By Ellen Nakashima
Washington Post Staff Writer
Thursday, September 28, 2006; D01
Hewlett-Packard Co.'s media-leak investigation went forward despite warnings from HP security personnel that the tactics used were "probably illegal" and should be stopped, according to documents collected for today's congressional hearing on the scandal.
In February, HP global security investigator Vince Nye told a Boston colleague working with him on the leak probe that he had "serious reservations" about how they were obtaining phone-record information in an internal probe to ferret out the source of media leaks.
He said he thought the method, impersonating someone else to trick the phone company into providing call data, "is very unethical at the least and probably illegal."
"I am requesting that we cease this phone number gathering method immediately and discount any of its information," Nye wrote in a Feb. 7 e-mail to Anthony Gentilucci, one of four members of the internal investigative team reporting to HP's legal department. Nye sent a copy of the e-mail to Kevin Hunsaker, then HP's chief ethics director, who supervised the probe.
How and why top management failed to heed the warning are among the questions members of the House Energy and Commerce oversight and investigations subcommittee want answered at today's hearing. More than a dozen key figures, including chief executive Mark V. Hurd and former chairman Patricia C. Dunn are scheduled to appear to explain how their media-leak probe morphed into an elaborate spying operation that targeted board members and journalists.
The hearing was fueled by concerns about how private citizens' phone records were illegally accessed. On a deeper level, analysts and lawmakers said, the issue is one of corporate ethics and how HP's leaders could let an internal probe go so awry.
Dunn, in a statement submitted to the committee for today's testimony, strongly defended her handling of the leak investigation, which started in 2005. She distanced herself from its operational aspects, saying: "I did not at any point consider myself its 'supervisor.' ''
Dunn professed not to know that illegal tactics were used. At some point in spring 2005, Dunn said she became aware from Ronald DeLia, a Boston contractor who had done investigative work for HP for eight or nine years, that phone records were being obtained as a "standard component" of internal investigations.
"The clear impression I had from Mr. DeLia was that such records could be obtained from publicly available sources in a legal and appropriate manner," she said.
Dunn, who left the company Friday, said both she and Hurd were aware of a planned e-mail sting operation on a reporter conducted in February in an attempt to flush out the reporter's source of company information. She said she was assured that this was "a legal and common investigative technique" and so referred it to Hurd for the final decision.
Dunn's remarks contrasted with a more contrite statement from Hurd to the committee for today's testimony. In it, he apologized to the nine journalists, two current HP employees, and seven former or current HP board members and their families whose phone records were to varying degrees obtained under false pretenses, a practice known as pretexting.
"How did such an abuse of privacy occur?" he wrote. "It's an age-old story. The ends came to justify the means."
"What began as a proper and serious inquiry into leaks to the press of company information from within the HP board became a rogue investigation that violated our own principles and values," he added. "There is no excuse for this aberration. It happened; it will never happen again."
The scandal brings to the fore questions of privacy that affect thousands of Americans whose phone or bank records have been fraudulently obtained by data brokers who sell the information to investigators. What catapulted this to the headlines was the fact that this time, it was a Fortune 100 company seeking the personal data
Not only did investigators lie to obtain phone call records, they also conducted extensive background checks of reporters, directors, their spouses and children; plotted to plant spies in newsrooms; discussed the possibility of inspecting trash; and planned a ruse to trick a reporter into revealing her source by planting a tracer in an e-mail sent by a fictitious HP tipster.
"What happened here was like cutting off your head to kill a head cold," said Charles M. Elson, chairman of the University of Delaware's John L. Weinberg Center for Corporate Governance.
The purpose of today's hearings, lawmakers and aides said, is to lay bare what happened, find out who committed or knew about any acts that were illegal or unethical, and to push Congress to pass pending legislation that could prevent much of this from happening again.
"For the highest-ranking officials of a company like Hewlett-Packard to be aware of and seemingly approve this kind of activity I do not think speaks well of their value system or their culture," said subcommittee chairman Edward Whitfield (R-Ky.).
The scandal seems curious, considering how Hewlett-Packard, founded in 1938, spent decades building an image as an ethical company devoted to civic responsibility and the welfare of its employees. HP codified its philosophy of respecting individuals, encouraging teamwork and promoting openness as it tried to fashion useful products. Called "the HP Way," its corporate philosophy became a legend in Silicon Valley.
In his statement, Hurd admitted that the probe had fallen afoul of the "HP Way." He outlined steps taken to correct mistakes, including accepting Dunn's resignation. Two others involved in the investigation, Hunsaker and Gentilucci, have also left the company. Hurd said existing ethical practices will be reviewed and new measures developed to protect information privacy.
He, too, distanced himself from the investigation's operation: "I was apprised of the existence of the investigation by Ms. Dunn, but I was not involved in the investigation itself."
Both the FBI and the California attorney general's office are investigating the case, and California Attorney General Bill Lockyer has said he has enough evidence to bring criminal charges against people inside and outside the firm. Documents delivered to Congress detailed one exchange between HP investigators that suggested they knew they were pushing the bounds of the law.
In a Jan. 30 e-mail, Hunsaker asked Gentilucci how HP's private investigator was obtaining phone records. "Is it all above board?" he asked.
Gentilucci replied that the investigator, DeLia, used " some ruse" to trick phone operators. "I think it's on the edge, but above board," he wrote.
Hunsaker's reply: "I shouldn't have asked."
Staff writer Yuki Noguchi and staff researcher Richard Drezen contributed to this report.