Was it appropriate for HewlettPackard to engage in an internal investigation to determine the identity of the person who was leaking confidential information? Should reviewing authorities - Congress and regulatory agencies, for example - give corporations broad authority to conduct internal investigations using whatever tools may be necessary to answer questions regarding violations of compliance policies or procedures? Or should they place limits on internal investigations in order to protect employees' privacy? Was it acceptable for HP to use a pretext to identify George Keyworth as the individual leaking information regarding confidential board deliberations?