Who Spammed the FDA With 250,000 Fake Comments?

The federal government web system accepting online comments on the FDA’s proposed flavor regulations for e-liquid— and any prefilled vape like disposables and pod vapes—has been compromised by the submission of more than a quarter-million spam comments.

According to reporting from Brent Stafford at Regulator Watch, the FDA Division of Dockets Management (DDM) has admitted that its servers have been overwhelmed by the comments, most of which were uploaded by bots during one weekend in June. The comments all appear to advocate against allowing vape flavors.

The agency logged 255,000 comments from the same four IP addresses during the weekend beginning June 8. By June 11, when the DDM was able to stop the flood of submissions, the computers were bogged down with the comments, and now — nearly a month later — the agency still hasn’t solved the problem. For the last two weeks, the agency hasn’t approved and published a single comment from the queue of hundreds of thousands pending.

But who was responsible, and what will happen now to the thousands of legitimate pending comments from vapers and vape businesses opposing flavor regulations?

The spam “comments” were unsigned, and all follow one of four templates, including three that used language copied from an April Campaign for Tobacco-Free Kids letter to FDA Commissioner Scott Gottlieb. Sociologist Amelia Howard, in a Twitter post (see below), identified additional wording copied from a form letter to California mayors created by the California Department of Public Health.

“I am writing because I am concerned about the tobacco industry’s use of flavors in their toxic products to lure kids into lifelong addiction,” says the spam comment, as transcribed from the RegWatch episode by Howard.

“The tobacco industry doesn’t stop at the use of flavors, it also uses kid-friendly packaging to deceive kids into thinking their products are harmless. This, coupled with unchecked online purchasing, gets tobacco products past parents and teachers and straight into the hands of kids.

“All of this is a recipe for disaster. Please ban all flavored tobacco products.”

The entire comment, aside from the last line, is copied from the CDPH form letter.

Each comment on the FDA docket must be read and approved for inclusion by FDA staff. As of July 9, there are more than 517,000 submissions waiting to be reviewed. Brent Stafford told Vaping360 yesterday that DDM employees expect that many more of the unreviewed responses — not just the 255,000 known spam submissions — could be spam as well.

The FDA Center for Tobacco Products (CTP) is investigating the fraudulent submissions, but hasn’t yet decided how they will be handled. “A decision is being made now whether the process has been spoiled,” says Stafford.

Stafford was told that one possibility is to deem the submissions to be duplicates and include just one in the final comments. But that could cause anyone studying the responses to believe that the included comment (which would not be identified as fraudulent) represents the actual thoughts of hundreds of thousands of citizens.

The whole process could be scrapped and begun again, but the FDA might view that as rewarding the digital vandals. It would also eliminate all the legitimate comments from vapers and low-risk nicotine advocates, who might not engage in the process a second time. The deadline for making comments is July 19. It has already been extended once.

Vaping organizations like VTA and CASAA have worked hard to encourage comment submissions from vapers, but now there are concerns that confusion and uncertainty over the corrupted comment docket will discourage many vapers from even telling their stories. Without personal comments from legitimate stakeholders in this debate, it will be easy for FDA regulators to dismiss vapers as disengaged and apathetic.

Who sent the fake comments?

No one knows for sure who engineered the spam FDA submissions. Unlike last year’s counterfeit Scott Gottlieb memo, the comments don’t seem to serve the purpose of any of the potential suspects. The fact that the spam event was so obvious and ham-handed makes the motivation even less clear.

And it may not even make any difference who is responsible. The result, no matter who is behind it, is a broken comments system, and that helps no one. “The public should be outraged that the process has been tampered with,” says Brent Stafford. “And unless people put pressure on the CTP right now, this may not end well for vaping.”

Some anti-vaping organizations have indeed initiated campaigns urging their followers to make comments on the docket. In the past, they’ve even used form letters (as have vaping organizations). But they certainly haven’t encouraged unsigned submissions, which would be automatically suspicious.

This effort looks amateurish. Any competent digital fraudster could do a better — and more believable — job. Why send all the comments at once, and all unsigned? The spam effort seems designed to be immediately recognized as fraud.

“At some point it doesn’t matter who did this,” Brent Stafford says. “What matters is what the FDA is going to do with the comments.”