Month: March 2020

On February 21, television station WPTV in West Palm Beach, Florida reported that because of a 2019 ransomware attack that locked Stuart (Florida) Police Department officers out of their computers, the local State Attorney’s Office found it necessary to dismiss 11 narcotics cases involving alleged drug dealers because of the loss of evidence.

According to a Stuart Police Department spokesman, the cyberattackers used a “spear phishing” attack to disseminate the Ryuk ransomware, which was in the Stuart Police computers for approximately two months before the attackers sent the Department a ransom note demanding $300,000 in Bitcoin.  When the City of Stuart refused to pay the ransom, the Police Department was unable to recover 1 ½ years of digital evidence that included photographs and videos.

WPTV also reported that losing data (or evidence in the Stuart Police Department’s case) “is highly common when an agency is hit by hackers. In the words of the Stuart Police Department spokesman, “I can’t recall, in speaking to my federal partners, that there has been a case where data has not been lost.”

The report said that the Stuart Police Department “has changed the way they save and store evidence, and city officials are now aggressively training employees to identify phishing emails.”

Note: This report should be of substantial concern to law enforcement officers and prosecutors across the country.  Any ransomware attacks directed at government agencies are cause for concern, but ransomware attacks like the Stuart attack that result in loss of evidence in criminal prosecutions represent a significant threat to the rule of law and the justice system.

Prosecutive, police, and law enforcement agencies cannot depend solely on cybersecurity software to safeguard the evidence they need for criminal prosecutions.  As the Stuart Police ransomware attack demonstrated, even a single individual who negligently clicks on a malicious link can compromise an entire computer network.  For that reason, if they are not already doing so, those agencies need to initiate procedures for frequent backups of potential evidence in their cases to offline repositories, and to be able, if necessary at trial, to prove to courts that those data have not been altered or damaged in any way.  The cost of providing such offline storage will be far less than the cost of admitting publicly that viable prosecutions had to be dismissed because police and prosecutors failed to take simple measures to protect their evidence.

On March 2, the U.S. Department of Justice announced that U.S.-headquartered generic pharma company Sandoz Inc. agreed to enter into a deferred prosecution agreement (DPA) with the Department for conspiring to allocate customers, rig bids, and fix prices for generic drugs.  In connection with the DPA, the Justice Department filed a four-count information in federal court in the Eastern District of Pennsylvania, charging Sandoz (a division of Swiss pharma company Novartis) “with participating in four criminal antitrust conspiracies, each with a competing manufacturer of generic drugs and various individuals.”

Under the terms of the DPA, Sandoz agreed to pay a $195 million criminal penalty and admitted that its sales affected by the charged conspiracies exceeded $500 million.  In that DPA, Sandoz admitted that it participated in the four charged antitrust conspiracies set forth in the information, as follows:

• Count One: This count charged Sandoz “for its role in a conspiracy with a generic drug company based in New York and other individuals.  Sandoz admitted that drugs affected by this conspiracy included clobetasol (cream, emollient cream, gel, ointment, and solution), desonide ointment, and nystatin triamcinolone cream.”
• Count Two: This count charged Sandoz for its role in a conspiracy with Kavod Pharmaceuticals LLC (formerly Rising Pharmaceuticals) “to allocate customers and fix prices of benazepril HCTZ. Rising was charged and entered into a deferred prosecution agreement in December 2019 for its participation in the same conspiracy.”
• Count Three: This count charged Sandoz “for its role in a conspiracy with a generic drug company based in Michigan. Sandoz admitted that drugs affected by this conspiracy included desonide ointment.”
• Count Four: This count charged Sandoz “for its role in a conspiracy with a generic drug company based in Pennsylvania. Sandoz admitted that drugs affected by this conspiracy included tobramycin inhalation solution.”

Note: This case is noteworthy for two reasons.  First, according to the Department, Sandoz’s $195 million criminal penalty is the largest ever paid in a domestic antitrust investigation.  A corporate criminal conviction under section 1 of the Sherman Act carries a maximum penalty of $100 million per count.   An alternative sentencing provision allows that penalty to be increased to not more than twice the gross gain derived from the crime, or twice the gross loss that victims suffered, if either amount is greater than $100 million.

Second, it indicates that the Antitrust Division of the Department is sustaining momentum in its investigation of the generic pharma industry.  Sandoz is the third pharmaceutical company to admit to criminal antitrust charges, and the seventh case to be charged, in that investigation.  In addition, three individuals, including a former Sandoz executive, have pleaded guilty to charges in the investigation, and a fourth individual was indicted last month and is awaiting trial.

For both reasons, compliance counsel in the pharma industry should report on this latest DPA to senior executives in their companies, and promptly incorporate information about the case into corporate briefing and training materials.  Every senior executive, in every industry, needs to understand that the Justice Department regards bid-rigging and price-fixing as core criminal conduct under the Sherman Act and tends to be highly motivated to investigate and prosecute such cases.