HP 'was warned over leak probe's legality'

HP's outside law firm told the company in a report last month that investigators' use of Social Security numbers, in a probe into boardroom leaks, "more likely than not violates federal law".

In its 30 August report, Wilson Sonsini Goodrich & Rosati concludes that the use of pretences to obtain phone records, a practice known as "pretexting", was "not generally unlawful" at the time of the investigation. However, the same report notes that "HP subcontractors may have used Social Security numbers [not provided by HP] while pretexting, which more likely than not violates federal law".

HP did not disclose any information about the leak probe until a 6 September Securities and Exchange Commission (SEC) filing, then saying only that its outside counsel had found "that the use of pretexting at the time of the investigation was not generally unlawful (except with respect to financial institutions), but such counsel could not confirm that the techniques employed by the outside consulting firm and the party retained by that firm complied in all respects with applicable law".

An HP representative on Friday declined to comment on the leak investigation or say why it did not mention in a 6 September SEC filing that Wilson Sonsini had warned that the use of Social Security numbers may have been illegal. The 30 August report was part of a batch of documents turned over to the House Energy and Commerce Committee and made public this week.

The company has since said that one of its security workers, Tony Gentilucci, did provide the Social Security number of an HP employee to outside investigators for the purposes of getting his or her phone number. The company also says that its external security companies obtained additional Social Security numbers and cautioned in an SEC filing this week that it has "not yet ascertained what involvement, if any, HP employees had in obtaining and/or transmitting these Social Security numbers".

Use of the Social Security numbers to obtain phone numbers "would more than likely constitute at least a technical violation of statute," Wilson Sonsini said in its report.

Federal and state authorities have launched criminal probes of HP's leak investigation, particularly the unauthorised access of phone records through pretexting. HP has said it targeted the phone records of seven current or former board members, nine reporters, two employees and an unspecified number of others.

In the wake of the scandal, chairman Patricia Dunn and general counsel Ann Baskins have resigned. Gentilucci left the company on Tuesday, as did Kevin Hunsaker, the senior counsel and ethics officer who oversaw the second part of the investigation.

The Wilson Sonsini report said Dunn "acted with the best of intentions" but committed an "error in judgment" by not involving HP legal or outside counsel at the outset of the investigation.

As for CEO Mark Hurd, the firm said he "acted properly in all respects", saying he was given assurances that investigative methods were legal and it was "reasonable for the CEO to rely on these assurances particularly since Mr Hurd was not leading the investigation".

In an interview with Wilson Sonsini, however, Dunn portrays Hurd as being far more involved in the second half of the investigation. "Hurd was outraged," Dunn told lawyers, according to the report. "Hurd and Dunn agreed they would 'tag team' on the investigation."

By contrast, Hurd said in his 25 August interview with Wilson Sonsini, that he let Dunn "run with the ball", according to the firm's notes from the meeting. However, Hurd also said that in one meeting - probably a 22 July, 2005 meeting - somebody mentioned obtaining phone record information off the web. According to Wilson Sonsini's notes of the meeting: "Hurd remembered thinking that there must be a website with such information."

Hurd has said he didn't read a March report that detailed both the results and many of the methods used in the investigation. He told a congressional committee on Thursday: "Not my finest hour."

Dunn also told the lawyers it was "misleading" to think of the investigation in phases. Wilson Sonsini said in its summary of Dunn's testimony: "It was one ongoing investigation." HP has said in SEC filings, among other places, that its investigation was divided into two phases. The first, "Kona I", stretched from early 2005 until late summer of that year, and ended without finding the source of leaks. The company said that a second phase, "Kona 2", began after a 23 January CNET News.com article that detailed a board meeting earlier that month.

However, the company has also said its investigators used physical surveillance at that meeting to see if any reporters were present. The company has refused to say why, if its investigation was not active, the January meeting was watched.

CNET News.com's Greg Sandoval contributed to this report

Ina Fried writes for CNET News.com