Former Hewlett-Packard Chairwoman Patricia Dunn was assured that methods used by investigators to find the source of leaks from the company's board of directors were legal, she told a U.S. Congress subcommittee Thursday.
Dunn also told lawmakers she believed any investigative techniques used during the 2006 portion of the investigation had to be approved by HP President and Chief Executive Officer Mark Hurd.
Hurd told lawmakers he did not know the methods of an internal HP team investigating the board leaks. He did not read a March report from the team describing its use of pretexting, a practice in which someone poses as a customer in order to gain access to personal records such as telephone logs.
"I pick my spots when I dive for details," he said. "This [investigation] was not a priority for me."
Dunn trusted HP employees and lawyers who told her the investigation complied with HP's high standards of conduct, she told the Oversight and Investigations Subcommittee of the House Energy and Commerce Committee. HP has disclosed that the year-old investigation included pretexting to gain the personal records of reporters, HP board members and employees.
When questions about the investigative techniques surfaced recently, Dunn passed concerns about the investigation's techniques to Hurd, she said. Before then, HP's internal lawyers assured her the investigative techniques were being done "legally and properly," she said.
"I deeply regret that so many people, including myself, were let down" by trusted HP advisors, she said.
Dunn, who was forced to resign Sept. 21, told lawmakers she authorized the investigation but did not oversee its operation. That task fell to the HP legal team, and two of its members declined to testify. "At no time in the investigation did I authorize its methods," Dunn said. "I asked this to be done in the HP standard way."
But lawmakers pointed to three documents, including the handwritten notes of former HP general counsel Ann Baskins, saying Dunn was told of pretexting methods as early as June 2005. Dunn said she was unaware that investigators were misrepresenting themselves in order to get personal records until July of this year.
Dunn said she doesn't remember the June 2005 conversation referenced in Baskins' note. "I had no reason to think anything illegal was going on," she said. "I had batteries of experts telling me that wasn't the case."
Representative Cliff Stearns, a Florida Republican, asked Dunn if she should take any blame for the questionable investigatory methods. "If I knew then what I know now, I would have done things differently," she said.
Stearns asked again if she had any culpability. "I do not accept personal responsibility for what happened," Dunn answered.
With HP officials telling her the investigation methods were legal, Dunn said she had no ethical concerns, she said. "I believed these [investigations] may be in fact quite common, not just at Hewlett-Packard, but at companies across the country," she said.
This whitepaper explains the terminology and concepts behind Data Replication technologies and establishes some sizing rules through worked examples. Learn the new paradigm in disaster tolerance—protect data anywhere.
Download now »Server virtualization is a popular option for dealing with mounting datacenter costs. Another equally promising approach is the use of an Application Delivery Controller. Citrix NetScaler provides a low-cost way for organizations to reduce their server count and accrue cost savings from a reduction in space, cooling, power and personnel.
Download now »
The emergence of WLANs has created a new breed of security threats to enterprise networks.
Included in HP ProCurve WLAN solutions is security technology that alleviates threats from WLANs through:
* Monitoring wireless activity inside and out of the enterprise
* Classifying WLAN transmissions into harmful and harmless
* Preventing transmissions that pose a security threat to the enterprise network
* Locating participating devices for physical remediation
Effectively address data protection challenges, implementing solutions that help store and protect businesscritical data while cutting costs and improving efficiency and reliability.
Download now »
Sign up to receive Security Resource Alerts
This white paper provides guidance on how to develop a strategic approach to managing and monitoring logs, a key function required for compliance with many regulatory mandates and a critical defense against security threats.
Download now! »Learn about the processes and technologies that support security information management (SIM) operations, as well as the business case for SIM. The series examines different options for implementing SIM and gives you evaluation criteria for selecting the best option for your organization.
Download now! »Learn the strategies, actions, and capabilities that Best-in-Class organizations employ and technologies they choose to obtain superior performance against various security performance metrics. This report provides guidelines for identifying which security solutions to consume as a MSS and defines best practices for choosing and managing MSSPs.
Download now! »