HP spying scandal
Encyclopedia
On September 5, 2006, Newsweek
revealed that Hewlett-Packard
's general counsel
, at the behest of HP
chairwoman Patricia Dunn
, had contracted a team of independent security experts to investigate board members and several journalists in order to identify the source of an information leak. In turn, those security experts recruited private investigators who used a spying technique known as pretexting. The pretexting involved investigators impersonating HP board members and nine journalists (including reporters for CNET
, the New York Times and the Wall Street Journal) in order to obtain their phone records. The information leaked related to HP's long-term strategy and was published as part of a CNET
article in January 2006. HP hired public relations firm Sitrick and Company
to manage their media relations during the crisis.
Cedric Villapando claimed she did not know beforehand the methods the investigators used to try to determine the source of the leak. Board member George Keyworth was ultimately accused of being the source and on September 12, 2006, he resigned, although he continued to deny making unauthorized disclosures of confidential information to journalists and was thanked by Mark Hurd for his board service. It was also announced at that time that Dunn would continue as chairwoman until January 18, 2007, at which point HP CEO Mark Hurd would succeed her. Then, on September 22, 2006 HP announced that Dunn had resigned as chairwoman because of the "distraction her presence on our board" created. On September 28, 2006, Ann Baskins
, HP's general counsel, resigned hours before she was to appear as a witness before the House Committee on Energy and Commerce, where she would ultimately invoke the Fifth Amendment
to refuse to answer questions.
News.com publicly released a five-page letter written by the United States House Committee on Energy and Commerce
to Patricia Dunn
stating that they had, for the past seven months, been conducting an investigation on Internet-based data brokers who allegedly use "lies, fraud and deception" to acquire personal information, and allow anyone who pay a "modest fee" to acquire "itemized incoming and outgoing call logs", not only for cell phone numbers but also for VoIP numbers, landline
numbers, and unpublished phone numbers. Additional data that could be obtained included addresses
and other personal data, obtained without the consent or prior notice to the owner of the number. The committee had learned about HP's use of pretexting through their September 6 SEC filing and through their own inquiry of HP's Nominating and Governance Committee, stating they are "troubled" by the information, "particularly that it involves HP—one of America's corporate icons."
The committee requested, under Rules X and XI of the United States House of Representatives
, the following information from HP by September 18, 2006:
In addition to the above mentioned information, the Committee on Energy and Commerce also requested the following information from HP by September 25, 2006:
At the September 28, 2006 hearing, Dunn and Hurd both testified extensively about the investigation. Dunn testified that until June or July 2006, she did not realize that "pretexting" could involve identity misrepresentation. Dunn repeatedly insisted that she had believed that personal phone records could be obtained through legal methods.
Other witnesses, including Ann Baskins, HP's former General Counsel, Kevin Hunsaker, a six-year HP employee who was a former HP Senior Counsel and "Director of Ethics and Standards of Business Conduct," Anthony Gentilucci, former HP/Compaq/DEC chief of global investigations, and several private investigators invoked the Fifth Amendment, refusing to answer questions due to the ongoing criminal investigations.
Baskins' attorney's letter to the committee contains several documents describing the investigatory methods, who was pretexted, and whether there were any illegal acts committed, including memoranda prepared by HP's outside law firm Wilson, Sonsini, Goodrich & Rosati (Larry Sonsini was among the witnesses at the hearing.)
Hunsaker's May 24 confidential "attorney-client privileged" final report, which gives full details of the investigation, is also available.
Bill Lockyer
filed criminal charges and arrest warrants against Dunn, HP's former chief ethics officer Kevin Hunsaker, and three outside investigators. The complaint alleged the following four felony violations of the California Penal Code
:
The criminal complaint can be found here.
On March 14, 2007, the judge in Patricia Dunn's criminal case dismissed all charges. Hunsaker and the two investigators pled no contest
to the wire fraud count; those charges were dismissed pending their completion of 96 hours of community service. The court also dismissed its case against the third investigator, Bryan Wagner, who had pleaded guilty in federal jurisdiction.
and identity theft
for allegedly obtaining the Social Security Number
of an unidentified journalist to obtain the journalist's phone records.
Wagner pled guilty to the charges. On August 12, 2009, his sentencing hearing was postponed.
Partially as a result of the case, however, congress passed a law
specifically prohibiting pretexting. Since then, at least two other people have been prosecuted under the new law:
Newsweek
Newsweek is an American weekly news magazine published in New York City. It is distributed throughout the United States and internationally. It is the second-largest news weekly magazine in the U.S., having trailed Time in circulation and advertising revenue for most of its existence...
revealed that Hewlett-Packard
Hewlett-Packard
Hewlett-Packard Company or HP is an American multinational information technology corporation headquartered in Palo Alto, California, USA that provides products, technologies, softwares, solutions and services to consumers, small- and medium-sized businesses and large enterprises, including...
's general counsel
General Counsel
A general counsel is the chief lawyer of a legal department, usually in a corporation or government department. The term is most used in the United States...
, at the behest of HP
Hewlett-Packard
Hewlett-Packard Company or HP is an American multinational information technology corporation headquartered in Palo Alto, California, USA that provides products, technologies, softwares, solutions and services to consumers, small- and medium-sized businesses and large enterprises, including...
chairwoman Patricia Dunn
Patricia C. Dunn
Patricia Cecile Dunn , aka Patricia Cecile Dunn-Jahnke, is the former non-executive chairman of the board of Hewlett-Packard , a position she held from February 2005 until September 22, 2006, when she resigned her position. On October 4, 2006 Bill Lockyer, the California attorney general, charged...
, had contracted a team of independent security experts to investigate board members and several journalists in order to identify the source of an information leak. In turn, those security experts recruited private investigators who used a spying technique known as pretexting. The pretexting involved investigators impersonating HP board members and nine journalists (including reporters for CNET
CNET
CNET is a tech media website that publishes news articles, blogs, and podcasts on technology and consumer electronics. Originally founded in 1994 by Halsey Minor and Shelby Bonnie, it was the flagship brand of CNET Networks and became a brand of CBS Interactive through CNET Networks' acquisition...
, the New York Times and the Wall Street Journal) in order to obtain their phone records. The information leaked related to HP's long-term strategy and was published as part of a CNET
CNET
CNET is a tech media website that publishes news articles, blogs, and podcasts on technology and consumer electronics. Originally founded in 1994 by Halsey Minor and Shelby Bonnie, it was the flagship brand of CNET Networks and became a brand of CBS Interactive through CNET Networks' acquisition...
article in January 2006. HP hired public relations firm Sitrick and Company
Sitrick and Company
Sitrick and Company is a Los Angeles-based public relations firm started by Mike Sitrick in 1989. It would go on to establish offices in New York, Miami, San Francisco, and Silicon Valley...
to manage their media relations during the crisis.
Cedric Villapando claimed she did not know beforehand the methods the investigators used to try to determine the source of the leak. Board member George Keyworth was ultimately accused of being the source and on September 12, 2006, he resigned, although he continued to deny making unauthorized disclosures of confidential information to journalists and was thanked by Mark Hurd for his board service. It was also announced at that time that Dunn would continue as chairwoman until January 18, 2007, at which point HP CEO Mark Hurd would succeed her. Then, on September 22, 2006 HP announced that Dunn had resigned as chairwoman because of the "distraction her presence on our board" created. On September 28, 2006, Ann Baskins
Ann Baskins
Ann O'Neil Baskins is former General Counsel for Hewlett-Packard Company . Baskins was linked to the HP pretexting scandal....
, HP's general counsel, resigned hours before she was to appear as a witness before the House Committee on Energy and Commerce, where she would ultimately invoke the Fifth Amendment
Fifth Amendment to the United States Constitution
The Fifth Amendment to the United States Constitution, which is part of the Bill of Rights, protects against abuse of government authority in a legal procedure. Its guarantees stem from English common law which traces back to the Magna Carta in 1215...
to refuse to answer questions.
Investigation by the House Committee on Energy and Commerce
On September 11, 2006, CNETCNET
CNET is a tech media website that publishes news articles, blogs, and podcasts on technology and consumer electronics. Originally founded in 1994 by Halsey Minor and Shelby Bonnie, it was the flagship brand of CNET Networks and became a brand of CBS Interactive through CNET Networks' acquisition...
News.com publicly released a five-page letter written by the United States House Committee on Energy and Commerce
United States House Committee on Energy and Commerce
The Committee on Energy and Commerce is one of the oldest standing committees of the United States House of Representatives. Established in 1795, it has operated continuously—with various name changes and jurisdictional changes—for more than 200 years...
to Patricia Dunn
Patricia C. Dunn
Patricia Cecile Dunn , aka Patricia Cecile Dunn-Jahnke, is the former non-executive chairman of the board of Hewlett-Packard , a position she held from February 2005 until September 22, 2006, when she resigned her position. On October 4, 2006 Bill Lockyer, the California attorney general, charged...
stating that they had, for the past seven months, been conducting an investigation on Internet-based data brokers who allegedly use "lies, fraud and deception" to acquire personal information, and allow anyone who pay a "modest fee" to acquire "itemized incoming and outgoing call logs", not only for cell phone numbers but also for VoIP numbers, landline
Landline
A landline was originally an overland telegraph wire, as opposed to an undersea cable. Currently, landline refers to a telephone line which travels through a solid medium, either metal wire or optical fibre, as distinguished from a mobile cellular line, where transmission is via radio waves...
numbers, and unpublished phone numbers. Additional data that could be obtained included addresses
Address (geography)
An address is a collection of information, presented in a mostly fixed format, used for describing the location of a building, apartment, or other structure or a plot of land, generally using political boundaries and street names as references, along with other identifiers such as house or...
and other personal data, obtained without the consent or prior notice to the owner of the number. The committee had learned about HP's use of pretexting through their September 6 SEC filing and through their own inquiry of HP's Nominating and Governance Committee, stating they are "troubled" by the information, "particularly that it involves HP—one of America's corporate icons."
The committee requested, under Rules X and XI of the United States House of Representatives
United States House of Representatives
The United States House of Representatives is one of the two Houses of the United States Congress, the bicameral legislature which also includes the Senate.The composition and powers of the House are established in Article One of the Constitution...
, the following information from HP by September 18, 2006:
1. The name and identity of the outside consulting firm cited in HP's September 6th, 2006, filing with the SEC (the outside consulting firm), and of any other outside consultants who were hired by HP to assist in conducting the Leak Investigation.
2. Copies of any contracts, letters of engagement and investigative plans related to the Leak Investigation that was conducted by the outside consulting firm or by any other party.
3. The names and identities of all third parties, whether hired directly by HP or by HP's outside consulting firm, who were used during the leak investigation to procure, or to attempt to procure telephone records and other personal consumer information of any targets or subjects of the Leak Investigation
4. A list of all individuals or entities that were targets or subjects, or designated as targets or subjects, of the Leak Investigation.
5. A list of all individuals, including HP employees, who were involved with conducting the Leak Investigation or who had contemporaneous knowledge of the Leak Investigation.
6. A list of all individuals or entities whose telephone records or other personal consumer information were procured or attempted to be procured by the outside consulting firm or by any party during the period January 1, 2005, to the present.
7. A list of all individuals whose telephone records or other personal consumer information were procured by the outside consulting firm or by any party during the period January 1, 2005, to the present. For each individual, describe the types of records that were procured.
8. Copies of all reports prepared for the Leak Investigation by the outside consulting firm or by any other party, including any and all analysis or opinions regarding the appropriateness or legality of pretexting.
9. A copy of the letter of engagement with the law firm Wilson Sonsini Goodrich & Rosati regarding the Committee Inquiry.
10. Copies of all reports prepared for the Committee Inquiry, including any report prepared by the firm Wilson Sonsini Goodrich & Rosati.
11. Copies of all draft and final Board minutes that either relate to either the Leak Investigation or the Committee Inquiry.
In addition to the above mentioned information, the Committee on Energy and Commerce also requested the following information from HP by September 25, 2006:
12. All records relating either the Leak Investigation or Committee Inquiry, including but not limited to communications to or from the outside consulting firm, communications by or between HP employees or Board Members, and communications to or from the outside counsel. Please do not provide any copies of the actual telephone records or any other records procured.
At the September 28, 2006 hearing, Dunn and Hurd both testified extensively about the investigation. Dunn testified that until June or July 2006, she did not realize that "pretexting" could involve identity misrepresentation. Dunn repeatedly insisted that she had believed that personal phone records could be obtained through legal methods.
Other witnesses, including Ann Baskins, HP's former General Counsel, Kevin Hunsaker, a six-year HP employee who was a former HP Senior Counsel and "Director of Ethics and Standards of Business Conduct," Anthony Gentilucci, former HP/Compaq/DEC chief of global investigations, and several private investigators invoked the Fifth Amendment, refusing to answer questions due to the ongoing criminal investigations.
Baskins' attorney's letter to the committee contains several documents describing the investigatory methods, who was pretexted, and whether there were any illegal acts committed, including memoranda prepared by HP's outside law firm Wilson, Sonsini, Goodrich & Rosati (Larry Sonsini was among the witnesses at the hearing.)
Hunsaker's May 24 confidential "attorney-client privileged" final report, which gives full details of the investigation, is also available.
California criminal case
On October 4, 2006, California Attorney GeneralAttorney General
In most common law jurisdictions, the attorney general, or attorney-general, is the main legal advisor to the government, and in some jurisdictions he or she may also have executive responsibility for law enforcement or responsibility for public prosecutions.The term is used to refer to any person...
Bill Lockyer
Bill Lockyer
William Westwood "Bill" Lockyer is an American politician. He is the current 32nd State Treasurer of California, elected in 2006 and re-elected in 2010. He has also served as California Attorney General and President Pro Tempore of the California State Senate...
filed criminal charges and arrest warrants against Dunn, HP's former chief ethics officer Kevin Hunsaker, and three outside investigators. The complaint alleged the following four felony violations of the California Penal Code
California Penal Code
The Penal Code of California forms the basis for the application of criminal law in the American state of California. It was originally enacted in 1872 as one of the original four California Codes, and has been substantially amended and revised since then....
:
- Conspiracy to commit crime in violation of Sections 182(a)(1)
- Fraudulent use of wire, radio, or television transmissions in violation of Section 538.5
- Taking, copying, and using computer data in violation of Section 502(c)(2)
- Using personal identifying information without authorization in violation of Section 530.5(a)
The criminal complaint can be found here.
On March 14, 2007, the judge in Patricia Dunn's criminal case dismissed all charges. Hunsaker and the two investigators pled no contest
Nolo contendere
is a legal term that comes from the Latin for "I do not wish to contend." It is also referred to as a plea of no contest.In criminal trials, and in some common law jurisdictions, it is a plea where the defendant neither admits nor disputes a charge, serving as an alternative to a pleading of...
to the wire fraud count; those charges were dismissed pending their completion of 96 hours of community service. The court also dismissed its case against the third investigator, Bryan Wagner, who had pleaded guilty in federal jurisdiction.
Federal criminal charges
On January 11, 2007, Bryan Wagner (a private investigator who was engaged by Hewlett-Packard who had already been charged in the California case) was charged by the federal government with conspiracyConspiracy (crime)
In the criminal law, a conspiracy is an agreement between two or more persons to break the law at some time in the future, and, in some cases, with at least one overt act in furtherance of that agreement...
and identity theft
Identity theft
Identity theft is a form of stealing another person's identity in which someone pretends to be someone else by assuming that person's identity, typically in order to access resources or obtain credit and other benefits in that person's name...
for allegedly obtaining the Social Security Number
Social Security number
In the United States, a Social Security number is a nine-digit number issued to U.S. citizens, permanent residents, and temporary residents under section 205 of the Social Security Act, codified as . The number is issued to an individual by the Social Security Administration, an independent...
of an unidentified journalist to obtain the journalist's phone records.
Wagner pled guilty to the charges. On August 12, 2009, his sentencing hearing was postponed.
Legal ramifications
Before this case, pretexting was a bit of a legal grey area. California had some laws that loosely applied to pretexting, but there were not really any federal laws specific to pretexting.Partially as a result of the case, however, congress passed a law
Telephone Records and Privacy Protection Act of 2006
The Telephone Records and Privacy Protection Act of 2006 prohibits pretexting to buy, sell or obtain personal phone records, except when conducted by law enforcement or intelligence agencies...
specifically prohibiting pretexting. Since then, at least two other people have been prosecuted under the new law:
- November 2008 - Nicholas Shaun Bunch was charged with using a victim's name and the last four digits of his Social Security number to obtain confidential phone records from T-Mobile.
- December 2008 - Vaden Anderson was indicted for using pretexting to obtain confidential phone records from Sprint/Nextel.