Hacker typing on a laptop with binary code in background

A cyberintelligence company that happened upon patient data mistakenly made accessible on the Internet by a cancer detection facility can sue the facility for defamation after it alleged in a video and book that the intelligence company worked with the government to surveil private businesses, a federal judge has ruled in denying a motion to dismiss.

In Tiversa Holding v. LabMD, U.S. District Judge Nora Barry Fischer of the Western District of Pennsylvania said statements made by co-defendant Michael J. Daugherty that Tiversa was using software to illegally search private files and use those files to extort companies into engaging Tiversa’s services and colluding in government shakedowns went beyond permissible opinion or hyperbole and entered the realm of possible defamatory statements.

“Given Tiversa’s line of business, it is undisputable that such statements, as pled by plaintiffs, could clearly damage Tiversa’s reputation and motivate current and/or potential clients to avoid interacting with plaintiffs,” Fischer said.

According to the opinion, Pittsburgh-based Tiversa is a cyberintelligence company that provides data protection and review for clients. At some point in 2008, while conducting a search of peer-to-peer networks for a client, Tiversa’s search terms resulted in the discovery of a LabMD file containing 1,718 pages of health care patient Social Security numbers, insurance information and treatment codes. The file was titled “Insurance Aging” and was located on computers in Arizona, Costa Rica and London and was discovered on a computer in San Diego, Fischer said.

Tiversa concluded LabMD inadvertently shared the file through a peer-to-peer file-sharing program downloaded onto a LabMD computer. Tiversa employee Robert J. Boback contacted Atlanta-based LabMD—a company that functioned as a cancer detection facility performing testing and diagnostic services for urologists in several states—and provided a copy of the file and offered Tiversa’s services, Fischer said.

LabMD requested a quote from Tiversa but ultimately turned down the company’s services, according to the opinion.

The Federal Trade Commission later contacted Tiversa as part of its investigations into security breaches from the use of peer-to-peer networks. The FTC attempted to obtain any and all nonredacted files that contained more than 100 Social Security numbers. Tiversa said in its complaint that it did not turn over the LabMD file, Fischer said.

An entity referred to in the complaint as the Privacy Institute, however, did get a copy of the file. Fischer said in a footnote that the complaint is not clear as to what the Privacy Institute is or how it came to possess the file.

A civil investigation demand was issued to the Privacy Institute from the FTC in August 2009 and the institute gave the FTC the file, Fischer said. An investigation into LabMD ensued and on Aug. 29, 2013, the FTC filed an administrative complaint against the company for failure to use reasonable measures to protect sensitive consumer data, Fischer said.

In September 2013, Daugherty authored a book titled “The Devil Inside the Beltway,” marketed as a “‘shocking expose on the U.S. government’s surveillance and overreach into cybersecurity, medicine and small business.’” To promote the book, Daugherty created a website with a video trailer that alleged Tiversa was part of a “‘government funded data mining and surveillance’” scheme, that Tiversa engaged in “‘psychological warfare,’” and that it assisted with “‘abusive government shakedown[s],’” according to Fischer’s opinion.

Other promotional materials alleged Tiversa’s actions constituted property theft, that Tiversa affected LabMD’s network and that, when LabMD declined its services, Tiversa turned the file over to authorities, Fischer said. The judge said the book contained similar commentary and included allegations that Boback was a con artist and LabMD was “entrapped” by Tiversa’s conduct.

Daugherty further alleged Tiversa engaged in “‘questionable practices,’” Tiversa “‘regularly contacted companies whose file they had taken in order to solicit business,’” that Tiversa’s actions constituted theft and that Tiversa “‘showed our file to Congress,’” according to the opinion.

Tiversa sent two letters to Daugherty informing him the statements were false and harmful to Tiversa and should be halted. Neither Daugherty nor LabMD responded. Tiversa filed suit in September 2013, alleging statutory defamation, common-law slander per se and common-law commercial disparagement/trade libel. The fourth count sought injunctive relief and monetary damages, Fischer said.

LabMD and Daugherty argued the statements weren’t capable of defamatory meaning because they were opinion or hyperbole and that they were true. They further argued injunctive relief would equate to prior restraint on free speech.

As to whether the statements were opinion, Fischer said even opinion can constitute defamation if the statements can reasonably be understood to imply undisclosed defamatory facts. She said Daugherty’s statements range from “mere insults to accusations of criminal activity.” Despite the defendants’ argument that the statements could only be construed as opinion or hyperbole, Fischer said she found multiple statements capable of defamatory meaning.

As to the factual accuracy of the allegedly defamatory statements, Fischer said the plaintiffs’ complaint states the file was inadvertently, not intentionally, accessed. Fischer said that, in accepting all of the plaintiffs’ factual assertions as true, they have adequately averred that Daugherty’s statements were false.

Fischer declined to address at this stage the parties’ dispute as to whether Tiversa is a public figure that is required to prove actual malice.

“While the court reserves judgment with respect to plaintiffs’ status as public figures prior to discovery, the court notes that even if plaintiffs were public figures for purposes of this action, actual malice is adequately pled in the first amended complaint,” Fischer said.

She noted Tiversa sent letters to Daugherty and LabMD before and after the allegedly defamatory statements were made informing them the statements were false and the letters went unanswered.

Fischer denied the motion to dismiss as to the injunctive relief count, but without prejudice. She said she didn’t need to decide the constitutional question of prior restraint at the motion to dismiss stage because the claim is contingent upon the success of the defamation claims.

Jarrod Shaw of Reed Smith in Pittsburgh represents Tiversa and Boback and did not immediately return a call for comment. Alexander W. Saksen of Gordon & Rees in Pittsburgh represents LabMD and Daugherty and declined to comment.

Gina Passarella can be contacted at 215-557-2494 or at gpassarella@alm.com. Follow her on Twitter @GPassarellaTLI.

(Copies of the 14-page opinion in Tiversa Holding v. LabMD, PICS No. 14-0592, are available from The Legal Intelligencer. Please call the Pennsylvania Instant Case Service at 800-276-PICS to order or for information.) •