HP leak probe scandal: Dunn steps down

Hoping to slow a growing storm of criticism over a controversial leak probe, HP on Friday said Patricia Dunn would step down immediately as chairman and board member, to be replaced by CEO Mark Hurd.

However, Hurd also confirmed on Friday that he knew about several key phases of the investigation and attended meetings at which the investigation was discussed. Hurd said he was emailed a report summarising the probe but that he did not read it.

He said: "I could have, and I should have." At the same time, Hurd said the investigation was necessary. "I feel strongly that leaks hurt the company's reputation and its ability to operate effectively. It was the responsibility of the HP chairman to pursue the leak situation."

Attorney Michael J Holston, a partner at the law firm Morgan, Lewis & Bockius, said the report "outlined the source of the leaking and outlined the investigative techniques involved - including pretexting". In addition to being sent to Hurd, it was also sent to Dunn and HP general counsel Ann Baskins, according to Holston.

The press conference, in which questions from the press were not permitted, comes ahead of a congressional committee hearing next week. Meanwhile, the California attorney general and federal authorities are pursuing criminal investigations.

On Friday, Hurd gave more details about his knowledge of the boardroom leak probe and said he hired law firm Morgan Lewis earlier this month to investigate the matter.

Hurd said: "I believe we have now a substantial set of the facts. I will also say that some of the findings that Morgan Lewis has uncovered are very disturbing to me."

Holston detailed the involvement of several other HP employees in the leak probe, including Baskins. And he confirmed many elements of the investigation's time line, which had two phases, as well as the outside businesses - including investigation company Security Outsourcing Solutions - that were involved.

Morgan Lewis has collected more than one million pages of documents, according to Holston. He said the company has reviewed "many of those pages". "We are committed to reviewing the remaining documents as fast as we are able," he added.

He promised a further inquiry into the matter. "Our investigation is not complete. There is still more work to be done," he said.

Hurd emphasised that it's a complicated situation, that keeps getting more complex. "As of today, we still do not have all of the facts," he said. "I also cannot guarantee that we will ever be able to obtain all of the information regarding this investigation. This is due to its complexity, the number of people involved, with many of them outside the company."

HP said that the investigation had two phases. The first phase, dubbed Kona I, stretched from early 2005 to late summer 2005 and the second, called Kona II, began in January 2006, when silicon.com sister site CNET News.com published a story that reported on an HP board meeting, Holston said.

But there is still some confusion around the timeline of HP's investigation.

Kona I may have concluded by late summer 2005 but HP apparently kept looking for leaks. In January 2006, HP's investigative contractor, Security Outsourcing Solutions (SOS), had an investigator keep an eye on an offsite board meeting to "determine if any journalists were seen at or around the site", said Holston.

He also said after CNET News.com wrote its 23 January article detailing that board meeting, the leak hunt resumed. But government investigators have told two CNET News.com reporters that their personal phone records were accessed the week before that story was published.

In fact, CNET News.com reporter Tom Krazit was told his phone records were accessed on 20 January, the same day he contacted Robert Sherbin, HP's vice president of external communications, for comment in advance of the story. Sherbin told CNET News.com he had been asked to alert other HP officials of potential leaks but did not remember who he contacted about his discussion with Krazit. Reporter Dawn Kawamoto was told by government investigators her phone records were first accessed on 17 January.

Holston said the first investigation was inconclusive, while the second probe did uncover the source of the leaks. "During the course of Kona II, certain members of the investigation team provided assurances that the techniques being used in the investigation were legal," Holston said.

He added: "The investigation included tactics that ranged from the review of HP's internal emails and instant messages, to the physical surveillance of an HP board member and at least one journalist, to the pretexting of telephone call information of board members, HP employees and journalists."

While these tactics had already become public, Holston also disclosed for the first time on Friday that investigators may have gone through people's rubbish in February 2006, though the company would not say whose bins may have been accessed.

In the second phase of its investigation, HP also sent CNET News.com reporter Dawn Kawamoto a bogus email tip that included an electronic tracer designed to reveal the IP address of anyone who received a forwarded copy of the email.

Although the journalist corresponded with the fake informant, "the investigation team never received any confirmation that the tracer was activated," Holston said.

Hurd said he approved the sending of a bogus tip but did not approve the use of the tracking technology. "I was asked to and did approve the naming convention that was used in the content of the email," he said. "I do not recall seeing, nor do I recall approving, the use of tracer technology." Holston said the Morgan Lewis inquiry also found no evidence Hurd was asked to approve use of the tracer.

On other surveillance methods, Holston said the Morgan Lewis investigation does not show any indication that computer keystrokes were tracked. Also, while a PowerPoint presentation detailing the investigation does discuss potential "undercover operations" at the San Francisco offices of the Wall Street Journal and CNET Networks, there is nothing that shows this actually occurred, he said.

As for the physical surveillance, Holston said investigators staked out a January board meeting to see if any journalists were nearby. Also, an investigator followed an HP board member on a trip to a conference in Colorado in early 2006 and observed him, his spouse and possibly other family members at his California home.

In February 2006, investigators watched a journalist at her residence, Holston said. In all cases the surveillance was done by SOS, Holston said.

During the investigation, HP or its investigators also obtained Social Security numbers of four reporters, three board members and one employee, Holston said. The identifying numbers, typically considered confidential, were used for the purpose of getting their phone records.

Holston also said HP is "not currently aware of any investigation into leaks continuing after 18 May, 2006."

Dunn isn't the only person to leave HP. Kevin Hunsaker, senior counsel and HP ethics director, and Anthony Gentilucci, an HP global investigations manager in Boston, are in the process of leaving the company, according to sources familiar with the matter. Those departures may not be the last related to the matter, a source said.

Board member Richard Hackborn was named lead independent director. In addition, HP has hired Bart Schwartz, a former US prosecutor, as counsel to perform a "forward-looking and independent" review of HP's investigative methods and the company's standard of business conduct processes, Hurd said. "This will ensure we have the appropriate level of rigour and discipline so we can be assured that this type of situation can never happen again," he added.

Despite acknowledging some involvement, Hurd pledged to further investigate the matter and attempt to "take full accountability" to set things right. "Our job is to fix this and get back to the job of running a business," he said.

Ina Fried writes for CNET News.com