Whistleblower Claims Cybersecurity Company Generated Fake Data Breaches To Sell Protective Services

from the selling-you-fixes-you-don't-need-for-problems-you-don't-have dept

Making money without actually having to earn it is the American dream, isn’t it?

In a federal court this week, Richard Wallace, a former investigator at cybersecurity company Tiversa, said the company routinely engaged in fraud — and mafia-style shakedowns.

To scare potential clients, Tiversa would typically make up fake data breaches, Wallace said. Then it pressured firms to pay up.

“Hire us or face the music,” Wallace said on Tuesday at a federal courtroom in Washington, D.C.. CNNMoney obtained1 a transcript of the hearing.

Tiversa would allegedly turn over “information” about these fake breaches to the FTC and push the agency to come down hard on the companies who refused to hire it. Once the FTC started asking questions, Tiversa would again approach these companies and ask them if they’d reconsidered the use of their services.

Wallace’s testimony suggests Tiversa engaged in several unethical practices at the behest of CEO Bob Boback. One of the companies it targeted with its fake breaches was LabMD. After LabMD expressed reluctance to hire Tiversa, Bob Boback delivered a simple message to Wallace.

Q. Are you aware of whether or not LabMD agreed or refused to do business with Tiversa?

A. I think initially I don’t think that there was a — I don’t think that they did not want to do business with Tiversa initially, and I think that as the communication advanced back and forth from Bob and different people with LabMD, I think that that’s when they decided that they did not want to do business with Tiversa.

Q. Did Mr. Boback have a reaction to LabMD’s decision not to do business with Tiversa?

A. Yes.

Q. And what was that reaction?

A. Do I say it?

MS. BUCHANAN: Answer the question.

THE WITNESS: He basically said f— him, make sure he’s at the top of the list.

The “list” was a compilation of prospective Tiversa customers, compiled with the assistance of investigators who had managed to secure personally identifiable information from companies’ servers. This was the information that was threatened to be turned over to the FTC (or in some cases, was turned over before contacting the companies) if these companies refused to purchase Tiversa’s services.

Q. Why does their name appear on the list?

A. So that the FTC would contact them and notify them of a data breach and hopefully we would be able to sell our services to them.

Q. Did someone tell you to put their name on the list?

A. Yes.

Q. Who?

A. Our CEO, Bob Boback.

Q. Why?

A. To use — to be able to use any means necessary to let them know that an enforcement action is coming down the line and they need to hire us or face the music, so to speak.

Q. Did you, at the time this was created, have information on companies who fit the threshold but whose names do not appear on that list?

A. Yes.

Q. Why does their name not appear on the list?

A. The list was scrubbed of all clients in the past and future clients that we felt that there might be, you know, the prospect of doing business with them. Their information was removed.

Q. Clients of Tiversa?

A. Yes.

Q. Who made the decision to remove their names from the list?

A. Bob Boback.

In order to make the breaches look legit, Tiversa’s investigators would download sensitive files, move them to the company’s servers and alter information to make it appear as though the files had been accessed or stored by a variety of IP addresses, including those of known/suspected identity thieves.

THE WITNESS: Usually it would be after the fact, Bob would make contact with the company, without coming to me or coming to anyone else first, and say, you know, your file has spread to three additional IP addresses, it’s in Europe and Nigeria and Poland and who knows. So then it would be up to me to make it appear that way in the data store so, if there was ever an audit or, you know, somebody was catching on, the data would be there if you — Coveo is basically a front end for the data store. It’s like a Google site, so you could type in there “insurance aging” and it’s going to come up with a list of IP addresses along with the file, date and time.

More on that tactic:

JUDGE CHAPPELL: If I understood you correctly, it was not true that the file was at this IP address.

THE WITNESS: That is correct.

JUDGE CHAPPELL: And if I were Company B in my earlier scenario, do I have any way to go to Apache Junction and see if they’ve downloaded my data?

THE WITNESS: We would see that in our — in our real data store, we would show — like, for example, with this one, this individual had over — I was very familiar with this guy. He had over 3,000 tax returns, and he was zipping them up and selling them. Therefore, we knew that he was a bad actor, and it made it easy to put this file there, so to speak, even though he never had it physically on that computer, but we made it look — appear like he did.

JUDGE CHAPPELL: All right. So if I follow you correctly, you never — the file was never actually at Apache Junction.


JUDGE CHAPPELL: But I, Company B, had no way of ever verifying that or knowing that.


Wallace’s testimony may be useful in placing Tiversa in the FTC’s sights, something Darrell Issa brought to its attention last year. But it won’t do much for LabMD, which appears to have been prosecuted out of existence based on Tiversa’s phony claims.

Tiversa claims Wallace’s testimony is nothing more than a fired employee being vindictive and cites its multiple awards from law enforcement agencies as evidence of its forthrightness and honesty. All well and good, but if law enforcement agencies have been subjected to the same tactics — bogus problems and bogus fixes — they might be handing out awards based on perceived effectiveness rather than Tiversa’s actual cybersecurity skills.

The House Oversight Committee looked into Tiversa’s allegations against LabMD last year and was none too impressed by the supposedly upstanding company’s inability/unwillingness to turn over the information it requested.

The Committee has obtained documents and information indicating Tiversa failed to provide full and complete information about work it performed regarding the inadvertent leak of data on peer-to-peer computer networks. In fact, it appears that, in responding to an FTC subpoena issued on September 30, 2013, Tiversa withheld responsive information that contradicted other information it did provide about the source and spread of the data, a billing spreadsheet file.

Despite a broad subpoena request, Tiversa provided only summary information to the FTC about its knowledge of the source and spread of the file.

The letter details Tiversa’s evasiveness in response to the HOC’s requests, noting that while it did turn over nearly 8,700 pages in response to the subpoena, 8,500 of those were five identical copies of the 1,718-page LabMD insurance aging file at the center of the FTC’s investigation, leaving only 79 pages of other materials, none of which substantiated Tiversa’s claims.

If the allegations are true, Tiversa is likely looking at altering its business model. Being just another name in the cybersecurity business means even less when that name is increasingly tied to fraudulent behavior.

1 Let’s address CNN’s claim about “obtaining” a transcript of the hearing. Like far too many press outlets, CNN seems to believe publicly-filed documents are trade secrets and refuses to provide download links or pointers as to where these might be obtained. In this case, it apparently obtained the transcript from former LabMD CEO Michael Daugherty’s website. Or it may have had it sent to it by Daugherty himself. But either way, it did not “obtain” something no one else could have obtained, no matter how much its wording suggests some sort of exclusivity. And it could have done what Daugherty did: posted the transcript so readers could read it for themselves. But it didn’t. TL;DR: CNN “obtained” this transcript in the non-exclusive way that you and I “obtain” air or any other non-rival good. (Yes, air becomes rivalrous in air-free environments, but non-pedantically, the comparison holds.)

Filed Under: , , , , , , , , ,
Companies: labmd, tiversa

Rate this comment as insightful
Rate this comment as funny
You have rated this comment as insightful
You have rated this comment as funny
Flag this comment as abusive/trolling/spam
You have flagged this comment
The first word has already been claimed
The last word has already been claimed
Insightful Lightbulb icon Funny Laughing icon Abusive/trolling/spam Flag icon Insightful badge Lightbulb icon Funny badge Laughing icon Comments icon

Comments on “Whistleblower Claims Cybersecurity Company Generated Fake Data Breaches To Sell Protective Services”

Subscribe: RSS Leave a comment
Ninja (profile) says:

Re: Re:

My thoughts. Manufacture ‘terrorists’ to keep useless programs alive? Check. Manufacture ‘truths’ and stretch connections and interpretation to maintain surveillance programs? Check. Threat with server punishment and jail time unless citizen pleads guilty regardless of innocence? Check.

I could go on. It’s just another day in the US. (Before somebody points out it happens elsewhere we are talking about the US. I know it happens elsewhere but elsewhere is not where the article focus.)

That One Guy (profile) says:

What a terrible price to pay...

If the allegations are true, Tiversa is likely looking at altering its business model. Being just another name in the cybersecurity business means even less when that name is increasingly tied to fraudulent behavior.

If the allegations are true, they should be facing multiple criminal charges for extortion and fraud. ‘Altering it’s business model’? That’s not a punishment, that’s barely even a slap on the wrist.

jim says:


Is any worse than McAfee, or the others advertising on the web, as there is a virus on your set? That you have to buy a certain program, to remedy this.. Or the company that finangles web porn to your search question and sends out requests for monies? Those companies have been out there since the 80’s. All trying to cheat you out of a dollar, and trying to get laws in place to invade your privacy. And, damn it, some judges don’t see thru them, and stomp on them. A legal and controlled mob.

Anonymous Coward says:

Now here's a curious coincidence...

Let me direct your attention to this, from 2013: Report: Obama helicopter security breached


Employees of Tiversa, a Cranberry Township, Pa.-based security company that specializes in peer-to-peer technology, reportedly found engineering and communications information about Marine One at an IP address in Tehran, Iran.

Bob Boback, CEO of Tiversa, told WPXI-TV: “We found a file containing entire blueprints and avionics package for Marine One, which is the president’s helicopter.”

The company was able to trace the file back to its original source.

“What appears to be a defense contractor in Bethesda, Md., had a file-sharing program on one of their systems that also contained highly sensitive blueprints for Marine One,” Boback said.

I wonder if the court would be interested in hearing Mr. Wallace’s testimony about this matter.

John Fenderson (profile) says:

Re: Re:

I think that if you’re “selling the problem”, they are already in unethical territory even if the problem does really exist.

If a problem is large enough that people are seeking solutions to it, then it doesn’t need to be “sold”. It only needs to be mentioned in the context of “this product (or me, if I’m a consultant) will ease that”.

Anonymous Coward says:

Not surprising...

I’ve run into “consultants” who pull similar tricks where i live.

I know of one guy who does “computer work” for various companies in the area. One of the companies he did work for happened to be owned by a friend of mine. When she told me all the “virus” issues they started having – and that she couldnt’ afford to pay him $80/hr to come clean up all the computers every couple weeks, I told her I would fix the problem.

Upon inspection, I saw that he had installed remote access software on every machine, supposedly so he could “fix problems remotely”. Furthermore, he had configured their network router and neglected to tell anyone the password.

After resetting the router configuration, re-securing it, and removing all the remote access software – the constant problems stopped. She never had to call him again. He did call after the fact and ask if she had someone new working on the computers, to which she replied that she did… and that was the last she heard from him.

Anonymous Coward says:

All digital evidence should be suspect

This story is a perfect example of why all digital evidence should be suspect. I’ll even go as far as to say that it should be disallowed in court. It’s fine to use it in pursuing an investigation that leads to reliable evidence. But the relative ease of planting/manipulating documents, pictures, logs, etc. is so well known now at this point that it is beyond me how these things can be considered proof of anything. Investigators, prosecutors, and/or rivals of any kind consistently show their willingness to distort “facts” in order to secure prosecutions, win lawsuits, and/or discredit individuals. Would it really come as a surprise to anyone to find out they’re manipulating digital evidence? It’s just too easy to do to consider it reliable.

Add Your Comment

Your email address will not be published. Required fields are marked *

Have a Techdirt Account? Sign in now. Want one? Register here

Comment Options:

Make this the or (get credits or sign in to see balance) what's this?

What's this?

Techdirt community members with Techdirt Credits can spotlight a comment as either the "First Word" or "Last Word" on a particular comment thread. Credits can be purchased at the Techdirt Insider Shop »

Follow Techdirt

Techdirt Daily Newsletter

Techdirt Deals
Techdirt Insider Discord
The latest chatter on the Techdirt Insider Discord channel...