HP's been tracing for years, employee testifies
September 29, 2006
News from the Congressional grilling that HP faced yesterday revealed the company has sent spying e-mails — HP calls it "tracer technology" — at least a dozen times in the past, according to an HP security worker. Such e-mails report who reads them and how they are forwarded.
Fred Adler, who was involved in HP's sting of illegal used 3000 brokers in 1999-2000, said the tracers have been used in cases where HP was working with law enforcement. Although Adler's testimony did not mention the spy-mails in conjunction with the 3000 investigation by the High-Tech Task Force, HP did work with the California law enforcement team in that matter. Several HP 3000 vendors were either jailed or put under house arrest in that 1999 case. A law enforcement official part of the Task Force, Adler has since joined HP as a security employee.
In a story published today by CNET — which saw its reporter Dawn Kawamoto tailed, her phone records nabbed through pretexting, and delivered a bogus HP e-mail — Adler's testimony sounds a good deal like HP's stance while it cracked down on 3000 companies like Hardware House six years ago.
HP security worker Adler said, under questioning, that he was the one who came up with the idea to include a software-based tracking device in the e-mail to Kawamoto. "That was my idea," Adler said. "At the time I understood it to be a legally permissible way to obtain information, and I still believe it to be."
Adler said it is a tactic still sanctioned by HP, and one they have used in past investigations. He said he knows of HP using the tracing technology a dozen or two dozen times, including instances when the company was working with law enforcement.
HP CEO Mark Hurd pledged to make internal changes at HP to stop what he called a "rogue operation." His pledges from prepared testimony included the statements below (click for a larger version):
Hurd said that
HP's policies will include language "related to inappropriate practices in obtaining confidential records or personal information. HP has a Privacy Training curriculum and a Chief Privacy Officer, Scott Taylor. The curriculum will be updated, and Taylor will be included in "review processes related to HP's accountability in the collection and use of sensitive information, including how such information is used in investigations.
In June, Taylor testified before a subcommittee of this week's House committee . He said then that HP considered privacy a core value. "At HP, we stand ready to serve as a resource to you, so that working together, we may find meaningful, functional ways to protect the privacy of American consumers and realize the full potential of e-commerce."
Meanwhile, resigned general counsel Ann Baskins and resigned chairman Dunn refused to accept responsibility. One blamed the other for the hoax, while HP's top lawyer Ann Baskins resigned before hearings started, then took the Fifth to avoid testifying and incriminating herself. Her attorneys said she "would have liked to appear
"Who was in charge was the HP internal legal department," said former chairman Patricia Dunn, who launched the pretexting probe in 2005. "Rightly or wrongly that's what happened. I do not accept personal responsibility for what happened."
The resigned director said under oath she believed personal phone records can be accessed as if they were public information. "My understanding was these records were publicly available," she said. "I understood that you could call up and get phone records."
One congressman on the House panel replied, "You're serious? I'm not being funny here. You honestly believed it was that simple?"
Investors remained unmoved by the testimony. HP's stock actually climbed 58 cents a share during Thursday's hearings, remaining less than a dollar off its five-year high. Investors have watched closely to see if CEO Hurd had been entangled in the hoax. Many give Hurd credit for HP's share resurgence in the last 18 months.
But the CEO delivered no new information under the questions of the panel from a Congress which the Wall Street Journal characterized as "enraged over H-P's use of pretexting and other spying tactics to find out which board member was leaking company information to the press."
Hurd testified he wasn't as concerned about board leaks as other directors, but he approved the content of the fake e-mail. He said last Friday in a press briefing he knew nothing about the "tracer technology."
But it was up to the Wall Street Journal, home of one of the probed reporters, to find the lighter side of Hurd's testimony. The Journal's legal blog said Hurd came away unscratched with a strong mea culpa, adding:
In a moment of levity during a day that had few of them, Rep. Blackburn of Tennessee asked Hurd who was currently heading up investigations at HP. “As of now we have an open position,” said Hurd, breaking into a wide smile. “We are looking for qualified candidates,” he said, drawing out the word “qualified” for dramatic effect.