Hewlett-Packard, in a now infamous case, hired an outside firm to help it spy on its own board of directors to find out who was leaking information to the press. The outside firm was asked to obtain the directors’ phone records. The firm used information, including the Social Security numbers of the suspects, to conduct pretexting—pretending to be a client or other authorized person to obtain the records of a third party. The scheme, which has since resulted in indictments against the chairwoman and three attorneys as well as large fines against the company, was overseen by the company’s ethics chief.
The only objection voiced at the time came from security personnel involved in the investigation who happened across the telephone records and questioned whether they had been obtained legally. The IT security director later testified before Congress on the issue. He said that his objections were passed along the chain of command and that he was assured that the pretexting was perfectly legal.
As this example illustrates, companies that are called on to investigate their own employees in major criminal cases, such as fraud or other financial crimes, must be aware of the legal constraints. Missteps can cost them more than the infractions they are investigating.
The need to understand how to conduct ethical and legal investigations is increasingly important as such investigations are on the rise. Virtually every public corporation and securities firm has conducted at least one significant internal investigation in the past few years. The reasons for this development include the environment created by the Sarbanes-Oxley Act and the policies of the Department of Justice (DOJ), the Securities and Exchange Commission (SEC), and other law enforcement agencies that encourage companies to conduct internal investigations.
Every internal investigation should be credible, timely, fair, accurate, objective, and thorough. The following overview focuses on the key legal questions that typically arise when investigating major crimes within an organization.