The Law They Wrote for Phone Records

Hewlett-Packard's board was leaking to the press. In January 2006, CNET published a piece detailing HP's strategy, sourced to someone in the boardroom. HP went looking for that person and found him: George Keyworth, director, who resigned on September 12, 2006. Objective achieved, target identified, leak closed. Everything else that happened is the invoice.

The method was pretexting. HP's chief ethics officer, Kevin Hunsaker, ran an operation that hired private investigators who called telephone companies impersonating HP directors and the reporters covering them, and asked for their call records. Cell, landline, VoIP, unpublished numbers. The journalists targeted worked at CNET, the New York Times, and the Wall Street Journal — a public company running a covert intelligence operation against three newsrooms to find out who was talking to them, with no warrant, no subpoena, and nobody outside the building aware it was happening.

Nothing was hacked. No system was breached, no password cracked, no encryption defeated. The carrier's authentication procedure was: sound like the account holder and know a few facts about him. Both of those are an afternoon's work for a competent investigator, and in 2006 there was no federal statute that named what they had done.

This is why a twenty-year-old corporate governance scandal is still a technology story rather than a business-school case. HP's investigators ran the attack that would go on to define the next two decades. You do not defeat the system. You defeat the human procedure bolted onto the side of the system for people who lost their password. Every SIM swap since, every helpdesk call that resets multi-factor authentication, every account-recovery takeover — same technique, same target, better payoff. The recovery path is not a flaw in the product. It is the product, because the alternative is telling a real customer standing in a parking lot with a dead phone that he no longer exists. Nobody has ever wanted to be the company that says that.

The collapse ran fast. Newsweek broke it on September 5, 2006. HP filed an SEC disclosure on the 6th. Chairwoman Patricia Dunn resigned on the 22nd; general counsel Ann Baskins on the 28th. On October 4, California charged Dunn, Hunsaker, and three investigators with four felonies each: conspiracy, wire fraud, computer data theft, identity theft.

Then watch where the criminal justice system decided the crime had occurred.

On March 14, 2007, every charge against Dunn was dismissed — and that is the wrong case to argue from. Judge Ray Cunningham dismissed in the interest of justice; Dunn had stage-four ovarian cancer, and the attorney general's office said she was released "not because she's innocent but because she is sick." Set her aside.

Argue from Hunsaker instead. The chief ethics officer who designed and directed the operation pleaded no contest to a misdemeanor count of fraudulent wire communications, and in September 2007 the charge was dismissed outright once he completed 96 hours of community service. Then argue from Bryan Wagner, the investigator who actually placed the calls, who actually said the words. Wagner pleaded guilty in January 2007 to conspiracy and aggravated identity theft and was sentenced in December 2012 — nearly six years later — to three months in prison and two years of supervised release. He is the only person in the affair who saw the inside of a cell.

Ninety-six hours for directing it. Three months for performing it.

I would not call that a law of nature; one case is one case. But it is the shape this case took, and every organization that has ever bought a capability it did not want to describe in a memo will recognize the shape. Distance from the handset is not a defense anyone has to argue for. It arrives on its own.

Congress responded with the Telephone Records and Privacy Protection Act of 2006, which made it a federal crime to obtain telephone records by fraud.

Telephone records. Read the noun.

The statute was scoped to the exact artifact in the headline — not to the technique, not to the carrier procedure that made the technique trivial, not to the general class of things a stranger can talk his way into. Congress does not legislate methods. It legislates the last object that embarrassed it, and then everyone goes home.

Which has aged badly, though not in the way it first appears. Phone records are the least of what a convincing voice gets you now. The same call, made to the same kind of support desk, moves a phone number to a new SIM, and the number receives the reset codes, and the codes open the accounts, and the accounts hold everything. A 2006 statute about billing records does not reach that.

But none of it is unpoliced, and it would be cheap to imply otherwise. SIM-swap crews get charged constantly — wire fraud, the Computer Fraud and Abuse Act, aggravated identity theft. General-purpose statutes: the same ones California reached for against the HP defendants in 2006, the same one that eventually put Wagner away. The FCC tightened carrier authentication for SIM swaps and port-outs in November 2023. The technique is not legal and never was. The failure is stranger than a gap in coverage: handed a live, fully documented demonstration of a method, Congress wrote down the object.

And an object can be acquired other ways. In 2006 Congress made it a felony to obtain phone records by lying. It did not make it anything at all to obtain them by paying. For most of the following two decades the carriers themselves sold access to customer location data to aggregators, who resold it onward to whoever was buying, and the FCC did not fine them until April 2024 — nearly $200 million across AT&T, Verizon, T-Mobile and Sprint, still contested in court. Eighteen years in which the fraudulent route to a person's whereabouts was a federal crime and the invoiced route was a line of business.

HP caught its leaker. It cost the chairwoman, the general counsel, and the company's reputation, and produced one narrow federal law about one narrow kind of file.

The pretext still works. It has simply been undercut on price.