Feeds

HP phone log black op tapped nine reporters

Hurd silent on growing scandal

Top three mobile application threats

HP's spy fiasco went from bad to catastrophic yesterday, as the company admitted to having tapped the phone logs of nine reporters.

So far, two reporters from CNET and one from the Wall Street Journal have disclosed that their phone records were obtained by the company HP hired for its investigation into boardroom leaks.

Six other reporters were also probed, according to HP spokesman Ryan Donovan.

The California Attorney General's office has been notified of the journalists' involvement and is continuing to dig into the nature the spy operation via its own investigation.

"We believe that crimes have been committed," said Tom Dressler, a spokesman for the AG's office, in an interview with The Register.

HP has admitted to hiring a company to investigate which members of its board leaked information to reporters about the company's planning sessions. The hired investigators then tapped the services of another as of yet unnamed firm that employed a technique known as pretexting to gain access to the personal phone logs of both HP's directors and reporters. The firm's staff used personal information such as the directors' and reporters' Social Security numbers to trick phone companies into releasing the phone records.

Chairman Patricia Dunn okayed the internal investigation, but HP maintains that it told partners not to do anything illegal as part of the probe.

Pretexting is only considered a crime under federal law when it's used to obtain information from financial institutions. California, however, is considering charging those involved with the pretexting operation as violating three state statutes. Two of the statutes deal with unauthorised access to computer data and wrongfully copying the data, while a third covers the unauthorised access to personal identifiers such as Social Security numbers.

Those involved in the operation and found guilty under California law could face felony charges and three years in prison, Dressler said. The AG's office hopes to complete its investigation within "a couple of months".

Earlier this week, HP said that board member George Keyworth will not be put up for reelection, after outing him as the leaker. In addition, former board member Tom Perkins revealed that he quit HP's board in disgust after having learned of the secret spy operation.

"My history with the Hewlett-Packard Company is long and I have been privileged to count both founders as close friends. I consider HP to be an icon of Silicon Valley, and one of the great companies of the world. It now needs, urgently, to correct its course," Perkins said in a letter to HP.

HP has refused to disclose whether CEO Mark Hurd's phone records were tapped as part of its investigation. In addition, the company will not say how much Hurd knew about the internal probe. The CEO has failed to issue any statement on this matter, which has tarnished the company's reputation in the wake of solid recent financial reports.

One sideshow of note to this affair involves Verizon vice chairman Lawrence Babbio. It's suspected that Babbio, as one of HP's board members, had his phone records tapped. Verizon has been an outspoken critique of the pretexting practice and sought legal action against firms that use the technique.

A Verizon spokesman declined to comment on the HP situation.

Such silence has become all too common in the HP debacle. It's inexcusable at this point for Hurd not to deal publicly with the situation and for Dunn to stay on as chairman of the company.

HP, of course, had every right to make sure its directors were keeping proprietary information secret. At the moment, however, we know only that Dunn was upset about a CNET report where a director revealed he was tired after a planning session and admitted in January that HP hoped to sell a lot of computers based on AMD's chips. The directors' ages and a glance at HP's product line would confirm just as much. To conduct a secret witch hunt for such minor leaks was tragic form.

Even worse is HP's "we said not to do anything illegal" defense. Apparently, the company thought its highly paid investigators would use ESP to discover the leaker's identity. If HP is sticking with that defense, it should issue a clear timeline about who knew what when about the nature of the investigation.

Also curious was HP's decision to admit to spying on its directors in a filing this week with the US Securities and Exchange Commission, while failing to disclose the snooping on reporters. We can only assume the nine reporters will team to file a class-action lawsuit against HP and its partners, making briefings about new PCs rather awkward. ®

3 Big data security analytics techniques

More from The Register

next story
Dropbox defends fantastically badly timed Condoleezza Rice appointment
'Nothing is going to change with Dr. Rice's appointment,' file sharer promises
Audio fans, prepare yourself for the Second Coming ... of Blu-ray
High Fidelity Pure Audio – is this what your ears have been waiting for?
Zucker punched: Google gobbles Facebook-wooed Titan Aerospace
Up, up and away in my beautiful balloon flying broadband-bot
Ex–Apple CEO John Sculley: Ousting Steve Jobs 'was a mistake'
Twenty-nine years later, post-Pepsi exec has flat-forehead moment
Apple DOMINATES the Valley, rakes in more profit than Google, HP, Intel, Cisco COMBINED
Cook & Co. also pay more taxes than those four worthies PLUS eBay and Oracle
Number crunching suggests Yahoo! US is worth less than nothing
China and Japan holdings worth more than entire company
Intel sees 'signs of improvement in the PC business' but earnings remain 'Meh...'
Prospects for the future, however, please Wall Street money men
prev story

Whitepapers

SANS - Survey on application security programs
In this whitepaper learn about the state of application security programs and practices of 488 surveyed respondents, and discover how mature and effective these programs are.
Combat fraud and increase customer satisfaction
Based on their experience using HP ArcSight Enterprise Security Manager for IT security operations, Finansbank moved to HP ArcSight ESM for fraud management.
The benefits of software based PBX
Why you should break free from your proprietary PBX and how to leverage your existing server hardware.
Top three mobile application threats
Learn about three of the top mobile application security threats facing businesses today and recommendations on how to mitigate the risk.
3 Big data security analytics techniques
Applying these Big Data security analytics techniques can help you make your business safer by detecting attacks early, before significant damage is done.