama of'corruption,"'The Associated Press, 

January 8,2009. http://v,ww.foxnew.;.comiprinter friendly wiresl2009JanOB/0,4675,FDADissidents,00.html 

(DownlOaded February 24, 20 14);AliciaMundy and Jared A Favale, ''FDA Scientists AskObama to Restructure 

Drug Agency," The Wall StreerJournal, January B, 2009. 

http://online.w.;j.com/new.;/artic1eslSBI231425621 04564381 (Downloaded February 24, 20 14); Gardiner Harris, "In 

F.DA Files, Claims of Rush to Approve Devices," The New York Times, January 12,2009. 

http://v,ww.nytimes.com/2009101I13/healthipolicy/13fda.htm1? r= I & (Downloaded February 24,2014) 

10 Some ofthe whistiebloweT6 were federal employees, and others were contractors. And the number of 

whistleblowers has changed over time-now there are only five seekingjustice in court. 

3 
49 


Insert offset folio 29 here 87176.029

disciplinary sanctions and/or individual criminal liability." II Senator Grassley shot back with 

letter to Torti stating, "If the memo sent last week was intended to have a chilling effect on FDA 

employees who want to speak up about problems, then that memo is contrary to the President's 

call for open and transparent government, and the Acting Commissioner needs to set the record 

straight." 12 

FDA Surveillance of the Whistleblowers 

It isn't clear exactly when it began, but the FDA admits that it conducted a secret surveillance 

program to monitor the whistleblowers' emails and other computer-generated documents. I] 

The FDA claims the surveillance was in response to the unauthorized disclosure of confidential 

commercial information to journalists in 2009 and 2010. The targets were the individuals known 

to have blown the whistle in letters to Congress, President Obarna, and the President's Transition 

Team 

On April 21,2010, the FDA received a request from the legal counsel for GE Healthcare, Inc. 

that the FDA investigate how information GE Healthcare considered a trade secret had appeared 

in a Times article on March 28, 2010. 14 The article included statements by two of the FDA 

whistleblowers. 

Incredibly, the CDRH managers claim that it was in response to that letter that they began to use 

spyware on April 22, 2010, to conduct surveillance on one of the scientists quoted in the 

article l5-which was only one day after the letter was received. 16 Instead of going to the HHS IG 

prior to beginning the investigation, as required by HHS procedures,17 CDRH managers 

II Frank Torti, Acting Commissioner of Food and Drugs, e-mail message to FDA employees, ''Re: Protecting 

Confidential Information," March 13,2009. http://online.wsj.com/public/resourcesldocumentslwsj090317-

Tortimemo.pdf(Downloaded February 25,2014) 

12 Senator Chuck GrassleyofIooo, "Grassley works to protect FDA v.histleblowers,"March24,2009. 

http://www.grassley.senate.gov/news/ Article.cfm?customel dataPagelD 1502= 19930 (Downloaded Fe bruary 25, 

2014) 

{J Letter from Jeanne Ireland, Assistant Commissioner for Legislation at the Food and Drug Administration, to 

Senator Charles Grassley, Ranking Member of the Committee on the Judiciary, regarding information about the 

FDA's use of computer monitoring, July 13,2012. http://www.grassley.senate.gov/aboutiuploadlFDA-7-13-12-

agency-response-to-Grassley-regarding-email-surveillance-on-eve-of-NYT-story.pdf(Downloaded February 24, 

2014) (Hereinafter Letter from Jeanne Ireland, Assistant Commissioner for Legislation at the Food and Drug 

Administration) 

14 Gardiner Harris "Scientists Say F.D.A Ignored Radiation Warnings," The New York Times, March 28, 20 I O. 

http://www.nytimes.com/2010/03/29/health/policy/29fdahtml? FO (Downloaded February 24, 20 14) 

Il Letter from Jeanne Ireland, Assistant Commissioner for Legislationatthe Food and Drug Administration, p. 3. 

16 Kimberly Holden, Assistant Commissioner for Management at the Food and Drug Administration, e-mail 

message to Horace Coleman and Mark McCormack, "FW: Advice/Investigation," Apri123, 20 1 O. 

http://pogoarcruves.orgfm/wi/holden-emails-to-coleman-201 00423 .pdf(Downloaded February 25,2014) 

17 The HHS manual states in pari: 

"A In orderto provide objective uniform procedures for the handling of allegations of wrongdoing covered by this 

chapter, it shall be the responsibilityofthe Office of Inspector General (OIG) to investigate allegations of 

wrongdoing reported to the OIG or to refer such allegations to the appropriate operating division(OPDIV), the 

appropriate staff division (STAFFDIV), to Assistant Secretary for Administration and Management (ASAM), to 

another law enforcement agency, or to another appropriate authority. 

4 
50 


Insert offset folio 30 here 87176.030

requested that the Office of Internal Affairs (OlA) investigate "unauthorized disclosure of 

information.,,18 The OlA rightly referred the matter to HHS IG in order to "remove any potential 

allegations of impartiality." 

HHS IG declined to investigate on May 18, 2010 in a letter stating: 

Additionally, 5 U.S.C. § 1213, identifies that disclosures, such as the ones alleged, when 

they relate to matters of public safety may be made to the media and Congress as long as 

the material released is not specifically prohibited by law and protected by Executive 

Order or National Security Classification. 19 

Perhaps the CDRH managers improperly took matters into their hands because the HHS IG had 

declined a request by the FDA Conunissioner's Office to investigate an earlier alleged 

unauthorized disclosures related to the FDA whistleblowers' whistleblowing in late 2008 and 

early 2009.20 On March 26,2009, then-FDA Assistant Conunissioner WilliamMcConagha made 

a referral to HHS OIG after having received a letter of complaint from the attorney of device 

maker iCAD. 

In any case, the CDRH managers spent the coming months spying on the FDA whistleblowers. 

Once they thought they had collected evidence of criminal violations, CDRH Director Dr. Jeffry 

Shuren, requested an HHS IG investigation. 

Again, HHS IG declined to investigate the alleged unauthorized disclosures by the 

whistleblowers, but first consulted with the Department of Justice to determine if there was 

evidence of a criminal violation. DOJ declined to prosecute, and HHS IG closed the case with a 

November 15,2010, declination letter to the Director ofCDRH, which states: 

B. E'lery employee, supervisor, and management official shall report any allegations of criminal offenses he/she 

recei'les, immediately to the OlG, unless it is clear to himlherthat the allegation is frivolous and has no basis in 

fact." .. . 

D. Any employee 000 has authority to take, direct others to take, recorrunend, or approve any personnel action. shall 

not, with respect to such authority, take or threaten to take any action against any employee as a reprisal for making 

a complaint or disclosing information to a supervisor, management official, or the DIG." Department of Health and 

Human Services, "General Administration Manual Chapter 5·10: Procedures for Reporting Misconduct and 

Criminal Offenses," December26, 2006. http://wv.w.hhs.govlhhsmanuals/gamlchapters/5. 1 0 rev.pdf(Downloaded 

February 25,2014) 

" Mark McCormack, Office of Internal Mfairs at the Food and Drug Administration, "Case Initiation and Fact 

Sheet," May 14,20 I O. http://pogoarchives.orglmiwi/fda.oia'ci.and.fact·sheet·20l40423.pdf(Dom>loaded February 

25,2014) 

19 Letter from Scott Vantrease, Assistant Special Agent in Charge, Special Investigations Branch ofthe Food and 

Drug Administration Office of the Inspector General, to Mark McCormack, Special Agent in Charge, regarding the 

decision not to investigate allegations of leaks, May 18,2010. 

wv.w.kkc.comifilesloigletter.fdawbdisclosuresprotected.pdf (Downloaded February 24, 20 14) 

20 Letter from William McConagha, Assistant Commissioner for Integrity and Accountability, Department of Health 

and Human Services, to Scott Vantrease, Directorofthe Special Investigations Unit at the Department of Health and 

Human Services Office of Inspector General, regarding referring allegations of misconduct for a formal 

investigation, March 26, 2009. http://pogoarchiYes.org/miwi/mcconagha·2nd.referral.hils·oig.re-icad· 20090326 .pdf 

5 
51 


Insert offset folio 31 here 87176.031

Your office indicated it had developed sufficient evidence to address the misconduct 

through administrative process, and as such, no further action will be taken by the OIG?I 

But instead of taking disciplinary action through an administrative process, CDRH managers 

continued their unauthorized spying on the whistleblowers. 

This initially narrow surveillance quickly expanded into what The New York Times called, "a 

much broader campaign to counter outside critics of the agency's medical review process." 22 A 

program called Spector 360 was used to take screenshots "every five seconds, all e-mails sent or 

received on the laptops, all data stored on or printed from the computers, all keystrokes 

performed, and data stored on personal thumb drives attached to the computers." Documents 

were cataloged in 66 huge directories reportedly containing more than 80,000 pages of computer 

documents culled from what must have been millions of data viewed by contractors hired by the 

CDRH managers to conduct the surveillance. 

Swept up in the dragnet were whistleblowerdisclosures to congressional staff, the Office of 

Special Counsel, and my organization, the Project On Government Oversight. 

On January 15,2012, the FDA Whistleblowers filed a lawsuit claiming violations of their rights 

under the First, Fourth, and Fifth Amendments.23 

Interestingly, none of this may have come to light if the documents captured in the surveillance 

had not been reportedly posted online by an FDA contractor. 24 The Washington Post reported 

that among the trove of FDA documents found to have been posted online, there were "Copies of 

the e-mails show that, starting in January 2009, the FDA intercepted communications with 

congressional staffers and draft versions of whistleblower complaints complete with editing 

notes in the margins.,,25 

]be revelations of the surveillance set off a firestorm that led to this hearing today?6 Naturally, 

Senator Grassley was incensed by the surveillance of the whistleblowers, having already warned 

21 Letter from Scott Vantrease, Assistant Special Agent in Charge, Special Investigations Branch ofthe Food and 

Drug Administration Office of the Inspector General, to Jeffrey Shuren, Director ofthe Center for Devices and 

Radiological Health, regarding alleged misconduct by the FDA whistle blowers, November 15,2010. 

http://oogoarchives.orglmlwi/vantrease-20 101115.pdf(Do,.,uoaded February 24, 2014) 

2l Eric Lichtblau and Scott Shane, "Vast F.DA Effort Tracked E-Mails oflts Scientists," The New York Times, July 

14,2012. hrtp:llwww.nytimes.coml2012/07 /] 51ns/fda-surveiHance-of-scientists-spread-to-outsidecritics.html?page\WIlted~all (Downloaded February 24,2014) (Hereinafter"Vast F.DA Effort Tracked E-Mails of 

Its Scientists") 

23 Hardy v. Shuren, No. I: ll-cv-01739(D. D.C. filed Sept. 28,2011) [Second Amended Complaint filed July 17, 

2012] http://epic.orgiarnicusJfdalhardylHardy-v-Shuren-2nd-Complaint.pdf (Downloaded February 25, 20 14) 

24 "Vast F.DA Effort Tracked E-Mails oflts Scientists" 

25 ElienNakashima and Lisa Rein, ''FDA staffers sue agency over surveillance of personal e-mail," The Washington 

Post, Jannary 29,2012. hrtp:llwww.w.oshinglonoost.comiworldJnational-securitylfda-staffer.;-sue-agency-oversurveillance-of-personal-e-mail/2012J01/23/gIQAj34DbQ story.html (Do,.,uoaded February 24, 20 14) ,6 Ellen Nakashima and Lisa Rein, ''FDA lav.yers authorized spying on agency's employees, senator says," The 

Washington Post, July 16,2012. http://artic1es.w.oshingtonoost.coml2012-07-16/politics!35489846 1 erica6 
52 


Insert offset folio 32 here 87176.032

the FDA to uphold legal protections for the whistleblowers. 27 On January 31,2012, Senator 

Grassley sent the FDA Corrmrissioner yet another strongly-worded letter pointing out that 

interfering with communications to Congress is a violation of the law. 28 He told The New York 

Times that agency officials "have absolutely no business reading the private e-mails of their 

employees. 'They think they can be the Gestapo and do anything they want. ,,29 

Representative Chris Van Hollen said, "It is absolutely unacceptable for the FDA to be spying on 

employees who reach out to members of Congress to expose abuses or wrongdoing in 

government agencies.,,30 Investigations were begun or expanded by Senator Grassley, Chairman 

Issa, the HHS IG, and the OSC. 

In two memos circulated together on June 20, 2012, the President's Office of Management and 

Budget (OMB) and the OSC directed all agencies to "evaluate their monitoring policies and 

practices, and take appropriate steps to ensure that those policies and practices do not interfere 

with or chill employees' use of appropriate channels to disclose wrongdoing.,,31 However, the 

FDA has not yet done so. 

Unanswered Questions 

It is not yet known whether the FDA whistleblowers will get the justice they seek or whether 

FDA managers will be held accOlUltable for retaliation. The whistleblowers' lawsuit is still 

pending, as is the OSC's investigation into retaliation. Though the HHS IG did not investigate 

the alleged leaks of confidential information, the IG twice reviewed the claims of retaliation by 

the whistleblowers and did not substantiate retaliation.J2 However, POGO has long been 

jefferson-frla-contractor-computer-surveillance (Downloaded March 4, 20 13) (Hereinafter "FDA lawyers authorized 

sfying on agency's employees, senator says") 

2 "FDA lawyers authorized spying on agency's employees, senator says" 

18 Letter from Senator Charles Grassley, Ranking Member of the Committee on the Judiciary, to the Honorable 

Margaret Hamburg, Commissioner of the Food and Drug Administration, regarding the agency's trearment of 

whistleblo""rs, January 31,2012. http://pogoarchives.orgimlwi/ceg-to-fda-whistleblo,,,,r-20120131.pdf 

Z9 "Vast F.DA Effon Tracked E-Mails ofIts Scientists," 

30 Jason Lange, Andy Sullivan and Anna Yukhananov, "FDA surveillance operation draw.; criticism from 

lawmakers," July 15,2012. http://articles.chicagotribune.coml20 12-07-15/news/sns-n-us-usa-fdalawmakersbre86eOgx-20 120715 I fda-medical-devices-surveillance (Downloaded February 24, 20 14) 

li Memorandum from Steven VanRoekel, Federal Chieflnformation Officer and Boris Bershteyn, General Counsel, 

to the Chief Information Officers and General Counsels, regarding Office of Special Counsel Memo on Agency 

Monitoring Policies and Confidential Whistleblo""r Disclosures, June 20,2012. 

http://www. whis t Ie bl 0 wers.orgisto rage/whistle blo""rs/documentsi ombandosc .monitoringmemo .pdf (Downloaded 

March 4,2013) 

32 Investigative Memorandum from Elton Malone, Special Agent in Charge, Special Investigations Branch, 

Department of Health and Human Services Office oflnspectorGeneral, to Unknown FDA Employees, regarding 

ciosingthe investigation, October 14,2010. http://pogoarchives.orWmlwi/oig-memo-no-prohibited-practices20 I 0 I 014.pdf (Hereinafter Investigative Memorandum from Elton Malone); Investigative Memorandum from Elton 

Malone, Special Agent in Charge, Speciallnvestigations Branch, Department of Health and Human Services Office 

oflnspector General, to Unknown FDA Employees, regarding closing the investigation, February 4,20 I O. 

http://pogoarchives.orgim/wi/oig-memo-prohibited-personnel-practices-201 oo204.pdf; Letter from Timothy Menke, 

Deputy Inspector General for Investigations Department of Health and Human Services Office oflnspector General, 

to Joshua Sharf stein, Principal Deputy Commissioner Department of Health and Human Services, regarding the 

status ofthe OIG investigation, February 23,2010. http://pogoarchives.orgimlwi/oig-Ietter-re-mgmt-wrongdoing20 1 00223.pdf. 

7 
53 


Insert offset folio 33 here 87176.033

concerned that the two reviews were conducted improperly.33 The first HHS IG investigation 

focused on criminal wrongdoing, instead of non-criminal retaliation for whistleblowing. And, 

from our January 2011 letter to FDA Commission Margaret Hamburg regarding the second 

investigation: 

The Office of Investigations did not conduct a new investigation, but instead initiated a 

"Special Inquiry." According to the Investigative Memorandum of October 2010, the 

findings of the Special Inquiry were based on the "case file and all reports and evidence 

contained therein"-in other words, the findings of the recent Special Inquiry in 

September 2010 were based exclusively or almost exclusively on docwnentation gathered 

during the 2009 investigation But the 2009 investigation was looking for the wrong 

things: criminal violations rather than administrative wrongdoing (i.e. alleged violations 

of FDA regulations and whistleblower retaliation). 

Also still in question is whether the FDA medical device approval process has improved at all. 

Have the concerns raised in the first place by the FDA whistleblowers about ineffective and 

dangerous devices been adequately addressed? 

In August of 20 10, CDRH responded to the substance of whistleblowing by issuing an action 

plan and requesting an independent review of the troubled 51 O(k) program. 34 CDRH asked the 

Institute of Medicine (10M) to conduct this review, and 10M determined the 510(k) program 

should be scrapped and replaced with an integrated premarket and post-market regulatory 

framework. 35 The 10M report states: 

510(k) clearance is not a determination that the cleared device is safe or effective. The 

committee concludes that the 510(k) process lacks the legal basis to be a reliable 

premarket screen of the safety and effectiveness of moderate-risk devices and, 

furthermore, that it cannot be transformed into one. 

The CDRH ignored this recommendation and continued the program 

In the 5 10(k) process, the whistleblowers objected to management overruling the scientists' and 

physicians' recommendations that the FDA should not approve a particular device for marketing. 

The FDA has regulations, including 21 CFR 10.70, describing clearly what must happen when 

JJ Letter from Project On Goverrunent Oversight, to the Honorable Kathleen Sebelius, Secretary of the U.S. 

Department of Health and Hwnan Services, regarding the FDA's negligent oversight of unsafe medical devices, 

January 12,2011. http://www.oogo.orglour-workilettersf2011lph-fda-20110112.html(Hereinafter Letter regarding 

the FDA's negligent oversight of unsafe medical devices) 

J4 Steve Strong, "The Ever-Changing Regulatory Envirorunent," Minnetronix 

http://www.minnetronix.comlpartials/company-industry insights-singlelthe-ever-changing-regulatory-environmentl 

(DomUoaded February 24, 20 14) 

35 Institute of Medicine ofthe National Academies, Medical Devices and the Public's Health: The FDA 51 O(k) 

Clearance Process at 35 Years, July 29, 20 II. http://www.iom.edul-/mediaiFilesfReport%20Filesf2011/MedicalDevices-and-the-Publics-Health-The-FDA-51 Ok-Clearance-Process-at·35-

Yearsl5 I Ok%20Clearance%20Process%2020 I I %20Report%20Bnef.pdf(DomUoaded February 24,20 14) 

8 
54 


Insert offset folio 34 here 87176.034

there are "significant controversies or differences of opinion" over decisions. 36 However, 

managers violated these regulations, and the result was the marketing of devices that are unsafe 

or ineffective. POGO has repeatedly asked for more oversight to ensure that efficacy and public 

health and safety are the priorities in medical device approvals. 37 

The HHS IG has initiated investigations into FDA's internal controls and quality review for 

StOCK) device approval process and CDRH's policies for resolving scientific disputes.38 

Undeniable: The FDA's Improper Employee SlllVeillance 

What is evident is that the FDA acted improperly in its surveillance of FDA whistleblowers. 

There is wide agreement that at a minimum the FDA improperly conducted employee 

surveillance and jeopardized whistleblower and privacy protections. 

In addition, the FDA's employee surveillance does not appear to have been effective as an 

investigative tool for the stated purpose. But employee surveillance is a handy tool for those 

seeking to chill whistleblowing and retaliate against whistleblowers. As with the NSA domestic 

surveillance, the risks to the rights of those under surveillance seem to outweigh the 

enhancements to security. 

What's at Stake? 

Lives are at stake. The FDA's problems can be deadly. There have been far too many ineffective 

and unsafe medical devices approved by the broken agency: 

• Inadequately tested metal-on-metal hip replacements caused a crippling, hard-to-treat 

disability.39 

• Defective cardiac defibrillators worked well when first implanted, but later some of them 

suddenly failed. 40 

• Unclean syringes containing deadly bacteria caused serious and sometimes fatal 

infections.41 

36 21 CFR I 0.70, ~'Documentation of significant decisioM in administrative file," 

http://'M>W.gpo.gov/fdsys/pkglCFR-20 12-title21-voll/pdf/CFR-20 12-title21-voll-sec I 0-70 .pdf (DomUoaded 

February 25,2014) 

"Letter from Project On Government Oversight, to Gerry Roy, Deputy Inspector General for Investigations, Office 

of Investigations at the Department of Health and Hwnan Services, regarding FDA's CDRH's low standard of 

medical devices approval, September28, 201 O. http://'M>W.oogo.orgiour-workileltersl2010/ph-fda-20Ioo928-

I.html; Letter regarding the FDA's negligent oversight of unsafe medical devices; Project On Government 

Oversight, "Obama Administration Should Re-Open Investigation of FDA Wrongdoing After Inspector General 

Office Rejected Whistleblower Complaints," January 13,2011. http://'M>W.oogo.orgiabout/pressroom/releases120 Il/ph-fda-20 100 113.html#sthash.KODI1W4a.5Ev9Gx9g.dpuf 

38 Investigative Memorandwn from Elton Malone 

39 Gregory Curfman and Rita Redberg, "Medical Devices-Balancing Regulation and innovation," New England 

Journal a/Medicine, Vol. 365, September 15,201l,pp. 975-977. 

http://'M>W.nejm.orgidoi/full/10.1056INEJMpII09094 (Downloaded February25, 20 14) 

40 William H. Maisel, ''Semper Fidelis--Conswner Protection for Patients with Implanted Medical Devices," New 

England Journal a/Medicine, Vol. 358, March 6, 2008, pp. 985-987. 

http://www.nejm.orgldoi/full/l 0.1 056INEJ Mo0800495 (Downloaded February 25, 20 14) 

9 
55 


Insert offset folio 35 here 87176.035

• Old-fashioned pediatric feeding tubes caused fatalities because they lacked a well-known, 

inexpensive safeguard that precludes accidental infusion of pureed baby food directly 

into the baby's bloodstream 42 

And this is just medical devices. The FDA has also failed to contain deadly food contamination 

outbreaks4l and have allowed dangerous drugs44 on the market. The FDA isn't doing its job and 

lives are at risk; and we have to ask: Why?4S 

Whistleblowers are the guardians of the public trust and safety. Without proper controls at FDA 

and throughout the government, employee surveillance is a serious threat to whistle blower 

protections. The resulting chilling effect will significantly reduce accountability-thus keeping 

waste, fraud, abuse, and threats to public health and safety in the shadows. Whistleblowers also 

are among the best partners in crime-fighting. It is a well-known fact that whistleblowers have 

saved countless lives and billions of taxpayer dollars. 

A survey conducted in 2012 by the Association of Certified Fraud Examiners found that nearly 

half of occupational fraud cases were uncovered by a tip or complaint from an employee, 

41 Christina Jewett, "Could FDA Have Prevented Syringe Deaths?" ProPublica, February 26, 2009. 

http://YMW.propublicaorgiartic le/could-fda-have-prevented-in-syringe-deaths (DovmJoaded February 25,2014) 

42 Gardiner Harris, ''U.S. Inaction Lets Look-Alike Tubes Kill Patients," The New York Times, August 20,2010. 

http://YMW.nytimes.coml2010/08/211healthioolicy/21tubes.html?pagewanted~all (DovmJoaded February 25, 2014) 

The fatalities can be prevented completely by a requirementthat the feeding tube have a connectorincompatible 

with connectors for intravenous fluids; See also: Associated Press, '1s the FDA a broken agency?" March 3, 2009, 

http://YMW.today.com/idl29 4 9 5269 14 313 685 1 %20 1n%2Othe%20fi ve%2Oyears%2 Os ince%20the%20 AP%20article 

%20was%20published,%2Omore%20disasterso/020%20have%20occurred.#.UwznEONdW41 (DovmJoaded February 

25,2014) (Hereinafter '1s the FDA a broken agency?"); POGO summarized the story of some of these disasters: 

Ned Feder, ''Powerful Leader Takes Command ofa Battered FDA: Irresistible Force Meets Immovable Object," 

May 19,2009. http://www.oogo.orglaboutipress-roomlreleasesI2009/ph-fda-20090519.html(Hereinafter·.Powerful 

Leader Takes Command ofa Battered FDA: Irresistible Force Meets Immovable Object"); Letter from Danielle 

Brian and Ned Feder, Project On Government Oversight, to Kathleen Sebelius, Secretary, U.S. Department of 

Health and Human Services, regarding reinvestigating FDA's negligent oversight ofWlSafe medical devices. 

Januaryl2, 2011. http://www.pogo.orglour-workllettersl20111ph-fda-20110112.html (Hereinafter Letter from 

Danielle Brian and Ned Feder, Project On Government Oversight, to Kathleen Sebelius) 

4J Salmonella-infected peanut butter: Centers for Disease Control and Prevention, "Multistate Outbreak of 

Salmonella Bredeney Infections Linked to Peanut Butter Manufactured By Sunland, Inc. (Final Update)," November 

30,2012. http://www.cdc.gov/salmonellaibredeney-09-12I(Downloaded February 25,20 14); Listeria-infected 

cantaloupes: Centers for Disease Control and Prevention, '1nvestigation Update: Multistate Outbreak of Listeriosis 

Linked to Whole Cantaloupes from Jensen Farms, Colorado," October 25, 20 II. 

http://www.cdc.gov/listerialoutbreaks/cantalouoes-jensen-fums/102511/index.html(DovmJoaded February 25, 

2014) 

44 Fungus-contaminated steroid mixture: Centers for Disease Control and Prevention, "Multistate Outbreak of 

Fungal Meningitis and Other Infections," October 23, 20 13. http://www.cdc.gov/hai/outbreaks/meningitis.html 

(DovmJoaded February 25,2014); Heparin: Gardiner Harris, ''U.S. Identifies Tainted Heparin in 11 Countries," The 

New York Times, April 22, 2008. http://www.nytimes.coml2008/04/22/health/oolicy/22fdahtml?pagewanted~alI 

(Downloaded February 25,2014) 

., '1s the FDA a broken agency?"; ''Powerful Leader Takes Command ofa Battered FDA: Irresistible Force Meets 

Immovable Object"; Letter from Danielle Brian and Ned Feder, Project On Government Oversight, to Kathleen 

Sebelius. 

10 
56 


Insert offset folio 36 here 87176.036

customer, vendor, or other source.46 In the case of fraud perpetrated by owners and executives, 

more than half were uncovered by tips from whistleblowers. A 2011 academic study confirmed 

that whistleblowers playa bigger role than external auditors, government regulators, selfregulatory organizations, or the media in detecting fraud. 47 

But perhaps the best illustration of how whistleblowers can save taxpayer dollars is the more 

than $38 billion recovered since 1987 through the hugely successful False Claims Act (FCA), 

championed by Senator Grassley.48 

The FCA prohibits a person or entity from fraudulently or dishonestly obtaining or using 

government fimds. The law not only acts as a deterrent, but also incentivizes whistleblowing 

through the financial awards and strong protections against retaliation 49 Federal Circuit Court 

Judge Kenneth Keller Hall said that the FCA provisions supplement the government's "regular 

troops" since it "let loose a posse of ad hoc deputies to uncover and prosecute frauds against the 

government. ,,50 

But unfortunately, the cost-benefit analysis for most whistleblowing is so often all cost to the 

whistleblower and all benefit to society. Professor Richard E. Moberly in his testimony before 

Congress aptly stated: 

Furthermore, almost all the benefits of a whistleblower' s disclosure go to people other 

than the whistle blower: society as a whole benefits from increased safety, better health, 

and more efficient law enforcement. However, most of the costs fall on the 

whistleblower. There is an enormous public gain if whistle blowers can be encouraged to 

come forward by reducing the costs they must endure. An obvious, but important, part of 

reducing whistleblowers' costs involves protecting them from retaliation 

after they disclose misconduct. 51 

Whistleblowing works for the public, but not without strong protections for the whistleblower. 

Recognizing this, Congress has repeatedly strengthened the rights and procedures available to 

whistleblowers. In 2012, Chairman Issa and Ranking Member Cummings-along with 

46 Association of Certified Fraud Exarniners, Report to the Nations on Occupational Fraud &Abuse: 2012 Global 

Fraud Study, 20 12, pp. 14-19. http://WNW.acfe.comluploadedFiles/ACFE Website/Content/rttnl20 12-report-tonations.pdf (Downloaded February 20,2014) 

47 Alexander Dyck, Adair Morse, and Luigi Zingales, "Who Blows the Whistle on Corporate Fraud?" 

http://WNW.afajof.orgfafaiforthcoming/4820p.pdf(DownloadedMay 10,20 II) 

48 Department of Justice, Office of Public Mfairs, "Fraud Statistics -Overview: October I, 1987 - SeptemberJO, 

20 I 3," December 23, 20 13. http://WNW.justice.gov/civil/docs forms/C-FRAUDS FCA Statistics.pdf(Downloaded 

February 20, 2014) 49 31 U.s.c. § 3730, "Civil actions for false claims." http://WNW.gpo.gov/fdsys/pkg/USCODE-2011-

title31/pdfIUSCODE-2011-title31-subtitleIn-chap3 7-subchapIfI-sec3730.pdf(DownloadedFebruary 25, 20 14) 

50 United States ex rei. Milamv. Univ. afTex. M.D. AndersanCancer Ctr., 961 F.2d46,49 (4thCir. 1992), 

paragraph 17. http://law.justiacomicases/federaliappellate-courtslF21961146f.208412/ (Downloaded February 20, 

2014) 

11 Testimony of Richard E. MOberly, Professor, before the Committee on Education and Labor, Subcommittee on 

Workforce Protections, One Hundred Tenth Congress, on "Private Sector Whistleblowers: Are There Sufficient 

Legal ProtectionsT'May 15,2007,p. 35. http://WNW.gpo.gov/fdsys/pkgfCHRG-110hhrg35185/pdf/CHRG110hhrg35185.pdf(DownloadedDecember 1,2011) 

II 
57 


Insert offset folio 37 here 87176.037

Representative Van Hollen, then-Representative Platts, and their Senate colleagueschampioned the latest enhancements to federal employee protections with the enactment of the 

Whistleblower Protection Enhancement Act. 52 While these reforms go a long way to improve the 

prospects for whistleblowing on government wrongdoing, employee surveillance, left 

unaddressed, seriously undermines these and other statutory protections for whistleblowersthat 

Congress intended. 

An Opportunity for Reform 

This committee's attention to the unacceptable actions of the managers at FDA will hopefully 

serve as a catalyst for government-wide reforms. Certainly security concerns and available 

technology will outstrip the protection of civil liberties, whistleblowerprotections, and other 

constitutional rights unless there is a concerted effort to consider all of these goals together. We 

can and should move towards a better policy and to ensure more accountability now. But if left 

to their own devices, the agencies cannot be expected to get this right. 

The FDA and other agencies should not be in the surveillance or law enforcement business. 

Federal agencies cannot be allowed to police themselves-that is why we have IGs, the OSC, 

Dol, and Congress. 

Investigations of unauthorized, illegal disclosures of information and other criminal misconduct 

must be conducted by law enforcement investigators-such as the FBI or the Inspectors 

General-not bureaucrats. While we acknowledge there may be a very limited need for agencies 

to gather evidence of wrongdoing by employees when there is reasonable suspicion of noncriminal misconduct, the electronic surveillance is ripe for abuse-as demonstrated by the FDA. 

Even with just cause and proper controls, it will be difficult, if not impossible to ensure 

constitutional rights are not violated. 

To what end? As with the NSA domestic surveillance, the risks to our rights may be greater than 

the ability of the surveillance to protect against risks to security. 

On September 12,2012, FDA Commissioner Hamburg issued a memorandum directing the 

Chief Information Officer (CIO) and Chief Counsel to "promptly develop a written procedure" 

for employee surveillance that includes some safeguards (Hamburg Memo).53 Preswnably, that 

written procedure is embodied in the interim policies and procedures established last September 

by the FDA in its Staff Manual Guide (Interim Policy).54 No doubt the FDA is in a tough spot, 

52 Project On Government Oversight et al., "After a Campaign Waged Over More Than a Decade, the Whistleblo""r 

Protection Enhancement Act Becomes Law," December 3,2012. http://www.pogo.orglabout/pressroomlreleasesi20 12120 121203 -advocates-Iaud-president-whistleblo""r-reforms.html 

53 Memorandum from Margaret Hamburg, Commissioner of the Food and Drug Administration, to Walter Harris, 

Chief Operating Officer, Eric Perakslis, Chieflnformation Officer, and Elizabeth Dickinson, Chief Counsel of the 

Food and Drug Administration, regarding developing a written procedure for employee surveillance, September 24, 

2012. http://pogoarchives.orglm/wi/harnburg-memo-20 120924.pdf (Hereinafter Memorandum from Margaret 

Hamburg) 

54 Walter Harris, Deputy Commissioner for Operations, Chief Operating Officer at the Department of Health and 

Human Services, "Monitoring of Use ofHHS/FDA IT Resources," September 26, 20 13. 

http://pogoarchlves.orglmlwi/interim-monitoring-policy-20 130926.pdf 

12 
58 


Insert offset folio 38 here 87176.038

attempting to put into place a process that is more proscribed for surveillance critics, but also 

placating the lawyers for drug and device companies that demand that information be kept 

confidential. 

Needless to say, the FDA doesn't have it right yet. 

Nothing in this policy would prevent the FDA Commissioner or Chief Operating Officer from 

using information collected by the surveillance as retaliation for whistleblowing or providing it 

to others who might. The policy does little to lift the chilling effect at FDA that fosters waste, 

fraud, abuse, and threats to public health and safety. How can the FDA ensure the public's health 

and safety if scientists and physicians are too afraid to come forward when deadly mistakes are 

made? 

Instead, the interim policy would allow the FDA managers to control a vast and far-reaching 

surveillance program without any oversight from an independent outside entity. Rather than 

protect whistleblowers from unwarranted FDA surveillance, this policy protects the FDA from 

whistleblowers and shields it from accountability. 

Simply stating that the FDA will follow existing laws to protect whistleblowers is not enough--

the procedures do not build in strong, substantive safeguards. The Interim Policy does attempt to 

protect some sensitive communications by prohibiting the targeting of communications with law 

enforcement, the OSC, members of Congress or their staff, employee union officials, or private 

attorneys. However, it does not include a similar prohibition on other protected disclosuresmost notably, public whistleblowing, which is protected as long as the disclosure of the 

information is not prohibited under law. 

Congress protected public whistleblowing because we live in a democracy that relies on an 

informed public and freedom of the press. In numerous instances, threats to public health and 

safety, waste, fraud, and abuse and other wrongdoing would never have come to light or been 

addressed without public whistleblowing.55 

The FDA has not ensured employees, contractors, and grantees can exercise all of their legal 

rights without fear of retaliation. ThU5, any final policy mU5t prohibit specifically monitoring 

communications with anyone that may include a protected disclosure. According to the 

Whistleblower Protection Act, these communications would include a reasonable belief that the 

disclosure evidences "any violation of any law, rule, or regulation; or gross mismanagement, a 

gross waste offtmds, an abuse of authority, or a substantial and specific danger to public health 

or safety."s6 

In practice, it may be difficult, if not impossible, to prevent the inadvertent capture of protected 

disclosures while monitoring employee communications. Therefore, any final policy must 

" David Shuster, ''Whistle-blowers...no made their mark," NBC New.;, JW1e 2, 2005. 

http://www.nbcnews.comlidl8076349/ns/msnbc-hardballwithchrismatthew.;/t/whistie-blowers-...no-made-theirmarkl#.UwuAnuNdWSo (Do\mloaded February 24,2014) 

'6 5 U.S.c. §2302, ''Merit system principles," http://www.gpo.gov/fdsys/pkglUSCODE-2010-title5/pdf/USCODE20 I 0-title5-partlIl-subpartA-chap23 .pdf (Do\mloaded February 25, 20 14) 

\3 
59 


Insert offset folio 39 here 87176.039

mandate a legal review and express authorization before any potentially protected 

communication that is collected is shared. Notification of potential legal pitfalls to recipients of 

collected information, as called for in the Hamburg Memo, is woefully insufficient.57 

The FDA must do more to ensure all agency personnel and federal fund recipients are better 

trained in whistleblower protections. Under the WP A, it is the responsibility of the head of each 

agency, in consultation with the Office of Special Counsel, to ensure that agency employees are 

informed of the rights and remedies available to them under the Whistleblower Protection Act. 58 

The OSC, has a certification program which allows agencies to demonstrate that they have 

fulfilled this legal obligation. Last year, only three agencies sought and received certificationand, remarkably, the FDA was not one of them 59 Clearly, certification should not be voluntary. 

Last December, in its second National Action Plan for the Open Government Partnership, the 

Obama Administration committed to taking steps over the next two years with the stated goal of 

strengthening and expanding protections for federal whistleblowers. 60 These commitments 

include mandating participation in the Office of Special Counsel's Whistleblower Certification 

Program However, Congress should ensure that agency compliance with the WPA notification 

requirement and certification will continue into the future by putting the requirement into statute. 

Federal contractors and grantees also are required to notifY their employees of the whistleblower 

protections available to them 61 There should be a mechanism to certifY this compliance as well. 

Perhaps this could be part of the contracting or grant-making process, or the Whistleblower 

Ombudsmen in the Offices of Inspectors General could playa role. The Inspectors General have 

responsibilities to conduct investigations of claims of retaliation by contractor and grantee 

employees, as well as by national security and intelligence community workers. 62 Agencies are 

currently certifYing compliance with Presidential Policy Directive 19, which protects national 

security and intelligence community whistleblowers. These certifications should be made public, 

but so far only the Department of Defense has done so. 

" Memorandum from Margaret Hamburg 

58 5 U.S.c. §2302(c), '1n administering the provisions ofthis chapter," http://www.gpo.gov/fdsys/pkg/USCODE20 I 0-title5/pdfIUSCODE-201 0-title5-partill-subpartA-chap23.pdf(Downloaded February 25, 2014) 

59 U.S. Office of Special Counsel, "Agencies That Have Completed the 2302(C) Certification Program," September 

20,2013. http://osc.gov/outreachAgenciesCertified.htm(Downloaded February 24, 20 14) 

60 The U.S. White House, The Open Government Partnership Second Open Government National Action Plan/or 

the United States 0/ America, December 5,2013. 

http://,,,,,,,,,.whitehouse.gov/sites/defaultlfiles/docs/us national action plan 6p.pdf(DownloadedFebruary 24, 

2014) 

6J IO USC § 2409, "Contractor employees: protection from reprisal fordisclosure of certain information," 

http://,,,,,,,,,.gpo.gov/fdsys/pkg/USCODE-2010-title I 0/pdfIUSCODE-201 O-titlel 0-subtitleA-partlV-chapI41-

sec2409 .pdf (Downloaded February 25, 20 14) (Hereinafter I 0 USC § 2409) ; 41 U.S. Code § 4712, ''Pilot program 

for enhancement of contractor protection from reprisal fordisclosure of certain information," 

http://uscode .house.govl vi ew.xhtml ti ses sionid=809F5 786 EE28C3E4 F AS 3 851870 F5F683 ?reg=granuleid%3 AUSC2012-title41-

chapter47&saved=%7CZ3JhbnVsZWlkOlyrovOyMOEyLXRpdGxINDEtc2VjdGlvbjQ3MTI%3D%7CdHJlZXNv 

cnQ%3D%7C%7CO% 7Cfalse%7C20 12&edition-20 12 (Downloaded February 25, 20 14) (He reinafter 4 I U.S. Code 

2, i?r~;?dent Barack Obama, ''Presidential Policy Directive/PPD-19: Protecting Whistle blowers with Access to 

Classified Information," October 10,2012. http://,,,,,,,,,.pogoarchives.org/miwi/white-house-IO-IO- 12.pdf 

14 
60 


Insert offset folio 40 here 87176.040

Additionally, a memo and staffrnanual guide will not alone ensure that privacy, whistleblower, 

and civil service rights are protected in employee surveillance. The policies and procedures for 

safeguarding employee rights whenever investigations or surveillance is conducted should 

include penalties for violations and should have the force of law. Therefore, a permanent 

regulation for all of HSS-not just the FDA-would be most appropriate. 

However, there ought to be a government-wide approach. The Department of Justice has the 

appropriate legal expertise for developing such policy, in consultation with the OSC and MSPB. 

Moreover, the FDA is only attempting to write a policy ad hoc because of all the tnlwanted 

attention it's receiving. But what is to prevent other agencies from spying on employees without 

regard to the legal rights of these employees? Congress and/or the President must mandate a 

government-wide policy to protect whistleblower and other constitutional rights and prevent 

future abuses. 

Of course, interfering with communications to Congress 63 and retaliating for whistleblowing64 is 

against the law. Although the law does protect the identity of whistleblowers in other ways-the 

OSC and IG are prohibited from disclosing the identity of whistle blowers except in certain 

circurnstances65-there is little to prevent other agencies from identifYing whistleblowersby 

collecting communications. Congress should consider amending the WP A and contractor 

protections to specifically prohibit an agency from using collected communications to identifY a 

whistle blower . 

Today, we don't know nearly enough about the scope of employee surveillance across the 

government. We hope that this connnittee will order a comprehensive study of how agencies are 

currently conducting surveillance of employees while protecting their rights. Far more needs to 

be known about current practices, legal protections, effectiveness, and cost. A government-wide 

study by the Government Accotnltability Office (GAO) and/or the Merit Systems Protection 

Board (MSPB) would provide the executive branch and Congress with a more complete picture 

and recommendations for best-practice policies.66 

63 18 USC § 1505, ''Obstructionofproceedings before departments, agencies, and committees," 

http://-.w.w.1aw.comell.eduluscode/textI1S/1505 (Downloaded February 25, 20 14);5 USC § 7211, "Employees' 

right to petition Congress," http://W'M'I.gpo.gov/fdsys/pkglUSCODE-20 I O-title5/pdf/USCODE-20 I 0-title5-parllllsubpartF-chap72.pdf (Downloaded February 25,2014) 

64 5 USC § Section2302, "Prohibited personnel practices," http://W'M'I.gpo.gov/fdsys/pkglUSCODE-2010-

title5/pdflUSCODE-20 10-title5-partm-subpartA-chap23.pdf(Downloaded February 25, 20 14); 10 USC § 2409;41 

USC § 4712 . 

• , 5 USC § 12 13 (h), "Provisions relatingto disclosures of violations ofJaw, gross mismanagement, and certain other 

matters," http://W'M'I.gpo.gov/fdsys/pkglUSCODE-20 I l-title5/pdf/USCODE-20 II-title5-partll-chapI2-subchapllsec1213.pdf(DownloadedFebruary25, 2014); 5 USC App. Section 7(b), "Protects employees -Ml0 file complaints 

or provide information to the Inspector General," http://statecodesfiles.justiacomlusI2011/title-5/appendix-title511 350/section-7/document.pdf(Downloaded February 25, 20 14) 

66 While GAO might be more effective at auditing current agency surveillance practices, given the technical 

components, the MSPB may be well-suited to use that information to develop recommendations on protecting the 

merit system. The mission ofthe MSPB is to "Protect the Merit System Principles and promote an effective Federal 

workforce free of Prohibited Personnel Practices.''''U.S. Merit Systems Protection Board," http://W'M'I.mspb.gov/ 

(Downloaded February 24,2014) 

15 
61 


Insert offset folio 41 here 87176.041

Naturally, there also must be a different approach with the ever-growing intelligence and 

national security workforce. More and more of the federal workforce is labeled as national 

security sensitive-and there is a jaw-dropping lack of oversight. The number of people cleared 

for access to classified information reached a record high in 2012, soaring to more than 4.9 

million.67 Add to that untold numbers of civil servants and contractors without access to 

classified information, but in positions labeled as national security sensitive. 68 In order to prevent 

leaks of classified information, it is critical that there are truly safe channels for legal disclosures. 

We have long been concerned about the potential for abuse of whistle blowers as a result of 

Insider Threat programs mandated by the President and Congress.69 The program pits employees 

against one another,70 creating an atmosphere of suspicion and intimidation likely to silence 

would-be whistleblowers. Intended to protect national security, implementation of the Insider 

Threat Program at agencies that have little to do with national security issues suggests a serious 

overreach. Blurring the line between spies and whistleblowers can only harm national security. 

An investigation by McClatchy last year discovered that agencies were using the Insider Threat 

Program as grounds to pursue Wl3uthorized disclosures of unclassified information-information 

that whistleblowers can legally disclose to anyone under current law. 71 

We hope this committee will also conduct rigorous oversight of whistleblower protections for the 

national security and intelligence community workforce. 

Importantly, we must not lose sight of what brought us here today. Scientists at the FDA were 

concerned about a device approval process that they believed might put lives at risk We urge 

you to ensure that the critical work being done by the CDRH puts the public's health and safety 

first. Bureaucrats at FDA should not be allowed to overrule the findings of expert scientists and 

physicians, except under extraordinary circumstances. There are no criminal penalties for FDA 

officials who allow unsafe devices to be approved. FDA officials should be held accountable for 

approving ineffective or unsafe products, and flawed devices must be taken off the market. There 

must be fur more transparency and less deference to the demands for confidentiality by the drug 

and device companies. 

67 Office ofthe Director of National Intelligence, 2012 Report on Security Clearance Determinations, January 2013, 

p.3. 

http://www.dnLgov/files/documenls/2012'Yo20Report%200n%20Security%20Clearance%20Determinations%20Fina 

~(Dov.nloaded November 14,2013) 

We only know from the government's briefin Conyers that there are at least half a million workers in positions 

labeled as national security sensitive at the Department of Defense (DoD) alone: Kaplan v. Conyers, Initial Brieffor 

Director, Office ofPersnnnel Management, November 23, 20 II, p. 4, n. 7. 

http://mspbwatch.files.wordpress.comJ20 I2I08Iberryv-conyers-ini rial briefforoom.pdf (Downloaded November 14, 

2013) (Hereinafter Kaplan v. Conyers Initial Brieffor OPM Director) 

69 The White House, "Executive Order 13587 -- Structural Reforms to Improve the SecurityofClassifiedNetworks 

and the Responsible Sharing and Safeguarding of Classified lnformation," October 7,20 II 

http://www.whitehouse.gov/the-press-officel2011/1 0/07/executi ve-order-structural-reforrns-improve-securityclassified-networks- (Dov.nloaded February 24, 2014) 

70 Defense Security Service, CounterinteUigence Directorate, ''INSIDER TIlREATS: Combating the ENEMY 

within your organizarion," http://www.dss.mil/documents/ci/lnsider-Threats.pdf(Dov.nloaded February 24,2014) 

71 Marisa Taylor and Jonathan Landay, "Obama's crackdown views leaks as aiding enemies of U.S.," 

McClatchyDC, June 20, 20 I J. http://,,,'WW.mcclatchydc.com/20 I 3/06120/19451 3/0bamas-crackdown-views-Ieaksas.html#.Uccy--vmVHI (Dov.nloaded February 24, 2014) 

16 
62 


Insert offset folio 42 here 87176.042

Finally, please do all you can to ensure the FDA whistleblowers get the justice that they deserve 

and that FDA managers are held accOlllltable for any violations of the rights of the scientists and 

physicians who sought to make medical devices safer and more effective. 

Thank you for the opportunity to testifY before you today. POGO and the Make It Safe Coalition 

pledge to continue to work with you to fulfill the promise of a government that is truly open and 

accountable to the American people. 

I look forward to your questions. 

17 
63 

Chairman ISSA. Mr. Harris, a couple of questions. First of all, I 

mentioned you’d be the person that would review a request to spy 

on an employee in the future, you would be the first point of contact. Is that correct? 

Mr. HARRIS. Yes, sir. 

Chairman ISSA. Okay. And your degree is in business administration? 

Mr. HARRIS. Can you repeat the question? 

Chairman ISSA. You have an MBA? 

Mr. HARRIS. Yes, sir, I do. 

Chairman ISSA. You’re not a lawyer? 

Mr. HARRIS. I’m not. 

Chairman ISSA. And the person that you, once you decided to do 

it, that you’d go to, would be the same person, the general counsel, 

who approved the spying in the past. Is that correct? 

Mr. HARRIS. Well, I want to give the committee accurate information, so most of what we speak about today predates my tenure at 

FDA. 

Chairman ISSA. No, no, I understand. I’m just looking at the 

process. 

Mr. HARRIS. Right. 

Chairman ISSA. The process in place, the so-called protection 

that the agency has put forward is you’d still go to the same general counsel. The first lawyer, if you will, would be the lawyer who 

thought this was just fine before, which is the general counsel, and 

second of all, before that, you’d go to the chief operating officer, 

who is, by definition, probably not an attorney. 

Mr. HARRIS. That’s right. 

Chairman ISSA. Okay. I just want to understand the system because I don’t approve of it. 

Mr. HARRIS. I’ll give you the process. So we have a process that 

requires a request to be formally written. 

Chairman ISSA. No, no. I apologize. But I only have 3 minutes 

and 55 seconds, and to be honest, the process sucks. So now let’s 

move on. 

Ms. Canterbury, you said it very well. They had suspected a 

criminal activity. Is that correct? 

Ms. CANTERBURY. They suspected that confidential information—— 

Chairman ISSA. Right. So alleging—— 

Ms. CANTERBURY. —was disclosed. 

Chairman ISSA. Right. So alleging the criminal activity, they did 

not go to the IG, they did not go to the criminal investigation units 

of which there are a multitude within—HHS has their own, obviously the FBI. 

Let me ask a question, Mr. Harris. Your opening statement, you 

used some very carefully toned words, and I picked up on just a 

couple of them as another nonlawyer with a business degree. You 

said that you didn’t target or use a term like that of Members of 

Congress, but you didn’t protect, in other words—not you—but the 

general counsel received all of the information without any attempt 

to screen out, you know, Mr. Van Hollen or my committees or Senator Grassley’s committees or for that matter, lawyers, doctors, 

there was no protection in place. 

64 

Mr. HARRIS. Again, Mr. Chairman, that predates my time at 

FDA. 

Chairman ISSA. Right. But I just want to make sure that’s correct, that there was no protection put in place. So the idea that you 

didn’t target doesn’t really matter. You didn’t protect the likelihood 

of five known whistleblowers, and especially Dr. Smith, a known 

whistleblower, the likelihood is he’s still talking to Members of 

Congress, he’s still—he didn’t change his opinion that the FDA had 

problems. So by definition, the FDA knowingly intercepted correspondence with Members of Congress because there was a reasonable expectation that he was having correspondence with Members of Congress. 

Let me just ask a couple of quick questions. To your knowledge, 

you weren’t there at the time, there were five people targeted. Was 

there anybody else at the FDA that had access to the information 

that was linked to The New York Times? Anyone else? 

Mr. HARRIS. Again, that predates my time at FDA. 

Chairman ISSA. Well, why don’t we make the assumption that 

there were just a load of them, that these five people were by all 

reasonable account not the only ones that had the ability to have 

gotten this information. 

Since you received none, the real question is, did the FDA and 

does the FDA have not the ability to be narrow, but the ability to 

be broad? If you have a leak and 4,000 people could have leaked 

it, the only way to do it properly would be to make the assumption 

that you had to equally monitor 4,000, unless you had a specific, 

credible reason to believe that one person had done it. Isn’t that 

right? You’re the approving officer. I need to understand how you 

would do it. 

Mr. HARRIS. In the current process, we would ask for a written 

request. That request would then be reviewed by a committee before we make any actions happen. From the committee, it goes to 

a legal review, and we get—— 

Chairman ISSA. You’re the final approval. Would you have targeted just these five known whistleblowers or would you have had 

to target more people who had accessed that information? 

Mr. HARRIS. It depends on the scenario. 

Chairman ISSA. Okay. So you’re not binding yourself to any kind 

of protection for the Federal workforce from being targeted. 

Mr. HARRIS. Just the opposite, Chairman. We clearly state in all 

documents these days, since our new policy has been implemented, 

that we consider interactions with the Hill, legal counsel, OMB, et 

cetera, as protected activities. When our staff has any interaction 

with that type of information, they know to—— 

Chairman ISSA. Oh, your staff. 

Mr. HARRIS. Any staff. 

Chairman ISSA. Oh, no, no. But the whole point is, who gets to 

see this information under your current policy first? 

Mr. HARRIS. Under the current policy, the information comes immediately back to me. I then bring the appropriate folks to the 

table. We talk through our next steps. It goes no further. 

Chairman ISSA. Okay. So you’re looking at correspondence that 

they had with me and you’re going to protect me. 

65 

Mr. HARRIS. No. No. What I’m doing is actually when they walk 

up on that type of information, they cease—— 

Chairman ISSA. Who is they? 

Mr. HARRIS. Those who are actually—— 

Chairman ISSA. Who are they? 

Mr. HARRIS. Those staff members who are part of the process. 

Chairman ISSA. Okay. I just want to understand. You’ve got staff 

members looking at correspondence with Members of Congress. 

Mr. HARRIS. No, sir. 

Chairman ISSA. Well, you just said that. 

Mr. HARRIS. That was not my statement. My statement was, 

when we are going through the monitoring process, should my staff 

who is actually administering the monitoring process find information of that type is considered protective activity. 

Chairman ISSA. But they see it in order to consider it. 

Mr. HARRIS. They do stop—well, you know, during the monitoring process they may walk up on that, but they stop all processes today. I can’t tell you what happened 2 or 3 years ago, but 

I can tell you what happens today. 

Chairman ISSA. Okay. Well, let me just close by saying do you 

know the name ‘‘Paul Hardy’’? 

Mr. HARRIS. I do. 

Chairman ISSA. Do you know what happens if you Google his 

name? 

Mr. HARRIS. No, sir. What happens? 

Chairman ISSA. Well, he Googled his name because he was concerned and apparently looking for a job, feeling that his was insecure. 

Mr. HARRIS. Oh, I’m sorry. I thought you said Paul Harvey. 

Chairman ISSA. No, Hardy. 

Mr. HARRIS. No, I don’t know Paul Hardy. 

Chairman ISSA. Well, he was one of the targets, and the Internet 

was filled and Google-able with all those screen shots basically, because your agency took no precautions on that confidential information, his correspondence with Congress, if it was there, his correspondence with his doctor, his lawyer, his priest, anybody. And 

it simply became an Internet phenomenon that you could Google 

and get it because it was put out on an open site because the FDA 

did not take the precautions, did not fill out the forms properly, 

and did not protect that information which it had captured clandestinely. Isn’t that true? 

Mr. HARRIS. Well, that may have been the case a few years ago. 

Chairman ISSA. No, no, no, wait a second. You’re a witness, 

you’re under oath. 

Mr. HARRIS. I am, sir. 

Chairman ISSA. You say may have been the case. Are you here 

today and you don’t know if it was the case? 

Mr. HARRIS. I was not there 2 years ago, so I would not have—— 

Chairman ISSA. Do any of you know if it was the case or if I’m 

just coming up with something that’s Internet lore? 

Ms. CANTERBURY. Respectfully, sir, I believe that Dr. Shuren was 

in charge of CDRH at the time. 

Chairman ISSA. Are you familiar with the—and I’m just on the 

same thing, I’ve got to give time to the ranking member—but are 

66 

you familiar with the release of that information, the fact that it 

wasn’t protected, and it became essentially Internet public? 

Dr. SHUREN. Yes, I know information was made public. I don’t 

know the full extent of it. I wasn’t involved in dealing with the contractor or any handling of that material. But I am aware that information was posted on the Internet. 

Chairman ISSA. Okay. And I’ll give you equal time, but if I had 

your indulgence for one more quick question. 

There has been an alluding to the confidential information The 

New York Times got. Just for the record, it wasn’t patent information. It wasn’t a deep, dark secret on how you make a product. It 

was the fact the product was in question as to whether it was safe 

and effective. Isn’t that correct, Doctor? 

Dr. SHUREN. It was whether or not the product was under review, and that has been considered confidential. Companies many 

times do not want competitors to know that they’re working on a 

product and that it’s under review by the agency. 

Chairman ISSA. Okay. I just want to understand. The level of 

trade secret is a product, The New York Times reported, was under 

review and may not have been safe. 

Dr. SHUREN. It was just simply that the product was under review would be confidential commercial information. 

Chairman ISSA. Okay. But it’s something that—I want everyone 

to understand that the term ‘‘confidential’’ is not the term the public thinks is all that confidential. Most people look at these products, clinical trials, the process of approval, and then the question 

of whether they’re being re-reviewed, most people probably listening and watching today believe the public has a right to know that 

information and may not agree with the FDA’s view that that is 

private or confidential or somehow a secret from the American people as to whether a product that may or may not yet be on the 

market is safe and effective. 

Ms. Canterbury, if you wanted to respond quickly. 

Ms. CANTERBURY. I couldn’t agree more. I think that at the base 

of all of these questions is, why is this information considered confidential in the first place, and is that serving the public health 

and safety? I think that there needs to be a question answered 

about why the FDA did not choose to first verify whether or not 

it was legitimately considered to be confidential in the first place 

and investigate that matter instead of investigating a so-called leak 

of confidential information. 

Chairman ISSA. Thank you. 

Mr. Cummings. 

Dr. SHUREN. If I may. I was going to respond to your question. 

Chairman ISSA. Of course. 

Dr. SHUREN. But our employees know that that information is 

confidential, and that has been for longstanding time. Keeping that 

information confidential is critically important. It can undermine 

ongoing review of medical device applications. In fact, I believe in 

that particular case it, in fact, did that. It undermines our medical 

device program, keeping that confidential information confidential. 

Companies, that information we need for making decisions about 

products, and companies rely on the fact that we protect that information. We don’t protect it, the companies don’t bring innovative 

67 

technologies to the U.S., our patients lose. Public health gets hurt 

when that happens. That’s why those protections are in place in 

the first place. That’s why Congress put the protections in place. 

And it hurts American businesses—— 

Chairman ISSA. Doctor, I appreciate what you’re saying. They 

bring innovative products here because of profit. But let’s understand one thing. Do these companies sign a gag order, are they prohibited from disclosing that you’re looking at it? 

Dr. SHUREN. No, they may disclose it. That is their decision to 

make. It’s their information. 

Chairman ISSA. Okay. Thank you. It’s a one-way gag order. 

Please, Mr. Cummings. 

Mr. CUMMINGS. Thank you very much, Mr. Chairman. 

I want to pick up where the chairman left off. Dr. Shuren, prior 

to the initiation of the monitoring, the agency believed that the 

FDA employees were involved in unauthorized disclosures of confidential information and trade secrets as a result of the monitoring. What did the agency find? 

Dr. SHUREN. So the agency did find, as I understand that, there 

was unauthorized disclosures to members of the public, and that is, 

from our perspective, in violation of HHS personnel policy and 

probably a violation of the law. 

Mr. CUMMINGS. So the agency found clear evidence that Dr. 

Smith and the other FDA employees whose computers were monitored were involved in unauthorized disclosures of confidential 

agency information. And as I understand it, that’s a violation of the 

law and can be subject to criminal penalties. Is that correct? 

Dr. SHUREN. Depending upon the kind of information that’s released. But, yes, this can be violative of the law. 

Mr. CUMMINGS. Now, when I listen to Ms. Canterbury—and I’m 

going to come back to you in a moment, Ms. Canterbury—you 

know, one of things that she said was perhaps the FBI and other 

agencies should be handling these kinds of issues. And I’m trying 

to figure out how would even—and you can address this in a 

minute—I mean, you all have laws that we passed that you’re trying to adhere to. And so, I guess there’s almost a—there is a duty 

to at least look into it. Is that right? 

Dr. SHUREN. There is an obligation to look into it. 

Mr. CUMMINGS. And if you don’t look into it, then you’re in trouble. Is that right? 

Dr. SHUREN. That’s correct. 

Mr. CUMMINGS. And as I understand it, with regard to The New 

York Times, there were people who were—companies that were 

complaining that, look, you know, we gave you information, we expected it not to be—not to read about it in The Times. That’s the 

last place we expected it to be. We thought it was confidential. And 

now this is where we see it. Is that fair to say? 

Dr. SHUREN. That is correct. Actually, the company involved sent 

a complaint and actually pointed out that we were in violation of 

Federal law. They asked for an internal investigation. Five days 

after receipt of that letter is when monitoring was started. It was 

also in the setting of a pattern of unauthorized disclosures that had 

occurred starting over a year before. 

68 

Mr. CUMMINGS. Now, I don’t know whether you—you need to 

hear this question, too, Mr. Harris—I don’t know whether you 

heard me a little bit earlier, but it seems that there is a major 

issue here with regard to whether this investigation should have 

been just retrospective or retrospective and prospective. And I’m 

just wondering what’s your view on that. 

Dr. SHUREN. So the honest answer is, I don’t know. I’m not an 

IT expert. And when the issue was raised what we asked for, what 

I asked my executive officer for was options to try to identify the 

source of the leak and to address further unauthorized disclosures. 

Our information technology people decided on what the appropriate 

solution would be. So I do not have the expertise. 

Mr. CUMMINGS. So you just passed it on, look, you said we got 

a—obviously The New York Times has got information that they’re 

not supposed to have, I just want you to help me figure out how 

this information is getting out there. Is that one of the things you 

wanted to know? 

Dr. SHUREN. Yes, what the source of the leak was, what the options were for doing it. And they proceeded to authorize—— 

Mr. CUMMINGS. And what was your plan after you got this information? I mean, what happened? 

Dr. SHUREN. So what happened with the information, we put a 

process in place; also tried to protect privacy. First the IT people 

collected information they thought met very narrow search terms. 

That information was then put on secure iron keys, one of two. It 

was passed to my executive officer. It was then conveyed to a subject matter expert to look at, was there confidential information in 

here? And then if there are issues of concern, there was something 

I called the management team. There was a group set up, which 

was the assistant commissioner for management, it was lawyers 

from HHS and employment law, and it was people from our labor 

employee relations, a group already established actually as in part 

as a protection for these complainants. And that information then 

went up to these individuals and others to try to decide what, if 

there is an issue here, what are the appropriate steps to take, 

which could be administrative or could be referred on for other action. 

Mr. CUMMINGS. And do you know which specific medical devices 

these individuals were concerned about? 

Dr. SHUREN. I know of some that were reported out in the press 

and some that went on a referral up to the OIG. And I say that 

because I wasn’t a subject matter expert, and I’m not the person 

who makes the personnel decision, so I was not reviewing the 

emails. We were trying to limit the people who would look at any 

information coming out in order to respect privacy of the individuals. 

Mr. CUMMINGS. Now, have these employee safety concerns been 

borne out? So you don’t know that either? In your assessment, were 

their concerns valid? 

Dr. SHUREN. Well, for the products—and I am aware of the concerns that they were raising on a variety of products, and I don’t 

think that their concerns were valid. I’ll raise the case in question 

here of The New York Times article of CT colonography, which was 

to be used to screen asymptomatic patients for cancer. And there 

69 

was a lot of good evidence on the table, several clinical studies, a 

big one that was funded by the Federal Government. And just last 

year, we held a joint meeting of two advisory committees at the 

FDA, experts in radiology and gastroenterology, 20 people in all, 

and they unanimously felt that CT colonography should remain an 

option for the screening of asymptomatic patients. 

Mr. CUMMINGS. Well, it’s interesting that the employees raised 

concerns regarding integrity of the device review process, and they 

called it corrupted and distorted. Did you know that? 

Dr. SHUREN. Yes. 

Mr. CUMMINGS. And when you first took over the center, did you 

evaluate these concerns regarding the review process? 

Dr. SHUREN. I did look into the concerns from my own standpoint 

of the complainants. The Office of the Inspector General was also 

investigating whether or not managers were retaliating against 

these complainants. And I will tell you the OIG found that there 

was no retaliation, there was no prohibitive personnel practices. 

The complainants raised concerns about that investigation, they reopened it, and then they subsequently concluded again there had 

been no retaliation. 

I will tell you I also took steps along the way for trying to assure 

that these complainants were actually protected and to make sure 

that if there really were problems and if I thought there were problems, I would have done something about it. 

Mr. CUMMINGS. And so you’re telling us today under sworn testimony that you are concerned about whistleblowers and would do 

everything in your power to protect them? 

Dr. SHUREN. Yes, I would. One example of something that I did 

do soon after I got there, I was hearing concerns from them, I was 

looking into the managers, I did not see problems. But I said to 

them, look, you’re complaining about the managers all the way up 

your chain of command to the office director. Here is what I will 

do. I have two offices involved in premarket review. I will offer to 

move the entire Radiological Devices Branch out of the one office 

and move it to a new office with new managers. 

I didn’t have evidence that I had bad managers. The OIG was 

continuing its investigation. But I said, in light of that, if the OIG 

finds problems, we will pursue that. But I am willing to do this. 

I am willing to disrupt my organization because of your concerns. 

And I did that. They wanted the move. I made the move. And within a few weeks of the move, the exact same complaints were now 

being levied against a brand new group of managers. 

Mr. CUMMINGS. Ms. Canterbury, you heard Mr. Harris, and he 

talked about the IG report. I guess that was what he was saying, 

the recommendations have now—— 

Mr. HARRIS. Yes, sir. 

Mr. CUMMINGS. You are telling us, Mr. Harris, that all of those 

recommendations are now in place? 

Mr. HARRIS. Yes, they are. 

Mr. CUMMINGS. And when did they go in place? 

Mr. HARRIS. September of last year. 

Mr. CUMMINGS. September of last year. So with regard to the recommendations, you all didn’t know about them in September, did 

you? 

70 

Mr. HARRIS. No. 

Mr. CUMMINGS. We just got the report last night. 

Mr. HARRIS. Correct. 

Mr. CUMMINGS. So, how did, I mean, how did that come about, 

just out of curiosity? 

Mr. HARRIS. Again, it goes back to I documented a couple of 

notes in Ms. Canterbury’s statements about making sure we protect all employees and their rights. She’s right on the money. So 

our process does that. 

I got a little bit concerned with the chairman’s comment that the 

process may suck. So the reason we’re here is because they were 

not commonly understood across the agency. So what we put in 

place today are commonly understood processes where a request 

comes in, it’s formally documented, it then goes before a committee, 

and then goes for a legal review and approval. Even beyond that, 

if we approve a process for monitoring to begin, there are regular 

checkpoints along the way to make sure we know what’s going on 

there. 

So we weren’t aware of the IG’s report, but, you know, we could 

have taken this in a Keystone Kop approach and then find ourselves here on a regular basis. We decided to look at a more methodical approach to this, and knowing that there are many scenarios out there that we have consider when putting any policy like 

this in play. What I want to have us do is have the folks who operate within the administrative process, when it comes to monitoring, 

understand the processes first, then we permeate the organization 

so they can understand what procedures we go through. 

Mr. CUMMINGS. Ms. Canterbury, just in my last question. You 

have your concerns. You heard Mr. Shuren say that he’s very concerned. It sounds like Mr. Harris is very concerned and taken steps 

to address the issue. Do you believe that it’s been adequately addressed? 

Ms. CANTERBURY. Thank you, sir. I believe that they are taking 

steps. I don’t believe it’s been adequately addressed. I would very 

much like to hear how he intends to protect the public whistleblowing once he receives, as COO, what has been collected. And 

there is no legal review of the collected information guaranteed 

under the interim rules, and I would like to hear from him on that. 

I also think it’s curious that Dr. Shuren said that he sought to 

protect those particular whistleblowers who were targeted for surveillance. If that’s his idea of protection, I find that very curious. 

I also want to point out that it doesn’t matter if the whistleblowers’ concerns bear out to be valid, whether those devices are 

unsafe or effective. As you know, sir, it is a reasonable belief that 

is protected under law for whistleblowing. 

And I also wanted to just point out another curious thing that 

Dr. Shuren said, which was the surveillance began 5 days after the 

receipt of a letter from GE Healthcare. In fact, the letter is dated 

April 16th. They received the letter on April 21st, and the surveillance began on April 22nd, according to documents that we have 

through FOIA and through the IG report and through the staff 

committee report. So I have never in my life, sir, seen the Federal 

Government move that fast. I find it highly suspect that the letter 

71 

arrived and then they made the decision after the arrival of the letter to do this surveillance. 

Mr. CUMMINGS. Well, Ms. Canterbury, my time has run out. This 

is what this is all about, trying to make sure that the Federal Government is doing the right thing. But I want to keep in mind what 

Mr. Shuren did say. He’s saying he’s got a set of laws that we 

passed, and he’s trying to adhere to the laws that we passed, and 

so there are certain things that they had to do. The question is, did 

they do it right? I don’t think so. But it sounds like they’re going 

in the right direction. 

Unfortunately, I’ve run out of time. I wish Mr. Harris could answer your question, but I’ve run out of time, and I’ll yield back. 

Mr. FARENTHOLD. [Presiding] Thank you very much, Mr. 

Cummings. 

We’ll now recognize the gentleman from Michigan for 5 minutes. 

Mr. WALBERG. Thank you, Mr. Chairman, and thanks to the witnesses for being here today. 

Dr. Shuren, I’ll give you a chance to respond to the timeline that 

Ms. Canterbury addressed here. It appears the differences in the 

dates of beginning the investigation, sending the letters, respond to 

that, if you would, please. 

Dr. SHUREN. Yes. No, in terms of when we received it, it was 

close, and my only point was, it was still within 5 days of getting 

the receipt of that letter the monitoring started. Mainly to say that 

this was not disconnected in time, that this was related to this 

complaint that came in, as well as a series of unauthorized complaints. That was my only point to make. 

Mr. WALBERG. Ms. Canterbury, let me ask you some questions, 

and then you might respond to that with greater detail as well. Is 

there any situation where monitoring employee communications 

with Congress or OSC can be justified? 

Ms. CANTERBURY. No. 

Mr. WALBERG. It’s a simple answer. Then is the problem of monitoring protected employee communications widespread across the 

Federal agencies? 

Ms. CANTERBURY. I don’t know—— 

Mr. WALBERG. Federal agencies. 

Ms. CANTERBURY. Yeah, I don’t know the answer to that, and I 

don’t know that anyone does. I think that it would be very good for 

this committee to order a study, a comprehensive independent 

study, perhaps at GAO, perhaps in consultation with the MSPB to 

determine the extent to which agencies are using surveillance programs on their employees. 

Mr. WALBERG. So this could be widespread? 

Ms. CANTERBURY. It very well could be, and there could be widespread abuses. 

Mr. WALBERG. What protections can agencies put in place to 

minimize the monitoring of protected communications such as with 

Congress or OSC? 

Ms. CANTERBURY. Well, firstly, I think that we need to question 

whether or not there is a legitimate reason for agencies to use surveillance on questions of criminal behavior or leaks of potentially 

unlawfully disclosed information. I think that, again, law enforcement should be conducting those investigations, and if there is a 

72 

few legitimate, very narrow reasons to monitor employees in this 

way, can it be done in a way that is in balance with the rights, the 

constitutional rights, with whistleblower protections, and if not, 

perhaps good, old-fashioned management is in order. 

Mr. WALBERG. Well, should management, in speaking of that, 

management be responsed to make sure that the law enforcement 

agencies are aware of their concerns, potential concerns? Is that 

what you would suggest? 

Ms. CANTERBURY. Yes, there would be a referral to a law enforcement agency. 

Mr. WALBERG. To quickly step away, refer it to a law enforcement agency. 

Ms. CANTERBURY. Yes. 

Mr. WALBERG. Mr. Harris, tell me about training that’s being implemented since you’ve arrived, the directions that are going to 

management relative to leaks, relative to whistleblowers, how you 

deal with them, relative to responding to what we just discussed 

here about referring to an appropriate agency to deal with the law 

and not outside of the law. 

Mr. HARRIS. So can you give me your first question again? 

Mr. WALBERG. First question is, what are you doing? What training having you implemented? 

Mr. HARRIS. Got it. 

Mr. WALBERG. Secondly, what administrative steps have you 

made to make sure that the department, the agency stays out of 

it as much as possible, to make sure that whistleblowers understand that they’re part of the agency but they’re protected by the 

law and that there are appropriate agencies that will be brought 

in to make sure the law is followed? 

Mr. HARRIS. Yes. There is standard training that occurs at FDA. 

There is when an employee comes on board an orientation, they get 

understanding about IT security awareness programs and 

trainings. There is annual training for NO FEAR, which does address the whistleblower issues. We have regular training that goes 

on in the information technology groups. 

And so we have lots of required training every year for all of 

FDA to understand how security awareness works. We often, as I 

said earlier, the banner flashes up and makes them aware of their 

right to a reasonable lack of privacy. It comes up on all devices we 

give them. 

As it relates to the management process we put in place, clearly, 

as I stated earlier, I would like to address Ms. Canterbury, if I 

could. I think this would kind of tie it all together. 

Mr. WALBERG. Tie it together. 

Mr. HARRIS. We consider the whistleblowers as our staff. They 

should not be treated any different as it relates to protection. We 

give everyone protection in our staff. So we don’t consider them 

outsiders. We consider them as part of our staff. 

The way we want to try to approach the issue is the committee 

we put together is not just myself and a couple of attorneys. There 

is an HR director there to determine whether we infringed on employee rights. There is IT professionals there to give Mr. Shuren 

in the future better information and guidance. There’s a legal team. 

And then there is myself. When we do find that we’ve stepped into 

73 

an area where we have communication occurring between Congress 

or anybody else, again, they stop everything they’re doing, nothing 

continues, monitoring stops, my office is notified. 

Mr. WALBERG. Are you notified immediately then? 

Mr. HARRIS. Immediately. 

Mr. WALBERG. When they come across something, it all stops. 

Mr. HARRIS. Immediately. 

Mr. WALBERG. No more eyes are seeing it. 

Mr. HARRIS. Nothing else happens after that. And this is why the 

committee is such a small group. We then bring legal into the conversation, and if it’s appropriate to send it out to another law enforcement agency, we do that. 

Mr. WALBERG. Well, I appreciate the answer, but I would suggest 

that last statement would be the approach to take more rapidly, to 

the outside agency. 

Mr. Chairman, thank you. 

Mr. FARENTHOLD. Thank you very much. 

We’ll now recognize my distinguished ranking member from the 

Subcommittee on Postal, Census, and the Workforce, the gentleman from Massachusetts, Mr. Lynch. 

Mr. LYNCH. Thank you, Mr. Chairman. 

I want to thank all the witnesses for your willingness to testify 

and to help the committee with its work. 

I do want to say that from an Oversight and Government Reform 

perspective, from this committee, our goal is to create and maintain 

an environment where whistleblowers can come forward. As has 

been said by Ms. Canterbury and the chairman and the ranking 

member, and Mr. Grassley earlier, our bureaucracies and these 

agencies and the work that they do has become so complex, whether it’s financial derivatives or whether it’s the FDA, some of us, it’s 

just so complex that unless we have someone on the ground in 

place that comes forward, our chances of finding out about wrongdoing or misconduct is negligible. 

So we really need to make sure that we have an environment 

there where people feel comfortable that if they have a reasonable 

belief that the laws are being broken, or that the public is being 

harmed, that they can come forward. 

So there’s a couple of instances. Usually the FDA flies below the 

radar screen. But this instance really gets me, and it’s the second 

time recently that the FDA has just caused me to shake my head 

and ask what the heck is going on over there. You know, this instance it looks like there’s a very robust framework in place to protect manufacturers’ trade secrets. And in this case I’m not so sure 

anybody has ever pointed to specifically trade secrets that have 

been protected, but by God, we went after these employees because 

we thought there might be a chance that they might disclose something. 

So I think it was a very, very strong response in protecting the 

manufacturers. I think it was very, very weak in terms of protecting the employees. And, you know, I have to acknowledge, Mr. 

Harris, this predates your involvement here, so I’m not criticizing 

you. 

So I see the FDA overriding their scientists in this case. And the 

last time that the FDA, their conduct came to the attention of this 

74 

committee, was the approval of Zohydro, okay. Now, I know this 

doesn’t involvement medical devices, but in that case the FDA 

overrode, again, their own scientific panel. Their scientists voted 

11–2 that approving Zohydro, which didn’t have any protections 

against abuse, quite similar to the early iterations of Oxycontin, so 

13 scientists, 11–2, they said to the bureaucrats, do not approve 

Zohydro. And the FDA turned right around, right around, with an 

opioid epidemic in this country from coast to coast. This is one of 

the most serious threats to our communities, and the FDA goes 

ahead and puts a gun to the head of the American people by approving Zohydro. So we got this problem. 

You know, personally I spend a lot of my time dealing with the 

effects of substance abuse in my communities. I’ve got three cities, 

major cities, and I’ve got 22 towns, and no one is immune. Good 

families, families that are struggling. It’s just unbelievable. It just 

blows my mind that the FDA would approve Zohydro. 

And so I need to put you on notice. I need to put you on notice. 

You have shaken my faith in the FDA because of that decision and 

what’s going on here today. And I just want to put you on notice 

that, you know, I used to give people the benefit of the doubt, but 

I’ve seen such bad decisions coming out of that agency that we’ve 

got a problem, which is I’ve got a problem, you’ve got a problem. 

So, you know, we got to start straighten up and fly right and start 

doing things that are in the best interest of the American people. 

And, you know, I appreciate that your mission and your goal is 

to do the right thing. I just think we’ve strayed. Sometimes the bureaucracy can do that. We just need to get back on the same page 

here in protecting the American people. 

I’ve exhausted my time, Mr. Chairman. I thank you for the indulgence, and I’ll yield back. 

Mr. HARRIS. We will be happy to have someone provide followup to you on that, on this issue. 

Mr. LYNCH. That would be great. Thank you, Mr. Harris. 

Dr. SHUREN. And, sir, we would also be happy to talk to more 

details on what really was happening with these unauthorized disclosures and the impact, because, in fact, what it was doing is it 

was stifling other scientists. It’s not that these complainants were 

necessarily just willy-nilly overrode. There were other scientists in 

the agency who disagreed with their opinion, and those people’s 

opinion was actually being disenfranchised. People were feeling 

harassed, retaliated against. Other scientists were feeling retaliated against by the complainants, and they were complaining that 

the unauthorized disclosures was having a chilling effect on the internal discussion within the FDA and that people were afraid to 

put their opinions in writing because it would be disclosed to the 

press. 

It’s the same thing that Senator Grassley talked about. We want 

to have open discussion within the FDA. We think it is so important. But it goes on both ends. 

Mr. LYNCH. Sure. 

Dr. SHUREN. And we were seeing that that actually was being 

adversely affected, and that adversely affects public health. We 

cannot make well-informed decisions when that happens. And that 

was a misuse of those disclosures, and that’s unfortunate, and they 

75 

were used to influence public meetings, and they were used to influence advisory committee meetings. 

Mr. LYNCH. Well, I’ll be happy to have that information offline, 

Dr. Shuren, and again, I thank you for your testimony. 

Mr. FARENTHOLD. Thank you very much. I am going to now recognize myself for 5 minutes for a couple of questions. 

First off, I want to say that whistleblowers are the lifeblood of 

this committee. It’s dedicated government employees who see something going wrong in their agency that have no recourse other than 

to bring it to the attention of Congress, which is the right way to 

do it. It’s not the right thing to do the way Mr. Snowden did it and 

take it to another country. And we work hard and we’ve passed legislation to make it safe for whistleblowers, and this committee, and 

I think Ranking Member Cummings will agree with me, will bend 

over backwards to protect a legitimate whistleblower. 

In fact, the committee Web site, Oversight.House.gov, has a place 

you can go online to become a whistleblower. And I guess there 

might be a lesson in this for potential whistleblowers. Maybe the 

initial contact needs to be made from your home computer or a 

computer at the library or from a Starbucks. But you shouldn’t be 

afraid to use your government computer to report government 

problems. 

And, Mr. Harris, I know a lot of this happened before you got 

there, but you are the acting chief information officer, so I want to 

take a step back and maybe look at what should have been done. 

I mean, I understand that our computer, our rule mentality, in the 

private sector, you’ve got a lot more flexibility than you do in the 

public sector. The Constitution doesn’t apply you due process in 

your private sector job. In many private sectors there are no whistleblower statutes other than potentially to the government. So as 

a manager you’ve got a lot more options in the private sector. 

But in the public sector, going in and installing snooping software seems rather draconian. I would think good practice is to 

have something on your network that captures all incoming and 

outgoing mail, and then you have the ability to search that after 

the fact if you’ve got a leak. I’ve used EnCase before. That’s a forensic software that lets you go copy somebody’s computer. But, 

you know, nowadays with all compliance issues in various industries, there are appliances that you can put on your network that 

catches all the mail and saves it. And you ought to be able to 

search that for emails to The New York Times and have an exclusion saying if it’s mail.house.gov don’t show me that. I mean, it 

seems like it’s that simple. Didn’t you all hire a contractor back 

there? Couldn’t you have told the contractor when pulling the EnCase stuff and it says mail.house.gov, I don’t want to see it? 

Mr. HARRIS. Yeah, I think you’re on the right track. I think one 

thing we should note is that monitoring is actually rare. And I 

think what sews this together is when you think about the reasons 

we do monitor at times. I can give you a couple of instances. I 

mean, we have had cases of child pornography. In my mind, we 

should immediately act on that and we should immediately start 

to look for the issues there because the child’s life is in the balance 

here. And then there are other instances where insider training 

does become an issue to protect trade secrets. 

76 

But, you know, everyone is correct. The need to protect those 

who whistleblow is important. So this new process that we have in 

place does that. It has, again on the committee, a legal individual, 

someone from IT, someone from HR to consider the entire range of 

issues that we may face before we even initiate our monitoring 

process. 

Mr. FARENTHOLD. And it’s just hard to judge what the culture of 

that is. You know, if within your agency there is a culture of gossip, you know, does it slip out? You’ve got to deal with the human 

elements of that as well, and I do think there needs to be a technological solution to that. 

Let me go to Ms. Canterbury and get her thoughts on what the 

appropriate way to do this is. 

Ms. CANTERBURY. So first I would like to ask why on Earth the 

FDA would conduct surveillance if they had suspected child pornography or insider training occurring, why would they not go to the 

FBI? That just makes no sense to me. So I’m struggling with under 

what circumstances—— 

Mr. FARENTHOLD. I’ve run a computer consulting company. I’ve 

done this for private sector. You know, you’ve got an employee you 

think is—let’s take child pornography out of it—and is just surfing 

porn and that’s against your policy. They haven’t broken the law, 

but they’ve broken your policy. So, I mean, obviously there are 

cases where you need to do that 

Ms. CANTERBURY. Sure. And so in that case, my question would 

be on the back end of the review committee, I think, is a substantial structural reform, but it’s only reviewing, to my knowledge, according to your interim policy, on the front end. So what would be 

an improvement would be to do a similar review on the back end, 

because there is no way you can use enough search terms to protect public whistleblowing. So if an employee is blowing the whistle 

with nonlegally protected information to The New York Times or 

to the Project on Government Oversight, that also cannot be swept 

up or they’ve been in violation of the Whistleblower Protection Act. 

Mr. FARENTHOLD. And I’m going to agree with you that in many 

cases retrospective is the way to go. 

I’m about out of time, but I will give Mr. Harris an opportunity 

to respond before we go to the gentlelady from California. 

Mr. HARRIS. Well, let me be clear. We by no stretch of the imagination are coming here today to tell you that our process is 100 

percent perfect. The idea behind this is to have a methodical approach to this. And by the way, the FBI comes to us sometimes for 

referrals to do some of the work that we do. And so it is by no way 

perfect, but the only way the agency can move forward is to start 

something now and then we can perfect it to a point to where we 

can then spread it to the rest of the agency and then we all understand what our policies, rules of engagement are around monitoring. 

Mr. FARENTHOLD. All right. Thank you very much. I appreciate 

your indulgence. 

We’ll now recognize the gentlelady from California. 

Ms. SPEIER. Mr. Chairman, thank you, and thank you to all of 

our witnesses. 

77 

You know, we are really very good here at calling agencies onto 

the carpet and beating them up and then talking to the companies 

in our district and hearing their complaints about the process being 

too slow, and the result is, is that so much innovation is going 

abroad because our process doesn’t work. 

We can’t have it both ways. If we want the FDA to be more 

streamlined so more of this research and development of clinical 

trials happens here in the United States, you know, we’ve got to 

embrace that. If we don’t, then we should just tell all of our constituents that if they want the new medical device that can save 

their lives, you’re going to have to go to France or Germany to get 

it. 

Having said that, I want to send some kudos to Dr. Shuren, because we do beat you guys up from time to time. I am sitting on 

an airplane 2 weeks ago coming back from going home, and the 

gentleman sitting next to me is a VC who specializes in medical devices, and he had nothing but praise to offer about your good work, 

Dr. Shuren. So I wanted you to have that at the outset. 

Now, let’s go to my questions. It appears that there were search 

terms that were developed within the administration that were superimposed on the computers of these scientists. What were those 

search terms? The inspector general report isn’t very specific about 

them. 

Ms. MCKEE. The search terms were ‘‘K’’ followed by a string of 

letters—— 

Ms. SPEIER. Right. 

Ms. MCKEE. —which indicates an identification for a 510(k) submission, the word ‘‘colonography’’ based on the release in the article 

in The New York Times. And then there were also names identified 

of individuals where managers had voiced concerns in the management team that Dr. Shuren talked about that were performing 

ghost writing 

Ms. SPEIER. Okay. So the first two make some sense to me. The 

others appear to be the beginnings of a witch hunt, and that troubles me. I think that Ms. Canterbury’s concern is one that we all 

have in that if we want to be clear about not having reprisals it’s 

better to have a hands-off investigation or review taking place so 

that it’s not within the department. Go to the Justice Department, 

whether it’s child pornography or leaks of trade secrets. And it’s 

not your core competency anyway. So I guess the real overriding 

question that I have is, why not just punt these all to Justice for 

them to undertake the review? 

Dr. Shuren. 

Dr. SHUREN. Yes. So a challenge we faced back then is in the 

past we had our Office of Internal Affairs. That is the group who 

did investigations within the FDA. And due to concerns raised by 

Senator Grassley, and I understand those concerns, in early 2010, 

the policy changed. The Commissioner said in the future the Office 

of Internal Affairs cannot do investigations of allegations of criminal conduct for employees who made allegations against the agency. It would go to the Office of the Inspector General. But they 

were not doing investigations unless they had adequate evidence to 

do it. 

78 

And that has caught us in a bind. And in fact when just the GE 

letter was sent to them, they came back and said, at this time, 

based on the information provided, they are not taking any action, 

the referral lacks any evidence of criminal conduct. But after, from 

the monitoring, there was evidence of unauthorized disclosures. In 

fact, the OIG did open a formal investigation and did look into it. 

And at that point they decided we’re not going to prosecute, but 

they also came back and didn’t say that this wasn’t wrong. In fact 

they said, we understand you have sufficient evidence to support 

administrative actions, and they closed the case at that point. In 

other words, this could be a problem, you are welcome to pursue 

it now with administrative action. And that’s what happened. 

Ms. SPEIER. All right. I have very little time left, but I’m concerned about the allegations by the scientists that thought that 

these devices were potentially unsafe or exposed people to radiation. Where are we in terms of evaluating that? 

Dr. SHUREN. Yeah. So for CT colonography and their concerns 

about exposure radiation, it shouldn’t be on the market, as I mentioned, there is a lot of evidence to support it. We think it is safe 

and effective. And last year there was a meeting of joint advisory 

committees, so two advisory committees with experts in radiology 

and gastroenterology, 20 people, and they unanimously felt that CT 

colonography should be an option for doctors and patients for 

screening asymptomatic individuals for colon cancer. Unanimous. 

Time and time again there were issues that were brought to advisory committees, outside experts, who did not agree with the 

complainants. In one case, I actually set up for an issue to be 

brought to the advisory committee, and I let the complainants give 

their own individual perspective. Actually had two perspectives. We 

never do that. We have the center provide a unit, one perspective, 

and here I said there is difference of opinion, I want to put sunshine on it, didn’t hide from it, put sunshine on it and get feedback, 

and the advisory committee didn’t agree with the complainants. 

And scientists within the agency, there were many scientists who 

didn’t agree. And many of our managers, they are scientists. These 

people are also experts. And they disagree, and that’s okay. People 

can disagree. They should disagree if they feel that way, and we 

have a process if they disagree, how they can appeal that. 

Unfortunately, never took advantage of that process, which actually brings it all the way up to my office, can even bring it up to 

the Commissioner’s office, and it has to be in writing and they have 

to justify their rationale, and never took advantage. Instead, it was 

put information that by law is prohibited to be disclosured by any 

FDA employee, whistleblower or not, and put that out in the public 

venue. And that does adversely affect public health, it adversely affected discussion within the agency, and it adversely affected the 

very issue of open dialogue, which they were complaining about. In 

fact, in one investigation, independent investigation, it was found 

that it was one of the complainants who was creating the hostile 

work environment. 

Ms. SPEIER. I thank you. My time has expired. 

Mr. BENTIVOLIO. [Presiding.] Thank you. 

At this point I’ll recognize myself. I would like to thank each of 

our panelists for being here today. 

79 

Mr. CUMMINGS. Yeah, I just want to close. 

Mr. BENTIVOLIO. Okay. Well, I’m going to ask a few questions. 

Mr. CUMMINGS. Oh, okay. Sure. 

Mr. BENTIVOLIO. Briefly. 

But, Doctor, you’ve answered a few of my questions. But after listening to testimony and the questions that were asked, I seem to 

have all my questions answered. But there seems to be an underlying problem that you just addressed, is that, you know, when you 

have a whistleblower there is procedures to follow to make your 

points, to make your complaint heard, correct? And you’ve just explained that procedure. But there is, according to your testimony, 

if I understood this correctly, they didn’t follow all the procedures 

and went over and above and then contacted Congress or blew the 

whistle, so to speak. 

Dr. SHUREN. No. They are welcome to contact Congress. The 

issue was they disclosed confidential information that is prohibited 

by law from disclosure to members of the public, including the 

press. 

It was never about Congress. None of this had anything to do 

about Congress. They had been complaining to Congress for 18 

months before this started. 

When I first started at the Center was in September 2009. Before I could even speak to any of my staff and hold an all-hands, 

my first two days, I spent a lot of it on Capitol Hill, at the request 

of congressional staff, to talk about them and their complaints. 

They were complaining all the time, which is fine. No one objected. 

And I kept hearing they were constantly complaining. 

If anyone was going to retaliate, they would have done that well 

before. This was in response to unauthorized disclosures. And the 

OIG even concluded that there was reasonable concern for doing 

the monitoring. 

Now, people will have issues about how that was done, but that 

is a different issue. This was nothing to do with retaliation. There 

was no targeting of Congress. The OIG concluded that was well. 

There was no targeted of protected disclosures by whistleblowers. 

None of that. 

Mr. BENTIVOLIO. Thank you, Doctor. 

Ms. Canterbury. 

Ms. CANTERBURY. So, the Inspector General did not confirm that 

there were disclosures of unauthorized information. 

The staff report, the Issa-Grassley report, explicitly says that 

they did not find evidence of unauthorized disclosures in their surveillance of the employees, of the whistleblowers. 

And I wanted to go back to one other thing that Dr. Shuren said 

about the IG refusing to conduct an investigation for lack of evidence. 

The IG declined on May 18th in 2010 to investigate for lack of 

evidence of criminal activity, but also pointed out to the agency at 

that time that 5, U.S.C., section 1213, identifies that disclosures 

such as the ones alleged, when they relate to matters of public 

safety, may be made to the media and Congress—to the media and 

Congress—as long as the material released is not specifically prohibited by law or protected by executive order and classification. 

80 

So that is what they got back, was their first determination, 

their first warning, not to violate whistleblower protections. 

When they went back to the IG and asked for a review, the IG 

looked at whether or not these unauthorized disclosures were in 

violation of the law, consulted with the Department of Justice, and, 

in fact, found that no further action would be taken. 

DOJ declined to prosecute. The OIG declined to investigate it 

further. There was no evidence of prohibitions of law. 

What the IG said in the letter was not that there was sufficient 

information to take administrative action, but, instead, it said your 

office indicated it had developed sufficient evidence to address the 

misconduct through administrative process. 

So the message from the IG was not that we think you have sufficient evidence, but you say you do; so, go ahead and take care of 

it administratively. 

Dr. SHUREN. Yes. But the OIG in the first place was actually 

making clear you can have certain disclosures to the media unless 

it is prohibited by law. That was the whole point. 

The kinds of disclosures that were occurring, and the ones we 

were concerned about—— 

Mr. BENTIVOLIO. Doctor, I think what really concerns me is that, 

when an employee, a scientist, raises a red flag on some medical 

equipment or medical product and they bring it to the attention of 

the people in charge of the agency and, yet, for some reason, their 

issues aren’t addressed to their satisfaction, they have to go outside 

of the agency to get redress. 

I think—to me, you know, after listening to all this testimony, 

it seems to be a cultural problem within a lot of government agencies, not just the FDA. So I think that is the thing we really need 

to focus on. 

Why can’t an employee, a scientist, probably one of the smartest 

people in that agency, have some concerns and those concerns be 

addressed in-house and taken care of? And, yet, even if you have 

to put in some overtime. 

Dr. SHUREN. I would agree with you. And actually—— 

Mr. BENTIVOLIO. But, apparently, those aren’t there. You have 

not created a culture—or the FDA has not created a culture where 

those things can be addressed and the public can be satisfied. And 

I think I am out of time. 

And now Mr. Cummings. 

Mr. CUMMINGS. Thank you. 

Thank you very much, Mr. Chairman. 

Looking at the report of the IG, Mr. Harris and Mr. Shuren, it 

says—and it is on page 20 of the report—it says, ‘‘Given this, 

FDA’s interim policy addresses our five recommendations outlined 

above. HHS should determine whether all other individuals OpDiv 

policies meet our recommendations above. HHS also should regularly review and, as necessary, update its Department-wide monitoring policies to ensure they are compatible with new and emerging technologies and methodologies. Information technology is continually changing, and a static monitoring policy could fail to address key implementation issues as capabilities evolve.’’ 

And I just want to make sure—it sounds like the IG is satisfied 

for the moment. But as he says, the technology is continuously 

81 

changing. And as you know, you can have technology today that is 

outdated today. 

And so the question becomes, you know—I want to—what I am 

going to do, Mr. Chairman, with Chairman Issa, is try to follow up 

with the IG to make sure that he is satisfied that everything that 

can be done at this moment, consistent with his recommendations, 

has been done. 

And, number two, I am just curious as to how you plan to keep 

up with the technology and make the changes that are necessary 

so that we are not outdated. 

Mr. HARRIS. Thank you, sir. 

Clearly, as we stated earlier, we don’t consider this process as 

anywhere near completed. Instead of static, it has to be fluid. We 

have to keep up with the emerging technologies. I mean, there is 

a smart kid somewhere who is able to come up with an idea of how 

to breach our system. So we have to always be out in front of the 

process. 

But going back to the earlier statement that we know that we 

need to have a set of clearly understood processes across FDA that 

requires us to have, again, approval before anything starts, I think 

the IG is also stating that we started out pretty good, but we still 

have much more work do. We recognize that. The agency recognizes it. So we are in no way saying that we are done here. We 

have a lot of work to do. 

Mr. CUMMINGS. I know the chairman was about to end the hearing; so, I will just finish my closing right here. I know. I saw him. 

That is why I said ‘‘was about to.’’ 

I just want to thank all of you for being here. 

And I want to reiterate the comments of Congresswoman Speier 

and, also, Lynch. It is so important that government operates correctly because, when government does not operate correctly, there 

are consequences. 

I go to the same bank every Friday. For the last five months, I 

have been following my teller, whose son’s wife was having—well, 

his girlfriend was having twins. And so, you know, everybody’s excited and everything. 

And then about a week ago I went in and I said, ‘‘Well’’—you 

know, she was so excited that these twins were going to be born. 

And they knew it was two boys. 

I was excited for her, and I would ask about them every time I 

walked in the bank. And then she said, ‘‘They have been born’’ and 

then she said, ‘‘I have got good news and bad news.’’ She said, ‘‘The 

boys are fine. The mother’s in a coma.’’ Apparently, there was some 

complications. Developed MRSA in the hospital. And then, when I 

came back last Friday, she said she died. 

Whether this was with regard to a device, I don’t know. I am not 

saying it is. But now we have got two boys a week old who will 

go for the rest of their life without their mother. Those are the consequences. 

I think a lot of times we here in government forget that there 

are people that are affected by our decisions, but they are. And so 

I think—first of all, I don’t think, to be frank with you, that a whistleblower has a right to remain silent if they see something wrong. 

That is why we want to protect them. We want to get it right. 

82 

I am asking you all, when you go back to your shops, to reiterate 

that. We are going to continue to follow this. I know the chairman 

will and our committee will. But this is so very, very, very important. 

And I heard you, Ms. Canterbury, and, basically, what you were 

saying was, ‘‘Look, we don’t trust that this is going to work out. It 

is not all complete’’ and all that. 

Well, it has got to work out. It has to work out because the 

American people deserve absolutely nothing less. That is why they 

pay our servants—our Federal servants, employees, to do these 

jobs. 

And going back to something Chairman Issa said, it is also about 

trust. So the more we do it right, like you said, Mr. Shuren, when 

you were talking about dismissing everybody or however—you 

know, when you said you were trying to make sure that the whistleblowers were protected, those are the kinds of things we have to 

continue to do because the public needs to feel that trust, and we 

have got to make sure that we take care of them. 

So I want to thank you very much. 

I am out of time, Ms. Canterbury, but that is up to the chairman. 

Ms. CANTERBURY. I just want to say that I have full trust that, 

if you and the chairman work together, that you will get the job 

done right. 

Mr. CUMMINGS. Thank you very much. And we will. Thank you. 

Mr. BENTIVOLIO. At this time I would like to recognize the gentleman from Florida, Mr. Mica. 

Mr. MICA. Well, thank you, Mr. Chairman, and ranking member. 

I came in a little bit late. I will try to ask a couple of questions, 

hopefully, that haven’t been asked. 

I was going to turn my first question to Mr. Harris. Mr. Harris, 

in September, I guess, of last year, you were acting CIO and you 

released an interim policy staff manual and guide for employees’ 

computer monitoring. 

You have both the role, I guess, of—is it COO and, also, CIO? 

Mr. HARRIS. Yes, sir. 

Mr. MICA. Okay. Now, in that capacity and in developing that 

manual, under the interim policies, what are your responsibilities 

as both the COO and, also, as the chief information officer? 

Mr. HARRIS. As the COO, it is my responsibility to make sure 

that the process is fluid and that it is commonly understood by all. 

As the chief information officer, it is to make sure that we give 

good guidance to program officers and centers across FDA when 

they have a request to look at issues that may occur within their 

centers. 

And so there is two separate hats there. One is of processes. I 

mean, this is not about power. This is really about well-matured 

processes that the entire agency can understand what we are doing 

from A to Z. 

And from an IT perspective—Dr. Shuren spoke of it earlier—the 

question was asked whether we could have taken a different approach. 

I think, as an IT professional, I would have said that we need 

to look at the entire scenario so we can determine the most appropriate approach. 

83 

Mr. MICA. Well, do you think, again, with you in the position of 

being both COO and CIO, there is a potential conflict? 

Some of your responsibilities are for the approval of the monitoring, the execution of the monitoring, and the direction, but, also, 

the review of the monitoring. 

Do you see that as something that actually should be kept separated? I don’t know how you are able to achieve your sort of—I 

would see it as in competing roles. What is your opinion? 

Mr. HARRIS. Well, the review committee that we have as part of 

our steps does have legal review included in it. So when it comes 

to—as a formal request, there is a committee, again, that has an 

HR person on it, has an IT person, a legal person on it. And then 

it comes back to me. 

So they have an opportunity to look at it without me even being 

present. But I think the most important part of this is the legal 

review takes place and then, before anything starts—— 

Mr. MICA. So you are saying on top of this there is another review that would ensure, again, some objective review? 

Mr. HARRIS. Yes. 

Mr. MICA. Ms. Canterbury is answering—or shaking her head 

‘‘no.’’ Did you want to respond? 

Ms. CANTERBURY. I understand from the interim policy that 

there is a legal review on whether or not to conduct the surveillance. 

But once the information is collected, it is Mr. Harris who maintains that and determines who gets to use that information and 

how it is used. 

And so my recommendation is that the COO shouldn’t be involved. As you suggest, sir, I think it may be a conflict of interest. 

He should not have a part in all decision-making and then control what—the information that is collected at the back end. 

Certainly, at the back end, there has to be a legal review to 

make sure—— 

Mr. MICA. So you don’t think that even though what he cited and 

considers as another step is not really doing the job because, again, 

just the nature of the conflict of his having both of those responsibilities—I mean, I don’t want to put words in your mouth. Is that 

correct? 

Ms. CANTERBURY. Right. My concern is with, after the information is collected, what happens to it. 

Mr. MICA. Right. 

Ms. CANTERBURY. Are there protected disclosures swept up in 

what is collected? And only Mr. Harris would get to decide that, according to the interim policy. 

Mr. HARRIS. I think, again, we stated earlier that the policy is 

nowhere near complete. We made a conscientious choice to have an 

interim policy so that we can get this right, and this has to be done 

right over time. 

There are many scenarios that apply here that don’t have a single answer to it. 

The other piece of it is that we want the agency to begin to move 

forward and, one, again, protect the whistleblowers, and, two, make 

sure that our processes are commonly understood from end to end. 

84 

And then, at the end of the day, before anything begins, anything 

begins, we have to have an approval. 

And so I don’t know what happened, again, 2 or 3 years ago, but 

I know now that we have a much more well-oiled process. 

It is interim. It is not perfect. We have to build it as we go because, as Mr. Cummings said earlier, the landscape changes with 

IT on a regular basis. We have to be fluid with it if we are going 

to stay on top of things. 

Mr. MICA. Also, again, in protections and making certain that 

important responsibilities are fulfilled. I think Ms. Canterbury did 

allude to, again, some conflict that exists just by the nature of the 

current way this is conducted. 

Mr. HARRIS. That is right. It comes out of my hands and goes, 

as we talked about, to the legal review. We call it a legal tank 

team. When something has occurred that needs to have a set of 

fresh eyes on it, it comes out of my hands and goes into the hands 

of a legal team, who looks at it, and we call them a tank team. 

They then decide the best recourse of action from there. 

So I think it would probably be better if we could at some point 

in time have some conversations about what we are doing because, 

I think, again, from where we were 2 or 3 years ago, night and day. 

Mr. MICA. Well, again, we wouldn’t be holding this hearing if it 

all worked right. But that is why we are here. 

Let me turn—a final question just to Ms. McKee. You are involved in, again, some of the monitoring. Is that correct? 

Ms. MCKEE. That is correct. 

Mr. MICA. Yeah. 

And did anyone ever tell you that it was inappropriate to look 

at disclosures to OSC or members of Congress or attorneys? Did 

they tell you that? 

Ms. MCKEE. The focus of the monitoring wasn’t on any of those 

disclosures. While they may have been captured broadly, it was not 

something that we looked at. 

Mr. MICA. Okay. And did you think that it was fair game, because they were doing it on an FDA computer, that they could 

again look at that information and make the disclosures? 

Ms. MCKEE. I am sorry. I don’t understand your question. They 

could look at it? 

Mr. MICA. Again, you thought it was fair game because they 

were using an FDA computer in the process. 

Ms. MCKEE. The software that was used captures everything, is 

my understanding. There was not a way to wall off different communications—types of communications. 

Mr. MICA. Well, again, you—but you thought it was appropriate 

use of computers and information? 

Ms. MCKEE. I am not getting your question. I am sorry. 

Mr. MICA. Again, you said to the committee that you were involved in this process. 

Ms. MCKEE. That is correct. 

Mr. MICA. And you, in fact, had said that it was inappropriate 

to look at disclosures—or you said there was not a problem with 

looking at disclosures to either OSC or members of Congress or attorneys, is what I—some of the information I have been provided. 

That is not correct? 

85 

Ms. MCKEE. I don’t believe that is correct, sir. It may have been 

a mistake, misspoke during an interview. 

Mr. MICA. Well, again, I am looking at information that was provided from your transcribed interview. And, furthermore, when 

questioned about this, I am informed that you thought it was fair 

game because they were doing it on an FDA computer. And I think 

you responded—at least in those interviews, you thought it was a 

fair game because, again, they were using FDA computers. 

Ms. MCKEE. If I recall—I am trying to put your question into 

context with the question I was asked—I believe monitoring FDA 

employees’ computers is fair game. 

Mr. MICA. Is fair game under the rules. And you still believe 

that. 

Ms. MCKEE. I believe there are times when it is appropriate, yes, 

to monitor FDA employees’ computers. 

Mr. MICA. Okay. And about—what about disclosure of that information? What is your feeling about what has taken place and how 

that has worked? 

There have been disclosures from the monitoring that are inappropriate. And, obviously, the monitoring, again, monitors people’s 

inappropriate activity. That is part of the purpose of the monitoring. Correct? 

Ms. MCKEE. That is correct. 

Mr. MICA. Okay. And what is your opinion as to how this has 

worked and functioned? You said it is fair game, which they are 

doing. They are conducting this monitoring. And, obviously, we 

have had problems with it not working. What is your opinion? 

What is the flaw? Where do we need to go? 

Ms. MCKEE. I certainly believe the processes that the agency has 

put in place in the last six months would have helped in the situation—— 

Mr. MICA. If it had been in place. 

Ms. MCKEE. If it had been in place in 2010, it certainly would 

have helped. 

Mr. MICA. Okay. Thank you. 

Yield back. 

Mr. BENTIVOLIO. Thank you. 

At this time I would like to thank all of our witnesses for taking 

time from their busy schedules to appear before us today. 

The committee stands adjourned. Thank you very much. 

[Whereupon, at 12:27 p.m., the committee was adjourned.] 

(87) 

APPENDIX 

MATERIAL SUBMITTED FOR THE HEARING RECORD

88 


Insert offset folio 43 here 87176.043

Department of Health and Human Services 

OFFICE OF 

INSPECTOR GENERAL 

REVIEW OF THE FOOD AND DRUG 

ADMINISTRATION'S COMPUTER 

MONITORING OF CERTAIN 

EMPLOYEES IN ITS 

CENTER FOR DEVICES AND 

RADIOLOGICAL HEALTH 

Daniel R. Levinson 

Inspector General 

February 2014 

0IG-12-14-01 
89 


Insert offset folio 44 here 87176.044

Office of Inspector General 

http://oig.hhs.gov 

The mission of the Office of Inspector General (OIG), as mandated by Public Law 95'452, as 

amended, is to protect the integrity of the Department of Health and Human Services 

(HHS) programs, as well as the health and welfare of beneficiaries served by those 

programs. This statutory mission is carried out through a nationwide network of audits, 

investigations, and inspections conducted by the following operating components: 

Office of Audit Services 

The Office of Audit Services (OAS) provides auditing services for HHS, either by conducting 

audits with its own audit resources or by overseeing audit work done by others. Audits 

examine the performance of HHS programs and/or its grantees and contractors in carrying 

out their respective responsibilities and are intended to provide independent assessments of 

HHS programs and operations. These assessments help reduce waste, abuse, and 

mismanagement and promote economy and efficiency throughout HHS. 

Office of Evaluation and Inspections 

The Office of Evaluation and Inspections (OEI) conducts national evaluations to provide 

HHS, Congress, and the public with timely, useful, and reliable information on significant 

issues. These evaluations focus on preventing fraud, waste, or abuse and promoting 

economy, efficiency, and effectiveness of departmental programs. To promote impact, OEI 

reports also present practical recommendations for improving program operations. 

Office of Investigations 

The Office of Investigations (On conducts criminal, civil, and administrative investigations 

of fraud and misconduct related to HHS programs, operations, and beneficiaries. With 

investigators working in all 50 States and the District of Columbia, 01 utilizes its resources 

by actively coordinating with the Department of Justice and other Federal, State, and local 

law enforcement authorities. The investigative efforts of 01 often lead to criminal 

convictions, administrative sanctions, and/or civil monetary penalties. 

Office of Counsel to the Inspector General 

The Office of Counsel to the Inspector General (OCIG) provides general legal services to 

OIG, rendering advice and opinions on HHS programs and operations and providing all 

legal support for OIG's internal operations. OCIG represents OIG in all civil and 

administrative fraud and abuse cases involving HHS programs, including False Claims Act, 

program exclusion, and civil monetary penalty cases. In connection with these cases, OCIG 

also negotiates and monitors corporate integrity agreements. OCIG renders advisory 

opinions, issues compliance program guidance, publishes fraud alerts, and provides other 

guidance to the health care industry concerning the anti' kickback statute and other OIG 

enforcement authorities. 
90 


Insert offset folio 45 here 87176.045

Table of Contents 

EXECUTNE SUMMARY ..................................................................................................... 2 

REVIEW OF THE FOOD AND DRUG ADMINISTRATION'S COMPUTER 

MONITORING OF CERTAIN EMPLOYEES IN ITS CENTER FOR DEVICES AND 

RADIOLOGICAL HEALTH .................................................................................................. 5 

I. FDA'S COMPUTER MONITORING ......................................................................... 5 

Events Prior to Computer Monitoring ....................................................................... 6 

The Decision To Monitor Scientist I ......................................................................... 8 

Monitoring Software Used by FDA ......................................................................... 10 

Computer Monitoring of Scientist I Begins ............................................................ II 

The Interim Report of Investigation ........................................................................ 12 

Computer Monitoring of Additional Scientists Begins ........................................... 13 

Procedures Used During FDA's Computer Monitoring .......................................... 14 

FDA Consultations With OGC ................................................................................ 15 

CDRH Takes Action as a Result of Monitoring ...................................................... 15 

II. FINDINGS .................................................................................................................. 16 

III. RECOMMENDATIONS ............................................................................................ 18 

IV. DEPARTMENT RESPONSE .................................................................................... 20 

APPENDIX A: Methodology ............................................................................................... 21 

APPENDIX B: CDRH and the Premarket Application Process .......................................... 22 

APPENDIX C: Applicable Legal Criteria ............................................................................ 23 

Reasonableness of a Computer Search .................................................................... 23 

Interception of Electronic Communications ............................................................ 24 

The Whistleblower Protection Act... ........................................................................ 25 

Prohibitions on the Disclosure of Information by FDA Employees ........................ 25 

Appendix D: Department Comments ................................................................................... 27 

IIPage 
91 


Insert offset folio 46 here 87176.046

EXECUTIVE SUMMARY 

On July 14, 2012, The New York Times reported on computer monitoring by the Food and 

Drug Administration (FDA) of certain scientists in FDA's Center for Devices and Radiological 

Health (CDRH). On July 20,2012, the Secretary of the U.S. Department of Health and Human 

Services (HHS) wrote to HHS 's Office of Inspector General (OIG), asking it to consider whether 

there was a sufficient basis to conduct the monitoring; to consider whether the methods of 

monitoring were appropriate; and to provide recommendations on how HHS can appropriately, 

effectively, and efficiently investigate allegations of improper dissemination of confidential 

information while protecting employees' rights and whistleblower protections. 

Between April 20 I 0 and October 20 11, the FDA used computer-monitoring software on 

the FDA computers of five CDRH scientists. FDA suspected that these employees were sending 

trade secrets or confidential commercial information (CCI) outside FDA in possible violation of 

FDA regulations and criminal statutes; FDA also was aware that these employees may have held 

whistleblower status. During the time immediately prior to and during the computer monitoring, 

FDA computer systems displayed a log-on banner that stated that users had no right of privacy in 

the system and that all data on the system may be monitored; however, FDA had no policy 

governing the approval or conduct of such monitoring. 

During 2009 and 2010, several newspaper articles referenced or quoted internal CDRH 

memorandums. One such article, published in The New York Times on March 28, 2010, 

referenced a confidential GE Healthcare submission to CDRH and quoted CDRH employee 

Scientist 1.1 Soon after, FDA received a complaint letter from counsel representing GE 

Healthcare that alleged that its CCI had been disclosed to the press by CDRH in violation of 

Federal regulations and agency policy and asked FDA to investigate. CDRH management 

strongly suspected that Scientist I was the source of the information in the article because, 

among other reasons, he was quoted in the article. CDRH management also suspected that 

Scientist I was inappropriately ghostwriting reports for his subordinates. 

CDRH's Director tasked CDRH's Executive Officer with finding out what options were 

available to identify the source of the disclosure to The New York Times and to prevent future 

unauthorized disclosures. In order to accomplish this, the CDRH Director instructed the CDRH 

Executive Officer to engage with FDA's Assistant Commissioner for Management and/or with 

FDA's Chief Information Officer (CIO). After the CDRH Executive Officer met with both the 

I OIG has redacted the names of the five scientists subject to computer monitoring since they may have been entitled 

to protections under the Whistleblower Protection Act, even though their names already are known to the 

Department. In an abundance of caution and in an effort to avoid the appearance of disclosing the names of 

whistleblowers, we refer to them as Scientists 1 through 5. 

2/Page 
92 


Insert offset folio 47 here 87176.047

Assistant Commissioner for Management and the CIO, the CIO, in conjunction with the Chief 

Information Security Officer (CISO), proposed investigating the leaks using computermonitoring technology. Office of Information Management (OIM) staff arranged to begin 

monitoring Scientist 1 's computer and chose the monitoring tools that were used. 

OIM staff chose two computer monitoring tools to investigate Scientist I. They used 

EnCase to image (or copy) the memory of Scientist I 's FDA computer, which, at times, included 

personally owned removable memory drives connected to the FDA network. OIM staff also 

chose SpectorSoft (Spector) and installed it on Scientist I 's computer. Spector captures: (I) 

screen shots of a user's computer every few seconds and (2) the user's keystrokes, including 

keystrokes used to enter passwords. 

Using a short list of search terms developed by CDRH's Executive Officer, OIM staff 

reviewed the screen shots taken of Scientist I 's computer for potential indications of 

unauthorized disclosures outside FDA or ghostwriting. Because Spector takes screen shots of 

the information displaying on a user's computer every few seconds, OIM staff could not scope 

Spector to capture only information relevant to the issues CDRH wanted investigated; rather, 

OIM staff manually reviewed the tens of thousands of screenshots after they were taken by 

Spector to cull out those that appeared relevant to certain search terms concerning unauthorized 

disclosures and ghostwriting. Accordingly, while we found no evidence that FDA used Spector 

to target specifically the scientists' communications with any particular person or group, such as 

Members of Congress or the media, it is precisely because Spector broadly captured information 

that the scientists' communications with such persons were captured. 

Partly on the basis of information discovered while monitoring Scientist I 's computer, 

CDRH management directed OIM staffto expand Spector and EnCase monitoring to include 

four additional CDRH scientists. We found no evidence that during the computer monitoring, 

OIM staff logged into any FDA user's computer in order to gain live access as a user of the 

computer or attempt to log into any FDA user's personal Web-based email accounts. While 

Spector captures by default the user's keystrokes-including keystrokes used to enter 

passwords-we found no evidence that anyone at FDA, CDRH, or OIM ever accessed Spector's 

keystroke logs, where such information resides. 

As a result of the computer monitoring, CDRH concluded it had developed evidence that 

certain employees had disclosed CCI. In the spring of2011, CDRH wrote to several companies 

that had submitted confidential materials to CDRH to inform them that it had determined that an 

employee had made, via email, unauthorized disclosures of their CCI in July or August 2010. 

On the basis of its review, OIG found that despite the reasonableness ofCDRH's 

concerns and the explicit language in FDA's network log-on banner, CDRH failed to fully assess 

beforehand, and with the timely assistance oflegal counsel, whether the scope ofpotentiaily 

31Pagc 
93 


Insert offset folio 48 here 87176.048

intrusive EnCase and Spector monitoring would be consistent with constitutional and statutory 

limitations on Government searches and consistent with whistleblower protections. OIG 

recommends that HHS ensure that its operating divisions draft and implement policies and 

related procedural internal controls that provide reasonable assurance of compliance with laws 

and regulations, particularly those governing current and prospective employee monitoring. In 

September 2013, FDA issued an interim computer-monitoring policy that addresses our 

recommendations. 

41Puge 
94 


Insert offset folio 49 here 87176.049

REVIEW OF THE FOOD AND DRUG ADMINISTRATION'S COMPUTER 

MONITORING OF CERTAIN EMPLOYEES IN ITS CENTER FOR DEVICES AND 

RADIOLOGICAL HEALTH 

This review responds to the Secretary's letter dated July 20,2012, asking the Office of 

Inspector General (OIG) to review the monitoring of electronic communications of certain 

employees in the Food and Drug Administration (FDA) Center for Devices and Radiological 

Health (CDRH). Specifically, the Secretary asked OIG to consider whether there was a 

sufficient basis to conduct the monitoring; to consider whether the methods of monitoring were 

appropriate; and to provide recommendations on how the U.S. Department of Health and Human 

Services (HHS) can appropriately, effectively, and efficiently investigate allegations of improper 

dissemination of confidential information while protecting employees' rights and whistleblower 

protections. 

The Secretary's request refers to the computer monitoring of five individuals at CDRH 

that began on April 22, 20 I 0, when FDA installed SpectorSoft monitoring software (Spector) on 

the Government-issued computer of Scientist I. FDA subsequently expanded its monitoring to 

the Government-issued computers of Scientist 2, Scientist 3, Scientist 4, and Scientist 5. FDA 

also used a product called EnCase to remotely take forensic data images of the individuals' 

computer and network memory. Although FDA monitored each individual's computer usage for 

varying lengths oftirne, FDA had ended its monitoring of all five individuals by October 9, 

201 I. 

This review is organized into four sections. Section I summarizes events that led to the 

computer monitoring and FDA's conduct of the monitoring, Section II presents OIG's findings, 

and Section III provides OIG's recommendations. Section IV presents the Department's 

response. Appendixes cover OIG's methodology, CDRH and the premarket application (PMA) 

process for medical devices, the legal criteria relevant to the disclosure of information by Federal 

employees and computer monitoring of Federal employees, and the Department's comments. 

I. FDA'S COMPUTER MONITORING 

This narrative of the facts and events leading to FDA's computer monitoring, the 

deliberation and authorization by FDA management relating to the computer monitoring, and 

FDA's conduct of the monitoring is the result of the interviews and the document review 

described in Appendix A. Our review uncovered few inconsistencies among the information 

provided by interviewees and obtained from documentation, but where there was ambiguity or 

conflict, we note it. 

51Page 
95 


Insert offset folio 50 here 87176.050

During the time immediately prior to and during the computer monitoring, FDA used a 

network log-on banner, which appeared each time an employee logged onto his or her computer, 

prompting the employee to press "OK" to continue.1 It read: 

This is a Food and Drug Administration (FDA) computer system and is provided 

for the processing of official U.S. Government information only. All data 

contained on this computer system is owned by the FDA and may, for the purpose 

of protecting the rights and property of the FDA, be monitored, intercepted, 

recorded, read, copied, or captured in any manner and disclosed by and to 

authorized personnel. USE OF THIS SYSTEM BY ANY USER, AUTHORIZED 

OR UNAUTHORIZED, CONSTITUTES CONSENT TO THIS MONITORING, 

INTERCEPTION, RECORDING, READING, COPYING, OR CAPTURING 

AND DISCLOSURE. THERE IS NO RIGHT OF PRN ACY IN THIS SYSTEM. 

Authorized personnel may give to law enforcement officials any potential 

evidence of crime found on FDA computer systems. Unauthorized access or use 

of this computer system and software may subject violators to criminal, civil, 

and/or administrative action. The standards of ethical conduct for employees of 

the Executive Branch (5 C.F.R. § 2635.704) do not permit the use of government 

property, including computers, for other than authorized purposes. 

Events Prior to Computer Monitoring 

On January 13,2009, The New York Times published an article that included potentially 

confidential information from a then-pending 51 O(k) submission3 for a mammography computeraided detection device from device manufacturer iCAD. 4 CDRH officials stated that these 

disclosures were not authorized. Therefore, the disclosures would have been in violation of FDA 

regulations. 5 According to information iCAD provided to FDA by letter dated that same day 

(the iCAD Letter), the article's author informed the company that he had received "internal FDA 

documents" regarding the device from "scientific officers of the FDA." The iCAD Letter 

enclosed copies of two January 8, 2009, news articles by the Associated Press and The Wall 

Street Journal that reported on a letter sent by a group of FDA scientists to then President-Elect 

Barack Obama's transition team complaining that the scientific review process for medical 

devices at FDA had been corrupted and distorted by FDA managers and singling out 

'FDA since has updated the language in its log-on banner to meet OIG recommendations. 

3 CDRH's PMA process. and the 51O(k) process in particular, are described in Appendix B. 

4 Gardiner Harris, In F.D.A. Files. Claims of Rush to Approve Devices, The New York Times (Jan. 13,2009). 

5 Several statutory and regulatory provisions limit the ability of FDA employees to share agency information with 

others outside the agency and are discussed in detail in Appendix C. They include 18 U.S.C. § 1905 (Federal 

criminal statute generally limiting disclosures), 21 U.S.c. §§ 3310) and 333 (additional criminal provisions in the 

Federal Food, Drug, and Cosmetic Act that prohibit disclosure of trade secrets (but not confidential business 

information) submitted to FDA in accordance with FDA approval processes), and 21 CFR § 814.9 (FDA disclosure 

restrictions with respect to PMAs). 

6iPage 
96 


Insert offset folio 51 here 87176.051

mammography computer-aided detection devices as an example of a technology that should not 

have gone fOIWard. The iCAD Letter pointed out that The New York Times, and possibly other 

media outlets, had obtained material relating to 51 O(k) submissions on mammography computeraided detection devices. The New York Times article quoted from an internal agency 

memorandum regarding the pending review of another firm's premarket 51 O(k) submission. The 

quoted memorandum was a consultation review memorandum on the 51 O(k) submission that had 

been drafted on March 14,2008 (and updated on March 26,2008), by CDRH personnel and 

addressed to, among others, Scientist I. 

On October I, 2009, the Acting Director ofCDRH and other CDRH staff participated in 

a telephone interview with Wall Street Journal reporter Alicia Mundy, who had co-authored the 

January 8, 2009, article enclosed with the iCAD letter. During the call, Ms. Mundy quoted an 

internal FDA 51 O(k) reviewer memorandum that contained what CDRH believed to be CCI, the 

disclosure of which is restricted by regulation, or potential trade secrets, the unauthorized 

disclosure of which may have constituted violations of criminal statutes. 6 The CDRH Freedom 

of Information Act (FOIA) officer later confirmed that this particular reviewer memorandum had 

not been requested or released under FOIA. 

On October I, 2009, CDRH requested an audit of its internal electronic imaging system, 

IMAGE, to determine which employees had accessed the files containing the disclosed materials. 

The audit identified Scientist I as the only person who had accessed the particular files without a 

valid reason. 

On March 28, 2010, The New York Times published another article on FDA's 510(k) 

process, which described allegations that FDA downplayed the risks of radiation exposure when 

considering applications for the approval of certain uses of radiological devices. The article 

stated that "a group of agency scientists who are concerned about the risks of CT scans say they 

will testify at [an FDA meeting on how to protect patients from unnecessary radiation exposure] 

that FDA managers ignored or suppressed their concerns .... " The article reported that General 

Electric (GE) had submitted a 51 O(k) application and referenced "[ s ] cores of internal agency 

documents made available to the New York Times" pertaining to it. 7 The article quoted 

comments made in internal FDA communications by Scientist I (see note I on page 3) and a 

former CDRH contractor in opposition to the GE submission. The article also mentioned 

internal discussions from a May 12, 2009, 510(k) premarket review meeting that CDRH believed 

to be privileged. 

6 Ibid. 

7 Gardiner Harris, Scientists Say F.D.A. Ignored Radiation Warnings, The New York Times (Mar. 28, 2010). 

71Page 
97 


Insert offset folio 52 here 87176.052

On April 16,2010, FDA received another complaint letter, this time from counsel 

representing GE Healthcare (the GE Letter). The GE Letter expressed disappointment in CDRH 

for disclosing to the press CCI contained in a 51 O(k) submission for a GE Healthcare device used 

in CT (computed tomography) colonography screening. The GE Letter asserted that "CDRH 

was not permitted to publicly disclose either the existence or the contents of GE Healthcare's 

510(k) submission, so in disclosing this information, CDRH breached the confidentiality of GE 

Healthcare's submission in violation of both federal regulations and internal agency policy." 

The GE Letter requested that FDA conduct an investigation of the leak. 

The Decision To Monitor Scientist 1 

According to the CDRH Executive Officer, Scientist 1 was selected for computer 

monitoring in part because he was named in the March 28, 2010, New York Times article, which 

was referenced by and enclosed with the GE Letter. (The other FDA scientist named in the 

article was no longer an employee ofCDRH at the time the GE Letter was received.) In 

addition, the audit requested by CDRH on October 1,2009, of FDA's internal IMAGE System 

had identified Scientist I as the only person who had accessed the particular files without a valid 

reason. 

On April 21, 2010, CDRH's Executive Secretariat brought the GE Letter to the attention 

of CDRH's Executive Officer, who shared a copy with the CDRH Director. The CDRH Director 

directed CDRH's Executive Officer to find what options were available to identify the source of 

the unauthorized disclosure and to prevent future disclosures. The CDRH Director also told her 

to share the GE Letter with FDA's Chief Information Officer (CIO) in FDA's Office of 

Information Management (OIM) and FDA's Assistant Commissioner for Management. 8 The 

CDRH Director instructed the CDRH Executive Officer to meet with the Assistant 

Commissioner for Management and/or the CIO to discuss the unauthorized disclosures. The 

CIO, in conjunction with the Chief Information Security Officer (CISO) and others, arranged to 

begin monitoring Scientist l's computer. The CDRH Director was told about this monitoring at 

the time and approved it. It does not appear that any other response, apart from computer 

monitoring, was considered. 

The CISO and the CDRH Executive Officer met with the Team Leader for Incident 

Response at Chickasaw Nation Industries, Inc. (CNI), (the CN! Team Leader), an information 

security contractor for FDA, to explain CDRH's concern that Scientist I was disseminating 

information outside the FDA network. According to the CNI Team Leader, CDRH also was 

8 Additional FDA officials, including the Chief Counsel of FDA and the Special Agent in Charge (SAC) of FDA's 

Office ofInternal Affairs also received copies ofthe GE Letter. 

81Page 
98 


Insert offset folio 53 here 87176.053

concerned that Scientist 1 was improperly preparing official CDRH reports in the names of other 

CDRH scientists (or ghostwriting them), on the basis ofcompJaints from the other scientists' 

supervisors. The group discussed how to implement the CIO's monitoring directive to 

investigate these allegations. 

At the time, neither HHS, FDA, nor CDRH had implemented a policy governing the 

computer monitoring of employees designed to ensure compliance with limits on Government 

searches of Government employees, such as the Fourth Amendment, the prohibition on 

intercepting electronic cornmunications (Title III of the Omnibus Crime Control and Safe Streets 

Act (Title III», and the protections in the Whistleblower Protection Act (WP A). 9 The only 

guidance issued by FDA that governed computer monitoring was FDA's Forensic & Incident 

Response Procedures Manual, which is a technical document based on technical guidance from 

the Department of Commerce's National Institute of Standards and Technology. It does not 

provide guidance to managers on how to conduct investigations, office searches, or computer 

monitoring. 

During the meeting, the CDRH Executive Officer gave the CNI Team Leader a piece of 

paper listing search terms she had developed. This page of notes established the parameters for 

the initial computer monitoring of Scientist 1. The page read: 

Search terms: 

Colonography 

Kfollowed by a string ofnumbers1o 

It is possible that the employee had "ghost written" for the following employees: 

[Scientist 3} 

[Scientist 2} 

[Scientist 4} 

[Name Redacted} 

[Name Redacted} 

[Scientist 5} 

9 As described more fully in Appendix C: (l) the Fourth Amendment requires that Government searches of 

Government employees be justified in their inception and permissible in scope; (2) Title ill establishes criminal 

penalties for the interception of electronic communications absent an applicable exception; and (3) the WP A 

prohibits retaliation against a Government employee for disclosure of evidence of violations oflaw or regulation, 

waste and abuse, or a specific danger to the public health. Other statutes, such as the Privacy Act, may also impose 

limits on such monitoring. 

10 "K followed by a string of numbers" refers to Premarket Notification filings in accordance with section 510{k) of 

the Federal Food, Drug and Cosmetic Act, in which such filings are labeled with "K" followed by a series of digits. 

9/Page 
99 


Insert offset folio 54 here 87176.054

The list of employees identified as possible recipients of Scientist 1 's ghostwritten 

material was based on complaints by their supervisors that work they were turning in was not 

their own. 

Monitoring Software Used by FDA 

Around the same time, the CISO met with the CNI Team Leader to discuss available 

software tools that could be used to carry out the computer monitoring. FDA ultimately chose 

two tools to monitor computer usage of the scientists: SpectorSoft (Spector) and EnCase. 

Spector monitors a user's ongoing computer activity by capturing screen shots at a set interval 

(for example, every 5 or 10 seconds) and recording keystroke data. Spector cannot be used to 

see a user's activity in real time; rather, it displays static screen shots that it has captured. The 

CNI Team Leader believed Spector was the best tool to use in this situation because it was 

responsive to concerns of ongoing data exfiltration. The CNI Team Leader stated it is generally 

impossible to find evidence of transmissions of data beyond the FDA network that occurred in 

the past because individuals typically use personal Web-based email to communicate and 

transmit such data. II He also stated that OIM could remotely install Spector on a computer that 

is part of the FDA network without the individual's knowledge and that Spector would transmit 

its data to the Incident Response team. 

Spector captures by default the user's keystrokes-including, but not limited to, 

keystrokes for passwords. The member of CNI' s Incident Response Team (the CNI Team 

Member) ultimately assigned the computer-monitoring project stated that no one else at CNI 

ever looked at the keystrokes. Furthermore, he knew that no one at FDA looked at the 

keystrokes either, because only he was in a position to provide access to the keystroke logs and 

he never received such a request. The CNI Team Member told OIG that during the monitoring, 

CNI stafTnever logged into an FDA user's asset to gain live access as a user of the asset, nor did 

the CNI Team Member attempt to log into any FDA user's personal Web-based email accounts. 

Similarly, the CNI Team Leader told OIG that during the computer monitoring, he and his team 

members never physically or remotely controlled anyone else's computer. 

Screen shots that CNI identified as showing potential indications of ghostwriting or 

unauthorized disclosures outside FDA were shared with CDRH for further review. CDRH's then 

Associate Director, Office ofIn Vitro Diagnostic Device Evaluation and Safety, was given 

primary responsibility for reviewing these selected screen shots to look for CCI or trade secrets 

Jl OIM stafftold OIG that no tool available to FDA at the time could re-create communications over earlier nonFDA Web-based email because Web-based e-mail leaves very few traces behind on a user's computer. 

IOIPage 
100 


Insert offset folio 55 here 87176.055

being sent outside FDA, because she had subject matter expertise on the medical devices that 

CRDH reviews. 

EnCase is a retrospective tool that can remotely create a forensic data image of a hard 

drive or other computing asset. EnCase was not able to easily show whether data that existed on 

an FDA asset had been transmitted beyond the network. However, FDA used EnCase to take an 

image of the scientists' computers and network memory several times, usually in an attempt to 

recover something seen on a Spector screen shot relevant to unauthorized disclosures or 

ghostwriting, such as an email attachment that appeared likely to contain CCI. When CDRH 

requested a document, such as an e-mail attachment.CNIstaffused EnCase to recover the file 

and then transferred the attachment and any other files to CDRH via an encrypted FDA USB 

storage device. 

Computer Monitoring of Scientist 1 Begins 

On April 22, 2010, the CN! Team Leader remotely installed Spector on Scientist I's 

Government-issued laptop. The CN! Team Leader subsequently assigned the project to a 

subordinate, the CNI Team Member, giving him a page of "specifications" he had drafted 

together with the page of search terms drafted by the CDRH Executive Officer. The CNI Team 

Member described them as a text file containing "directions and guidance for the FDA task," but 

FDA did not provide a copy of the specifications to OIG. 

On April 23, 2010, FDA's Assistant Commissioner for Management informed FDA's 

Office of Criminal Investigations (OCT) about the GE Letter allegations, and OCI advised that it 

believed the issue should be referred to OIG because the individual alleged to have made the 

disclosure was also involved in a series of ongoing whistIeblower/Qui Tam issues with CDRH. 

ocr opened a case regarding the allegations in the GE Letter on May 14, 2010, and, by 

letter dated the same day, wrote OIG's then-Assistant Special Agent in Charge ofOIG's Special 

Investigations Branch requesting that it investigate the allegations in the GE Letter. On May 18, 

20 I 0, OIG responded that it would take no action because the referral lacked evidence of 

criminal conduct and noting that the disclosures implicated the WP A. 12 In the meantime, FDA 

12 On June 28, 2010, after Spector had been installed on Scientist 2's computer and 2 days before it would be 

installed on the remaining scientists' computers, CDRH renewed its request that 010 open an investigation, on the 

basis of evidence it gathered during its computer monitoring, including "documents suggesting that employees are 

engaged in the inappropriate, and likely illegal, disclosure of non public information." In response, 010 opened an 

investigation on July 31, 2010, and, after completing its review, presented the matter to the U.S. Department of 

Justice, where prosecutors reviewed the matter and declined prosecution. By letter dated November 15,2010,010 

notified the CDRH Director that it had closed its investigation, noting that prosecutors declined prosecution and 

"[ylour office indicated it had developed sufficient evidence to address the alleged misconduct through 

administrative processes, and as such, no further action will be taken by 010." 

II I P age 
101 


Insert offset folio 56 here 87176.056

had already initiated its monitoring of Scientist I (DIM installed Spector on Scientist l's laptop 

on April 22, 2010). J] 

On May 17,2010, FDA used EnCase for the fIrst time to obtain a snapshot of the 

contents of Scientist I's computer hard drive and attached external memory devices. For 

example, CNI staff recalled an EnCase analysis it performed of a non-FDA thumb drive 

belonging to Scientist 1 that was plugged into an FDA computer. However, it appears EnCase 

also was used to conduct searches umelated to anything identified through Spector. Additional 

EnCase snapshots were taken several times before the writing ofthe Draft OGC Memo. 

The Interim Report of Investigation 

On or about June 3, 2010, the CNI Team Member authored a summary of the computer 

monitoring captioned "Subjects of Interest," which he transmitted to FDA's CIO under a cover 

memo captioned, "Interim Report of Investigation." The cover memo characterized the 

allegations presented to the FDA Security Department as follows: 

• "Ghost writing HIS subordinates' reports, in particular those surrounding those 

reports that are identifIed by the letter 'K' followed by six (6) numbers." 

• "[Scientist I] communicating with external news sources (press) regarding HIS 

concerns over the FDA's approval process of particular medical devices surrounding 

CT scans and Colonography. This allegation particularly related to Gardiner Harris, 

reporter for the New York Times." 

The cover memo added that "[t]he analytical findings to date appear to support the 

allegations, however the review is ongoing and substantial volumes of data are currently being 

culled." 

The report summarized data and communications identified by looking at 2 weeks' worth 

of Spector screen shots. The report contained four categories of "subjects": primary, secondary, 

ancillary, and media outlet. The "primary" subjects were individuals within FDA with the 

highest frequency of communication regarding improper release of confidential information or 

ghostwriting. The "secondary" subjects referred to individuals within the agency with 

substantive communications about the search term issues at any frequency level. "Ancillary" 

subjects referred to individuals outside the agency with any communications about the search 

term issues and included a Member of Congress and Congressional staff. "Media outlet" 

subjects referred to members of the media with any communications about the search term 

13 A draft Office of the General Counsel (OGC) legal memorandum (Draft OGC Memo), discussed more fully 

below, mistakenly asserts that CDRH began its computer monitoring of Scientist I after OIG's May 18, 2010, 

response. 

12 I P a g: e 
102 


Insert offset folio 57 here 87176.057

issues. This report did not indicate-and we found no evidence-that the monitoring was 

implemented in a manner specifically designed to capture communications with Congress, as has 

been alleged to HHS. 

The report characterizes the primary subjects (Scientist 1, Scientist 2, and a former 

CDRH employee) as follows: "The above listed subjects appear to be the point men. All 

communications amongst aU the subj ects filter through one or all of these three primary 

subjects." 

Scientist 3, Scientist 4, and Scientist 5 were included on the list of secondary subjects; the 

report summarizes their communications as follows: 

The secondary subjects listed above are in constant communication amongst 

themselves and the primary subjects via FDA email, Yahoo Mail and Gmail. 

Communications involve review, editing, compilation, production or distribution 

of verbiage, documentation, and information pertaining to medical reviews, 

current investigations, claims against HHSIFDA, release of information to the 

press and external organizations. 

The report included hyperlinks labeled "View All instances of the above noted in order 

by date" that linked to screen shots showing some of the data the report identified. 

Computer Monitoring of Additional Scientists Begins 

Partly on the basis of information discovered while monitoring Scientist 1, including 

email contacts between Scientist 1 and others, CDRH's Executive Officer told OIM staff to 

expand the monitoring, and Spector then was installed on additional FDA computers used by 

Scientist 2 (on May 24,2010) and Scientist 3, Scientist 4, and Scientist 5 (all on June 30, 2010). 

According to CDRH's Executive Officer, the decision to expand the monitoring was a 

group decision made by her, the CIO, the Assistant Commissioner for Management, CDRH's 

then Associate Director, Office of In Vitro Diagnostic Device Evaluation and Safety, and 

others. 14 We found no evidence that this group considered employing any investigative 

technique other than computer monitoring. 

On June 25,2010, an OGC attorney discussed expanding the monitoring in an e-mail to 

FDA's Chief Counsel. "[Attorney to attorney communication redacted.]" 

In the CDRH Director's June 28,2010, letter to OIG (discussed in footnote 11 

above), the CDRH Director described what was discovered during the monitoring: 

'4 CDRH's then Associate Director, Office ofln Vitro Diagnostic Device Evaluation and Safety, disputed her 

involvement in computer-monitoring decisions, stating she did not know who at FDA was being monitored. 

13IPage 
103 


Insert offset folio 58 here 87176.058

"Specifically, [the documents discovered during the computer monitoring] show that the 

employee at issue and other employees have recently disclosed nonpublic information to 

at least one former FDA employee .... We have also discovered e-mails that the 

employee in question sent to unauthorized recipients which appear to have attachments 

likely containing confidential commercial information .... " 

stated: 

A July 25,2010, email from the CDRH Director to the Deputy FDA Commissioner 

... after several weeks of monitoring IT security and FDA technical experts 

identified several instances in which [Scientist I] provided confidential 

information about medical devices under review to [a former FDA scientist] when 

[that former FDA scientist] was no longer an FDA employee. In some instances 

the medical devices did not pertain to [this former FDA scientist's] area of 

expertise. Other CDRH employees were participants in these email exchanges. 

As a result, FDA expanded its monitoring to the computers of four other CDRH 

staff who were parties to the disclosure of confidential information. 

Procedures Used During FDA's Computer Monitoring 

As discussed above, screen shots that CNI staff identified as showing potential 

indications of ghostwriting or unauthorized disclosures were shared with CDRH's then Associate 

Director, Office of In Vitro Diagnostic Device Evaluation and Safety, for further review. The 

then Associate Director also made written lists of filenames of monitored emails and screen shots 

that appeared to contain CCI or details of internal processes being sent outside the FDA 

computer network and gave these lists to CDRH's Executive Officer aslcing her to confirm with 

FOIA experts whether the information identified as CCI was actually CCL The then Associate 

Director identified some of the emails as going to individuals who no longer worked forFDA,as 

well as Members of Congress; when she talked to the CDRH Director about information going 

outside FDA, he expressed his understanding that employees have the right to share CCl with the 

press if they think there are immediate, urgent public health concerns that are being ignored by 

FDA. 

As with Scientist I, FDA used EnCase to take images ofthe other scientists' computers 

and network memory several times, usually in an attempt to recover something seen on a Spector 

screen shot. For instance, CNI staff used EnCase after it observed that numerous potential FDA 

files were being copied and transferred to a thumb drive docked into Scientist 3' s FDA computer 

(when a thumb drive is docked into an FDA asset, the thumb drive becomes part of the FDA 

network). 

141Page 
104 


Insert offset folio 59 here 87176.059

FDA Consultations With OGC 

With no agency policies in place, FDA and CDRH officials had no written guidance to 

follow to ensure that any computer monitoring would be conducted in accordance with 

applicable laws and in a manner that protected the rights of employees. 15 We found no evidence 

of consultation between FDA and OGC prior to the decision to conduct computer monitoring of 

Scientist I in April 2010. FDA stated that after monitoring began, OGC was consulted on a June 

2010 draft referral from CDRH to OIG on issues related to computer monitoring. Also in 

approximately June 2010, a staff attorney in the OGC Food and Drug Division (FDD), at the 

direction of the Associate General Counsel ofFDD, wrote a legal memorandum (the Draft OGC 

Memo), which addressed some of the legal issues raised by the computer monitoring. 16 

The Draft OGC Memo is relevant to our review, even though the latest version of it was 

dated July 8, 20IO-several weeks after the initiation ofthe computer monitoring of Scientist 

I-because it is the only document from an attorney provided to OIG evidencing FDA's and 

CDRH's understanding of the applicability oflegallimits on the conduct of searches of 

Government employees. The legal advice provided in the memorandum was limited in scope 

and did not address the applicability of all the relevant laws to all the targeted scientists. 

CDRH Takes Action as a Result of Monitoring 

As a result of the infonnation collected during the monitoring, Scientist I was put on 

administrative leave on July 7, 2010, and his tenn appointment expired on July 31,2010. 

Scientist 4 was given advance notice of removal from Federal service on December 6, 2010, for 

unauthorized release of agency information; however, Scientist 4 was temporarily reappointed on 

February 17, 2012, and her reappointment remained effective through September 25, 2013. 

Scientist 3's appointment was not renewed as of November 6,2010. Scientist 2, who was a 

Commissioned Corps officer, was directed to nonduty with pay status on May 5,2011, and was 

formally terminated from the Corrunissioned Corps on October 9, 2011. Scientist 5 remains 

employed by CDRH. 

15 FDA published and periodically updated a Forensic & Incident Response Procedures Manual; however, this 

manual is a technical document largely based on technical guidance from the Department ofCommerce's National 

Institute for Standards and Technology. It does not provide guidance to FDA managers on how to conduct 

investigations, office searches, or computer monitoring. 

16 According to FDA, the Draft aGC Memo was never finalized. FDA told us that it does not know why it was not 

finalized and that, since the Associate General Counsel ofFDD (who directed preparation of that memorandum) no 

longer works in aGC, FDA would speculate as to neither the reasons for directing preparation of it nor the way in 

which it was used. During our review, OIG saw several iterations of this memorandum. The Draft aGC Memo is 

marked "privileged and confidential- attorney work product." 

151Page 
105 


Insert offset folio 60 here 87176.060

In four letters sent in March and April 2011, CDRH wrote to companies with business at 

CDRH to inform them that CDRH had determined that one ofits Office ofIn Vitro Diagnostics 

employees had made unauthorized disclosures of their CCI in July or August 2010 via email. In 

each letter, CDRH apologized and made assurances that it had taken appropriate administrative 

action. 

II. FINDINGS 

We found that CDRH had reasonable concern that confidential information, including 

possibly trade secrets and/or CCI, had been disclosed by agency employees without 

authorization. This concern was reasonable largely because news reports cited internal agency 

documents and agency scientists as sources of the confidential information. Indeed, by the 

spring of2011, CDRH was sufficiently certain that its investigation had turned up evidence of 

such unauthorized disclosures that it sent letters of apology to several device manufacturers. 

We also found that FDA had provided notice to its scientists (and all other users of its 

network) through a network log-on banner that there was no right to privacy on the FDA 

computer network and that all data on the network were subject to interception by FDA. 

Consistent with the banner, FDA monitored the scientists' communications over FDA's network 

using computer-monitoring technology that captured communications from both their 

Government and personal email accounts. In our interviews ofthose conducting the computer 

monitoring and our review of other data sources, we found no evidence that FDA had obtained 

or used passwords to any of the scientists' private email accounts, nor did we find any evidence 

that FDA logged into any of the scientists' computers in order to gain live access as a user of the 

computer. The images of private emails that FDA obtained were captured by screen shots taken 

by Spector of the scientists' use of the FDA network. 

Because there was no policy in place at FDA or CDRH to ensure compliance with 

applicable laws and restrictions, such as the Fourth Amendment, Title III, and the WPA, it was 

particularly important for fDA and CDRH to ensure that it understood the full extent of the 

limits on the agency and the rights of its employees. However, we found no evidence that FDA 

or CDRH planned its investigation or scoped the monitoring with the timely assistance of 

counsel, who could have advised FDA and CDRH prior to the monitoring on compliance with 

relevant requirements, such as the Fourth Amendment, criminal prohibitions on the interception 

of electronic communications, and the WP A; there was no policy in place at FDA or CDRH to 

ensure compliance with these requirements. 

The legality of the surveillance under these authorities currently is being litigated, and we 

are not prejudging the outcome. Nevertheless, we find that despite the reasonableness of 

CDRH's concerns and the explicit language in FDA's network banner, CDRH should have 

l61Page 
106 


Insert offset folio 61 here 87176.061

assessed beforehand, and with the assistance oflegal counsel, whether potentially intrusive 

EnCase and Spector monitoring would be the most appropriate investigative tools and how to 

ensure that the use ofthese tools would be consistent with constitutional and statutory limitations 

on Government searches. 

For instance, in the absence of existing guidance, CDRH should have considered, and 

sought legal counsel on, the following in advance of the monitoring: 

I. Did the leaked information implicate criminal prohibitions or merely regulatory ones? 

(This question is relevant to both the permissibility of the monitoring under the Fourth 

Amendment and to the applicability of the WPA. See Appendix C.) 

2. Was FDA's network log-on banner sufficient to remove all the scientists' REP, and 

would the use of EnCase or Spector constitute a search that was justified at its inception 

and that was of permissible scope? 17 

3. Were the five scientists whistleblowers under the WP A, and if so, how should the 

surveillance be conducted to ensure that there would be no WPA-prohibited retaliation?]8 

4. Was Title III applicable, and if so, did the surveillance fall under an applicable 

exception? 

We found no evidence that CDRH or FDA considered these legal questions before 

initiating surveillance. The only documented legal analysis, namely the Draft OGC Memo, was 

prepared after the surveillance already had begun. While recognizing that the Draft OGC Memo 

was just that-a draft-it is one of few indications of any contemporaneous consultation with, or 

consideration by, FDA counsel. 

Another indicator of the lack of adequate consideration of the implications of the Fourth 

Amendment, in particular, is the lack of documentation supporting both the reasons why EnCase 

and Spector-both of which broadly capture information-were determined to be the most 

appropriate tools and the manner in which the EnCase and Spector searches were scoped. 

Specifically, we found that the discussion of what investigative technique to use and how to 

scope the monitoring was limited largely to technical discussions with information technology 

\7 Courts have established that a sufficiently broad network banner can eliminate a Government employee's REP. It 

is important to note, however, that soon after FDA began its computer monitoring, the United States Supreme Court 

decided City olOntario v. Quon. in which the Court's Fourth Amendment analysis bypassed the question of REP 

altogether and concluded the search was legal after applying the two-part test that the search be justified at its 

inception and permissible in scope. This suggests that a prudent agency would ensure that any monitoring would be 

of permissible scope under 0 'Connor v. Ortega (see Appendix C), even in cases when the monitored employee has 

no REP. 

"In the wake of revelations about FDA's monitoring of its scientists, the Office of Special Counsel (OSC) issued 

guidance to Federal agencies stating that "agency monitoring specifically designed to target protected disclosures to 

the OSC and lOs is highly problematic." 

171Pagc 
107 


Insert offset folio 62 here 87176.062

professionals about the available surveillance technology. In addition, neither CDRH nor FDA's 

OIM staff could produce or recall the substance of the specifications on how to implement the 

Spector monitoring that were provided by the CN! Team Leader to his subordinate conducting 

the monitoring. Similarly, although OIG was able independently to identify search terms applied 

when CDRH used EnCase to search for relevant material on the scientists' computers, we found 

no document that explained the relevance of these search terms. The absence of documentation 

concerning scoping decisions makes it difficult to evaluate the reasonableness of these computer 

searches. 

Because CDRH and FDA did not prospectively assess the relative risks involved in 

whether or how to conduct investigations of potential whistieblowers, such as ensuring that their 

investigations were conducted in accordance with laws and regulations, the computer monitoring 

of the five scientists had significant negative consequences for FDA. A timely, fuller, and better 

documented consideration of all of these risks may have provided the agency greater protection 

from controversy, while demonstrating the agency's commitment to protecting its employees' 

rights. 19 

m. RECOMMENDATIONS 

HHS should ensure that its operating divisions (OpDivs) draft and implement policies 

and related procedural internal controls that provide reasonable assurance of compliance with 

laws and regulations, particularly those governing current and prospective employee monitoring. 

At a minimum, the internal controls concerning electronic monitoring of employees20 should 

address: 

the agency's authority to monitor employee communications or access employee 

files; 

protection of the rights of employees and the extent of an employee's expectation 

of privacy while using agency IT resources; 

specific conditions for requesting access to employee communications; 

defined roles and responsibilities for initiating, reviewing, and approving requests 

to access employee communications and data; and 

19 On June 17,2013, all HHS employees received an email both describing the Department's authority and ability to 

monitor the electronic activities that take place on its networks and equipment and notifying employees of the laws 

in place to protect Federal employees who reveal instances of waste, fraud or abuse within the Federal Government, 

commonly referred to as the "Whistleblower Protections laws." The email included a notice regarding the 

Whistleblower Protection Enhancement Act of 2012. 

'0 This includes, but is not limited to, current and former Federal employees, contractors, interns, and visitors that 

are provided access to HHS information technology and data. 

181Pagc 
108 


Insert offset folio 63 here 87176.063

retention of records that document the initiation, review, and approval of 

electronic monitoring, including opinions and recommendations of legal counsel. 

At the time of FDA's investigation of the five scientists, neither the Department, FDA, 

nor CDRH had policies or procedures in place that governed the monitoring of agency 

employees' use of Government IT resources. After public revelations that FDA had monitored 

its employees, HHS implemented a Department-wide policy regarding such computer 

surveillance. Issued on June 26, 2013, HHS's "Policy for Monitoring Employee Use of HHS IT 

Resources" requires that its agencies "establish policies and procedures that will strengthen the 

ability to effectively document, analyze, authorize, and manage requests for HHS employee 

computer monitoring." The policy states that "[w]hile the warning banner gives OpDivs the 

authority to monitor employee use of IT resources, it is each OpDiv's responsibility to carry out 

monitoring in a fashion that protects employee interests and ensures the need for monitoring has 

been thoroughly vetted and documented." The policy gave the agencies, including FDA, 90 days 

to develop and deliver written policies and procedures that meet requirements laid out in the 

HHS policy. These requirements include, among other things: maintaining advanced written 

authorization of any computer monitoring, consulting with OGe to ensure the proposed 

monitoring complies with all legal requirements, and documenting the basis for approving 

requests to conduct computer monitoring. 

FDA issued its interim computer-monitoring policy on September 26, 2013. In 

particular, the FDA's interim policy: 

• establishes procedures requiring authorization by senior management and 

consultation with legal counsel; 

• distinguishes between monitoring conducted at the behest oflaw enforcement and 

monitoring conducted for management purposes to minimize interference with 

law enforcement investigations; 

• requires monitoring to be narrowly tailored in time, scope, and degree to 

accomplish the monitoring's objectives; and 

requires that the authorization describe the reason, factual basis, and scope of the 

monitoring. 

Given this, FDA's interim policy addresses our five recommendations outlined above. 2

! 

HHS should determine whether all other individual OpDiv policies meet our recommendations 

above. HHS also should regularly review and, as necessary, update its Department-wide 

" We note that both the HHS policy and the FDA policy are ambiguous with respect to their applicability to 

circumstances in which the misconduct being investigated might not violate a written policy. HHS and FDA should 

ensure that their managers have adequate guidance in such cases. 

191Page 
109 


Insert offset folio 64 here 87176.064

monitoring policies to ensure they are compatible with new and emerging technologies and 

methodologies. Information technology is continually changing, and a static monitoring policy 

could fail to address key implementation issues as capabilities evolve. 

IV. DEPARTMENT RESPONSE 

HHS concurred with all of the recommendations in this report. See Appendix D for the 

full text ofHHS's comments. HHS also offered technical comments that we incorporated as 

appropriate. 

20 I P age 
110 


Insert offset folio 65 here 87176.065

APPENDIX A: Methodology 

This review was conducted by a 12-member team (the Review Team) composed of 

individuals from OIG's Immediate Office, Office of Audit Services, Office of Counsel to the 

Inspector General, Office of Evaluation and Inspections, Office of Investigations, and Office of 

Management and Policy. 

We interviewed current and former employees of FDA for this report, including the 

CDRH Director, the CDRH Executive Officer, the then Associate Director in CDRH's Office of 

In Vitro Diagnostic Device Evaluation and Safety, the FDA OCI Office oflnternal Affairs SAC, 

an OCI Office of Internal Affairs Assistant SAC, and FDA's former Chieflnformation Security 

Officer during the relevant time period. We also interviewed two employees ofCNI, an FDA 

contractor: the CNI Team Leader and the CNI Team Member. 

We were unable to interview certain individuals with information relevant to our review. 

FDA's former CIO, who is no longer in Federal service, declined through counsel to speak with 

the Review Team. Similarly, an attorney collectively representing the five scientists subject to 

computer monitoring did not respond to our repeated information requests. 

The Review Team also collected information and documents from FDA on topics that 

included policies regarding the use of software to engage in computer surveillance of FDA 

employees, surveillance software files and logs, and consultations FDA engaged in prior to 

initiating monitoring. In all, we received more than six terabytes of information that included 

documents, emails, and screen shots. 

Throughout this document, when an assertion is made, it is based on information 

gathered from witness interviews and other evidence reviewed by the Review Team. 

21 I P age 
111 


Insert offset folio 66 here 87176.066

APPENDIX B: (DRR and the Premarket Application Process 

CDRH is responsible for ensuring the safety and effectiveness of medical devices. 

Devices vary in complexity and application, ranging from simple tongue depressors to complex 

pacemakers. CDRH assigns each type of device one of three regulatory classifications (Class I, 

II, or III), which are based on the level of control needed to ensure the safety and effectiveness of 

the device for patients and other end users. Regulatory control increases from Class I to Class 

III. A device's risk classification determines its premarket review process. 22 

CDRH must approve Class III medical devices prior to their marketing under either the 

Premarket Approval process or the Premarket Notification (the latter is referred to as "5 I O(k)") 

process. Premarket Approval review is the most stringent process for obtaining FDA approval to 

market a device and is required by statute for devices that support or sustain human life, are of 

substantial importance in preventing impairment of human health, or present a potentially 

umeasonable risk of illness or injury. 23 

If a Class III device is not required to undergo Premarket Approval, the manufacturer 

must submit to CDRH a 510(k) application. The 510(k) is a faster and less stringent premarket 

review process than Premarket Approval. Submissions under the 51 O(k) process must 

demonstrate that a device to be marketed is substantially equivalent to a predicate device that is 

already legally marketed in the United States. 24 CDRH determines a device is substantially 

equivalent to a predicate device if the 5 I O(k) submission demonstrates that it has the same 

intended use and technological characteristics as the predicate. A device with technological 

characteristics that differ from the predicate device may also be declared substantially equivalent 

if the information in the 51 O(k) submission demonstrates that the device is at least as safe and 

effective as the predicate and does not raise new questions of safety and effectiveness. 25 

Scientists who are either CDRH staff or contract employees determine which regulatory 

class a device falls into, whether a device should be reviewed under the Premarket Approval or 

510(k) process, and whether a device should be approved, or cleared. 

22 See 21 C.F.R. § 860.3. 

23 Seethe Federal Food, Drug, and Cosmetic Act §§ SIS(a) and SI3(a)(1)(C), 21 U.S.C. §§ 360e(a) ard 

360c(a)(1 )(C). 

" See 21 CFR § 807.92(a)(3). 

" FDA, CDRH, Guidance on the CDRH Premarket Notification Review Program 6/30/86 (K86-3), SIO(k) 

Memorandum #K86-3. 

22, Pug e 
112 


Insert offset folio 67 here 87176.067

APPENDIX C: Applicable Legal Criteria 

The FDA scientists' communications with outside entities and FDA's computer 

monitoring implicate a variety of legal restrictions relating to disclosure of information and to 

privacy. This appendix summarizes those legal principles, which are relevant to determining 

whether the conduct of the FDA scientists provided a sufficient legal basis for FDA to engage in 

the computer monitoring in the manner and scope that it did. 

Reasonableness of a Computer Search 

The Fourth Amendment's protections against unreasonable searches and seizures apply 

where an individual has REP. Without REP, a search by the Government is not a search for the 

purposes of the Fourth Amendment. Where there is REP, the Government generally must have 

probable cause and obtain a warrant for a search to be reasonable. In general, Government 

employees who are notified that their employer has retained rights to access or inspect 

information stored on the employer's computers can have no REP in the information stored 

there. 

The Supreme Court's decision that governs the constitutionality of a search in a 

government office is 0 'Connor v. Ortega, 480 U.S. 709 (1987). In Ortega, the Supreme Court 

describes the factors for determining REP: 

Individuals do not lose Fourth Amendment rights merely because they work for 

the government instead of a private employer. The operational realities of the 

workplace, however, may make some employees' expectations of privacy 

unreasonable when an intrusion is by a supervisor rather than a law enforcement 

official. Public employees' expectations of privacy in their offices, desks, and file 

cabinets, like similar expectations of employees in the private sector, may be 

reduced by virtue of actual office practices and procedures, or by legitimate 

regulation. 

Ortega, 480 U.S. at 717. 

Therefore, whether the scientists had REP in their use of FDA computer resourcessuch as computer hard drives, external memory devices, and network storage is determined on 

a case-by-case basis and will be influenced by such facts as the presence and wording of FDA's 

network banner. 

Where a public employee has REP, there are several exceptions to the probable cause and 

warrant requirements. Among these is the exception for workplace searches conducted for 

purposes unrelated to the enforcement of criminal laws. The Supreme Court held in Ortega that 

"public employer intrusions on the constitutionally protected privacy interests of government 

23 I P age 
113 


Insert offset folio 68 here 87176.068

employees for non-investigatory, work-related purposes, as well as for investigations of workrelated misconduct, should be judged by the standard of reasonableness under all the 

circumstances." Further, the search must be justified at its inception and permissible in scope. A 

search is justified at its inception if there are reasonable grounds, based on all of the 

circumstances, for suspecting that the search will (I) turn up evidence that the employee engaged 

in work-related misconduct or (2) that the search is necessary for a noninvestigatory workrelated purpose, such as to retrieve a file when the employee is not available. It is permissible in 

scope where the measures adopted are reasonably related to the objectives of the search and not 

excessively intrusive in light of the nature of the misconduct. Ortega, 480 U.S. at 726. The 

measures, however, need not be the least intrusive measures practicable. 26 

It is important to note that in one of the Supreme Court's recent consideration ofa 

workplace search ofa Government employee's use of agency information resources, the Court 

avoided the question of REP altogether and proceeded to apply the two-part test that the search 

must be justified at its inception and permissible in scope. 27 Because of the uncertain or 

speCUlative nature of REP determinations, application of the two-part test in all circumstances 

prior to the initiation of a workplace search, such as computer surveillance, could help limit the 

Government employer's litigation vulnerability. 

Interception of Electronic Communications 

FDA's computer monitoring potentially implicates criminal prohibitions on the 

interception or acquisition of electronic communications without process because Spector 

captured images of e-mails being prepared or dispatched by the scientists using both their 

personal and FDA e-mail accounts. Title III, as amended by the Electronic Communications 

Privacy Act of 1986, governs the authority of the Government to intercept electronic 

communications, such as email. Title III requires that the Government obtain a court order prior 

to engaging in real-time interception of email, as would be required for real-time interception of 

telephone calls. Among the exceptions to the court order requirement is the "consent exception," 

which requires an analysis similar to establishing whether REP exists. In particular, the consent 

exception analysis would be used to determine whether an individual gave consent by agreeing 

to abide by the terms of FDA's computer network banner when logging onto FDA's network. 

The law also limits the Government's ability to obtain "stored communications." 

Amendments made to Title III by the Stored Communications Act require the Government to 

issue a subpoena to an email service provider to acquire emails that have been retrieved by the 

26 See City o/Ontario v. Quon, 130 S. Ct. 2619,2632 (2010). 

" Quon, 130 S. Ct. at 2630. 

241 P age 
114 


Insert offset folio 69 here 87176.069

holder of the email account. To acquire emails that have not been retrieved, the Government 

must either issue a subpoena or obtain a warrant depending on how long the email has been in 

electronic storage with the email service provider. These provisions are relevant only if FDA 

acquired stored personal emails from the five scientists' email service providers. 

The WhistJebJower Protection Act 

Although a workplace search may be justifiable under existing Fourth Amendment 

principles and under Federal prohibitions on disclosure of information, searches conducted 

against those who make disclosures to, for example, Congress or to the press may implicate the 

prohibition in the WPA, at 5 V.S.c. § 2302, against retaliation. 

Subsequent to public revelations of the FDA's surveillance of its five employees, OSC 

issued a memorandum in which it stated that "agency monitoring specifically designed to target 

protected disclosures to OSC and IGs is highly problematic." This admonition was based in part 

on the provisions of the WP A, which prohibit taking or not taking any personnel action with 

respect to a Government employee because of any disclosure of information that the employee 

reasonably believes to evidence violations of law or regulation, waste and abuse, or a specific 

danger to public health. Section 2302 defmes "personnel action" to include disciplinary or 

corrective actions or any other significant change in working conditions and is therefore 

sufficiently broad to include targeting an employee for computer surveillance. Notably, the 

statute does not specify to whom a disclosure must be made for whistleblower protections to be 

available, and thus the statute has been interpreted to cover disclosures made to media outlets, in 

addition to OIGs, OSC, and Congress. 28 

Section 2302 contains one important caveat regarding the applicability of whistle blower 

protections: an agency is prohibited from taking (or not taking) a personnel action only when the 

disclosure made by the employee is not specifically prohibited by law. Therefore, the statutory 

prohibitions on certain disclosures, described immediately below, are relevant to the applicability 

of this caveat to FDA's monitoring of its employees. 

Prohibitions on the Disclosure of Information by FDA Employees 

Several statutory and regulatory provisions limit the ability of FDA employees to share 

agency information with others outside the agency. Violation of any of these provisions may 

provide a legitimate basis for an internal investigation. The Federal criminal statute generally 

"See e.g .• Horton v. Department of the Na1Y, 66 F.3d 279 (Fed. Cir. 1995) (stating, "The purpose of the 

Whistleblower Protection Act is to encourage disclosure of wrongdoing to persons who may be in a position to act 

to remedy it, either directly by management authority, or indirectly as in disclosure to the press."). 

25jPage 
115 


Insert offset folio 70 here 87176.070

limiting disclosures, at 18 U.S.C. § 1905, provides for removal and for criminal penalties for the 

disclosure of trade secrets and confidential business information where such disclosure is not 

authorized by law. The Federal Food, Drug, and Cosmetic Act has additional criminal 

provisions at 21 U.S.C. §§ 331 (j) and 333, which prohibit the disclosure oftrade secrets (but not 

confidential business information) submitted to the FDA in accordance with FDA approval 

processes. The prohibition in section 331 (j) does not apply to disclosures made to Congress or 

its committees, but it does apply to disclosures to the media. FDA implemented and expanded 

on section 331 (j) in its regulation at 21 CFR § 20.61. The regulation states that neither trade 

secrets nor CCl is available for public disclosure outside of the procedures set forth in the 

regulation and provides definitions for "trade secrets" and "CCI." 

Finally, FDA has implemented disclosure restrictions with respect to PMAs. "The 

existence of a PMA file may not be disclosed by FDA before an approval order is issued to the 

applicant unless it previously has been publicly disclosed or acknowledged." 21 CFR § 814.9. 

Furthermore, "lfthe existence of a PMA file has not been publicly disclosed or acknowledged, 

data or information in the PMA file are not available for public disclosure." Similarly, 21 CFR § 

807.95 prohibits the disclosure of the existence of a PMA, except under the specified 

circumstances. 

261 P age 
116 


Insert offset folio 71 here 87176.071

Appendix D: Department Comments 

To. 

Subja:!; 

THE SECRErARY OF IlEAl~ AND HIJt,jAjI S£AvIC~ 

WA5HlNtiTOH. D.C. 21lOl 

Daniel P.. L,',nson 

!nspcolOt GenerBJ 

Februory 24. 2014 

U. S. Department of Health nnd Human Servi= 

RC$pOns. to 010 DrAft M .... "rnndUQI Report: Re,.'e .. of 11>£ ,,,od QNi Drug 

Admiffi,51r'ation's Compuler )'loniforil1g a/Cerlaln Employee$ in lJ.t Center for 

!)e"ice! nnd Rodial"gica! Hcallh. 010·I2.J4-01 

On July 20, 20ll, 1 ""lueSleO the Office of the Inspector Gcneral(0I0) 10 conduci aT"';'''' of 

the Food 8IKI Drug Administration's Center for De,icc. Dnd Radiological Health employee 

monitoring pra<1iees. 010 ""ndueled thi, review and, on January 24, 2014, issued the OIG Draft 

Momorandum Report: R""/el!' "flhe Food aNi DrIlg Aa,niniSlration's Computer Moniloring of 

Cerlai. Emplo)~es In lIS CemeT for DeVIces and /ladlC.logicai Health. 010·12·14-01. 

Til< Draft Memor.ndum Report requestc<i commenls pertaining 10 the recommendations in the 

report. I have ,1O\';oWcllhi. repon Bnd """"ur with the 010 recommendolion .. as described in 

the lUlnchmenl I""vided by my office. 

p~..., do 110\ hesitlllC to ",""h out 10 me. E. J, Holland. Assistant Secretary for Admini.lJ'1IIlon, 

Da\"id Homwi17_ Deputy G<:n<raI Coun""I, <>r FtBIIlt B.;lm.", Chief Information Officer, iF you 

have any question!: or ne-ed additional information, 

~~ Kathleen Sebelius 

Enclosun:: Attt>clunent· Responses to Recommendations in GIG Draft Ml'lOOI2Ildum Repon 

OIG·12·)4.lJ) 

271 P age 
117 


Insert offset folio 72 here 87176.072

Appendix D, continued 

Anacl!lIIeII!: Rap''',"' tG RetOltlmelld.Iio •• lD Ole br*il M .... oraodlllll Report OIC-ll· 14-01 

The U.S. Department of Health and Hum .. Services (HHS) is in =ipt of the Office or 

InspectOr Gmctal's (010) draft repel" e.tiIled 'Rt:Vi~ oflhe Fc)tx!(md Drug A.dministration·, 

Computer ManUaring oj Cerloin Employees in its Cf!nler for an'leu and Radiological Health. 

OIG 12-14-01." Our coneUlTence wim.he recommendations in this repel" wll not be construed 

as a waiver by HHS of any privileges or ~emptions 1T0m disdosu:re that HHS moy IWCrt ill MY 

proceedings with respecllO any inro"",,1ion or records referenced in the dooum£llL 

OIG RECOMMENDATIONS: 

1. HHS !hould ensure that ;1S Opemtin£ Divisions (OpDh'S) draft and implement policie1 and 

related proceduml illlemal eontrols that provide reasonable assurance of eompllmK:e with 

laws and resulati on •• panicularl)' those governing Ctlmnt and prospective employee 

monitoring, At a minimum. the internal cootro!s concerni"1 electronic monitoring of 

emplo)'~. should addre.'iS: 

• the 'gene)', .ulhori.y 10 moni.or employee communications or """.s> omployce files; 

• protectiDl1 of the righ .. or employees and the .nco. of.,. employee's expectation or 

privacy while using agency IT resDlm:eS; 

• specific conditions for requesting access to employee- communications; 

• defined rol .. and mponsibiliti .. for initiating. reviewing, and appro"iog requests to 

access anployee communications and data; 

• retention of records that. document the initiation,. review, and approval of elct;:tronic 

monitoring. including opinions and recommend.tions of I~ counsel; and 

• maintaining advanced v.Tinen authorization or any computer monitorin~ conmlting 

with the OGC to ensure the proposed monitoring complies with all legal 

requirements. and documenting IDe basis for approving requests to """duct computer 

monitoring. 

HHS RESPONSE: CONCUR 

As no."" in the 010 Draft Memorandum Report OIG-12-I4-Ol, HHS issued lhel'oIli:yJor 

Aloniluring Empluyer Use of HHS IT Resources Memorandum on June- 26, 20ll. This 

memorandum instNded the OpDi,'S to develop and implement polioie1 and procedures thai 

inc<uporalbd the re~ui .. "".nt.! li.slcd abovt. A copy of !he memorandum was posted on tile 

MRS Whistlcblo~r webpage' and.he Off"", of (he Chief Infonn.otion Officer (OCIO) 

webpage'. On June 26, 2013, an email ""'" sent from tile HHS Ass!""",! Se=tary for 

Administration (ASA) through the HHS CIO to HHS OpDlv Heads, StafIDh' Head,. and 

£>:=Ii,,,, Ollicers, informing them of the memorandwn. The following day. the HHS Chief 

Information S."urity Officer (CISO) also noIified the GpOiv ClSOs of Ihis or .... policy 

I htlp:/~.hhs.pfhr iobr,'WbLnl~blO'wer.hun] 

1 http:/~n:tra.neth'ns BO"Jiticybersecurttyl}lohdes:index.Mnif 

1 

281 P age 
118 


Insert offset folio 73 here 87176.073

Appendix D, continued 

rrquirement During the CoOowing monlhs, the HHS C:ISO communicated with the OpDiv 

ClSOs al their IIlOfIlhly Council meeting 10 tnStII'e that prognss was uwIe in the 

developmenl of their new policics. 

HHS .~ that with the reoammendSlion that the OpOivs implemc .. policies IlJ1d 

procedures that provide reasonable llSSlItlIIlCe of compliance wilb l.,,~ and regulations, HHS 

also agree. that the OpDiv policies and procedures should address the elements highlighted 

by OlG, which are incorporated in the HHS memorandum of June 26, 2013, 

2. HHS should determine whether.1I other individual OpDiv po\idOl! meet our 

recommendations outlined above. 

HHS RESPONSE: CONCUR 

HHS Bgr1!e< that the HHS CIO should determine whether indi"idual CpDiv policies comply witb 

the ... onliaJ elemen!! "flhe HHS policy, which are in accordance "'illl the OlG 

recommendations outlined obo''O, The HHS elSo PoIic), T cam has initi.ted a process to tn>ek 

and review current Opo;v computer monitoring policies and procedures, HHS is a"tively 

working ,,;th OpDiv', as needed, to further refine their policiOl! and procedures. 

3, HHS also .bould regularly"';ew and, as necessary. update ilS DepW1menf-wide monitoring 

policies tD ensure thC)' are compatible with new and emerging tecbnologies and 

methodologies, l"faImoli,. technology is continually changins. and • static moni"'riDj: 

policy could fail to addness key implementation issue, as capabilities ~'olve. 

HHSRESPONSE: CONCUR 

HHS agrees that re@ularrel·'ewamlllpciatingofthecomputermoniloring polici .. and 

proceuun:s is essential. HHS elSO will f1Iwe l".t eac" 01'0;, periodically re"iews and 

updates its polki •• and procedures '0 ensure that ''',y re/lee. implem<:ntatioo experience and 

slllY in alignment with any rele"an! cbanges in te<:hnnlogy, loW and policy. 

291 P age 
119 


Insert offset folio 74 here 87176.074

LIMITLESS SURVEILLANCE AT THE FDA: 

PROTECTING THE RIGHTS OF FEDERAL WHISTLEBLOWERS 

JOINT STAFF REPORT 

Prepared for 

Representative DarrellE. Issa, Chairman 

Committee on Oversight and Government Reform 

United States House of Representatives 

& 

Senator Charles E. GrassIey, Ranking Member 

Committee on the Judiciary 

United States Senate 

113th Congress 

February 26, 2014 
120 


Insert offset folio 75 here 87176.075

I. Table of Contents 

I. Table of Contents .............................................................................................................. 2 

II. Table of Names .................................................................................................................. 3 

III. Executive Summary .......................................................................................................... 5 

IV. Findings .............................................................................................................................. 9 

V. Recommendations ........................................................................................................... 11 

VI. Background ..................................................................................................................... 12 

A. Confidential Documents are Posted Online ................................................................... 16 

VII. Authorization and Instructions for Monitoring ........................................................... 17 

VIII. Details of the Computer Monitoring ............................................................................. 25 

IX. Evolution of the Monitoring Program .......................................................................... 29 

B. Initiation of Monitoring .................................................................................................. 29 

C. Type of Monitoring ........................................................................................................ 31 

D. Development of Search Terms ....................................................................................... 32 

E. Interim Report ................................................................................................................ 33 

F. Expansion of People Monitored ..................................................................................... 35 

G. Changes to the FDA Employee Login DisclaimeL ....................................................... 35 

X. The Office of Inspector General Declines to Investigate ............................................. 39 

XI. Monitoring Was Not the Solution .................................................................................. 41 

XII. Managing By Investigation ............................................................................................ 42 

XIII. Post-Monitoring Changes ............................................................................................... 45 

XIV. Conclusion ....................................................................................................................... 47 

XV. Appendix I: Relevant Documents .................................................................................. 49 

Page 12 
121 


Insert offset folio 76 here 87176.076

II. Table of Names 

Food and Drug Administration 

Jeffrey Shuren 

Director, Center for Devices and Radiological Health 

Jeffrey Shuren is the Director for the Center for Devices and Radiological Health. He oversees 

the Center's operations and strategic direction. Dr. Shuren, along with several other FDA 

officials, ordered the initial computer monitoring and was a later proponent of its expansion. 

Ruth McKee 

Associate Director for Management and Executive Officer, Center for Devices and Radiological 

Health 

Ruth McKee is the Associate Director for Management and Executive Officer for the Center for 

Devices and Radiological Health. McKee reports directly to Dr. Shuren, who tasked her to lead 

the charge to determine what steps the FDA needed to take after it learned of the potential leak. 

McKee also ordered the monitoring and determined the initial monitoring search terms given to 

the Office of Information Management. 

Mary Pastel 

Deputy Director for Radiological Healthfor In Vitro Diagnostics, Center for Devices and 

Radiological Health 

Mary Pastel is the Deputy Director for Radiological Health for In Vitro Diagnostics with the 

Center for Devices and Radiological Health. Ruth McKee instructed Pastel to review encrypted 

flash drives containing surveillance of information on scientists' computers. 

Lori Davis 

Chief Information Officer 

Lori Davis was the Chief Information Officer fOT the FDA. Prior to being named the Chief 

Information Officer in January 2009, she served as the Deputy Chief Information Officer. She 

worked with Ruth McKee to set up computer monitoring of Dr. Robert Smith, and was asked to 

search through e-mails of FDA employees to determine the source of the information leak. 

Joe Albaugh 

Chief Information Security Officer 

Joe Albaugh was the Chief Information Security Officer for the FDA until March 20 I I. Lori 

Davis approached Albaugh to set up the computer monitoring for Dr. Robert Smith. 

Page 13 
122 


Insert offset folio 77 here 87176.077

Robert Smitb 

Medical Officer, Center for Devices and Radiological Health 

Robert Smith was a Medical Officer for the Center for Devices and Radiological Health. He was 

the first employee at the FDA to experience computer monitoring. Based on information 

gathered from Dr. Smith's computer, officials at the FDA later expanded this monitoring to 

include additional FDA scientists. His contract was not renewed after his contacts with 

Congress, the Office of Special Counsel, and his personal attorney were captured through the 

FDA's monitoring program. 

Les Weinstein 

Ombudsman, Center for Devices and Radiological Health 

Les Weinstein was the Ombudsman in the Office of the Center Director for the Center for 

Devices and Radiological Health. Weinstein asked the U.S. Department of Health and Human 

Services Office of Inspector General to investigate the disclosure of confidential information to 

the press. 

Chickasaw Nation Industries Information Technologv, LLC 

Christopher Newsom 

Contract Forensic Engineer, Incident Response Team 

Christopher Newsom is a Forensic Engineer with Chickasaw Nation Industries Information 

Technology. Newsom conducted the computer monitoring of FDA employees. After the FDA 

first set up this monitoring for Dr. Robert Smith, Newsom prepared an interim report to 

summarize the status of the monitoring. 

Joseph Hoofnagle 

Contract Investigator, Incident Response Team 

Joseph Hoofnagle is a Contract Investigator with Chickasaw Nation Industries Information 

Technology. Hoofnagle installed Spector 360 software on the monitored employees' computers. 

He worked with Newsom to conduct computer monitoring of FDA employees, and assisted 

Newsom in writing an interim report to summarize the status of the monitoring. 

Page 14 
123 


Insert offset folio 78 here 87176.078

communications, communications with Congress, and communications with the OSc. The FDA 

intercepted communications with congressional staffers and draft versions of whistle blower 

complaints complete with editing notes in the margins.8 The agency also took electronic 

snapshots of the computer desktops of the FDA employees and reviewed documents and files 

they saved on the hard drives of their government computers as well as personal thumb drives 

attached to their computers.9 FDA even reconstructed files that had been deleted from personal 

thumb drives prior to the device being used on an FDA computer. 

The contractors conducting the investigation prepared an interim report to update FD A 

officials. 1O This report, which was sent to Deputy Chief Information Officer Lori Davis on June 

3,2010, attempted-yet could not definitively support-a link to Dr. Smith with the release of 

51O(k) information to non-FDA employees. I I The report described information found on Dr. 

Smith's computer, including e-mails with journalists, Congress, and the Project on Government 

Oversight. 12 The report also stated that Dr. Smith "ghostwrote" reports for his subordinates and 

supplied internal CDRH documents to external sources. 13 After receiving this r~rt, the FDA 

expanded the computer monitoring to include three additional CDRH scientists I and declined to 

renew Dr. Smith's contractY 

FDA officials also contacted the Department of Health and Human Services (HHS) 

Office of Insrector General (OIG) on numerous occasions to request an investigation into the 

disclosures. I The OIG declined these requests, noting that contacts with the media and 

Congress were lawful, and no evidence of criminal conduct existed. 17 Despite the OIG's 

repeated refusal to investigate, the FDA continued to monitor Dr. Smith and his colleagues in the 

hope of finding enough evidence to convince the OIG to take action. 18 However, the FDA failed 

to take direct administrative or management action on its own to address the concerns directly. 

g Ellen Nakashima and Lisa Rein, FDA staffers sue agency over surveillance oj personal e-mail, WASH. POST, Jan. 

29,2012. 

9 Id. 

10 Memorandum from Joseph Hoofnagle, Incident Response & Forensic Lead & Chrislopher Newsom, Incident 

Response & Forensic Investigator, Interim Report oj Investigation - Robert C. Smith (June 3, 2010) [hereinafter 

Interim Report]. 

II Id. 

12 Id. 

IJ !d. 

14 McKee Tr. at 16. 

" Id. at 33. 

16 Letter from Jeffrey Shuren, Dir., Ctl. for Devices & Radiological Health, FDA, to Daniel R. Levinson, Inspector 

Gen., Dep't of Health & Human Servs. (Feb. 23, 2011) [hereinafter Shuren Letter, Feb. 23, 2011]; Letter from Les 

Weinstein, Ombudsman, Center for Devices & Radiological Health (CDRH), FDA, to Leslie W. Hollie, Supervisory 

Special Agent, Office of Investigations, Office ofinspector Gen., U.S. Dep't ofHe.lth & Human Servs. (HHS) 

(Mar. 23, 2009); E-mail from Les Weinslein, Ombudsman, CDRH, FDA, to Leslie W. Hollie, Supervisory Special 

Agent, Office ofInvestigations, Office of Inspector Gen., HHS (Oct. 23, 2009, 6:06 p.m.) [hereinafter Weinstein Email]. 

17 Letter from Scott A. Vantrease, Asst. Special Agent in Charge, Special Investigations Branch, Office of the 

Inspector Gen., HHS, to Mark McCormack, Special Agent in Charge, Office of Criminal Investigations, Office of 

Internal Affairs, FDA (May 18, 2010) [hereinafter Vantrease Letter]. 

!8 H. Comm. on Oversight & Gov't Reform, Transcribed Interview of Jeffrey Shuren, at 20-21 (Nov. 30, 2012) 

[hereinafter Shuren Tr.]. 

Pagel 6 
124 


Insert offset folio 79 here 87176.079

III. Executive Summary 

In January 2009, several national news outlets, including the New York Times, Associated 

Press, and the Wall Street Journal, reported that U.S. Food and Drug Administration (FDA) 

scientists had lodged complaints that the agency was approving unsafe and risky medical 

devices. l In March 20 I 0, the New York Times published a follow-up article reporting allegations 

by FDA scientists that the FDA ignored radiation warnings when approving certain medical 

devices.2 

Specifically, Dr. Robert Smith and four other employees of the FDA's Center for Devices 

and Radiological Health (CDRH) expressed concern about FDA-approved medical devices. Dr. 

Smith believed FDA managers ignored warnings from scientists regarding potential health 

hazards related to radiation exposure. Dr. Smith and the other CDRH employees also expressed 

their concerns to Congress and the 2009 White House Transition Team. 3 Additionally, Dr. 

Smith and his colleagues reported allegations of retaliation to Congress and the U.S. Office of 

Special Counsel (OSC).4 

Upon learning CDRH scientists publicly disclosed information about pending device 

applications, known as 51 O(k) applications, CDRH management initiated an electronic 

surveillance program of unprecedented scope. To determine which scientists were disclosing 

information and what specific information they were disclosing, the CDRH engaged two 

contractors working on the FDA's information technology security systems in April 2010 to 

begin monitoring Dr. Smith.s Approximately one month later, the monitoring expanded to 

another CDRH scientist.6 Using a software monitoring program called Spector 360, which took 

screenshots of FDA employees' computers every five seconds, 7 FDA officials were able to 

obtain sensitive information and protected communications, including attorney-client 

1 Gardiner Harris, In F.D.A. Files. Claims oj Rush to Approve Devices, N.Y. TUvIES, Jan. 13,2009, available at 

http://www.nytimes.com/2009/01/13/heaithlpolicy/!3fda.html?_r=0 (last visited Feb. 21, 2014) [hereinafter Rush to 

Approve Devices]; Ricardo Alonso-Zaldivar, FDA Scientists Complain to Obama oj 'Corruption,' Assoc. PRESS, 

Jan. 8, 2009 [hereinafter Scientists Complain to Obama]; Alicia Mundy & Jared Favole, FDA Scientists Ask Obama 

to Restmeture Drug Agency, WALL ST. J., Jan. 8, 2009, available at 

http://online.wsj.cominewslarticleslSB 1231425621 04564381 (last visited Feb. 21, 2014). 

'Gardiner Hanis, Scientists Say F.D.A. Ignored Radiation Warnings, N.Y. TIMES, Mar. 28, 2010, available at 

http://www.nytimes.com/2010103i29/healthlpolicyI29fda.html?pagewanted=all (last visited Feb. 21, 2014) 

lhereinafter F.DA. Ignored Radiation Warnings]. 

Scientists Complain to Ohama, supra note 1. 

4 Letter from Lindsey M. Williams, Dir. of Advocacy & Dev., Nat'l Whistleblowers Ctr., to Sen. Chuck Grassley, 

Ranking Member, Senate Judiciary Comm., Chairman Darrell Issa, H. Comm. on Oversight & Gov't Reform, & 

Special Counsel Carolyn Lerner, U.S. Office of Special Counsel (Sept. 17,2012) [hereinafter NWC Letter]; Letter 

from CDRH Scientists, Office of Device Evaluation, Food & Drug Admin. (FDA), to Rep. John Dingeli, U.S. 

House of Representatives (Oct. 14,2008) [hereinafter CDRH Letter]. 

5 H. Comm. on Oversight & Gov't Reform, Transcribed Interview of Ruth McKee, at 7-9 (Nov. 13,2012) 

[hereinafter McKee Tr.]. 

See Letter from Jeanne Ireland, Ass! Comm'r for Legis., FDA, to Hon. Darrell E. Issa, Chairman, H. Comm. on 

Oversight and GOV'! Reform (July 13, 2012) [hereinafter Ireland Letter]. 

7 H. Comm. on Oversight & Gov't Reform, Transcribed Interview of Christopher Newsom, at 10-11 (Oct. 2, 2012) 

[hereinafter Newsom Tr.]. 

Page 15 
125 


Insert offset folio 80 here 87176.080

FDA officials eventually forwarded information gathered from the computer monitoring 

program to the OIG. 19 The OIG contacted the Criminal Division of the Department of Justice to 

determine whether the evidence collected by the FDA against Dr. Smith and his colleagues 

supported a criminal referral.2o In November 2010, by letter, the Criminal Division formally 

declined to take up the matter.21 

FDA's overly-invasive monitoring program came to light in January 2012, when Dr. 

Smith and several of his colleagues filed a lawsuit in U.S. District Court in Washington, D.C. 

The suit alleged that information gathered during the monitoring was used to harass or dismiss at 

least six current and former FDA employees. House Committee on Oversight and Government 

Reform Chairman Darrell Issa and Senate Cornmittee on the Judiciary Ranking Member Charles 

Grassley (the Committees) subsequently launched ajoint investigation into the monitoring 

program. 

In May 2012, documents associated with the monitoring were posted on a public internet 

site. Included in these materials were confidential and proprietary FDA documents, as well as 

confidential communications between FDA employees and Congress, the OSC, and personal 

attorneys.22 

Witnesses who contacted the Committees voiced concerns about the intrusive nature of 

the surveillance, and the irresponsibility in posting the fruits of the surveillance on the Internet 

for anyone to see. They believed that the FDA conducted surveillance for the sole purpose of 

retaliating against the scientists for raising concerns about the medical device review process. 

The Committees conducted seven transcribed interviews with current and former FDA 

employees and contractors and reviewed approximately 70,000 documents. The pace of the 

Committees' investigation was slowed by FDA's unwillingness to cooperate. The FDA 

repeatedly cited the ongoing litigation with Dr. Smith and his colleagues as an excuse to 

withhold documents and information. 

Documents and information obtained by the Committees show the FDA conducted this 

monitoring program without regard for employees' rights to communicate with Congress, the 

OSC, or their personal attorneys. The Committees' investigation also found that data collected 

could be used to justify adverse personnel actions against agency whistleblowers. Absent a 

lawful purpose, an agency should not conduct such invasive monitoring of employees' computer 

activity. The FDA failed not only to manage the monitoring program responsibly, but also to 

consider any potential legal limits on its authority to conduct surveillance of its employees .. The 

Committees' investigation has shown that agencies need clearer policies addressing appropriate 

monitoring practices to ensure that agency officials do not order or conduct surveillance beyond 

their legal authority or in order to retaliate against whistleblowers, especially in such a way that 

19 Letter from Jeffrey Shuren, Dir., Ctr. for Devices & Radiological Health, FDA, to Hon. Daniel Levinson, 

Inspector Gen., Dep't of Health & Human Servs. (June 28, 2010) [hereinafter Shuren Letter, June 28, 2010). 

20 Shureo Tr. at 67-68. 

21 Letter from Jack Smith, Chief, Public Integrity Section, Dep't of Justice, to David Mehring, Special Ageo!, Office 

of the Inspector Gen., Dep'! of Health & Human Servs. (Nov. 3, 2010) [hereinafter DOJ Letter]. 22 ld. 

Page 17 
126 


Insert offset folio 81 here 87176.081

chills whistleblower communications with Congress, the OSC, and Inspectors General. 23 

Congress has a strong interest in keeping such lines of communication open, primarily as a 

deterrent to waste, fraud, and abuse in Executive Branch departments and agencies. 

Whistleblower disclosures are protected by law, even if they are ultimately 

unsubstantiated, so long as the disclosure was made in good faith. Accordingly, the analysis of 

the issues examined in this report is not dependent on the merits of the underlying claims that 

whistleblowers made about the safety of certain medical devices. Thus. this report does not 

examine the merits of those underlying claims and takes no position on whether the devices in 

question posed a risk to public health. 

13 The Whistleblower Protection Act provides protections for whistleblowers against personnel actions taken 

because of a protected disclosure made by a covered employee. The Act provides that "any disclosure of 

information" made by a covered employee who '"reasonably believes" evidences '"a violation of any law, rule, or 

regulation" or evidences "gross mismanagement, a gross waste of funds, an abuse of authority, or a substantial and 

specific danger to public health or safely" so long as the disclosure is not prohibited by law nor required to be kept 

secret by Executive Order. See 5 U.s.C. § 2302(b)(8)(A); Congo Research Serv., Whistleblower Protection Act: An 

Overview. at 3 (Mar. 12,2007), available at http://www.fas.org/sgp/crs/natsecIRL33918.pdf(last visited Feb. 21, 

2014). 

Page 18 
127 


Insert offset folio 82 here 87176.082

IV. Findings 

~ CDRH scientists and doctors raised concerns to Congress, the OSC, and President 

Obama's transition team about pressure from management to approve medical devices 

they believed were unsafe. 

~ Despite the extensive scope of the monitoring, there was insufficient written 

authorization, no monitoring policy in place, and there was no legal guidance given to the 

contractors who conducted the monitoring. The lack of any legal guidance to limit the 

monitoring program resulted in FDA capturing protected communications. 

~ Although FDA claimed to be investigating a specific leak of 51 O(k) information, the 

computer monitoring did not include a retrospective inquiry into any of the scientists' 

network activities. When interviewed, FDA managers and IT professionals failed to 

explain clearly how the rationale offered to justify the monitoring (investigating a past 

leak) was consistent with the method used (monitoring current activity). The goal of 

monitoring was allegedly to identify who leaked confidential information. Instead of 

looking back at previous communications using available tools in their possession, 

however, the FDA chose real-time monitoring of current and future communications. 

Because FDA managers lacked formal investigative training and did not understand the 

legal concerns related to employee monitoring, they believed all employee 

communications that occurred on government computers were "fair game." 

~ Because FDA managers lacked formal investigative training and legal guidance, they did 

not understand the legal limits ofperrnissible employee monitoring. As a result, the 

scope was limited only by the FDA's technical capabilities. For example, those 

conducting the monitoring said they believed all employee activity having any remote 

nexus to government computers was "fair game"-even to the point of forensically 

recovering deleted files from personal storage devices when plugged into FDA 

computers. Moreover, the monitoring software collected all keystrokes on the computers, 

including the passwords for personal email accounts and online banking applications, 

even though de minimis personal use is pennitted. 

~ The monitoring program began when a law firm representing a manufacturer alleged 

unlawful disclosures were made to the press regarding a device that was under FDA 

review. Ruth McKee fust ordered monitoring on Dr. Smith's computer because Dr. 

Smith was believed to be the source of the leak. Later, monitoring expanded to include 

four additional CDRH scientists. Officials used Spector 360, a software package that 

recorded user activity with powerful capture and analysis functions, including real-time 

surveillance and keystroke logging. 

~ The FDA's surveillance was not lawful, to the extent that it monitored communications 

with Congress and the Office of Special Counsel. Federal law protects disclosures to 

OSC and Congress. 

Page 19 
128 


Insert offset folio 83 here 87176.083

~ HHS OIG denied FDA's repeated requests for an OIG investigation into the allegedly 

wrongful disclosures. OIG found no evidence of criminal conduct on the part of any 

employee. Still, officials continued to contact OIG to request an investigation. OIG 

again denied the request, and the Justice Department declined to take action. 

~ The monitoring program ultimately failed to identify who leaked information to the New 

York Times or the Wall Street Journal, despite capturing approximately 80,000 

documents and inadvertently publishing those documents on the Internet. 

~ Despite known complaints about performance issues regarding Dr. Robert Smith, FDA 

management and leadership chose to address Dr. Smith's employment status through 

repeated requests for criminal investigation, rather than by simply taking administrative 

or managerial actions directly within its own control and authority. 

~ Over a year after receiving directives from OMB, OSC, and the FDA Commissioner, the 

FDA produced interim guidelines on monitoring procedures in September 2013. The 

FDA's interim policies require written authorization prior to initiating employee 

monitoring. Only the Commissioner, Deputy Commissioner, or the Chief Operating 

Officer can authorize surveiltance of employees. The FDA has not yet implemented 

permanent policies to govern employee monitoring. 

~ The FDA's interim policies do not provide safeguards to protect whistleblowers from 

retaliation. Under these policies, protected communications are still subject to 

monitoring and may be viewed by agency officials. 

Page 110 
129 


Insert offset folio 84 here 87176.084

V. Recommendations 

Based on its investigation, the Committees identified several recommendations that, if 

implemented, would assist other Executive Branch departments and agencies in avoiding a 

repeat of the mistakes made by the FDA: 

~ The FDA should promptly develop permanent written procedures to govern employee 

monitoring and safeguard protected communications through substantive restrictions on 

the scope of surveillance that can be authorized on employees. Procedural safeguards 

merely requiring approval of surveillance by senior officials are not enough. 

~ The FDA should ensure that programs used to monitor employees do not collect personal 

information such as bank account numbers or passwords for personal e-mail accounts. 

~ The FDA's interim guidance does not include provisions to protect employees against 

retaliation if communications with Congress, the OSC, or personal attorneys are captured 

through monitoring. The FDA should establish procedures that ensure protected 

whistleblower communications cannot be used for retaliation. 

~ The FDA should develop clear guidance for identifying and filtering protected 

communications so that protected communications are not retained or shared for any 

reason. Any employee or contractor involved in the monitoring process, including the 

Review Committee established by the September 26, 2013 Staff Manual Guide, should be 

trained on these procedures. 

~ Employees should be notified that their communications with Congress and the OSC are 

protected by law. 

~ The OSC should modifY its June 20,2012 memorandum to all federal agencies regarding 

monitoring policies to include communications with Congress.24 

~ The GAO should conduct a study of all Executive Branch departments and agencies to 

determine whether the guidelines set forth for computer monitoring in the OSC's June 20, 

2012 memorandum have been implemented. 

24 Memorandum from Carolyn Lerner, Special Counsel, U.S. Office of Special Counsel to Executive Branch 

Departments and Agencies, Agency Monitoring Policies & Confidential Whist/eblower Disclosures to the Office of 

Special Counsel & to inspectors General (June 20, 2012) [hereinafter Lerner Memo]. 

Page III 
130 


Insert offset folio 85 here 87176.085

VI. Background 

The Food and Drug Administration (FDA), a component of the U.S. DeEartment of 

Health and Human Services (HHS), is responsible for promoting public health. 5 Specifically, 

the FDA is charged with regulating and supervising a variety of consumer health products.26 

These products include dictary supplements, prescription and over-the-counter drugs, vaccines, 

biopharmaceuticals, and medical devices.27 The FDA has broad powers for determining the 

safety, risks, marketing, advertising, and labeling of these products. 28 

The Center for Devices and Radiological Health (CDRH) is a division within the FDA.29 

The CDRH is also tasked with protecting and promoting public health. 30 The mission of the 

CDRH is to ensure that patients and providers of health services have access to safe medical 

dcvices, such as hip implants, hcart valves, and mammography machines. J1 The CDRH tests and 

examines potential medical devices, and makes recommendations to the FDA regarding the 

approval and widespread usage of radiation-emitting products.J2 The CDRH seeks to assure 

consumer confidencc in devices manufactured in thc United States.]] Scientists and doctors who 

work for the CDRH are directly involved in product testing, making recommendations to the 

FDA, and assessing whether the medical devices are safe for public use.J4 

In 2007, CDRH scientists tirst started raising concerns about the FDA's marketing of 

unsafe mcdical devices used to detect cancers of the brcast and colon. J5 These scientists also 

complained of a toxic work environment in which thcy feared retaliation by their managers for 

writing unsupportive reviews of medical devices they believed to be unsafe. J6 The scientists 

argued that the CDRH's process for approving medical devices for public use was not 

sufficiently rigorous and that the FDA's premature release of products without sufficient testing 

posed health risks to the public.]7 In an attempt to implement more stringent guidelines for this 

"fDA, About FDA, http://www.fda.gov/AboutFDNdefault.htm (last visited Feb. 21, 2014). 

26 FDA, About FDA: What Does FDA Regulate?, http://www.fda.gov/aboutfdaitransparency/basics/ucmI94879.htm 

(last visited Feb. 21, 2014). 

27 !d. 

28 FDA, About FDA: What Does FDA Do>, http://www.fda.gov/AboutFDNTransparency/Basics/ucm194877.htm 

(last visited Feb. 21,2014). 

29 FDA, Training & Conlinuing Education: CDRH Learn, http://www.fda.gov!Training/CDRHLearnidefauit.htm 

(last visited Feb. 21, 2014). JO lei. 

" !d . . ll [d. 

11 FDA, About FDA: CDRH Mission, Vision & Shared Values, 

http://www.fda.gov/AboutFDNCentersOftices/OfficeofMedicaIProductsandTobacco/CDRH/ucm300639.htm (last 

visited Feb. 21, 2014). 34 [d. 

35 CDRH Letter, supra note 4. J(j Jd. 

17 [d. 

Page 112 
131 


Insert offset folio 86 here 87176.086

testing process, the CDRH scientists filed complaints with the OSC/8 the HHS DIG, Congress,39 

and even the transition team for then-President-elect Obama.40 

On January 13,2009, the New York Times published an article stating that "front-line 

agency scientists believed that FDA managers [had] become too lenient with the industry.,,41 

The article further stated that "an agency supervisor improperly forced them to alter reviews of 

[aJ breast imaging device.,,42 The article, citing internal FDA documents, referred specifically to 

the ongoing review ofthe iCAD SecondLook Digital Computer-Aided Detection System for 

Mammography device.43 The article further stated: 

One extensive memorandum argued that FDA managers had encouraged 

agency reviewers to use the abbreviated process even to approve devices 

that are so complex or novel that extensive clinical trials should be 

required. An internal review said the risks of the iCAD device included 

missed cancers, "unnecessary biopsy or even surgery (by placing false 

positive marks) and unnecessary additional radiation.,,44 

Later that day, Ken Ferry, the Chief Executive Officer ofiCAD, wrote a letter to the 

CDRH Ombudsman, Les Weinstein, urging him to look into the breach of confidentiality 

concerning the pre-market approval ofiCAD's breast-imaging device.4s Ferry reminded the 

Ombudsman that the FDA cannot release confidential information submitted to the FDA as part 

of a premarket approval application, including any supplements to the application, without 

38 The U.S. Office of Special Counsel is tbe fIrst step in the whistleblower review process. OSC is an independent 

federal investigative and prosecutorial agency. Its primary goal is to safeguard all protected employees from 

prohibited personnel practices, especially reprisal for whistleblowers. U.S. Office of Special Counsel, Introduction 

to OSC, http://www.osc.gov/lntro.htm(lastvisitedFeb. 21, 2014); NWC Letter, supra note 4; CDRH Letter, supra 

note 4. 

39 Employees who provide information to Congress are protected by the Whistleblower Protection Act (WP A). See 

5 U.S.c. § 7211. The WP A provides statutory protections for federal employees wbo make disclosures reporting 

illegal or improper activities, including employees who provide information to Congress. See id.; Eric A. Fischer, 

Cong. Research Serv., Federal Laws Relating to Cybersecurity: Overview and Discussion of Proposed Revisions, at 

16 (June 20, 2013) ("A reasonable argument could be made that monitoring the content of every employee 

communication is excessively intrusive."). Additionally, the Fourth Amendment protects individuals from 

unreasonable searches and seizures. U.S. CONST. Amend. IV. states, in pertinent part: "The right of the people to be 

secure in their persons, houses, papers, and effects, against unreasonable searches and seizures, shall not be 

violated." The Supreme Court recognizes individuals do not lose Fourth Amendment rights merely because they 

work for the government as opposed to a private employer. See City o/Ontario v. Quon, 560 U.S. 746; 130 S. Ct. 

2619 (2010). 

40 CDRH Letter, supra note 4; NWC Letter, supra note Error! Bookmark not defined.4; Telephone Call with 

Leslie W. Hollie, Supervisory Special Agent, Office ofInvestigations, Office ofInspector Gen., HHS (May 26, 

2009); Letter from CDRH Scientists, CDRH, FDA, to John D. Podesta, Presidential Transition Team (Jan. 7, 2009). 

41 Rush to Approve Devices, supra note 1. 

42 [d. 

4J !d. 

44 !d. 

"Letter from Ken Ferry, Pres. & CbiefExec. Officer, iCAD, to Les Weinstein, Ombudsman, CDRH, FDA (Jan. 13, 

2009) [hereinafter Ferry Letter]. 

Page 113 
132 


Insert offset folio 87 here 87176.087

explicit pennission.46 Rather than taking any steps to deal with the issue directly, CDRH 

managers forwarded the complaint to the OIG.47 

Ferry also noted that a New York Times reporter had called him four days before the 

article was pub1ished.48 The reporter had questions concerning an internal dispute at the CDRH, 

which was reviewing iCAD's application49 According to Ferry's letter, the reporter told Ferry 

that the proprietary documents "were sent [to the reporter] by Scientific Officers of the FDA.,,50 

On October I, 2009, Dr. Jeffrey Shuren, Director of the CDRH, talked to a reporter about 

a different medical device.51 Dr. Shuren learned that the reporter was also in possession of 

similar documents related to the pre-market medical device process. 52 To better understand who 

may have provided the infonnation, the CDRH asked its IT Department to compile a list of those 

scientists that accessed a certain working memo that would either approve or reject the device 

under review.53 

46 Id. 

47 Memorandum from Les Weinstein, Ombudsman, CDRH. FDA, Documents Related to the Radiological Devices 

Branch (Mar. 23, 2009). 

48 Ferry Letter, supra note 45. 

49 Id. 

50 It!. 

51 Weinstein E-mail, supra note 16. 

5' Id. 

5.1 Id. 

Page 114 
133 


Insert offset folio 88 here 87176.088

Shuren, Jeff 

From: 

Sgnt: 

To: 

Ce: 

Subject; Un.u!ho~ Disci"""",. 

Attachments: DO(:ul!lentp(ll; K1J!>S1!/1 audlllds; N'tT Jon 13 2OO9.pdf: 1<:071671 .- clin"" cs!'!llolOll)' reI"'" LEWIS Ma'th 26 20011.000; Dooumentpdt Doo"meotpdf 

CDRH officials fOlwarded four names resulting from this search to the Office of Inspector 

General. 54 Dr. Shuren testified that he "did not recall" if the OIG was going to look into the 

matter.55 

On March 28, 2010, the New York Times published a second article regarding the FDA's 

approval process for medical devices. 56 This second article, published fourteen months after the 

January 2009 article, cited information concerning a GE Healthcare device under FDA review: 

Scores of internal agency documents made available to The New Yark 

Times show that agency managers sougbt to approve an application by 

General Electric to allow tbe use of CT scans for colon cancer 

screenings over tbe repeated objections of agenc~ scientists, who 

wanted the application rejected. It is still under review.5 

On April 16, 2010, GE Healthcare's outside legal counsel wrote to Dr. Shuren to request 

an internal investigation and a meeting to discuss a possible breach of confidentiality regarding 

GE Healthcare's device under FDA review. 58 The letter stated: 

" Id. 

GE Healthcare is extremely concerned about this violation of 

confidentiality and respectfully requests that you conduct an internal 

investigation into how this information was leaked to the press.59 

55 Shuren Tr. at 14. 

56 F.D.A.lgnored Radiation Warnings, supra note 2. 

57 Id. (emphasis added). 

58 Letter from Edward M. Basile, Partner, King & Spalding LLP, to Jeffrey E. Shuren, Dir., CDRH, FDA (Apr. 16, 

2010) [hereinafter Basile Letter]. 

Page 115 
134 


Insert offset folio 89 here 87176.089

In light of the two New York Times articles describing internal turmoil at the FDA, as well as 

complaints filed by both iCAD and GE Healthcare, the FDA began real-time monitoring of 

CDRH employees' computer activity. 

A. Confidential Documents are Posted Online 

In May 2012, an HHS contractor, Quality Associates, Inc (QAI), posted approximately 

80,000 pages of documents associated with the FDA employee monitoring on a public internet 

site. 6o Included in these materials were confidential and proprietary FDA documents, as well as 

confidential communications between FDA employees and Congress, OSC, and personal 

attorneys.61 FDA had asked the HHS Program Support Center (PSC) to use a contractor to 

produce and print PDF-versions of the surveillance records, and PSC tasked contractor QAI with 

the project.62 

A fter the documents left FDA, they followed a chain of custody that included several 

parties before they got to QAI. 6J According to HHS, QAI received the job from PSC on May 2, 

2012, and completed it on May 9, 2012.64 The files were uploaded to the site at the direction of 

PSC, on May 3, 2012. 65 They were removed from the site and archived six days later on May 9, 

2012.66 During this time, confidential and proprietary information was publically available and 

easily searchable. 67 

QAI officials claimed they were simply following their client's instructions68 In fact, 

FDA did not mark the documents as confidential, and there is no written record reflecting the 

sensitive nature of the documents.69 Furthcnnore, the purchase order, which was submitted to 

the Government Printin~ Office (GPO) only after the work was completed, failed to mention any 

sensitive c1assification. 7 When prompted on the purchasing order form, PSC checked the "no" 

boxes, indicating there was I) no personally identifiable information (PII), 2) no classified 

information, and 3) no sensitive but unclassified (SBU) information contained in the files. 71 

HHS identified the misclassification as a "clerical error at the PSC."72 

59 !d. 

60 Letter rrom lim R. Esquca. Assistant See'y for Legis., U.S. Dcp't of Health & Human Servs .. to Han. Charles E. 

Grassley, Ranking Member, S. Comm. on Judiciary (March 13,2013) [hereinafter Esquea Letter]. 

"' NWC Letter, supra note 4 . 

., Esquea Letter, supra note 60. 

03 Id. 

64 !d. 

65 Letter from Paul Swidersky, President, CEO, Quality Associates Inc., to Hon. Charles E. Grassley, Ranking 

Member, S. Comm. on Judiciary (July 17,2012). 66 !d. 

67 ld. 

68 Id. 

o\) See iel.; see also Esquea Letter, supra note 60. 

70 DHHS, FDA, GPO Simplified Purchase Agreement Work Order Form 4044 (May 23, 2012). 

"!d. 

T!. Esquea Letter, supra note 60. 

Page 116 
135 


Insert offset folio 90 here 87176.090

FDA did not take responsibility for the mishandling of the documents. 73 Rather, FDA 

shifted the responsibility to HHS, which, in tum, attempted to blame QAI: 

The PSC advised QAI that the documents were sensitive and that access to 

them should be limited. The PSC further requested that QAI delete all 

files on its computers after completing the job, and shred any printed 

documents in its possession. Regrettably, despite these instructions, QArs 

unauthorized use of an unsecure website caused QAI to lose control of the 

confidential material. 74 

FDA and HHS refused to take responsibility for the mishandling, even though they failed to 

identify the documents as sensitive or confidential in the paperwork provided to the contractor. 

This raises doubt about the veracity of the claim that the agencies had notified QAI of the 

sensitive nature of the documents. The incorrect purchase order that was submitted to GPO was 

dubbed by HHS as "erroneous" and was prepared after the project's completion.75 HHS also 

pointed to shortcomings in the GPO form itself: 

Unfortunately, the GPO's required Work Order forms do not reflect the 

variety of confidential material frequently handled by Executive Branch 

agencies, including material as to which Congress has imposed specific 

statutory protections. The forms provide only three document category 

options[.J . .. Other options for identifying protected information, such as 

confidential commercial information, are not available on GPO's Work 

Order form. 76 

However, the documents clearly contained personally identifiable information, and yet the form 

incorrectly indicated that there was no such information. 

VII. Authorization and Instructions for Monitoring 

"ld. 

"]d. 

"]d. 

76 1d. 

Page 117 
136 


Insert offset folio 91 here 87176.091

On April 16,2010, Ruth McKee, Executive Officer for the CDRH, approached Dr. 

Jeffrey Shuren, Director of the CDRH, conccrning the April 2010 letter and asking him what to 

do. Dr. Shuren testified: 

Q. And so how did you begin to look into the disclosure that appeared 

in the New York Times? 

A. Well, I asked Ruth McKee, who is my Executive Officer, were there 

ways in which we could identifY the source of the leak, a little bit 

akin to what happencd in October, is there something you can sort 

of look for to then support for doing an investigation. One of the 

challenges we also faccd at the center is that normally in the past, 

the Office of Internal Affairs would take it, they would look into it 

over concerns, at least to my understanding, over interventions from 

Scnator Grassley over concerns about the Office of Internal Affairs 

invcstigating whistleblowers. The Commissioner had previously 

instructed thc Office of Internal Affairs not to conduct 

investigations, I think particularly if thcre was any possible criminal 

conduct as [it] relates to cmployees who had allegations against the 

agency. So-and a copy was also given of the complaint to the 

Office ofInternal Affairs. Thcy subsequently sent that to the OIG as 

wcl1. 77 

Dr. Shuren testified that in his conversation with McKee, he learned that FDA Chief 

Information Officer Lori Davis had authorized the monitoring: 

A. [Ruth] wound up talking to the Chief Information Officer and then 

told me afterwards that the Chief Information Officer had 

authorized computer monitoring, thought it was serious and this 

was the step that should be taken. 

Q. Was computer monitoring something that you had suggested to 

Ruth? 

A. No. 

Shuren Tr. at 19-20 (emphasis added). 

Page 118 
137 


Insert offset folio 92 here 87176.092

Q. You asked her to explore the options, and she came back with 

computer monitoring? 

A. Not even from the option. She spoke to Lori, and Lori 

authorized the monitoring. I will say that knowing of it, 

though, I didn't object to the monitoring. I am not the exrert for 

what are the circumstances to monitor a person's computer. 7 

Lori Davis, however, remembered the authorization of computer monitoring differently. 

She testified: 

A. Well, we got the request from the center. I mean, asking on behalf 

ofthe center, the center asked, "Can you do that?" 

Q. You mean Ruth runs the center? 

A. Yes. Ruth said, "Can you?" And we said, "Yes, we can." So 

in my mind that was the authorization to proceed based [on) some 

conversation that obviously CDRH, whether or not that was Ruth 

or anybody else, I don't know, had with Joe Albaugh and either, 

you know, his staff at this point. I am assuming it's either Chris or 

Joe. Those conversations happened and they agreed on a course of 

action. 

Q. There was no written authorization? 

A. Not that I'm aware of no.79 

Davis further testified that she told McKee that she would forward the request for 

monitoring to FDA Chief Information Security Officer Joe Albaugh, who would be able to set up 

the monitoring.8o For his part, Albaugh testified that he was only "a pass through between the 

technical team that was within [his) division and the request of the CIa and the Executive 

Officer.,,8! 

The CDRH engaged two primary investigators, Joseph Hoofuagle and Christopher 

Newsom, who were in place to work on the FDA's information technology security systems 

contract with Chickasaw Nation Industries Information Technology (CNIIT), to ultimately lead 

the computer monitoring effort. 82 

1B !d. at 21 (emphasis added). 

19 H. Comm. on Oversight & Gov't Reform, Transcribed Interview of Lori Davis, at 17 (Jan. 8, 2013) (emphasis 

added) [hereinafter Davis Tr.]. 

80 !d. at 9-10. 

81 H. Comrn. on Oversight & Gov't Reform, Transcribed Interview of Joe Albaugh, at 9 (Mar. 7,20\3) (emphasis 

added) [hereinafter Albaugh T r.]. 

82 H. Comrn. on Oversight & Gov't Reform, Transcribed Interview of Joseph Hoofuagle, at 6-7 (Oct. 11,2012) 

[hereinafter Hoofuagle Tr.]; Newsom Tr. at 6-9. 

Page 119 
138 


Insert offset folio 93 here 87176.093

Hoofnagle, a Contract Investigator with CNIIT who managed the Incident Response 

Team for the FDA's network security systems, received few instructions as to the extcnt of 

monitoring CDRH officials soughtS

] Hoofnagle's only instructions were to find documents that 

contained certain kcy words, including the letter K followed by specific numbcrs; such 

documents, which reflect the FDA's naming convention for 51O(k) applications, were leaked to 

the press 84 As a result, he created an initial document that would govcrn thc invcstigation85 

Hoofuagle testified that he reccived no lcgal guidance whatsoever from the FDA: 

"Hoofnagle Tr. at 11-12. 

" !d. at 12. 

85 Joseph Hoofnagle, Chickasaw Nation Industries Infom1ation Technology, Spector Client: installed and Actil'e 

Since 4122110. [hereinafter Spector Clientj. 

Page 120 
139 


Insert offset folio 94 here 87176.094

Q. Over the course of [the monitoring], were you ever given any legal 

guidance about the limitations of surveillance or any legal 

considerations that would be relevant to using monitoring 

software? 

A. No. 

Q. At FDA, was there ever any guidance? 

A. The only guidance I ever received was from law enforcement. 

Q. Uhhuh. 

A. And it wasn't from a legal perspective. It was just from an 

authority perspective of, you know, hi, I need you to do this. 86 

In fact, CDRH leadership lacked sufficient training and background in conducting an 

internal investigation - particularly in monitoring computers. The contractors hired to conduct 

the computer monitoring received no legal guidance about the limitations of the monitoringsuch as carving out communications with Congress or preserving protected attorney-client 

communications.87 

After monitoring two employees' computers, contractors with CNIIT prepared an interim 

report to describe the status of the surveillance.88 In the report, CNIIT contractors explained that 

they initiated a review of Dr. Smith's computer to determine whether he contacted external 

sources regarding the FDA's approval process of certain medical devices. 89 

86 Hoofnagle Tr. at 25-26. 

87 See. e.g. Interim Report, supra note 10. 

ss !d. 

" Id. 

Page 121 
140 


Insert offset folio 95 here 87176.095

Lori P.vis, Chiof Infu,.,..rion 011'\<", 

J". Aloo.gb, ChI.f!niomation Serurity Offi"", -

Jon Hoofuagle, lncldent ll."P""M nnd Fo"""je LeOO; Christopher 

Incident Resp<)l'lSe lU'Id Forenik Inv~scigatot 

J""o3,2010 

Int"';'" Rep"",o! fuvtS"s<tiom -Rob." C, SMITH 

fot the 

to 

When asked about the interim report, Hoofnagle explained that the FDA officials who ordered 

the monitoring never voiced concerns that the infonnatlon being captured was too extensive. 90 

He testified: 

Q_ So the very last bullet on the first page, it says, "information 

indicating potential involvement of Congress Mcmber(s) serving as 

conduits to the press," At that point, did anybody raise a concern 

that information like that should not be gathered or should not be 

reported up to Ruth McKee? 

A_ No_ 

Q_ Did you ever hear that concern? 

A No_ 

<)0 Hoofnag!e Tr. at 36-37. 

Page 122 
141 


Insert offset folio 96 here 87176.096

Q. Did anyone from Ruth's office ever express to you any limitations 

or concerns about what was being collected? 

A. No. 

Q. Had you ever, in your experience, you know, with monitoring 

initiated by the inspector general's office, heard the concern that 

information about communications with Congress should not be 

collected or should not be communicated up the chain at FDA? 

A. No. 

Q. How about communications with the people under surveillance and 

their - between them and their personal attorneys? 

A. No. 

Q. Between them and the Office of Special Counsel? 

A. No. 

Q. In any of the surveillance, were limitations or concerns expressed 

about the scope of monitoring? 

A. No. 

Q. Nobody's ever come to you and said, we should maybe limit the 

scope of surveillance? 

A. No.9! 

Dr. Jeffrey Shuren, the highest-ranking FDA employee involved in the monitoring, was 

equally unaware that the monitoring had captured communications with Congress. 92 He 

testified: 

91Id. 

Q. Can you explain to us why you didn't take any steps to instruct 

Ruth McKee to do any kind of narrowing with regard to the scope 

of the monitoring - once you learned that Congressional 

communications were being captured? 

A. I mean, as I said before, it wasn't even on my radar screen. And I 

don't recall when I first 

Q. When it came up? 

92 Shuren Tr. at 123. 

Page 123 
142 


Insert offset folio 97 here 87176.097

A. I don't recall whcn it first came up. But. no, it just - it didn't - it 

just didn't dawn on me. Didn't dawn on me. 93 

The Committees found that there was no documentation or written authorization for 

monitoring employees' computers, and the FDA personnel interviewed were uncertain as to who 

authorized surveillance. 

The computer monitoring also did not include a retrospective inquiry into any of the 

scientists' network activities to understand who may have accessed the memoranda that were 

leaked to the press. The FDA managers and IT professionals interviewed failed to explain 

clearly how the rationalc offered to justify the monitoring was consistent with the method used. 

There appeared to be confusion about the distinction between retrospective identification of 

individuals who already accessed certain documentation that was featured in the New York Times 

articles and real-time monitoring going forward once the internal inquiry began. Lori Davis 

testified that "at that first meeting I would have said [the search for evidence ofleaks on FDA 

computers] was historical because ... in my mind it had already happened.,,94 

Dr. Shuren described his concerns about both past leaks and the potential for future 

leaks. 95 He testified: 

Q. Maybc it would be helpful for us if you clarified what exactly the 

purpose of the monitoring was. What was the question that you 

were trying to answcr through the monitoring? 

A. Well, again, what 1...1 didn't ask for monitoring. I didn't object to 

monitoring, but 1 didn't ask for monitoring. I had asked can we 

identify, are there ways to identify who was the source ofthe New 

York Times and the GE CT colonography dcvice ... 

Q. So you wanted to try to figure out retrospectively who had made 

that leak as opposcd to going forward if there were futurc leaks, 

can we kind of catch them as they occur? 

A. Well, we all had concerns about future leaks. Once they were 

doing monitoring there was interest, are there othcr leaks that are 

occurring, but when 1 asked Ruth to look into what ways were 

available options, it was about finding the source of that. 96 

Ruth McKee, who acted as a liaison between Dr. Shuren and CNIIT, testified that "[her] 

understanding was there was not a technological way to do a past look" based on what she was 

told by the FDA Chiefinformation Officer, Lori Davis, and the FDA Chiefinformation Security 

93 Id. 

94 Davis Tr. at 8-11. 

95 Shuren Tr. at 32-33. 

% Id. 

Page 124 
143 


Insert offset folio 98 here 87176.098

Officer, Joe Albaugh.~7 Furthermore, McKee stated that it was her understanding that CNIIT 

"would be doing real time monitoring of Dr. Smith's e-mail account.,,98 

Contrary to McKee's testimony, however, Christopher Newsom, CNIIT investigator, 

testified that although his firm had the capability to look back at e-mails that may have been sent 

or received in the past through FDA servers, CNIIT did not conduct such a review.99 Newsom 

testified: 

Q. Is there a way to look, other than looking on the hard drive, to look 

for e-mails ... in the past through FDA servers? 

A. Yes. 

Q. Was that done with regard to Dr. Smith or Dr. Nicholas? 

A. Not to my knowledge. 

Q. Do you know why not? 

A. I don't. 100 

Not only was there insufficient written guidance on how to monitor an employee in compliance 

with applicable laws, it seems there was also inadequate knowledge or guidance on how to 

conduct the monitoring in order to accomplish the goals of initiating the monitoring in the first 

place. As Dr. Shuren testified, the goal was not only to capture future leaks, but to find the past 

leaks linked to the New York Times. 101 Yet, no one conducted an inquiry into past 

communications. 

VIII. Details of the Computer Monitoring 

91 McKee Tr. at 58-60. 

98 Id .. 

99 Newsom Tr. at 34-35. 

,00 Id. 

10' Shuren Tr. at 19-20. 

Page 125 
144 


Insert offset folio 99 here 87176.099

On April 22, 2010, the FDA began monitoring the FDA-issued computer and FDA-issued 

laptop of Dr. Robert Smith. 102 On May 24,2010, the FDA began monitoring the FDA-issued 

computer ofCDRH scientist Paul Hardy.'03 On June 30, 2010, the FDA began monitoring the 

FDA-issued computers of three additional CDRH scientists. 104 

To monitor these computers, the FDA used a computer monitoring software program 

called Spector 360, which allowed the FDA to record all computer activity in real-time. Spector 

360 also has the ability to log keystrokes, capture passwords and confidential information, and 

record activity remotely in the event that a laptop being monitored is not directly connected to 

the FDA network. 105 

As part of the monitoring, the FDA took screen shots of each of the computers every five 

seconds and logged all keystrokcs on the keyboards. 106 CDRH officials reviewed thc 

information gathered through the monitoring using encrypted flash drivCS. 107 Information on the 

encryptcd flash drives included private, non-official communications, including Gmail and 

Yahoo! Mail messages. lOB Transmitted information also contained communications with 

Congrcss, confidential attorney-client communications, and confidential complaints filed with 

the OIG and OSC. '09 

Spector 360 user activity monitoring software is readily available for both home and 

business usc. The software "monitors, captures, and analyzes ALL user and user group activity 

including: e-mail sent and received, ehat/IM/BBM, websites visited, applications/programs 

accessed, web searches, phone calls, file transfers, and data printed or saved to removal 

deviees."llo FDA employees received no notice that this specialized software with such 

extensive monitoring capability was being installed on their computers. I I I Moreover, the FDA 

did not routinely subject all of its cmployees to such intense scrutiny.'12 CNIIT investigator 

Joseph Hoofnagle, installed the software, and his colleague Christopher Newsom collected the 

data. '13 The Spector 360 software docs not distinguish or filter out any information, such as 

protected communications with Congress, communications covered by attorney-client privilege, 

or communications that might otherwise be protected by law, sueh as contidential submissions to 

the Office of Special Counscl. Moreover, those collecting and forwarding the information did 

not have any training or instruction in minimizing the collection of pri vileged 

communications. I 14 

102 Spector Client, supra note 85; Ireland Letter, supra note 6. 

!03 See Ireland Letter, supra note 6. 104 fd. 

105 Newsom Tr. at 10-11. 106 Id. 

107 McKee Tr. at 13. 

103 See e.g., Newsom Tr. at 54-55. 

109 McKee Tr. at 76. 

110 SpectorSoft Spector 360, http://www.spcctor360.eom (last visited Feb. 21,2014). 

III McKee Tr. at 73. 

112 Id. at 83. 

113 Newsom Tr. at 8-10. 

114 See e.g., Hoofnagle Tr. at 27-28. 

Page 126 
145 


Insert offset folio 100 here 87176.100

The CNIIT contractors collected this infonnation and summarized it for FDA managers' 

later review. lI5 

Anci\lary Actor!> 

10. Ned Feder - Staff Scientist I Writer- POGO (Project On Government 

Oversight) 

1100 G Street, NW. Sui~ Washington, D.C 

11. Associate of Ned Feder 

Nuclear Engineering, Texas A&M University 

12. lack Mitchell - United States Senate, Special Committee on Aging 

031 Dirksen or 628 Hart Senate Office Buildings, Washington, D.C. 

B.loan Kleinman - District Director. Congressman Chris Van Hollen (D-Md) 

Office of Representative. 51 Monroe Street #507, Rockville, Md. 

14. Congressman Chris Van Hollen (D-Md) 

House of Representatives 

1707 Longworth H.O.B., Washington, D,C, 

District Office - 51 Monroe Street #507, Rockville, Md. 

When asked whether they thought it was appropriate to gather attorney-client privileged 

communications, Hoofuagle responded: 

Q. Okay. So if you got that pennission and you put Spector on, and 

you noticed someone communicating with their personal attorney, 

what 

A. I have not received instruction on that. 

Q. Okay. You don't know what you would do. 

A. You know, what I would do, I might say something. Because 

we're in an environment where, you know, obviously this is a 

problem. And I might say something. But, yeah, that process is 

evolving. 

Q. But you don't currently have a procedure that would allow ... you 

to not capture those types of communications? 

'" Chickasaw Nation Industries Info. Technologies, Actors List (May 5, 2010). [FDA 1023·1024J 

Page 127 
146 


Insert offset folio 101 here 87176.101

A. To not capture those types of communications is correct. I 16 

In order to keep the infonnation secure, CNIIT used two encrypted flash drives to deliver 

infonnation to FDA officials for review. When the CNIIT investigators found infonnation they 

believed to require further review, they would flag this infonnation when they forwarded it to 

FDA officials. Specifically Ruth McKee, served as the "contact point between [Office of 

Infonnation Management] and the center [CDRH].,,117 McKee testified that although she had 

access to all the infonnation, the infonnation she passed on to her superiors did not contain the 

communications with Congress or any other protected communications. 

Q. [D]id you or Mary Pastel provide summaries of the infonnation 

that was being captured to either people above you in the chain of 

command or to the employees' supervisors? 

A. Only relevant to disclosure ofinforrnation, agency infonnation. 

Q. Right. To Members of Congress, to OSC? 

A. No. No. Only relevant infonnation. 

Q. Why not? 

A. Why not what? 

Q. Well, your goal I thought was to look at disclosures to outside 

parties, right? 

A. Right. 

Q. And nobody ever told you that it was inappropriate to look at 

disclosures to OSC or Members of Congress or attorneys, 

right? 

A. Right. 

Q. And you thought that was fair game because they were doing it 

on an FDA computer, right? 

A. I thought monitoring was fair game. I IS 

116 HoofnagJe Tr. at 39. 

II' McKee Tr. at 57. 

liS Id. at 76-77 (emphasis added). 

Page 128 
147 


Insert offset folio 102 here 87176.102

IX. Evolution of the Monitoring Program 

B. Initiation of Monitoring 

FDA officials conducted surveillance of employees' comRuter information in response to 

an April 16, 2010, letter from GE Healthcare's outside counseLl 9 GE Healthcare alleged the 

disclosure of confidential information to the press regarding the company's premarket 

notification submission for a CT scanning device for colonography screening. 120 Ruth McKee, 

CDRH's Executive Officer, led the agency's effort to determine what it could do in response to 

the allegations contained in the letter, which, ultimately, was to initiate the monitoring ofCDRH 

employees' computer activity. McKee testified: 

Q. How did it fall to you in this case to initiate the investigation? 

A. I think giving me credit for initiating an investigation is giving me 

more credit than I am due. I was the executive officer for the 

organization where the allegation arose. It was my job to try to 

figure out what options we had. 121 

The FDA's computer monitoring program appears to have been unprecedented in scope 

and intensity. In the past, monitoring activities were limited to activities like high-bandwidth 

transfers of data or viewing pornography on government computers. 122 McKee instructed Mary 

Pastel, Deputy Director for Radiological Health in the CDRH's Office of In Vitro Diagnostics 

and Radiological Health, to review surveillance materials collected on the encrypted flash drives. 

This was the first time she had received instructions to review such close surveillance of 

119 Basile Letter ~ supra note 58. 

120 !d. at 2. 

121 McKee Tr. at 29-30. 

122 Davis Tr. at 34. 

Page 129 
148 


Insert offset folio 103 here 87176.103

employees' computer activity. McKee did not provide any monitoring boundaries or limitations. 

Pastel testified: 

Q. Okay. Had you ever been asked to do a project like that before? 

A. A project like what? 

Q. Like reviewing - from a computer that was under surveillance. 

A. No. 

Q. Did anybody give you any guidance about how to do that besides 

the instructions that Ruth gave you? 

A. NO. 123 

Initially, the FDA monitored only one employee, Dr. Robert Smith. In April 2010, Lori 

Davis approached Joe Albaugh, who was thcn the FDA's ChiefInformation Sccurity Officer. to 

set up monitoring for Dr. Smith.124 The FDA set up monitoring of Dr. Smith on April 22, 2010, 

five days alier FDA's receipt of the GE letter. Albaugh testified: 

Q. Can you describe for us what Lori told you? 

A. That . .. the executive officcr had approached her and that the 

concern was about confidential information that had been leaked to 

the public. 

Q. And what did Lori ask you to do? 

A. To work with the . .. executive officer at CDRH, to set up 

monitoring . .. for an individual who they believed to be 

responsible for the leakage. 

Q. When you say "executive officer," can you tell us that person's 

name? 

A. That was Ruth McKce. 125 

When Davis ordered the surveillance, she offered no guidance, alternative approaches, or 

instructions on how to conduct the monitoring. 126 Along with the FDA officials' failure to give 

any instructions about appropriate protocol for the monitoring, officials also failed to offer 

123 H. COl11l11. on Oversight & Gov't Reform, Transcribed Interview of Mary Pastel, at 23 (Jan. 4, 2013) rhereinafter 

Pastel Tr.]. 

I" Albaugh Tr. at 6-8. 

III Id. at 6-7. 

"" Id. at9-10. 

Page 130 
149 


Insert offset folio 104 here 87176.104

guidance about possible legal implications of a broad-based surveillance of private information 

such as communications with attorneys or Congress. Pastel testified: 

Q. Did anybody talk about the legal guidelines or other things that 

might be worth paying attention to, such as the reason that we're 

kind of here today is because communications with Congress, with 

OSC, with some of these people's personal attorneys were captured 

and reviewed. And Chairman Issa and Senator Grassley were 

concerned about that, especially since some of Senator Grassley's 

staff were folks, you know, whose communications were being 

captured. 

So my question is, did anybody ever suggest to you, you know, 

let's exclude those communications from the scope of this review? 

If you see anything like that, you know, don't forward them along 

to whoever you were handing the material back to? Did you ever 

get guidance along those lines? 

A. No. These were communications on government computers. 

And we have government computer security training every 

year, and in that security training it says that anything on the 

government computer can get monitored. 127 

c. Type of Monitoring 

Some FDA officials stated they did not fully appreciate the scope of the surveillance or 

the intrusiveness of the Spector 360 user activity monitoring software installed on employees' 

computers. While at least one FDA official was under the impression that only a retrospective 

search would be conducted to attempt to determine if an employee had leaked information to the 

press, another official was well aware that real-time surveillance would be the protocol used by 

the CNIIT investigators. 

Executive Officer Ruth McKee stated: 

Q. Okay. So then what is it that you thought that IT was going to be 

doing in response to your request about that topic? 

A. I didn't know what they were going to be doing. That's why I went 

to talk to them. 

Q. Right. And after the discussion, what was your understanding of 

what they would be doing? 

.21 Pastel Tr. at 23-24 (emphasis added). 

Page 131 
150 


Insert offset folio 105 here 87176.105

A. That they would be doing real-time monitoring of Dr. Smith's 

email account. 

Q. For future communications? 

A. Yes. 128 

On the other hand, CIO Lori Davis maintained that she was unaware that the monitoring 

would include real-time surveillance. Davis stated: 

Q. So, at this first meeting, did you contemplate that this would be a 

historical search, a search of existing e-mails in the past to 

determine who had been responsible for this particular leak? Or 

were you anticipating that there would be real-time monitoring 

going forward? 

A. At that first meeting, I would have said it was historical . . . 

because in my mind, it had already happened. 129 

* * * 

Q. Uh huh. So when did you understand? 

A. I am going to tell you that I don't think I ever knew that they were 

doing real-time monitoring to the extent that it was reported on. 

Q. You mean in the press? 

A. In the press. 

Q. So when you read the press reports about screen shots every 6 

seconds 

A. That's the first that I have learned the extent of what that real-time 

monitoring looked like. 130 

D. Development of Search Terms 

Ruth McKee was responsible for detennining the initial search tenns for the employee 

computer monitoring project. The FDA's Office of Infonnation Management (OIM) used these 

search terms to provide summaries and examples of the captured infonnation to management. 131 

Il8 McKee Tf. at 59. 

'" Davis Tf., at 11. 

IlO [d. at 24. 

III McKee Tf. at 9. 

Page 132 
151 


Insert offset folio 106 here 87176.106

Even after the surveillance began, McKee never asked for or received any feedback from OIM 

about limiting or expanding the scope of the surveillance. McKee testified: 

Q. Okay. Did you ever get any feedback from Dr. Shuren or anybody 

else about what was being collected? 

A. Describe "feedback." 

Q. Did they give you any guidance to either limit or expand the scope 

of the surveillance? Did they suggest additional search terms, or 

did they say, keep doing what you are doing, this seems to be 

working? 

A. No additional guidance, no. Not to expand search terms or to 

make changes, no. 132 

E. Interim Report 

Christopher Newsom and Joseph Hoofuagle, CNIIT investigators, drafted an interim 

report to summarize the status of the surveillance. 133 Prior to finalizing the interim report, CNIIT 

investigators met with FDA managers to review the document. 134 Little, if any, planning, 

however, went into the preparation of the report. Hoofuagle and Newsom did not receive any 

guidance on what to include. McKee testified: 

Q. In the interim report, when you met to discuss this document, did 

anybody have any concerns about the language that was used in 

here? 

A. No. 

Q. Was the language used in here - did Chris or Joe receive any 

guidance on how they should create this document? Were they 

given a framework by which to present the evidence that they 

uncovered? 

A. Not that I am aware of, no. 

Q. This is something they devised themselves, as far as you know? 

A. That is my understanding. 1l5 

132 !d. at 22 (emphasis added). 

133 Hoofuagle Tr. at 34. 

134 McKee Tr. al 26-27. 

135 fd. at 91-92. 

Page 133 
152 


Insert offset folio 107 here 87176.107

Newsom explained that no one at the FDA gave him any guidance on writing the report. 

He testified: 

Q. Did anybody give you any guidance on the language in the interim 

report? 

A. No. 

Q. That was all your own? 

A. Yes.l3& 

On June 3, 20 I 0, CNIIT sent the report to Davis and Albaugh. 137 McKee viewcd the 

report soon after. 138 The report summarized the surveillance conducted thus far of Dr. Smith's 

official and personal e-mail accounts, including e-mails with journalists, congressional staff 

members, and the Project on Government Oversight. 139 

• 

View AU instances of the above noted in (m:lcr by date 

• iylultiple email contactswithJoanKleinman(DistrictDiraetorforR$.ID. Chris 

Van Hollen) - Emails ineIude attaehments with significant amount of documents 

including those self-redacted. 

View All instances of the above noted in order by date 

The interim report also alleged that Dr. Smith "ghostwrote" his subordinates' rep0!1s and 

supplied internal documents and infonnation to external sources. 140 The report confinned that 

Dr. Smith spoke with colleagues who shared his concerns about the approval of potentially 

dangerous products. '41 These colleagues also worked with Dr. Smith to shed light on these 

alleged improprieties. 142 Prior to the issuance of the interim report, the FDA began monitoring 

CDRH scientist Paul Hardy's computer. Following the report, FDA officials expanded the 

surveillance to more CDRH employees. 

136 Newsom Tr. at 122. 

m Interim Report, supra note 10. 

138 McKee Tr. at 26. 

]39 Interim Report. supra note 10. 

"0 rd. 1<1 Td. 

I-I.:! ld. 

Page 134 
153 


Insert offset folio 108 here 87176.108

F. Expansion of People Monitored 

Soon after writing the interim report, monitoring was expanded to three additional CDRH 

employees. 143 McKee explained her role in permitting the monitoring of additional employees, 

acknowledging she initiated and expanded the surveillance with the approval of Dr. Shuren and 

others. She stated: 

Q. Okay. What was your - describe your role to me, as you 

understand it. 

A. I was essentially - I was the contact point between LIM and the 

center. 

Q. When you say you were the contact point, you initiated the scope 

of monitoring. Correct? 

A. Yes. 

Q. And it was your decision to expand the scope of the monitoring to 

the additional FDA employees, correct? 

A. Not only my decision, no. 

Q. Right. You had to seek Dr. Shuren's approval of that? 

A And there were discussions held, I believe, above Dr. Shuren's 

level. 144 

Christopher Newsom testified that fellow CNIIT investigator Joseph Hoofnagle, along with Joe 

Albaugh from the FDA, instructed him to expand the surveillance. 145 

G. Changes to the FDA Employee Login Disclaimer 

Every employee within the FDA receives a brieflogin disclaimer before logging into a 

government computer explaining that their activities on the computer could be monitored. The 

FDA, however, changed the message on the disclaimer before the monitoring program began. 146 

Initially, the disclaimer stated that for the purpose of protecting the FDA's property, information 

accessed on the computer could be "intercepted, recorded, read, copied, or captured in any 

manner and disclosed by and to authorized personnel.,,147 

143 McKee Tr. at 16. 

144 !d. at 57-58. 

145 Newsom Tr. at 122. 

146 Davis Tr. at 54. 

147Id. at 53, Exhibit 7, FDA Employee Login Disclaimer. 

Page 135 
154 


Insert offset folio 109 here 87176.109

In her testimony, Lori Davis, the FDA ChiefInformation Officer, described the purpose 

of the warning message. 148 She also explained that Joe Albaugh, the FDA ChiefInformation 

Security Officer, had the capacity to change the disclaimer language. 149 Davis testified: 

Q. This is the FDA warning banner. Do you recall - well, first 

describe to us what this is. 

A. This pops up when you power on your machine. It's probably one 

of the first things all employees see when they log onto their FDA 

computer. 

Q. And who is responsible for coming up with this text and/or making 

any edits or changes to the text if need be? 

A. Joe Albaugh worked - and I don't recall whether or not it was the 

Office of Inspector General that he worked with it or Office of 

Legal Counsel at HHS. But he worked either with OIG or Office 

'" !d. at 53-54. H9 1d. 

Page 136 
155 


Insert offset folio 110 here 87176.110

of Chief Counsel - you have to ask him - on editing this 

language. 150 

Davis later explained that Albaugh chan'fed the disclaimer language because he did not believe 

the prior language was "tight enough.,,15 Although no other FDA Officials interviewed could 

recall when then change was made, Davis stated that AlbauF decided, to edit the message 

before monitoring began on CDRH scientists and doctors. 15 Davis stated: 

Q. So you recall a change in this languageA. Correct. 

Q. -- at some point while you were there? 

A. Correct. 

Q. Okay. Can you tell me what precipitated the change and why? 

A. You'll have to ask - in Joe's mind, he felt that the language was 

not tight enough. 

Q. When did he - he expressed that concern to you at some point? 

A. Yes. 

*** 

Q. Do you recall whether it was after the monitoring in this case had 

already begun? 

A. No, it was before. 153 

Mr. Albaugh, however, could not recall any sr,ecific changes made or when they 

occurred, only that he was sure changes were made. I 4 

According to documents obtained by the Committee, the disclaimer message was edited 

to explain to users that they have no reasonable expectation of privacy when using the FDA 

security system. 155 The prior disclaimer was significantly expanded to list specific devices 

which encompassed the U.S. Government information system, and outlined additional details 

about what information the FDA could monitor on the computer. 156 These personal storage 

l50/d. 

lSI Davis Tr. at 54. 

152 /d. 

153 1d. (emphasis added). 

154 Albaugh Tr. at 34. 

155 See Ireland Letter, supra note 6. 156 /d. 

Page 137 
156 


Insert offset folio 111 here 87176.111

devices were ultimately monitored and searched in the FDA monitoring investigation. The 

revised disclaimer stated: 

You are accessing a U.S. Government infonnation system, which includes 

(l) this computer, (2) this computer network, (3) all computers connected 

to this network, and (4) all devices and storage media attached to this 

network or to a computer on this network. 

This infonnation system is provided for U.S. Government-authorized use 

only. Unauthorized or improper use of this system may result in 

disciplinary action, as well as civil and criminal penalties. 

By using this infonnation, you understand and consent to the following: 

• You have no reasonable expectation of privacy regarding any 

communications or data transiting or stored on this infonnation 

system. At any timc, and for any lawful government purpose, the 

government may monitor, intercept, and search and seize any 

communication or data transiting or stored on this infonnation 

system. 

• Any communications or data transiting or stored on this 

infonnation system may be disclosed or used for any lawful 

government purpose. I 57 

Rcgardless of when the banner was changcd to address, among other things, personal storage 

devices that were attached to agency computers, it did not discuss the intrusive search procedures 

to which those personal storage devices attached to the FDA network would be subject. 

In the course of the FDA monitoring investigation, CNIIT investigator Chris Newsom 

used Encase, a forensic imaging tool used to recover specific documents, including deleted files, 

artifacts, and infonnation from unallocated space, to retrieve data from the personal storage 

device of one of the five employees being monitored. 158 Therefore, the employees being 

monitored were not only subject to real-time monitoring of activity on FDA computers, but also 

to an additional layer of intrusion involving personal storage devices. Encase was used to 

reconstruct and copy personal files that FDA employees had deleted from their personal storage 

device before plugging that device into an FDA computer. That level of surveillance is not 

reasonably contemplated by the phrase in the FDA's disclaimer, which merely asserts that a 

"government infonnation system" includes "all devices and storage media attached to this 

network." 

157/d. 

158 Newsom Tr. at 27, 63. 

Page 138 
157 


Insert offset folio 112 here 87176.112

x. The Office of Inspector General Declines to Investigate 

When Dr. Shuren learned about the extent of the confidential disclosures of Dr. Smith 

and other employees, he wrote to the FDA Office of Internal Affairs (IA), which in tum referred 

the matter to the Office ofInspector Oeneral. 159 Les Weinstein, the Ombudsman for the CDRH, 

contacted the oro to request an investigation into Dr. Smith's disclosure of confidential 

infonnation to the press. 160 Dr. Shuren was copied on the e-mail request to the 010. 161 On May 

14,2010, IA wrote to the oro in response to the allegations contained in OE Healthcare's April 

16, 2010, letter. 162 In its response, IA asked the oro to investigate any disclosure of confidential 

infonnation by CDRH employees. 163 

In response, the oro wrote to IA on May 18,2010, stating the wrongful disclosure 

allegations "lack any evidence of criminal conduct on the part of any HHS employee."I64 The 

oro added that federal law permits disclosures to the media and Congress when related to 

matters of public safety, so long as the infonnation is not protected by national security interests 

or any other specific prohibitions. 165 Later, the oro clarified the statement to mean that the oro 

did not have the authority to determine the legality of such disclosures. 166 Instead, the oro could 

refer matters to the Department of Justice if there were "reasonable grounds to believe" there 

was a criminal law violation. 16? The oro clarified that the final detennination on whether there 

is potential criminality was the Justice Department's responsibility.168 

On June 28, 2010, Dr. Shuren again wrote to the oro with a new request for an 

investigation.169 He explained that the FDA had acquired new infonnation regarding the 

disclosures based on an internal investigation.I7O He reiterated that the disclosures, which were 

prohibited by law, had continued for quite some time.I?1 His letter explained that FDA officials 

159 Shuren Tr. a114. 

160 Weinstein E-mail, supra note 16. 

161 [d. 

162 Letter from Mark S. McCormack, Special Agent in Charge, Office ofintemal Affairs, FDA, to Scott A 

Vaolrease, Office ofInspector Gen., HHS (May 14, 2010). 

163 [d. 

164 Vantrea.')e Letter, supra note 17. 

165 [d. 

166 Letter from Elton Malone, Office ofthe Inspector Gen., HHS, to Mark McCormack, Office ofIntemal Affairs, 

FDA (Jul. 26, 2012). 167 Id. 

168 Jd. 

169 Shuren Letter, June 28, 2010, supra note 19. 

170 Jd. 

171 Jd. 

Page 139 
158 


Insert offset folio 113 here 87176.113

conductcd their own investigation because thcy believed an employee had leaked confidential 

proprietary information. 172 Dr. Shuren noted that IA authorized OIM to conduct real-time 

monitoring of Dr. Smith's computer. 173 He enclosed excerpts of the investigative findings and 

asked the OIG to review the communications to determine whether employees engaged in 

unlawful conduct. 174 

On November 3,2010, the Justice Department wrote to the HHS OIG. 175 The Justice 

Department explained that the Criminal Division would decline prosecution.1 76 The OIG 

concurred with the Justice Department's decision not to prosecute because "the referrallack[edJ 

any cvidence of criminal conduct on the part of any HHS employee:' 177 

On February 23, 2011, Dr. Shuren wrote for the third time to the OIG to request an 

investigation into two FDA employees' noneonsensual recording of phone calls and meetings 

regarding FDA business. l78 He added that the non consensual recordings were potential 

violations of state and/or fcdcral wiretapping laws, which, in somc instances, require conscnt of 

the parties to the communication.I79 Dr. Shuren noted that violations of wireta~fing laws are 

felonies, which may subject the person in question to fines and imprisonment.I He further 

explained that there was no FDA policy that permitted the unauthorized recording of phone calls 

and cmploycc meetings, or the usc of FDA equipment for surveillance. lSI Additionally, he 

expressed concerns over the storage of the recordings. noting the agency's requirements for 

secured storage and destruction of sensitive information. 182 

In March 2011, Ruth McKee also wrote to the OIG in reference to the alleged recordings. 

The OIG responded to Ruth McKee on June 10, 2011, and declined to investigate the matter. I8J 

Rather, the OIG defcrred to the FDA for any necessary administrative action. I84 Still, the 

monitoring continued according to Dr. Shuren: 185 

172 ld. 

173 Id. 

"'Id. 

Q. I'm trying to understand the distinction between continuing to 

pursue the investigative track, by which I mean monitoring, and 

then the administrative track, whieh sounds like it started shortly 

after you got that letter. But simultaneously the surveillance 

continued. Is that correct? 

I7S DOJ Letter, supra note 21. 176 Ill, 

177 Vanirease Letter, supra note 17; E-mail from Kenneth Marty, Special Invesligations Branch, Office of Inspector 

Gen., Dep't of Health & Human Scrvs .. to Ruth McKee. Exec. Orticer. etL for Devices & Radiological Health, 

FDA (June 10, 201 1,1:37 p.m.) [hereinafter Inspector Gen. E-Mail]. 

178 Shuren Letter, Feb. 23, 201 I, supra note 16. 

170 Jd. at 2. 

ISO Iii. 

181 ld. 

'" Iii. at 1-2. 

1B} Inspector Gen. E-mail. supra note 177. 

," Jel. 

ISS Shuren Tr. a141. 

Page 140 
159 


Insert offset folio 114 here 87176.114

A. Yes. 186 

When asked about the multiple requests for an 01 G investigation into the disclosures, 

McKee expressed disappointment at the OIG's decision not to investigate. She stated: 

Q. Okay. At a number of points along the way facts, evidence was 

referred to the Inspector General's Office. There were a series of 

letters asking the IG to take up this matter. Were you surprised or 

disappointed or did you have any reaction when the Inspector 

General's Office declined? 

A. Yes. 

Q. Can you describe for us what that reaction was? 

A. Surprised and disappointed. 

*** 

Q. Why then were a series of additional efforts made to refer this to 

the IG after it had been declined more than once? 

A. The additional referrals were for different topics. 

Q. Okay. So there was a hope that while the IG had set aside the 

communicating proprietary infonnation outside the agency piece 

of the puzzle, that maybe they would take up the patent issue or the 

one party recording issues? 

A. Yes. 

Q. And they declined at each step of the way? 

A. Yes, they did.187 

XI. Monitoring Was Not the Solution 

'86 Id. 

'87 McKee Tr. at 90-91 (emphasis added). 

Page 141 
160 


Insert offset folio 115 here 87176.115

The whole point of initiating the monitoring of the five FDA employees was to confirm 

the suspicions of FDA management that these employees were, in fact, leaking information to 

the press. At the direction of FDA officials, the monitoring program collected approximately 

80,000 documents. 18S Interviews with key FDA officials made it clear that the program did not 

accomplish what it was set up to achieve. For example, Dr. Shuren stated: 

Q. Okay. So you never actually found proof that Robert Smith was 

disclosing [information] it to the press? 

A. Confidential information? 

Q. Yes. 

A. Not to my recollection. 189 

In fact, in an effort to be thorough, FDA officials even reviewed Dr. Robert Smith's FDA-issued 

computcr oncc he Icft thc agcncy following the expiration of his contract but found no evidence 

of disclosures of confidential information to the mcdia. 190 

FDA management went to unprecedented lengths in order to determine who was leaking 

confidential information to the press. Yet, they failed to find proof of leaks to the press. In fact, 

the only information FDA officials uncovered on one of the five FDA scientists monitored, Paul 

Hardy, was information disclosed to Congress - a protected form of communication. 191 

XII. Managing By Investigation 

Over the coursc of the investigation, it became evident that FDA officials chose not to 

address Dr. Robert Smith's job performance through administrative procedures available to 

them. Instead, FDA officials used the HHS OIG and computer monitoring tactics to investigate 

him. Dr. Robcrt Smith, the first scientist FDA officials monitorcd, was a thorn in thc agcncy's 

side. According to Dr. Shuren, Dr. Smith created a "toxic" environment. Dr. Shuren stated: 

The work environment was toxic and had bled over to other parts of the 

center as well. And that was a - radiological devices was a hornet's nest. 

188 Newsom Tr. at 132. 

"9 Shuren Tr. at 93. 

190 Newsom Tr. at 32. 

191 McKeeTr. at 17-18. 

Page 142 
161 


Insert offset folio 116 here 87176.116

It was essentially two camps. It was the people who were - Robert and his 

supporters, and there [were] other people or people who just wanted to 

stay out of the way. 

People felt intimidated to speak up. There were people who I spoke to 

regarding what was going on in the office and some of them, I asked if 

they would speak to other investigators and OIG and others. And they 

declined to do so. They didn't even want to talk about it. 

We had reviews being held up. They were just not going anywhere. And 

there wasn't an issue about science. Some of these were tactics of a 

meeting was being scheduled, and they'd say, we're not meeting - an 

internal meeting - until you give us an agenda. Then we want to see all emails between managers and the company before we actually agree to 

corne in for an internal meeting. I mean, there was one thing - there was 

one thing after the other. 

Early on, one of the things Robert I think even put this in writing, his 

position was if a manager didn't have adequate experience or expertise, 

his perspective, and they disagreed with another scientist, that is 

retaliation. By its nature. I mean, those were the kind of things we were 

dealing with. 

And it was - it was constant. It was one thing after another. 192 

When asked whether FDA officials attempted to resolve this "toxic" environment 

through administrative measures rather than investigative channels, Dr. Shuren responded that 

senior management had rejected earlier attempts to discontinue Dr. Smith's contract. He stated: 

A. I mean, he had managers in different offices at different times talk 

to him about his bad conduct. He received a number of cautions as 

well. 

Q. These are the specific questions I want to ask about. 

A. . .. But we also had the management team, you have to remember. 

So for these managers who also want to do something, they had the 

Assistant Commissioner for management, they had the lawyers, the 

HHS lawyers from General Law Division, these are the 

employment lawyers, and you have labor and employee relations, 

and that is what that mechanism was, the managers actually were 

going to them about what do we do in the circumstances, and they 

were hearing back from those people, this is what you should be 

doing. It wasn't about ignoring Robert Smith at all, but they were 

192 Shuren Tr. at 43. 

Page 143 
162 


Insert offset folio 117 here 87176.117

getting their advice on what to do, they were talking with Robert, 

there was memo of cautions. 

* * * 

Q. So my understanding is a letter of caution is not an adverse 

personnel action as a technical matter. 

A. Right. 

* * * 

Q. So this group, this management group that you described, you 

participated in the discussions with them and with Robert Smith's 

managers about various steps to take? 

A. No, I for the most part was not part of the managers team. I got 

pulled into some things a little bit more than I normally would 

simply because of the circumstances. So even on the managers 

for Robert not wanting to renew his contract, they came to me 

because they were concerned about would the Office of 

Commissioner not let them, if you wiU, not renew his contract, 

essentially saying you have to renew it. Two years before the 

managers did not want to renew Robert's contract, and the Office 

of Commissioner stepped in and told them you will have to renew 

it, and they were worried, even though it is different people, 

they were worried about the same thing. So I told them, I wiII 

support you, and I went to the Commissioner's office about 

will they support not renewing the contract, and even that 

decision on not renewing the contract and the memo regarding 

it went all the way up to the Acting General Counsel at HHS 

for review. 193 

So, according to Dr. Shuren, managers initially renewed Dr. Smith's contract even 

though there were significant concerns about his performance. Then, despite continued problems 

and a letter from the OlG deferring to the FDA to take administrative action, senior FDA 

officials chose to address Dr. Robert Smith's alleged shortcomings through repeated referrals to 

the OIG for criminal investigation, rather than through direct management action. 

\OJ fd. at 82 (emphasis added). 

Page 144 
163 


Insert offset folio 118 here 87176.118

XIII. Post-Monitoring Changes 

In response to the intrusive nature of FDA's computer monitoring, the federal 

government took the unprecedented step of acknowledging that excessive monitoring could 

violate the law. On June 20, 2012, the Office of Management and Budget (OMB) sent a 

memorandum urging all Executive Branch departments and agencies to review their employee 

monitoring policies. 194 The memorandum is the first acknowledgment by the federal 

government that there are limitations on surveillance of government employees' computers. 

In particular, the memorandum recognizes that the government may not conduct 

unlimited computer surveillance, even when an employee is on duty and operating a 

government-owned computer. 195 Further, the memorandum also purports to safeguard protected 

communications made using private e-mail accounts. 196 Specifically, OMB instructed agencies 

to "take appropriate steps to ensure that those policies and practices do not interfere with or chill 

employees' use of appropriate channels to disclose wrongdoing." 197 0MB enclosed a 

memorandum from ose highlighting that federal law protects whistleblowers' rights. 198 

According to OSC, while lawful agency monitoring of employee electronic 

communications may serve a legitimate purpose, agencies should ensure these policies and 

practices do not interfere with or deter employees from using appropriate channels to disclose 

wrongdoing. 199 

194 Memorandum from Steven VanRoekel, OMB Fed. ChiefInformation Officer, & Boris Bershteyn, OMB General 

Counsel, Office of Special Counsel Memorandum on Agency Monitoring Policies and Confidential Whistleblower 

Disclosures (June 20, 2012). 

195 Seeid. 

1% See id. 

197 Id. 

198 See id. 

199 Lerner Memo. supra note 24. 

Page 145 
164 


Insert offset folio 119 here 87176.119

OSC addressed the issue of electronic monitoring and protected communications with 

OSC and 01Gs. 2oO The memorandum failed, however, to acknowledge whistleblowers' rights to 

communicate with Congress?OI OSC issued a press release on February 15,2012, 

acknowledging that monitoring employee e-mails should not dissuade employees from making 

disclosures to Congress 2112 Unlike the OSC memorandum, however, the press release was not 

circulated government-wide and did not receive as much attention. As a result, agencies have 

not received official notice from OMB or OSC that computer monitoring guidelines should 

ensure that protected communications include communications with Congress. If the Executive 

Branch has a legitimate reason for excluding communications with Congress from those that 

should be protected, it has not explained what that reason might be. 

On September 24, 2012-shortly after OSC released its memorandum-FDA 

Commissioner Margaret Hamburg directed Elizabeth Dickinson, the FDA Chief Counsel, to alert 

the agency that future installation of Spector 360 software would require "written approval by 

the FDA Chief Counselor her delegee." 20J Commissioner Hamburg also directcd the CIO and 

Chief Counsel to "promptly" develop written standards and procedures for monitoring employee 

personal work computers?04 

Despite the urgency expressed by the Commissioner, FDA did not release any additional 

guidelines until over a year later. On September 26,2013, Chief Operating Officer (COO) and 

Acting Chiefinformation OtIicer (CIO) Walter Harris released interim guidelines outlining new 

procedures for cmployee monitoring.205 The interim guidelines have not yet been fully 

implemented, and are subject to change as the FDA continues to develop policies that are 

consistent with HHS monitoring policies. The FDA Commissioner's September 2012 

memorandum, therefore, still acts as the guiding documcnt. The interim guidelines included the 

following: 

200 Id. 

2D1 Id. 

• Basis for computer monitoring 

• Express written authorization 

Establishment of a review committee 

• Limitations on time, scope, and invasiveness 

Periodic review by the COO 

• Legal review of monitoring requests by FDA Office of the ChicfCounsc1206 

202 U.S. Office of Special Counsel, Press Release. Office a/Special Counsel Opens Investigation into FDA's 

Surveillance a/Employees' E-mail (Feb. 15,2012). 

20J Memorandum from Elizabeth Dickinson, FDA Chief Counsel, Requirements/or Deploying Spector Software 

(Aug. 1,2012). 

204 Memorandum from Margaret A. Hamburg, FDA Commissioner to Walter A. I'janis, FDA Chief Operating 

Officer, Eric Perakslis, Chief Information Ofticer, & Elizabeth H. Dickinson, FDA Chief Counsel, Monitoring 0/ FDA Personnel Work Computers (Sept. 24, 2012). 

205 FDA Information Resources Management -Information Technology Security, Monitoring a/Use o/HHSIFDA 

IT Resources (Sept. 26, 2013). 106 1d. 

Page 146 
165 


Insert offset folio 120 here 87176.120

Although FDA's interim policies propose to establish procedures for regulating employee 

monitoring, the policies do not provide protections against whistleblower retaliation. Even with 

national media attention, recommendations from outside agencies, and internal agency 

directives, FDA has yet to implement permanent policies and procedures. Additionally, as of the 

date of this report, multiple inquiries are still pending, including two OIG reviews requested by 

the Secretary ofHHS. 

XIV. Conclusion 

The FDA's secret monitoring ofCDRH employees is a prime example ofa flawed 

oversight process for employee computer surveillance. A federal agency may monitor 

employees' computers for a lawful purpose. Retaliatory motives and excessively intrusive 

monitoring schemes that capture legally protected communications, however, are inappropriate. 

The lack of appropriate limitations and safeguards in conducting employee surveillance 

has long been a concern of the Committee on Oversight and Government Reform. In 2012, the 

Committee learned of a similarly flawed employee surveillance program at the Federal Maritime 

Commission (FMC). Like the FDA, the FMC used Spector 360 to conduct covert surveillance of 

a select group of employees. The FMC allegedly targeted for surveillance employees who 

expressed opinions which contradicted the Chairman's views. Furthermore, the FMC OIG 

requested that agency management stop using the monitoring software, citing concerns it 

violated federal privacy regulations. Despite this admonition, agency management continued 

using Spector 360 against the advice of the Inspector General. The Committee found that these 

tactics, along with adverse personnel decisions, contributed to a climate of fear and intimidation 

among agency managers and staff.207 

The Committees' investigation of the FDA's surveillance of whistle blowers raises 

broader questions about the policies and practices for electronic surveillance at other Executive 

Branch departments and agencies. In this instance, scientists and doctors raised concerns about 

the effectiveness of the FDA's process for approving medical devices. Once they learned that 

scientists and doctors had communicated with Congressional offices and the Office ofthe 

Special Counsel, FDA officials did not have a legitimate purpose to institute an intrusive 

monitoring scheme that would capture those communications, among others. The FDA officials 

who conducted employee monitoring appeared to be engaged in a form of retaliation, as well as 

an attempt to interfere with protected whistleblower communications. These actions may have 

serious ramifications, as they threaten to chill legally protected disclosures to Congress and the 

Office of Special Counsel. While the FDA has adopted interim policies to regulate surveillance 

of employees' computers, there are still no permanent guidelines in place. Additionally, the 

temporary regulations do not provide safeguards to protect whistleblowers from retaliation. 

207 Letter from Han. Darrell E. Issa, Chairman, H. Comm. on Oversight & Gov't Reform, to Richard A. Lidinsky, 

Jr., Chairman, Fed. Maritime Comm'n (May 9, 2012). 

Page 147 
166 


Insert offset folio 121 here 87176.121

From the start, when the FDA learned of the potential disclosures to entities outside of 

the FDA, officials who ordered the monitoring demonstrated an egregious lack of oversight and 

judgment. There were no guidelines in place, and no one considered the consequences of an 

invasive monitoring scheme. An agency may not monitor whistleblowers to retaliate against 

those whose actions were lawful. Here, the scientists and doctors who raised concerns about the 

FDA's approval process in good faith were within their lawful right to do so. 

Testimony from numerous FDA officials established that when officials ordered the 

surveillance, they failed to consider the legality and propriety of the monitoring. Instead, 

officials not only approved the monitoring, but also expanded both the number ofCDRH 

employees monitored and the scope of the monitoring. Witnesses also testified that the officials 

who ordered the monitoring were not adequately aware of the intrusiveness of the computer 

monitoring software. When FDA officials later contacted DIG to request an investigation into 

the whistleblowers' release of unauthorized information, DIG declined to investigate because the 

allegations were unsubstantiated. Despite DIG's response, monitoring of employees continued. 

The Committee on Oversight and Government Refonn ofthe U.S. House of 

Representatives has jurisdiction over the federal civil service, govenunent management, and the 

management of government operations and activities, as set forth in House Rule X. In addition 

to its role in conducting oversight and consideration of nominations, the Senate Judiciary 

Committee also considers other matters, including government information, as set forth in the 

Standing Rules of the Senate. The Oversight and Government Reform Committee and the 

Senate Judiciary Committee have a responsibility to ensure federal agencies arc using taxpayer 

dollars appropriately and upholding whistleblower protection laws. 

Executive Branch departments and agcncies must take a cautious approach to employee 

monitoring. An intrusive monitoring scheme may run afoul of federal law. In addition, such a 

scheme could have a chilling effect, making employees reluctant to report waste, fraud, abusc, 

and mismanagement for fear of retaliation. The Committees will continue to assess whether the 

FDA is taking adequate steps to prevent such practices from recurring, and will endeavor to 

determine whether other Executive Branch departments and agencies arc taking appropriate steps 

to engage only in limited employee monitoring when absolutely necessary, subject to thorough 

vetting and approval. 

Page 148 
167 


Insert offset folio 122 here 87176.122

xv. Appendix I: Relevant Documents 

Page 149 
168 


Insert offset folio 123 here 87176.123

Appendix I: 

Relevant Documents 

Appendix j: Relevant Documents 
169 


Insert offset folio 124 here 87176.124

N we ; ~::I~~~:BlLOWERS I CENTER 

J2JS P STREET, N W WASHINGTON. DC 10007 I ••••••••••• I WWWWHtSTLEBlOWF.R5.0RG 

URGENT MATTER - REQUEST FOR INVESTIGATION 

Senator Chuck Grassley 

Ranking Member 

Senate Judiciary Committee 

135 Hart Senate Office Building 

Washington, D.C. 20510 

Congressman Darrell Issa 

Chairman 

September 17, 2012 

House Committee on Oversight and Government Reform 

2347 Rayburn House Office Building 

Washington, D.C. 20515 

Ms. Carolyn Lerner 

U.S. Special Counsel 

Office of Special Counsel 

730 M Street, N.W., Suite. 

Washington, D.C. 20036 

Dear Senator Grassley, Chairman Issa and Special Counsel Lerner: 

The National Whistleblowers Center ("Center") hereby requests a formal investigation 

into U.S. Food & Drug Administration ("FDA" or "Agency") violations of the Privacy Act of 

1974 ("Privacy Act" or "Act"). See generally 5 U.S.C. § 552a(b), (c) and (e). The Center also 

requests a review of all federal agencies' compliance with the Act in their implementation of 

internet security programs and the surveillance offederal employees and private citizens.l 

These Privacy Act violations relate to the ongoing investigations into the FDA's targeted 

surveillance of whistleblowers.2 Among other violations, the FDA collected and maintained 

approximately 80,000 pages of records related to employee communications with Congress, the 

I The Center requests these investigations pursuant to the Office of Special Counsel's ("OSC") jurisdiction to 

investigate "gross mismanagement" and violations of law,S U.S.c. § 1211, et seq., and Congress' authority to 

oversee the actions of the executive branch. 

2 For purposes of clarity, the term "FDA" as used in this letter incorporates the FDA, the Department of Health and 

Human Services ("HHS"), Quality Associates, and other persons, agencies, or contractors involved in the 

surveillance program. Managers or attorneys within HHS likely approved FDA's actions, and various departments 

within HHS likely participated in or provided support services for the surveillance program. These HHS components 

must also be fully investigated. 

CONFIDENTIAL DISCLOSURE - PRIVACY ACT PROTECTED 

Appendix I: Relevant Documents 
170 


Insert offset folio 125 here 87176.125

Office of Special Counsel ("OSC"), the Office of Inspector General ("OIG") and other 

constitutionally protected communications.) The FDA subsequently released these records to the 

public by posting them on the internet through its contractor, Quality Associatcs, Inc. ("Quality 

Associates"). 

BACKGROUND 

The FDA has a system of records related to the FDA's targetcd surveillance of internal 

whistleblowers and their associates ("Surveillance Cache"): The Surveillance Cache consists of 

approximately 80,000 pages of scrcen shots of the targets computers, intercepted e-mails, e-mail 

attachmcnts, records taken from privately owned portable hard drives ("thumb drives"), drafts of 

legal filings with the OSC and OIG, and communications with Congress. Along with the 

intercepted information, the Surveillance Cache contains internal FDA memoranda regarding the 

surveillance, and a full index of the intercepts, containcd in sixty-seven "logs" ("Log"). Each 

Log outlines the specific rccords collected, stored, maintained and discloscd by the FDA, along 

with the corrcsponding Bates stamp number. 5 

The FDA collected the Surveillance Cache through spyware programs, including the 

"Spector" program. Spector pennitted the FDA to "capture evcry single keystroke" the 

whistleblowers typed on their computers, including passwords. See SpectorSoft Brochure, 

Exh. I. Spector also pennitted the FDA to "read every email sent and received" by the 

whistlcblowers and conduct continuous "Screen Snapshot Surveillance" of "EVERYTHING" the 

employees did online. Id. (emphasis in original)6 

The records in thc Surveillance Cache werc culled from likely millions of pages of 

records obtained through the FDA's surveillance of its whistleblowers. According to a letter sent 

to Senator Grassley from the FDA, the surveillance program targeted five whistleblowers' 

computers for 11 to 78 weeks: 

Robert C. Smith, April 22, 2012 - July 7,2010 (11 weeks); 

Paul T. Hardy, May 24, 2010 - May 5,2011 (35 weeks); _

Ewa M. Czerska June 30, 2010 - December 6, 2010 (23 weeks) 

June 30, 2010 - November 5, 2010 (18 weeks) 

] The FDA has repeatedly cited to the Federal lnfonnation Security Management Act of 2002 ("FlSMA") as the 

authority for its surveillance program. See CDRII 8-24-12 001285. Nothing in FISMA repealed any provision of 

the Privacy Act or authorizes agencies to violate the Privacy Act in the administration of FISMA. FISMA mandates 

that federal agencies continue to adhere to the Privacy Act and prohibits agencies from using FISMA as a means to 

interfere or spy on communications with Congress. See 44 U.s.c. ~ 3549 ("Nothing in this [FISMA] subchapter. 

may be construed as affecting the authority of ... any agency, with respect to the ... protection of personal privacy 

under section 552a of tide 5 ... orthc disclosure of information to the Congress. " 

, The Center discovered and located the Logs and Surveillance Cache through a Googlc search. 

5 Copies of the Logs and the underlying documentation will be provided upon request. However, based on the prior 

availability of these materials on the World Wide Web, we understand that these documents are currently readily 

available. 

G The FDA confimJed that it activated these features in a ictter to Senator Grassley dated July 13,2012. 

CONFIDENTIAL DISCLOSURE - PRIVACY ACT PROTECTED 2 

Appendix I: Relevant Documents 
171 


Insert offset folio 126 here 87176.126

R. Lakshmi Visnvajjala, June 30, 2010 - December 31,2011 (78 weeks) 

See Letter, FDA to Grassley, Exh. 2 (July 13, 2012).The letter also indicates that the FDA took a 

screenshot of the targets' computers every five seconds. In addition, the FDA copied the entire 

contents of the whistleblowers' hard drives and all connected storage devices-including 

encrypted thumb drives. The FDA also activated software that records keystrokes and passwords. 

!d. 

The full extent of the FDA's systems of records is as of yet unknown. Given the extent of 

the FDA's surveillance activities, though, it is clear that the 80,000 pages in the Surveillance 

Cache is a targeted, refined and filtered collection of millions of pages of records of raw 

surveillance data. 

The FDA distributed its Surveillance Cache to various persons, including, but not limited 

to, its contractor, Quality Associates, Inc. ("Quality Associates"). On or about May 2012, 

Quality Associates, acting on behalf of the FDA, published the Surveillance Cache on the public 

internet. 7 A review of the Surveillance Cache demonstrates that FDA officials committed 

numerous violations of the Privacy Act through its collection, maintenance, and release of these 

records. 

7 Under the Privacy Act, actions taken by FDA contractors are treated as actions undertaken by agency "employees." 

5 U.S.c. § 522a(m). 

CONFIDENTIAL DISCLOSURE - PRIVACY ACT PROTECTED 

Appendix I: Relevant Documents 

3 
172 


Insert offset folio 127 here 87176.127

SPECIFIC VIOLATIONS OF LAW 

Below is an outlinc of some of the violations of law documented by the Surveillance 

Cache, which is in thc public record. A full document-by-document review of the Surveillance 

Cachc in light of thc rcquircmcnts of thc Privacy Act would result in the documentation of 

potentially thousands of Privacy Act violations. Thc full scopc of the FDA's surveillance 

activities is unknown as of yet. Once uncovcred though, thc Center cxpects to discover additional 

Privacy Act violations. 

I. Violations of the Privacy Act of 1974, § 552a(b) 

The FDA and its officials violated § 552(b) of the Privacy Act of 1974, which states: 

No agency shall disclose any record which is contained in a system 

of records by any means of communication to any person, or to 

another agency, except pursuant to a written request by, or with the 

prior written consent of, the individual to whom the rccord 

pertains, unless disclosure of the record [falls within a numbcr of 

narrow exceptions). 

The FDA disclosed rccords contained in the Surveillance Cache to agency and nonagency employees who had no necd to review the rccords. For example, the FDA "disclosed" the 

Surveillance Cache by publishing and making it publicly availablc on the internet. 

Moreover, the Surveillance Cache contained private information concerning 

whistleblowers and other individuals and agency employces for which there was no justification 

for collection, maintenance or disclosure. For example, thc Surveillance Cache includes 

attorncy-client communications, communications with Congress and the Inspector Gcneral, draft 

Equal Employment Opportunity Commission ("EEO") complaints and numerous highly 

confidential draft Office of Special Counsel ("OSC") complaints and supporting documents. 

There was no legal justification for FDA to collect thesc records, and once collected, there was 

no legal justification for the disclosure of these records. 

We hereby request that eaeh rccord collected by thc FDA, including all of the records 

published on-linc by Quality Associates, be carefully reviewed for actual or potential violations 

of section 552a(b) ofthc Privacy Act. 

II. Violations of the Privacy Act of 1974, § 552a(c)(l) 

The FDA and its officials violated § 552a( c)( I) of the Privacy Act of 1974, which states: 

Each agency, with respect to each system of records under its 

control, shall ... keep an accurate accounting of--

(A) the date, nature, and purpose of each disclosure of a 

record to any person or to another agency made under 

CONFIDENTIAL DISCLOSURE - PRIVACY ACT PROTECTED 

Appendix I: Relevant Document.., 

4 
173 


Insert offset folio 128 here 87176.128

subsection (b) of this section; and 

(B) the name and address of the person or agency to whom 

the disclosure is made. 

This record-keeping mandate was not followed for the Surveillance Cache. The 

Surveillance Cache was published in a manner that permitted any person with an internet 

connection to access these materials at -will with no accounting. Based on the documents 

produced, and the description of how the FDA processed these documents, it is apparent that the 

violations of the record keeping requirements of the Privacy Act were not limited to the actions 

of FDA's contractor. The FDA managers involved in the surveillance program appear to have 

failed to keep an accounting of their disclosures of records as required under section 552a(c)(l). 

The FDA should be required to produce a full accounting of every document collected 

during its surveillance program and fully document each and every disclosure of these 

documents, as required under this provision of law. Additionally, as part of the investigation, 

Quality Associates should be required to document each and every person who accessed the 

Surveillance Cache on-line in accordance with the requirements of § 552a(c)(l). 

The accounting provisions of the Privacy Act are critical for the enforcement of the Act. 

Without accurate accounting it is impossible to determine whether § 552a(b) was violated, and 

impossible to determine the nature and scope of harm which may have been caused by the 

collection, maintenance or distribution of records in violation of the Act. Furthermore, many of 

the provisions of the Privacy Act can only be followed if an accounting of who accessed the 

records is accurately maintained. 

III. Violation ofthe Privacy Act of 1974, § 552a(e)(I) 

As set forth in this letter, it cannot be reasonably contested that the FDA and its managers 

violated § 552a(e)(l) of the Privacy Act of 1974, which states: 

Each agency that maintains a system of records shall ... (I) 

maintain in its records only such information about an individual 

as is relevant and necessary to accomplish a purpose of the agency 

required to be accomplished by statute or by Executive order of the 

President. 

This provision is extremely broad. The Act defines "maintain" to include not only the 

maintenance of an agency record, but also the collection of the record: "[T]he term 'maintain' 

includes maintain, collect, use or disseminate," 5 U.S.C. § 552a(a)(3). 

By maintaining documents related to numerous individuals' communications with OSC, 

the Office of Inspector Oeneral ("010"), EEO, and Congress, among others, the FDA 

maintained thousands of records that were, as a matter of law, not "relevant and necessary" for 

the FDA to "accomplish a purpose" for which that agency is permitted to engage in. Many other 

records collected and maintained by the FDA, such as attorney-client communications, cannot, 

CONFIDENTIAL DISCLOSURE - PRIVACY ACT PROTECTED 

Appendix I: Relevant Documents 

5 
174 


Insert offset folio 129 here 87176.129

under any circumstances, meet this standard. 

Each record that was collected as part of the whistleblower surveillance program, for 

which the FDA decided to "maintain," should be reviewed and a determination made as to how 

that specific record was both "relevant" and "necessary" for the FDA to "accomplish" its 

"purpose." Each and every record "maintained" by the FDA as part of its surveillancc program 

must meet the criteria set forth under § 552a(e)(I). The following document groups are provided 

as examplcs of some of the thousands of documcnts maintained by FDA which fall outside of the 

records for which FDA could lawfully maintain pursuant to § 552a(e)(l). In this regard, thc 

FDA should provide written justification, under oath, as to the legality of maintaining each and 

cvcry one of the following records and/or record groupings: 

• Confidential disclosures prepared for the Office of Special Counsel. Surveillance 

Cache, Bate Stamped Nos. 52368-56755. 

Confidential communications with staff members of Congress. Surveillance 

Cache, Bate Stamped Nos. 1135-38, 1150, 1180-82, 1186, 1210-14, 1304-14, 

1342-46, 1406-08, 1790-98, 1810, 1838-51, 72471-73, 72405-06, 72514-17, 

72,522-23. 

• Private communications with EEO Office or Confidential EEO documents. 

Surveillance Cache, Bate Stamped Nos. 1282,1370,1628-48,1658-60,1694-96. 

• Communications with the Office of Inspector General. Survcillance Cache, Bate 

Stamped Nos. 65359, 65367-72, 65359, 65367-65372, 65376-412, 65415, 65419-

65422. 

• Confidential Draft Letter to Attorney General of the United States selling forth 

Alleged violations of law. Surveillancc Cache, Bate Stamped Nos. 52173-77. 

Confidential attorney-client communications related to the terms and scope of 

representation provided to FDA employees who sought legal representation to/ile 

OSC complaints. See e.g. Surveillance Cache, Bate Stamped Nos. 509-513 

(private attorney-client privileged emails with private attorneys regarding OSC 

filing). 

• Confidential attorney-client communications related to contacts with Congress 

and tactic/actions being undertaken in settlement negotiations. See e.g .. 

Surveillance Cache, Bate Stamped Nos. 1216-24, 1334. 

• Private communications bet>veen whistleblowers in which they discuss the 

contents of a disclosure to upper-levels of management or whether to raise 

certain issues to managers. Surveillance Cache, Bate Stamped Nos. 1318-24, 

1382-92. 

• Communications regarding the attempt by one of the whistleblowers (Julian 

CONFIDENTIAL DISCLOSURE - PRIVACY ACT PROTECTED 

Appendix I: Relevant Documents 

6 
175 


Insert offset folio 130 here 87176.130

Nicholas} to obtain government employment. Surveillance Cache, Bate Stamped 

Nos. 803, 813-14, 845-46, 991. These intercepted emails, that were maintained 

and disclosed by FDA were collected as part of a specific search request to learn 

about Dr. Nicholas' attempts to obtain employment. See Bate Stamped No. 1016 

in which FDA employees conducting the surveillance were instructed to "View 

All instances" of "correspondence indicating that Julian Nicholas has reapplied to 

CDRH and is being considered for a position." 

IV. Violations of the Privacy Act of 1974, § SS2a(e)(4) 

The FDA violated § 552a(e)(4) of the Privacy Act of 1974, which states: 

[Each agency shall] ... publish in the Federal Register upon 

establishment or revision a notice of the existence and character of 

the system of records, which notice shall include . . . (E) the 

policies and practices of the agency regarding storage, 

retrievability, access controls, retention, and disposal of the records 

... ; (F) the title and business address of the agency official who is 

responsible for the system of records; (0) the agency procedures 

whereby an individual can be notified at his request if the system 

of records contains a record pertaining to him; (H) the agency 

procedures whereby an individual can be notified at his request 

how he can gain access to any record pertaining to him contained 

in the system of records, and how he can contest its content. 

The FDA failed to establish rules governing the "storage, retrievability, access controls, 

retention, and disposal" of the Surveillance Cache. The FDA had no process to notifY the targets 

of its surveillance program that the agency had created a system of records related to them. The 

FDA had no process to notifY the targets that they had the right to notification and access, or the 

right to contest the content of this system ofrecords. 

For example, Congressional staff members whose private and constitutionally-protected 

correspondence was collected and maintained by the FDA had a right to notice regarding the 

storage of these records. The same is true for the numerous FDA employees whose materials 

were obtained. 

This provision of the Privacy Act is essential to ensure that the gross violations of law 

and privacy caused by the FDA's online publication of the Surveillance Cache would never have 

occurred. Had the FDA not violated this provision of law, it may have been able to properly 

police its collection, storage and distribution process. 

V. Violations of the Privacy Act of 1974, § 552a(e)(6) 

The FDA violated § 552a(e)(6) of the Privacy Act of 1974, which states: 

... prior to disseminating any record about an individual to any 

CONFIDENTIAL DISCLOSURE - PRIVACY ACT PROTECTED 

Appendix I: Relevant Documents 

7 
176 


Insert offset folio 131 here 87176.131

person other than an agency, unless the dissemination is made 

pursuant to subsection (b )(2) of this section, make reasonable 

efforts to assure that such records arc accurate, complete, timely, 

and relevant for agency purposes. 

The FDA disseminated, at the very least, approximately 80,000 pages of records to an 

outside contractor, which in tum were made publicly available for the world to see on the World 

Wide Web or internet.8 Much of the Surveillance Cache was not "relevant for agency purposes" 

as a matter of law or fact. For example, the OSC materials, which constitute thousands of pages 

of the information provided to Quality Associates, could not, under any circumstance, be 

considered records that were "relevant for agency purposes." 

When Quality Associates re-published these records on the World Wide Web, the 

violations were compounded. As outlined in this letter, FDA's dissemination of protected 

communications was not "relevant for agency purposes." These communications include 

Congressional communications, attorney-client communications, EEO draft documents, 

documents describing how persons engaged in First Amendment protected activities, and 

numerous other records. 

VI. Violations ofthe Privacy Act of 1974, § 552a(e)(7) of the Privacy Act 

The FDA violated § 552(a)(7) of the Privacy Act of 1974, which states: 

[no agency may] maintain no record describing how any individual 

exercises rights guaranteed by the First Amendment unless 

expressly authorized by statute or by the individual about whom 

the record is maintained or unless pertinent to and within the scope 

of an authorized law enforcement activity. 

The Surveillance Cache confinns that the FDA collected and maintained thousands of 

pages ofrecords "describing how" various individuals "exercise(d) rights guaranteed by thc First 

Amendment.,,9 These records include, but arc not limited to lO: 

, Given the nature and scope of the spyware that was utilized by FDAfHHS to conduct surveillance of 

whistleblowing activities by the FDA employees, it is more than likely that the 80,000 pages represent a small 

fraction of the documents collected or intercepted by the agency as a result of its surveillance program. 

Accordingly, the actual number of documents disseminated by the agency could be considerably greater than the 

80,000 pages that were publishcd on the internet. 

o According to the U.S. Department of Justice Privacy Act guidebook: "The OMB Guidelines advise agencies in 

determining whether a particular activity constitutes exercise of a right guaranteed by the First Amendment to 'apply 

the broadest reasonable interpretation.' 40 Fed. Reg. 28,948, 28,965 (July 9, 1975). available at 

http://www.whitehouse.gov/omb/assetslomb/inforeglimplementation_guidelines.pdf; see also 120 Congo Rec. 

40,406 (1974)," DOJ, Overview oJ The Privacy Act oj 19742010 Edition. All of the examples set forth herein are 

unquestionably covered under the First Amendment, as they constituted records related to employee speech on 

matters of "public concern" that were not subject to the '''official duty" exception carved out in the case of Garcetti 

\'. Ceballos, 547 U.S. 410 (2006). 

CONFIDENTIAL DISCLOSURE PRIVACY ACT PROTECTED 

Appendix J: Relevant Documents 

8 
177 


Insert offset folio 132 here 87176.132

• Documents related to communications with Congress. See, Surveillance Cache, 

recording email from Dr. Czerska to 

of Senator Grassley's staff); 72522-72523 

Smith to Dr. Czerska advising her to contact 

Grassley's Office, Van Hollen's Office, and Senate staff member Jack Mitchell); 

72405-72406 (snapshot recording of Mr. Hardy's Computer 8-17-2010 shows 

email to Joan Kleinman from Congressman Van Hollen's office); 1838-1851 

(snapshot recordings of multiple emails between Dr. Smith and Van Hollen's 

office); 72516-72517 (Snapshot Recording of email from Dr. Czerska to Senate 

staff member Jack Mitchell with attachments complaining about Shuren and 

Sharf stein); 1154 (file folders permitting FDA to access documents filed for 

Congressional staff members, including "Joanne" and "Van Hollen;" 1436 

(screenshot of computer inbox messages showing emails to Senate staff member 

Jack Mitchell and Van Hollen staff member "Joan;" 1154 (Snapshot Recording of 

files saved for various Congressional offices, listing "desktop" folders "For 

Congress," "For Emilia" [an aid for Senator Grassley], "For Joanne" [an aid on 

the House Oversight Committee] and for "Van Hollen." 

• Documents related to communications with the Office of Special Counsel and/or 

complaints drafted for filing with the OSC. See Surveillance Cache, Bate Stamped 

Nos. 52368-56755 (thousands of pages of OSC filing documents collected, 

maintained and distributed by FDA); 1720-1721 (Snapshot Recording of Smith 

computer shows contents of folder named "OSC Filers" that shows the names of 

all persons planning to file OSC complaints); 509-513 (private attorney-client 

privileged emails with private attorneys regarding OSC filing); 53271-53273 

(copies of confidential scanned signature pages for Dr. Nicholas' OSC Form 11 

filing); 53560-53561 (copies of confidential scanned signature pages for FDA 

whistleblower Nancy Wersto's OSC Form 11 filing); 1154 (snapshot of Desktop 

file folders containing OSC documents entitled "OSC Corrections" and "OSC 

Individual Folders Final Cruzer." 

Documents related to communications with the HHS Office of Inspector General. 

See Surveillance Cache, Bate Stamped Nos. 65359, 65367-65372, 65389-65401, 

65407-65410, 65419-65422, 65415; 1140: screenshot listing numerous emails 

with 010 agents Les Hollie and German Melo and other documents related to 

orG; 1164: screenshot of document folder established for "HHS orO." 

• Documents intercepting confidential communications between the FDA scientists 

and doctors and their attorneys. See Surveillance Cache, Bate Stamped Nos. 509-

513 (private attorney-client privileged emails with private attorneys regarding 

OSC filing); Bate Stamped No. 1326 (screenshot of inbox email from attorney 

to The page numbers referenced in this letter are the page numbers placed on these documents either by FDA or 

Quality Associates. Additional examples of records collected, maintained andlor disclosed by the FDA in violation 

of § 552a(e)(7) are set forth in the discussion regarding violations of § 552a(eXl), which also sets forth specific 

citations to records published on-line by Quality Associates. 

CONFIDENTIAL DISCLOSURE - PRIVACY ACT PROTECTED 

Appendix I: Relevant Documents 

9 
178 


Insert offset folio 133 here 87176.133

marked "STRICTLY CONFIDETIAL [sic] ATTORNEY CLIENT" and 

referencing "Office of Special Counsel filing" with a message from the attorney 

stating "sounds good" [cmphasis in original]); Bate Stamped No. 1280 

(screenshot of inbox email from •• " marked "Confidential Attorney-Client 

Commu~ Stamped No. 1292 (screenshot of inbox email from 

attorney __ " referencing "Office of Special Counsel Filing" with a 

message stating "Great!"). I I 

• Documcnts intercepting confidential communications related to EEO proceedings. 

See Surveillance Cache, Batc StamfJed Nos. 643-684 (emails with Congressional 

offices about FDA whistleblower __ s EEO complaint); 558-563 

(Czerska email communications ~ office intercepted); 67320-

67321 (Screenshots of emails from Czerska to Smith about her EEO amendment); 

1628-1651 (Screenshots of Smith editing Czerska EEO document labeled as 

ghostwriting; 67454-67460 (Email from Czerska to EEO making 

~huren); 2542-2546 (Email from Smith to EEO Officer 

_ about Smith EEO complaint); 1154 (Snapshot of "Desktop" file 

contammg documents for EEO proceedings, marked as "EEO," "Cindy EEO" and 

"Julian EEO." 

• Screenshots of the whistleblowcrs' email "in-box" listing who thc whistleblower 

communicated with and a summary of the communication. The "inbox" 

communications collected and maintained by FDA include: From the Screenshot 

dated 412811 0 (page 1264): message sent to "Jack," a Senate stafT member, 

discussing "HHS OIG investigation," a message sent from Dr. Nicholas 

discussing his "EEO fonnal complaint," and an email discussing "amendment of 

EEO complaint;" From the Screenshot dated 5/3/10 (page 1650): "Confidential 

Attorney Client Communication," "suggested response to EEO," '.bank 

Service" communication; Scrccnshot datcd 5/12110 (pagc 1328): email message 

between two clients represented by one attorney under a joint representation 

agreement discussing 'ned from HHS OIG and the "need" to 

speak with their dated 5/14110 (page 1340): 

numerous emails discussing her EEO case, including her 

settlement discussions and offers, and the 

contents of her complaints; Screenshot dated 5/1511 0 (page 1354): "draft email 

for Joan" (staff member for Congressman Van Hollen), "melo emails" (emails to 

and from HHS OIG invcstigator), email to "Jack" (a Senate staff member) 

concerning the "HHS OIG," an email from another whistleblowcr, entitled 

"Retaliation and Prohibited Personnel Practices at FDA;" Screenshot dated 

5/1311 0 collecting documents related to "PJ thoughts," "DOJ," "Julian EEO," and 

'.EEO." 

j I Employee communications with attorneys are given special protections under the First Amendment, and are 

entitled to "rigorous protection." Martin v. Lauer, 686 F.2d 24 (D.C. Cir. 1982). The attorney-client records 

intercepted by the FDA. and thereafter maintained by the FDA and disclosed directly concerned the fact that the 

FDA whistleblowers were in the process of hiring attorneys to represent them in OSC filings. Thus. the violations 

documented in the referenced documents materially compounded the severity of the violations of the Pri vaey Act. 

CONFIDENTIAL DISCLOSURE - PRIVACY ACT PROTECTED 10 

Appendix I: Relevant Documents 
179 


Insert offset folio 134 here 87176.134

• The logs published online set forth an index of thousands of documents collected, 

maintained and distributed by the FDA. Thousands of pages of documents 

identified in these logs fall within the § (e)(7) prohibition concerning the 

collection, maintenance and distribution of such documents. 

The U.S. Court of Appeals for the District of Columbia Circuit explained the seriousness 

of these violations: 

Similarly, although not expressly provided for in the Constitution, 

courts have long recognized that "the First Amendment has a 

penumbra where privacy is protected from governmental 

intrusion." Griswold v. Connecticut, 38LU.S. 479, 483, 85 S.Ct. 

1678,1681,14 L.Ed.2d 510 (1965). This penumbra of privacy can 

be invaded, under certain circumstances, by the mere inquiry of 

government into an individual's exercise of First Amendment 

rights. See Buckley v. Valeo, 424 U.S. 1,64,96 S.Ct. 612,656,46 

L.Ed.2d 659 (1976) ("compelled disclosure, in itself, can seriously 

infringe on privacy of association and belief guaranteed by the 

First Amendment"); Gibson v. Florida Legislative Investigation 

Committee, 372 U.S. 539, 544, 83 S.Ct. 889, 893, 9 L.Ed.2d 929 

(1963); Talley v. California, 362 U.S. 60, 64, 80 S.Ct. 536, 538,4 

L.Ed.2d 559 (1960); NAACP v. Alabama, 357 U.S. 449, 461-63, 

78 S.Ct. 1163, 1171-72, 2 L.Ed.2d 1488 (1958) ("compelled 

disclosure of affiliation with groups engaged in advocacy may 

constitute ... effective ... restraint on freedom of association"). 

Thus it is not surprising that Congress would have provided in 

this Act, dedicated to the protection of privacy, that an agency 

may not so much as collect information about an individual's 

exercise of First Amendment rights except under very 

circumscribed conditions. 

A/bright v. United Slates, 631 F.2d 915 (D.C. Cir. 1980) (emphasis added). 

The FDA and its responsible officials and contractors committed hundreds or thousands 

of violations of § (e)(7) based on a review of the Surveillance Cache alone. However, we 

estimate that the Surveillance Cache is only a sampling of millions of pages of records collected 

by the FDA pursuant to their spying program. This is a conservative estimate based on public 

representations of FDA officials regarding the nature and scope of their surveillance program 

and the technology utilized to intercept and create records of the whistleblowers' activities. The 

FDA's collection, maintenance and/or distribution of a large portion of these documents most 

likely violates § (e)(7). 

We request an investigation of the full and complete extent of these violations, not just 

the violations that are evidenced by the online activities of Quality Associates. 

CONFIDENTIAL DISCLOSURE - PRIVACY ACT PROTECTED 11 

Appendix I: Relevant Documents 
180 


Insert offset folio 135 here 87176.135

VII. Violations of the Privacy Act ofl974, § 552a(e)(9) 

The FDA violated § 552a(e)(9) of the Privacy Act of 1974, which states: 

[Each agency shall] cstablish rules of conduct for pcrsons involved 

in the dcsign, development, operation, or maintenance of any 

system of records, or in maintaining any record, and instruct each 

such person with respect to such rules and the requirements of this 

section, including any other rules and procedures adopted pursuant 

to this section and the penalties for noncompliance. 

The FDA admits that commencing on April 22, 2010, it started to collect and maintain 

records on employee whistleblowers though a highly complex and intrusive warrantless 

administrative surveillance program. The agency admits that it collected and maintained records 

on at least five employee "whistleblowers" who had made in constitutionally and statutorily 

protccted speech to a number of appropriate authorities. Howcver the documents published 

online indicate that at least seven persons were subjected to covert surveillance, and a system of 

records was created on these seven persons. See Surveillance Cache, Bate Stamped No. 1854. An 

additional 14 persons were eventually viewed as "collaborators" with the main whistlcblowers. 

See Surveillance Cache, Bate Stamped Nos. 1023-1024. 

The FDA creatcd this system ofrccords in or about April 2010 without implementing the 

mandatory quality assurance requirements of the Privacy Act. There appears to have been no 

"rules of conduct" published by the agency controlling the behavior of persons involved in this 

program. There appears to be no "rules" govcrning the design of the record collection process. 

Had such rules been implemented, perhaps the agency would not havc willfully and aggressively 

collectcd confidential documents covered under the § (e )(7) exception, and if collected would not 

have distributcd such documcnts to outside contractors and would not have had those documents 

published on the World Wide Web. 

Thcre appears to have bccn no "instructions" given to the persons responsible for 

designing, developing, operating and maintaining the system of records created by the 

surveillance program. 

VIII. Violations of the Privacy Act of 1974, § 552a(e)(1O) 

The FDA violated § 552a(e)(lO) of the Privacy Act of 1974, which states: 

[Each agency shall] establish appropriate administrative, technical 

and physical safcguards to insure the security and confidentiality 

of records and to protect against any anticipated threats or hazards 

to their security or integrity which could result in substantial harm, 

embarrassment, inconvcnience, or unfairness to any individual on 

whom information is maintained. 

The FDA's violation of this provision is extremely troublesome and threatens the 

CONFIDENTIAL DISCLOSURE - PRIVACY ACT PROTECTED 12 

Appendix J: Relevant Documents 
181 


Insert offset folio 136 here 87176.136

financial security of the whistleblowers who were the subject of the targeted surveillance. 

Specifically, as part of its surveillance program, the FDA purchased and authorized the 

targeted use ofthe highly-intrusive Spector spyware to collect and maintain records on suspected 

whistleblowers and their "collaborators." It is clear from a review of the documents FDA 

published online, through its contractor Quality Associates, that the FDA failed to ensure that the 

system of records created with the use of the Spector program contained "appropriate 

administrative, technical and physical safeguards" that would "insure the security and 

confidentiality of records." 

The Spector program permitted FDA to collect highly-personal information regarding its 

employees, including financial and medical data and private passwords to the employees' 

personal third-party email and financial accounts. The FDA was able to obtain fuJI access to the 

whistleblower-employee's highly confidential personal financial information, and it had secret 

access to the codes necessary to effectuate financial transactions from the employee's private 

bank and retirement accounts. 

Thus, FDA officials and unknown other employees or contractors had ready access to 

password-protected financial data, and were in a position to use this information to engage in 

fraud. 

A brief look at a handful of screenshots published online by Quality Associates 

demonstrates that FDA had access to the personal financial information of the targeted 

whistleblowers. For example: 

• Surveillance Cache, Bate Stamped No. 1454 (Private Citibank Email); 

• Surveillance Cache, Bate Stamped No. 1472 (Capital One statement) 

• Surveillance Cache, Bate Stamped No. 1368 (Citibank Debt Card email) 

• Surveillance Cache, Bate Stamped No. 1164 (an AZA Transfer of Funds 

transaction conducted by email); 

• Surveillance Cache, Bate Stamped No. 1292 (email from Vanguard re: investment 

newsletter); 

• Surveillance Cache, Bate Stamped No.: 73660 (email transactions with Mint.com, 

including loan serving transactions, fees charged to Citibank account, fees 

charged to HSBC account, and weekly financial summaries). 

IX. Violations of the Privacy Act of 1974, § 5S2a(m) 

The FDA violated § 552a(m) of the Privacy Act of 1974, which states: 

When an agency provides by a contract for the operation by or on 

CONFIDENTIAL DISCLOSURE - PRIVACY ACT PROTECTED 

Appendix I: Relevant Documents 

13 
182 


Insert offset folio 137 here 87176.137

bchalf of the agency of a system of records to accomplish an 

agency function, the agency shall, consistent with its authority, 

cause the requirements of this section to be applicd to such system. 

For purposes of subsection (i) of this section any such contractor 

and any employee of such contractor, if such contract is agreed to 

on or after the effective date of this section, shall be considered to 

be an employee of an agency. 

This provision mandates that any invcstigation into FDA's misconduct also include a full 

investigation into the actions of FDA's contractor, Quality Associatcs. 

X. Violation of the Privacy Act Requirements of the Federal Acquisition Regulations 

The FDA entered into a contract with Quality Associates to maintain and distribute 

Privacy Act protected documents. Under the provisions of the Federal Acquisition Regulations 

("FAR"), 48 C.F.R. § 24.104, FDA must ensurc that Quality Associates "design, development," 

and "operat[e]" its record keeping systems in conformance with the Privacy Act. Based on the 

public disclosure of the Surveillance Cache, the FDA and I or Quality Associates violated the 

Privacy Act provisions of the FAR. 

REOUEST FOR INVESTIGATION PURSUANT TO 5 U.S.C. § 1213 

The National Whistlcblowers Center hereby requests an investigation of the FDA and 

Quality Associates. Under the Whistleblower Protection Act, the U.S. Special Counsel has broad 

jurisdiction to investigate agency misconduct, including violations of law and gross 

mismanagement. See 5 U.S.c. § 1211, el seq. As set forth above, the FDA grossly mismanaged 

its obligations under the Privacy Act and violated the statutory requirements of the Act, resulting 

in systemic violations of the legal, statutory and constitutional rights of FDA employees. 

In addition, a careful investigation must be conducted into how and why FDA collected, 

maintained and disclosed records related to the whistleblowers' intent to file complaints with the 

OSc. All such complaints are required to be kept confidential as a matter of law, and under the 

Privacy Act FDA could not lawfully collect, maintain or disclose such records. 

The FDA's actions undermine federal workers' willingness to approach Congress, the 

OSC, and the OIG by destroying the presumption of confidentiality. For example, in one 

interccpted e-mail, an FDA worker explains why she was reluctant to file an OSC complaint: 

"Filing will make people really unhappy .... " In response, her correspondent explains that OSC 

filings are confidential: "The names of the persons who file are secret .... " See Surveillance 

Cache, Bate Stamped Nos. 1290. 12 

Subsequently, the FDA published her identity and her affiliation with the whistleblower 

12 The cited document is a screenshot taken contemporaneous with the drafting of the email, and is not the finished 

document. FDA apparently thought this communication was very significant, as it separately collected and 

maintained the final version of the email. Surveillance Cache, Bated Stamped No. 579. 

CONFIDENTIAL DISCLOSURE - PRIVACY ACT PROTECTED 14 

Appendix I: Relevant Documents 
183 


Insert offset folio 138 here 87176.138

group. With the FDA's release of these records, it is now well known and notorious that 

communications with OSC, OIG, and Congress have no guarantee of secrecy nor confidentiality. 

The Surveillance Cache should never have been collected, maintained or distributed. 13 In 

particular, interception of OSC, Congressional, and OIG-related records and communications 

should not be tolerated. Any violations should be subject to the strictest sanction. 

Thank you in advance for your prompt attention to these matters. S~u need any 

additional information, please do not hesitate to contact us by phone at (202)_. 

Respectfully submitted, 

NATIONAL WHISTLEBLOWERS CENTER 

By: 

Lindsey M. Williams 

Director of Advocacy and Development 

National Whistleblowers Center 

13 Although this employee's name was widely disclosed by FDA, in order to minimize the harm caused by FDA's 

violation oflaw, we ask that you not publicly release this person's identity. 

CONFIDENTIAL DISCLOSURE - PRIVACY ACT PROTECTED 15 

Appendix I: Relevant Documents 
184 


Insert offset folio 139 here 87176.139

DEPARTMENT OF HEALTH AND HUMAN SERVICES MEMORANDUM 

Congress of the United States 

House of Representatives 

Representative John D. Dingell 

2328 Rayburn House Office Building 

Washington, DC 20515 

Dear Mr. Dingell: 

Food and Drug Administration 

Office of Device Evaluation 

9200 Corporate Boulevard 

Rockvdle. MD 20850 

October 14, 2008 

This letter seeks your urgent intervention because serious misconduct by managers of the U.S. 

Food and Drug Administration (FDA) at the Center for Devices and Radiological Health (CDRH) 

is interfering with our responsibility to ensure the safety and effectiveness of medical devices for 

the American public and with FDA's mission to protect and promote the health of all Americans. 

Managers at CDRH have failed to follow the laws, rules, regulations and Agency Guidance to 

ensure the safety and effectiveness of medical devices and consequently, they have corrupted the 

scientific review of medical devices. This misconduct reaches the highest levels of CDRH 

management including the Center Director and Director of the Office of Device Evaluation (ODE) . 

•••• ~!!!I~~~ •• at CDRtI have 

The physicians and scientists _ liiiiiiii.lI. are responsible for ensuring the safety and effectiveness of all 

they are used on the American The devices we 

devices constitute a <lIh<t."·ti.1 

American health care system with more than 500 million adult and 

procedures performed every year in the United States. 

It is crucial for FDA to regulate medical devices based on rigorous science. As stated in the 

November 2007 FDA Science Board Report] entitled "FDA Science and Mission at Risk": 

] Available at http://www.fda.gov/ohrmsidockets/ac/07Ibricfing/2007-4329b_02_00_index.html 

Page I of5 

Appendix I: Relevant Documents 
185 


Insert offset folio 140 here 87176.140

"A strong Food and Drug Administration (FDA) is crucial for the health of our 

country. The benefits of a robust, progressive Agency are enormous; the risks of a 

debilitated, under-performing organization are incalculable. The FDA constitutes 

a critical component of our nation's healthcare delivery and public health system. 

The FDA, as much as any public or private sector institution in this country, 

touches the lives, health and wellbeing of all Americans and is integral to the 

nation's economy and its security. The FDA's responsibilities for protecting the 

health of Americans are far-reaching. ... The FDA is also central to the 

economic health of the nation, regulating approximately $1 trillion in consumer 

products or 25 cents of every consumer dollar expended in this country annually. 

The industries that FDA regulates are among the most successful and innovative 

in our society, and are among the few that contribute to a positive balance of trade 

with other countries. The importance of the FDA in the nation's security is 

similarly profound .... Thus. the nation is at risk if FDA science is at risk." 

There is extensive documentary evidence that managers at CDRH have corrupted and interfered 

with the scientific review of medical devices. The scientific review of medical devices is required 

to work as follows: FDA clinical and scientific experts ("FDA experts") review submissions based 

on the best available scientific information and in accordance with the Food Drug and Cosmetic 

Act, the Code of Federal Regulations and Agency Guidance documents (when such Guidance 

documents exist for a particular device or category of devices). FDA experts give their best 

scientific judgments, opinions and conclusions regarding safety and effectiveness of medical 

devices and make corresponding regulatory recommendations. These form the scientific and 

regulatory basis for managers at FDA to make final regulatory decisions (Le., clearance or 

approval of medical devices). While managers can disagree with FDA experts, they cannot order, 

force or otherwise coerce FDA experts to change their scientific judgments, opinions, conclusions 

or recommendations. In accordance with the law, if managers at FDA disagree with FDA experts, 

managers must document their disagreements in official Agency records, must scientifically justify 

any contrary judgments, opinions, conclusions or recommendations and must take personal 

responsibility for their final regulatory decisions. The review process is well described in long 

existing Agency Guidance.2 

The law requires that qualified experts make safety and effectiveness determinations based on 

.vaiiiliiidiis.ciiie.n.tific evidence. Managers at CDRH with no scientific or medical eXilre.rt.is.e.i.n.1II!I1. • devices, or any clinical experience in the practice of medicine._ 

have ignored serious safety and effectiveness concerns of FDA experts and have ignored scientific 

regulatory requirements. To avoid accountability, these managers at CDRH have ordered, 

intimidated and coerced FDA experts to modify their scientific reviews, conclusions and 

recommendations in violation ofthe law. Furthermore, these managers have also ordered, 

intimidated and coerced FDA experts to make safety and effectiveness determinations that are not 

in accordance with scientific regulatory requirements, to use unsound evaluation methods, and 

accept clinical and technical data that is not scientifically valid nor obtained in accordance with 

legal requirements, such as obtaining proper informed consent from human sUbjects. These same 

2 Available at http://www.fda.gov/cdrh/g93-l.html. 

Page 2 of5 

Appendix I: Relevant Documents 
186 


Insert offset folio 141 here 87176.141

managers have knowingly avoided and failed to properly document the basis of their decisions in 

official Agency records. 

Under the banner of regulatory "precedent," managers at CDRH have demanded that physicians 

and scientists review regulatory submissions employing methods, and accepting evidence and 

conclusions, that are not scientifically proven and clinically validated. These demands appear to 

be based on the misguided notion that because flawed methods, evidence and conclusions were 

used or accepted in the recent or even the remote past, we must continue to blindly and knowingly 

accept these flawed methods, evidence and conclusions and continue to use them as the basis for 

regulatory recommendations. Such invalid regulatory "precedent" goes against current scientific 

and clinical evidence. Rather than remedy past regulatory or scientific errors after they come to 

light, and rather than applying the best and latest scientific knowledge and methodology, these 

managers at CDRH knowingly continue to make the same regulatory and scientific mistakes over 

and over again. Rather than recall, re-evaluate or otherwise deal with potentially unsafe or 

ineffective devices that are already on the market, these managers at CDRH continue to approve 

more devices of the same kind in a non-transparent and non-scientific manner. This is especially 

true of the 51 O(k) program but also applies to the PMA program as well as the advice and guidance 

given to manufacturers before they make regulatory submissions. The practices described above 

represent an unwarranted risk to public health and a silent danger that may only be recognized 

after many years. 

When physicians and scientists have objected to the management practices described above, 

managers at CDRH have engaged in reprisals and ignored these critical concerns. FDA physicians 

and scientists therefore contacted the Office of the Commissioner: 

On May 31, 2008,. FDA physicians and scientists.~!!I •• I!I".~ •••• wrote to 

the FDA Commissioner, Dr. Andrew von Eschenbach (See attached letter). 

The Commissioner immediately asked Mr. William McConagha, the Assistant Commissioner 

for Integrity and Accountability, to begin a full investigation. 

Sincc early June 2008, FDA physicians and scientists have met with Mr. McConagha 

numerous times and have facilitated his investigation by providing written documentary 

evidence including internal emails, reviews, memos, meeting minutes, etc. 

Mr. McConagha has characterized the documentary evidence as "compelling," "convincing" 

and "sufficient" to justify curative and disciplinary actions. As a result, the Commissioner met 

with the CDRH Director in August. 

On September 3, 2008,. FDA physicians and scientists ....... ~ •••• 

met with the Director ofCDRH in the presence of representatives from the 

Commissioner's Office. At the request ofMr. McConagha, the FDA physicians and scientists 

presented the issues and documentary evidence to the Director of.CDRH (See attached 

presentation). 

Page 3 of5 

Appendix 1: Relevant Documents 
187 


Insert offset folio 142 here 87176.142

The Director of CDRH then conducted his own investigation and concluded that we, FDA 

physicians and scientists, need to "move forward," thus allowing managers to avoid and evade 

any accountability and without taking any curative or disciplinary actions whatsoever. The 

Director of CDRH has further aggravated the situation by knowingly allowing a continuation 

of management reprisals. These reprisals now include removal and threatened removal of 

physicians and scientists _ as well as illegal and improper 

employee performance evaluations. 

• On September 29, 2008,. FDA physicians and scientists wrote a second letter to Dr. von 

Eschenbach (see attached letter). 

To date, despite involvement by the Commissioners Office, there has been enormous internal 

resistance from entrenched managers at CDRH including the Center Director and the Director of 

ODE. These managers seem far more concerned about ensuring their current positions and 

protecting and promoting their own careers and those of their cronies, than they are about ensuring 

the safety and effectiveness of medical devices and protecting and promoting the health of all 

Americans. CDRH managers prefer to employ regulation-based "pseudo-science" rather than 

science-based regulation. 

It is evident that managers at CDRH have deviated from FDA's mission to identify and address 

underlying problems with medical devices before they cause irreparable harm, and this deviation 

h.as placed the American people at risk. Given the large number of _ 

submissions to the FDA, the complexity of the scientific and medical issues involved and the 

of I devices to the practice of medicine, we believe that grgeer regulation of 

the establishment of a new and separate Office at FDA • _ • jiiiiiiiillii: This Office must be staffed by expert physicians and scientists at all levels 

including management and must provide vision and leadership by being proactive rather than 

reactive, by incorporating the latest scientific and technological evidence into device evaluation, 

compliance and post-market surveillance, and by making all regulatory decisions in a transparent 

manner based on sound scientific and clinical principles. At the same time, there is a need for new 

legislation that modernizes the regulatory structure of the 51 O(k) program so that complex medical 

devices are not allowed onto the market without a comprehensive (or in some cases, any) clinical 

evaluation of their safety and effectiveness. This is especially true for devices due to 

their markedly increased use in clinical practice and because devices employ highly complex 

hardware and software, undergo rapid technological changes and touch the lives 0 f so many 

patients on a daily basis. The current framework for medical device adverse event reporting does 

not work for many devices as the adverse effects of 

_ devices are rarely detected immediately, are not transparent on an individual patient basis, 

and can only be prevented by a rigorous pre-market evaluation process. 

FDA leaders need to re-establish the trust of the American people. Congress needs to ensure that 

FDA physicians and scientists can do their jobs by being allowed to follow the laws, rules and 

regulations without fear of reprisal, by applying the best and latest scientific knowledge and 

methodologies, by having an updated modem regulatory structure, and by allocating sufficient 

financial and other resources to FDA. I Finally, FDA leaders and Congress must restore 

compliance with the law, must hold accountable those managers at FDA that fail to carry out the 

Page 4 of 5 

Appendix I: Relevant Documents 
188 


Insert offset folio 143 here 87176.143

FDA mission to protect and promote the health of all Americans, and must protect FDA physicians 

and scientists so that they can protect the American pUblic. 

As the Branch of government responsible for oversight of the FDA, we urgently seek your 

intervention and help. 

Page 5 of 5 

Appendix I: Relevant Documents 
189 


Insert offset folio 144 here 87176.144

{ " ..... "'Jd -f.. DEPARTMENT OF HEALTH &. HUMAN SERVICES 

,~::J 

JUL 1 3 2012 

The Honorable Darrell Issa 

Chairman .. 

Committee on Oversight and Government Reform 

House of Represenlatives 

Washington, D.C, 20515 

Dear Mr. Chairman: 

JUL 1 6 2012 

Food and Drug Administration 

Silver Spring, MO 20993 

Thank you for your leiter of February 9, 2012, requesting information about the use of computer 

monitoring by the Food and Drug Administration (FDA or the Agency) to investigate the ilIega! 

and unauthorized release of confidential information related to medical device applications and 

submissions. 

In connection with this matter, there are severa! cases in active litigation and open investigations 

by the U.S. Office of Special Counsel (OSC). Further, on June 14,2012, in response to a request 

from OSC, the Secretary of Healtll and Human Services (HHS) asked the HHS Office of 

Inspector General (DIG) to conduct an investigation of the premarket review process for some 

medical device applications and submissions, which, in part, relate to the aforementioned 

unauthorized disclosures. The litigation, OSC investigations, OIG referral, and commensurate 

need to understand all the facts surrounding the improper disclosure of con fidential information, 

and the subsequent Agency response, require a thorough and deliberate review of events. This 

review must respect the rights of individual employees as well as protect governmental legal 

prerogatives. Such constraints might limit the Agency's response to questions related to matters 

involved in the litigation and open investigations. Please accept my apology for the delay in 

responding due to the pending investigations and litigation related to Ibis matter. 

FDA recognizes and appreciates the Committee's legitimate oversight interest in the issues 

raised in your letter. We share your concern that OUr employees be afforded all appropriate and 

available opportunities to raise issues relating 10 Agency policies and decisions. At the same 

lime, FDA has important obligations to ensure the integrity of the medical device premarket 

review process, which requires FDA, including the Center for Devices and Radiological Health 

(CDRH). to routinely receive and review trade secrets and confidential commercial information 

submitted by regulated entities, the disclosure of which could cause competitive harm to the 

company submitting the information. Congress has enacted statutes that expressly prohibit FDA 

personnel from disclosing trade secrets and confidential commercial information. Such 

unauthorized disclosures not only violate federal law and undermine the integrity of FDA 

programs; they also can result in civil suits against FDA andlo! criminal and monetary penalties 

against its employees. In many instances, the mere fact that a device firm has submitted a premarket submission or application is itse1fconfidential. Similarly, details about a company's 

Appendix I: Relevant Documents 
190 


Insert offset folio 145 here 87176.145

Page 2 The Honorable Darrell Issa 

product in development, or the data and information concerning a product's safety and 

effectiveness, could give the company's competitors an unfair advantage by providing previously 

unavailable insights into the development process, and disclosure of such details could 

undermine incentives for innovation and competition in the commercial market. Protection of 

this highly sensitive information is of utmost importance to FDA. 

Please note that this response may include information that is t:ade secret, commercial 

confidential, or other information otherwise protected from disclosure to the public, for example 

under the Freedom of Information Act (5 U.S.c. § 552), the Trade Secrets Act (18 U.S.c. § 

1905), the Federal Food, Drug, and Cosmetic Act (21 U.S.c. § 331 U), and Agency regulations. 

We respectfully request that the Committee not publish such information in order to preserve the 

proprietary and competitive interests of the companies involved, as well as other significant 

interests. FDA staff would be pleased to discuss with Committee staff the protected status of any 

specific information. 

Please also note that this letter reflects FDA's current understanding of the facts pertaining to 

this matter and is based upon the Agency's review of the matter to date. 

FDA conslrues the questions in your letter to relate to the individuals who were signatories to the 

January 2009 letter to which your letter refers, ~s well as to Lakshmi Vishnuvajjala, who, though 

not a signatory, was one of the five individuals whose computer activity was monitored by FDA 

pursuant to the Agency's investigation into suspected unauthorized disclosures by CDRH 

personnel. 

We have restated your speclfic questions below in bold, followed by our responses. 

I. Identify the individuates) responsible for deciding to initiate monitoring of the personal 

e-mail accounts of the FDA Nine. 

In 2009 and 20 I 0, fDA became aware of a series of unauthorized disclosures of confidential 

information contained in various medical device premarket applications and submissions llnder 

review. For instance, on January 13,2009, The Xew York Times (Times) published an article that 

included confidential information from iCAD's then-pending premarket approval application 

(PMA) for its SecondLook Digital Computer-aided Detection for Mammography device. 

According to information iCAD provided to FDA, the article's author informed the company that 

he had received "internal FDA docwnents" regarding the device from "Scientific Officers of the 

FDA." On January 13,2009, legal counsel for iCAD sent a letter to the CDRB Ombudsman 

expressing concern regarding the apparent disclosure by FDA of the company's confidential 

PMA information. The ~anuary 13,2009, Times article also quoted from an internal Agency 

memorandum regarding the pending review of Shina Systems' submission seeking clearance to 

mark<:t ilS AngioCt device. A consultation review memorandum on the premarket notification 

submission ircfclTcd to as u "510(k),,) had been written on Ma!'ch 14,2008, by other CDRH 

personnel to a CDRH staff fellow, and Dr. Robert Smith, an FDA 

medi cal 0 fficer 

Appendix I: Relevant Documents 
191 


Insert offset folio 146 here 87176.146

Page 3 - The Honorable Darrell Issa 

Then, on April 16, 20 I 0, CDRH received a letter from legal counsel for GE Healthcare Inc., 

alleging that FDA had disclosed to the press confidential information from the firm's pre market 

notification submission for a new CT colonography screening indication for its CT 

Colonography II image analysis software visualization device. The letter referenced a March 28, 

2010, Times article as evidence that confidential information from the company's 51 O(k) 

submission had been leaked to the press in violation of federal law, FDA regulations, and 

internal Agency policy. This article referred to n[sJcores of internal agency documents made 

available to The New York Times." Although the article did not disclose the source of the 

internal agency documents, it included quotes from both Dr. Robert Smith and former FDA 

contractor, Dr. Julian Nicholas. The firm requested that FDA "conduct an internal investigation 

into how this information was leaked to the press." 

The question of the authorization of monitoring is being addressed in the OSC investigation you 

and Senator Grassley have requested, as well as the pending litigation, and the Agency is still 

identifying and gathering evidence with respect to these issues. 

We can assure you, however, that the Agency did not monitor these individuals' use of nongovernment-owned computers. To the extent an individual elected to use a government 

computer to engage in correspondence using a personal e-mail account, data derived fTom such 

use were collected in the same manner as were data derived from other uses of the governmentissued computer. 

2. IdentifY each employee who was the subject of any form of surveillance, ineiuding, but 

not limited to, screen captures and e-mail monitoring. 

FDA authorized active monitoring of the use of government-owned computers by the following 

individuals: Ewa Czerska, Paul Hardy, Robert Smith, and Lakshrni 

Vishnuvajjala. 

3. State the date on which surveillance started for each employee identified above. 

Software-enabling active monitoring of computer activity was installed by FDA as follows: 

Robel1 Smith - April 22, 2010 

• Paul Hardy - May 24, 20 I 0 

June 30,2010 

Ewa Czerska - June 30,2010 

• Lakshmi Vishnuvajjala-- June 30, 2010 

As listed above, software-enabling computer monitoring was installed on Dr. Smith's 

government-issued computer on April 22, 2010-five days after FDA received the GE 

Healthcare letter alleging unlawful public disclosure of confidential information. During the 

course of monitoring Dr. Smith's use of his government-issued computer, evidence was 

uncovered suggesting that certain additional CDRH personnel were participating in unauthorized 

Appendix I: Relevant Documents 
192 


Insert offset folio 147 here 87176.147

Page 4 The Honorable Darrellissa 

disclosures of information, a'1d monitoring was expanded to include these additional personnel, 

as noted above. 

Although your letter states that "[ t1he first documented interception of an e-mail occurred in 

January 2009," this is incorrect. As indicated above. in no case were any of these individuals 

subject to computer monitoring prior to April 22, 2010. Screenshots of e-mails that were 

originally sent or received prior to the date on which monitoring was initiated could only have 

been captured as a result of the individual having opened or reopened the e-mail message on 

his/her FDA computer after the date monitoring was commenced. 

4. For any individual no longer employed by FDA whose e-mail was monitored, please 

explain the circumstances of departure from the agency, including relevant dates . 

••••• was II General Schedule employee who was removed from her position on 

April 29, 20 II. for unauthorized disclosure of confidential information. Pursuant to an 

agreement recently reached between OSC and both HHS and FDA, has been 

temporarily reappointed with pay through July 31,2012. 

• was a Commissioned Corps officer within the U.S. Public Health Service, 

who was not recommended for promotion by the Annual Promotion Board in September 

2011. On October 9, 2011, he was terminated from the Regular Corps pursuant cO ('2 

U.S.C. § 2J \(g), 

••••• III.was at FDA as a limited-term staff fellow appointed pursuant to 42 

U.S.C. § 209(g). Hn term appointment expired on November 6, 2010 . 

•••••• wa5 a Schedule A Appointment Medical Officer. His term appointment 

expired on July] 1,2010. 

S. Explain the extent of thc agency's surveillance of the FDA Nine, including a description 

of the methods for and frequency of any surveillance. 

As noted above, FDA collected data regarding certain personnel's use of their governmentowned computers. For each of the individuals subject to computer monitoring, data were 

collected from the following sources: 

Screenshots, taken every fIve seconds. of the totality of whatever was visible on one or 

more monitors in use for a given government-issued computer; 

All e-mail sent or received to/from a given government-issued computer; 

All network activi:y to/from the government-issued computer; 

All data stored on and printed from the government-issued computer or on external 

storage drive connected thereto; and 

All keystrokes performed on the government-issued computer. 

Appendix I: Relevant Documents 
193 


Insert offset folio 148 here 87176.148

Page 5 - The Honorable Darrell Issa 

According to individuals involved at the tirne, as well as our review of the rnatter to date, the 

data collected were searched to identify records of correspondence leaving the FDA network in 

which the e-rnail or any attachrnent to it contained the terrn "colonography" or the letter "k" 

irnrnediately followed by a series ofnurnbers. the latter being intended to identify reference to 

specific 51O(k) prernarket notification subrnissions as to which FDA had received cornplaints 

about irnproper disclosures of confidential inforrnation. Later, the search pararneters were 

broadened to include terrns beginning with the letter "p" or "g," followed by a series of nurnbers, 

which would potentially correspond to prernarket approval device applications or investiga.onal 

device exernption applications, respectively. Search terrns were also eventually expanded to 

include the narnes and rnanufacturers of products about which it was suspected unauthorized 

disclosures rnay have been/or were being rnade. FDA also endeavored to identify e-rnails being 

sent to individuals outside the FDA network that appeared to include confidential Agency 

records. 

FDA is not aware of any information that suggests that Agency personnel collected passwords 

for individuals' personal e-rnail accounts. According to the forensic engineer principally 

involved in the cornputer rnonitoring, to the extent individuals' passwords rnay have been 

captured, it would have been incidental to the objective of the rnonitoring and FDA did not 

utilize or otherwise take any action related to such passwords. 

To the extent FDA becarne aware of the use of personal e-rnail accounts to transrnit information, 

it was either through the identification of screenshots, which in rnany cases recorded 

correspondence that had heen accessed on an FDA cornputer, or because the individual used his 

or her FDA e-rnail account to send Agency records to his or her own personal e-rnail address. It 

should be noted that once rnonitored individuals transrnitted Agency records to their own 

personal e-rnail account, in rnany cases the records were alrnost irnrnediately forwarded further 

to individuals outside the governrnent. 

Note that since 2009, all users of the FDA cornputer network have received notice upon logging 

into an FDA cornputer that they should have no reasonable expectation of privacy when utilizing 

the FDA cornputer systern. l 

I For example, upon logging 011 to the FDA network, users immediately receive the following warning message: 

You nre accessing a U.S. Government infonnation system, which includes (J) this computer, (2) this 

computer network, (3) aU computers connected to this network, and (4) all devices and storage media 

attached to this network or to a computer on this network, 

TIlis information system is provided for U.S. Government-authorized use only, Unauthorized OT improper 

use of this system may result m disciplinary action, as well as civil and criminal penalties. 

By using this information, you understand and consent to the following: 

You have no reasonable expectation of privacy regarding any communications or data transiting or 

stored on this information system, At any time, and fO!' any lawl\tl government purpose, the 

government may monitor, intercept, and search and seize any communication or data transiting OT 

stored on this information system, 

Appendix I: Relevant Documents 
194 


Insert offset folio 149 here 87176.149

Page 6 - The Honorable Darrell Issa 

6. State thc purposc of the agcncy's surveillance of the FDA Ninc. 

FDA initiated monitoring of the government-owned computers of the five individuals identified 

above for two principal purposes: I) to identify the source of the unauthorized disclosures, if 

possible; and 2) to identify any further such unauthorized disclosures so as to better enable FDA 

to facilitate their cessation, 

Your letter states that "it appears that FDA targeted these employees for surveillance because 

they talked to Congress," Beginning as early as October 2008, FDA had begun receiving letters 

and other inquires from multiple Congressional offices regarding concerns brought to them by 

various members of the group of individuals you reference. These inquiries made clear that 

CDRH personnel were seeking the intervention of Congress. Nonetheless, it was not until 

approximately 18 months ~er FDA began to rcceive such inquiries that the monitoring of Dr. 

Smith's government-owned computer activity was initiated. The impetus for the monitoring was 

not any communication to Congress. Rather, the impetus for monitoring was the II larch 20J 0 

Times article and the receipt of the OE Healthcare letter just prior to the initiation of monitoring, 

which indicated that the preceding pattcrn of similar unauthorized disclosures of confidential 

information from other pending medical device applications and submissions was continuing 

unabated. It should also be noted that, in conducting the computer monitoring, data were 

collected without regard to the identity of the individuals with whom the user may have been 

corresponding. 

7. Explain the legal justification relied on by FDA to initiate survcillancc of the FDA Nine. 

As explained above, this ma:ter is the subject of current litigation, It should be noted, however, 

as described above, that since 2009 all users of the FDA computer network have received notice 

upon logging in that they should have no reasonable expectation of privacy when utilizing the 

j·DA computer system, Please see footnote 1 for the text of the infonnation that all users 

receive. 

You have also requested documents, and we have restated below your requests, followed by our 

responses. 

1. Documents referring or relating to the FDA Nine collectively or individually, including, 

but not limited 10, all communications 10 or from Grcgory Campbell, Dr. Jeffrey 

Shurcn, Ruth McKcc, Ralph Tyler, or Dr. Joshua Sharfslein. 

Any communications or data tran<;.iting or slored on this informatIOn system mllY be disclosed or used 

tOl' any lawful government purpuse. 

T~.e above warning has been in continuous use since a~ least September 2U I U, and a s:milar wanting was in lise at 

the time the monjtOling, as. described herein, W<J,S initialed Addi!ionally, all FDA personnel afC lequlred to receive 

Computel Security Awareness Training annually, dUring which they are reminded, among other thing~, that all 

network actiVIty may be monitored The employees aho~ll whom you have inq'Jiled recel\:ed 5\lCh an:1Ual training 

Appendix I: Relevant Documents 
195 


Insert offset folio 150 here 87176.150

Page 7 - The Honorable Darrellissa 

FDA is continuing to gather responsive documents, which will be provided in a rolling 

production. 

2. Documents created or obtained as a result of e-mail monitoring since January 1,2009, 

including but not limited to all documents in the file named "FDA 9." 

As noted above, FDA did not commence the computer monitoring discussed above until various 

dates in 2010. The Agency is continuing to gather responsive documents, which will be 

provided in a rolling production. 

3. Guidance from the Office of the General Counsel referring or relating to monitoring 

employee e-mail accounts. 

We are working to identify any documents that may be responsive to this request. 

4. Guidance from the Office of the Inspector General referring or relating to monitoring 

employee e-mail accounts. 

We are not aware of documents provided to FDA by OIG that provide general guidance, with 

respect to the monitoring of employee e-mail accounts. 

Thank you, again, for contacting us concerning this matter. If you have further questions. please 

let us know. 

cc: The Honorable Elijah E. Cummings 

Ranking Member 

Sincerely, 

Jeanne Ireland 

Assistant Commissioner 

for Legislation 

Committee on Oversight and Government Reform 

Appendix I: Relevant Documents 
196 


Insert offset folio 151 here 87176.151

r"e 

I...~', . 

j'roo; 

Dale: 

:"ub)ecr 

Interim Report of Investigation 

L<:lD Dav1s, ChIef Information Officer 

Joe Albaugb, Chief Info=aooo Security Officer 

Joe Hoofnagle, Incident Response and ForenSIc Lead; Chnstophel Newsom, 

InCldent Response and Forensic Invesugawr 

June 3, 2010 

[nlaim Report of lnvesng~uoos - Robert C. SMITH 

h i'vby of 2010 speciEc al!egatir,os were presented to the I'D,\ Seeuoty Deparunent r<g"ding 

P,obw c: SMITH, ~v!edieal Ofncer - CDRH/ODE/DRARD These allegauons ptrt"'Md to the 

fullowL1g 

Ghost writing HIS subordinates' repom, 10 particular those surroundmg those reports [1., 

ate ,dennaed by the letter "K" followed by SIX (6) numbers, 

S"flTfl commuoicanog wHh external news sources (press) regarding HIS concerns o\'cr the 

f'DA's approval process of parbcuhu medJcal devires slilloullding CT scan5 and 

colonograpby n,,> allegaoon particularly related to GardlOer Harris, reponer for the Ne\" 

Yors. Tlme~. 

T1,e Security Departmeot bas U1Jtateci a review of FDA data sources associated ~!ith SMITH In 

detccminl' the vahdlty of the aUego~ons, The analy~cal findwgs to d'le .ppe.r to suppOrt the 

;1JlcgaDon", however the revIew is ongoing and substantial vohnnes of data are currently beIng cullcci 

The subr!Id.m3rc loformation that follows conta.Jns 

['[),~ person.nel that appear to be ir,volved \Vlth the aDegauons, 

Commun.lcaoons wah e'!temal press SOUJCCS j lDduding Gardmer HarriS, [cporter for (he 

Nco,' York Tune.<;, 

(oilabor.bon amongst FDA petsonael and enetual sources to prov,de dcf,matoP' 

In{,)lmaboll aLom the ffiA approval process :l.S \VC)] as ISSUeS reg::lrdll1g hosw(' wod'L 

envIronment and dlscrlmlnltlon, 

Dlstri!:n..!uon orpotcmialJy sensitive mformatlon to external, non FDI\ sources. and 

[n~'ormatioD indicating porenoal involoement of Congress rnember(s) ser\'Ulg as conduit, [') 

the pre:;s 

Appendix I: Relevant Documents 
197 


Insert offset folio 152 here 87176.152

2 

Interim Report of Investigations .. Robert C. SMITH 

Subjects 0 f J nterest: .................... . 

Primary Subjects .................... . 

Secondary Subjects ................................................................................. , ....... .. 

Ancillary Subjects ...... , ......................... "..................... .. ................................ .. 

Media Outlet Subjects............................................. .. ....................... .. 

I n'trim Report of Analysis & Findings ....... , ................................ " ............ . 

Allegation 1: Ghost Writing ........................... " ................. '" .... , ...... , .. , .... , .. , .... ". 

.3 

..3 

.. ............ 4 

.. ............. 4 

.. .. 6 

.. .. 6 

Allegation 2: Supplying Iatemal Documents and Information to External Soul'ces ... G 

Possible Fumre Concerns: .............................................. .. ........................... .. .. 7 

Possible Poteatiallssue: ................................................. .. .. ................................... " ....... 8 

Possible Coll.bor.tion Issue: ............................................. , ................................... . .. 8 

Appendix I: Relevant Documents 
198 


Insert offset folio 153 here 87176.153

Interim ReS Report of Analvsis & Finriil1Ps 

~ l:nderlined items indicate findings ]lost "Preliminary Res Analysis Results.doe" 

AllrgaliolJ 1: Ghost Writing 

Indications of ReS receiving documents and email fiTlm co-workers / cocom plainants pel1aining to investigation via FDA email and Gmail 

Documents being edited by ReS and retullled via Gmail- Mostly investigation 

related documentation. 

Lengthy suggestions of content to be used supplied by ReS via lImai!. These are 

contained in body of email for use by reci pients (co-workers I co-complainants) 

Documents helll>! edited hv ReS and retl!!lled via Gmail- Identified Device 

Rcvie\' . .: dl)\,..·ltm~IltS;l'()n cSfH l~h.lcn('L·. 

\bnv orthe above rdcrenced documents and communications arc currentlv '~l>il1g 

to .IN for re\'i,'\I" inPlit. 

\'iew All possible !!lstances of the above allegation in order by date 

.:llli'xalion 2: Suppl\'in(l Internal Docnments and Information to External Sources 

i\lultiple Gmaii contacts with (Jardiner HalTis - NY Times 

Identified multiple Gmail communicatIons between ReS and Gardiner ilarrlS 

regarding telephonic communications and in-person meetings 

\'iew All instances orthe above not cd in order by date 

:'.1ulti pie Gmail contacts with Matthew Perrone Associated Press Ncws 

Identified multiple Gmaii communications between RCS and Gardiner Harris 

regarding telcphonic communIcations and in-person meetings 

\'iew All rnstances of thc above noted in ordcr by date 

Multiple Gmail contacts with Alyah Khan Insidc Washington Publishers news 

organization 

ReS Received intcmal document via Gmail from Kahn reference Chris 

\'an Hollcn Alyah requcstcd in same cmail not to be revealed as source 

or distnbute document. 

View All instances or the above noted in order by date 

Appendix I: Relevant Documents 
199 


Insert offset folio 154 here 87176.154

oRCS currently assisting Khan with editing story regarding Chris Van 

Hollen 

View All instances of the above noted in order by date 

o Kahn indicates the "editor" wants to hold the "Van I !ollen story" as of 

May 14,2010 

View All instances of the above noted in order by date 

o RCS and IN are in communication with Kahn regarding aJ1icles 

View All instances of the above noted in order by date 

o RCS and IN are in communication with Robert Lowes (Unknown News 

OI:U) Olav be an associate of Kahn's 

View All instances of the above noted in order by date 

• Multiple Gmail contacts with Joe Bergantino and Rochelle (unk last name} - RCN 

Cable Washington based Direct Cable provider) 

Identified mUltiple Gmail communications between retluesting times to meet and 

talk. 

View All instances of the above noted in order by date 

R CS and IN received communication from Laine), Moseley - {Philadelphia 

Journalist of Unknown News Org) -I.()()king for a "Biguer Swrv" on CT scans. 

patient safety and FDA recolllmendations. 

View All instances of the above noted in order by date 

• Multi.DJc Gmail contacts with Ned Feder (POGO - Project On Government 

Oversi,g)1t- non affiliated non projitl- Emails include allachments with 

signiticant amount of documents. 

View All instances of the above noted in order by date 

• MultinJe GmaH contacts with Jack Mitchell (agin!!.senate.go\') - Emails include 

allachments with si(!nific<1nt amount of documents includinl! those self-redacted. 

View All instances of the above noted in order by date 

Appendix I: Relevant Documents 
200 


Insert offset folio 155 here 87176.155

Multiple Gmail contacts with IN - Emails include attachments with significant 

amount of documents including those self-redacted 

View All instances of the above noted in order by date 

• Multiple Gmail contacts with Joan Kleinman (District Director for Rl!~ Chris 

Van Hollen) - Emails include attachments with signiticant amount of documents 

including those self-redacted. 

View All instances of the above noted in order by date 

Possible Future Concerns: 

Gmail from Paul/lardy stating "Time to pound them into dust -1 think its time to 

talk to Joe about the documentary on Frontline" - Received May II, 20 I 0 - (Joe 

is an unknown person) 

View All instances of the above noted in order by date 

• Gmail correspondence indicnting that Julian Nicholas has reapplied to CDRH and 

is heing considered for a position. 

View All instances of the above noted in order by date 

Possible Potential Issue: 

Gmail cOlTespondence with outside physician(s) - Possible FDA research 

knowledge being leveraged (ref CON and STARK) CSIRT not sure whether or 

not is these are FDA intemal projects. 

View All instances of the above noted in order by date 

lmal!e of Certificate of Remillance (transfer) from Shinan Bank dated 4115/09 

viewed on 4/26/20 I 0 

View All instances of the above noted in order by date 

Appendix I: Relevant Documents 
201 


Insert offset folio 156 here 87176.156

Possible Collabol'ation Issue: 

• Numerous FDA emails and Gmail amongst primary and secondary actors 

indicating collaborative cOiTespondence regarding review, editing, compilation, 

production or distribution of verbiage, documentation and information pertaining 

to medical reviews, CUlTent investigations, claims against HHS/FDA, and release 

of information to extemal organizations. 

View AI! instances of the above noted in order by date 

• Emails among Actors indicating a collaborative plan to produce a document 

defamatory to IIIIS/FDA that will be passed to Joan Kleinman. leaked to the press 

on Chris Van 1I0llen's letterhead and returned to Van Hollen's Office 

View All instances of the above noted in order by date 

• Email amOII!! Actors indicating a collaborative plan to modifv document(s) to 

reflect only inconsistencies and remove allY speCUlative information. 

View All instances of the above noted in order by date 

Appendix I: Relevant Documents 
202 


Insert offset folio 157 here 87176.157

March 23,2009 

To: Leslie W. Hollie 

Supervisory Special Agent 

Office of Investigations 

Oftlee of Inspector General 

Department of Health & 

From: Les Weinstein 

Ombudsman 

MEMORANDUM 

Center for Devices and Radiological Health (CDRH) 

Food & Drug Administration 

Depar1J:>J.ent of Health & Human Services 

As you requested, enclosed are documents related to the Radiological Devices Branch 

and the current allegations. 

Please contact 1!:e if you need any additional information. 

Thank you. 

Appendix I: Relevant Docwnents 
203 


Insert offset folio 158 here 87176.158

January 13. 2009 

BY HAND DElJVER Y 

PMA Document Mail Center (HFZ-401) 

Center for Devices and Radiological Health 

Office of De\;cc Evaluation 

Food and Drug Administra1ion 

9200 Corporate Bouievard 

Rockville, MD 20&50 

Hogan " Hartsoo U1 Columbia Squat! 

S5S~S_~NW 

.. 

wwwllhlaw.com 

John J. Smith, M.D., 1.0. 

Re: Possible Diic!osure of Confidential ieAD, Inc., PMA Application Information 

(POlO03g, 

Attn: Les S.YhinSieiu (HFZ-5) 

Dear Mr. Weinst"in: 

. On behalf of our cli~nt, iC.>\D, Inc. ("iCAD" or "the company~), we are .... Titing to provide the 

U.S. Food and L~g Ad!:ninistrntion ("FDA" or the "agency") with the company's letter 

describing possible disclosure of confidential information contained within the company' s PM-A.. 

application. 

Should you have any o,.uestioDS regarding this enclosed letter. please contact me at the number 

above. 

Sincerely. 

\+~~ John~. Smith, M.D., 1.0. 

Enclosure:! 

Appendix I: Relevant Documents 
204 


Insert offset folio 159 here 87176.159

i.;i,-,: 157 PM 

Shuren, Jeff 

From: 

Sent: 

To: 

Cc: 

Subject: 

Attachments: 

WeInstein, Les S 

Fridar 0nom 23 20096:06 PM 

Shuren. Jeff 

Unauthorized Disclosures 

DocumenLpdf;_ audit.xls; NYT Jan 13 2009.pdf;_- clinical cardiology review 

_March 26 200B.doc; Document pdf; Documentpdf 

Mr. Hollle- -As you had suggested dunng our phone conversatlOn yesterday. I am sending you this email regarding a 

third (# 1 below) unauthorized and inappropriate disclosure of information to the press in, or from, intemal FDA documents 

regardIng the review of marketing applications submitted 10 the Office of Device Evaluation (ODE) in FDA's Center for 

DevIces and Radiological Health (CDR H), FDA is referring this to OIG for an investigation into this dIsclosure 11"1 addition to 

the other two disclosures (#2 and #3 below) we previously referred to DIG earlier this year. 

1. On October 1, 2009, Dr. Jeff Shuren, Acting Center Director: Dr. Bram Zuckerman, Director of the Division of 

Cardiovascular Devices {OCO}; Mathew HiUebrenner, a Branch Chief in DCD; and Timothy Ulatowski, Director of the 

Office of Compliance, participated in a Wall Street Jo~phone interview with reporter AIic~a Mundy regarding the 

Edwards dETloglX annuloplastv ring ((510(k} number_. To their surprise Ms. Mundy was. able tolls1u,ot.e.f,ro.m.lh.e. 51 O(k) reviewer's memo on which IS attached. The memo was completed by the lead reviewer. ~ •• II • 

on April 9. 2009. The 510(k} has since been cleared for marketing. It is on IMAGE (an electronic Imaging system for 

CDRH documents). Dr. Zuckerman believes that someone from CDR\! accessed IMAGE (which anyone in CDRH can do) 

and sent this document out Reviewer memos are disclosable under FOIA but only after they have been officially 

requested and appropriately redacted The CDRH FOIA office informed me that this memo has not been requested or 

released via FOiA, and that it contains trade secret (TSI) and confidential commercial information (CCI) that is not 

disclosable. The following memo has portions marked in pink on pages 2. 10, 11, 14, 16 and 19 indicating TSI (trade 

secret informatlon) and eCI (confidential commerci~1 information) 

DOOJment.pdr (5 

MB) 

10 get a list of people who electronically accessed the memo, we asked our IT staff to search IMAGE audit information 

from the date of the memo (AprjI9) up to and including the date of the Interview w'th Ms. Mundy (October 1). The folloWing 

list shows that four people accessed the 25~page document mdlcated by the color green in column E (The color yellow 

indIcates a related 2-page document that is fully disclosable; I am not attaching this document.) 

g~ 

@j 

-"udll~5 

(20 KB) 

For further Informafion please contact me or Dr. Zuckerman. 

2. AngioCT device (K071S?1) (DCD) wrote the attached consult review memo on _to_ 

~and Dr Robelt Smith, both from the Radiological Devices Branch (ROB) in the Division of Reproductive. 

Abdomina,. and Radiological Devices (DRARD). The memo is dated March 26, 200B. Dr._was made aware of the 

release of this memo when ft appeared In the attached New York Times alticle on Janua:y 13, 2009. Please let me know If 

OIG needs any information In addition to what FDA has already sent. 

Appendix 1: Relevant Documents 
205 


Insert offset folio 160 here 87176.160

NYT Jan 13 

2009.pdf (36 KB) 

~ aJ _-dinl",1 

cardiology ... 

3. iCAD appealed their PMA. P010038JS12. for the SecondLook Digital product for mammography: Gardiner Harris (New 

York Tmes) spoke with iCAD on January 9. 2009. When iCAD asked the source of his information. he said tt was ·from 

internal FDA documents" and that "they were sent by scientifIC officers of the FDA." This product is regulated by RDB in 

DRARD. Please see attached correspondence to me from iCAD and their lawyer. of Hogan and Hartson. 

Please let me know if OIG needs any information in addition to what FDA has already sent. 

Doeument.pdf (t 

Ma) 

Documenlpdt (2 

MB) 

You mentioned that you would forward this email to_ who now has the lead for the overall investigation into 

the aUegatlons from the Radiological Devices Branc~ who has the lead for the related investigation 

into the disclosure of proprietary information. Please have thern call me to apprise me of the current status of these 

investigations. Thank you very much. 

T WIsh you well n your new assignment. 

Les Weinstein 

Ombudsman 

Office of the Center Director 

Center for Devices and Radiological Health 

Food and lirua 'm!rIew W.O. Bldg. 66 

10903 NH Ave. 

Appendix I: Relevant Documents 
206 


Insert offset folio 161 here 87176.161

Mr. WJM!; "1cC(\r:u~c!~ 

Sn...""Cial Ai!cr~t in Ch2!2e 

MAY 1 820m 

u'.S. Dct);rttl1,ent QfH;~Hh ~md Ihllnan Services 

Food and Drug A~mir.ai$c-aJjG!l 

OfiIce ofCIiminal Inves::i£anons 

Office oflntemal Affairs -

! Church Street,_ 

Rock"ille, :'>ID 20850 

P.E: Ca:.~ :';,,:ue: tnau:bor:'zed Disclosure oflnfoIT:lation 

OJ File H10t001413 

SAC .\~cCo:ma.cl:: 

n.., U.S. Deparunent ofHealili and HU1'11an Services (lmS), Office of inspector General (OlG), OffIee 

of Investigations (OIl. Special Investigations Branch (SIB), is in receipt of your rcferr~ (OIA File #: 

201O-01A-970-073';' At ""is time, based on the information pro\'ided, OIUrOL'SIB \,~Il be taking no 

action. Th~!!lfl.'rr'" !.d", any cvid>!nce of criminal conduct on the of any HHS employee. 

Additionally, 5 G3.C. § :_,~, ldemifies t"at disclosures, sue!:. as t.lte ooes eg "en t ey relate to 

malh.'TS ofpuhlic safi!\y mz.y be made to the media and Congress as long as the material rel:asad is not 

speCilioolly prohbited by law and protected 0)' Executive Order or Kalion.al Security Classification. 

atlore::iJltiv'e o~· Y0ur Sl1ppon iu its overall mission. Thank you for contacting the 010 OU 'UI' 

Appendix I: Relevant Documents 

~"Y questions, or need any additional i'lfbrmalion. plcase feel free (0 rontacl 

RcspecUul~, 

~.J_ 

Sea:! A Vantrease 

Assistant Special Agent in Charge 

Speciallnvcs(ig-atians Branch 
207 


Insert offset folio 162 here 87176.162

DEPA.RTMENT OF HEALTH & HUMAN SERVICES 

• June 28,2010 

Da.r.!i!lhl:.el(jn~OlJ~spector General 

U.S. Department of Health and Human Services 

Office of Inspector General 

Washington, DC 20201 

RE: Case Number: Unauthorized Disclosure of Information 

01 File#: H100001413 

Dear Mr. Levinson: 

We are in Feceipt 

Special Agent in C r • Special !nvesti""llru>..-R 

Food and Drug Administration 

10903 New Hampshire Avenue 

Silver Spring. MD 20993-0002 

response to our reques or I. galion. However, we are now making a new 

request for an OIG investigation. We have obtained new information confirming the 

existence Qf information disclosures -that undermine the integrity and mission of the FDA 

and. we beljeJ{li!....may bep£Q!libltecl by law .. Furthermore. these disclOsures may be 

on ifJg:\IV~uesHhatttm OIG promptly reVIew this-flew..information. 

On May 17. 2010, the FDA OffICe of Internal Affairs (OIA), Mark M ck, Special 

Age' ,!lested that the OIG-' a A determined to be an 

inappropriate disclosure of confidential commercial information .in the. potential release 

of infPt'mation related tl) a pending GE Healthcare application •. The 01 G determined 

based on the information presented at the time that the referral lacked evidence of 

crimina! conduct and declined to take action. 

We now have additional evidence, based on an internal investigation, that several 

employees may have engaged in the unlawful disclosure of confidential commercial 

information. We undertook this intemal investigation because we had reason to befieve 

that an employee may have been responsible for leaking confldentia! commercia! 

information. Based on our reasonable suspicion: OIA authorized the Office of 

Information Management (OIM) to institute real-time monitoring of his FDA computer, 

using narrowly tailored search criteria relating to device cases to which he was 

assigned. 

Our monitoring. which is ongoing. produced documents suggesting that employees are 

engaged in the inappropriate, and likely illegal, disclosure of nonpublic information. 

These documents are being forwarded to your secure IT portal. Specifically, they show 

that the employee at issue and other employees have recently disclosed nonpublic 

information to at least one former FDA employee relating to full field digital 

mammography (FFDM), spine analysis software. and infant enteral feeding tube device 

Appendix I: Relevant Documents PI 
208 


Insert offset folio 163 here 87176.163

application files. In the case of the FFDM device submission, the employees sharing 

and discussing the company-confidential information with the unauthorized recipient 

were officially assigned to review these fifes, but the unauthorized recipient lacked any 

prior history with these files or specific expertise that might justify seeking his input 

(notwithstanding that such disclosure may be illegal). In another case, employees 

assigned to the review of spine analysis software shared with the former employee 

information about the content and ongoing review of that file. In a third case, the 

employees shared with the former employee information from infant enteral feeding 

tube, accessories, and tube extension set files that they were not officially assigned to 

review, and there was no apparent justifk:ation for disclosing or discussing the files with 

the unauthorized recipient. We have also discovered em ails that the employee in 

question sent to unauthorized recipients which appear to have attachments likely 

containing confidential commercial information, but we have not yet confirmed that we 

have all the attachments themselves. For example, the employee sent an email to the 

former employee asking for comments on a hemodialysis device file. 

Notably, the OIA-authorized monitoring by OIM has not involved analysis of past 

periods, during which leaks relatin'g to the GE Healthcare device application or other 

matters may have occurred; a retrospective' analysis would actually require a review of 

the contents of the subject employee's government"iSSIJed computer and the 

government-issued computer(s) of other identified empJoyee(s), which would be 

facilitated by the opening of a formal investigation. We have also determined that 

nonpublic information from multiple device application files was improperly downloaded 

from the employee'S FDA computer to a non-FDA computer and to portable storage 

devices; further investigation may determine that these downloads resulted in additional 

disclosures of confidential commercial information. 

We request that you review the attached communications to determine whether this 

would warrant opening an investigation to determine whether one or more employees 

may have engaged in unlawful conduct. We believe that the emails and attached 

documents represent disclosures that may be prohibited by law. Among other things, 

the federal Food, Drug, and Cosmetic Act (the Aot) prohibits anyone "revealing, other 

than to the Secretary or officers or employees of the Department, or to the courts when 

relevant..., any information acquired under the" FDA's authority to review and approve 

applications for devices and other products. 21 U.S.C. § 3310). Moreover, the Act 

prohibits the disclosure of confidential commercial information without the written 

consent of the sponsor who submitted the information. 21 U.S.C. § 331 (y). In the case 

of a device not on the market, for which the intent to market the device has not been 

disclosed, and that has been submitted to the FDA for premarket approval or premarket 

notification review, FDA generally may not disclose the existence of the premarket 

submission. 21 C.F.R. §§ 807.95 & 814.9. More generally, any federal employee who 

discloses confidential trade secret information is subject to a fine or imprisonment. See 

also 45 C.F.R. § 73.735-307(3) (prohibiting FDA employees from disclosing information 

obtained in confidence, in accordance with applicable federal laws). 

Appendix I: Relevant Documents 
209 


Insert offset folio 164 here 87176.164

We are particularly concerned that the continued release of confidential information has 

compromised or will compromise the integrity of the ongoing premarket review of the 

subject device applications. Therefore. we request that the OIG immediately review this 

new information and open an investigation. 

Attachments 

Appendix I: Relevant Documents P2 

Sincerely, ,I} 

lL~~ J~ffTe/shuren, M.D.,J.D. 

Director, Center for Devices 

and Radiological Health 

Food and Drug Administration 
210 


Insert offset folio 165 here 87176.165

Mr. David Mehring 

Special Agen! 

Office of the Inspector General 

Department of Health and Human Services 

330 lndcpcnd~ncc Avenue SW 

Washington, DC 20201 

Re: Dr. Roberl Smith 

::leal Mr. Mehring: 

U.S. Department of Justice 

Criminal Div!sion 

WiH/lingIO'!, () C ]()jj() 

T11~ Public Integrity Section hus reviewed the above-referenced matter in which 

there were alleged violations of Title 18, United States Code, Section 1905, perpetrated by Dr. 

Robert Smith and other employees of the Food and Drug Administration's Center for Devices 

and Radiological Health. After reviewing this matter, we have decided to decline prosecution. 

We understand that your office concurs with this decision. 

if you ha vo OIl; qu~.,tions regarding this malter, please contact me at_ 

Than~ you for your cooperation in this mailer. 

Appendix I: Relevant Documents 

Sincerely, 

~) 

Pl 

JacK Smith 

Chief 

Public Integrh:y Section 
211 


Insert offset folio 166 here 87176.166

TO: 

DEPARTMENT OF HEALTH M1> HUMAN SERVICES 

Dr. Jeffrey Shuren 

Director 

NOV t 620lD 

Center for Devices and Radiologicali:{ealth 

Food and Drug Administration 

Office of la.specror Gcm:ral 

Office of iovesdgltioJJ$ 

Se.«ial Invcstig>tioDf Branch 

330 Independence A venue, S.W. 

WasbingtOD, DC 20201 

FROM: Scott A. Vantrease /rJ----

Assistant Special Agent in Charge 

Special Investigations Branch 

SUIlJECT: Closure ofInvestigation Concerning Paul Hardy, Dr. Ewa Czerska, and Dr. Robert Smith 

01 File Number: H-IO-0024R-3 

On July 31,2010, the Office of Investigations (OJ), Special Investigations Branch (Sm), opened an 

investigation regarding your complaint referral that alleged several employees within the Food and Drug 

Administration (FDA), Center for Devices aud Radiological Health (CDRH). had disclosed confidential 

infOlmation, as such undermining the integrity and mission of the FDA. Investigators with OJ/sm 

reviewed the complaint, met with several FDA staff; including the FDA Assistant Commissioner for 

Management to obtain additionsl information ahout the alleged misconduct. 

After completing a review, OUSIB investigators discussed the alleged misconduct, along willi the 

evidence identified during FDA's internal investigation, with prosecutors /i'om the U.S. Department of 

Justice. The prosecutorsperfonoed a tborougb review of the matter, and declined prosecution. At this 

time, ousm is closing its investigation of this matter. Your office indicated it had developed sufficient 

evidence to address the alleged misconduct through administrative processes, and as such, no further 

action wiU be taken by OIG. 

If you have:illiliiiiiliilf ....... additional information, please contact SJB, ASAC, Scott A. 

Vantrease "' 

Appendix I: Relevant Documents 

P3 

P1 
212 


Insert offset folio 167 here 87176.167

EXECUTIVE OfFICE OF THE PRESIDENT 

OFFICE OF MANAG~~MEI'J r AND BUDGE r 

June 20, 2012 

MEMORI\NOUM FOR CHIEf II'\FORMATION OFFICERS AND GENERAl, COUNSEI,S 

FROM: 

SL.HJI-.CT 

Steven vnllRllekCIr? ~~ if? 

Federal Chid !11!i)r~~ 

Boris Bershteyn 

General Counsel 

Office of Special Counsel Memorandum on Agency Monitoring Policies and 

Confidential Whistleblower Disclosures 

The attached memorandum from the Ot'flce of Special Counsel (OSC) identifies certain 

legal restrictions and guidelines that executive departments and agencies should considcr when 

evaluating their policies and practices regarding monitoring of employee electronic mail and other 

communications. Although lawful agency monitoring of employee communications serves 

legitimate purposes, Federal law also protects the ability of workers to exercise their legal rights to 

disclose wrongdoing without rear of retaliation, which is essential to good government. 

We strongly urge you to carefully review the attached OSC memorandum when evaluating 

your agcncy's monitoring policies and practices, and to take appropriate steps to ensure that those 

policies and practiccs do not interfere with or chill employees' use of appropriate channels to 

disclosc wrongdoing. 

Appendix I: Relevant Documents 
213 


Insert offset folio 168 here 87176.168

U.S. OFFICE OF SPECIAL COUNSEL 

17)0 M Slr.d, N.W .. Sull •• 

Wa~b.h1Rton, D.C. lOOl6.4~05 

101_ 

June 20, 2012 

MEMORANDUM FOR EXECUTIVE DEPARTMENTS AND AGENCIES 

FROM: Special Counsel Carolyn N. Lerner /)~ . ./ L 

U.S. Office of Special Counsel ~'7" ~ 

SUBJECT: Agency Monitoring Policies and Confidential Whistle blower Disclosures to the 

Office of Special Counsel and to Inspectors General 

This memorandum identifies certain legal restrictions and guidelines that agencies should 

consider when evaluating their policies and practices regarding monitoring of employee 

electronic mail and other communications. Although la wful agency monitoring of employee 

communications serves legitimate purposes, Federal law also protects the ability of workers to 

exercise their legal rights to disclose wrongdoing without fear of retaliation, which is essential to 

good government. Indced, Federal employees are required to disclose waste, fraud, abuse, and 

corruption to appropl'iate authorities I and are expected to maintain concern for the public 

intercst,l which may includc disclosing wrongdoing. 

We strongly urge executive departments and agencies (agencies) to evaluate their 

monitoring policies and practices, and take measures to ensure that these policies and practices 

do not interfere with or chill employees from using appropriate channels to disclose wrongdoing. 

The following legal restrictions and guidelines should be considered as part of this evaluation. 

Legal Framewerk 

Federal law generally prohibits adverse personnel actions against a Federal employee 

because of an employee's disclosure of information that the employee reasonably believes 

evidences a violation of any law, rule, or regulation, or gross mismanagement, a gross wastc of 

fiRlds, an abuse of authority, or a substantial and spccific danger to public health or safety.) 

Subject to certain exceptions, Federal law also protects the identity of an employee who makes 

t See Ethics Principle No. 11,5 C.P.R. § 2635.101(b)(II). 

1 See Merit Principle No.4, 5 U.S.C. § 2JOI(b)(4). 

J See 5 U.S.C. § 2302(b)(8). 

Appendix I: Relevant Documents 
214 


Insert offset folio 169 here 87176.169

such a protected disclosure to the Office of Special Counsel (OSC) or an agency Inspector 

General (lG)4 

Guidelines 

In light of this legal framework, agency monitoring specifically designed to target 

protected disclosures to the OSC and JGs is highly problematic, Such targeting undermines the 

ability of employees to make confidential disclosures. Moreover, deliberate targeting by an 

employing agency of an employee's submission (or draft submissions) to the OSC or an JG, or 

deliberate monitoring of communications between the employee and the OSC or JG in response 

to such a submission by the employee, could lead to a determination that the agency hus 

retaliated against the employee for making a protected disclosure. The same risk is presented by 

an employing agency's deliberate targeting of an employee's emails or computer files for 

monitoring simply because the employee made a protected disclosure. 

SUIlll1lan 

In sum, we strongly recommend that agencies review existing monitoring policies and 

practices to ensure that they are consistent with both the law and Congress's intent to provide a 

secure channel for protected disclosures. 

, See 5 C .S.C. § 1213(h) (prohibiting the Special Counsel from disclosing the identity of a 

whistleblower without the individual's consent unless disclosure becomes necessary due to an 

imminent danger to public health or safety or imminent violation of any criminal law); 5 U.S.c. 

App. § 7(b) (prohibiting IGs from disclosing the identity of a whistleblower without the 

whistleblower's consent unless an JG determines such disclosure is unavoidable during the 

course of an investigation). 

2 

Appendix I: Relevant Documents 
215 


Insert offset folio 170 here 87176.170

U.S. Office of Special Counsel 

1730M Street, N.W., Suite. 

Washington, D.C. 20036·4505 

FOR IMMEDIATE RELEASE 

Office of Special Counsel Broadens Investigation 

into FDA's Surveillance of Employees' E-mail 

CONTACT: Ann O'Hanlon, 202._ •••••• 

The Office of Special Counsel (OSC) has broadened the scope of an existing investigation into the 

surveillance of employees' emails by the Food and Drug Administration (FDA). FDA acknowledged that it 

monitored emails at the Center for Devices and Radiological Health to congressional investigators and the OSC 

after the employees reported coercion to approve unsafe or harmful medical devices. 

Recently, OSC received new and troubling allegations of retaliatory surveillance of OSC 

communications and other acts of retaliation against the whistleblowers, including FDA attempts to initiate 

criminal prosecution of the whistleblowers. We are reviewing these additional allegations and information from 

Congress and will take appropriate action. 

Relying on documents obtained through FOlA, the whistleblowers allege that the agency reviewed 

disclosures intended specifically for OSC, and that the agency also monitored the communications of 

employees who were suspected of blowing the whistle on FDA's approval of unsafe medical devices. These 

disclosures indicated repeated attempts by employees to warn the public that the devices were not safe and 

should not have received FDA approval. 

Under the Whistleblower Protection Act, federal employees are authorized to provide any information to 

OSC, including confidential business information, in order to disclose government waste, fraud, abuse, gross 

mismanagement or health and safety issues. In establishing the OSC, Congress intended to provide a secure 

channel for disclosures, and whistleblowers are entitled to keep their disclosures to OSC confidential. Even 

where an agency has a legitimate basis to monitor an employee's email or has a warning regarding email 

monitoring, that basis or warning does not trump the employees' right to confidentially blow the whistle to OSC 

or Congress. 

"Monitoring employee emails with OSC or Congress could dissuade employees from making important 

disclosures," said Special Counsel Carolyn Lerner. "Monitoring communications with OSC is unacceptable. 

We encourage other agencies to review their policies to ensure that they are not monitoring or otherwise 

impeding employee disclosures to OSC or Congress." 

The U.S. Office of Special Counsel (OSe) is an independentfederaf investigative and prosecutorio/ agency. Our basic authorities 

come from four federal statutes; the Civil Service Reform Act, the Whistleblower Protection Act, the Hatch Act, and the Uniformed 

Services Employment & Reemployment Rights Act (USERRA). OS["s primary mission is to safeguard the merit system by protecting 

federal emplayees and applicants from prohibited personnel practices, especially reprisal for whistlebJowing. For more information, 

please visit our website at wWW.osc,gov. 

Appendix I: Relevant Documents 
216 


Insert offset folio 171 here 87176.171

DEPARTMENT OF HEALTH AND HUMAN SERVICES 

John D, Podesta 

Presidential Transition Team 

Washington, DC 20270 

Dear Mr, Podesta: 

Food and Drug Admln!stratlon 

Centerror Devices and Radiological Heallh 

9200 Corporate Boulevard 

Rockville, MD 20850 

January 7, 2009 

We, physicians and scientists of the U,S, Food and Drug Administration (FDA), fillly support the 

agenda of President Obama to "challenge the status quo in Washington and to bring about the kind 

of change America needs.,,1 America urgently needs change at FDA because FDA is 

fundamentally broken, failing to fulfill its mission, and because re-establishing a proper and 

effectively fimctioning FDA is vital to the physical and economic health of the nation. As stated in 

the November 2007 FDA Science Board Reporr entitled FDA Science and Mission at Risk: "A 

strong FDA is crucial for the health of our country. The benefits of a robust, progressive Agency 

are enonllOUS; the risks of a debilitated, under-performing organization are incalculable. The FDA 

constitutes a critical component of our nation's healthcare delivery and public health system. The 

FDA, as much as any public or private sector institution in our country, touches the lives, health 

and well-being of all Americans, ... The FDA is also central to the economic health of the nation, 

regulating approximately $1 trillion in consumer products or 25 cents of every consumer dollar 

expended in this country annually ... , The importance of the FDA in the nation's security is 

similarly profound. '" Thus, the nation is at risk if FDA science is at risk." 

The purpose ofthis letter is to infonn you that the scientific review process for medical devices at 

FDA has been corrupted and distorted by current FDA managers, thereby placing the American 

people at risk. Through this letter and your action, we hope that future FDA employees will not 

experience the same frustration and anxiety that we have experienced for more than a year at the 

hands of FDA managers because we are committed to public integrity and were willing to speak 

out. Currently, there is an atmosphere at FDA in which the honest employee fears the dishonest 

employee, and not the other way around. Disturbingly, the atmosphere does not yet exist at FDA 

where honest employees committed to integrity and the FDA mission can act without fear of 

reprisal. This letter provides an inside view of the severely broken science, regulation and 

adminish'ation at the Center for Devices and Radiological Health (CDRH) that recently forced 

FDA physicians and scientists to seek direct intervention from the U.S. Congress.J This letter also 

provides elements of reform that are necessary to begin real change at FDA from the "bottom up." 

Since May 2008,4 the FDA Commissioner has been provided with irrefutable evidence that 

managers at CDRH have placed the nation at risk by corrupting and distOlting the scientific 

evaluation of medical devices, and by interfering with our responsibility to ensure the safety and 

effectiveness of medical devices before they are used on the American public. Before a medical 

device can be cleared or approved by FDA, the law requires5 that safety and effectiveness is 

determined based on "valid scientific evidence .. , from which it can fairly and responsibly be 

Appendix I: Relevani Documents 
217 


Insert offset folio 172 here 87176.172

Page 2 of 6 - Mr. Podesta 

concluded by qualified experts that there is reasonable assurance of the safety and effectiveness of 

the device." Managers at CDRH have ignored the law and ordered physicians and scientists to 

assess medical devices employing unsound evaluation methods, and to accept non-scientific, nor 

clinically validated, safety and effectiveness evidence and conclusions, as the basis of device 

clearance and approval. Managers with incompatible, discordant, and irrelevant scientific and 

clinical expertise in devices for which they have the full authority to make fmal regulatory 

decisions, have ignored serious safety and effectiveness concerlls of FDA experts. Managers have 

ordered, intimidated, and coerced FDA experts to modify scientific evaluations, conclusions and 

recommendations in violation of the laws, rules and regulations and to accept clinical and technical 

data that is not scientificalJy valid nor obtained in accordance with legal requirements, such as 

obtaining proper informed consent from human subjects. These same managers have knowingly 

tried to avoid transparency and accountability by failing to properly document the basis of their 

non-scientifIC decisions in administrative records. As examples of wrongdoing, the Director of the 

Office of Device Evaluation (ODE) has gone so far as to: 

Order physicians and scientists to ignore FDA Guidance documents; 

• Knowingly alJow her subordinates to issue written threats of disciplinary action if physicians 

and scientists failed to change their scientific opinions and recommendations to confOlm to 

those of management; 

• Issue illegal internal documents that do not conform to the requirements of Good Guidance 

Practices,6 are not publicly available, and, iffolJowed, would circumvent science and legal 

regulatory requirements; 

• Fail to properly document significant decisions in the administrative files;1 

• Make, and allow, false statements in FDA documents; 

• Allow manufacturers to market devices that have never been approved by FDA; 

• Remove Black Box warnings recommended by FDA experts; 

• Bypass FDA experts and fail to properly label devices; and 

• Exclude FDA expel1S from participating in Panel Meetings8 because manufacturers "expressed 

concems that [FDA experts] are biased." 

For ~ months, Dr. von Eschenbach and his Assistant Commissioner for Accountability and 

Integrity (Mr. Bill McConagha) have conducted a sham investigation resulting in absolutely 

nothing: no one was held accountable, no appropriate or effective actions have been taken, and the 

same managers who engaged in the wrongdoing remain in place and have been rewarded and 

promoted. Dr. von Eschenbach and Mr. McConagha failed to take appropriate or effective actions 

while the physicians and scientists who had the courage and patriotism to speak out, and who 

refused to comply with FDA management wrongdoing, have suffered severe and ongoing 

retaliation.9 The failure of Dr. von Eschenbach and Mr. McConagha to take appropriate or 

effective actions has made them complicit in the wrongdoing,10 has harmed the reputations and 

lives of individual employees, and has unnecessarily placed the American public at risk. 

In October 2008, the U.S. Congress was provided with the same evidence of wrongdoing that was 

given to the Commissioner. After Congress examined the evidence, the U.S. House of 

Representatives Committee on Energy and Commerce sent a letter to the FDA Commissioner 

dated November 17, 2008,11 stating that they had "received compelling evidence of serious 

wrongdoing ... and well-documented allegations ... from a large group of scientists and physicians 

... who report misconduct within CDRH that represents an unwarranted risk to public health and a 

silent danger that may only be recognized after many years ... and that physicians and scientists 

Appendix I: Relevant Documents 
218 


Insert offset folio 173 here 87176.173

l'age j ot b - Mr. l'odesta 

within CDRH who objected [to the misconduct] ... have been subject to reprisals." 

U nfortunateiy, the preceding facts are only the latest examples of shocking managerial cOITuption, 

wrongdoing and retaliation at CDRH. Back in February 2002, a biomedical engineer at CDRH 

reported serious managerial misconduct to the current Director of ODE and ultimately filed an 

EEOC lawsuit in September 2004. After six long stressful years of hardship and litigation, a Judge 

issued a forty-two page Decision and Findings of Factl2 concluding that: "the Agency promoted a 

hostile working environment ... permeated with derogatory comments and adverse employment 

actions" ... the Agency "failed to exercise any reasonable care to prevent and correct promptly the 

harassing behavior" ... the actions toward the engineer were "unconscionable" and "occurred 

openly within the FDA, unchecked, for over four years" ... that "FDA managers were aware and 

failed to take appropriate or effective cOlTective actions; but rather, demonstrated a systemic 

disregard for federal regulations as well as the FDA's own policies." The Judge further concluded: 

"su pervisors [including the current Director of ODE] knew or should ha ve known of the hostile 

work environment, but neither the supervisors nor the Agency did anything to con'eet the situation 

or prevent further discrimination" ... and "failed to exercise any reasonable care to prevent or 

correct the hostility of [managers] towards the Complainant." Shockingly, the current Director of 

ODE herselftestified in court that she was aware of the "hostile work environment" but "did not 

want to get involved," thereby corroborating her complicity in the corruption and retaliation 

against this employee. These independent facts confirm the longstanding pandemic corruption that 

cries out for new leadership at FDA fi'om the bottom up. 

We are confident that new leadership from the bottom up will be a top priority of Mr. Daschle as 

the new Secretary of the Department of Health and Human Services (HHS). As Mr. Daschle has 

recognized,13 the integrity of the FDA scientific review and decision-making process, where 

scientific experts make evaluations and recommendations, must be evidence-based and 

independent, insulated from improper influences. As a matter offact, Mr. Daschle points to the 

1998 FDA approval of mammography computer-aided detection (CAD) devicesI4 as an example 

of a breakdown of the independent scientific review and decision-making process. These CAD 

devices were supposed to improve breast cancer detection on mammograms. As Mr. Daschle 

recognized, post-approval scientific publications rcvealed that actual clinical performance ofthese 

CAD devices did not improve breast cancer detection IS and they were associa ted with increased 

patient recalls and unnecessary breast biopsies.I6 We note that the Agency Itnowingly approved 

these devices in 1998 even though there was no clinical evidence of improved cancer detection 

and, furthermore, the device was never tested in accordance with its intended use- one of the 

principal required elements for device approvalY Astoundingly, the approval was based on 

pseudo-science that consisted of unsubstantiated estimates of potential benefit using flawed 

testing. Use of these devices is a major public health issue as approximately 40 million 

mammograms are performed every year in the U.S. IS Furthermore, as a failure of FDA postapproval monitoring, the FDA never carried out any post-marketing assessment or re-evaluation of 

the clinical performance of these devices, ignoring accumulating clinical evidence provided by 

independent research publications revealing that these devices were ineffective and potentially 

harmful when used in clinical practice. 

FDA managers continue to fai I to apply even the most fundamental scientific and legal 

requirements for the approval of these, and so many other, devices. These failures constitute a 

clear and silent danger to the American public. Since 2006, FDA physicians and scientists have 

recommended five times not to approve mammography CAD devices without valid scientific and 

clinical evidence of safety and effectiveness. Manufacturers of these devices have repeatedly 

Appendix [: Relevant Documents 
219 


Insert offset folio 174 here 87176.174

Page 4 of 6 - Mr. Podesta 

failed to provide valid scientific and clinical evidence demonstrating safety and effectiveness of 

these devices in accordance with the intended use as required by the law. These matters were the 

subject of a Radiological Devices Panel meeting in March 200819 at which independent outside 

experts ratified all of the scientific, clinical, and regulatory points of the FDA experts required for 

proper assessment of the safety and effectiveness of these devices. Despite this, in April of 2008, 

the Director of ODE ignored the recommendations of all of the experts and approved these devices 

without any scientific, clinical or legal justification. Although unknown to Mr. Daschle and the 

American public, the Director of ODE and her subordinates committed the most outrageous 

misconduct by ordering, coercing, and intimidating FDA physicians and scientists to recommend 

approval, and then retaliating when the physicians and scientists refused to go along. This, and 

similar management actions with other devices, compelled us to write the FDA Commissioner in 

May 2008 and, because he utterly failed to take appropriate or effective actions, we later informed 

the U.S. Congress in October 2008. 

We, physicians and scientists at FDA, seek your immediate attention for change and reform at 

FDA. To bring real change and refolID to FDA, it is absolutely necessary that Congress pass, and 

the Presidenro sign, new legislation providing the strongest possible protections for all government 

employees,21 especially physicians and scientists, who speak out about wrongdoing and corruption 

that interferes with their mission and responsibility to the American public. We desperately need 

honesty without fear of retaHation for our evaluations and recommendations on medical devices, as 

well as accountability and transparency, to become the law and thus the foundation of the FDA 

mission and workplace. We totally agree with the following statement of President Obama:22 

"Often the best source of information about waste, fraud, aJld abuse in government is an existing 

government employee committed to public integrity and willing to speak out. Such acts of 

courage and patriotism, which can sometimes save lives and often save taxpayer dollars, should be 

encouraged rather than stifled. We need to empower federal employees as watchdogs of 

wrongdoing and partners in performance. Barack Obama will strengthen whistleblower laws to 

protect federal workers who expose waste, fraud, and abuse of authority in government. Obama 

will ensure that ..• whistleblowers ha ve full access to courts and due process." 

As President Obama has emphasized, he intends to govern the nation and to bring about change 

!i:om the bottom up. We believe that, as applied to FDA, this means a complete restructuring of 

the evaluation and approval process such that it is driven by science and carried out by clinical and 

scientific experts in their con'esponding areas of expeltise who are charged with review of 

regulatory submissions in accordance with the laws, rules and regula tions. It is necessary that 

FDA expelt physicians and scientists approve fmal regulatory determinations of safety and 

effectiveness, rather than mUltiple layers of managers who are not qualified experts and who often 

ignore scientific evidence and the law. President Obama has also emphasized the need foc 

complete transparency in government. His Transparency Polici) should be mandatory for .all 

FDA regulatory decisions and associated documentation. The long-standing FDA practice of 

secret meetings and secret communications between FDA managers and regulated industry must 

be strictly prohibited. Complete transparency in the regulatory decision-making process would 

serve as a detelrent to wrongdoing and an incentive for excellence. 

FDA also requires major renovation of the organizational structure of the various Centers and 

Offices to restore internal checks and balances that proactively prevent corruption and 

manipUlation of facts, science, and data. At present, FDA is plagued by a heavy-layered top-down 

organizational structure that concentrates far too much power in isolated Offices run by entrenched 

managers where cronyism is paramount. We recommend that the Office of Device Evaluation be 

Appendix I: Relevant Documents 
220 


Insert offset folio 175 here 87176.175

Page 5 of 6 - Mr. Podesta 

dismantled and split into multiple Offices, each headed by a physician or scientist with strong 

leadership credentials and extensive clinical and technical expertise in the specific devices they 

regulate. These leadership positions should be rotated on a regular basis. Furthermore, the current 

system of employee performance evaluation must be eliminated because it is used as an instrument 

of extortion by management and to telTorize employees who would otherwise selVe as "watchdogs 

of wrongdoing and partners in perfonnance."u The performance of FDA physicians and scientists 

must be based on an independent peer review process where extramural experts review the quality 

of the scientific content of their regulatory work. 

We strongly support the sentiments expressed in a recent letter from Congressman Bart Stupak2S 

urging complete change in FDA's CUtTent leadership. At CDRH, such change can be implemented 

immediately by removing and punishing all managers who have participated in, fostered or 

tolerated the well-documented corruption and wrongdoing. All improper management actions, 

including improper adverse personnel actions, and clearance/approval of medical devices that were 

not made in accordance with the laws, rules and regulations, must be reversed. Such swift and 

decisive action of transparency and accountability will send a strong message FDA-wide that 

wrongdoing will no longer be tolerated. In order to have a truly fresh start, we recommend that the 

new Commissioner request resignations from management positions by ru! current managers 

within CDRH, and use a competitive merit-based process to re-fill J!lJ management positions. 

The FDA mission is not limited to pre-market evaluation of safety and effectiveness. FDA is also 

responsible for the total product life cycle including actual clinical performance?6 FDA must not 

engage in a fire-fighting regJllato!), posture after medical products are introduced into clinical 

practice and used on patients.21 FDA must pursue a culture of proactive regulatqry science and 

remain vigilant in monitoring clinical performance of devices. For FDA to fully accomplish its 

post-marketing responsibilities there must be complete coordination between FDA and all HHS 

health-related agencies and institutes?! This will provide FDA with the necessary critical 

scientific capability and capacitj9 to achieve its post-marketing oversight. In tum, FDA will be 

able to provide the American public and all health care decision makers with objective and 

scientifically rigorous assessments that synthesize available evidence on diagnosis, treatment and 

prevention of disease. Ultimately, this will result in a lower health care burden on our society. 

In a time of transition, with the country facing an economic crisis with potential devastating 

consequences to the American people, we strongly believe that change and reform at FDA must be 

a top priority because FDA is central to the physical and economic health of the nation and 

because it can playa central role in reducing the future healthcare burden and avoiding public 

health catastrophes.3D We sincerely hope that, together, we can establish a culture of science, 

honesty, transparency and integIity at FDA to serve as the genesis ofrefonn for the entire 

American health care system. 

Sincerely, 

Appendix I: Relevant Documents 
221 


Insert offset folio 176 here 87176.176

Page 6 of 6 - MI'. Podesta 

Cc: Senator Tom Daschle, HHS Secretary-Designate 

Dr. Joshua Sharfstein, HHS Transition Team 

Congressman John Dingell 

Congressman Hemy Waxman 

Congressman Bait Stupak 

Congressman Chris Van Hollen 

Senator Edward Kelmedy 

Senator Michael Enzi 

Senator Barbara Mikulski 

Senator Max Baucus 

Senator Chuck Grassley 

• See hnp:llcJlange.govlagenda! 

, See http;//www.fdagovlohrms/dockets/ac{07Ibriefingl2007.4329b 02 00 index.html 

, See http://energycommerce.houso.gov/images{slories/Documents/PDFINew.room/II O·ltr. 101408 CDRHscientists pde 

http:[/energycommerce.house.gov{images{stories/DocumenlsIPDFlNewsroomfIIQ·ltr.1117QS vonEschenbach.CDRH.pdf 

4 See letter to Dr. Andrew von Eschenbach dated May 30, 200S; See also documentary evidence provided 10 Vr. von 

Eschenbach and Mr. Bill McConagha beginning in June 200S. 

'See21 CFRS60.7. 

6 See21 CFR 10.115. 

7 See 21 CFR 10.70. 

'See http://www.citilen.orglpublications/release.cfin?ID~7620 

• See letter 10 Mr. Bill McConagha dated October 20,2008. 

10 See letter to Dr. Andrew von Eschenbach dated September 29, 2008 • 

•• See hllp:flenergycommerce.house.gov/images!stories{Docltments/PVF /Newsroom/I/o·ltr. 

111708.vonEschenbach.CDRH.pdf 

'2 EEOC No. 531-2006-001l4X. 

1l See e.g., pages 116·128 and 169-180 ofCRITlCA~·WHAT WE CAN DO AOBUTTHE HEALTH·CARE CRISIS, by 

Senator Tom Daschle, Thomas Vunne Books, New York, 200S. 

14 rd. atpage 121. 

" See http://www.fda.gov/ohrmsldockels/aclOSlbriefing/200S·4349bl. 

R 1 %20FDA %20Radiological%20Devices%20Panel%20Meeting%20Introd.pdf at pages 52-56. 

• See rd. al pages 42 and 52-56. 

17 See 21 CFRS60.7. 

18 See http://www.fda.gov/CDRHlMAMt\10GRAPHY/scorecard.stalistics.html 

•• See http://www.accessdRta.fda.gov/scripts/cdrh/cfdocs/cfAdvisQry/details.cfm?mlg=694 

'" See http://www. whistleblowers.org!index.php?option-com c0!1tent&task=yiew&id-695<emjd-IOO 

21 See the December2008 Reportfrom the Union of Concerned Scientists, Federal Science alldthe Public GoodSecurillg Ihe IlIlegrily o/Sciellce ill PoI;cymaJdllg, available.t 

http://www.ucsus •. org!assets/documentslscienlific integri!y/Federal·Science·and·lhe·Public-Good·12.0S·Update.pdf. 

2l See ht!p:/Ichange.gov/agendafethics agendaf 

" See hup:llc!tange.gov/page/·!open%20govemmentlyourseatalthetable/SeatAtTIleTable memo.pdf 

" See http://change.gov/agendafethics agenda! 

" See http://online.wsj.com/pybliclresources/documentslstupak·letter·1o-obama·20081205.pdf 

"See http://www.fda.gov{cdrhfstrategicftplchtml 

" See page4, Section 1.2.1 at http:Pwww.fda.gov/ohnns/docketslac/07Ibriefing/2007· 

4329b 02 01 FDA%20Report<' .... 200n%20Science%20and%20Technology.pdf 

,. See http://www.hhs.gov/aboutlorgchartl 

"See page 44. Section 3.2.4 at http:Uwww.fda.gov/ohrms{dockets/ac/07Ibriefingl2007-

4329b 02 01 FDA%20Report<' .... 20ol1%20Science%20.nd%20Technology.pdf 

3. See, e.g. National Center for Health Statistics, Health, United States, 2007, with ChRrtbook on Trends in the Health of 

Americans, available at http://wwwcdc.gov/nchsldatafhllslhus07.pdf;and 200S World Cancer Report, available at 

http://www.iarc.frfenIPublicalionslPDFs.online!World.Cancer-Report 

Note: We can provide all documents referenced in footnotes ujXln your request. 

Appendix I: Relevant Documents 
222 


Insert offset folio 177 here 87176.177

January 13, 2009 

Les S. Weinstein 

Ombudsman and Quality Assurance Manager 

Center for Devices and Radiological Health (HFZ-S) 

Food and Drug Administration 

9200 Corporate Boulevard 

Rockville, Maryland 20850 

RE: Possible Disclosure of Confidential iCAD, Inc,., PMA Application Information 

Dear Mr. Weinst"in, 

I am writ!n£! to bring to the Food and Drug Administration's attention a 

possible serious breach of confidentiality concerning the Company's premarket 

approval appHcaticms on the oart of an unknown individual or individuals at the 

agency. It was our intention to bring this matter to the attention of the 

agency's integrity OffiCer but it is our understanding that the pOSition is vacant 

at this time. 

8, 2009, I was contacted by the 

Fujifilm Medical Systems USA, Inc., a company 

9artnered in regard to iCAD's Digital 

Computer-aided Detection for Mammography In our 

discussion, .related that Fuji had received call earlier that 

day from Gardiner Harris, an indiVidual representing himself as a reporter from 

the New York Times. I noted that Mr. Harris was under the 

misimpression that "ICAD" was a Fuji device and was seeking Fuji's opinion 

concerning very specific questions on certain documents related to the approval 

of this "device" that had come into the possession of the New York Times .• 

_indicated th2t Mr. Harris further implied that a member of Congress had 

intervened in tr:s ;In:>duct'sreview prOCeSS and had pressured an FDA official to 

support approval of During the course of the conversation, it 

became apparent Mr. Harris was referring to the approval of 

iCAD's Fuji's computed radiographic 

Accordingly, Mr. Harris was informed 

that leAD was a ==="-,",,. Mr. Harris in turn indicated that he 

would contact leAD n,gardif19 these documents and the SecondLook®. 

Appendix I: Relevant Documents 
223 


Insert offset folio 178 here 87176.178

iCAD(·j 

~ ~~ 

On FriG~Y, )a:Juary 9., I personally spoke with Mr. Harris by phone with 

Ms, Darlene De;:mj!~-HiCI($, our EVP and CFO, also present in the room during 

the conversi'.tl')n. :wr discussion, Mr. Harris stated that he was in receipt of 

"internal FDA :J·oCl!fr:"nt,,· that were sent to him by "Scientific Officers of the 

FDA." During ti";t: course of our conversation, Mr. Harris asked a number of 

questions that dearly reflected a depth of detail and knowledge that only would 

be known to either the Company or the FDA, and not generally available to the 

public. r can assure you tn3t the Company has not disclosed this sensitive 

information teo the New York Times, or to any other individuals or organizations 

outside of its b,lsi1ess partners or attorneys, and only then with the appropriate 

confidentiality ~'"':;;:ectlor:s in piace. 

As you ",? "w,re, under 21 C.F.R. § 814.9, confidential infcrmation 

submitted to th~ ofle:;cy as part of a premarket approval application or a 

supplement tG that a:,olication cannot be released by FDA with9ut the explicit 

permission of i': PIWI. spons:J'. From the dlSCUSS10P with Mr. Harris, I am deeply 

concerned th"t ;:;f::;-;nat,on concerning and potentially other 

Company subrn'",,'cr's, heve been shared with the New York Times. Further, 

articles that ha'!e ::"r,~emporaneously appeared in other media outlets suggest 

that the disc!;:'$ure of this information mai have involved organizations beyond 

the New Ya,l{ T:""'~s. I '13Ve "ttached a sample of these articles For your 

reference. 

We ap:w?d2'::; v,ur 3ttention to this serious matter. Should you reqUire 

anyadditiorlci ','rcrr;c"tion, pie3se do not hesitate to contact me. 

Sincerely, 

Ken Ferry 

President and Cl~,tef Ex~c:utive OffIcer 

Cc: 

Appendix I: Relevant Documents 
224 


Insert offset folio 179 here 87176.179

lUNG- & SPlu.DING UP 

Aprill6,2010 

VlA HAND O£UVERY 

Dr. Jetli:ry E. Sburen, Director 

Cenler for Devices and Radiological Health 

U.S. food lind Drug Adminislralion 

10903 NeWH!UIlPslIil'll Avenue 

Silver Sprin& MD 20993 

Dear Dr. Shuren: 

r am writin£ on behalf ofGE Healthcarc:, a unit ofOenerai Electric Company ("OE 

Heallhcare"), to e).:p:ess its disappointment in the Center for Devices and Radiological Health 

C'CDRH") for c!i$:::!osing to' the press confidential information in GE Hea.lthcare'$ prenwt::et 

notification C" 5fG{k),,) submission dated Navemb::r 26, 200& and received by CDRli on 

December I, 200S. On Ma.-ch 28, 2010, a NI!II' York Times article by Gardiner Harris entitled, 

"Scientists Say F.D.A. Ignored Radiation Warnings." revealed \hal "scores ofintemal agene)' 

doc:urm:nts" reglll'ding GE Heahb:::are's submission were provided to the N4I\1I York Thnes. See 

Appendix I. GB Healthcan: is extremely concerned about this viollltion of' eonftdentiality and ~ful!y teqQes\s that you conduct an internal investigation into how Ihis information was 

leaked \0' the press. G£ Healthca.re alSO requestS a meeting with you 10 discuss steps you. plan to 

take going (or .... «d to ensu.re Ihat breaches of contidentiality such as this one do not happen 

again. 

While Ih:! Food iUl!f Drus Administratian's ("FDA") general Jlolicy is 10' allow di~lasurc: 

a finfonnatian, specific conditians constrain when fDA, ami there{ are, CDRH, moy disc lase the 

existen~e and cant>:nls af 5JO(k) submissions. None oEllIese eanditions were present when 

CORH disclosed infarmation \0 the NIIW York Time&. CDRH was not pennitted to publkly 

disclose either the exis:~ce or the contents orGE Healthcare's 51O(k) submission, so in 

disclosing tris iniotmalian. CDRH breached the confidentiality orGE Healthean's submission 

in violation ofbotll federal TCiuJations 1!IId internal agency policy. 

Appendix I: Relevant Documents 
225 


Insert offset folio 180 here 87176.180

Apri116,20l0 

Page 2 

!. Con ditiolts Under Which rnA. Clln Disdo~e the [xistener DCa S10{k} Submission 

Under 21 C.F.R. § 807.95{b), FDA cannot publicly distlos~ the existenc:e ora 510(1:) 

submission for a device the.! is not on the market and where the intent to market the device has 

no! been C:isclos~d if three requirements are met: 

• Ihe submitter must ~ues( in the submission Ihal FDA hold as confidential commercial 

information the inle,11 \0 market the device; 

• FDA agrees thatihe intent to market the device is confidential commercial information; and 

• the submitter must ceMiry as \0 the confidentiality ofthe information and thaI neither he nor 

an)'one else hu disciosed the intent to market the device, that he will i~diatell' notify 

FDA iihe discloses his intent 10 anyone who is nol an employee, paid consuitlllJt, or member 

ofa hired adv'!nising or law firm, lind thaI he undersl.3nds tlIat the submission of false 

information 10 the government is illegal. 

21 C.ER. § 807. ~5(b). Ii the requirements of seclion 807.95(b) are met, FDA cannot distlos~ 

the e)tisten::e oftne SIO{k) submission far 90 days after FDA receives a complete 510{k) 

submission. S"1l' 21 C.F J~ .. § 807.95(c)( I). I fFDA tT:ques!s additional information regarding the 

SIIbmission, the el:isu:nee of the device will not be: disclosed lInIiI 90 days after FDA tT:ceives the 

complete submission. Pr;:amble to Establishment Regislrallon and Premarket NotiftealioD 

ProcedureI'. Fina! Rule, 42 Fed. Reg. 42520, 42524 [Aug. 23. 1977) ("ifthe Commissioner 

requests additional information regurding the device under § 807.87(h). lhe existence oftbe 

device will not be: disclosed until 90 days after the agency's receipt of a complc:le premarket 

notification sub~issi()n.") 

On No\'Cmher 26, :.008. OS Healthc2n: submit1ed B 5 I O{I:) requesting CDRH clearance 

of B new CT co!a!lOgra.phy scree"ing indication for its CT Colonograpby n image analysis 

software visuali~!ion o~vice, a compmeri2ed lomD&ruphic eolonography device for \'irtual 

colonoscopies. In this 5i O(!t) SIIbmission. OE Heallhcare requested CDRH clearance to permil 

promotion ofGE CT S:~3nning devices for CT colonograph1y.sc.I'C.Ciiin.ing. CDR}! n:ceived the 

submissien on Dec:mber 1, 200li, and assigned it nwnbe'li 

When G E Healthcare submitted itf 510(1:), CT colonography sc:n:ening was not being 

markeled, The use is Stil! no! on t1)e market today. OE HeaJthcare did not disclose the existence 

or its 5 I O(k) $\Ibmission t, a,.,y individunls who were not employees, peid consultlllllS, or 

members ofadver::ising or law firms hired ~nder arrangements safeguarding confidentiality. GE 

liealtbcare still il"s !'I:)t revealed ilS submission ror CT colonography sereening. In ilS 

submission, 010 Eea!t:tcare requesl~d tbal CDR}{ hold as confidential commercial infonnation 

ilS inlent to mash' CT colonograpby screening and made all cenificalions required under se:;lion 

807.95(b). CDRH did not object to GE Helllthcare's request. Because OE Heallhcare met alllhe 

requiremenlS or se:tion g~7.95(b}> CORM was nOI permilted to reveaJ the existence of OE 

Healrbcare's SlOG.:} 5u:,mission fot' 90 days. OE Healtheare requested this confidentiality 

because it did n01'.yem its competilOrs 10 know that if was seeking this clearance, orcreale 

Appendix I: Relevant Documents 
226 


Insert offset folio 181 here 87176.181

April 16, 2010 

Pagel 

confusion in the :narb;t?la.::e t:S to the elcared indications for the currently marketed device, 

Those goals are r>Qw lost. 

Of Health:;l!.!'e nos nosponded \0 numerous fonnal and informal requests for additional 

required inf onnstion from CDRli sinee GE Healthtare submitted its SlOCk) submission in 

November 2008. CDR..'Y infoaned Of HeallhclIll!. in December 2009 that it .... iII be iSS'Jing 

anolher n:qtJ.."S{ [or eadiljonal inf=aOOn, which Gf Heallhcare is curr:ntly anticipating, In 

asking for additional infonnation, FDA is effectively statin, thaI Gf Healthcare's premarl:et 

submission is not complete, Accorciinglo section 1I01.9S(c)(I), requests for additional 

information reset t}c % cia y period in whiCh FDA is required to keep the existence of a S I O(k) 

submission confidential !t:cause Ilte period does not beg.in until FDA receives a complete 

premarl:et notHication sl!o",jssion, CORM is not permitted to reveal the existence of GE 

Heallhcm's Sl1blllission until the' submissiQn is complete, $0 in revealing the existence orGE 

Hea11hcare 's ~ubmitsb!1 while still !lSl:ing f« additional inf omalion, CDRH has breac:hed the 

confidentiality teqwren:erus of2! C.P,R. ~ 801,95. 

II. C.nditiOlis linG!!!" Wb!eh FDA Can OIsdoSl< Ihe Contents uf II SlO{k) Submission 

Data or inlO;:ma.ion submilled v.ith or incorporated by reference in a submission III\: not 

publicly aisdos~ie until tbe intent to market the device is no longer confidential. 21 C.F.R. § 

807.95(e); see c£s~ Pre <mole to Establishment Registration and PRmarket NtllulCation 

Pro..-edures, Fmal R~. 42 FllIi, Reg. al 42525 ("Once FDA CIII:I disclose the fact that a 

premark.et nmifica:iQ.n c>;ists, the ~onlent$ ofthe SIIbtnission (other thall information prolect1:d 

under § 807.9S(<l}) "''ill be avsilab!e for public diSClOSure."}. FDA thus cannot disclose the 

conlenlS 01' a 5! C~/;) submtssion unlil it ean disclose the fact that Ihe SIIbmission exists. Certain 

information is eXzmpt irom disclosure even aller the intent to mari.:et t}c device is revealed, such 

as confidential co:nm::reial infOl:matinn or safety and etr.:ti,·eness data thaI have not already 

been clisclosed 16 ,,'Ie : .. ubH"" See it!.: Tmde Secrets arid Commercial or Financial Information 

Which is ?rivile¥~;i '?""lC C:m1ide!:lial, 21 C.F.R, § 20.61(c) (2009). Once FDA makes a final 

classilicatioll ciec!;;in!~ snf:::.:}· and effectiveness infonnation in the submiuion are available to the 

public Ul'On r~~st. unle"" !he devi¢e is II Class tit device. See 21 C.F.R, § 80?~S(e). 

Qeeaus: O)!Ui WlIS not authorited to disclose. the existence ofGE Healtheare's 510(k) 

submission, it 1Vl!$ n:>l Ill"ho:i1,ed 10 disclose Ihecontents ofGE Healthcare's submission either. 

CDRH bas not Y'" ma:!e! lil12l classification decision regarding CT eolonograpby screening, 

ami GE Healtxa~ nlt.s /Ill! revealed lls intent 10 merkel t}c use, so information in the 

submissio~ is 00\ ~\'aiial>'e f« pcullHc disclosure and should not bave been releasad to tire New 

rorkTimes. 

In. Freedom cr!t;!crud1.rio,c. Ad Prl.H:eriures for FDA Dlelesureof Information 

Rebtinl; ~" !:':H,(ll) S .. bmis$ions 

When F _'.'\ :a''';!:lori:;.-d 10 disclose the existence IiIldlor contents of a S IO(\:) submission 

to th: g~ j)udc, " mll}' :Ii> Si> ollly in respoose to II specific written request for disclosure 

under the Freeac3!': ol'1nfurola.ion Act ("FOIA'1. S/1/1 Polley Oll the Disclosure of Food ar.d 

Drug ACminisuc.:i;m :'e:::(;f'6s. :;:! C.F,R. § 2o.20(c) (2009); Establishment Registration and 

Appendix I: Relevant Documents 
227 


Insert offset folio 182 here 87176.182

April 16.2010 

Page 4 

Preman:ell\o!iiizaticn Procedures. final Rule. 42 Fed. Reg. 8142524, 42525; fOOD AND DRUG 

AOMINISTRA no',. FDA 3T I\FF MANUAL GUIDES § 3297.1·7 A (2007). We are W1l1ware that any 

such request wa." receiv=!l a::d processed v..'ith regard 10 OE Healthcare '5 510(1:). 

FOIl.. rec::les'<s for information in 510(1:) 5ubmissiot'.slhal meellhe requirements of 

section 807.95(1:;) fcii within a FOIA exemption for records containing trade secrets and 

confidential cO:1'.:ne.d'1.i information (~Exemption 4,. Confidemiat commercie.l iofonllalioo is 

any ''valuable. non-pubiic dl!la or informatiDll relaling to businesses, commerce, trade, 

employment. p:ciits, or 'inllIlces." FDA STAFf MANUAL GUIDES § 3297.1-70(4). Records 

containing ronfloen:ia! comm=i!ll infonnation an: subjecl to predisclosure notifICation 

("PDN") an:! mt!S\ he "'11':th~ld or reda<;led before release. See id.al § 3297.1·1G. 

Under rDN !lwcedures, fDA issul'posed to makereesonableefforlslOnOlify II subminer 

of II FOIA "'Quest £c.: intbrmation in the submitter's 510(k} if the submitter has designated thai 

the submission be protected as confidential commercial information. or if FDA ~ rqsoo to 

believe thaI disclosure could reescnably be expected to cause substantial competilive harm to 1M 

submiuer. See Exec. Order No .. 12.600 § Bfd), 52 Fed. Reg. 2318l (J\lne 25.1987); 21 C.F.R. § 

20.61(e}O); CO::lild~nt:elit~ of lnfotnllltion. Final Rule. 59 Fed. Reg. 64287.64289.64290 (Dec14. 1994): fDA "lTAf;?l ANt'A\.. GUIDES § 3297.1·8L. FDA ptaelice ino provide tbe submitter 

with II ropy oftt,~ f¢iillcst and 5 iO(Jt) SUbmission prior to release so !hat the submitter can object 

to disclosure by ~daetl~!ll;l'l)' tmlle SIW'elS or confidential commercial information from the 

submission. See 21 C.F.R § 20.6I(e}(I}; FDA STAFHiANtJALOUIDES§ 3291.2-i8(6)(A). l'he 

submitter has five dt~·s 1:'1 cb!ect to the requested disclosure. 21 C.F.R. § 20.61(e)(2). If FDA 

decides lod.isclose tile inf.rmationdespilea submitter's objections, it must ioform the submitter 

ofwhyil did not s\ls:.e.l!l his ;>oje<:lions. Se! 21 C.P.R. § 20.6!(e)(). No such efforts were 1I'.ade 

in this =, cltho:Jg!'. h b our ::)(perien~e thaI FDA always follo\\'$ these procedures. 

There is:1o t:~':.de-nce t~t ilIe Nell' York 1'imes made any FOIA requests for information 

relating to Of Healthca.-e's submission. Even ifit nad. it is unlikely that the information 

requested wouk! h~fI ''um.ished so quickly because FOIA requests generally !like several 

mont"s to year.; f.:'Ir !'DA ~ process. See Eric: P. Radii and James O. Qemenls. A Trap for lhe 

War)': HolV CO!n'!.lliclJcc \l'llit FDA Ml!dlCQf Device Regulalion$ Can Jeopardize Patent Righrs. 

46 IDEA 171. 3"'9 (2006;. Even ,flbe New York Tim/!$ had made II FOlA ~S!, GE 

Healthcare shouf·j Mve r,een !lmmed oClhe request and given II chance Lo object to the d~losure 

OeeBuse lhe reau:::SI. involved i.:onfidential I:omm::rcial informalion. However. al 00 time was Os. 

HeaJlhcare i!'lfOrr~*c c:f l1~ re::llem nr disclosure until it was (;()nlaCted by New York Times 

reporter Q!!rt!inet :ier:is nn M&re.lt 25.1010. By not wailing for a FOJA request before 

disclosing inf 0!T"1S1ion i!: GB Heallh=are's submisSion and notallowing OS Heallhcare 8 chance 

10 object even :rod Tif't<1Slud made a FOrA request. CDRH acted in violation of both 

federal lli4::n~)' procedlll'e5 when disclosing information in GB 

Vv"hHe 

cons!tllin when 

Appendix I: Relevant Documents 

f;wor. pubiic disclosun: ofinfonnation. specifIC conditions 

CORH. can dis;lose information relating to SIOCk) 
228 


Insert offset folio 183 here 87176.183

April 16,1010 

PageS 

stlbmissions. FCA mal' :mi>' eiselose the e)(istence ora 510(1.:) submission fer a d~\'lce that is 

not on the marke; l!n~ w!lert the intentto maltet the device is no! publicifthe submitter has nol 

designated the s,,'.l!nh:sion as confidential or made the jII'Oper certitications. or FDA diS/lgrees 

with the designcion. OLi.erwise, FDA must wait 90 daysto disclose thee)(istence ofthe 510(1;). 

If fDA esks lhe stlomitter for additional required information, it cannOI reveal the e)(istence of 

the SlO(k) even ar..er9f1 ds.ys !Ja~'e elapsed. because the confidential period does no! start Ilntil 

FDA receives a e::mple\,: submis~ion. FDA Clonal n:vealthe contents of a SI O(k) until il can 

disclose the er.is:ence of the submission, sllCh as when the mtenl to matlret is no longer 

confidemw. or :;;fter FDA ma.lccs a final non-Class U! classification decision. Even when the 

existence or c:mm'lts of z submission are diselosable. FDA will not disclose infonnation until il 

has received I! s;::ecif,c writ!<:n ~uest and given Ii submitter notice ofthe request and a chance 10 

object to tim ciisc:"s:Jre. 

None oft'll! cc·neitlons pemlitling FDA and CDRM torevelll the existence or conlents of 

GE Healthcsre's 510(k} submission \¥ere pl"',sent when CDRM disclosed information to the Nrw 

/'orl: Times. c\-en ifiley wer::, GE Healthcare was not given a chance to object to the II:lease of 

confidential infoimatio;; in 1:s submissions, in violation of federal regulations and internal 

agency procedlJr~. 

The con;,,:;entiali1y oISl 0(1;) submissions is protected by federal regulations that resulted 

from extensive p;JoJic c!iscl1$sion and commenL In creating these regulations, FDA '$ goal was 10 

balance the need for L'le :1111est pcssible government disclosure with the prop~ rights of pe~ons in confit.::mill1 ~orr.mefCial information and the agency's necd fer frank internal policy 

deliberatic!ls. See 11 C.F.R.. § 20.20{a). A breach in the confidentiality of 5 I O(k) submissions 

upends the balan::-e FDA lv..s s::rkken between the need of companies to protect information that 

could cause comeetitive )tat'ln and the need oCtne public for iovemment tranSparency. CDRH's 

release of i.'Itcmai doeumenlS such as emails and minutes of meetings also jeopardizes FDA's 

staled goal of p'~'~!!li dthe r!eed ter the ogency to promote frank internal policy delibellltions 

and to Jlursue ill: t'eg'.!t.~ory eetivlties without disruption." 21 C.P.R. § 20.2O{a). By disclosing 

informetion in GE Hee'to".eare's suomission in violation of these regulations, CORM has 

dis!Upteo Ihis ~53l!\:\l:e of interests and sacrifICed pressing privlIte I!lld governmental 

needs in the ll2l"~ of .:nvrta."!tl!';; 'Puhlic disdosure. 

Your pr::::;:;: !O \211$ ma.ller wuuld be greatly appreciated. I will be contatting 

your office to S::!it-aMte ! m~ting 10 discuss this matter. 

Sincerely, 

[~4{~~. Edward M. Basile 

cel Dec Me1kr, C~if.'fQualit)' Officer, OR Hellithcare 

Patricia ;';:aecin(l, CliefRegu!atory Counsel, OE Heallheare 

Appendix I: Relevant Documents 
229 


Insert offset folio 184 here 87176.184

'l""'-~'''''<'''('<f, f DEPARTMENT Of HEALTH & HUMAN SERVICES 

'& 

, ....... 

OffICE Of THE SECRETARY 

Assislant Secrelary ror legislation 

Washington. IX 20201 

The Honorable Charles E. Grassley 

Ranking Member 

Committee on the Judiciary 

United States Senate 

Washington, DC 20515 

Dear Senator Grassley: 

March 13,2013 

Thank you for your letter of July 24, 2012, concerning the unauthorized disclosure of 

Food and Drug Administration (FDA) documents through a publicly accessible server 

operated by Quality Associates, Inc. (QAI). FDA and Department of Health and Human 

Services (Department) staff provided your staff, and staff of the House Committee on 

Oversight and Government Reform, a briefing on this matter on September 14,2012. For 

purposes of this written response, Dr. Hamburg asked that I respond on her behalf 

because the business arrangement with QAI involved the Department of HeaIth and 

Human Services (Department). 

As we have previously advised, both the Department and FDA take seriously the 

unauthorized disclosure of sensitive personal information, confidential commercial 

information, and trade secrets entrusted to us. The Department is required to investigate 

security breaches in order to minimize the risk to the Department and individuals 

affected, and conducted such an inquiry in this case. The results of our internal review 

are included in the attached written responses to your specific questions. We apologize 

for the delay in providing you this follow-up written response, and appreciate your 

patience in this regard. 

It is important to note that the FDA and the Department of Health and Human Services 

Program Support Center (PSC), which handled the Government Printing Office (GPO) 

contracting vehicle for the QAI task order, went to great lengths in attempting to protect 

the material in question from improper disclosure. At all times while the data was in the 

custody of the FDA and the PSC, it was securely maintained on an encrypted, 12-digit 

passcode-protected external hard drive. Data stored on the hard drive included, among 

other things, confidential commercial information, which the FDA is obligated to protect 

under federal law. 

FDA requested the PSC's assistance in arranging for the conversion of the securely 

stored data to readable and printable format. FDA indicated to the PSC that the materials 

Appendix I: Relevant Documents 
230 


Insert offset folio 185 here 87176.185

The Honorable Charles E. Grassley 

Page Two 

were highly sensitive and requested that the copying job be assigned a contractor that had 

prior experience with large copying jobs of sensitive and confidential documents. The 

PSC designated QAI under a Simplified Purchase Agreement (SPA), a streamlined 

printing procurement vehicle used by the GPO's customer agencies in the Executive 

Branch. 

The PSC advised QAI that the documents were sensitive and that access to them should 

be limited. The PSC further requested that QAI delete all files on its computers after 

completing the job, and shred any printed documents in its possession. Regrettably, 

despite these instructions, QAI's unauthorized use of an unsecure website caused QAI to 

lose control of the confidential material. Although the PSC reviewed this matter with the 

GPO's Contracting Officer, unfortunately, the GPO's fonnal complaint process is limited 

to reports of poor printing quality, and is not designed to address security breaches. 

Again, we share your concern about the data breach that occurred here. Any 

unauthorized use, disclosure, or loss of confidential infonnation, such as the breach that 

occurred here, has the potential to undennine the public's trust and confidence in the 

Department's ability to properly protect such material, a matter we take quite seriously. 

We would be happy to answer any further questions you may have. 

Sincerely, 

~-o~ Jim R. Esquea 

Assistant Secretary for Legislation 

Enclosure 

Appendix I: Relevant Documents 
231 


Insert offset folio 186 here 87176.186

RESPONSES TO SENATOR GRASSLEY'S QUESTIONS REGARDING 

QUALITY ASSOCIATES, INC. WORK ORDER 69308 

1. Please provide and describe all communications to Quality Associates regarding the 

file converting contract, DHHSIFDA work order 69308. 

The first direct contact between persOlUlel of the Food and Drug Administration (FDA or 

Agency) and Quality Associates, Inc. (QAI) regarding the work performed under this 

contract occurred on July 13,2012, when FDA learned from a reporter that confidential 

Agency records appeared to have been released to the public. 

In late April, 2012, individuals in FDA's Office of Information Management contacted 

the Program Support Center (pSC) of the Department of Health and Human Services 

(HHS), to request its assistance in arranging for certain FDA records to be organized and 

produced, in portable document format (PDFs), and printed. FDA persolUlel handdelivered these records to the PSC on April 30, 20 I 2, on an encrypted, 12-digit passcodeprotected external hard drive. FDA requested that PSC utilize a contractor with proven 

experience handling sensitive information, and with whom PSC had a strong 

confidentiality agreement The PSC later arranged for the data to be delivered to QAI via 

the same secure hard drive. For added security, FDA separately conveyed the 12-digit 

passcode to the PSC by telephone. 

The PSC initially engaged a different firm, Ideal ScalUlers and Systems Inc. (Ideal), to 

organize and produce material from files stored on the FDA's encrypted hard drive in 

PDFs. On May 1,2012, Ideal persolUlel picked up the hard drive and took it to Ideal's 

facilities. However, after Ideal obtained the 12-digit passcode from the PSC, Ideal 

determined that it lacked the technical capability to convert all of the hard drive data to 

PDFs. The next day, Ideal contacted the PSC Printing Specialist, who was on-site at QAI 

at the time for unrelated reasons. After the Printing Specialist and QAI conferred by 

phone with Ideal, QAI indicated that it could meet the technical and expedited time 

requirements for the job. 

The FDA had requested that the job be completed within 72 hours, by Friday, May 4, 

2012. The Printing Specialist verbally informed QAI that this was a "sensitive job" 

involving litigation and was to be treated as such, including by ensuring the files were 

handled by as few staff as possible and removed from computers when the job had been 

completed. QAI sent a courier specifically cleared to handle sensitive data to pick up the 

hard drive from Ideal. Moreover, Ideal gave QAI the passcode verbally. 

The PSC did not authorize QAI to load the files on a publicly accessible file transfer 

protocol (FTP) site. Although QAI shared with the PSC a link to its FTP site with the 

first set of PDFs it generated, FTP sites may be shielded from public view through at 

least two techniques: (1) password protection and (2) "locking down." Thus, QAI's 

reference to its use of an FTP site failed to alert the PSC that documents would be 

publicly available. Indeed, neither the PSC nor FDA were aware that the material was 

available on a publicly accessible network until a reporter for the New York Times 

informed the FDA of this fact on July 13, 2012. 

Appendix I: Relevant Documents 
232 


Insert offset folio 187 here 87176.187

QAI completed the job on May 9,2012. The PSC documented the work done by QAI, 

which included organizing, bates-stamping, and converting data to PDFs, as part of Work 

Order 69308 on May 23, 2012. 

Unfortunately, the GPO's required Work Order forms do not reflect the variety of 

confidential material frequently handled by Executive Branch agencies, including 

material as to which Congress has imposed specific statutory protections. The forms 

provide only three document category options: a) Classified; b) SBU (sensitive but 

unclassified); and c) PH (personally identifiable information). Other options for 

identifying protected information, such as confidential commercial information, are not 

available on GPO's Work Order form. 

Although the FDA hard drive in fact contained PH (one of the designated options on the 

form), the Work Order that the PSC later submitted to document the job order 

inadvertently indicated that the material did not contain PII. Notably, however, this 

erroneous documentation occurred after QAI had completed its work, and, therefore, 

could not have contributed to QAI's unauthorized disclosure of FDA's sensitive and 

confidential data. 

2. Prior to May 23, 2012, did FDA represent to Quality Associates that the Jiles 

submittedfor conversion contained no information that was classified, SHU, or Pll? 

Please describe all communications with Quality Associates regarding the nature of 

the documents to be converted and provide all records relating to those 

communications. 

As noted above, FDA had no direct contact with QAI prior to the completion of QAI's 

work in this matter. The PSC verbally informed QAI on May 2,2012, the same day work 

on the job commenced, that this was a "sensitive job" involving litigation and was to be 

treated as such, including by ensuring the files were handled by as few staff as possible 

and removed from computers when the job had been completed. The fact the data was 

delivered on an encrypted, ) 2-digit passcode-protected external hard drive reinforced the 

extra security precautions that the PSC expected QAI to take. The PSC's Printing 

Specialist also asked QAI to shred any documents they had in their possession derived 

from the work. 

3. Why was Quality Associates allowed to begin work without an authorizing work 

order? Was the work completed on a rosh basis, and ifso why? 

The PSC and the vendor were attempting to accommodate the FDA's request for 

expedited delivery; i.e., to have the job completed and delivered to FDA within 72 hours. 

4. Please explain the timeline as to when Quality Associates actually performed 

services for the federal government. More specifically, please clarifY how Quality 

Associates claims that the Jiles were uploaded on May 3, archived on May 9, the 

order was placed on May 21, and the work order was approved May 23. 

Appendix I: Relevant Documents 

2 
233 


Insert offset folio 188 here 87176.188

QAI received the job from PSC on May 2, 2012, and completed it on May 9, 2012. The 

final print order was generated afterward. While the initial request was for approximately 

10,000 flies of various sizes in approximately 1,000 folders on a hard drive to be 

converted to PDFs for purposes of printing, the number of PDF pages requested to be 

converted, and the formatting of the job, changed several times during the process, 

thereby delaying delivery on the initially requested date of May 4,2012. 

5. Who was responsible for initiating the work order eventually received by Quality 

Associates? Please provide the originating document(s}. 

The Printing Specialist for the PSC was responsible for initiating the print order. The 

originating document is Work Order 69308 (attached to your letter). 

6. Were there any additional employees. either within FDA. the Government Printing 

Office (GPO). or any other federal agency responsible for passing along the details 

of the Quality Associates work order? Please provide the information about the 

documents related to al/ of the steps required from the originating document until 

the purchase agreement is considered complete. 

a. No additional employees within FDA, or any other executive branch agency, or 

GPO, were responsible for passing along details of the QAI work order. 

b. A completed HHS-26 Form is the originating document for a print order. If an 

HHS-26 is not accessible, a customer may email its job requirements and method 

of payment to initiate work on the part of the Program Support Center. On May 

2,2012, the Program Support Center received the final set of requirements from 

FDA, including the funding information. 

c. We note that the work order and invoices were included with your letter. 

Attached hereto are the terms and conditions and instructions for completing the 

4044. 

7. Who was responsible for preparing the "Simplified Purchase Agreement Work 

Order Form 4044" for Quality Associates' DHHSIFDA work order no. 69308? 

Where did that person obtain the information contained within the document? 

a. For Work Order 69308, the PSC Printing Specialist was responsible for filling 

out the Simplified Purchase Agreement Work Order Form 4044. 

b. FDA provided information to PSC regarding the nature of the documents. 

Although this information was not fully reflected on the completed form, the 

form was not prepared until after the work was done. Nonetheless, PSC did 

convey the sensitive nature ofthe information to QAI orally, before it undertook 

the work. 

8. Does the FDA still maintain that the documents provided to Quality Associates 

contain no information that is classified. SBU, or defined as PII under the Privacy 

Act? 

Appendix I: Relevant Documents 

3 
234 


Insert offset folio 189 here 87176.189

The FDA and HHS have never maintained that the hard drive contained no personally 

identifiable information. The absence of such a notation on the later-completed work 

order was the result of a clerical error at the PSc. 

9. What litigation was this document conversion beingpreparedfor? Were the 

documents being prepared for production or merely for review in order to determine 

what would and would not be produced? 

At the time QAI was engaged to convert the FDA data into a readily printable form, 

concerns related to the computer monitoring of certain current and former FDA personnel 

were already the subject of Congressional and Office of the Special Counsel (OS C) 

investigations, as well as litigation. The printing was principally intended to enable 

review of these records to facilitate understanding facts thought to be potentially relevant 

to these matters, and not for production in response to a specific request. 

10. Quality Associates asserts that the original files were initially supplied on physical 

media to another contractor. What is the name of the other contractor? 

The original contractor requested to perform this work was Ideal Scanners and Systems 

Inc. Ideal was unable to perform the work. 

II. How many files were contained on the physical media? 

The PSC did not open the files on the media provided; however it is estimated to be -

10,000 files per emailed requirements. 

/2. What was the total number of pages provided from Quality Associates to FDA 

following the conversion? 

The total number of pages provided from QAI following the conversion to PDF was 

83,187. Three copies were printed and delivered to FDA. 

Appendix I: Relevant Documents 

4 
235 


Insert offset folio 190 here 87176.190

United States Senate 

Committee on the Judiciary 

Attn: Senator Grassley 

Washington, DC 20510·6275 

RE: Letter received on July 16th (attached) 

Quality As.,ociales, Inc. is extrentely concerned by your letter lIIld 

questions. We have also contacted your staff in the interest of 

clearing any misunderstandings that we have done anything othet. 

directions. 

Pleuse see the fQUowing answers to your questions; 

Response - QAI has hundreds of government Clients and the d 

hundreds of dollars (for product purchases) to millions of 

contracts. 

2) Which of these other agencies' internal infornlalion, if any, wasll()t.es:si~~~~1!ro 

the Internet prior to Friday alternoon? 

Response - The FTP site is used to make available conversiQIIc: 

etc.) and DLL files forou~ en!!~neers to download and 

we have Cliel\tsthllltei:tU~lfiles .and..~ith their appro 

3) WhYWerethe~~4~ts~1l~li~ty engines, such as Google? ... 

Appendix I: Relevant Documents 
236 


Insert offset folio 191 here 87176.191

pro>iue services to the phannaceutical, pesticide, and othl'fappr9pt'/ate chemical and biotech 

industries. In the late 199()'s, QAl started to focus more on tlteF!!d~llll!lrketplace, primarily 

with the regulatorylresearch agency's who required day-t4-dayl?uslness s91utions for turning 

paper-based infonnation into usable electronic data. In recent YellfS' OAf hlllH'xpanded its client 

relationships to include educational, healthcare and banking clISI!!mj:rS and is now providing full 

document/content management solutions based on the Microsofi,SbarePoint ECM platfonn. 

5) Has Quality Associates ever discovered a similar leak as the one identilied in The 

New York Times anicle? If yes, please provide a detailed explanation oreach 

in.stance. 

Response - Never. 

6) lIow long were the FDA documents publicly available on Quality Associateslntl'fnet 

site? 

Response - The files were first uploaded to the site, at the direction of aUf Cli~t, late in the 

evening on May 3"'. There were several iterations of file revision and reloadins to help our 

Client with their printing afth. files. The last day that we worked with oUr Clien~{and these files 

was on May 9"'. Our records show that the files were archived on May 9'h. ' 

7) What steps have you taken to ensure that such internal iofonnation is not 

inappropriately available online in the future? 

Response - We have removed the FTP site and wilt handle all future receipt and delivery of 

Client infonnation, regardless of Client direction, via physical pick:fqpldelivery andlor 

secure/encrypted transfer. 

Si:1J~~4 Paul 

President, 

Swidersk;Y. 

CEO 

~ 

_I 2 

Appendix I: Relevant Documents 
237 


Insert offset folio 192 here 87176.192

Simplified Purdlue Agl'Nlllent 

Wort Order Fonn 4044 

Appendix I: Relevant Documents 
238 


Insert offset folio 193 here 87176.193

Quality AuocI .... lnc. 

8111t "Iple ~ Blvcl._ 

Maple ~. MD 20758 

Fax: 

.... nllftgac--.Pub 1Ig .. ,B ..... h 

Otv"'lIojI_ao_ 

p ......... _- _1'10 .......... __ 

"o.u"lo. IID_ 

- ~.""" .... not 30 daY". 

Appendix I: Relevant Documents 
239 


Insert offset folio 194 here 87176.194

Laptop Na~e - DR~0098686 

Spector Client: installed and active since 4/22/10 

SUBJECT: Robert C. Smith (RCS) 

Medical Officer 

W066 RM0319G HFZ-470 

CDRB - ODE/JRnRD 

Search Terms: 

Colonography - SUBJ~CT feels the ron is not handling this issue well. 

ALlegations! 

Sending proprietary doc~ments and information out o[ the FDA. Some 

documents are may ha'J8 the lel::cr "K" followed by a strir:g of six (6) 

numbers. Check to sec i ~ SUBJECT is sending these outside ttc fDA. 

Probably using Gmai 1 to send out. 

SUBJECT sent proprietary documents to press, possihly NY Ti~cs (Gartner 

Harris - sp?) - (Gardiner Harris - Corrected) for article al.1edging the 

FDA was mis-handli~g the Colonog~apllY topic. 

His superiors believe HE is "ghost wr:tinglf his subordinates FJA reports. 

Chock all possi~le avenues for possible occuranccs. 

SUBJECT'S subordinates 

Paul T. Hardy 

Cindy Oemian 

Nancy Wersto 

Laksr.mi Vishnuvajjala 

or co-horts: 

JRL0091494 

DRLDI0231~ 

DRLOIOl046 DRL5125449 

DRLO]OlGOO 

DRL51149?4 

OR~~1256l7 !)RLOD963?2 

Check all for possihle POP3 or en~ernal, non-FDA email conversations, 

either via Websen~e, Encase, Mandiant, or Spector. 

Appendix I: Relevant Documents 
240 


Insert offset folio 195 here 87176.195

Actors List: 

Prima!y Actors 

1. , CORR, ODE/DRARD 066, ••••• liiiiii[II'.;9.3 New Hampshire Ave, Silver Spring, MD 

2. Paul T Hardy (also referred to as "PJ") - Regulatory Review Officer, CDRH, 

OIVD W066, ••• 11.9.3 New Hampshire Ave, Silver Spring, MD 

3. Julian J. Nicholas - Fonner CDRH Physician 

Summary - The above listed actors appear to be the point men. All clmmunications 

amongst all the actors filter through one or all of these three primary actors. These actors 

appear to perfotlli the majority of any review, editing, compilation, production or 

distribution If verbiage, documentation and infonnation. Actors 1 and 3 appear to have 

the greatest involvement with media outlets and external organizations. 

Secondary Actors 

5. 

DlUILUgIJSI. CDRH, ODE/DRARD 

470, 109'3 New Hampshire Ave, Silver Spring, MD 

Visiting Scientist, CDRH, OSELIDIAM 

0903 New Hampshire Ave, Silver Spring, MD 

6. ___ Biomedical Engineer, CDRH, ODE/POS/IDE 

~, 1.9'3 New Hampshire Ave, Silver Spring, MO 

7. Nancy Wersto - Biologist, CDRH, ODE/D:/!M. 

W066, , 10903 New Hampshire Ave, Silver Spring, MD 

8. Lakshmi Vishnuvajjala - SUPV. Mathematical Statistician, CDRH, 

OSB/DBSIDOB 

W066, 550, 109'3 New Hampshire Ave, Silver Spring, MO 

9. CDRH, ODE/DRAW 

470, 10903 New Hampshire Ave, Silver Spring, M. 

Summary - The secondary actors listed above are in constant communication amongst 

themselves and the primary aetlrs via FDA email, Yahoo Mail and Gmail. 

Communications involve review, editing, compilation, production Ir distribution of 

verbiage, documentation and information pertaining to medical reviews, cummt 

inVestigations, claims against HHSiFDA, release of infoffi1ation to the press and extemal 

organi2ations. 

Ancillary Actors 

10. Ned Feder - Staff Scientist / Writer - POGO (Project On Oovellllnent 

Oversight) 

Appendix I: Relevant Documents 
241 


Insert offset folio 196 here 87176.196

1100 G Street, NW, Suit~ Washington, D.C 

11. Associate of Ned Feder 

Nuclear Engineering, Texas A&M University 

12. Jack Mitchell - United States Senate, Special Committee on Aging 

031 .irksen or 628 Hart Senate effice Buildings, Washington, D.C. 

13. Joan Kleinman - District Director, Congressman Chris Van Hollen (D--Md) 

Office of Representative, 51 Monroe Street #507, Rockville, Md. 

14. Congressman Cluis Van Hollen (D-Md) 

House of Representatives 

1707 Lon~onh H.D.B., Washington, D.C. 

District Dfiice - 51 Monroe Street #507, Rockyille, Md. 

Summary - The ancillary actors above are actively participating with primary and 

secondary actors with regard to complaints and claims filed against HHSWaA 

referencing FDA review / approval process, discrimination and hostility within the iiii.ili: actors (with the exception of Congressman Chris Van Hollen and • directly) have received a substantial number of documents primarily 

from Actors 1 and 3. There has also been nUmerous communications with many of the 

secondary actors either directly or through the primary actors. References to One or more 

of the above ancillary actors providing a conduit to release intbrmation to the press has 

been identified. 

Media Outlet Actors 

15. Gardiner Harris- Reporter, New York Times 

16. Matthew Perrone - Reporter, Associated Press 

17. Alyah Khan - Reporter, Inside Washington Publishers news organization 

18. Joe Bergantino - Reponer, RCN Cable Washington based Direct Cable provider 

l~. Rochelle ( last name unknown) - Associate of Joe Bergantino 

20. Lainey Moseley - Journalist, Unknown Philadelphia news organization. looking 

for a "Bigger Story" on CT scans, patient safety and FDA recommendations 

21. Joe (last name unknown)- Documentaries, Frontline PBS (Public Broa.casting 

Service) 

Sununary - The media outlet actors listed above have actively and recently 

communicated primarily with Actor 1. Actor 1 has been in constant contact with Actors 

15,16,17, & 18 via email, phone commUnications and/or in-person meetings regarding 

"issues with in the FDA". Actor 20 was refelTe& to Actor 1 by Actor 3. Actor 21 has 

been referenced to Actor 1 by Actor 2. 

Appendix I: Relevant Documents 
242 


Insert offset folio 197 here 87176.197

Scott A. Vl!lltrease 

l:.S. Department of Heal Lit and Human Seryices 

Office ofluspector General 

Office ofIovestigations 

Special Investigations Unit 

330 Independence A\'enue, S. W. 

Wasbington, DC 20201 

RE: G E HealtJcare Con:plai!lf 

De" ASAlC Vantre .. e: 

fltE COpy Food and Drug Adminjstration 

Office of In""",} A~·55(1) 

00< Ch=b Str"..el,_ 

RochiIJe, MD 208S0 

May i4. 2010 

~e O1'5ce of Internal .!Ufairs was given a copy of a complaint ftom Kjng and Spalding, a Jaw 

fi~ting GE Healtbcare. This complaint alleges disclosure of confidential iuformation by 

unknov:n individuals at the FDA's Center for Devices and Radiological Health (CDRH). 

As tbese allegations are vel)' serious and to avoid any appearance of impropriety, I respectfully request that 

Hl-lS/OlOiSlU investig.te GE Healthcare's allegations. Because Ll,c 010 is entirely indep~Ddent of the 

programs and offici",s being investigated, any potential allegations of conflict of interest by any party, or 

members of congress would be eiiminated. Please co;:tact me at (240J_ifyou wish to discuss this 

matter. 

Enclosure 

Cc: 

Case File 

CbroIl 

Appendix I: Releyant Documents 

Sincerely. 

/,/J)?#.L~ !>1ark S. !>1cCormack 

SpeciaJ Agent in Cbarge 
243 


Insert offset folio 198 here 87176.198

Food and D"l!g AdrIlini~'tra!ion 

Office oflnwnal AfT airs 

C{lS~ Inirituion and FacrShccl 

Cas~ Nun:ber: 201O·QiA·970·073 Case Tille: GE HealthcaT~ 

~ase T)1'e: Unauthorized Disclosure of Ir.forma:ion Case Assignment: 

CO:\lPLAl:'.'T: 

Date Rectived: 4/231 lO 

Complaint·r,,~.eived hy: Telephone: 

Person Receiving Allegation: S.-\JC McCormad:: 

Leaer: Other: X (email) 

Natne of Complainant: King and Spaulding, LLP 

Address: J 700 Pcnnsvlnrua Ave; IT" \VDC 20006 

Telepho:Je l\'llmber: 

Allegation and!or Issues: GE Hcalthcere alleges unauthorized cisc]osure ofinfonnation by 

unknown FDA/CDRH employees. This allegalion is being referred to HHSiOlGISIC 10 remove 

wy potential allegations of impartiality. 

SU.lUECT(S); 

Grade: 

Title: 

Cumponent: 

Region: 

Address: 

Telephone ::-':umoer: 

Other A;ency Im'ol\'ement: 

O]G Notific3.TIon: Telephone: 

Date Notified: 5/17/1 C 

Pcr;on Notifid: 5Ct.>ir Vc.:,,'nJ.re4 S.:: 

CO!'>lMEl'.'7s; 

f / I ;J L.~t:-L SAIC Sign~rure/i( aAl -4 1/1':: ...: 

Appendix I: Relevant Documents 

\1emor30dum: -- Fax: 
244 


Insert offset folio 199 here 87176.199

Mr. Marl McConnack, 

Sreciai Agent in Cbarge 

U.S. Department ofH""lth Jud Ibm," Services 

Food and Drug Administration 

Office of Crirninallnvestigations 

Office of 

I Church 

[(i:: Case Same: Unauthorized Disclosure oflnfonnation 

01 File #: H-JO-O-0141-3 

Dear S,\C McCormack: 

O1flce ofln~pectQr Gen<:r ,d 

Oflicc of lovestif,::.dlcns 

,SjlCci;:.; :n\'e~tlgi)(IC'm 1J;~D'':!~ 

w~$bTtil~~n:rjc- 20024---

JUL 26 2Di2 

I am writing to clarify our May I g, 2010, kttc.r 10 you regarding your referral (OIA File if: 2010-

OJA-970-073). First, tbe Office oflnspector Genera! (OlG) docs not determine the legality of 

disclosures of confidential government-beld in fonnation. Instead, an 01G conducts 

i:westigaIions and refers matters to the Deparlnlent of Justice when the OlG determines there are 

'1"...asonabte grounds to believe" there has been a vjulation of Federal crirninalluw_ (lG Act, § 

4(d)). Our 20LO leLler should Dot be read to reflect II detemunatiOIl by OlG abouttbe reach af 

Fede,.! criminal!.w. ,".gain, that determination rests witb tbe ;)epartment of Justice and the 

C(JUrts. OlG's May 2010 decision to take no further action on your rei""a! wa.' based on (Jill 

assessment or the e\'idcnee available at that time under tbe standard set forth in the IG Act. 

If you bave any lJ\!cSiirilnlnis'lolrlrllCl"'ldl'ii~ny additioo:Jl information regarding tbis m::ntcr, pkJse fcd f~ee to contact me <11. 

Appendix I: Relevant Documents 

Sincerely. 

F,lton Malone 

Specio! Agent in ChHge 

Specla1 Investigations Branch 
245 


Insert offset folio 200 here 87176.200

(""~ DEPARTMENT OF HEALTH A'IID HUMAN SERVICES 

.... ::::8~ ~ 

Mr. Mark McConnack, 

Special Agent in Charge 

MAY 1 82010 

U.S. Department of Health and Human Services 

Food and Drug Administration 

Office of Criminallnvestigations 

Office of 

1 Church 

Rockville, MD 20850 

RE: Case Name: Unauthorized Disclosure oflnforrnation 

01 File /I: HI00001413 

SAC McCormack: 

Office of lnIpecro, Gm.ral 

Office orlnvestigations 

Special Investigations llrIIncb 

Washington, D.C. 20201 

The U.S. Department of Health and Human Services (HHS), Office ofInspector General (OIG), Office 

of Investigations (01), Special Investigations Branch (SIB), is in receipt of your referral (alA File #: 

20 I 0·OIA-970-073). At this time, based on the information provided, OIGfOUSm will be taking no 

action. The referral lacks any evidence of criminal conduct on the part of Bny HHS employee. 

Additionally, 5 U.S.c. § 1213, identifies that disclosures, such as the ones alleged, when they relate to 

matters of public safely may be made to the media and Congress as long as the material released is not 

specifically prohibited by law and protected by Executive Order or National Security Classification. 

The OlG is apprecia1ive of your support in its overall mission. Thank you for contacting the OIG on this 

Appendix I: Relevant Documents 

any questions, or need any additional information, please fed free to contact 

/4"-

Scott A Vantrease 

Assistant Special Agent in Charge 

Special Investigations Branch 
246 


Insert offset folio 201 here 87176.201

McKee, Ruth E 

From: 

Sent: 

To: 

~:ubJect: 

Marty, Kenneth L (OIG/C)I) •••••••••• 

Friday, JU~l~ 10,2011 1 '37 PI,' 

McKee, Ruth '" 

Complaint RE: Hardy eLal 

A :tachments: H1 0002483001Sa2449 20101115 Closing Memo to CDRHpdf, H1 0 0024830015a2449 20101105 

Declination Letter from orJJ PI N pdf 

Ruth, 

The ref~rraj YOIl made to our office in March of th!s Yl2ar regarding. t1~ .wav files was s:Jbsumed ir.to case 

H100002483 ,ince it pertained to the same category of conduct. .-

Attached are previous documents our office transmitted to your office regarding that case, As in that instance, v,'e 

a re deferring to fDA for any apprDpriate administrative aC!lon, 

~f you need a more official letter from us, please- let me know, 

SincerelY, 

Kenrl<!lh Marly, Inspeclor 

SpeciallnvEsligafions Bran~h 

Office a/lnspeClol' General, Office 'of investigations 

: ..;.5. DepfJrlmel1f oj flealth &"I.H."."'.O.".S.ciriivicl'S 330 Jrulependcnce Ave., S WI 

Cohen Bldg., 

This £;mail INtly c<wlain :rensilive law mfof('emellf fwd/or ptil'ileccd injormntion. If you are not fht imetJded recipic:rrt (or 

hU)J(! received tilis E-mail in l!r!O?) pJt!.Qse notify lite sender immedialely and destroy ti:i5 E-maiL Any unauthorized copying, 

d(\['/:},'iU.,c_L!.'J!ilfr!lE!!.l21! eIJ!!..~m~~~~ll}{J1t ~hj~'J:-~!n(Ji! i.L~I!.J~'(~rlllf~i~[~·~~: 

From: Mehring, David 5 (OlGJOl) 

sent: Friday, June lO, 7011 10:Z7 AM 

To: Marty, Kenneth L (OIG(OI) 

Subject: Complaint from Ruth McKe~ 

t~en, 

Here's the additional complaint sent to us by Ruth McKee afterwe closed Our investigation (H10002483), and my 

email response. I've also included DOJ/PIN's declination letter, and our case dosing memo to CDRH 

'~: 1ne know if i can. provide ~my fur:her info, or ass:st with the re:o;ponse to CDRH. 

Lave' 

David Meh:"tng, Specinl AgC:l1 

:...l.S, [)eparrn:~enl ofH~a!th and Human Service::; 

O:f.ce Df Inspector General 

Sreciall~vestigQ[ions Branch 

'," ,<".-. 'A'pp61l:M I: Relevant Documents 
247 


Insert offset folio 202 here 87176.202

("~ DEPARTMENT OF HEALTH & HUMAN SERVICES 

<:::z~ 

"",", 

Dlmiel R. Levinson, Inspector General 

U.S. Department of Health and Human Services 

Office oflnspector General 

Washington, DC 20201 

Re: Potential Unlawful Wiretapping By FDA Employee 

Dear Mr. Levinson: 

Food and Drug Administration 

10903 New Hampshire Avenue 

Silver Spring, MD 20993-0002 

We have obtained evidence that at least two FDA employees appear to have engaged in 

widespread recording of telephone calls and meetings regarding FDA business without the 

consent of all other parties. We are concerned that these actions violated state anli/or federal 

criminal laws. r have enclosed with this letter a draft summary of some of the recordings we 

have obtained, and 1 am sending all the recordings to you via your secure IT portal Please 

review this information to determine whether the Office of Inspector General (DIG) will open an 

investigation. 

In the course of network monitoring, we discovered 96 .wav files containing recordings of 

conversations the employees had with other FDA employees and with representatives of 

companies with matters pending before FDA. These .wav mes were located on a thumb drive 

connected to an FDA computer in 'Unallocated space" iuiicating they had been "deleted" but not 

yet overwritten. The recordings themselves suggest that they were made by two different 

employees, and the recordings also suggest that many of the participants were not aware that 

they were being recorded. The subject matters of these recorded calls and meetings include the 

review of pending medica! device submissions, FDA personnel matters, and effortS of the 

employees 10 use the press and Congress to force the removal of specified FDA managers. 

These recordings include non-public information, some of which appear to constitute 

confidenlial commercial information. For instance, Files 16 and 17 are recordings of 

conversations with a manufacturer regarding a device submission. Although the files we have 

obtained do not specify the dates or times of the calls themselves, we expect, based on the 

context and subject matter of the recordings, thai t.he calls generally took place between 2008 and 

2010. 

The employees seem to have been in several different physical locations, all of which were likely 

in the State of Maryland, when they made the recordings. In particular, the recordings suggest 

that they were variously recording 111e calls and meetings from their FDA offices (in White Oak, 

Maryland or Rockville, Maryland), and from coffee shops near the FDA offices. 

Appendix I: Relevant Documents PI 
248 


Insert offset folio 203 here 87176.203

There is no FDA policy or practice that supports the unauthorized taping of phone calls or 

meetings by employees, or the use of FDA equipment or resources for such plUposes. 1 

Moreover, the creation and storage of these recordings might run afoul of the requirements 

relating to the secure storage and destruction of sensitive information and prohibitions against 

the concealment of such information for personal use; these requirements are contained in the 

Department of Health and Human Services Rules of Behavior For Use of Technology Resources 

and Information, which all employees must read and sign. 

More significantly, these nonconsensual recordings potentially violate state or federal criminal 

wiretapping laws. For example, Maryland law prohibits the interception of oral or electronic 

communications unless "all a/the parlies to the communication have given prior consent to the 

interception .... ,,2 Violations are felonies subject to imprisonment and fines. Federallaw 

appears to require the consent of only one party to the interception of a phone call,4 but the 

unauthorized taping of calls by federal employees involving confidential information may 

constitute prohibited conduct. 

If you have any questions, or if you need any additional information, please let me know. 

Enclosure 

Sincerely, 

Jeffrey Shuren, M.D., J.D. 

Director 

Center for Devices and 

Radiological Health 

I fDA regulations generally allow the recording of public adm inistrative proceedings, with advance nmification to 

the agency. See 21 c.r.R. § 10.204. None of the calls at issue here appear 10 constitute public administrative 

rroceedings. 

Md. COURTS & JUDlCIAL PROCEEDINGS Code Ann. § 1O-402(c)(3) (emphasis added). Other exceptions 

apply, which do not appear to be relevant here. 

J Jd § 1O.402(b). 

• See 18 V.S.c. § 2511. 

Appendix I: Relevant Documents ,2 
249 


Insert offset folio 204 here 87176.204

(/~ DEPARTMENT OF HEALTH & HUMAN SERVICES 

~ 

TO: Walter Harris, Chief Operating Officer 

Eric Perakslis, Chief Infonnation Officer 

Office of the General Counsel 

Office oflheChiefCounsel 

Food and Drug Administration 

l0903 New Hnm~hircAvenue 

Silver Spring, MD 20993'()002 

FROM: Elizabeth H. Dickinson, Chief Counsel ~:~ ... _--__ _ 

RE: Requirements for Deploying Spector Software 

DATE: August 1,2012 

Effective immediatelyPer the direction of Commissioner Margaret A. Hamburg. the FDA Office of Infonnation 

Management will not deploy the Spector 360 software without written approval by the Chief 

Counselor her delegee. The Chief Infonnation Officer is to immediately instruct his staff 

accordingly. 

Questions on this policy are to be. directed to Elizabe(h Dickinson, Chief Counsel. 

cc: Margaret A. Hamburg. Commissioner of Food and Drugs 

Lisl! Barclay. Chief of Staff 

John M. Taylor, III, Counselor to the Commissioner 

Mark Raza, Acting Deputy Chief Counsel 

Appendix 1: Relevant Documents 
250 


Insert offset folio 205 here 87176.205

Otl'Atl r~!E:--;T OF HEALTH'" HL:\tAN srJtv tCl' 0 

FROM: 

DATE: 

I

' b ~~. " Margnrct A. 1;j!l1 mg, C 01ll1lllSsioncr 

Walter Han'is, Chief Operating Officer 

r:ric Perakslis, Chief Information Ofticer 

Elizabeth H. Dickinson, Chief Counsel 

MOnitoring of FDA Personnel Work Computers 

September 24, 2012 

I=-ood and Drug Admln:s!ratlon 

Sliver Spnng MO 20~a3 

Tl1e Food and DlUg Administration has recently undertaken a review orthe standards and 

p:,occd'klres for monitoring the usc ofgo\-cl1llllcnt-owllcd computers issued to FDA personneL 

After careful consIderatIOn, ! am issuing aLldition;',l! guidance to ensure that such activity 

co-ntinues to be conducted in em nppropriatc manncr. i AcconJjngly, I Llm directing the fDA 

Chicflnformation Omcer (CIO) to pul inlo place promptly procedures that will strengthen 

fDA"s abili~y to cffcctl\'cJy document. analy7.e~ and authorize requests for employee computer 

monJtonng.-

I'ur,uant 10 Ihis memorandum. which is effeclivc immediately, J am directing that the CIO and 

ClllerCounse1' promptlY develop a written procedure that includes Ihe following clements' 

Express Written Authorization of Monitoring: The CIO may not initiate monitoring of FDA 

employees' computers without advance written authorization hy onc of the follo\ving: The 

Commissioner, a Deputy Commissioner. or the Chief Operating Officer (COO) This authority 

may nol be redelegated, Requests for monitoring musl be approved hy the Chief Counsel 10 

\\rit:ng prior to implemcntJtion 1 ilS dC;-il:rjhed he low. 

Asan IlHtl(l] 11lIerillls!ep,by Me1l1crandL:11l dated Augu;-,:}, 2012. I directed that Ihe FDA Ofticc oflnformatlOll 

Managelllen: wJ!lnot depJ0Y new u~c" of the Srector JoO ... ofl\\,;:\re without wnuen aprrova! by the Chief loul1~,el or 

her dl.'kgec 

There ?ore currently a nUl11her of Itl(']uines i;\\o IIlOniIOI'l!lg practICes thru \\ ill Infol m FDA's. pohcic\ and prac;!ces 

:1l1d that lll<ly re~uh in additional c!langes to rOA pr,lcedufcs in the IOllger len I). IIlclu{ilng a Def1iH1Il1eIH.wldc 

rc\ If.:\\ reque:-!td by ~he Oftice of l\.lanagcmen! and eudget and {WO rent\',-:, by Ille BHS in"fleclor Genera! 

by the Secretary. J will ~!pdil.te FD;\'~ iloliClc5 a~ needed oll;.:e 1110"e revle\\,:-; ilre c01l1rletcd, 

1l1e:l;o;,Hldulll addrc"~e,, the tl"e of J1101111:1f1llg "OflwJre directed all1ldll ;duJl fJA computer:.; I:'$ued :0 

\jlt'Cff:c \, !\Jch 0pCfJ~C" by on ,,,uch C~~Tl1pu\cr.\, It I" no: l!l!c:lded 

:l1fofma:lon tilt' rJ/\ IT "y.);cmlO 

;jhllCll~ f cdc):11 jrJoftllatiOll ACl of 2002 technology 

con;:ell1" ,il1l'l<1r:c :h()~(' Ide!l[Jficd In rlw:;mcmO!"dlld;llll rll(· er(1 and 

cel'e!(lfJ a~ necc;;~my :,~ add:-c\" the"c as II ell 

) f'DJ\'s on;(C ofllle ChlCrCOUil"cll.<; oflfHS' OfJ1cc of Gener<ll Counsel eOGC); 1 c,\;)C[(III;1: III "j,ismg 

Appendix I: Relevant Documents 
251 


Insert offset folio 206 here 87176.206

Basis for MoniloJ"ing: Computer monitoring may be authorized only for the following reasons: 

( I) at the request of an outside law enforcement or na tional security authority (e.g., FBI, DHS) or 

the HHS Inspector General; (2) based on reasonable grounds to believe that the individual to be 

monitored may be responsible for an unauthorized disclosure oflegally protected information, 

such as confidential commercial ortrade secret infol111ation; or (3) based on reasonable grounds 

to believe that the individual to be monitored has violated HHS or FDA personnel or 

administrative policy or HHS or FDA policy on the use of government infonnation technology 

equipment and systems. 

Doenmentation: The written authOlization for monitoring of FDA employee computers must 

describe the reason for the monitoring. If the monitoring is initiated at the request of an outside 

law enforcement or national security authority or by the H HS Inspector General, the 

authorization must state that the request was approved by the Director of FDA's Office of 

Criminal Investigation or by the HHS Inspector General, as appropriate.' 

For monitoring that is initiated for reasons other than at the request of an outside law 

enforcement or national security authority or the HHS Inspector General, the pm1y requesting the 

monitoring must document in writing the factual basis justifying the monitoring. The Chief 

Counsel shall document in writing the legal basis for any such monitoring. 

Limiting the Time, Breadth, and Invasiveness of Monitoring: The written authorization for 

monitoring should reflect that the cIa has identified a method of computer monitoring that is as 

narrow, time-limited, and non-invasive as is appropriate to accomplish the stated infolmationgathering objective. The cia also shall consider and advise on whether there are alternative 

steps the agency could take to address the concern. 

When monitoring is initiated at the request of an outside law enforcement or national security 

authority or the HHS Inspector General, the cia should, to the extent possible under the specific 

circumstances, obtain appropriate infonnation to advise on the use of a method of computer 

monitoring that is as nalTOW, time-limited, and non-invasive as is appropriate to carry out the 

request. 

Legal review: When a retjuest for computer monitoring is made by a party other than an outside 

law enforcement or national security authority or the HHS Inspector General, the Chief Counsel 

will deternline whether the monitoring is legally supportable and will notify the CIa, the COO, 

and the Commissioner or her designee, of these conclusions, including any recommended limits 

or boundalies. In evaluating the monitoring, the Chief Counsel shall consider whether the 

proposed monitoring is consistent with all applicable legal requirements, including the 

Whistleblower Protection Act. 

In addition, the Chief Counsel shall infonn the parties to whom information derived 1i'0l1l 

monitoring is to be made available that such information may not be used in violation of the 

• Monitoring initiated al the request of outside law enforcem<nt or national security authoritie~ or the fIHS Inspe<tor 

General roises i!'sues that warrant additional considerotioll on a Depaltmcnt-wide hasis. These nr~ e),pected to he 

addres;ed by the additional HHS .. e .. ie,,·, referellc~d elsewhere in thi, documem. 

Appendix I: Relevant Documents 
252 


Insert offset folio 207 here 87176.207

WhistlcbJowcr Protection Act [lnd rdJted protectIons The Chief Counsel wdl advise other 

components of FDA on Implementing thcsc protections effectively 

Periodic reYil'w of monitoring: The CIO shJlJ review Jny computer monitoring on J monthly 

bJsls and, in consultation with the indi\'iduaJ who authorized the monitoring, assess whether it 

rel11Jins justified or must be discontinued, A decision to continue monitOling shall be expJJined 

and documented in WIlting by the CIO, who shall report monthly to (I) the COlllmlssioner or her 

dclegate, (2) the COO, and (3) the ChicfCounseJ, regarding the status of Jny on-going 

monitoring, 

Spedal circumstances: The CJO Jnd ChiefCounsd may lllake recommendations to the 

COlllmissioner fllr Jdditional procedures, ifnccessary, to Jddress specific circumstances not 

andressed in this l11el11orJndul11, 

Appendix J: Relevant Documents 
253 


Insert offset folio 208 here 87176.208

..... ~ C::J.. DEPARTMENT OF HEALTH AND HUMAN SERVICES 

STAFF MANUAL GUIDE 32S2.XX 

GENERAL ADMINISTRATION 

EFFECTIVE DATE: 09/26120J3 

FOOD AND DRUG ADMINISTRATION 

Food and Drug Administration 

Sillier Spring MO 20993 

INFORMA nON RESOURCES MANAGEMENT - INFORMA nON TECHNOLOGY 

SECURITY 

OPERATIONAL CONTROL POLICIES 

MONITORING OF USE OF HHS/FDA IT RESOURCES 

I. PURPOSE. 

This Staff Manual Guide establishes interim policies and procedures that will strengthen the 

Food and Drug Administration's (FDA) ability to effectively document, analyze, authorize, and 

manage requests to monitor use of Department of Health and Human Services (HHS or 

Department) and FDA information technology (IT) systems and resources. 

2. SCOPE. 

This interim policy: 

• Applies to all individuals (including, but not limited to current and former civilian 

government employees, contractors, local or foreign government exchange program 

participants, Commissioned Corps personnel, guest researchers, visiting scientists, 

fellows and interns). provided access to HHS/FDA IT systems and resources; 

• Covers real-time or contemporaneous observation, prospective monitoring (e.g., using 

monitoring or keystroke capture software), and retrospective review and analyses (e.g., of 

e-mail sent or received, or of computer hard-drive contents) targeting an individual; 

• Does not apply to computer incident response monitoring of systems relating to national 

security or the Federal Infonnation Security Management Act of 2002 (FISMA) that 

perfonn general system and network monitoling, or examinations of computers for 

mal ware; 

• Does not apply to any review and analysis requested or consented to by the individual(s) 

being monitored; 

Does not apply to retrospective searches for documents in response to valid infomlation 

requests in the context of litigation, Congressional oversight, Freedom of Infonnation Act 

Appendix I: Relevant Documents 
254 


Insert offset folio 209 here 87176.209

Page 2 

(FOIA) requests, and investigations by the Government Accountability Office (GAO) 

and the Oftice of Special Counsel; 

This interim policy does not supersede any other applicable law or higher level agency 

directive, or existing labor management agreement in place as of this interim policy's 

effective date; and 

Excludes routine IT equipment examinations. Any unintended discoveries of 

problematic content and resulting follow-up actions are not subject to this interim policy, 

although follow-up actions that involve computer monitoring are subject to this interim 

policy. 

3. BACKGROUND. 

FDA is required to protect vast quantities of sensitive infonnation including, but not limited to, 

confidential commercial and financial infonnation, trade secrets, protected healthcare 

information, and classified infonnation. The Deparbnent of Health and Human Services (HHS) 

Policy /iJr Infiml1atioll Systems Security ami Privacy (lS2P),! requires the use of a warning 

banner on all Department IT systems. The warning banner must state that, by accessing an 

HHS/FDA IT system,' (e.g., logging onto a Department computer or network), the employee 

consents to having no reasonable expectation of privacy regarding any communication or data 

transiting or stored on any HHS/FDA IT system, and the employee understands that, at any time, 

the Department may monitor the use of Agency IT resources for lawful government purposes. 

While the warning banner gives FDA the authority to monitor employee use of Agency IT 

resources, FDA must carry out computer monitoring in a manner that recognizes employee 

interests and relevant legal protections. FDA will comply with all applicable laws, including but 

not limited to the Privacy Act of 1974, the privacy provisions of the E-Govemment Act of 2002, 

Whistleblower Protection Enhancement Act of 2012, and the Federal Infonnation Security 

Management Act, as well as administration policy directives issued in tiJrtherance of those Acts. 

4. REFERENCES. 

HHS Po/ic:y/iw M01litoring Employee I..lsl! o/HHS IT Resources. dated June 26, 2013 

FDA Memorandum, Monitoring o/FDA Personnel Work Compttlers, dated September 24,2012 

HHS IRM Policy for Personal Use of Infonnation Technology Resources dated February 17, 

2006 

HHS Policy/ill' b,fimnalion Systems Security ami Privacy, dated July 7,2011 

NIST SP 800-61, Computer Security Incident Handling Guide, dated March 2008 

NIST SP 800-86, Guide to Integrating Forensic Techniques -Incident Response, August 2006 

J Available at: !Jnp:"illlr:J11l·!.Ilh:-. :.!t., il'I.:\hl..·l:-<l·(.,uril\·pnli ... ·i ....... 'llhh:' hlml 

1 According to the warning banner, an HHS IT system includes "(1) the computer being accessed, (2) the computer 

network, (3) all computers connected to this network, and (4) all devices and storage media attached to this network 

or to a computer OIl this network.'· 

Appendix I: Relevant Documents 
255 


Insert offset folio 210 here 87176.210

Page 3 

Presidential Policy Directive/PPD-19, Protecting Whistleblowers with Access to Class(fjetl 

/'lformalion, dated, June 26, 2013 

S. INTERIM POLICY. 

5.1. BASIS FOR COMPUTER MONITORING. 

Computer monitoring may be authorized only for the following reasons: 

a. A written request by OIG, OSSI or an outside law enforcement authority (e.g., FBI, DHS); 

b. Where reasonable grounds exist to believe that the individual to be monitored may be 

responsible for the unauthorized disclosure of legally protected information (e.g., confidential 

commercial infomlation or PI;vacy Act-protected infomlation); or 

c. Where reasonable grounds exist to believe that the individual to be monitored may have 

violated applicable law, regulation or written HHS or FDA policy. 

5.2 EXPRESS WRITTEN A UTHORIZA TION FOR COMPUTER 

MONITORING. 

No agency ofticial, including the Chief Infonnation Officer (CIO), may conduct computer 

monitoring without prior written authorization by one of the following ofticials: 

• FDA Commissioner 

• FDA Deputy Commissioner 

• FDA Chief Operating Officer 

The authority identified herein may not be (re)delegated below the office of Chief Operating 

Officer. All requests to initiate monitoring must be in writing and shall include an explanation of 

how the monitoring will be conducted, by what method the information collected during 

monitoring will be controlled and protected, and a listing of individuals who will be provided 

access to the infonnation gathered through monitoring. Except for monitoring requested by 

outside law enforcement authority or the OIG, the party requesting the monitoring must 

document the factual basis justifying the request for monitoring and the proposed scope of the 

request. The requesting organization shall document the basis for any request for computer 

monitoring. 

5.3 REVIEW COMMITTEE. 

A Review Committee shall be established as described below and as further set forth in 

implementing procedures. This Review Committee shall consist of a representative from the 

Office of the Chief Counsel, a representative fi'om the Oftice of Infomlation Management with 

Systems Administration expertise, and a representative from the Office of Human Resources 

Appendix I: Relevant Documents 
256 


Insert offset folio 211 here 87176.211

Page 4 

with Human Capital expertise. The Review Committee may draw on additional expertise, as 

needed. 

For designated requests for monitoring, the Review Committee shall review such requests and 

recommend to an authorizing official specified in 5.2 above, that the official authorize or not 

authorize a specific request. For other requests, the Review Committee will not ordinarily 

recommend authorization or non-authorization, although it may at its discretion put a request on 

hold or make a recommendation concerning authorization to an FDA authorizing official as 

specified in 5.2 above. 

The Review Committee shall develop, as soon as practicable, procedures by which it will review 

and receive notification of requests for computer monitoring and, if appropriate, explain how 

such requests are to be submitted and documented. The Review Committee's procedures should 

ensure that the Committee promptly and efficiently reviews requests for computer monitOling 

that require a Committee recommendation to an agency authorizing official or which require that 

the Review Committee be notified of such requests. 

In developing implementing procedures, the Review Committee should consider the following 

framework for review, authOlization, and notification of requests for computer monitoring: 

a. Requests rrom outside law enforcement: The Review Committee should be 

notified of requests from outside law enforcement for which a Memorandum of 

Understanding (MGU) or similar written agreement is in effect. Provided such an 

MGU or similar written agreement is in effect (see 5.4 below), the Review 

Committee will not ordinarily make a recommendation concerning such requests 

to an FDA authorizing official. If an MGU or similar written agreement is not in 

effect, all such requests should be provided to the Review Committee for review 

and recommendation. 

b. Requests Irom GIG: The Review Committee should be notified of requests from 

GIG. 

c. Requests from sources other than outside law enforcement/GIG for prospective 

monitoring should be provided to the Review Committee for review and 

recommendation to an authorizing official. 

d. Requests from sources other than outside law enforcement/GIG for retrospective 

monitoring should, when implementing procedures have been developed, be 

provided to the Review Committee for review and recommendation, or 

notification and appropriate action. 

Appendix I: Relevant Documents 
257 


Insert offset folio 212 here 87176.212

Page 5 

5.4 MONITORING REQUESTS FROM OIG AND OUTSIDE LAW 

ENFORCEMENT. 

Computer monitoring may be requested by outside law enforcement authorities (e.g., Federal 

Bureau of Investigation (FBI), Department of Homeland Security (DHS»3 or the HHS Office of 

Inspector General (OIG). All requests from outside law enforcement agencies must be 

coordinated through the OIG, except for requests relating to national security or non-criminal 

insider threat matters, which must be coordinated with the Office of Security and Strategic 

Infornlation (OSSI) and/or the FDA Security Liaison Officer/Insider Threat Coordinator. Such 

external computer monitoring requests may be subject to different standards partly because they 

are covered by the internal controls of the requesting agency or judicial process. 

If the monitoring is requested by outside law enforcement authorities, a Memorandum of 

Understanding (MOU) or similar written agreement may be developed with outside law 

enforcement as a precondition for approving computer monitoring requests from these 

organizations. 

Such an MOU or similar written agreement shall include the following: 

a. The title and organizational component of the person(s) authorized to request 

monitoring on behalf 0 f the law enforcement agency; 

b. Documentation of the source of the official request, demonstrating approval by an 

official of the governmental entity that has the authority to request the initiation of 

such monitoring (e.g., a subpoena (administrative or grand jury», WalTant or 

national security letter (NSL), or other acceptable documented request (e.g., a 

written administrative request that meets the HIPAA Privacy Rule's requirements 

for certain disclosures to law enforcement agencies); 

c. Any restrictions applicable to the handling and disclosure of confidential 

information that may be produced by the computer monitoring; and 

d. Other items consistent with this memorandum, including the handling of sensitive 

communications. 

5.5 SCOPE OF COMPUTER MONITORING. 

Requests for computer monitoring shall be narrowly tailored in time, scope, and degree of 

monitoring. All requests to monitor shall identify the least invasive approach to accomplish the 

monitoring objectives. When reviewing requests for monitoring, authorizing officials shall also 

consider whether there are alternative information-gathering methods a v a i I a b I e (in lieu of 

monitoring) that can be utilized to address the potential risk, without jeopardizing the agency's 

objectives. When the monitoring request originates from OIG or outside law enforcement, 

.' For the purposes of this interim policy. the term "law enforcement aUlhorily" includes national security and 

intelligence agencies of the U.S. Government 

Appendix I: Relevant Documents 
258 


Insert offset folio 213 here 87176.213

Page 6 

the authorizing official will grant appropriate deference to requests made in accordance with 

this memorandum. 

5.6 DOCUMENT A TION. 

The wlitten authorization for computer monitoling must describe the reason for the monitoring. 

If the monitOling is initiated at the request of outside law enforcement, the authorization must 

document that the request was approved by an official of the governmental entity that has the 

authority to request the initiation of such monitoring. 

Except for computer monitoring initiated at the request of an outside law enforcement authority 

or OIG, the party requesting the monitoring must document the factual basis justifying the 

request for monitoring and the proposed scope of the request. Requests for such monitoring must 

include: an explanation of how the monitoring will be conducted, by what means the information 

collected during monitoring will be controlled and protected, and, a listing of individuals who 

will be provided access to the resultant monitoring infonnation. 

A record of all requests for monitoring shall be maintained by the FDA COO, along with any 

other summary results or documentation produced during the period of monitOling. The record 

also shall reflect the scope 0 f the monitoring. All infonnation collected from monitoring and 

maintained by the FDA COO must be controlled and protected, with distribution limited to the 

individuals identified in the request for monitoring and other individuals specifically designated 

by the COO as having a specific need to know such infonnation. 

5.7. LIMITING THE TIME, SCOPE AND INVASIVENESS OF 

MONITORING. 

The FDA COO will authorize computer monitoring that is appropriately nalTOW in scope, timelimited, and takes the least invasive approach to accomplish monitoring objectives. The COO, in 

reviewing requests for computer monitoring, must also consider whether there are alternative 

infonnation-gathering methods that FDA can utilize to address the concern in lieu of monitoring. 

When the computer monitoring request originates from OIG or outside law enforcement, the 

COO authorizing the monitoling will grant appropriate deference to a request made in 

accordance with this interim policy. 

5.8. SENSITIVE COMMUNICATIONS. 

No computer monitoring authorized or conducted may target communications with law 

enforcement entities, the Office of Special Counsel, members of Congress or their staff, 

employee union officials, or private attorneys. If such communications are inadvertently 

collected or inadvertently identified from more general searches, they lllay not be shared with a 

Appendix J: Relevant Documents 
259 


Insert offset folio 214 here 87176.214

Page 7 

non-law enforcement party who requested the monitoring, or anyone else, without express 

written authorization from OGC and other appropriate HHS and FDA official(s). 

5.9. PERIODIC REVIEW OF MONITORING. 

The COO shall review all computer monitoring 011 a monthly basis and, in consultation with the 

party who requested the monitOling (e.g., OCI), assess whether it remains justified or must be 

discontinued. The COO shall consider if the decision for ongoing computer monitoring should 

be reviewed by OGe. A decision to continue monitOling shall be documented in writing by the 

COO, who shall report at least monthly, to the Commissioner regarding the status of any ongoing 

monitoring. 

5.10. LEGAL REVIEW. 

Review by the FDA Office of the Chief Counsel of a request for computer monitoring will 

include, as necessary, consultation with other Divisions of HHS Office of the General Counsel, 

such as the General Law Division, especially concerning legal requirements such as the 

Whistle blower Protection Act and the HIPAA Privacy and Security Rule, about which other 

OGC Divisions have expertise. 

5.11 SPECIAL CIRCUMSTANCES. 

The authorizing official and Chief Counsel may make recommendations to the Commissioner 

for additional procedures, if necessary, to address specific circumstances not addressed in this 

Staff Manual Guide. Policies and procedures that deviate from the elements of the HHS 

Memorandum may not be implemented without the written concurrence of the HHS COO in 

consultation with the OGe. 

6. ROLES AND RESPONSIBILITIES. 

FDA Chief Counsel. Provides legal review and advice regarding requests for, and 

implementation of, computer monitoring of HHS IT systems and resources. OCC will consult 

with HHS OGC as needed. 

FDA Chief Operating Officer (COO). The COO Provides executive direction, leadership, 

coordination, and guidance for the overall day-to-day administrative operations of the FDA 

ensuring the timely and effective implementation and high quality delivery of services across the 

Food and Drug Administration (FDA). The COO will coordinate with the Office of Chief 

Counsel, the ChiefInfomlation Officer, Office of Criminal Investigation (OCI), law enforcement 

and other authorities on actions and activities involving monitoring of use of IT Resources. 

FDA Chief Information Officer (CIO). The CIO in the Office of Information Management 

(OIM) is responsible for executing monitoring as authorized by the Commissioner and COO 

Appendix I: Relevant Documents 
260 


Insert offset folio 215 here 87176.215

Page 8 

following consultation with Chief Counsel. The cIa provides the overall policy. guidance and 

general oversight of FDA's electronic records and for establishing and implementing the agency 

incident response plan for responding to the detection of adverse events involving FDA 

infonnation systems. 

FDA Chief Information Security Officer (CISO). The FDA clsa is responsible for the 

establishment and management of the FDA incident response process. The FDA clsa serves as 

an FDA focal point for incident reporting and subsequent resolution. The clsa provides advice 

and assistance to Agency managers and other organizational personnel concerning incident 

response activities. 

FDA Computer Security Incident Response Team (CSIRT). Headed by the CSIRT Lead, the 

Incident Response (IR) Team will conduct computing monitoring, forensic capabilities and 

techniques in accordance with established NIST Standards. The CSIRT provides centralized 

monitoring, tracking, analysis, insider threat detection, repOliing, notification, and coordination 

of computer security incidents and to report the finding with the appropriate officials in support 

oflaw enforcement and national secUlity officials. 

7. DEFINITIONS. 

Employee - All individuals (e.g., including, but not limited to current and fonner civilian 

government employees, contactors, local or foreign government exchange program participants, 

Commissioned Corp personnel, guest researchers, visiting scientists, fellows and interns), 

provided access to Department of Health and Human Services, Food and Drug Administration IT 

systems and resources. 

IT System - Includes (I) the computer or electronic device being accessed, (2) the computer 

network (3) all computers connected to this network, and (4) all devices and storage media 

attached to this network or to a computer on this network. 

Accessing an HHS/FDA System - e.g., logging on to a government or contractor furnished 

computer, laptop, Blackberry, iPad, scanner or other electronic device or logging on to the FDA 

network via local or remote use. 

IT Resources - Includes but is not limited to: computers and related peripheral equipment and 

software, network and web servers, telephones, facsimile machines, photocopiers, Internet 

connectivity and access to internet services, e-mail and, for the pUllJoses of this policy, office 

supplies. It includes data stored in or transported by such resources for HHS/FDA purposes. 

Outside Law Enforcement Authority - Includes national security and intelligence agencies of 

the United Sta tes. 

Appendix I: Relevant Documents 
261 


Insert offset folio 216 here 87176.216

Page 9 

Passive Monitoring/Computer Incident Response Monitoring - The Federal Infonnation 

SecuJlty Management Act (FISMA) requires each federal agency to develop, document, and 

implement an agency-wide program to provide infonnation security for the infonnation and 

infonnation systems that support the operations and assets of the agency, including those 

provided or managed by another agency, contractor, or other source. 

Walter S. Harris, MBA, PMP 

Deputy Commissioner for Operations 

Chief Operating Officer 

Appendix I: Relevant Documents 

Date: 
262 


Insert offset folio 217 here 87176.217

OfJE HUimHED TWELFTH CONGHESS 

COMMiHEE ON OVERSIGHT AND GOVERNMENT REFORM 

Housl2 OFFICE BUILDING 

WASHlt"GTON, DC 20515--614a 

May 9, 2012 

The Honorable Richard A. Lidinsky, Jr. 

Chairman 

Federal MarJtime Commission 

800 North Capitol Street, NW 

Washington, DC 20573 

Dear Mr. Chairman Lidinsky: 

It has come to my attention that the FederalMaritime Commission (FMC) may be.an 

agency in crisis. Commission insiders allege that the politicization of the Commission's core 

functions and administrative decisions has contributed to a climate offear and intimidation 

among agency managers and staff. As you know, the Office of SpeciaJ Counsel has opened an 

investigation into these allegations. 

The effect oil the staff has been measurable. According to the Partnership for Public 

Service, which produces the respected federal employee satisfaction survey The Best Places 10 

WO/'k in the Federal Government, in 2011 the FMC suffered the largest drop in employee 

satisfaNion of any agency in government.! The Committee observed a similar chilling effect on 

the staff when the Chainnan of the Nuclear Regulatory Commission politicized the agency and 

bullied career staff. The Committee treats allegations of politicization of independent regulatory 

agencies very seriously because, if true, they can undermine the performance of an agency's 

mission. The purpose of this letter is to request documents and information to better understand 

the allegations concerning the Federal Maritime Commission. 

The allegations center on your treatment of staff who objected to banning owner-operator 

truck drivers fronl providing services at the Port of Los Angeles (POLA). Prior to your being 

named Chairman in September 2009, the FMC was involved in litigation concernin~ the POLA 

Clean Truck Program (CTP), which was intended to reduce air pollution at the port. The FMC 

opposed one provision of the CTP, unrelated to air pollution, which would have effectively 

banneu independent owner-operator truck drivers, who provide the vast majority of port drayage 

services, from working at POLA. 3 Instead, under POLA.'s proposal, only trucking companies 

utilizing employee-drivers, Who are subject to unionization, would be allowed to work at the 

, THE BEST PLACES TO WORK IN TliE FEOERAL GOVERNMENT (20 II), 

htip:l!bestplacestowork.orglSPTWlrankingsioileralllsmall. 

1 Ronald D. White, Agel1<y ObjeclS 10 Clean Tl'llck Progl'Om, LA. TIMES, Oct. 30, 2008. 

's, Calif Port Truck nonSupportets Warn Currel1/ Version Will Fail, SHiPPERS' NEWSWIRE,]uiy 5, 2007. 

Appendix I: Relevant Documents 
263 


Insert offset folio 218 here 87176.218

The Honorable Richard A. Lidinsky, Jr. 

May 9,2012 

Page 2 . 

port. However, FMC economists Roy Pearson and Robert Blair testified in federal court that this 

provision would reduce competition and "unreasonably increase transportation costs," and was 

"not in any way critical to sustaining the CTP's environmental and public health benefits.'" 

Labor unions, S environmental groups,6 and "green jobs" advocacy organizations decried 

FMC's opposition to the employee-driver mandate. as set forth by Pearson and Blair in their 

court testimony.' The Natural Resources Defense Council filed a Freedom ofInformation Act 

request tor FMC documents in an attempt to prove that "external influences" may have 

precipitated the agency's "rabid attacks and scrutiny" of the employee-driver mandate.s 

According to information received by the Committee, the nonpartisan Office of the Secretary and 

the General Counsel's office - not the Chairman's Office - typically handle ForA requests. 

One of your first acts as Chairman was to insert yourself into the nonpartisan FOIA 

process by ordering that six boxes of Blair's work papers concerning CTP be sent to your office 

for review. You made this request despite the fact that these documents were the subject of 

ongoing litigation between the FMC and the Natw'al Resources Defense Council. 

The Committee has learned that Blair and Pearson may have faced retaliation for 

testifying in opposition to the employee-driver mandate in federal court. According to 

information received by the Committee, in October 2009 you told Blair and Pearson's supervisor 

Austin Schmitt to "keep an eye on" them. You further advised their supervisor that Blair and 

Pearson did not reflect well on the agency, and that Blair, who had worked for a time at the 

World Shipping Council, an association representing ocean carriers, was a "spy for the carriers" 

inside the agency. Furthermore, you allegedly told Schmitt that you regretted not having sought 

permission from OPM to fire Blair and Pearson. In another instance, following a presentation 

Pearson gave to Commissioners and staff, you stated: 

I've had several complaints concerning [Pearsons's) 'performance' at 

meeting yesterday - which fell somewhere between a red brick poly in 

Liv'erpool or a too-c1ever-by-half over the hill vaudevillian who once read 

a book. He took way too much time on a very busy day, too obtuse charts 

and his never-ending arrogant sneer toward the bench. Who vetted his 

• Dec!. of Dr. Roy 1. Pearson in Supp. ofPl.'s Mo\. for Prelim. Inj., at 5, 6-7, Fed. Mar. Comm'n v. City of Los 

Angeles. et aI., No. 08-1895 (D.D.C. Nov. 17,2008). 

, Press Relea~e, International Brotherhood of Teamsters, Environmental-Led Port Coalition Praises President 

Obama's Pick of 10seph Brennan to Lead FMC (June 9, 2009), http://www.teamster.org/contentlenvironmental-ledport-coal ition-praises-presid ent-obamas-p ick -j oseph-breMan-lead-fmc. 

David Pettit, A Tn,ekload 0/ HYPl'oerisy, NATURAL RESOURCES DEFENSE COUNCIL, Sept. 17,2008, 

http://switchboard.nrdc.orgiblogs/dpettitla_ truckload _of_hypocrisy. htm!. 

1 Press Release, Coalition for Clean & Safe Ports, National "Blue-Green" Coalition Applauds Key Obama 

Appointee's Inaugural Earth Day Award to LA Clean Truck Program (April 21, 2010), 

hltp:l/cleanandsafeportS.orglresources-for-the-mediaipress-releases/national-blue-green-coalition-applauds-keyobama-appointees-inaugural-earth-day-award-to-Ia-clean-truck-program/. 

I NRDC, "The Federal Maritime Commission Needs a Lesson in Transparency," May 19,2009, available al 

!J!l.Q:iI.llxirchboard.nrdc .orl!!blo~"'amartinezllh'" federal maritime commission.hlm!. 

Appendix I: Relevant Documents 
264 


Insert offset folio 219 here 87176.219

The Honorable Richard A. Lidinsky, Jr. 

May 9, 2012 

Page 3 

performance time? I will decide in the future what time he has. Take this 

up with his supervisor, RL. 9 

The Committee has learned that Schmitt may also have faced retaliation for defending 

Blair and Pearson. On September 20, 2010, Schmitt, in his capacity as Blair and Pearson's direct 

supervisor, gave them an adjectival performance rating of "Outstanding" and recommended they 

each receive an annual pelformance award of 3 percent of base salary, the minimum amount 

commensurate with an "Outstanding" rating under established FMC policy.IO According to 

documents reviewed by the Committee, this would have equated to awards of roughly $3,800 to 

$4,200, respectively. I I 

In spite of these ratings, you informed Schmitt through the Managing Director that you 

wanted Blair and Pearson to receive no more than $200 each, despite the fact that both their 

direct supervisor and FMC Commissioner Rebecca Dye had lauded their work performance as 

"outstanding.,,12 After Schmitt protested that this would violate agency policy, you agreed to a 2 

percent award for Blair and Pearson. You refused to put your rationale for rejecting the 

reviewing supervisor's recommendation in writing, despite the fact that doing so is also required 

by established agency policy. I] 

According to documents obtained by the Committee, on the same day that Schmitt 

refused to arbitrarily lower his recommended performance award for Blair and Pearson without 

written explanation from your office, you informed Schmitt that his department would be 

subjected to a "management survey.,,14 One of the staffers tasked to conduct this "management 

survey" later resigned, in part because he believed his task was to conduct a biased investigation 

designed to produce predetermined conclusions and damaging information about Schmitt and 

others. 

In addition to adverse personnel decisions taken against them, the Committee has learned 

that agency management subjected Schmitt, Blair and Pearson, along with at least three other 

FMC employees, to covel1 surveillance of their computers and e-mails by means of software 

called Spector 360. According to the company's website, this software captures all the 

workstation activity of a monitored employee. 15 The Committee has learned that the Inspector 

General for the FMC expressed concern about whether the agency's use of this software violated 

federal privacy regulations and requested that agency management stop using it in January 2012. 

9 E-mail from Richard A. Lidinsky, Chairman, Federal Maritime Commission, to Ronald Murphy, Managing 

Director. Federal Maritime Commission (July 14,20 I I). 

10 FEDERAL MARITIME COMMISSION, RECOMMENDATION FOR PERfORMANCE OR lNCENTIVE AWARD 

(Sept. 20, 20 I 0). 

11 FEDERAL MAllITIME COMMISSION, supra note 10 

I! Memoranda fTom Rebecca Dye, Commissioner, Federal Maritime Commission to Austin Scnmitt, Director, 

Bureau of Trade Analysis (Sept. 13, 20 I 0) (on file with aUlhor). 

OJ FEDERAL MARITfME COMMISSION, supra note I I, § (f)(7). 

" Memorandum from Ronald D. Murphy, Managing Director, Federal Maritime Commission to Austin Schmitt, 

Direclor, Bureau of Trade Analysis (Sept. 22,2010) 

IS SpectorSolt, Computer & Internet Moniloring Software, hltp:l/www.speetor360.com/(last visited May 8, 2012). 

Appendix I: Relevant Documents 
265 


Insert offset folio 220 here 87176.220

The Honorable Richard A. Lidinsky, Jr. 

May 9, 2012 

Page 4 

Despite this admonition, it appears agency management continued using Spector 360 against the 

advice of the Inspector General. 

The Committee is also concerned about misuse of taxpayer funds. For example, 

according to information we have received, the FMC procured an official car and chauffer used 

mostly to drive you from FMC headquarters to Union Station, a distance of approximately three 

blocks. 

To assist the Committee's investigation of this matter, please provide the following 

documents and infonnation as soon as possible, but by no later than May 22,2012, at noon: 

l. All documents and communications, from July 1,2009, to the present, between and 

among Richard A Lidinsky, Ronald D. Murphy and the following 

organizations/individuals: 

a. Natural Resources Defense Council; 

b. International Brotherhood of Teamsters; 

c. International Longshoremen's Association; 

d. International Longshore and Warehouse Union; 

e. Coalition for Clean & Safe Ports; 

f. Change to Win; 

g. Office of the Honorable Antonio Villaraigosa, Mayor of Los Angeles; 

h. Office of Geraldine Knatz, Executive Director, Port of Los Angeles; 

i. Office of the Honorable Nancy Pelosi; and 

j. Executive Oftice of the President. 

2. 'All documents and communications, from July 1,2009, to the present, referring or 

relating to Austin Schmitt, Roy Pearson, Robert Blair, Edward Anthony, Spector 360 

software, the Survey o/Bureau o/Trade AnalysiS Programs (Aug. 22, 201 1), the 

Natural Resources Defense Council FOIA request, the Port of Los Angeles Clean 

Truck Program, and the Chainnan's Inaugural Earth Day A ward, between and among 

Richard A Lidinsky, Ronald D. Murphy and the following individuals: 

a. Rebecca A. Fenneman; 

b. Adam R Trzeciak; 

c. Laura Mayberry; 

d. Jerome Johnson; 

e. Michael H. Kilby; 

f. David Story; and 

g. Anthony Haywood. 

3. ,A complete accounting of the agency's purchase and use of Spector 360 software, 

including the total amount of agency funds expended, the agency employees 

subjected to monitoring, the justification for monitoring them, whether the FMC 

Inspector General requested that the agency stop using Spector 360 to monitor certain 

employees, and whether the agency immediately complied with that directive, 

Appendix I: Relevant Documents 
266 


Insert offset folio 221 here 87176.221

The Honorable Richard A. Lidinsky, Jr. 

May 9, 2012 

Page 5 

4. A complete accounting of the agency's procurement of a vehicle for the purpose of 

transporting commissioners and agency employees, including: 

a. The year, make and model of the vehicle; 

b. The total amount spent on the vehicle, including any costs involved in securing 

garage space for the vehicle; 

c. The salary of any individual whose job description includes driving the vehicle; 

and 

d. All records describing the use of the vehicle including origins, destinations, 

frequency of use, and passengers. 

5. A complete accounting of the agency's purchase of any decorative or commemorative 

items such as paintings, sculptures, works of art, furniture, or coins on behalf of the 

Office of the Chailman since September 11, 2009, including the total amount spent 

and the method of payment 

6. A complete accounting of the agency's 50th Anniversary Party, including total funds 

expended and a break-down of funds expended by category. 

The Committee on Oversight and Government Reform is the principal oversight 

committee of the House of Representatives and may at "any time" investigate "any matter" as set 

forth in House Rule X 

When producing documents to the Committee, please deliver production sets to the 

Majority Staff in Room 2157 of the Rayburn House Office Building and the Minority Staff in 

Room 2471 of the Rayburn House Office Building. The Committee prefers, if possible, to 

receive all documents in electronic format An attachment to this letter provides additional 

information about responding to the Committee's request. 

If you have any questions about these requests, please contact Brien Beattie or Jonathan 

Skladany of the Committee staff at (202) 225-5074. Thank you for your attention to this 

important matter. 

Attachment 

cc: The Honorable Elijah E. Cummings, Ranking Minority Member 

Appendix I: Relevant Documents 
267 


Insert offset folio 222 here 87176.222

DARRELL E. ISSA, CALIFORNIA 

CHAIRMAN 

ELIJAH E. CUMMINGS, MARYLAND 

RANKING MINORITY MEMBER 

ONE HUNDRED TWELFTH CONGRESS 

ctCougte~~ of tbe mtutteb ~tate~ 

~ou5e of il\epresentlltibes 

COMMITTEE ON OVERSIGHT AND GOVERNMENT REFORM 

2157 RAYBURN HOUSE OFFICE BUILDING 

WASHINGTON, DC 20515-6143 

MajoritY (202) nSo-SO?4 

Minontv (202) 225-5051 

Responding to Committee Document Requests 

J, In complying with this request, you should produce all responsive documents that are 

in your possession, custody, or control, whether held by YOll or your past or present 

agents, employees, and representatives acting on your behalf. You should also 

produce documents that you have a legal right to obtain, that you have a right to copy 

or TO which you have access, as well as documents that you have placed in the 

temporary possession, custody, or control of any third pany. Requested records, 

documents, data or information should not be destroyed, modified, removed, 

transferred or otherwise made inaccessible to the Commitlee. 

2. In the event Ihat any entity, organization or individual denoted in this request has 

been, or is also known by any other name than that herein denoted, the request shall 

be read also to include that alternative identification. 

3. The Committee's preference is to receive dOC\lments in electronic form (Le., CD, 

memory stick, or th\lmb drive) in lieu of paper productions. 

4. Documents produced in electronic format should also be organized, identified, and 

indexed electronically. 

5. Electronic document productions should be prepared according to the following 

standards: 

(a) The production should consist of single page Tagged Image File ("TIF"), files 

accompanied by a Concordance-formar load file, an Opricon reference file, and a 

file defining the fields and character lengths of the load file. 

(b) Document numbers in the load file should malch document Bates numbers and 

TfF file names. 

(c) If the production is completed through a series of multiple partial productions, 

field names and file order in all load files should match. 

Appendix I: Relevant Documents 
268 


Insert offset folio 223 here 87176.223

6. Documents produced to the Committee should include an index describing the 

contents of the production. To the extent more than one CD, hard drive, memory 

stick, thumb drive, box or folder is produced, each CD, hard drive, memory stick, 

thumb drive, box or folder should contain an index describing its contents. 

7. Documents produced in response to this request shall be produced together with 

copies of file labels, dividers or identifying markers with which the)' were associated 

when they were requested. 

8. When you produce documents, you should identify the paragraph in the Committee's 

request to which the documents rcspond. 

9. It shall not be a basis for refusal to produce documents that any other person or entity 

also possesses non-identical or identical copies of the same documents. 

10. I f any of the requested information is only reasonably available in machinc-readable 

[orm (such as on a computer server, hard drive, or computer backup tape), you should 

consult with the Committee staff to determine the appropriate format in which (0 

produce the information. 

11. ]fcompliance with the request cannot be made in full, compliance shall be made to 

the extent possible and shall includc an explanation of \Vhy full compliance is not 

possible. 

12. In the event that a document is withheld on the basis of privilege, provide a privilege 

log containing the following information conceming any such document: (a) the 

privilege assettcd; (b) the type of document; (c) the general subject matter; (d) the 

date, author and addressee; and (e) the relationship of the author and addressee to 

each other. . 

13. If any document responsive to this request was, but no longer is, in your possession, 

custody, or control, identify the document (stating its date, author, subject and 

recipients) and explain the circumstances under which tbe document ceased to be in 

your possession, custody, or control. 

14. If a date or other descriptive detail set forth in this request referring to a document is 

inaccurate, but the actual date or other descriptive detail is known to you or is 

otherwise apparent from the context of the request, you should produce all documents 

which would be responsive as if the date or other descriptive detail were correct. 

15. The tilne period covercd by this rcquest is included in the attached request. To the 

extent a time period is not speci [jed, produce relevant documents from January 1. 

2009 to the present. 

16. This request is continuing in nature and applies to any newly-discovered information. 

A ny record, document, compilation of data or information, not produced because it 

has not been located or discovered by the return date, shall be produced immediately 

upon subsequent location or discovery. 

Appendix I: Relevant Documents 

2 
269 


Insert offset folio 224 here 87176.224

17. All documents shall be Bntes-stamped sequentially and produced sequentially. 

18. Two sets of documents shall be delivered, one set to the Majority Staff and one set to 

the Minority Staff. When documents are produced to the Commillee, production sets 

shall be delivered to the Majority Staff in Room 21570fthe Rayburn House Office 

I3uilding and the Minority Staff in Room 2471 of the Rayburn House Orrice Building. 

19. Upon completion of the document production, YOIl should submit a wrillen 

certification, signed by you or your counsel, stating that: (I) a diligent search has 

been completed of all documents in your possession, custody, or control which 

reasonably could contain responsive documcnts; and (2) all documents located during 

the search that are responsive have been produced to the Committee. 

Definitions 

1. The term "document" means any IM'ittell, recorded, or graphic matter of any nature 

whatsoever, regardless of how recorded, and whether original or copy, including, but 

not limited to, the following: memoranda, reports, expense reports, books, manuals, 

instructions, financial reports, working papers, records, notes, leners, notices, 

confirmations, telegrams, receipts, appraisals, pamphlets, magazines, newspapers, 

prospectuses, inter-office and intra-office comniunicatiol1s, electronic mail (e-mail). 

contracts, cables. notations of any type of conversation. telephone call, meeting or 

other communication. bulletins, printed matter, computer printouts, teletypes, 

invoices, transcripts, diaries, analyses, returns. summaries, minutes, bills, accounts, 

estimates, projections. comparisons, messages, correspondence, press releases, 

circulars, financial statements, reviews, opinions, offers, studies and investigations, 

questionnaires and surveys, and work sheets (and all drafts, preliminary versions, 

alterations, modifications, revisions, changes, and amendments of any of the 

foregoing, as well as any attachments or appendices thereto), and graphic or oral 

records or representations of any kind (including without limitation, photographs, 

charts, graphs. microfiche, microlilm, videotape. recordings and motion pictures), and 

electronic, mechanical, and electric records or representations of any kind (including, 

without limitation. tapes, cassettes, disks, and recordings) and other written, printed, 

typed. 0/' other graphic or recorded matter of any kind or nature, however produced or 

reproduced, Dnd whether preserved in writing, film, tape, disk, videotape or 

otherwise. A document bearing any notation not a part of the original texi is to be 

considered a separate document. A draft or non-identical copy is a separate document 

within the meaning of this term. 

2. The term "communication" means each manner or means of disclosure or exchange 

of infonnation, regardless of means utilized, whether oral, electronic, by document or 

otherwise, and whether in a meeting, by telephone, facsimile. email, regular mail, 

telexes, releases. Or otherwise. 

3. The terms "and" and "or" shall be eonstrued broadly and either conjunctively 01' 

disjunctively to bring within the scope of this request any information which might 

Appendix I: Relevant Documents 

3 
270 


Insert offset folio 225 here 87176.225

otherwise be construed to be outside its scope. The singular includes plural number. 

and vice versa. The masculine includes the feminine and neuter genders. 

4. The terms "persoll" or "persons" mean nntural persons, firms, partnerships, 

associations, corporatim1s, subsidiaries, divisions, depaf1ments, joint ventures, 

proprietorships, syndicates, or ather legal, business or government entities, and all 

subsidiaries, affiliates, divisions, departments, branches, or other units thereof. 

5. The term "identify," when used in a question about individuals, means (0 provide the 

following information: (a) the individual's complete name and title; and (b) the 

individual's business address and phone number. 

6. The term "referring or relating," with respect to any given subject, means anything 

that constitutes, contains, embodies, reflects, identities, states, refers to, deals with or 

is pertinent to that subject in any manner whatsoever. 

Appendix 1: Relevant Documents 
271 


Insert offset folio 226 here 87176.226

l~WRfNnj ~RADY 

S11\t,omECh)R 

ONE HUNDRED THIRTEENTH CONGRESS 

((ongre5'5' of tbe mniteb ~tate5' 

~OU5c of l\eprescntlltibcs 

COMMITTEE ON OVERSIGHT AND GOVERNMENT REFORM 

2157 RAYBURN HOUSE OFFICE BUILDING 

WASHINGTON, DC 20515-6143 

t2Wl22>-~7~ 

IZU:;)22hl~N 

1201j225-:;O$1 

February 25, 2014 

The Honorable Elijah E. Cummings 

Ranking Member 

Committee on Oversight and Government Reform 

U.S. House of Representatives 

Washington, D.C. 20515 

Dear Ranking Member Cummings: 

HljA>1E CUMPilINGS.MARVlANIJRANI(INOMINOfllTVMEM!IE~ 

CAROLYN II. MAlON~V, fo;fWYOR~ 

fLfA"'OR >10lMES NORTON, 

DISTRICT O~ COLUMPIA 

JO>1NF.TIEflN£'(MA.SSAC>1USHTS 

WM.LACYCtAY.I;IISSOUfll 

Sf€P~ENF,lYNC>1.MASSACHUS€TrS 

JIMCOOPER,TENNESSH 

GfRAlOE.CONNQlLY,VIRGINIA 

)ACK1fSI'EIEF!.CAllFOJlNIA 

MATTHEW A, CAflTWF!IG~;. P€NNSVlIIANI", 

MA~!(POCAN,WISr:ONSiN 

l TAMMY OUCKWORTH ,LLINOI$ 

AOI!JNl K£lLY,IU1NOIS 

DANNY I( DAVIS,lLllNOIS 

H'rEflWEtCKVfAMONT 

TONI'CARDEN.lS.CAllfORNIA 

STIlIIENA kORSfORD,N(IIAOA 

MICH!LlE LUJAN GfllSHAM,NEW Mf)(lC'O 

I received your letter requesting a postponement of the February 26,2014, full 

Committee hearing entitled "Limitless Surveillance by the FDA: Protecting the Rights of 

Federal Whistleblowers."l I am surprised by your efforts to thwart a hearing exposing 

unprecedented computer monitoring of employees at the Food and Drug Administration, 

especially when it became clear that FDA officials approved this monitoring without 

regard for the employees' right to communicate with Congress. 

During this joint investigation with Senator Grassley, the Committee conducted 

transcribed interviews in which your staff participated fully. Senator Grassley's 

Democratic counterparts were also invited to participate, but they declined. Your request 

to postpone appears to be yet another attempt to obstruct the progress of the Committee 

as it seeks to expose waste, fraud, abuse and mismanagement in our federal government. 

In fact, the reasons from the FDA and your office for requesting a postponement 

for the hearing have shifted several times in less than a week. First, the FDA told the 

Committee that its witnesses needed more time to prepare, despite having known about 

this hearing since January 14,2014. Next, the FDA stated that scheduling conflicts 

would prevent their witnesses from testifying. Then, your staff requested a postponement 

to allow the HHS Inspector General additional time to complete its report on the FDA 

monitoring. Now, according to your letter, your staff needs additional time to interview 

the whistleblowers. In fact, as your staff knows, the FDA whistleblowers expressed 

serious reservations about providing documents and information to your staff, based on a 

belief that you and your staff work hand in hand with the federal agencies under 

investigation by the Committee. Based on the events of the past week-in which r have 

heard requests to postpone the hearing from FDA, your staff, and now you-it is obvious 

why they would think that. 

! Letter from Hon. Elijah E. Cummings, Ranking Member, H. Comm. on Oversight and Gov't Refonn. to 

Hon. Darrell E. Issa, Chairman, H. Corum. on Oversight and Gov't Reform (Feb. 24, 2014). 
272 

Æ 


Insert offset folio 227 here 87176.227

The Honorable Elijah E. Cummings 

February 25,2014 

Page 2 

I am also concerned that you and your staff-perhaps unwittingly-partnered 

with the FDA in an attempt to mislead the Committee. On February 20,2014, your staff 

wrote an e-mail to my staff-based on one of many conversations your staff had with 

Administration officials that excluded the Majority staff--claiming that FDA "informed 

us that the IG has already completed a draft report, that the FDA has already submitted 

its comments to the draft report, and that they expect the final report to be released 

'imminently. ",2 In fact, FDA did not submit its comments to the draft until the next day, 

February 21,2014. 3 

Throughout this investigation, your stafffocused on the conduct of the 

whistleblowers that were under surveillance, as part of an apparent effort to justify the 

actions of the FDA. Despite your often hostile posture towards federal employee 

whistleblowers who contact Congress about waste, fraud, abuse and mismanagement at 

federal agencies, I will continue to position this Committee as a safe place where 

whistleblowers can confidently bring their allegations. In the future, I hope you will 

work with me to safeguard protected communications with Congress instead of 

attempting to obstruct a hearing aimed at exposing mismanagement and supporting the 

rights of whistle blowers. 

Darrell Issa 

Chairman 

2 E-mail from H. Comm. on Oversight & Gov't Refonn Minority Staff to H. Comm. on Oversight & Gov't 

Refonn Majority Staff (Feb. 20, 2014,3: 17 p.m.). (emphasis added) 

J Telephone call with HHS OIG staffCFeb. 21, 2014).