The probe recently carried out by Hewlett-Packard Co. into its own board members in the U.S. has raised concerns in Canada about how telecommunication service providers protect customers’ private information.
California state Attorney General Bill Lockyer had earlier stated that HP violated state laws relating to identity theft and illegal access to computer records in connection with the company’s efforts to determine the source of anonymously leaked company information to journalists.
The firm’s techniques involved hiring a private investigation firm whose agents impersonated HP officials and journalists. The agents tricked AT&T and other phone companies into releasing detailed records of home phone and cellular phone calls of the impersonated individuals.
“The need to protect intellectual property or company information should not trump privacy and human rights,” according to David Fewer counsel for the Ottawa-based Canadian Internet Policy and Public Interest Clinic (CIPPIC).
Another lawyer was amazed that investigators hired by HP were able to access detailed phone logs from both landline and wireless service providers.
“What surprised me is they were able to trick the phone companies into releasing their records,” said Barbara McIsaac, a senior member with the Ottawa litigation team of law firm McCarthy and Tetrault LLP.
McIsaac, however, noted that at the moment HP’s precise involvement is not known. “There is still the question of whether HP actually authorized or condoned [the probe] or the agents went on a frolic of their own.”
A Canadian IT industry analyst slammed AT&T and other phone companies for failing to protect customer records. “Identity theft is the real issue at play here,” according to Ross Amrstrong, senior research analyst at Info-Tech Research Group Inc. in London, Ont.
Armstrong said AT&T and the other service providers “should have had stringent security policies and training for customer relations staff that was tough enough to deter any coercive action by the impostors.”
For another analyst, the HP fiasco brought to mind a situation last year when a Toronto-based magazine was able to obtain the private phone records of Canada’s Privacy Commissioner Jennifer Stoddart from a U.S.-based online company.
“If it happened in the U.S., it’s a possibility in Canada,” said Stefan Dubowski, managing editor of Decima Reports in Ottawa.
Dubowski recalled that in a test of telecom privacy policies in November last year MacLean’s Magazine was able to purchase a detailed list of phone calls made from Commissioner Stoddart’s Montreal home, cottage and even her government-issued BlackBerry.
Locatecell.com in the U.S. provided the Bell Canada records of Stoddart’s home and cottage phones. The magazine was also able to get the commissioner’s Telus Mobility cell phone records.
Dubowski’s concerns were echoed by Fewer who alluded to the findings of a recent CIPPIC survey that Canadian companies “are not attentive to Canadian privacy legislations.”
“Our privacy laws also lack teeth,” Fewer said. He said some companies flout these laws because of the lack of adequate enforcement.
Phillipa Lawson, CIPPIC executive director, also stressed the need to regulate private investigation firms.
“Under the current regime, these firms get off the hook fairly often,” Lawson said.
She said there is insufficient legislation covering how such companies should gather private information that they sell to clients.
Meanwhile, the fiasco has left a cloud over the tenure of HP Chairwoman Patricia Dunn, who had ordered the probe.
Dunn, considered one of the most powerful women in corporate America, was responsible for the ouster of CEO Carly Fiorina in February of 2005 and the hiring of Mark Hurd as her successor.
HP board member George Keyworth II was subsequently identified as the source of the leak and was barred by the company from seeking re-election. The move drove Tom Perkin , another HP director, to resign from the board in May protesting the invasive investigation.
Perkin’s resignation eventually forced HP to publicly disclose that it ordered the investigations.
The computer and printer maker has since apologized publicly for the incident.
“HP is dismayed that the phone records of journalists were accessed without their knowledge, and we are fully cooperating with the attorney general’s investigation,” said company spokesman Ryan Donovan.
Donovan declined to comment when asked if Dunn was facing ouster or was being investigated in connection with the incident.
QuickLink 061441
