Feeds

HP phone log black op tapped nine reporters

Hurd silent on growing scandal

Internet Security Threat Report 2014

HP's spy fiasco went from bad to catastrophic yesterday, as the company admitted to having tapped the phone logs of nine reporters.

So far, two reporters from CNET and one from the Wall Street Journal have disclosed that their phone records were obtained by the company HP hired for its investigation into boardroom leaks.

Six other reporters were also probed, according to HP spokesman Ryan Donovan.

The California Attorney General's office has been notified of the journalists' involvement and is continuing to dig into the nature the spy operation via its own investigation.

"We believe that crimes have been committed," said Tom Dressler, a spokesman for the AG's office, in an interview with The Register.

HP has admitted to hiring a company to investigate which members of its board leaked information to reporters about the company's planning sessions. The hired investigators then tapped the services of another as of yet unnamed firm that employed a technique known as pretexting to gain access to the personal phone logs of both HP's directors and reporters. The firm's staff used personal information such as the directors' and reporters' Social Security numbers to trick phone companies into releasing the phone records.

Chairman Patricia Dunn okayed the internal investigation, but HP maintains that it told partners not to do anything illegal as part of the probe.

Pretexting is only considered a crime under federal law when it's used to obtain information from financial institutions. California, however, is considering charging those involved with the pretexting operation as violating three state statutes. Two of the statutes deal with unauthorised access to computer data and wrongfully copying the data, while a third covers the unauthorised access to personal identifiers such as Social Security numbers.

Those involved in the operation and found guilty under California law could face felony charges and three years in prison, Dressler said. The AG's office hopes to complete its investigation within "a couple of months".

Earlier this week, HP said that board member George Keyworth will not be put up for reelection, after outing him as the leaker. In addition, former board member Tom Perkins revealed that he quit HP's board in disgust after having learned of the secret spy operation.

"My history with the Hewlett-Packard Company is long and I have been privileged to count both founders as close friends. I consider HP to be an icon of Silicon Valley, and one of the great companies of the world. It now needs, urgently, to correct its course," Perkins said in a letter to HP.

HP has refused to disclose whether CEO Mark Hurd's phone records were tapped as part of its investigation. In addition, the company will not say how much Hurd knew about the internal probe. The CEO has failed to issue any statement on this matter, which has tarnished the company's reputation in the wake of solid recent financial reports.

One sideshow of note to this affair involves Verizon vice chairman Lawrence Babbio. It's suspected that Babbio, as one of HP's board members, had his phone records tapped. Verizon has been an outspoken critique of the pretexting practice and sought legal action against firms that use the technique.

A Verizon spokesman declined to comment on the HP situation.

Such silence has become all too common in the HP debacle. It's inexcusable at this point for Hurd not to deal publicly with the situation and for Dunn to stay on as chairman of the company.

HP, of course, had every right to make sure its directors were keeping proprietary information secret. At the moment, however, we know only that Dunn was upset about a CNET report where a director revealed he was tired after a planning session and admitted in January that HP hoped to sell a lot of computers based on AMD's chips. The directors' ages and a glance at HP's product line would confirm just as much. To conduct a secret witch hunt for such minor leaks was tragic form.

Even worse is HP's "we said not to do anything illegal" defense. Apparently, the company thought its highly paid investigators would use ESP to discover the leaker's identity. If HP is sticking with that defense, it should issue a clear timeline about who knew what when about the nature of the investigation.

Also curious was HP's decision to admit to spying on its directors in a filing this week with the US Securities and Exchange Commission, while failing to disclose the snooping on reporters. We can only assume the nine reporters will team to file a class-action lawsuit against HP and its partners, making briefings about new PCs rather awkward. ®

Beginner's guide to SSL certificates

More from The Register

next story
WHY did Sunday Mirror stoop to slurping selfies for smut sting?
Tabloid splashes, MP resigns - but there's a BIG copyright issue here
Spies, avert eyes! Tim Berners-Lee demands a UK digital bill of rights
Lobbies tetchy MPs 'to end indiscriminate online surveillance'
How the FLAC do I tell MP3s from lossless audio?
Can you hear the difference? Can anyone?
Inequality increasing? BOLLOCKS! You heard me: 'Screw the 1%'
There's morality and then there's economics ...
Google hits back at 'Dear Rupert' over search dominance claims
Choc Factory sniffs: 'We're not pirate-lovers - also, you publish The Sun'
EU to accuse Ireland of giving Apple an overly peachy tax deal – report
Probe expected to say single-digit rate was unlawful
While you queued for an iPhone 6, Apple's Cook sold shares worth $35m
Right before the stock took a 3.8% dive amid bent and broken mobe drama
prev story

Whitepapers

A strategic approach to identity relationship management
ForgeRock commissioned Forrester to evaluate companies’ IAM practices and requirements when it comes to customer-facing scenarios versus employee-facing ones.
Storage capacity and performance optimization at Mizuno USA
Mizuno USA turn to Tegile storage technology to solve both their SAN and backup issues.
High Performance for All
While HPC is not new, it has traditionally been seen as a specialist area – is it now geared up to meet more mainstream requirements?
Beginner's guide to SSL certificates
De-mystify the technology involved and give you the information you need to make the best decision when considering your online security options.
Security for virtualized datacentres
Legacy security solutions are inefficient due to the architectural differences between physical and virtual environments.