SEC filing acknowledges 'pretexting' in HP board probe

The company's investigation into media leaks has stirred up federal regulators and the California attorney general's office.

Dawn Kawamoto Former Staff writer, CNET News
Dawn Kawamoto covered enterprise security and financial news relating to technology for CNET News.
Dawn Kawamoto
4 min read
A controversial data-gathering technique known as "pretexting" was used in Hewlett-Packard's internal investigation of media leaks from its boardroom, the company disclosed Wednesday in a filing with the U.S. Securities and Exchange Commission.

In addition, the SEC filing noted that, in conjunction with the investigation, longtime director George Keyworth will not be nominated for another term on the HP board.

George Keyworth George Keyworth

As previously reported, HP Chairwoman Patricia Dunn launched an investigation into the company's board following leaks to the media, in particular a CNET News.com article on an HP retreat to discuss the company's long-term strategies.

HP's handling of its investigation has spurred an informal investigation by the attorney general of California, but also prompted a letter from the staff of the SEC, according to the filing. State regulators are concerned about the use of pretexting and its legalities, while sources say the SEC is interested in the initial brief disclosure HP issued in announcing the departure of HP director Tom Perkins, who resigned in protest of the board investigation.

"We are investigating the HP situation for potential criminal violations. It's one of about a half-dozen significant (pretexting) cases we're investigating," said Nathan Barankin, a spokesman for the California attorney general's office. "We're in the fact-gathering stage, and it's early in the investigation."

The SEC and Keyworth declined to comment.

At a board meeting in May, Dunn presented the results of the investigation and revealed that Keyworth was the source of the leaks, which he acknowledged. Keyworth was asked by the board to resign at that meeting but refused, leading to a decision by the board in late August not to renominate him.

Related documents
Perkins: I was 'hacked'
Former HP director Tom Perkins lays out the issues he has with the board.

It was at that May meeting when Perkins resigned. He reiterated his earlier request of Dunn to just ask the board members if they had leaked information, rather than launch a full-blown investigation, and ask for a private apology, sources said.

A month later, according to the SEC filing, Perkins asked HP about the methods it used to conduct its investigation. (To see letters and e-mail to and from Perkins regarding these matters, including his charge that "my personal phone records were 'hacked'", click here.)

"Perkins sought information from HP concerning the methods used to conduct HP's investigations into the leaks, (asserting) that phone and e-mail communications had been improperly recorded as part of the investigation and that he had recently consulted with counsel regarding that assertion," according the SEC filing.

HP responded that "no recording or eavesdropping" had occurred but acknowledged pretexting had been used to gather information on phone records. Pretexting is a method used by individuals seeking to gain access to someone else's personal information, such as phone records, by pretending to be the legitimate holder of that account. These individuals sometimes feed the information to data brokers, who in turn sell individuals' private phone records to others.

HP, acting upon Perkins' request for more information on how the investigation was performed, asked its outside legal firm to conduct an investigation. The outside legal firm was not involved in the initial investigation into the leaks, according to the SEC filing. HP has long relied on Wilson Sonsini Goodrich & Rosati as its outside legal firm, with Larry Sonsini often present during board meetings, according to sources.

HP hired an outside private investigation firm, with "substantial experience" in internal investigations, according to the filing. "This firm had retained another party to obtain phone information concerning certain calls between HP directors and individuals outside of HP."

While Dunn and the internal HP team informed the private investigation firm to use techniques that were legal, the company later learned that the third party the private investigation firm hired had "in some cases employed pretexting," according to the SEC filing.

"The committee (assigned to review the investigation methodology) was then advised by the committee's outside counsel that the use of pretexting at the time of the investigation was not generally unlawful, except with respect to financial institutions, but such counsel could not confirm that the techniques employed by the outside consulting firm and the party retained by that firm complied with all respects with applicable law," according to the SEC filing.

HP's board of directors and its chief executive, Mark Hurd, have accepted the results of the committee's findings on the way in which the investigation was handled and have also agreed to "assure that all aspects of HP's investigations comply with applicable laws and HP's code of ethics," the SEC filing states.