The Truth Behind Pretexting: In-house Investigations and Professional Responsibility Concerns

To this day, The Wall Street Journal, New York Times, and internet blogs continue to run new articles and queries focusing on the growing scandal involving H-P's investigation and its pretexting techniques. While many of these reports inquire about criminal liability for those involved, this article discusses the professional responsibility consequences for lawyers involved with pretexting. The simple truth is that lawyers are held to a higher bar than just avoiding criminal conduct.

This article, thus, briefly explains what pretexting is and what H-P did, highlights relevant rules of professional conduct, and discusses the impact these rules have on internal investigations.

Pretexting and HP: The Background

What is Pretexting?

Pretexting is a practice where an individual lies about her identity in order to obtain confidential or privileged information that she is not entitled to. There are a number of different ways pretexting occurs. Pretexters may use the telephone or computer. They may claim to be an institution like a bank or credit agency, or they may call a company claiming to be the consumer.

Pretexting for financial data is a federal offense under the Gramm-Leach-Bliley Act.[1] At the time of the H-P scandal, the legality of pretexting for other forms of information, such as for phone records, was considered a legal gray area.[2] Under federal law, pretexting may fall within the proscriptions of wire[3] or computer fraud.[4] And just last May, for example, the Federal Trade Commission, in an attempt to stop pretexting, charged five internet companies with violating Section 5 of the FTC Act, which bars "unfair or deceptive acts" in business practices.[5] State law crimes involving fraud and identify theft-related statutes may also be used to prosecute pretexters.

On January 12, 2007, the President signed into law the Telephone Records and Privacy Act of 2006.[6] This new law makes it a federal felony to fraudulently acquire telephone records.[7] Among other things, the Act makes it a crime to knowingly and intentionally obtain confidential phone records information of a "covered entity" in interstate or foreign commerce by making false or fraudulent statements or representations to an employee of a "covered entity."[8] The term "covered entity" is defined as all telecommunications carriers, including those providing IP-enabled voice service (voice-over-internet protocol services).[9]

What happened at H-P?

In January 2006, after an article written by Dawn Kawamoto and Tom Krazit in CNET[10] detailed a private board retreat, H-P started an investigation headed by Senior Counsel Kevin Hunsaker (who ironically was H-P's Director of Ethics) to determine the identity of the leak.[11] The investigation was extensive. It included reviewing more than ten thousand published articles, analyzing internal H-P documents, searches of H-P's email and internet servers for traffic to and from reporters and news agencies, individual interviews, and phone records of H-P board members acquired through pretexting.[12]

H-P retained outside investigators to assist with the investigation. The investigators obtained the phone records through pretexting. While Hunsaker did not engage in pretexting, Hunsaker did know that the technique was being used. The Wall Street Journal reports that he learned how phone records were obtained when the investigation began in January 2006.[13] Then, in April 2006, Hunsaker sent an email to the investigation team discussing how the phone records were attained and asserting the legality and commonality of the practice.[14]

Shortly after the use of pretexting was brought to the public's attention in September 2006, the California attorney general filed a criminal complaint on October 4, 2006 against four individuals associated with the scandal, including Hunsaker.[15] The individuals were charged with conspiracy, wire fraud, taking, copying and using computer data, and using personal identifying information without authorization. All the individuals will avoid jail time after a judge dropped charges against former HP chairwoman Patricia Dunn and the other three defendants pled no contest.[16] H-P, itself, settled a lawsuit with the California attorney general for $14.5 million over its use of private investigators and use of pretexting for phone records.[17]

As we've seen, H-P's investigation-irrespective of the pretexting-was extensive. Based on the review of the CNET article and the quotes attributed to the source and review of internal email and internet server searches, the investigation team determined that the leaker had to have been present at the board meeting the article was based on.[18] Having narrowed the field to board members, the investigation team reviewed additional articles written by Kawamoto and analyzed quotes and information attributed to an anonymous source.[19] This review further narrowed the potential leakers because the articles went back to 2001.[20] Since the investigation team determined that the leaker was likely the same all along, that narrowed the potential leaks down to six board members.[21] Furthermore, witness interviews indicated George Keyworth's interest in a variety of the topics that were reported on by Kawamoto.[22] The investigation team also deduced that the language used by the leak was of an academic nature, and Keyworth was the only board member with an academic background.[23] Finally, Keyworth "admitted right away" that he was the source at an investigatory interview.[24]

Obviously the telephone records placing calls to and from Keyworth and Kawamoto shortly before the release of the article locked in Keyworth as the leak, but the fact of the matter is that the investigation team identified Keyworth as the leak through legitimate means. Ironically, the pretexting not only added little value, but resulted in H-P's loss of the moral high ground: an investigation that started as an attempt to stop a board member from violating his fiduciary duties transformed into a criminal corporate scandal.

But our interest here is not determining whether pretexting can survive a risk-benefit analysis, nor whether it was criminal, rather it is whether pretexting survives an ethical analysis. For this, we start with the Model Rules of Professional Conduct.

Relevant Professional Responsibility Rules

While the criminal complaint in the H-P matter captured all the headlines and attention, all attorneys and, especially in-house attorneys, should not miss the critical professional responsibility implications in this case and relating to pretexting in general. Of the Model Rules of Professional Conduct[25] Rule #'s 8.4, 4.1, and 5.3 are particularly germane to our analysis. [26]

• • Rule 8.4(c) provides for professional misconduct when a lawyer "engage(s) in conduct involving dishonesty, fraud, deceit or misrepresentation."[27]
  • Rule 4.1(a) prohibits a lawyer, in the course of representing a client, from knowingly making a false statement of material fact to a third person.

Both of these rules, on their face, prevent lawyers from pretexting during investigations. There is no clearer example of dishonesty and misrepresentation than calling a company and claiming to be someone you are not to obtain the customer's private records. Similarly, an in-house lawyer conducting an internal investigation is "in the course of representing a client" and lying about his identity is plainly a false statement of fact. It is likely material because without the misrepresentation, the pretexter would not be able to receive any information. Notably, Minnesota does not have a materiality requirement in Rule 4.1.

Would it matter if the pretexting was delegated to a private investigation firm as in the H-P scandal? That is where Rule 5.3(b) comes into play.

• • Rule 5.3(b) requires lawyers with supervisory authority over nonlawyers "to make reasonable efforts to ensure that the person's conduct is compatible with the professional obligations of the lawyer."

Rule 5.3(b) requires lawyers to properly oversee nonlawyers working on the lawyer's behalf. This raises two points. First, a lawyer cannot order a nonlawyer to do something that the lawyer would be prohibited from doing herself.[28] Second, a lawyer has an affirmative duty of oversight to make sure nonlawyers are acting consistent with the lawyer's professional obligations. A former director of the Minnesota Office of Lawyers Professional Responsibility recalls that "[s]everal disciplines have been issued to attorneys whose assistants or investigators were not sufficiently supervised or trained and who then contacted represented parties, used deceitful tactics, etc."[29] Comment 1 to Model Rule 5.3, moreover, specifically highlights a lawyer's duty to supervise investigators.[30] Accordingly, a lawyer cannot turn a blind eye to conduct that would violate the rules if the lawyer performed them and then claim that someone else did it and the lawyer had no idea that the conduct was going on.

Rule 5.3(b) is likely the rule most applicable to the H-P scandal and most important rule to keep in mind for future investigations. While nothing suggests Hunsaker engaged in pretexting himself, records do show that investigators working on H-P's behalf used pretexting, and he in fact defended its use even months later. As the head of the investigation, Hunsaker had supervisory authority over and responsibility for the private investigators. Accordingly, it seems pretty clear that he had a professional obligation under the Model Rules to make reasonable efforts to instruct the investigators not to engage in pretexting. It should be noted that California does not have rules analogous to Model Rules 8.4(c) or 4.1.[31]

Government Lawyers & Law Enforcement

Perhaps you are surprised and somewhat skeptical that lawyers' professional obligations reach covert investigations, given how common they appear to be.[32] Government prosecutors, for instance, routinely are involved in sting operations and other undercover operations. These cases generally show that government lawyers "may engage in lawful covert activities that gather information through dishonesty, deceit, and misrepresentation without running afoul of Rule 8.4(c) and DR 1-102(A)(4)."[33] To be clear, though, deception based investigations is limited to government lawyers, [34] and even some instances can rise to the level of a violation. The Colorado Supreme Court's decision in In re Pautler is a good example that the government law enforcement exception is not without boundaries.

In Pautler,[35] a district attorney represented himself over the phone to be a public defender to negotiate the surrender of a brutal murderer and rapist, who made references "to his continued ability to kill."[36] The Attorney Regulation Counsel in Colorado charged Pautler with violating Colorado Rule of Professional Conduct 8.4(c), which the presiding disciplinary judge granted summary judgment against Pautler.[37] The Colorado Supreme Court affirmed. In doing so, the court rejected an imminent public threat exception to Rule 8.4(c) and noted that when an attorney is "presented with choices, at least one of which conforms to the Rules, an attorney must not select the option that involves deceit or misrepresentation."[38] Moreover, the court refused to grant government or law enforcement officers any special exemptions.[39]

The Pautler case is very telling about how a court may look at a lawyer's role in pretexting. Quite simply, if a lawyer will be disciplined for misrepresenting his identity to obtain the surrender of a murderer, isn't it conceivable that a lawyer can lie about his identity to receive phone records for a private investigation?

Future Internal Investigations

Attorneys should consider the consequences of moving forward with pretexting or other forms of deceitful investigations. First, attorneys that sanction the use of pretexting during investigations can likely be subject to professional discipline-potentially including disbarment-if they are governed by the Model Rules of Professional Conduct.

In addition, investigations can lose the protection of the attorney-client privilege. Often one of the main advantages to having counsel lead an investigation is to shield the investigation with the attorney-client privilege. In the H-P scandal, for example, Hunsaker was asked to head the investigation "in order to protect the attorney-client privilege in the event there is litigation or a governmental inquiry of some sort."[40] The use of pretexting in investigations may threaten the privilege, however, because of the crime-fraud exception.

In addition to the severe consequences that may result from the use of pretexting in investigations, it is also important to note a complete investigation can be done without pretexting. In the H-P case, for example, as the internal report points out, there was enough information available through legitimate investigatory measures to determine who the leak was.

Thus, attorneys involved with internal investigations should take note of this debacle and remember that their professional obligations as an attorney apply to investigations. Moreover, in-house attorneys should make sure that its company has sufficient, legitimate guidelines in place for future investigations. Document reviews, witness interviews, and legitimate searches and surveillances, to name a few options, can and should be implemented to achieve a complete, thorough, and successful investigation.

Conclusion

While pretexting for phone records is now a federal offense, it was not so clear when the H-P scandal transpired. Additionally, pretexting is a continuing issue, beyond phone records. The H-P scandal, therefore, is a reminder to lawyers that "conduct that is legal may not be ethical."[41] The profession's honor requires that "truthfulness, honesty and candor are the core values of the legal profession."[42] The use of pretexting in corporate investigations headed by an attorney may likely violate an attorney's duty of honesty and supervision and may lead to professional discipline. Moreover, the use of pretexting may vitiate the attorney-client protection. Thus, when examined closely, the truth behind pretexting becomes clear-it just isn't worth it.