News from the Congressional grilling that HP faced yesterday revealed the company has sent spying e-mails — HP calls it "tracer technology" — at least a dozen times in the past, according to an HP security worker. Such e-mails report who reads them and how they are forwarded.
Fred Adler, who was involved in HP's sting of illegal used 3000 brokers in 1999-2000, said the tracers have been used in cases where HP was working with law enforcement. Although Adler's testimony did not mention the spy-mails in conjunction with the 3000 investigation by the High-Tech Task Force, HP did work with the California law enforcement team in that matter. Several HP 3000 vendors were either jailed or put under house arrest in that 1999 case. A law enforcement official part of the Task Force, Adler has since joined HP as a security employee.
In a story published today by CNET — which saw its reporter Dawn Kawamoto tailed, her phone records nabbed through pretexting, and delivered a bogus HP e-mail — Adler's testimony sounds a good deal like HP's stance while it cracked down on 3000 companies like Hardware House six years ago.
HP security worker Adler said, under questioning, that he was the one who came up with the idea to include a software-based tracking device in the e-mail to Kawamoto. "That was my idea," Adler said. "At the time I understood it to be a legally permissible way to obtain information, and I still believe it to be."
Adler said it is a tactic still sanctioned by HP, and one they have used in past investigations. He said he knows of HP using the tracing technology a dozen or two dozen times, including instances when the company was working with law enforcement.
HP CEO Mark Hurd pledged to make internal changes at HP to stop what he called a "rogue operation." His pledges from prepared testimony included the statements below (click for a larger version):
Hurd said that HP's policies will include language "related to inappropriate practices in obtaining confidential records or personal information. HP has a Privacy Training curriculum and a Chief Privacy Officer, Scott Taylor. The curriculum will be updated, and Taylor will be included in "review processes related to HP's accountability in the collection and use of sensitive information, including how such information is used in investigations.
In June, Taylor testified before a subcommittee of this week's House committee . He said then that HP considered privacy a core value. "At HP, we stand ready to serve as a resource to you, so that working together, we may find meaningful, functional ways to protect the privacy of American consumers and realize the full potential of e-commerce."