Spying: Business As Usual

Subterfuge seen as a gray area in world of corporate snooping

Hewlett-Packard Co.'s use of undercover skullduggery to track down the source of a leak has generated outrage and attention since it became public last week. The outcry might make you think that cloak-and-dagger activities at major companies are out of the ordinary.

But corporate espionage is a fact of life. Some form of snooping is relatively commonplace at all kinds of companies, experts say. And in the electronic age they are becoming even more so.

There are extreme examples, such as Oracle Chairman Larry Ellison hiring private investigators to spy on Microsoft allies, including pawing through their garbage. "I feel very good about what we did," Ellison told reporters in June 2000, when the activities came to light.

Back in the 1960s, General Motors, rattled by Ralph Nader's expose of safety defects in its Corvair, hired private eyes to dig up dirt on the consumer activist. Not only did the investigators fail, but GM paid $280,000 to Nader after he sued and the president of GM had to testify to Congress about the harassment and apologize to Nader.

This summer, the FBI nabbed three Coca-Cola employees who, rather ineptly, allegedly tried to sell the secret formula for Coke to archrival PepsiCo.

Corporate spying may be as simple as a company president visiting competitors' stores to see what's on sale, as elaborate as engaging outside experts to learn about a rival's business or as high-tech as hiring a hacker to try to breach a company's own security measures to identify weaknesses.

"I think corporate investigations are common these days because corporations have an obligation to follow up on allegations of improper behavior," said Kirk Hanson, executive director of the Markkula Center for Applied Ethics at Santa Clara University.

He and others said they think HP was entirely correct in trying to find the leak. "I would argue it was (HP Chairwoman) Pattie Dunn's responsibility to set an investigation in motion to try to identify the source of the leak," Hanson said.

The problem is the techniques used. HP has acknowledged that a contractor hired by its outside investigators used pretexting to obtain private phone records of board members and journalists.

In its broadest sense, pretexting simply means misrepresentation. Specifically, HP's outside agents evidently masqueraded as the people they were investigating, including using parts of their Social Security numbers, to obtain their phone records.

Pretexting to obtain financial records is banned by federal law. California Attorney General Bill Lockyer says HP's agents committed the crime of identity theft.

Several laws introduced in Congress this year would prohibit pretexting to obtain phone records. The HP scandal is likely to accelerate their passage.

But some experts in corporate security defend pretexting and other forms of subterfuge.

"Pretexting sounds like a bad word, but it's not," said R. Mark Halligan, a Chicago attorney who chairs the American Bar Association committee on trade secrets. "It simply means that a person represents himself in such a manner that the person that is suspected of a crime makes a certain admission or makes certain statements the investigator would not otherwise have obtained. Now this (HP) case involves access to telephone records, so it's complicated." He emphasized that he doesn't know all the facts in the HP case.

Halligan said he thinks that ferreting out trade-secret theft or unauthorized disclosure of proprietary information could merit some forms of deception.

For example, a client once hired him to find out whether a former employee who was starting a rival business planned to illegally copy the firm's manufacturing techniques. Halligan hired an investigator who befriended the former employee at a trade show and worked to develop a relationship. After several weeks, the two men went on a fishing trip together, during which the former employee offered the investigator a job with his new firm and revealed that he had his former employers' trade secrets. The company used that information to sue the former employee with the investigator as the star witness.

This content continues onto the next page...