PR and Cybersmear Campaigns How to avoid and fight online reputation attacks against your clients…what every PR professional needs to know Parry Aftab, Esq. parry@aftab.com 201-463-8663 For NETA Communications Council November 16, 2005

What is a cybersmear campaign? It’s an organized campaign designed to intimidate, harass or adversely affect the reputation of a company or representative of that company It may start out innocently or as an angry communication, but builds to have a potentially serious affect on the business, operations or reputation of the company or its representatives It may start out small and build with the help of unwitting accomplices manipulated into supporting the campaign

How does it work? Rumors and innuendo Stock manipulation Personal attacks and harassment Cyberstalking and cyber-harassment Posing and impersonation Cybersmear by proxy Communications with key stakeholders Anonymous defamatory statements Getting competitors and regulators involved

Cybersmear and the Law Defamation TOS violations, acceptable use policy violations Cyberstalking and harassment SEC violations Regulatory violations False light and common laws Intellectual property crimes and violations Hacking, cyber-espionage, unfair trade practices and fraud…Oh! My!!

What can anyone do about it? The best time to consider this is BEFORE it occurs Create a cyberattack committee or team Keep a cyber-eye out for anything posted online about your company, key executives and employees and products Alert your IT people to watch for SPAM referencing any of the above Terminate access for any problematic employees, agents and contractors Monitor employee communications and set rules about permitted and inappropriate technology uses Google your company and watch the blogs (feedster.com and other similar service)

The role of the PR professional in protecting the reputation of the client PR is crucial and should help lead in these issues PR must be a member of the cyberattack team and help identify crisis spokespeople PR must maintain credibility with industry and mainline media and press PR must deliver the message positively, without feeding the misinformation PR needs to be well-informed about the company’s operations, businesses and strategies PR needs a good working relationship with legal and IT, as well as management PR needs to identify possible breaches and targets PR has to think like an attacker…how would you attack reputations and business?

Anatomy of a cybersmear Sounds plausible Builds on provable facts and statements Relies on anonymity of the attacker Relies on the gullibility of certain media and others online, like influential bloggers Gives a suggested outcome and suggested places to launch attacks Targets key stakeholder within and without

Things you can do in advance… Register the URL of all permutations of your brands Register all permutations of your brands in blogging services Register all of the above with “bash,” “hates,” “sucks” or similar terms Get online and after-hour contact information for media, press and key stakeholders – analysts and shareholders, major ISPs, and police Inform senior management and unions, as well as board members of the possibility of cybersmear and what to do if contacted Put in systems to collect evidence and work with IT on tracing methods and with legal on subpoena execution

Selling it to Management Find ways to prove the value to management – upside and downside Fear and greed motivate Find the ROI, get legal, HR, risk managers and IT on your side Do some research Do some sensitivity training on online reputation risks – tie it to cyberharassment and cyberbullying in the media

Cyberattack Team Make-up PR Legal, consumer relations and HR Brand managers Marketing IT and website/services management Insurance and risk managers Corporate communications (if separate from PR) Senior management and at least one board member

Understanding the Cyber-Breadcrumbs Everyone leaves behind an IP address Static and dynamic IP addresses Civil subpoena or law enforcement subpoena process Preserving the records How to read a header – what it shows

Things to think about Insuring the risk Early warning systems with IT and HR If monitoring employees, check with unions Tracking news releases about your client Holding seminars and workshops within the company to raise awareness Learning more about the problem

To contact me or for more information parry@aftab.com www.Aftab.com www.ThePrivacyLawyer.blogspot.com The Privacy Lawyer column for Information Week Magazine (informationweek.com) 201-463-8663