UPDATE: Here's a reference, at the very end, spotted by Sean, which indicates HP has been "informally contacted" now also by the United States Attorney's Office for the Northern District of California:

Item 5. Other Information. As reported in a Current Report on Form 8-K filed by HP on September 6, 2006, we recently have been informally contacted by the Attorney General of the State of California requesting information concerning the processes employed in an investigation into possible sources of leaks of HP confidential information. In addition, since the filing of that Form 8-K, we have been informally contacted by the United States Attorney's Office for the Northern District of California requesting information similar to that sought by the California Attorney General. We are cooperating fully with these inquiries.

Now a House committee is asking HP for records too, according to MarketWatch:

The House Energy and Commerce Committee on Monday asked Hewlett-Packard Co. to turn over records and information related to the company's reported effort to obtain private phone records. The committee said the request is part of seven-month subcommittee inquiry into data brokers and the practice of "pretexting" to obtain access to certain information. In a letter to H-P Chairwoman Patricia Dunn, the committee said it was "troubled" by the news that company had used firms to obtain phone information about H-P directors and others. The panel requested, among other things, the names of the firms used by H-P in connection with its internal investigation, and the names of the people who were targets or subjects of the probe.

According to Ina Fried's article on CNET, they want to know everything you want to know, and maybe more. And they set a date of September 18 to have the records provided. And here's a bit of detail on the letter the FCC sent AT&T:

The Federal Communications Commission on Thursday sent a letter of inquiry to AT&T Inc. in connection with allegations that Hewlett-Packard Co. gained access to the AT&T phone records of H-P directors through fraudulent means, according to a person familiar with the matter.

The letter comes two weeks after the FCC was asked to investigate whether any telecommunications laws were broken. In an Aug. 23 letter sent through his lawyers, former board member Thomas Perkins told the FCC that Hewlett-Packard had hired an outside firm "in order to spy on its own directors by fraudulently gaining access to their personal calling records." An FCC spokesman declined to comment, but said that the issue of "pretexting" is a "high priority" for FCC Chairman Kevin Martin. A letter of inquiry is the first step toward a formal investigation.

It just keeps getting bigger. Here's what I've concluded: you don't ever want Tom Perkins to get mad at you.

Here's what the House committee is asking for, from the Fried account:

It asked for the name and identity of the outside company used by HP; contracts and other documents related to the investigation; a list of all third parties hired by HP or its investigation company; a full list of targets or subjects of the investigation; a list of all individuals that were part of or knew of the investigation; and a list of all those whose telephone records or other information were procured, or attempted to be procured, from Jan. 1, 2005 to the present.

In addition, the committee is seeking other information, including a copy of HP's letter of engagement with its outside law firm, Wilson Sonsini Goodrich & Rosati, in regard to this matter. It has also asked for all reports prepared as part of the investigation, including any outside opinions HP may have received about the appropriateness or legality of the practice of pretexting. The committee also wants any draft and final board minutes that relate to either the leak investigation or the inquiry by HP's nominating and governance committee.

By Sept. 25, the committee also wants all records related to either the leak investigation or the governance committee inquiry, including but not limited to communications to or from the outside consulting firm, communications by or between HP employees or board members, and communications to or from outside counsel.

There is a section in the 10Q that talks about indemnification of directors:

Some anti-takeover provisions contained in our certificate of incorporation and bylaws, as well as provisions of Delaware law, could impair a takeover attempt.

We have provisions in our certificate of incorporation and bylaws, each of which could have the effect of rendering more difficult or discouraging an acquisition of HP deemed undesirable by our Board of Directors. These include provisions:

• authorizing blank check preferred stock, which HP could issue with voting, liquidation, dividend and other rights superior to our common stock;
• limiting the liability of, and providing indemnification to, HP's directors and officers;
• specifying that HP stockholders may take action only at a duly called annual or special meeting of stockholders and otherwise in accordance with our bylaws and limiting the ability of our stockholders to call special meetings;
• requiring advance notice of proposals by HP stockholders for business to be conducted at stockholder meetings and for nominations of candidates for election to our Board of Directors;
• requiring a vote by the holders of two-thirds of HP's outstanding shares to amend certain bylaws relating to HP stockholder meetings, the Board of Directors and indemnification; and
• controlling the procedures for conduct of HP Board and stockholder meetings and election, appointment and removal of HP directors.

These provisions, alone or together, could deter or delay hostile takeovers, proxy contests and changes in control or management of HP. As a Delaware corporation, HP also is subject to provisions of Delaware law, including Section 203 of the Delaware General Corporation Law, which prevents some stockholders from engaging in certain business combinations without approval of the holders of substantially all of HP's outstanding common stock.

If the directors are indemnified by the company, as is indicated here, then I wonder if that might not represent a risk, given all the legal clouds on the horizon now regarding the leak probe. I realize that they disclosed the matter in the recent 8K, but wouldn't it belong in the 10Q also? I'm no SEC expert, as you know, so I don't know what it all means or what one must file in a 10Q. But it's hard for a normal person, just reading this, to not be puzzled. If I were a shareholder, I think I'd want to know that the company could conceivably have some fines or legal expenses as a result of the leak probe gone wild.

Then there is this section:

Item 4. Controls and Procedures.

Under the supervision and with the participation of our management, including our principal executive officer and principal financial officer, we conducted an evaluation of the effectiveness of the design and operation of our disclosure controls and procedures, as defined in Rules 13a-15(e) and 15d-15(e) under the Securities Exchange Act of 1934, as amended (the "Exchange Act"), as of the end of the period covered by this report (the "Evaluation Date"). Based on this evaluation, our principal executive officer and principal financial officer concluded as of the Evaluation Date that our disclosure controls and procedures were effective such that the information relating to HP, including our consolidated subsidiaries, required to be disclosed in our Securities and Exchange Commission ("SEC") reports (i) is recorded, processed, summarized and reported within the time periods specified in SEC rules and forms, and (ii) is accumulated and communicated to HP's management, including our principal executive officer and principal financial officer, as appropriate to allow timely decisions regarding required disclosure.

Under the supervision and with the participation of our management, including our principal executive officer and principal financial officer, we conducted an evaluation of any changes in our internal control over financial reporting (as such term is defined in Rules 13a-15(f) and 15d-15(f) under the Exchange Act) that occurred during our most recently completed fiscal quarter. Based on that evaluation, our principal executive officer and principal financial officer concluded that there has not been any change in our internal control over financial reporting during that quarter that has materially affected, or is reasonably likely to materially affect, our internal control over financial reporting.

That drew my eye, only because of the dispute with ex-director Thomas Perkins over whether HP originally appropriately filed full information about his resignation back in May. I went to the SEC originally to try to find something Forbes mentions today in its article on the leak probe mess:

Hewlett-Packard (nyse: HPQ) also said Monday it was "informally contacted" by the California attorney general's office and U.S. Justice Department requesting information concerning the company's investigation into press leaks. In a filing with the Securities and Exchange Commission, Hewlett-Packard said it was "cooperating fully" with the inquiries.

So, the US Justice Department is in this picture now too, if Forbes is accurate. I couldn't immediately find the filing substantiating this report, but it may not yet be digitally available. [Note Update.] Here's HP's Privacy Policy, by the way, and for completeness its Standards of Business Conduct.

And here are the Bylaws [PDF]. The indemnification clause, beginning on page 17, is very broad, in that it appears to cover both civil and criminal matters "against all expenses, liabilities and losses (including attorneys' fees, judgments, fines, ERISA excise taxes or penalties and amount paid or to be paid in settlement) reasonably incurred or suffered by such person in connection therewith and such indemnification will continue as to a person who has ceased to be a director, officer, employee or agent and will inure to the benefit of his or her heirs, executors and administrators; provided, however, that except as provided in the third paragraph of this Section 6.1, HP will indemnify any such person seeking indemnification in connection with a proceeding (or part thereof) initiated by such person only if such proceeding (or part thereof) was authorized by the Board of Directors...."

So, was the pretexting "authorized by the Board of Directors" or not? What about the investigation? If not, do they all have to pay out of their own pocket? Things that make you go hmm. I see here an escape hatch for HP, at least a conceivable one, if it does not wish to pay for all these investigations and any criminal or civil litigation expenses that may flow from the leak probe.

Finally, here's the company's board of directors' statement about yesterday's telephone meeting:

HP Board of Directors Releases Statement
PALO ALTO, Calif., Sept. 10, 2006

The HP board of directors met for several hours Sunday morning. It has agreed to reconvene late Monday afternoon. No further statement will be forthcoming from the company before that time.

About HP

HP is a technology solutions provider to consumers, businesses and institutions globally. The company's offerings span IT infrastructure, global services, business and home computing, and imaging and printing. For the four fiscal quarters ended July 31, 2006, HP revenue totaled $90.0 billion. More information about HP (NYSE, Nasdaq: HPQ) is available at http://www.hp.com

Update 2: Nell Minow, editor and co-founder of The Corporate Library, on MarketWatch says the media is missing the point, that leaks of this kind are serious:

It seems clear that it crossed the boundaries of acceptable conduct. "Pretexting" is the wrong word. It should simply be called "fraud." But let's not lose sight of the original breach of trust, the unilateral decision by one director to reveal confidential information, deny that he had done so, and then refuse to resign when he was found to have been responsible. It is a shame that the steps this board took to begin to repair its dysfunction have created another public mess. But now is when we see whether this board is ready to earn shareholders' trust. It would be a mistake to ask Dunn to resign until the full story is on the record. The board should retain outside counsel to prepare a full report, including the name of the firm that did the investigation and the level of supervision they were operating under. The directors should make themselves available to investors to listen to their concerns and answer questions, including how they plan to work with now-acknowledged leaker Keyworth until the end of his term. And the press should think about how they would feel if they felt that everything they said in confidence might appear in the press the next day thanks to an anonymous link.

Bloomberg has details regarding Dunn's career:

Some governance specialists say Dunn's biggest failure at Palo Alto, California-based Hewlett-Packard was a lack of oversight -- not knowing how the investigation was conducted.

"She may have been naive," Franklin Edwards, a professor of corporate governance at Columbia University in New York, said last week. "But all of that says she shouldn't be chairman."

As for CEO Mark Hurd, more information was revealed today by HP as to what he knew and when he knew it:

H-P said Monday that Hurd learned of the investigation in March, but that he was only told of the results of the investigation authorized by Chairwoman Patricia Dunn, not the tactics.

"Only in recent weeks did he come to understand that techniques of concern to him were deployed, and deployed toward journalists," according to a statement by the company. "Mr. Hurd rejects such methods and reiterated that these methods will not again be used at H-P."

That statement raises the question: so who did know? Did no one have oversight? If no one had oversight and no one knew, then was it a procedure authorized by the Board? If not, I think everyone, like Ms. Dunn, would have to pay their own legal bills, at least according to the ByLaws. The Board can change the ByLaws, according to the Certificate of Incorporation [PDF], but can they make it retroactive, so anything can happen that HP wants to happen? The trouble with secretive spy stuff is, the usual safeguards are not necessarily there for you if it all goes south.

I can't help but notice that it wasn't the CEO who saw any need to investigate the methods, when he was informed of the results of the investigation in March. It was apparently only Tom Perkins who cared about the how of it, when he learned the results in May. From March to May, did no one in this company wonder how the results were obtained and then about the legality of obtaining other peoples' phone records?

UPDATE 3: Wall St. Journal has this tidbit:

One person who has spoken with Mr. Hurd since the scandal broke says the CEO is eager to move beyond the imbroglio as quickly as possible. Mr. Hurd considers the matter "clutter," this person says, and wants to return to the business of running H-P.

It isn't clear specifically what H-P's board is discussing and why it needs another day for its deliberations. H-P may be trying to negotiate legal resolutions, possibly with Ms. Dunn or with Mr. Keyworth and former H-P director Thomas Perkins, who resigned his seat in May in protest over the leak investigation. In a statement this weekend, Mr. Perkins, a Keyworth ally, called for Ms. Dunn to resign and said, "Each day the hole gets deeper. Recent statements by Ms. Dunn have only served to increase both her own and the company's legal exposure."

According to The Age, the FBI is involved now too:

Now the FBI and the U.S. Attorney's Office for the Northern District of California have convened their own inquiry, issuing a statement Monday saying they were "investigating the processes employed in an investigation into possible sources of leaks."

And Macworld pinpoints a bit more:

A spokesman for the U.S. Attorney’s Office in San Francisco, Luke Macaulay, said the Federal Bureau of Investigation is joining the U. S. Attorney in “investigating the processes employed” by HP.

Update 4: Frank Hayes tells an interesting anecdote on ComputerWorld and has a diagnosis -- HP needs "a values transplant":

Last year, just after Carly Fiorina walked away with $21 million in severance pay, I ran a letter in my column from a demoralized HP employee. ... A week later, an HP manager asked me, "Who was your source?" At the time, I was more amused than offended. Of course, I didn't identify the source, whose only crime was grumbling without a license. And I wrote off the question as coming from a gung-ho manager who didn't realize how out of line it was -- how completely contrary to everything that HP is all about. Looks like I was wrong....

HP needs a values transplant. Hard as it is to believe, the company that once was the epitome of wise management in the IT business has become a corrupt, dysfunctional travesty of itself.... We know now that an HP that will chase after grumbling employees in 2005 will lie to get phone records of its board members in 2006. And in 2007?