FTC OIG Investigations Reveal Mostly Individual Misconduct Over Past Five Years

One case included a few hundred thousand dollars of improper purchases of devices including Sony gaming systems, Apple iPods and others. The OIG substantiated that and five other cases. We couldn’t determine the culprits in such cases because that information was among the documents the FTC declined to release to us. Our appeal is pending.

A financial fraud investigation uncovered an employee who had made $217,000-plus “in unauthorized purchases that were billed to the FTC,” the OIG said in a 2011 report. The purchases ran the gamut from iPods to DVD players to TVs and PlayStations, the OIG said. The employee then “sold most of the merchandise that he purchased,” including to a fellow FTC employee, who bought two Hewlett-Packard Mini Netbooks, according to the report. The employee who bought the netbooks “repeatedly lied” to investigators, only confessing “when confronted with evidence,” the OIG said. The U.S. Attorney’s Office for the District of Columbia prosecuted the first individual for the unauthorized purchases and placed the second individual on administrative leave with further administrative action and criminal prosecution possible, the OIG said.

The most recent case looked into fraudulent use of the FTC FedEx account, leading some consumers to get fake checks from the agency. After the investigation, the OIG expressed “concerns that the practice of shared login information and passwords could potentially be occurring in other FTC offices,” but found no evidence the practice actually enabled the misuse of the account. The FTC has conducted 53 enforcement actions over the past decade-plus regarding companies’ inadequate data privacy and data security processes.

Overall, “I didn’t see any evidence of widespread corruption,” said Michael Smallberg, an investigator with the Project on Government Oversight (POGO), which analyzes the work of federal IGs. “It looked like it was mostly individual misconduct,” he said after reviewing the documents. In FY 2013, the FTC had a staff of 1,143 on a $279 million budget. An FTC spokesman said the OIG “helps to ensure the FTC’s operations remain efficient and effective."

Some Documents Kept Secret

The FOIA request returned 267 pages from the eight OIG reports, but only 41 were partially released. All identifying information -- name, position, FTC department -- was redacted. FTC officials declined to broadly characterize the seniority of the employees in the investigations and said it was unlikely an appeal asking for names or positions of the individuals would be granted. Explaining the redactions, the FTC cited FOIA exemptions prohibiting the disclosure of financial information, pre-decisional staff opinions, personally identifying information collected for law enforcement purposes and information obtained confidentially.

The exemption practice is common, said Smallberg. “Some IGs will at least identify a position or give a little bit more of an indication of which office they're coming from.” If the individual involved is “a senior enough official,” there’s a public interest in releasing that information, said Smallberg. “Sometimes you need that public disclosure in order to get to the problem.” POGO has urged federal IGs to make their investigation reports public, Smallberg said. While IGs are required to post public audits and reports within three days of completion, “many IGs avoid complying by simply not making the reports publicly available in the first place,” said POGO Executive Director Danielle Brian in a Jan. 14 blog post (http://bit.ly/1hfonpf).

The FTC’s website confirms: “OIG investigative reports are not public documents and are not available on the OIG website.” The FTC OIG does post yearly audits of the commission’s budget and reports on the agency’s compliance with both the Improper Payments Elimination and Recovery Act and the Federal Information Security Management Act (http://1.usa.gov/1kxWYzr). The published reports for FY 2013 found the FTC was compliant with both laws. The FY 2013 audit found the commission had met, or exceeded, the vast majority of its strategic goals, including several markers in consumer education and consumer savings that the commission hadn’t hit in FY 2012 (http://1.usa.gov/1hBOoPV).

Three OIG investigations involved FTC employees using commission equipment for outside projects, showed the documents responding to our FOIA request. Two employees in 2010 were found using work equipment to help run a home-based businesses, including one the OIG found was using FTC resources to find clients. A year later, another employee was caught using FTC equipment to research, write and print a book she was writing.

Another investigation found an employee booking Marriott hotel rooms for FTC events in 2008 and 2009 put the resulting Marriott “reward points” -- 232,389 -- on a personal account, according to the OIG report. That many points could be redeemed for approximately 30 free nights at the company’s cheapest hotels and roughly five nights at the high-end hotels, said Marriott’s website. The employee “lacked candor during her investigative interview,” and tried “to deceive management” about the incident, the OIG said. The employee was referred for administrative action and the OIG declined to seek prosecution for “false statements in an investigatory interview."

FTC FedEx Account

The most recent investigation involved an unauthorized compromise of the FTC’s FedEx account. An unidentified individual used the account to ship 20 packages containing fake “rebate” checks for $1,980 to a “drop box” location in Chicago, the OIG said. Nine of the packages were intercepted and rerouted back to the FTC, it said. The OIG was alerted to the issue Jan. 9, a day after a consumer contacted the FTC regarding the suspicious check, according to the report. The consumer had received the check in exchange for a dress she was selling on Craigslist for $500, the report said.

Despite a subpoena to FedEx to obtain the IP address used to initiate the transactions, another subpoena for phone records related to a Google Voice account and investigations of all computers that had accessed the FedEx account, the OIG was unable to determine the source of the compromise, it said. The OIG was told FTC employees had ceased sharing FedEx account login and password information, “although subsequent interviews with employees raise doubts as to whether or not this was actually remedied,” the OIG said. FedEx had no comment for this story.

"There’s a certain kind of amusing takeaway from it, but it’s not terribly surprising,” said John Simpson, director of the Privacy Project at Consumer Watchdog. The privacy-rights group has criticized the FTC for what it deemed insufficient enforcement action against Google, while praising it over a recent action against Facebook’s Snapchat. “Humans are humans,” said Simpson. “It just once again shows that people who are involved in, and concerned about, that issue don’t always follow best procedures.”