The unfolding controversy over spying on board members and journalists at Hewlett-Packard has cast an uncomfortable light on the shady world of corporate leak investigations.
People familiar with the industry say that the tactics employed by investigators hired by HP’s board — who impersonated company directors and members of the media in order to obtain their personal telephone records — were unusual, even in an environment where companies are increasingly turning to investigators to uncover leaks.
Rodgin Cohen, chairman of Sullivan Cromwell and a leading banking industry lawyer, says the use of such practices in an investigation against members of a corporate board would be “beyond extraordinary”.
HP disclosed in an SEC filing last week that its investigators had used “pretexting”, the act of impersonating a person in order to gain access to sensitive information, in order to identify a board member suspected of leaking to the media.
Mr Cohen says that suspected leaks by members of a company’s board pose a special problem for companies.
“It’s an extremely difficult situation,” he says. While leaking sensitive information may violate a company’s internal policies, such secrecy is not enshrined in law and companies that set out to clamp down on leaks must take special precautions when launching any investigation.
Mr Cohen, a veteran of several big banking mergers who has overseen several leak investigations, says there is “a problem of uncovering the leak without creating an even worse upheaval than the leak itself”. Because of the sensitivity involved, the way investigations of a board member are conducted must be carefully considered and controlled.
Patricia Dunn, HP’s chairman, said last week that she had not asked detailed questions about the techniques used by the private investigators she hired to pinpoint the company’s errant board member, because she herself was a subject of the leak investigation. Ms Dunn said she had relied on assurances that the investigators’ techniques were above board.
Security experts who conduct such investigations say they must walk a fine line to balance companies’ demands for information against legal restrictions on how they can gather sensitive data.
One investigations specialist says, “we get asked a lot by fairly senior executives and lawyers who [want to access] private records and bank accounts.”
But the concern that evidence obtained through legally-dubious methods could endanger court cases is enough to keep most private investigators out of trouble, says Sean Walsh, past president of the California Association of Licensed Investigators.