*NEWS*HOW HP KEPT TABS ON ME FOR A YEAR

[Anonymous]

A Reporter’s Story: How H-P Kept
Tabs on Me for a Year
Firm’s Search for Leak Led Sleuths
to Scope Out Trash, Compile Phone Dossier Organizing a Bridal ShowerBy PUI-WING TAM,
Unbeknownst to my family and me,
someone was scoping out our trash earlier this year — someone hired by
Hewlett-Packard Co.

The trash study was carried out in
January by Security Outsourcing Solutions Inc., a Needham, Mass., investigative
firm that H-P employed, according to a briefing H-P officials gave me
yesterday. Whether the sleuths ever encountered my toddler’s dirty diapers, H-P
said it doesn’t know.I learned this — and more — as I sat in a conference
room at H-P’s outside law firm yesterday in San Francisco, where attorney John
Schultz ran through a litany of snooping tactics H-P’s agents used against me
as part of its effort to identify which of its directors might be leaking news
to the press. For around a year, Mr. Schultz told me, H-P collected information
about me. H-P’s investigators tried at least five times, he said, to get access
to my home-phone, cellphone and office-phone records. In several instances,
they succeeded: H-P now has lists of calls I made to people such as my editors,
my husband, my insurance company and a reporting source employed by one H-P
rival.H-P’s agents had my photo and reviewed videotaped footage of me, said Mr.
Schultz, of the law firm of Morgan, Lewis & Bockius. They conducted
“surveillance” by looking for me at certain events to see if I would
show up to meet an H-P director. (I didn’t.) They also carried out
“pre-trash inspections” at my suburban home early this year, Mr.
Schultz said.Mr. Schultz was carrying out a public promise by H-P Chief
Executive Mark Hurd, who pledged before Congress last month that he would give
investigation details to the targets of H-P’s snooping. The company told me, in
an email, that I would receive “a complete accounting of the information
that H-P gathered about you and exactly what methods were used to collect
it.”But what was surprising were the questions Mr. Schultz left
unanswered: How did H-P’s agents get my phone numbers in the first place? When
did they review videotaped footage of me? Did their gumshoes park their cars
outside my house at night? And what the heck is pre-trash inspection? On that,
Mr. Schultz said: “We just don’t know.” Indeed, there’s a lot H-P
seems not to know — or isn’t telling — about what it did to me. Mr. Schultz
told me H-P can’t yet provide a comprehensive picture because security firms it
contracted with aren’t cooperating with its requests to hand over information
about some of the investigative work.Many details of what H-P had done in my
case I had already gleaned from some now-public investigation documents.
According to those documents, H-P built up information on my husband, including
where we got engaged and married. H-P sleuths reviewed voicemails I’d left for
an H-P director, and got a description of my car. They read my instant messages
to an H-P media-relations executive. According to the California attorney
general, H-P’s investigators also used the last four digits of my Social
Security number to impersonate me in order to obtain my phone records, a
technique known as “pretexting.”H-P’s lawyer shed no new light on
these details, but one thing’s increasingly clear: H-P went to some truly
strange lengths to dig up personal details.The methods H-P used on directors
and journalists like me were “far from standard practice,” says Ann
Keating, vice president at Investigative Group International Inc., a
Washington, D.C., security consulting and investigations firm. Surveillance and
trash inspection in particular, she says, are typically “more tied to
marital cases, such as when someone is trying to find out if his or her spouse
is cheating.”H-P considered these tactics in its leak probes — code-named
Kona and Kona II — which unfolded in two stages, one in 2005 and the other
earlier this year. During the investigations, H-P secretly put its directors,
nine journalists and others under scrutiny. The scandal, which became public
last month, has spurred the departures of three executives and three H-P
directors, including former chairman Patricia Dunn. Earlier this month,
California Attorney General Bill Lockyer filed fraud and conspiracy charges
against Ms. Dunn and four others because of techniques used in the probes. Ms.
Dunn hasn’t yet entered a formal plea.I was a subject of the investigations
because I covered H-P for The Wall Street Journal from 2002 until earlier this
year. The H-P board’s initial inquiry into leaks was prompted by a January 2005
Wall Street Journal article I wrote detailing the board’s unhappiness with then
CEO Carly Fiorina. This angered Ms. Fiorina, who launched the investigation to
determine the source of the information. She was fired in February 2005, but
the company’s probes into leaks didn’t stop there.Ms. Dunn has said my story
and others that came later created a “fundamental distrust” on the
board because it meant someone was speaking to the press when they shouldn’t
have, making a leak investigation “necessary.” H-P recently said that
its initial probe didn’t identify any leakers. The company said a second probe,
done this year, identified one director, George Keyworth, who has since
resigned, as a source for CNET, a technology-news Web site.I suddenly became
aware of H-P’s machinations for the first time on the afternoon of Sept. 6.
While I was working on a story on deadline, an email marked “urgent”
plopped into my inbox. The message’s alarming subject line: “Investigation
r.e. your phone records being illegally accessed.” The email was from an
investigator in the California attorney general’s special-crimes unit, who
called minutes later to tell me my phone records had been obtained by H-P.Over
the next few weeks, information about H-P’s leak investigation emerged in dribs
and drabs. I got an emailed apology from Ms. Dunn, the H-P chairman who
continued the investigation. I often found myself reading about what H-P had
done in press reports.At first, I thought the company had simply accessed a
month’s worth of my phone records.But I grew more concerned as the scope of
H-P’s tactics became clearer. I learned from documents released to Congress
last month — but not by Mr. Schultz yesterday — that H-P’s investigative team
unearthed factoids about myself that I never knew. In one PowerPoint slide
prepared for Ms. Dunn, H-P’s team noted that I live precisely two miles away
from former H-P director Mr. Keyworth. In another slide that mapped out — like
a spider’s web — Mr. Keyworth’s relationships with the press and others, I
learned that my real-estate agent, Mavis Delacroix, had once worked with his
wife. When I called Ms. Delacroix to tell her that her name had popped up in
H-P’s probe, she said: “I end up in the weirdest places.”H-P’s leak
investigations first kicked off in early 2005. At that point, an H-P outside
security consultant, Ronald DeLia, owner of Security Outsourcing Solutions,
gave the names of several journalists, including mine, and former H-P
executives to Action Research Group, a Melbourne, Fla., data brokerage firm,
according to investigation documents released by Congress. Mr. DeLia asked
Action Research Group to pull our telephone records, according to the
documents.It isn’t clear how Mr. DeLia got our phone numbers. Mr. Schultz said
my name came up as a target after Mr. DeLia’s firm reviewed thousands of
articles on H-P and homed in on journalists who wrote about confidential H-P
information citing unidentified sources. An attorney for Mr. DeLia didn’t
return a call for comment. Mr. DeLia has been charged by the California
attorney general in this case, and has pleaded not guilty. Action Research
Group officials, one of whom has been charged by the California attorney
general and has also pleaded not guilty, didn’t return a call for comment.By
July 2005, H-P had compiled background on many of its subjects, including me,
according to documents released by Congress last month. In an investigation
summary, H-P listed my educational background, the date I joined The Wall
Street Journal, and information about my husband. The document also notes that
I made 78 phone calls from my cellphone between April 16, 2005, and June 16,
2005. “An analysis of the subscribers of the 78 numbers is in
progress,” the document says.That 2005 analysis, which H-P’s lawyer wasn’t
able to provide me, probably yielded nothing more than a portrait of frenzied
planning for my sisters’ weddings. At the time, my family had just finished the
wedding preparations for one of my sisters and we were busy organizing a bridal
shower for my other sister. That meant frequent phone calls to and from my
mother.Still, H-P’s investigative team compiled information on me. In November
2005, one of H-P’s then directors turned over voicemail messages I’d left him
earlier that year, according to an email from H-P’s investigative team. That gave
the company a record of my voice, which was stored away. Mr. Schultz, H-P’s
outside lawyer, told me yesterday that such records were collected to provide
“context,” in an attempt to link me to a source of the leaks.H-P’s
probe ramped up again in January, after articles ran in The Wall Street Journal
about H-P’s talks to acquire technology outsourcing and consulting firm
Computer Sciences Corp. and after an article appeared on CNET about a board of
directors’ retreat that same month. By late January, the second phase of the
company’s investigation — known as Kona II — was in full swing. (The
investigations were dubbed Kona by Ms. Dunn, who named the probes after the
location of her Hawaiian vacation home.)That was when some of H-P’s creepiest
incursions on me occurred. On Jan. 30, Security Outsourcing Solutions reported
that a “pre-trash inspection survey is in progress for the Tam
residence,” according to a document Mr. Schultz gave me yesterday. But
there was more to the story: H-P investigation documents that Mr. Schultz
didn’t provide me reveal that in early February H-P’s investigators also
conducted “pre-surveillance reconnaissance” on directors and several
journalists, including me.Mr. Schultz said it isn’t clear if H-P’s
investigators actually went through my trash or just looked around my house.
According to Ms. Keating, the security expert at IGI, terminology such as
“pre-trash-inspection” typically means that investigators scoped out
neighborhoods and office buildings and tried to figure out if the garbage was
easily accessible — all in preparation for more-extensive digging-through at a
later time.Trying to learn more about investigators’ tactics, I asked Francie
Koehler, a licensed private investigator in Oakland, Calif., for the past 21
years, to visit my neighborhood to give me tips on how such techniques might be
carried out. This week, as she walked around my street, which is atop a small
hill, Ms. Koehler thought it would be easy to stake out my house. There are
plenty of parking spots on the hill where one can get a clear view of my home
through a car’s rearview mirror, she said. Since I’m not on a cul-de-sac, it
would also be easy for an observer to get away, she added. And because we bring
down our recycling to the curb every Monday, Ms. Koehler says, it is legal for
someone to rifle through some of the trash. “That’s all fair play,”
she said.

 

H-P didn’t just plan to infiltrate
my neighborhood, however. According to the documents released by Congress, in
one PowerPoint slide from February — which was, again, missing from Mr.
Schultz’s briefing yesterday — H-P investigators proposed sending in their
team to pose as cleaning crew members or clerical staff in The Wall Street
Journal’s and CNET’s San Francisco offices. Mr. Schultz said that as far as he
knows, “that was never done.”By mid-February 2006, H-P had obtained
my cellphone records for mid-December 2005 through mid-January 2006, Mr.
Schultz told me. H-P’s investigators later accessed my cellphone records for
February and my home-phone records for January and February, he said.H-P now
had printouts of names and numbers of people I called. From these records,
copies of which Mr. Schultz gave me, H-P discovered that of the 25 calls I made
from my cellphone between mid-December and mid-January, I called home 20 times.
In other records, H-P’s investigators highlighted calls I made to current and
former H-P executives, as well as calls I was making to my editors in San
Francisco and New York. Twice, H-P saw that I called my insurance company. They
saw that I often called my sister.Among the calls H-P’s investigators saw were
those I made to sources for other stories I was reporting for the Journal —
including sources at H-P competitors. One call was to Marlene Somsak, a former
H-P media-relations executive who now works at H-P competitor Palm Inc. H-P’s
phone records list Ms. Somsak’s name and address. Ms. Somsak declined to
comment. The list provided by Mr. Schultz also shows reporting calls I made to
Lucasfilm Ltd. and the San Francisco Police Department. A spokeswoman for
Lucasfilm declined to comment.H-P’s briefing of its spying on me is mum about
other events around February 2006. Mr. Schultz had no information, for example,
on how the H-P investigative team handed out a photo of me and a description of
my car to their surveillance teams — something that a congressional
subcommittee has now made public. It’s unclear where they got the information.
H-P began researching my husband and whether he had any relationships with H-P
directors and others — work that was “90% complete” at the time,
according to a note in a February document.Also missing from Mr. Schultz’s
briefing was H-P’s snooping on my instant messaging. In February, H-P’s
investigative team focused on my communications with one of their own
media-relations executives, Mike Moeller, whom I frequently talked to as part
of our jobs. That was when they accessed our instant messages, which generally
included witty repartee such as the following transcript that H-P had in its
files: Me: Nice results (for H-P’s financial quarter). Mr. Moeller: Real nice.
Nice guidance. Me: Yup.

 

Mr. Moeller declined to comment.

H-P
also attempted to catch me talking to sources. In a March email from then H-P
chief ethics officer Kevin Hunsaker, who helped direct the H-P investigation,
Mr. Hunsaker asks one of his investigators: “Can you please do some
monitoring on incoming and outgoing calls to Pui-Wing Tam, and keep a really
close eye on her IM traffic with Moeller. There is going to be a special telephonic
board meeting next Tuesday to discuss a very important topic…this is yet
another major opportunity for a leak to occur.” Mr. Schultz didn’t include
this email, which H-P released to Congress, in his briefing with me. An
attorney for Mr. Hunsaker declined to comment. Mr. Hunsaker has been charged by
the California attorney general, but hasn’t formally entered a plea.In March, a
man whom the California attorney general has identified as Bryan Wagner of
Littleton, Colo., allegedly used the last four digits of my Social Security
number and my home phone number to set up an AT&T online account for my
local phone service. Mr. Wagner has worked for Action Research Group, according
to the California attorney general. Using that account, Mr. Wagner appears to have
accessed some of my phone records, according to the state attorney general’s
criminal complaint. It’s unclear how Mr. Wagner may have gotten my Social
Security number, but H-P’s outside attorney Mr. Schultz said there appear to be
databases where Social Security numbers can be accessed.Mr. Wagner, whom the
California attorney general filed felony charges against this month, didn’t
return a call seeking comment. His attorney also declined to comment. Mr.
Wagner has pleaded not guilty.Even as late as April, H-P was conducting
“surveillance” of me. Around April 3, Security Outsourcing Solutions
reported that an investigator traveled to a San Francisco hotel to attend a
dinner reception where then-H-P director Tom Perkins was making a speech. The
investigator was asked to look out for whether I would show up at the event —
which I didn’t. A few days later, Security Outsourcing Solutions reported
looking out for me at an H-P conference in Los Angeles. (I was a no-show).
H-P’s probes wrapped up around this time, according to the California attorney
general’s investigators.Since then, H-P officials have apologized repeatedly
for the investigations. Mr. Hurd apologized in a news conference and before
Congress. Ms. Dunn emailed all nine journalists who were under scrutiny a
similar apology. (In the copy she sent me, my name was written in a different
font from the rest of the message.) Yesterday in the conference room, it was
the turn of Cathy Lyons, H-P’s chief marketing officer. “I apologize on
behalf of H-P,” she said.

[Author]

October 20, 2006 at 12:08 PM