"How HP raped my privacy and Patricia Dunn sent me an e-mail apology"

I'll admit to blatant plagarism in the title of this post, but when you need to verbally kick somebody's ass, Mary-N-Texas is hard to beat. And when you read Pui-wing Tam's story in Thursday's Wall Street Journal ("A Reporter's Story:How H-P Kept Tabs On Me for a Year"), you'll realize that the Hewlett Packard folks, and their lawyers, need a serious ass kicking. (Unfortunately, you need a WSJ subscription to read the link.)

Ms. Tam is a WSJ reporter who covered HP until last year. As I've mentioned in previous posts (here, here, and here), HP undertook an investigation of its directors after someone on the board apparently leaked board strategy talks to reporters. This investigation crossed the line when the investigative firm used pretexting in order to obtain telephone and other records of the board members to see who they were talking to. This was bad enough. What we now know is that this investigative firm also used pretexting and internet viruses to obtain telephone, email and IM records from a number of reporters as well.

Now Tam reveals that HP's investors also engaged in dumpster diving, among other tawdry investigative techniques:

The trash study was carried out in January by Security Outsourcing Solutions Inc., a Needham, Mass., investigative firm that H-P employed, according to a briefing H-P officials gave me yesterday. Whether the sleuths ever encountered my toddler's dirty diapers, H-P said it doesn't know.

I learned this -- and more -- as I sat in a conference room at H-P's outside law firm yesterday in San Francisco, where attorney John Schultz ran through a litany of snooping tactics H-P's agents used against me as part of its effort to identify which of its directors might be leaking news to the press. For around a year, Mr. Schultz told me, H-P collected information about me. H-P's investigators tried at least five times, he said, to get access to my home-phone, cellphone and office-phone records. In several instances, they succeeded: H-P now has lists of calls I made to people such as my editors, my husband, my insurance company and a reporting source employed by one H-P rival.

H-P's agents had my photo and reviewed videotaped footage of me, said Mr. Schultz, of the law firm of Morgan, Lewis & Bockius. They conducted "surveillance" by looking for me at certain events to see if I would show up to meet an H-P director. (I didn't.) They also carried out "pre-trash inspections" at my suburban home early this year, Mr. Schultz said.

Mr. Schultz was carrying out a public promise by H-P Chief Executive Mark Hurd, who pledged before Congress last month that he would give investigation details to the targets of H-P's snooping. The company told me, in an email, that I would receive "a complete accounting of the information that H-P gathered about you and exactly what methods were used to collect it."

...

Many details of what H-P had done in my case I had already gleaned from some now-public investigation documents. According to those documents, H-P built up information on my husband, including where we got engaged and married. H-P sleuths reviewed voicemails I'd left for an H-P director, and got a description of my car. They read my instant messages to an H-P media-relations executive. According to the California attorney general, H-P's investigators also used the last four digits of my Social Security number to impersonate me in order to obtain my phone records, a technique known as "pretexting."

H-P's lawyer shed no new light on these details, but one thing's increasingly clear: H-P went to some truly strange lengths to dig up personal details.

The nature of the information that Tam knows was provided to the board makes it pretty clear that Patricia Dunn at least had reason to suspect that not all of these techniques were legitimate or legal.

At first, I thought the company had simply accessed a month's worth of my phone records. But I grew more concerned as the scope of H-P's tactics became clearer. I learned from documents released to Congress last month -- but not by Mr. Schultz yesterday -- that H-P's investigative team unearthed factoids about myself that I never knew. In one PowerPoint slide prepared for Ms. Dunn, H-P's team noted that I live precisely two miles away from former H-P director Mr. Keyworth. In another slide that mapped out -- like a spider's web -- Mr. Keyworth's relationships with the press and others, I learned that my real-estate agent, Mavis Delacroix, had once worked with his wife.
...

By July 2005, H-P had compiled background on many of its subjects, including me, according to documents released by Congress last month. In an investigation summary, H-P listed my educational background, the date I joined The Wall Street Journal, and information about my husband. The document also notes that I made 78 phone calls from my cellphone between April 16, 2005, and June 16, 2005. "An analysis of the subscribers of the 78 numbers is in progress," the document says.
That 2005 analysis, which H-P's lawyer wasn't able to provide me, probably yielded nothing more than a portrait of frenzied planning for my sisters' weddings. At the time, my family had just finished the wedding preparations for one of my sisters and we were busy organizing a bridal shower for my other sister. That meant frequent phone calls to and from my mother.

Still, H-P's investigative team compiled information on me. In November 2005, one of H-P's then directors turned over voicemail messages I'd left him earlier that year, according to an email from H-P's investigative team. That gave the company a record of my voice, which was stored away. Mr. Schultz, H-P's outside lawyer, told me yesterday that such records were collected to provide "context," in an attempt to link me to a source of the leaks.

H-P's probe ramped up again in January, after articles ran in The Wall Street Journal about H-P's talks to acquire technology outsourcing and consulting firm Computer Sciences Corp. and after an article appeared on CNET about a board of directors' retreat that same month. By late January, the second phase of the company's investigation -- known as Kona II -- was in full swing. (The investigations were dubbed Kona by Ms. Dunn, who named the probes after the location of her Hawaiian vacation home.)

That was when some of H-P's creepiest incursions on me occurred. On Jan. 30, Security Outsourcing Solutions reported that a "pre-trash inspection survey is in progress for the Tam residence," according to a document Mr. Schultz gave me yesterday. But there was more to the story: H-P investigation documents that Mr. Schultz didn't provide me reveal that in early February H-P's investigators also conducted "pre-surveillance reconnaissance" on directors and several journalists, including me.

...

H-P didn't just plan to infiltrate my neighborhood, however. According to the documents released by Congress, in one PowerPoint slide from February -- which was, again, missing from Mr. Schultz's briefing yesterday -- H-P investigators proposed sending in their team to pose as cleaning crew members or clerical staff in The Wall Street Journal's and CNET's San Francisco offices. Mr. Schultz said that as far as he knows, "that was never done."

By mid-February 2006, H-P had obtained my cellphone records for mid-December 2005 through mid-January 2006, Mr. Schultz told me. H-P's investigators later accessed my cellphone records for February and my home-phone records for January and February, he said.

H-P now had printouts of names and numbers of people I called. From these records, copies of which Mr. Schultz gave me, H-P discovered that of the 25 calls I made from my cellphone between mid-December and mid-January, I called home 20 times. In other records, H-P's investigators highlighted calls I made to current and former H-P executives, as well as calls I was making to my editors in San Francisco and New York. Twice, H-P saw that I called my insurance company. They saw that I often called my sister.

Among the calls H-P's investigators saw were those I made to sources for other stories I was reporting for the Journal -- including sources at H-P competitors. One call was to Marlene Somsak, a former H-P media-relations executive who now works at H-P competitor Palm Inc. H-P's phone records list Ms. Somsak's name and address. Ms. Somsak declined to comment. The list provided by Mr. Schultz also shows reporting calls I made to Lucasfilm Ltd. and the San Francisco Police Department. A spokeswoman for Lucasfilm declined to comment.

H-P's briefing of its spying on me is mum about other events around February 2006. Mr. Schultz had no information, for example, on how the H-P investigative team handed out a photo of me and a description of my car to their surveillance teams -- something that a congressional subcommittee has now made public. It's unclear where they got the information. H-P began researching my husband and whether he had any relationships with H-P directors and others -- work that was "90% complete" at the time, according to a note in a February document.

Also missing from Mr. Schultz's briefing was H-P's snooping on my instant messaging. In February, H-P's investigative team focused on my communications with one of their own media-relations executives, Mike Moeller, whom I frequently talked to as part of our jobs. That was when they accessed our instant messages, which generally included witty repartee such as the following transcript that H-P had in its files: Me: Nice results (for H-P's financial quarter). Mr. Moeller: Real nice. Nice guidance. Me: Yup.

Tam mentions HP's classy touch at the end:

Since then, H-P officials have apologized repeatedly for the investigations. Mr. Hurd apologized in a news conference and before Congress. Ms. Dunn emailed all nine journalists who were under scrutiny a similar apology. (In the copy she sent me, my name was written in a different font from the rest of the message.)

I find all of this mind-boggling. You don't need to be a lawyer to suspect that any investigative firm providing the information that Security Outsourcing Solutions Inc. was making Powerpoint slides of may have crossed into illegal territory. (Though maybe you do have to be a lawyer to imagine a scenario where collecting this kind of information on reporters wouldn't be considered illegal.) But it's the clear lack of judgment that gets me. It doesn't matter how much damage a leaky board member can cause a company -- it can' t possibly be as bad as having your chairman indicted, and a shadow cast on your CEO that he or she might be next.

And a word of wisdom to John Schultz and Morgan, Lewis & Bockius: unless you want to come off looking like Larry Sonsini and Wilson Sonsini Goodrich & Rosati, really really do your homework on this case, particularly before talking to victims who happen to work for very large newspapers.