Cyberattack Archives - Charlie Pownall 查理·保诺

It is a trusim that every high-profile incident or crisis is accompanied by a tidal wave of rumour and misconception. This has always been the case, but nowadays the volume, intensity and power of false stories and fake news means every company has to work much harder to ensure what is being said about them is accurate and fair.

As Facebook can attest to the scathing reaction to some of its senior executives using social media to correct reports describing the harvesting of 50 million or so user profiles by SCL Group/Cambridge Analytica as a ‘data breach’, clamping down on rumour can feel as futile as chasing ghosts. It can also be as perilous.

https://twitter.com/boztank/status/975018461997887494

Legally and technically, Andrew Bosworth (@boztank) and his colleagues were correct – this was not a data breach. The profiles had been misappropriated rather than stolen, and precision is required from a security, legal and communications perspective.

That said, the average Facebook user has little interest or understanding of the difference between a cyber attack, data breach, data loss or data leak. She wants to know what has happened to her data, and how its unintended use may affect her. Bosworth’s intervention made Facebook appear unnecessarily touchy, defensive and inward-looking.

Worse, it rebuttal served to highlight the real, underlying issue: Facebook’s apparently cavalier approach to collecting and profiting from its users’ personal information in ways most people have little understanding of.

Handling rumour and speculation is not about pouncing ruthlessly on every misconception or tall story – it is necessary to box clever, especially when the eyes of the world are on you.

Here are five basic but important things to remember when punching back against fake or partially fake stories during a crisis:

1. Pick your target carefully.

You could spend much of your time dealing with clearly inaccurate, wilfully misleading or entirely false news in a crisis. As we have seen, a misjudged intervention can easily prove counterproductive. My advice is to focus on those rumours that you know are untrue and which may cause real long-term damage to your company’s reputation due to the plausibility of their claims and the credibility of their advocates. And to ignore rumours that are clearly absurd, irrelevant or that matter little in the broader scheme of things and to which a response will likely come across as nitpicking or needlessly defensive.

2. Speak clearly and unambiguously.

If you do decide to respond to a rumour in a crisis, make sure your position is clearly expressed and in a language that everyone from the technical expert to the bemused member of the general public can understand. Little irritates and alienates people more than a put-down full of weasel wording, legalese and jargon. Or one that fails to tackle the issue in a straight-forward manner – as demonstrated by the hostile reaction to a series of Twitter-based rebuttals by Cambridge Analytica in the aftermath of Channel 4’s first investigatory video into its dealings with Facebook.

MYTH #5: CA uses fake news.
REALITY: We do not. Fake news is a serious concern for all of us in the marketing industry. Malicious actors are using the same digital marketing tools that ad agencies use, and that's deeply worrying for everybody.

— Cambridge Analytica (@CamAnalytica) March 20, 2018

3. Understand others’ opinions and limitations.

There will be times when you strongly believe your company is innocent or is being unfairly maligned in a crisis. In such instances, it is tempting to hit back as hard as possible. There are good reasons to resist this urge. Some people may not understand what is necessarily a complex situation or topic. Others will struggle to give you the benefit of the doubt based on their personal experiences and interactions over the years. And nobody appreciates being told what to think.

Even if a crisis is not your fault you must accept that others are entitled to their point of view and explain your case in a way they can relate to and understand. This requires paying close attention to the tone of your words and making sure you are not seen as arrogant, patronising or antagonistic at any time.

If success breeds envy and scrutiny, then so be it. There are countless firms that have used our tactics to get information on target customers. More in @Forbes: https://t.co/lb9re88E9j

— Cambridge Analytica (@CamAnalytica) March 19, 2018

4. Support your position clearly and in a human way.

Today’s distrustful business and political environment means words alone may be insufficient to quell a rumour. Rather, it is necessary to buttress your case with compelling evidence. Better still that respected third-parties are willing and able to support your argument in the mainstream media and online.

And the more human you can appear the better. Mark Zuckerberg may have been conspicuously absent from Facebook’s response to its current data privacy crisis over the past few days and while he has been accused of hiding behind his Facebook page he has used it successfully in the past to set the record straight by answering questions and generally giving the impression he is available and willing to talk.

5. Provide a visible call to action.

Whichever way you choose to rebut a rumour or misconception, it is important to provide people with an easy way to get further information. This might be an email address, telephone number or URL that directs people to a news article or dedicated crisis website or page containing your statements, plans, FAQs and other resources. Whatever it is, signpost it clearly on your homepage and media statements, and work it into your tweets and other interactions.

Combatting false rumours is a real challenge for business owners and communicators at any time, and is particularly tricky during a crisis. A hard head and thick skin are useful attributes, but even more necessary is the ability to read the public mood and react in an appropriate manner, even when presented with the most jaundiced and outlandish views.

These five basic considerations will ensure you are in a decent position to stop rumour and speculation escalating and start convincing people of your side of the argument.

We live in the age of the leaky corporation – one in which the wrong information can easily slip into the wrong hands – be it from external cyber attack or data breach, or from malicious or careless insiders, partners or suppliers.

Some organisations continue to think a good way to minimise the likelihood of data breaches, leaks and losses is to restrict employee access to the internet and/or social media. This may sound sensible, but at what cost to an organisation’s ability to conduct research, share information and communicate externally?

I recently met with the regional communications lead at a major global bank who turned out to be the only person in his company in Asia with access to Twitter. Little surprise that the individual felt highly restricted in what he could achieve online on behalf of his employer.

So it was good to hear business and cyber experts on the HBR podcast argue that cutting internet access is a simplistic, impractical and ineffective solution to the problem of leaky data.

Rather, companies should focus on adopting strong cybersecurity policies, monitoring use of their IT systems and email, and raising awareness about common, insidious threats such as phishing and malware.

Such an approach has the additional benefit of letting communicators get on with the job of managing their employer’s reputation whenever and wherever they need to.