HP Spying Scandal (2006): How Pretexting Investigators Obtained Directors' and Reporters' Phone Records

How the HP pretexting scandal reached the phone carriers

It started in April 2005. HP chairwoman Patricia Dunn wanted to know which director kept leaking confidential board talk to the press. According to the California Attorney General, she gave outside investigator Ronald DeLia the home, cell, and office numbers of board members that month.

From there the job went down a chain. HP hired DeLia's firm, Security Outsourcing Solutions. DeLia brought in Action Research Group (ARG), a Florida information broker, and ARG used contractors such as Bryan Wagner to get the records.

Those contractors used pretexting: pretending to be someone else, in this case the account holder, so a company hands over information.

1. Reconnaissance: investigators collected each target's name, phone numbers, and Social Security number. ARG required clients to supply complete Social Security numbers, according to the Justice Department.
2. Pretext: a contractor called the carrier, or opened an online account, claiming to be the subscriber.
3. Access: all or part of the Social Security number was enough to get past the carrier's identity check. It's a form of account takeover.
4. Exfiltration: the carrier released billing and call records, and they made their way back through ARG and DeLia to HP's investigators.

Here's one documented example. On March 8, 2006, Wagner used a Wall Street Journal reporter's Social Security number to set up an online account for the reporter's phone service. Then he pulled the call records. He admitted this in his federal guilty plea.

The probe had two phases, code-named Kona I (2005) and Kona II (from January 2006). Investigators also followed directors and journalists in person and sent a reporter a tracer email.

What the phone carriers accepted as proof of identity

The weak spot was the carriers. A name, a phone number, part of a Social Security number: for their reps and their websites, that was enough to prove you were the customer.

Any check like that falls over once the data can be bought or dug up. In this case HP's own side supplied it. So every fake call came with the right answers ready.

ARG's contractors got information on at least 14 people later identified as targets of HP's investigation, the Justice Department says, plus 19 others. California's complaint centered on the phone records of 12 people, among them board members, reporters, and their relatives.

Press reports citing the complaint, such as one from the Associated Press, said records of roughly 1,750 calls across 157 cell phones and 413 landlines were compiled.

Who knew, and when, according to the charges

The complaint alleged that at a June 2005 briefing, Dunn learned that "telephone records were obtained by ruse from telephone and cellular carriers." She went on to help restart the investigation in January 2006.

The complaint also alleged that Kevin Hunsaker, HP's in-house lawyer and ethics chief, learned of the ruse in January 2006. Even so, the complaint said, he gave the investigators the home, cell, and office numbers of HP officials.

Someone inside HP did push back: according to the congressional hearing record, an HP investigator wrote in a February 2006 email that he had "serious reservations" and asked that the phone-number gathering stop immediately.

HP spying scandal timeline, April 2005 to June 2007

Six defendants, two courts, and how each case ended

California dropped its charges against Wagner because, once he'd been convicted federally, state law didn't allow a second trial for the same crime, as Computerworld reported.

What HP paid, and what the figures mean

The settlement also bound HP to five years of governance reforms, according to the Attorney General. HP had to appoint a chief ethics and compliance officer, set rules for outside investigators, and give the board oversight. The shareholder number is from an Associated Press report on the amended complaint.

Did the HP scandal create the federal pretexting law?

Not really. That's how the story usually gets told, though. The Telephone Records and Privacy Protection Act was introduced on February 8, 2006, and passed the House on April 25, 2006, months before HP's disclosure.

The Senate only caught up in December 2006, after the hearing. It was signed on January 12, 2007. Throwing out the last state charges, the judge credited the case with helping spur anti-pretexting laws. Fair enough, but the bill was already on its way.

What would have stopped it

At the carriers, the fix was authentication a stranger can't just recite. Call back the number on file. Send a one-time code. Ask for a PIN the customer picked. Any of those would have stopped someone who only had a Social Security number.

At HP, it was governance. Any investigation that touched outsiders' personal data needed a lawyer's review and lawful process, like a subpoena, plus a written ban on deception in contractor agreements. That warning email should've stopped everything until the lawyers looked at it.

What help desks and legal teams can take from the HP pretexting scandal

• Help desks and carriers: knowing someone's personal data isn't authentication. Verify through a channel the real customer controls.
• Legal and compliance teams: handing the work to a contractor, who hands it to another, doesn't hand off the blame. California went after the people who kept using the results once they knew where they came from.
• Security leaders: if someone puts a legal or ethical objection in writing, that's your cue to stop and escalate. Don't let it sit in a folder.

For more pretexting examples, compare the retired general's phone-records pretexting incident, the FTC sweep against telephone record sellers, and the modern Clorox help-desk pretexting case. The difference between this technique and email lures is explained in phishing vs pretexting.

HP spying scandal: common questions