FDA Spied On Emails To Try To Silence Critics

from the and-it-may-have-just-made-new-critics dept

We've discussed how the government often seems much more focused on silencing leaks of information, rather than recognizing that those leaks are often highlighting serious misconduct. The latest example involves the Food and Drug Administration (FDA), who apparently started trying to find the source of a leak, but in the end started collecting thousands of emails to try to stifle all sorts of criticism of the FDA, as revealed by the NY Times over the weekend.
What began as a narrow investigation into the possible leaking of confidential agency information by five scientists quickly grew in mid-2010 into a much broader campaign to counter outside critics of the agency’s medical review process, according to the cache of more than 80,000 pages of computer documents generated by the surveillance effort.

Moving to quell what one memorandum called the “collaboration” of the F.D.A.’s opponents, the surveillance operation identified 21 agency employees, Congressional officials, outside medical researchers and journalists thought to be working together to put out negative and “defamatory” information about the agency.
The details show that the FDA installed key logger software on the computers of their own scientists, tracked the personal emails they wrote to others, and tracked documents they copied to key drives. Now, you can make a reasonable argument that since these were work laptops, the FDA has every right to track the usage, but it seems pretty clear that the FDA went really far here, and it wasn't just about stopping leaks, but about trying to stifle criticism and whistleblowing.

In fact, much of the evidence suggests that this absolutely was an attempt to blow the whistle on faulty review procedures by the FDA, that resulted in the approval of medical imaging devices that weren't actually safe. And, apparently, the complaints by the whistleblowers were convincing enough that there's now a Congressional investigation into "a substantial and specific danger to public safety" from this activity.

If the FDA were functioning as it was supposed to, it would have seen these complaints as a reason to investigate its own activities. Instead, in the supposed attempt to "stop leaks," the FDA used this info to try to squelch the attempt to have its own practices investigated.

Filed Under: fda, key logger, leak, whistleblower


Reader Comments

Subscribe: RSS

View by: Time | Thread


  1. identicon
    Anonymous Coward, 16 Jul 2012 @ 1:03pm

    Re: Re: Re:

    Monitor is ok, you can monitor what's done without logging passwords. Every1 has a banking life and most companies I know allow you to check your account from within the company network. So the question is, are they allowed to monitor your banking history and passwords? I don't think so, even if they don't plan to log into your account later.

    The US government (USG) does have the right to monitor everything done on their computers and network because users may not log into a USG computer unless they agree to monitoring. All properly configured USG computers display a log-in warning banner that states the computer is an official USG computer to conduct USG business. The banner also states that there is no expectation of privacy, all activity is monitored, and by logging in the user consents to monitoring.

    All USG employees and contractors are also required to complete annual FISSA training. A reminder that users consent to monitoring is also in that training. The USG also has an ROB that users must accept before they are allowed to use a USG computer, and guess what the ROB contains? That makes three notices warning of monitoring, one of which appears every time you log in.

    The scientists only have a case if they were using a USG computer that did not have a warning banner, they never took FISSA training, and they did not sign an ROB.

    Besides, if there's enough sensitive information you have to block all access to the internet because you wouldn't be able to see exactly what's going through an encrypted connection that easily (please correct me if I'm wrong).

    All unsolicited SSL connection attempts from the Internet to USG computers are (well, are supposed to be) blocked. Outbound SSL connections are decrypted by the USG using a proxy similar to a man-in-the-middle attack.

    I don't see how they could see who were the ppl the employees sent their e-mails on external webmails without effectively logging into their accounts.

    Yahoo! webmail only encrypts authentication, everything else is sent in clear text which can be obtained through a network packet capture. I beleive GMail encrypts everything. Decryption of GMail is accomplished with a proxy as mentioned above.

Add Your Comment

Have a Techdirt Account? Sign in now. Want one? Register here



Subscribe to the Techdirt Daily newsletter




Comment Options:

  • Use markdown. Use plain text.
  • Remember name/email/url (set a cookie)

Follow Techdirt
Insider Shop - Show Your Support!

Advertisement
Report this ad  |  Hide Techdirt ads
Essential Reading
Techdirt Deals
Report this ad  |  Hide Techdirt ads
Techdirt Insider Chat
Advertisement
Report this ad  |  Hide Techdirt ads
Recent Stories
Advertisement
Report this ad  |  Hide Techdirt ads

Close

Email This

This feature is only available to registered users. Register or sign in to use it.