In Vast Effort, F.D.A. Spied on E-Mails of Its Own Scientists

[choie]

Source: NY Times

By ERIC LICHTBLAU and SCOTT SHANE
Published: July 14, 2012

WASHINGTON — A wide-ranging surveillance operation by the Food and Drug Administration against a group of its own scientists used an enemies list of sorts as it secretly captured thousands of e-mails that the disgruntled scientists sent privately to members of Congress, lawyers, labor officials, journalists and even President Obama, previously undisclosed records show.

What began as a narrow investigation into the possible leaking of confidential agency information by five scientists quickly grew in mid-2010 into a much broader campaign to counter outside critics of the agency’s medical review process, according to the cache of more than 80,000 pages of computer documents generated by the surveillance effort.

Moving to quell what one memorandum called the “collaboration” of the F.D.A.’s opponents, the surveillance operation identified 21 agency employees, Congressional officials, outside medical researchers and journalists thought to be working together to put out negative and “defamatory” information about the agency.

F.D.A. officials defended the surveillance operation, saying that the computer monitoring was limited to the five scientists suspected of leaking confidential information about the safety and design of medical devices.

Read more: http://www.nytimes.com/2012/07/15/us/fda-surveillance-of-scientists-spread-to-outside-critics.html?hp

[MADem]

1. Are those bowling balls or...wait, wait...HEADS ROLLING?

And not the heads of whistleblowers, either....?
At least the WH gave a shit about this--the Bush administration would have cheerleaded it.

While federal agencies have broad discretion to monitor their employees’ computer use, the F.D.A. program may have crossed legal lines by grabbing and analyzing confidential information that is specifically protected under the law, including attorney-client communications, whistle-blower complaints to Congress and workplace grievances filed with the government.


Other administration officials were so concerned to learn of the F.D.A. operation that the White House Office of Management and Budget sent a governmentwide memo last month emphasizing that while the internal monitoring of employee communications was allowed, it could not be used under the law to intimidate whistle-blowers. Any monitoring must be done in ways that “do not interfere with or chill employees’ use of appropriate channels to disclose wrongdoing,” the memo said.

http://www.nytimes.com/2012/07/15/us/fda-surveillance-of-scientists-spread-to-outside-critics.html?pagewanted=2&_r=1&hp

[DeSwiss]

2. Damn I hope so.....

...because if there is any agency which deserves to be reamed, excoriated and the whole lot of them fired forthwith, it's the Big Pharma sycophantic drug pushers at the FDA.

Corrupt and rotten as hell.....



K&R

[MADem]

4. Well, one thing about Congressmen--they aren't at all short of hubris.

And these unelected little bureaucratic fuckers over at FDA were SPYING ON THEM, reading THEIR mail, intercepting THEIR private correspondence! White House staff aren't all that humble either--I'm sure they've got their "How DARE they?" on!

I can't disagree with your assessment of those FDA assclowns--but the good news is this; it may be an opportunity to do an early clear-out of all that BushCo deadwood over there that converted from appointments to civil service. Of course, there will have to be investigations, but I can't see Congress coddling those bums one bit if they decide to hold hearings. Here's hoping...!

[boppers]

8. In what way is using a public resource, to send a public message, over a public network.... private?

I'm not seeing it, at multiple levels.

[MADem]

9. These people were whistleblowing. You're seriously thinking that anyone, for any reason, should be

allowed to read anyone's work-related emails for any reason? What--we should publish the emails of Congressional staffers along with the Congressional record? Please. The messages are not "public"--they are work product and in this case, they had to do with whistleblowing. The network, FWIW, is not "public" either--if it were, we could all access it. And we cannot.

We do not have the contemporaneous "right" to look over the shoulders of public servants as they do their jobs. If we did, there'd be very little work getting done. This work product is made a matter of record for historical and other purposes, but it is not published unless a need arises for the materials, for example, in the context of an investigation. Contemporaneous surveillance, in the hopes of catching people out, to discover who the "rat" is who is reporting on workplace malfeasance, is an improper use of Privacy Act authorities.

Talk about a context-free thought process! That's the politest way I could think of to describe what you are saying.

I'm not seeing the point you are struggling to make. I doubt anyone else is, either.

[boppers]

10. Not their network, not their computers, not their email.

It's public equipment, public networks, public emails.

If you want to be a whistle blower, get internet at your house and use your own laptop, or use a borrowed machine at a coffee shop, or whatever.

[MADem]

12. The keyloggers were abusing their Privacy Act oversight duties.

They were stalking people and reading, line for line, what they were writing. They weren't checking to be sure they weren't watching porn or playing solitaire, they were keylogging. You don't do that without very specific authorizations.

Further, computer security/oversight is the job of the IT arm of an organization, it is not the job of the leadership within the organization to spy on their workers.

The networks are not "public," one more time. If they were, you could log on to them, and you cannot. They are "government" and there is a distinction and a difference there. Nor are the emails "public"--if they were, you could read them at your leisure any time you please, and you cannot do that either.

Heads will roll over this, count on it.

[boppers]

28. The networks are public property. The emails can be FOI'ed.

First I've heard of keyloggers, though, and that would be a sign of incompetence, as what I had heard was logging their email, and for that, you just need to log their email server traffic, not the keyboard.

[MADem]

30. You can FOIA them, but you might not get them.

You can't say "I want all of Joe Blow's emails from date to date." You have to have a reason and a subject.

The software was installed on their computers in order to do copying of flash drives as well as keylogging, and the bosses were reading the stuff--not just what they were writing, but what they were writing in REAL TIME.

It was a complete abuse of the privacy act. I hope those heads roll soon.

[boppers]

31. Was the software installed on private, personal, computers?

I haven't read as such.

Sure, it could have read flash drives, once they made them part of a public-asset computer network. Again, I haven't seen any references to keylogging, and don't expect to, mostly because it's a total waste of resources, and is only useful for catching things like caps-lock morse code. They weren't chasing spies, they were chasing folks who were trying to get grants approved by whining about their research to lower-level flunkies....

...and now those folks seem to be whining that "OMG, my workplace can see what I did on my work computer!".

[MADem]

32. I don't mean to be rude, but when you keep repeatedly insisting that you are right, and you are not,

it would help if you bothered to click on the link and read the story before you kept doubling down. If you "haven't read as such" it's because you didn't bother to read the doggone article.

Really. Here, since you seem unable to be bothered to read the full story that is linked in the OP (and here's that very link again) : http://www.nytimes.com/2012/07/15/us/fda-surveillance-of-scientists-spread-to-outside-critics.html?pagewanted=2&_r=1&hp

The agency, using so-called spy software designed to help employers monitor workers, captured screen images from the government laptops of the five scientists as they were being used at work or at home. The software tracked their keystrokes, intercepted their personal e-mails, copied the documents on their personal thumb drives and even followed their messages line by line as they were being drafted, the documents show.

Okay?


But wait, there's more:

Other administration officials were so concerned to learn of the F.D.A. operation that the White House Office of Management and Budget sent a governmentwide memo last month emphasizing that while the internal monitoring of employee communications was allowed, it could not be used under the law to intimidate whistle-blowers. Any monitoring must be done in ways that “do not interfere with or chill employees’ use of appropriate channels to disclose wrongdoing,” the memo said.

They used a commercial software to do their dirty work:

The software used to track the F.D.A. scientists, sold by SpectorSoft of Vero Beach, Fla., costs as little as $99.95 for individual use, or $2,875 to place the program on 25 computers....“Monitor everything they do,” says SpectorSoft’s Web site. “Catch them red-handed by receiving instant alerts when keywords or phrases are typed or are contained in an e-mail, chat, instant message or Web site.”

And they "went rogue" to do it, because they were turned down by the agency who would have been responsible for an investigation, because that agency found no wrongdoing. That didn't stop them, though:

F.D.A. officials went to the inspector general at the Department of Health and Human Services to seek a criminal investigation into the possible leak, but they were turned down. The inspector general found that there was no evidence of a crime, noting that “matters of public safety” can legally be released to the news media.

I understand government monitoring of communications on government workplace computers. These assclowns went WAY over the line, and they deserve to be fired for it.

[boppers]

38. I read it.

Government computers, government networks.

FWIW, line-by-line isn't keylogging, it's auto-save, and in general, I don't trust the media to get anything tech right, so maybe I have blinders on.... It looks like the software company in question *does* do keylogging software, but that just seems like a waste of time, and maybe I give them more credit than they deserve.

[MADem]

40. Sorry--I continue to vociferously disagree with your argument. And I have first-hand experience

with this issue and how government IT oversight is applied, so I will have to take my view over yours.

[boppers]

43. I have a bit of first hand experience, myself.

Maybe it's a matter of different policies in different arms of government, and different levels of security.

Example: Q clearance data and equipment gets *no* real-world exceptions for, oh, personal medical privacy, attorney-client privilege, etc... everything is assumed to be under surveillance, and it often is, because a single misplaced hard drive is a "National Security Threat", a single inappropriate packet on the network can be an attack.

A federal grain inspector, OTOH, is probably under much less scrutiny, and likely wouldn't be fired for writing a letter to their congressman on their work computer. The FDA is likely somewhere in between.

[MADem]

47. FDA has no "security issues" -- and the HHS IG said as much.

Nonetheless, the FDA leadership engaged in a rogue operation where they spied on members of the workforce, despite the Inspector General attached to the agency ABOVE them in the chain of command telling them that there was no "there" there.

They were also specifically told that the scientists and researchers had every right to communicate with members of Congress, and that, too, was ignored.

The whole thing stinks to high heaven...wrongful termination, intimidation of whistle-blowers...the morons who thought installing spyware on those computers was a good idea are probably regretting it, as Dick Cheney would say, "Big Time."

[boppers]

50. No, the IG and Federal Prosecutors said there was no criminal case.

Either way.

Work for the Fed, expect *every email*, *every web page", *every document* on their computers to be their property, not yours, and definitely, not private.

[MADem]

55. What part of crossing the legal line is unclear here ?

They were retailiated against for lawfully communicating with Congress and others.

While federal agencies have broad discretion to monitor their employees’ computer use, the F.D.A. program may have crossed legal lines by grabbing and analyzing confidential information that is specifically protected under the law, including attorney-client communications, whistle-blower complaints to Congress and workplace grievances filed with the government.

...The intercepted e-mails revealed, for instance, that a few of the scientists under surveillance were drafting a complaint in 2010 that they planned to take to the Office of Special Counsel. A short time later, before the complaint was filed, Dr. Smith and another complaining scientist were let go and a third was suspended.

http://www.nytimes.com/2012/07/15/us/fda-surveillance-of-scientists-spread-to-outside-critics.html?hp&pagewanted=all

The only question that remains is, did GE Healthcare assist FDA in spying on those scientists and researchers? If they did, there's more Big Trouble to follow.

[boppers]

59. "may have"

"may have crossed legal lines"

From your quotes.

"may have".

[woo me with science]

45. Maybe not if Obama gets his way.

Obama Admin Seeks Permission To Lie In Response To FOI Requests - Even To The COURTS
http://www.democraticunderground.com/discuss/duboard.php?az=view_all&address=439x2185303

[boppers]

49. To emphasized and convoluted for me to follow right now.

Can you post this "Obama Admin Seeks Permission To Lie" part?

[woo me with science]

62. Sorry that was too difficult,

but, no, I won't be doing that for you. Perhaps learning to read and follow links should precede trying to participate on a political discussion board.

I will also wait until you master the usage of "to," "too," and "two."

[boppers]

64. Mea culpa.

I woke up and couldn't figure out what the hell I was trying to say.... I gotta stop working 18 hour shifts.

[boppers]

65. Okay, now I have myself put together.

This spat could be broken down as follows:
"I want to know about the government's program Orange".
"Can't tell you".
"Do you have an Orange"?
"Can't tell you".
"Does Orange exist"?
"Can't tell you".

It's not a lie to say "No, you don't have the access levels required to know whether or not something even exists or not"... It's a defense against brute-forcing the system.

[bananas]

16. "specifically protected under the law, including attorney-client communications, whistle-blower complaints to Congress and workplace grievances filed with the government.

specifically protected under the law,
including attorney-client communications,
whistle-blower complaints to Congress and
workplace grievances filed with the
government.

[boppers]

29. So, all bitching to congress and lobbying should be protected?

Be careful what you wish for.

[MADem]

34. Who's talking about lobbyists? You are being deliberately obtuse. nt

[boppers]

39. They were lobbying congress over FDA regulations.

They got caught, and are now screaming about it, because their "privacy" to lobby in secret was being captured.

[MADem]

41. You don't, quite apparently, understand what lobbying means.

Government employees speaking with government representatives about faults in a government agency is not "lobbying."

Trying to con a congressman into voting for a new road into an area where you plan to build a casino is lobbying.

I think you've pretty much showed your hand, here.

[boppers]

44. Journalists are government representatives?

They were leaking confidential information to anybody who would listen, trying to lobby for changing the standards.

Typically, this happens when somebody has a financial interest in a competing product that would meet the changed standards... so, not roads, but millions and billions in sales of drugs and medical devices.

[MADem]

48. Last time I checked, journalists weren't members of Congress.

Words do have meanings, you know, and you are going very far afield indeed with your stretched definition of "lobbying."

[boppers]

51. Read the OP.

In case you missed it: "A wide-ranging surveillance operation by the Food and Drug Administration against a group of its own scientists used an enemies list of sorts as it secretly captured thousands of e-mails that the disgruntled scientists sent privately to members of Congress, lawyers, labor officials, journalists and even President Obama, previously undisclosed records show"

[MADem]

52. I did read it--I understand what the scientists did. It's called whistleblowing, not "lobbying."

Lobbyists are people paid by manufacturers of drugs, defense equipment, restaurant supplies, you name it, who "lobby" elected officials in order to persuade them to vote this way or that.

You are confusing reporting problems to the press and communicating those problems to elected officials with "lobbying," and your definition is off the mark. The scientists and researchers were not paid to tout a POV. They did it because they saw a problem and reported it.

[boppers]

56. They saw a problem/solution which might affect their monetary interests.

"The scientists and researchers were not paid to tout a POV. "

You have no idea how this works.

[MADem]

60. No--you don't. And you've demonstrated that here very clearly. nt

[boppers]

61. Google "Dr. Andrew Wakefield".

[MADem]

53. You are wrong, you didn't read the article carefully at all.

The ones approving the changes that harmed the public were the OTHER guys--the ones who were doing the spying and firing. The scientists didn't want patients getting fried. The issue here, specifically, was the safety and design of medical devices. The scientists opposed the changes that the bosses wanted. They felt the review process was "faulty."

So, if anyone had a financial interest here, it would be the ones desiring the change of standards--the keyloggers, the spies, the whistleblower-intimidators, who wanted new equipment--dangerous equipment--manufactured and sold.

Details in this paragraph from the OP link:

The extraordinary surveillance effort grew out of a bitter dispute lasting years between the scientists and their bosses at the F.D.A. over the scientists’ claims that faulty review procedures at the agency had led to the approval of medical imaging devices for mammograms and colonoscopies that exposed patients to dangerous levels of radiation.

[boppers]

57. Oh, "radiation" fear?

I think we're done.

PS: Don't eat Brazil Nuts.

[MADem]

58. You didn't read the article, and now you are being rude, so yeah, we are done. nt

[bananas]

3. Wow - and then it was posted on a public website by a private document-handling contractor. nt

[MADem]

5. Yep--blazingly stupid. There's always some little fart digging around here! nt

[judesedit]

24. Good one

[judesedit]

25. Too funny

[slackmaster]

6. How does one send email "privately" from an employer- (i.e. government-) owned laptop computer?

Anyone who has an expectation of privacy on such a system is a fool.

[judesedit]

23. Precisely!

[boppers]

7. They sent emails from government accounts, on government computers, over government networks.

Gee, they might be observed? Color me shocked.

This is how it is *supposed* to work.

[slackmaster]

11. It's safe to assume they signed a computer usage agreement that explicitly says their activity...

...is subject to monitoring.

[bananas]

17. specifically protected under the law,including attorney-client communications,whistle-blower complaints to Congress andworkplace grievances filed with thegovernment.

specifically protected under the law,
including attorney-client communications,
whistle-blower complaints to Congress and
workplace grievances filed with the
government.

[FarCenter]

13. Anything you do on your employer's IT system is not private.

[sendero]

14. For those for whom the nuance of this story was lost.....

.... it isn't the communications of the scientists involved strictly speaking that is the issue here. it is that replies from congresspersons and the like were monitored also.

You might make a case for the former, the latter is going to be a tough sell.

[FarCenter]

15. If you send to [e-mail] the email belongs to EatNoFat

[bananas]

18. "specifically protected under the law, including attorney-client communications, whistle-blower complaints to Congress and workplace grievances filed with the government.

specifically protected under the law,
including attorney-client communications,
whistle-blower complaints to Congress and
workplace grievances filed with the
government.

[FarCenter]

20. So the senders should put "whistle blower complaint" or "attorney client" in the Subject line

Else, how does the company's mail server distinguish between these kinds of email and others?

[MADem]

26. The "bosses" should not be keylogging the employees.

There are ways for the IT people to monitor usage, and they usually do it on a random basis, unless they find someone downloading porn or what-have-you. The IT boss doesn't tattle to the administrative or operational bosses, so long as the communications meet, dare I say, TOS!

Playing World of Warcraft? Bad. Communicating via email or transmitting work product to another .gov entity, like a Congressman? None of IT's business.

[bananas]

27. These asshole managers committed multiple felonies and should be thrown in jail for a long time. nt

[judesedit]

22. Exactly!

[MADem]

36. The other nuance is that their bosses in the criminal investigation division at Health and Human

Services told them to cut the shit, that there was no evidence of wrongdoing, and no investigation (the purview of which belongs to HHS IG--not a couple of admin bosses buying off the shelf spy software) was warranted.

They didn't like what their boss told them, so they went and did an investigation on their own.

[MADem]

33. The IG at HHS told them that the scientists and researchers were doing NOTHING WRONG.

They turned down the big cheese's request for a criminal investigation citing lack of evidence. In other words, the bosses of these idiots told them NO, and they did it ANYWAY.

The leadership "went rogue" and did their OWN investigation to try to save their own asses and intimidate whistleblowers who would get them in trouble.

[MADem]

35. When the IG of the agency above you says the scientist/researchers were doing NOTHING WRONG, I think

those FDA assclowns should have taken them at their word. The IG refused to do a criminal investigation and that pissed off these bullies at the FDA.

Instead, they started up their own investigation outside criminal investigative channels, in order to protect their own jobs as a consequence of their own misdeeds.

They are in big trouble.

[FarCenter]

37. This appears to have been done by FDA IT security people with the advice of FDA counsel.

Investigation Sought of Extensive F.D.A. Surveillance

http://www.nytimes.com/2012/07/17/us/politics/inquiry-sought-of-extensive-fda-surveillance.html

It appears that the F.D.A.’s information security section ran the day-to-day operations using so-called spy software that collected e-mails, screen images and other material from the scientists’ government-issued computers and on their personal thumb drives.

Senator Charles E. Grassley, Republican of Iowa, said in a letter Monday to Dr. Margaret Hamburg, the F.D.A. commissioner, that he had learned from an unnamed source that the agency’s general counsel had signed off on the program in writing.

Any whistleblower who uses an organization's equipment and software to do private communications is naiive in the extreme. You need to use your personal stuff that has never been connected to the organization's network, and you need to use strong encryption for private communications. The FBI and NSA make it difficult and complex to communicate privately, but it can be done.

[may3rd]

19. transparency you can believe in ?

Why doesn't the admin put a stop to these spam checkers?

[judesedit]

21. Sent privately? If they were on company computers that is standard practice really. That's what IT

is for. To make sure employees are not bullshitting around on company time and not sending out sensitive or derogatory information against the department/company/agency. Since when did the Food and Drug Administration become some secret entity? I'ts a government agency paid for with tax dollars? Is it because Food and Drugs don't belong in the same agency anyway??? GMO's anyone??? This is non-news as far as I'm concerned. The president and congress SHOULD know what's going on over there.

[annabanana]

42. more kick.. n/t

[cstanleytech]

46. Sucks but isnt it legal if they were on government owned computers? nt

[MADem]

54. The Inspector General did not authorize the spying.

In fact, the IG said Don't Do It.

[cstanleytech]

63. Interesting. Someone may soon wish that they hadnt done this then. .nt