Last issue, we looked at privacy and I ended by asking how trustworthy should the vendors be from whom you buy your identity management products. This usually isn't a question that arises. It's not that the more dubious spammers or adware purveyors are getting into the identity management fields, but what one particular vendor in the identity management space is accused of brings this to mind.

<disclaimer> LavaSoft, maker of the Ad-Aware antispyware tool, defines its targets as "Datamining, aggressive advertising, parasites, scumware, keyloggers, selected traditional Trojans, dialers, malware, browser hijackers, and tracking components." I don't mean to associate any identity management vendor with those practices. At least not yet. </disclaimer>

The recent board scandals at HP have been front-page stories in the San Jose and San Francisco papers on many a day recently. Beyond that, they've been fodder for the New York Times, Wall Street Journal, and other prestigious nontechnical publications. It is alleged that HP used a number of unethical, and possibly illegal, methods to try to stop leaks of information from its various board of directors squabbles (the Compaq purchase, the firing of Carly Fiorina, etc.) over the past few years.

It's alleged that the company employed private investigators to engage in what's euphemistically called "pretexting." This is defined as "when a caller poses as someone else to obtain information" (See "FAQ: HP board scandal"). The investigators allegedly used this method to obtain telephone records of board members, HP employees and newspaper reporters.

Pretexting is, by the way, covered in the Gramm-Leach-Bliley (GLB) Act, written in order to protect consumers’ personal financial information held by financial institutions. As I just read in the white paper “Corporate governance and business continuity and availability,”: “The Pretexting provisions of the GLB Act protect consumers from individuals and companies that obtain their personal financial information under false pretenses, a practice known as ‘pretexting’.” The really interesting thing is that the paper was sponsored and published by … HP!

When someone "poses as someone else" in order to obtain banking or credit card information, though, it's called something else - identity theft. Do you really want your identity vendor to be an admitted identity thief?

Dave Kearns is a consultant and editor of IdM, the Journal of Identity Management.