HP lights the privacy powder keg
Once a darling at privacy hearings, HP is now the villain in a storm about pretexting that has been building in Congress for months.
By Nina J. Easton, Fortune Washington bureau chief

Washington D.C. (Fortune) -- When embattled HP chairman Mark Hurd steps before a US House panel on Thursday, he will be walking into a bipartisan buzz-saw of lawmakers worried about privacy and stunned that a company they once considered a prominent advocate of federal privacy protection for consumers would snoop on reporters and its own employees.

The expected grilling by angry lawmakers also should jump-start efforts for new laws explicitly outlawing "pretexting" - in which imposters gain access to individuals' personal data - and adding penalties to the Federal Trade Commission's arsenal of weapons against the practice.

hurd_mark_hp.03.jpg
Hewlett-Packard CEO Mark Hurd

"Congress wants everyone to know that pre-texting is unequivocally, absolutely illegal," said FTC Commissioner Jon Leibowitz.

The House Energy and Commerce Committee has been investigating the practice since February, when Chicago police warned officers that criminals were buying their phone records online.

Ironically, HP (Charts) was a good-guy star of the hearings that followed that revelation. In June, HP's chief privacy officer, Scott Taylor, told the committee that privacy "is a core value at HP" and no one questioned the assertion.

"HP has traditionally been one of the best companies for privacy," said Ari Schwartz, deputy director of the Washington-based Center for Democracy and Technology. Last year the privacy nonprofit groups TRUSTe and the Ponemon Institute gave HP the "The Most Trusted Company for Privacy" award for "establishing and enforcing progressive privacy practices that build a high level of consumer trust."

Until the HP scandal broke, the main targets of Congress' investigation were fly-by-night operators that "proactively invade your privacy and sell the results of their ill-gotten gains to anybody with 100 bucks," as Committee Chairman Joe Barton of Texas recently said.

Likewise, the FTC, acting under its own authority to take action against "unfair" or "deceptive" business practices, has gone after what Leibowitz calls a "disturbingly large cottage community" of operators that buy and sell personal records.

Now HP, the company once known around Washington as a leading advocate for federal privacy laws, stands accused of hiring these same operators to surreptitiously gain access to the phone records of board members and nine journalists in a botched and possibly illegal attempt to stop news leaks.

"The fact that this is a particularly reputable company is an indication of why we need federal legislation," said Rep. Jan Schakowsky of Illinois, a co-author of pretexting legislation.

"You can't arms-length it either," she added in a pointed reference to HP's use of subcontractors.

The tone for Thursday's session was set in a committee letter to HP demanding that it turn over internal documents. "The committee is troubled by this information, particularly given that it involves HP, one of America's corporate icons," the letter said.

Legislation to outlaw pre-texting for phone records - obtaining financial records under false pretenses is already considered a federal offense under the FTC's law - passed unanimously earlier this year and awaits consideration by the full House. The legislation would also enable the FTC to impose fines; right now all the agency can do is force operators to shut down and turn over their profits.

Lawmakers say they expect an airing of the HP scandal to breathe new life into the bill.

The House Energy and Commerce Committee, whose oversight subcommittee is hosting Thursday's hearing, is home to a yawning political divide among its members - from staunch conservatives such as chairman Barton of Texas to diehard liberals like Edward Markey of Massachusetts. But on privacy issues, they march in lock-step. Barton and Markey co-chair the Congressional Privacy Caucus, a club of members dedicated to the issue.

Those who know Barton say HP executives can expect a grueling session by his committee's oversight panel. "HP is not going to have an easy time," says a lobbyist who deals with Barton's committee. "He's fearless on this stuff."

While formally Barton is an "ex-officio" member of the oversight panel, he is a driving force behind the session and, when provoked, has a history of subjecting witnesses to angry diatribes and finger-wagging.

"It seems like almost every, if not every week, every month now, we get some widely publicized data security breach," Barton complained at a recent hearing on consumer privacy. "And they seem to be getting worse instead of better."

Markey asserted that the "problem of corporations using private detectives and information brokers to obtain illicit access to telephone records and other personal information is not limited to Hewlett-Packard. Congress needs to be asking exactly how widespread this practice is." Top of page