Update: Lawmakers grill Dunn, Hurd over pretexting

Former Hewlett-Packard Chairwoman Patricia Dunn was assured that methods used by investigators to find the source of leaks from the company's board of directors were legal, she told a U.S. Congress subcommittee Thursday.

Free IT resource Hear how top CIOs turn change into a competitive advantage. Sponsored by HP Free IT resource Try Sun servers, workstations and storage products free for 60-days. Sponsored by Sun Microsystems DISCUSSION Talk back about the privacy and legal implications of HP's investigative techniques.

Dunn also told lawmakers she believed any investigative techniques used during the 2006 portion of the investigation had to be approved by HP President and Chief Executive Officer Mark Hurd.

Hurd told lawmakers he did not know the methods of an internal HP team investigating the board leaks. He did not read a March report from the team describing its use of pretexting, a practice in which someone poses as a customer in order to gain access to personal records such as telephone logs.

"I pick my spots when I dive for details," he said. "This [investigation] was not a priority for me."

Dunn trusted HP employees and lawyers who told her the investigation complied with HP's high standards of conduct, she told the Oversight and Investigations Subcommittee of the House Energy and Commerce Committee. HP has disclosed that the year-old investigation included pretexting to gain the personal records of reporters, HP board members and employees.

When questions about the investigative techniques surfaced recently, Dunn passed concerns about the investigation's techniques to Hurd, she said. Before then, HP's internal lawyers assured her the investigative techniques were being done "legally and properly," she said.

"I deeply regret that so many people, including myself, were let down" by trusted HP advisors, she said.

Dunn, who was forced to resign Sept. 21, told lawmakers she authorized the investigation but did not oversee its operation. That task fell to the HP legal team, and two of its members declined to testify. "At no time in the investigation did I authorize its methods," Dunn said. "I asked this to be done in the HP standard way."

But lawmakers pointed to three documents, including the handwritten notes of former HP general counsel Ann Baskins, saying Dunn was told of pretexting methods as early as June 2005. Dunn said she was unaware that investigators were misrepresenting themselves in order to get personal records until July of this year.

Dunn said she doesn't remember the June 2005 conversation referenced in Baskins' note. "I had no reason to think anything illegal was going on," she said. "I had batteries of experts telling me that wasn't the case."

Representative Cliff Stearns, a Florida Republican, asked Dunn if she should take any blame for the questionable investigatory methods. "If I knew then what I know now, I would have done things differently," she said.

Stearns asked again if she had any culpability. "I do not accept personal responsibility for what happened," Dunn answered.

With HP officials telling her the investigation methods were legal, Dunn said she had no ethical concerns, she said. "I believed these [investigations] may be in fact quite common, not just at Hewlett-Packard, but at companies across the country," she said.

HP security investigator Fred Adler said he was not aware of any other times when HP has used pretexting, but he believes the HP has used e-mail tracing technology a "dozen to two dozen" times for internal investigation in the three years he's worked there.

Some subcommittee members said Congress needs to pass a new law making clear that the practice of pretexting is illegal. But several lawmakers suggested the practice is already illegal under a handful of federal laws as well as a California law prohibiting the use of false information to get customer information from utilities.