The aftereffects of the Hewlett-Packard scandal

By Erin Zureick

In the fast-paced world of Silicon Valley, secrecy matters. Innovations are created constantly, and keeping the competition in the dark can be the difference between profits and losses for many tech companies.

So maybe it’s not surprising that when leaks to the press began to surface at computing giant Hewlett-Packard Co. in 2005, top executives wanted to quash the chatter from its board members. But the lengths the company took to identify the leak’s source were surprising. HP, once reputed for its integrity, came under fire in September 2006 for its unsavory surveillance methods of journalists.

In the aftermath of the HP spying scandal, there’s been a lot of reflection and calls for change. Top members of the HP board of directors stepped down, including Patricia Dunn, the board chairwoman who authorized the investigation. The U.S. Congress passed a bill making it illegal to obtain a person’s phone records without permission, otherwise known as pretexting. Multiple lawsuits are underway.

But self-scrutiny has largely been absent from the media corporations that relied on anonymous sources for the stories that drew HP’s ire. And while the use of anonymous sources won’t be going away anytime soon, some say that the biggest effect the scandal has had on business journalists has been to stymie corporate board members willing to talk off the record.

“We’re sort of the victims here,” said John Markoff, a business and technology reporter for The New York Times who was targeted as part of HP’s spy operation.

Markoff, who reports out of the Times’ San Francisco bureau, is familiar with the personal fallout of operations such as HP’s. In the 1990s computer pirate Kevin Mitnick illegally gained access to his e-mails.

“This wasn’t the first time it happened to me,” Markoff said. “I kind of just shook my head.”

The birth of a spy scandal

HP, based in Palo Alto, Calif., was founded in 1939 by Bill Hewlett and Dave Packard, who were classmates at Stanford University. Its first product was the resistance-capacitance audio oscillator — ordered by Walt Disney Co.

Today HP operates in more than 170 countries and is ranked 14th on Fortune magazine’s Fortune 500. Before the spy scandal came to light, the company also was known in the industry for its integrity.

“I didn't understand why a company would be so paranoid that it would do something like that,” said Robert Mullins, a San Francisco-based correspondent for IDG News Service in an e-mail.

“HP has a storied reputation in Silicon Valley for integrity,” added Mullins, who covers HP for IDG, which supplies news to publications such as InfoWorld and Computerworld.

“This didn't jibe with that.”

Leaks first surfaced as a problem early in 2005 under the leadership of former HP CEO and chairwoman Carly Fiorina. Fiorina, who was one of the most visible female CEOs at the time, saw several damaging leaks prior to her February 2005 firing.

Dunn was appointed chairwoman of the board, and one of her objectives was to find out who was providing the press with the secret information. In January 2006 another article appeared, citing an anonymous source who gave details about the company’s annual retreat.

Although the contents of the leak were judged relevantly benign, Dunn and other board members wanted to get to the bottom of it. Dunn went to Security Outsourcing Solutions, based in Needham, Mass., to investigate the leaks, which now had resulted in stories appearing in publications such as the Wall Street Journal and CNet, a technology Web site.

Named Kona I and Kona II — after Dunn’s Hawaiian vacation home — the inquiries used unscrupulous tactics such as e-mail and phone surveillance, as well as “pre-trash inspections.”

Several months later, the investigation uncovered that George Keyworth, a nuclear physicist and powerful board member, was the source. But the illicit tactics HP had used only became known in September 2006 after another board member, venture capitalist Thomas Perkins, who had resigned upon the disclosure of the investigation’s methods, went public.

Maintaining anonymity

Leaks to the press are discouraged in the business world. They can take away from a company’s ability to craft a unified message, and they can create an image of a business that isn’t in control of its key players.

“In the case of Hewlett-Packard, there was total dysfunction on that board,” said Chuck ReCorr, executive director of the Research Triangle Park chapter of the National Association of Corporate Directors.

ReCorr said that directors on most corporate boards are discouraged from speaking with reporters and that leaks ultimately can undermine the company. He said this general rule hasn’t changed since the HP spying scandal.

“You have to be very couched in your communications with everyone — not just the media,” he said.

But in the wake of the HP spying incident, most journalists haven’t noticed a chilling effect on anonymous sources, partially because most of the publications have established policies for using anonymous sources. Most publications haven’t moved to make changes to these policies.

“I think most reporters have an understanding with their sources about how the relationship works,” Mullins said.

“I think the HP incident was an anomaly and that it would be unlikely that other companies would do the same to reporters,” he said. “They've certainly been put on notice by the negative publicity HP suffered as a result of its actions.”

And leaks still can be a valuable source of information for the press and public.

Herb Greenberg, a senior columnist for Marketwatch.com and a contributor to CNBC who says he was spied on by Allied Capital Corp. and was the victim of pretexting when his Verizon Wireless records were tapped illegally, said he always works under the assumption that someone could be listening to his phone conversations or monitoring his call records.

“I believe it’s important, as someone who follows stocks and companies, to find out why people are taking the other side of the trade,” Greenberg said. “The only way to find out is to get the information by not identifying the source. In the end, it’s up to the reporter to confirm the data, which … is often buried in some financial document.”

Although Allied Capital has not admitted that it used pretexting, unlike HP, many of the alleged motives were the same — trying to uncover the source of anonymous information.

Markoff said the Times already has an extensive anonymous source policy that requires reporters to describe who the person is, their intentions and why they want to remain off the record, among other things.

He said that while journalist must be careful about the motives of leakers, the practice is “a necessary evil.”

“You have to rely on anonymous sources (in some cases),” he said. “I think it’s still valuable to the reader.”

Mullins said that IDG has a policy that looks at each case individually.

“I would use an anonymous source if I felt their information was crucial to the story, they had specific reasons for being anonymous and there was no other way to get the information,” Mullins said.

“I also think readers should be wary of a story with too many anonymous sources as it can be more suspect than if people were on the record.”

IDG has not changed its policy as a result of the spying incident.

“Facetiously, we felt it would have been an honor for a company to be so worried about your coverage that they'd spy on you,” Mullins said. “It's like making it onto Nixon's Enemies List."

ReCorr said directors must try to settle any disputes within the boardroom and must have a communication plan of who will talk to the media for the board and what they will be willing to address.

“I think the media is going to ask questions of the board that are corporate-executive related and not board related,” he said. “As long as your questions revolve around the strategic vision of the company and the succession plan. … Anything past that, I’m not going to be able to talk about.”

Leaks such as HP’s can occur when a director doesn’t feel like his or her opinion is getting through in the traditional board setting, Recorr said, adding that this is never the appropriate avenue because it can damage a shareholder’s earnings.

“The stock lost value, not because of the functionality of the company, but because of the uncertainty of what’s going on.”

An industry’s response

The revelation of the scope of HP’s spy operation has brought pretexting to the forefront of the nation’s vocabulary and provoked the outrage of media outlets and legislators alike.

HP issued personal apologies to those it targeted, including nine journalists, and gave briefings on what the security company had uncovered. But the journalists have said that they walked away from the meetings with few new details. The company has said that security firms it employed aren’t cooperating.

Wall Street Journal reporter Pui-Wing Tam, who was one of the targeted journalists, wrote in an October 2006 WSJ article that many of her questions have gone unanswered.

“How did HP’s agents get my phone number in the first place?” wrote Tam, who declined comment for this story. “When did they review videotaped footage of me? Did their gumshoes park their cars outside my house at night?”

Markoff, who was unsuccessfully pretexted because he already had set up an online account for his cellphone, said affected media organizations have reacted in different ways. According to Times’ policy, Markoff cannot sue HP separately from the newspaper.

But Markoff’s wife, Leslie, who was successfully pretexted, could be a different case, although the publication still is trying to determine how and if the policy pertains to Leslie Markoff.

“We’re in this interesting situation,” John Markoff said.

Other media sources, such as CNet, have been more vigorous about pursuing litigation. The Times reported on May 7 that three CNet journalists, Dawn Kawamoto, Stephen Shankland and Tom Krazit, planned to sue HP for invasion of privacy.

CNet still is considering how to proceed, but the decision by the journalists to sue separately from their company is an unconventional one. Krazit and Kawamoto declined comment for this story.

Seven of the nine affected journalists originally banded together to discuss how to proceed. But the three CNet reporters parted ways with the group. The other four —Markoff and three BusinessWeek reporters — are represented by the New York Times Co., according to the Times.

Many media companies forgo seeking compensation to prevent the appearance of exchanging stories for settlements.

None of the journalists seeking legal action cover HP as their primary beat, though some of their stories sometimes touch on the company.

Markoff said he continues to write technology-related stories but is prohibited from writing about the legal actions and problems the HP has faced after the scandal.

“It hasn’t really changed my behavior in any significant way,” Markoff said.

A changing field

A complicating factor in the HP case is the changing face of technology and how reporters utilize different ways of contacting their sources.

Technology such as cellphones and instant messaging make reporters and sources available practically 24-7, which can help blur the line between source and social relations and contribute to lazy journalism.

Greenberg and Markoff said making contact through methods such as e-mail and IM are becoming commonplace. But the flip side is that these contact methods are less personal and much easier to trace by persistent companies or individuals.

For example, Tam’s instant messages to a public relations representative at HP were monitored. While the messages were standard exchanges between a reporter and a PR person, many journalists still are grappling with when they’re appropriate versus when a call is more effective.

“The upside, it’s hard to misquote somebody,” Greenberg said. “The downside, you can’t ask follow-up questions. I’ve actually started pushing hard for phone interviews.”

Lessons learned, legislation enacted

Some of the biggest changes in the past year have come from within HP. While Dunn resigned, CEO Mark Hurd, who also knew of the spying, is still in charge. Internal changes have come in the form of a new position — a chief ethics and compliance officer.

“It's not clear how much responsibility the CE & CO officer will have, and if they "get a seat at the table,” said Alex Koritz, public relations director for Sprout Marketing in Utah. “HP also was quite delayed in their response, which breaks the No. 1 rule of crises management, get information out fast and accurately so you can help ‘guide’ the story.”

Koritz said one of HP’s main mistakes was how PR people, who are supposed to serve as gatekeepers to those in power, handled the situation.

“Public relations should have been front and center in the decision-making process,” he said.

The potential impact of legislation that President Bush signed in January, which outlawed pretexting, also is up for debate. The U.S. Department of Justice will be charged with prosecuting any future violations.

Greenberg, Markoff and Mullins said that while the legislation might help curb the problem, it’s far from a cure-all.

“If someone wants to steal your phone records, they’re going to steal your phone records,” Greenberg said. “It just shows how nasty this business and corporate America can get — and how delicate things can get when you’re dealing with money.”

Erin Zureick is a business journalism student at the University of North Carolina at Chapel Hill.

Posted May 15, 2007