
On September 5, 2006,
Newsweek
''Newsweek'' is an American weekly news magazine based in New York City. Founded as a weekly print magazine in 1933, it was widely distributed during the 20th century and has had many notable editors-in-chief. It is currently co-owned by Dev P ...
revealed that the
general counsel
A general counsel, also known as chief counsel or chief legal officer (CLO), is the chief in-house lawyer for a company or a governmental department.
In a company, the person holding the position typically reports directly to the CEO, and their ...
of
Hewlett-Packard
The Hewlett-Packard Company, commonly shortened to Hewlett-Packard ( ) or HP, was an American multinational information technology company. It was founded by Bill Hewlett and David Packard in 1939 in a one-car garage in Palo Alto, California ...
, at the behest of
HP chairwoman
Patricia Dunn, had contracted a team of independent security experts to investigate board members and several journalists in order to identify the source of an
information leak
A data breach, also known as data leakage, is "the unauthorized exposure, disclosure, or loss of personal information".
Attackers have a variety of motives, from financial gain to political activism, political repression, and espionage. There ar ...
. In turn, those security experts recruited private investigators who used a spying technique known as
pretexting
Pretexting is a type of social engineering attack that involves a situation, or pretext, created by an attacker in order to lure a victim into a vulnerable situation and to trick them into giving private information, specifically information that ...
. The pretexting involved investigators impersonating HP board members and nine journalists (including reporters for
CNET, the ''
New York Times
''The New York Times'' (''NYT'') is an American daily newspaper based in New York City. ''The New York Times'' covers domestic, national, and international news, and publishes opinion pieces, investigative reports, and reviews. As one of ...
'' and the ''
Wall Street Journal
''The Wall Street Journal'' (''WSJ''), also referred to simply as the ''Journal,'' is an American newspaper based in New York City. The newspaper provides extensive coverage of news, especially business and finance. It operates on a subscriptio ...
'') in order to obtain their phone records. The information leaked related to HP's long-term strategy and was published as part of a CNET article in January 2006. HP hired public relations firm
Sitrick and Company
Sitrick and Company is a Los Angeles–based public relations firm founded, in 1989, by its chair and CEO, Michael "Mike" Sitrick. The company has established offices in New York City and Washington, DC. Since 2009, the company is owned by Resourc ...
to manage their media relations during the crisis.
Patricia Dunn claimed she did not know beforehand the methods the investigators used to try to determine the source of the leak.
Board member
George Keyworth was ultimately accused of being the source and on September 12, 2006, he resigned, although he continued to deny making unauthorized disclosures of confidential information to journalists and was thanked by Mark Hurd for his board service. It was also announced at that time that Dunn would continue as chairwoman until January 18, 2007, at which point HP CEO
Mark Hurd
Mark Vincent Hurd (January 1, 1957 – October 18, 2019) was an American technology executive who was CEO of Oracle Corporation. He had been chairman, chief executive officer, and president of Hewlett-Packard, before his forced resignation in 2 ...
would succeed her. Then, on September 22, 2006 HP announced that Dunn had resigned as chairwoman because of the "distraction her presence on our board" created. On September 28, 2006,
Ann Baskins
Ann O'Neil Baskins (born August 5, 1955 in Red Bluff, California, USA) is former General Counsel for Hewlett-Packard Company (HP). Baskins was linked to the HP pretexting scandal. On September 28, 2006, following public disclosure of the matter, ...
, HP's general counsel, resigned hours before she was to appear as a witness before the House Committee on Energy and Commerce, where she would ultimately invoke the
Fifth Amendment to refuse to answer questions.
Investigation by the House Committee on Energy and Commerce
On September 11, 2006, CNET News.com publicly released a five-page letter written by the
United States House Committee on Energy and Commerce
The Committee on Energy and Commerce is one of the oldest standing committee (United States Congress), standing committees of the United States House of Representatives. Established in 1795, it has operated continuously—with various name chang ...
to
Patricia Dunn stating that it had, for the past seven months, been conducting an investigation on Internet-based data brokers who allegedly use "lies, fraud and deception" to acquire personal information, and allow anyone who pay a "modest fee" to acquire "itemized incoming and outgoing call logs", not only for
cell phone
A mobile phone or cell phone is a portable telephone that allows users to make and receive calls over a radio frequency link while moving within a designated telephone service area, unlike fixed-location phones ( landline phones). This radio ...
numbers but also for
VoIP
Voice over Internet Protocol (VoIP), also known as IP telephony, is a set of technologies used primarily for voice communication sessions over Internet Protocol (IP) networks, such as the Internet. VoIP enables voice calls to be transmitted as ...
numbers,
landline
A landline is a physical telephone connection that uses metal wires or optical fiber from the subscriber's premises to the network, allowing multiple phones to operate simultaneously on the same phone number. It is also referred to as plain old ...
numbers, and unpublished phone numbers. Additional data that could be obtained included
addresses
An address is a collection of information, presented in a mostly fixed format, used to give the location of a building, apartment, or other structure or a plot of land, generally using border, political boundaries and street names as references, ...
and other personal data, obtained without the consent or prior notice to the owner of the number. The committee had learned about HP's use of pretexting through its September 6 SEC filing and through their own inquiry of HP's Nominating and Governance Committee, stating they are "troubled" by the information, "particularly that it involves HP—one of America's corporate icons."
The committee requested, under Rules X and XI of the
United States House of Representatives
The United States House of Representatives is a chamber of the Bicameralism, bicameral United States Congress; it is the lower house, with the U.S. Senate being the upper house. Together, the House and Senate have the authority under Artic ...
, the following information from HP by September 18, 2006:
[ ]
1. The name and identity of the outside consulting firm
A consulting firm or simply consultancy is a professional service firm that provides expertise and specialised labour for a fee, through the use of consultants. Consulting firms may have one employee or thousands; they may consult in a broad ra ...
cited in HP's September 6, 2006, filing with the SEC (the outside consulting firm), and of any other outside consultants who were hired by HP to assist in conducting the Leak Investigation.
2. Copies of any contracts, letters of engagement and investigative plans related to the Leak Investigation that was conducted by the outside consulting firm or by any other party.
3. The names and identities of all third parties, whether hired directly by HP or by HP's outside consulting firm, who were used during the leak investigation to procure, or to attempt to procure telephone records and other personal consumer information of any targets or subjects of the Leak Investigation.
4. A list of all individuals or entities that were targets or subjects, or designated as targets or subjects, of the Leak Investigation.
5. A list of all individuals, including HP employees, who were involved with conducting the Leak Investigation or who had contemporaneous knowledge of the Leak Investigation.
6. A list of all individuals or entities whose telephone records or other personal consumer information were procured or attempted to be procured by the outside consulting firm or by any party during the period January 1, 2005, to the present.
7. A list of all individuals whose telephone records or other personal consumer information were procured by the outside consulting firm or by any party during the period January 1, 2005, to the present. For each individual, describe the types of records that were procured.
8. Copies of all reports prepared for the Leak Investigation by the outside consulting firm or by any other party, including any and all analysis or opinions regarding the appropriateness or legality of pretexting.
9. A copy of the letter of engagement with the law firm Wilson Sonsini Goodrich & Rosati regarding the Committee Inquiry.
10. Copies of all reports prepared for the Committee Inquiry, including any report prepared by the firm Wilson Sonsini Goodrich & Rosati.
11. Copies of all draft and final Board minutes that either relate to either the Leak Investigation or the Committee Inquiry.
In addition to the above-mentioned information, the Committee on Energy and Commerce also requested the following information from HP by September 25, 2006:
12. All records relating either the Leak Investigation or Committee Inquiry, including but not limited to communications to or from the outside consulting firm, communications by or between HP employees or Board Members, and communications to or from the outside counsel. Please do not provide any copies of the actual telephone records or any other records procured.
At the September 28, 2006 hearing, Dunn and Hurd both testified extensively about the investigation. Dunn testified that until June or July 2006, she did not realize that "pretexting" could involve identity misrepresentation. Dunn repeatedly insisted that she had believed that personal phone records could be obtained through legal methods.
Other witnesses, including Ann Baskins, HP's former General Counsel, Kevin Hunsaker, a six-year HP employee who was a former HP Senior Counsel and "Director of Ethics and Standards of Business Conduct," Anthony Gentilucci, former HP/Compaq/DEC chief of global investigations, and several private investigators invoked the Fifth Amendment, refusing to answer questions due to the ongoing criminal investigations.
Baskins' attorney's letter to the committee contains several documents describing the investigatory methods, who was pretexted, and whether there were any illegal acts committed, including memoranda prepared by HP's outside law firm
Wilson, Sonsini, Goodrich & Rosati (Larry Sonsini was among the witnesses at the hearing).
Hunsaker's May 24 confidential "attorney-client privileged" final report, which gives full details of the investigation, is also available.
California criminal case
On October 4, 2006, California
Attorney General
In most common law jurisdictions, the attorney general (: attorneys general) or attorney-general (AG or Atty.-Gen) is the main legal advisor to the government. In some jurisdictions, attorneys general also have executive responsibility for law enf ...
Bill Lockyer
William Westwood Lockyer (born May 8, 1941) is an American politician and lawyer from the state of California. A Democrat, he served in both houses of the state legislature, having been a member of the California State Assembly from 1973 to 19 ...
filed criminal charges and arrest warrants against Dunn, HP's former chief ethics officer Kevin Hunsaker, and three outside investigators. The complaint alleged the following four felony violations of the
California Penal Code
The Penal Code of California forms the basis for the application of most criminal law, criminal procedure, penal institutions, and the execution of sentences, among other things, in the United States, American state of California. It was origin ...
:
# Conspiracy to commit crime in violation of Sections 182(a)(1)
# Fraudulent use of wire, radio, or television transmissions in violation of Section 538.5
# Taking, copying, and using computer data in violation of Section 502(c)(2)
# Using personal identifying information without authorization in violation of Section 530.5(a)
The criminal complaint is publicly available.
On March 14, 2007, the judge in Patricia Dunn's criminal case dismissed all charges. Hunsaker and the two investigators pleaded
no contest
''Nolo contendere'' () is a type of legal plea used in some jurisdictions in the United States. It is also referred to as a plea of no contest or no defense. It is a plea where the defendant neither admits nor disputes a charge, serving as an ...
to the wire fraud count; those charges were dismissed pending their completion of 96 hours of community service. The court also dismissed its case against the third investigator, Bryan Wagner, who had pleaded guilty in federal jurisdiction.
Federal criminal charges
On January 11, 2007, Bryan Wagner (a private investigator who was engaged by Hewlett-Packard who had already been charged in the
California case) was charged by the federal government with
conspiracy
A conspiracy, also known as a plot, ploy, or scheme, is a secret plan or agreement between people (called conspirers or conspirators) for an unlawful or harmful purpose, such as murder, treason, or corruption, especially with a political motivat ...
and
identity theft
Identity theft, identity piracy or identity infringement occurs when someone uses another's personal identifying information, like their name, identifying number, or credit card number, without their permission, to commit fraud or other crimes. ...
for allegedly obtaining the
Social Security Number
In the United States, a Social Security number (SSN) is a nine-digit number issued to United States nationality law, U.S. citizens, Permanent residence (United States), permanent residents, and temporary (working) residents under section 205(c)(2 ...
of an unidentified journalist to obtain the journalist's phone records.
Wagner pleaded guilty to the charges. On August 12, 2009, his sentencing hearing was postponed.
On December 13, 2012, Wagner was sentenced to serve three months in prison, along with two years of supervisory release.
Legal ramifications
Before this controversy, pretexting was a legal grey area. California had laws that applied to pretexting, but there were no federal laws specific to pretexting.
Partially as a result of the case, however, Congress passed the
Telephone Records and Privacy Protection Act of 2006, which specifically prohibits pretexting.
Since then, at least two other people have been prosecuted under the new law:
* November 2008 – Nicholas Shaun Bunch was charged with using a victim's name and the last four digits of his Social Security number to obtain confidential phone records from T-Mobile.
* December 2008 – Vaden Anderson was indicted for using pretexting to obtain confidential phone records from Sprint/Nextel.
References
{{HP
Corporate scandals
United States espionage scandals and incidents
2006 in the United States
Hewlett-Packard
2006 scandals