A Massachusetts company called Security Outsourcing Solutions was involved in HP's investigations, the SF Chronicle reports.

According to the Chronicle's Ben Pimentel, one individual at SOS has been identified as being involved - Ronald DeLia, managing director for SOS's Due Diligence practice. According to the company's Due Diligence.com site, DeLia's group offers such services as:

An investigative tool that provides a business profile of a company, its Officers & Directors and meets standard investigative Due-Diligence background requirements.

An in-depth background inquiry into a company, its Officers, Directors, subsidiaries, corporate affiliations, finances, and reputation.

The Chron story notes that it's not known whether the company was hired directly by HP or was a subcontractor. But the company's site makes clear that it is an outsourcing broker for security services.

When it is determined that specialized services are required we select a firm from our network of affiliated companies to provide the services. Our in-depth knowledge of the security industry insures that our clients receive the most favorable rates from our affiliates. It is important to note that Security Outsourcing Solutions, Inc., does not accept any form of compensation or gratuities from its affiliated firms. Affiliated firms are selected solely on the basis of their expertise, reputation and quality of work product. We work closely with our client in managing the activities of the affiliated company providing the specialized services. We continue to do so until a suitable resolution to the security issue is obtained. Our unique business model incorporates long distance support through technology, our network of affiliates and personalized service. Our ability to access our world wide network of affiliated firms is one of Security Outsourcing Solutions most valued assets.

The New York Times' story notes that the investigations biz has many layers and that SOS is a tiny firm operating from a "small yellow house" in suburban Boston. So there must have been other companies between HP and SOS.

“I’d be dumfounded if you could find a corporation the size of H.P. that turned directly to the pretexter,” said Rob Douglas, an information security consultant who has testified to Congress about illicit tactics used to obtain telephone records. He added that these investigations “have middlemen and are layered.”



Mr. Douglas said it was not clear whether the layering in this case was intended as a way to shield company executives, or was just the way the process worked, with one step leading to another until a specialist in obtaining phone records was needed.