The debacle over Hewlett-Packard's handling of board leaks to the press was an eye-opener—not just for junkies of boardroom drama, but to students of business ethics and crisis management. Even if HP (HPQ) Board Chairman Patricia Dunn deliberately set out to create a case study for debate in business school she couldn't have done any better.
Dunn will step down in January as HP board chair amid a furor over tactics used during an investigation into the source of boardroom leaks. Dunn will remain on the board. As part of the probe, contractors for HP's private investigator posed as journalists, directors, and HP employees to obtain telephone records—all in the name of finding out which board member was feeding information to reporters. It's a tactic known as pretexting, and California Attorney General Bill Lockyer has said he has unearthed enough evidence of wrongdoing to issue indictments of people within and outside HP (see BusinessWeek.com, 9/12/06, "Charges on the Way at Hewlett-Packard?").
The whole episode, with its many twists, throws up an array of ethical dilemmas, many of which could be faced by other company directors. Here are just a handful:
Should the chair inform the board it is being investigated for leaks? Knowing that it was likely that only one board member was leaking to the press, Dunn either did or did not have an obligation to inform the board she was about to undertake an investigation and how it was to be conducted. I believe she did have such an obligation, out of respect for the innocent board members and their rights.
How do you pick an outside investigator and what kind of guidance do you give? Every company hopes its vendors, contract manufacturers, or business partners follow its standards and adhere to its values. Today, companies are increasingly being held accountable for what happens throughout the supply chain.
How explicit should HP be in giving direction to its outside investigators? I believe HP had an obligation to pick an investigator with a reputation for respecting the rights of those investigated, and the obligation to give explicit direction that the outside firm should follow HP values enshrined in the "HP Way."
Should ethics—or legality—be the standard for how an investigation is conducted? Investigative methods are evolving quickly. While companies have an increasing responsibility to investigate employee or even board misbehavior, they are also facing a legal landscape that is changing rapidly. It's clear the American public is deeply worried about the privacy of its financial, Web search, and, yes, telephone records.
Should HP be guided by what it and its lawyers believe is legal, or by the sometimes ambiguous standard of what is "ethical?" I believe HP has long been committed to acting"ethically," not just legally, and it would give up a major portion of its reputation by choosing mere legality as the standard.
FORCING THE BOARD'S HAND.
What should you do when a report to the board is based on private telephone records? We know only about director Tom Perkins' reaction when the board was presented with the report fingering George Keyworth as the leaker. Perkins slammed down the cover of his briefcase and immediately resigned. What should other board members have done?
I believe every member of the board should have been concerned that the report was based on private phone records, and recognized this was an ethical problem. That could have enabled the HP board to have moved quickly to clean up its own mess before Perkins forced its hand several months later through a flurry of letters and e-mails.
Do you apologize for what happened? Who should apologize and to whom? At what point in the emergence of a scandal is an apology warranted? How much "blame" does the company admit? I believe HP was a bit slow apologizing to board members and employees for the invasion of private phone records. To say one was "appalled" at the methods falls short of an apology. The board chair and management spokesperson should have apologized early and often.
Should anyone be punished? One of the fundamental ethical turning points is whether anyone is held accountable and whether the punishment fits the crime. You hope that any penalty communicates an unambiguous message about the values of the company and its commitment to accountability. I fear HP gave at best a mixed signal. Apparently the board concluded Dunn did something wrong but it was unclear what, and it's unclear why stepping down in January and then remaining on the board was the appropriate punishment.
Should HP explain to its employees and to the public exactly what steps have been taken to prevent a recurrence? I believe it must do this to quell the anxiety of employees who fear that their phone records could be examined next and to relieve the worry of HP customers that the data HP keeps on them might be used against them.
Should you also purloin the phone records of reporters? Sorry, the answer to this one is so obvious that you get no credit for saying: "No, they should not." This merely insured that negative media attention would follow.
Above all, I believe past episodes—from the tragic poisonings of Tylenol buyers 25 years ago to the spate of corporate scandals that began with Enron in 2002—have established a clear standard for the management of ethical scandals and other corporate crises. The four principles are a) tell everything you know as you learn it; b) apologize early and often; c) punish those who are guilty; and d) state clearly what the company has done to make another such incident unlikely. Unfortunately, the HP board stumbled on several of these.
Hanson is a university professor and executive director of the Markkula Center for Applied Ethics. He taught business ethics for 23 years at the Stanford Graduate School of Business before becoming head of the Markkula Center.