How HP Spied Journalists?

September 26, 2006 at 6:05 am (Companies, US)

From SiliconValleyWatcher, here is the press conference transcript of remarks made at a Sept. 22 press conference by Michael Holston, partner with law firm Morgan Lewis, legal counsel to Mark Hurd, CEO of Hewlett-Packard:


· Thanks Mark. Good afternoon.

· I’ve been asked by Mark to discuss the work that Morgan Lewis has done to date.

· Specifically I’ve been asked to explain the process that Morgan Lewis has used to uncover the facts behind the leak investigation and to present those facts to you, with a particular focus on the facts related to the issues that have been addressed in the media in the past few weeks.

· Before getting into the specifics, let me say that our investigation is not complete. There is still more work to be done.

· I was first retained by HP with regard to these issues on Sept. 8th.

· As I mentioned, the Firm has been asked to do an in-depth review of all the facts surrounding the investigation of the board leaks.

· The objective of the investigation is to get a comprehensive picture of what happened, when it happened and how it happened.

· In addition to this investigation, Morgan Lewis is also now handling all federal and state inquiries and investigations related to this matter.

III. Process:

· First, let me talk about the process. During the past two weeks:

o Morgan Lewis has collected more than a million pages of documents.

o We have reviewed many of those pages.

o We are committed to reviewing the remaining documents as fast we are able.

· The documents include internal HP documents and, to the extent we have been able to obtain them, documents from third parties who worked with HP in the leak investigation.

IV. High Level Overview:

· The investigation conducted by HP into the Board room leaks encompassed two phases: the first in early 2005 called Kona I; and the second in early 2006, which was called Kona II.

· Documents reviewed by Morgan Lewis show that certain HP executives and employees assisted in or were knowledgeable about the investigation.

· I will address the roles of various HP executives and employees in more detail in a few minutes.

· It is now clear that the investigation included tactics that ranged from the review of HP’s internal emails and instant messages, to the physical surveillance of an HP Board member and at least one journalist, to the “pretexting” of telephone call information of board members, HP employees and journalists.

Kona I – a high level snap shot

· Let me start with the first phase of the investigation, called Kona I.

· The investigation was started in early 2005 in response to a series of leaks of confidential company information. HP’s then Chairwoman, Patricia Dunn, contacted Security Outsourcing Solutions, Inc. (“SOS”) to perform investigative work.

· HP had a longstanding contractual relationship with SOS.

· For the first month or so of the investigation, Ms. Dunn worked directly with Ron DeLia from SOS.

o The investigation focused on attempting to find the source of the leaks to various Business Week, Wall Street Journal and New York Times journalists.

· Two months into Kona I, HP Global Security was brought in to assist with the investigation.

· At a July 22, 2005 meeting, SOS reported on the findings of the investigation. We believe that meeting was attended by Ms. Dunn, Ann Baskins, Jim Fairbaugh, Tony Gentilucci, Ron DeLia and Kevin Huska. Mark Hurd also briefly attended a portion of the meeting.

· Kona I concluded in the late summer of 2005 without uncovering the source of the leaks.

VI. Kona II – A high level snapshot

· Now let me discuss Kona II.

· In late January of 2006, there were leaks of confidential information from a January 2006 Board meeting that appeared in a CNET story on January 23, 2006.

· After these further leaks, the investigation resumed.

· The core investigative team behind Kona II was:

o Ron DeLia – SOS

o Tony Gentilucci – HP Global Security

o Vincent Nye – HP Global Security

o Fred Adler – HP IT Security Team

o Kevin Hunsaker – HP Senior Counsel

· Kevin Hunsaker directed the Kona II investigation for HP.

· Ms. Dunn, Mark Hurd, Ann Baskins, and Jim Fairbaugh were made aware that the Kona II team was assembled and was beginning to identify the source of the leaks.

· Over the next three months, regular updates were provided by members of the investigation team to Ms. Dunn and, to a lesser extent, to Ann Baskins. · During the course of Kona II, certain members of the investigation team provided assurances that the techniques being used in the investigation were legal.

· Those assurances came from, among others, Kevin Hunsaker, SOS and SOS’s outside legal counsel in Massachusetts.

· In March 2006, the Kona II team prepared a draft report of the investigation that was addressed to Ms. Dunn, Mark Hurd and Ann Baskins. The Report identified the source of the leaking and outlined the investigative techniques employed – including pretexting – with assurances that those techniques were lawful.

· In April 2006, HP provided a copy of the draft report to its outside corporate counsel for review and comment.

· The results of the investigation were reported on at the May 18, 2006 Board


· On May 24th, Kevin Hunsaker produced a final report of the investigation.

· We are not currently aware of any investigation into leaks continuing after May18, 2006.

VII. Investigative techniques used

· Now that I have given you an overview of the leak investigation I want to address certain techniques that were used in the leak investigation and which have been largely reported on by the media during the past several weeks

· In particular, I want to focus principally on four methods that were used:

o Obtaining telephone and facsimile call information through “pretexting”;

o The use of social security numbers to obtain phone call information through “pretexting”;

o Sending an email that had a tracing mechanism as an attachment to the email, and;

o The surveillance of individuals.

· These techniques were used in addition to traditional investigatory techniques, such as the review of other articles written by the journalists with access to the source of the leak and a search of HP internal records.

· Let me walk you through how and what was done in each of the four areas based on what we currently know.

1. Telephone call information through pretexting

· We are trying to respect the privacy of the individuals involved and thus we will not be disclosing the identity of the individuals investigated. HP fully intends to provide each person with detailed information about the information obtained about them, and the methods used for obtaining such information.

· Information regarding hundreds of telephone calls was obtained through “pretexting.”

· At this point in our investigation, there is evidence that SOS, directly or indirectly, obtained telephone (landline or cell) or facsimile call information through “pretexting” for:

o Two (2) current HP employees

o Seven (7) former or current HP Board members (or their family members)

o Nine (9) journalists (or their family members of some journalists)

· I want to stress that to the best of our knowledge, this activity was conducted by an outside investigator. As a result, it has been difficult for us to obtain all of the relevant documentation so far.

2.Use of Social Security Numbers in order to obtain records and HP employees involvement in the “pretexting”

· Morgan Lewis has uncovered one instance where, in January 2006, a member of the core investigation team – Tony Gentilucci – provided an HP employee’s social security number to SOS. We believe this was done for the purpose of obtaining telephone call information through “pretexting.”

· In addition, in January 2006, SOS obtained and transmitted social security numbers to Action Research Group (“ARG”) – the subcontractor SOS used to assist it the investigation. Again, we believe this was done for the purpose of obtaining telephone call information through “pretexting.” It is unclear at this stage what involvement, if any, HP employees had in obtaining and/or

transmitting these social security numbers to SOS. At this point in our investigation, we have information that social security numbers were used for the following:

o Three journalists

o Three current or former HP board members

o One HP employee

· In March of 2006, we believe that SOS obtained and transmitted the social security numbers for one other journalist, expressly for the purpose of obtaining telephone call information. It is unclear what involvement, if any, HP employees had in obtaining and/or transmitting this information to SOS.

3. Tracer

· Recent media stories have discussed the use of an email message, with what has been referred to as a tracer.

· A tracer is frequently used in businesses by individuals or companies which run websites to understand the behavior of their customers, and can be used to obtain information, such as the IP address of the person who downloads the tracer.

· In January 2006, the Investigation Team created an email account with a fictitious name and used that email account to send an email containing a tracer to a journalist. The objective of Investigation Team was to determine whether the journalist would forward the email to her source, and to determine the source of the leaks of HP confidential information.

· The Investigation Team prepared the email account and message so that the message appeared to be coming from a disgruntled senior executive, who was willing to share information with the journalist. The email to the journalist would provide what appeared to be confidential information.

· At this stage, the evidence suggests that the Investigation Team never received any confirmation that the tracer was activated, even though it received email messages from the journalist.

· The concept of sending the misinformation to the reporter and the content of the misinformation to be contained in the message of the email was approved by Mark Hurd. We have found no evidence that he was asked to approve the use of the tracer.


· Members of SOS engaged in physical surveillance. At this point in our investigation, we have the following information:

o In January 2006, SOS had an investigator surveil a Board meeting to determine if any journalists were seen at or around the site of the Board meeting.

o In late January into early February of 2006, SOS had an investigator surveil a HP Board member. The surveillance efforts included:

 Surveilling him during a trip to Boulder, CO where he was a keynote speaker at an event. . SOS also surveilled him, his spouse and potentially other family members who were at the Board member’s residence in California at the time.

o In February 2006, SOS had an investigator surveil a journalist and her residence.

· We also have evidence that in February 2006, third party investigators may have conducted a search of individuals’ trash. However, at this time, we do not know who the targets of these efforts were.

VIII. In conclusion

· Finally, I want to address what we have not seen so far in our investigation. At this point in Morgan Lewis’ investigation:

· We have seen no evidence that any employee authorized or had knowledge of any use of online accounts being created or used to obtain telephone call information;

· We have not seen evidence that any wiretapping of any telephones occurred;

· We have not seen evidence that any computer keystrokes were tracked; and

· While a PowerPoint presentation discussing potential investigative techniques suggested studying the feasibility of “undercover operations” at the San Francisco offices of the Wall Street Journal and CNET, we do not have information to support the contention that any such operations actually occurred.

· I appreciate the cooperation of HP and its employees during the course of our investigation.

· Thank you for your time today.


Leave a Reply

Fill in your details below or click an icon to log in: Logo

You are commenting using your account. Log Out /  Change )

Google+ photo

You are commenting using your Google+ account. Log Out /  Change )

Twitter picture

You are commenting using your Twitter account. Log Out /  Change )

Facebook photo

You are commenting using your Facebook account. Log Out /  Change )


Connecting to %s

%d bloggers like this: