In Depth
5 Things About Corporate Investigations That Won't Change...
...As a Result of the Hewlett-Packard Pretexting Scandal
By Sarah D. Scalet
strong>
Let's be clear here. Telephone records are a routine part of investigations, and no single law is going to
change that.
Company phone records, for instance, are routinely used for internal investigations, and no one blinks
an eye. Employees simply don't have a reasonable expectation of privacy about calls they make and
receive on company phone systems.
Likewise, phone records are also routinely used for investigations done by law enforcement, especially
after the passage of the USA Patriot Act. Sometimes records are obtained with subpoenas; other times
they're released as a courtesy. Large telecommunications companies even have staffs in charge of
responding to these requests for telephone and ISP records.
A law protecting private phone records would make it more difficult to obtain records outside of those
two circumstances. But no one thinks it will stop the practice. It'll just change how individuals weigh the
risks and possible rewards of accessing such records.
"I think the HP case will turn people away from phone records, but in a cheating spouse situation or
with a business partner gone bad, I think people are going to take that upon themselves to hunt around
for that information," the National Retail Federation's LaRocca says.
"There are always people out there who can get you any kind of information, anytime, anywhere, and if
you hire those people they'll get it for you," Wells Fargo's Wipprecht says. "The question is, do you really
want to know?"
Reality check: There are legitimate ways to obtain private phone records, and the illegitimate ways
won't disappear overnight.
Assumption #5 Companies will hire law firms, not investigations firms, so that
investigations are done by the book.
Investigative firms aren't the only ones hired to do investigations. There's a booming business right
now for law firms that do investigations—and that's not going to change.
"A lot of investigations that would have been handed out to a small investigative boutique will instead
go to a reputable law firm," predicts Lavinder of Security and Investigative Placement Consultants,
noting that this is a trend she's been observing for a while.
These are firms such as the New York City-based Debevoise & Plimpton, which did an internal
investigation into whether Merck executives knew about dangers of the arthritis drug Vioxx; and
WilmerHale, the firm based in Washington, D.C., that was recently in the news for its investigation into
how stock options were granted at UnitedHealth. Firms like these use different methods than
investigations firms.
"We have a lot of clients who turn to us to do investigations, but they're not going to go out and find
somebody's phone records," says one attorney who works on white-collar investigations for a large law
$firstKeyword
Security Directions: A Virtual Conference
Available On Demand Sept. 30 - Dec. 30
Join us for a virtual event with candid, expert information on top security challenges and issues - all from the comfort of your desktop.
Protecting PII: How to Work with IT to Manage Risk
Understand the critical nature of the test data privacy problem and get tips on how to work with IT to implement a test data privacy program.



