Under questioning, Dunn was asked why she didn't recognize that investigators would have to turn to dubious means to get personal phone records. Dunn said she relied on the advice of others, including HP's outside investigator, Ron DeLia.
"I did not know where this information could be found publicly, but I was aware that the kinds of investigations done by Mr. DeLia had previously been based solely on publicly available information," Dunn said. "I took the understanding without any question, and I understand why that might seem strange today, knowing what I know now."
Dunn was questioned by the committee, as were HP's outside lawyer Larry Sonsini and HP IT security worker Fred Adler. A number of other former HP employees and contractors refused to testify earlier Thursday, invoking their Fifth Amendment rights against self-incrimination.
The comments came at the start of two days of hearings, by an oversight and investigations subcommittee of the House of Representatives' Energy and Commerce Committee. The hearings regard the practice of pretexting, or obtaining phone records without consent and through the use of false pretenses. Thursday's hearing is devoted to the HP case, while hearings Friday will focus on the broader issue.
Among those who refused to testify was Ann Baskins, who resigned Thursday as HP's general counsel. Also pleading the Fifth were two other HP employees who have left the company, as well as DeLia, the operator of Security Outsourcing Solutions in Boston.
Also refusing to testify were a variety of outside contractors involved in the HP leak investigation, including Joe Depante, owner of Action Research Group in Melbourne, Fla.
As for Dunn, she was asked about a June 15, 2005, meeting at which the methods of pretexting were discussed. Investigations and Oversight subcommittee chairman Ed Whitfield, R-Kentucky, pointed to handwritten notes attributed to Baskins that included Dunn's initials next to questions and also noted that "obtaining phone numbers is a time consuming process" in which investigators call various carriers "and use pretexting to extract the information."
Rep. Greg Walden, R-Oregon, presented Dunn with an e-mail from the day earlier in which Dunn asks DeLia to reschedule a meeting to June 15 so Baskins could be included. In earlier testimony, before Walden presented the e-mail, Dunn said, "I do not recall being in that meeting."
On further questioning, Dunn said that she may have seen the word pretexting, but didn't know it equated to fraudulent misrepresentation. "The word pretext does show up in documents I had seen," Dunn said.
Walden repeatedly asked Dunn how she thought HP was getting the phone records. "My understanding was these records were publicly available," she said, later adding, "I understood that you could call up and get phone records" because she thought it was a common investigative technique.
Walden expressed skepticism, asking Dunn if she really believed that. "I thought a year ago, I thought six months ago, that indeed you could," she said.
"You're serious?" Walden said. "I'm not being funny here. You honestly believed it was that simple?"
He also presented Dunn with documents from a later Wilson Sonsini inquiry that had DeLia and others saying that Dunn was aware of the techniques being used. Dunn said the word "pretexting" may have been used, but that she did not understand that meant fraudulent misrepresentation.
"No one ever described to me that the fraudulent use of identity was part of the HP way of conducting investigations," Dunn said.
Dunn was asked whether she had a problem with the e-mail sting, in which HP sent an e-mail to CNET News.com reporter Dawn Kawamoto under the guise of "Jacob," a ficticious disgruntled employee. "This did raise a concern to me," she said.
But Dunn said she was not the one in a position to decide on such matters. "I sent the team to management to get approval for their techniques," Dunn said.
Asked repeatedly whether she was at all at fault for what happened, Dunn expressed regret but did not accept the blame. "If I knew then what I know now, I would have done things very differently," Dunn said. However, she said, "I do not accept personal responsibility for what happened."