HP warned on leak probe's legality

In its Aug. 30 report, Wilson Sonsini Goodrich & Rosati concludes that the use of pretenses to obtain phone records, a practice known as "pretexting," was "not generally unlawful" at the time of the investigation. However, the same report notes that "HP subcontractors may have used Social Security numbers (not provided by HP) while pretexting, which more likely than not violates federal law."

Hewlett-Packard did not disclose any information about the leak probe until a Sept. 6 SEC filing, then saying only that its outside counsel had found "that the use of pretexting at the time of the investigation was not generally unlawful (except with respect to financial institutions), but such counsel could not confirm that the techniques employed by the outside consulting firm and the party retained by that firm complied in all respects with applicable law."

An HP representative on Friday declined to comment on the leak investigation or say why it did not mention in a Sept. 6 SEC filing that Wilson Sonsini had warned that the use of Social Security numbers may have been illegal. The Aug. 30 report was part of a batch of documents turned over to the House Energy and Commerce Committee and made public this week.

The company has since said that one of its security workers, Tony Gentilucci, did provide the Social Security number of an HP employee to outside investigators for the purposes of getting his or her phone number. The company also says that its outside security firms obtained additional Social Security numbers and cautioned in an SEC filing this week that it has "not yet ascertained what involvement, if any, HP employees had in obtaining and/or transmitting these Social Security numbers."

Use of the Social Security numbers to obtain phone numbers "would more than likely constitute at least a technical violation of statute," Wilson Sonsini said in its report.

Federal and state authorities have launched criminal probes of HP's leak investigation, particularly the unauthorized access of phone records through pretexting. HP has said that it targeted the phone records of seven current or former board members, nine reporters, two employees and an unspecified number of others.

In the wake of the scandal, Chairman Patricia Dunn and General Counsel Ann Baskins have resigned. Gentilucci left the company on Tuesday, as did Kevin Hunsaker, the senior counsel and ethics officer who oversaw the second part of the investigation.

The Wilson Sonsini report said that Dunn "acted with the best of intentions" but committed an "error in judgment" by not involving HP legal or outside counsel at the outset of the investigation.

As for CEO Mark Hurd, the firm said he "acted properly in all respects," saying he was given assurances that investigative methods were legal and it was "reasonable for (the) CEO to rely on these assurances particularly since Mr. Hurd was not leading the investigation."

In an interview with Wilson Sonsini, however, Dunn portrays Hurd as being far more involved in the second half of the investigation. "Hurd was outraged," Dunn told lawyers, according to the report. "Hurd and Dunn agreed they would 'tag team' on the investigation."

By contrast, Hurd said in his Aug. 25 interview with Wilson Sonsini, that he let Dunn "run with the ball," according to the firm's notes from the meeting. However, Hurd also said that in one meeting, likely a July 22, 2005 meeting, somebody mentioned obtaining phone record information off the Web. "Hurd remembered thinking that there must be a Web site with such information," according to Wilson Sonsini's notes of the meeting.

Hurd has said he didn't read a March report that detailed both the results and many of the methods used in the investigation. "Not my finest hour," he told a congressional committee on Thursday.

Dunn also told the lawyers that it was "misleading" to think of the investigation in phases. "It was one ongoing investigation," Wilson Sonsini said in its summary of Dunn's testimony. HP has said in SEC filings, among other places, that its investigation was divided into two phases. The first, "Kona I," stretched from early 2005 until late summer of that year, and ended without finding the source of leaks. The company said that a second phase, "Kona 2," began after a