November 2010 White Paper: Social Media - The Dark Side by Elias Vamvakas President, BrandProtect a division of brandprotect
Understanding the Value of a Social Media Risk Management Program As Social Media has become a part of everyday life, we all are starting to believe that it may be as transformational to society as the introduction of the internet. It has become the new internet for most people and it s certainly indistinguishable by today s generation. What is even more There are thousands of articles and blogs available to help companies ride the waves created by the Social Media Tsunami. The focus of this article is to help companies learn how to prepare, prevent and even eliminate the devastation that such a Tsunami can bring. transformational is the adoption of Social Media by the 55+ crowd who appear to have embraced social media in spite of their fear and avoidance of mainstream internet usage, in order to stay in touch with their grandchildren and friends. There are three components: 1. What is Social Media and how can it impact you negatively? 2. How can you establish an appropriate Social Media Risk Prevention Program 3. Can you really minimize the risk and eliminate Social Media Threats Let s start from the beginning. What is Social Media and how can it impact you negatively? There is significant confusion on what constitutes Social Media. Many people assume that all internet content is considered social media, while others see Social Media Unfortunately, like every great leap in technology, the positive benefits and opportunities created are matched by the dark side of human ingenuity to create havoc and generate unearned personal benefit. Social Media has given corporations the power to communicate with their customers, solicit feedback to create better products and offer previously unattainable levels of service. It has allowed friends and families to stay connected and share life s special moments. Unfortunately, it has also created a vehicle where personal information is always at risk, identities can easily be stolen and both customers and employees can legally blackmail as only the portion where individuals congregate to get information, chat, keep in touch or just render their opinion. While Social Media sites like Facebook or Twitter are icons of Social Media, the reality is that the lines have blurred. Are Blogs individual expressions of opinion, or just daily updates of a friend s adventures? Is YouTube just a website for posting videos, a search engine (now considered the world s second largest), or a Social Media site? These questions lead us to conclude that the entire web has been transformed into a place where individuals congregate to get information, chat, keep in touch, or just render their opinion. anyone with a simple $50 video camera. So how could that possibly be a bad thing? Let s now examine the dark side of Social Media.
What is Social Media and how can it impact you negatively? Internet / Social Media threats can be characterized in 3 major areas: 1. Identity Theft 2. Brand or Intellectual Property Abuses 3. Malicious Discussion Before going into more detail, let s clarify what is considered to be a threat. In the world we live in today, you are your reputation. In the marketing world we would call this your brand. A threat is anything that will negatively impact your REVENUE, RIGHTS or REPUTATION. Identity Theft: Identify Theft is most well-known, because it is pervasive. Your identify can be stolen by an unknown individual or entity, gaining access to your financial assets and bank accounts. Identity Theft takes on two primary forms: Phishing (misleading emails hoping to entice you to divulge personal information such as account numbers and passwords), and Malware (a piece of code that is downloaded onto your computer when you click on infected websites or emails, ultimately taking over your computer, sending private information to pre-identified locations). While these attacks have traditionally targeted major financial institutions, the new security measures being incorporated by them are forcing cybercriminals to move to easier targets. Smaller organizations, that have not as yet invested in security measures, either because of awareness or financial limitations, are the new targets of choice for cybercriminals. If you sell products online, if you take credit cards, or if your customers have to log in to your website, you are at risk, and you must have a risk management program in place. It is not just the prudent thing to do, it is also the law. Great article: https://www.internet911.com/downloads/the- Brand and Intellectual Property Abuses These abuses come in many forms, and note that in some instances, the source is purely accidental. Here are some examples: 1. Competitor registers a website that is similar to yours to divert your traffic 2. Competitor uses your brand, produce, images and/or name to sell a competitive product or counterfeit imitation. 3. Companies use your brand or logo to infer a relationship or association with your company or product. 4. Companies use your brand and reputation to attract potential customers to their website or their products 5. Employees expose classified information, intellectual property or even financial information through unsecure email, or while downloading personal information through peer to peer networks. Malicious Discussion: While the name malicious discussion implies intent, in most cases these threats are innocent, and in many cases, accidental. Unfortunately, they usually end up being the most damaging to a company s reputation, creating long term repercussions. Case-for-Internet-Brand-Governance.pdf
Establishing an appropriate Social Media Risk Prevention Program Malicious Discussion con t: Here are some examples: 1. Employee is upset with boss and goes home and tells all his friends online how terrible they are. He describes them as cruel and unethical, claiming how they treat their customers even worse than their employees. 2. A waitress at a golf club tweets about the intoxicated member who propositioned her last night. 3. A worried employee tells her mother that business is terrible and if things don t improve they may not have enough money to pay her or any of their creditors. 4. The excited receptionist at the doctor s office can t wait to tell her online friends that a public figure just came in for a pregnancy test. 5. Two employees decide to make a YouTube video of how they add special off the floor ingredients to every pizza they deliver. The list can go on, but as you can appreciate, any of these situations are possible. In fact, with the popularity of Facebook, Twitter, YouTube and the iphone, it is more than likely that such issues will occur often. Can anything be done about it? Absolutely!!! First and foremost, you need to be prepared. You need an appropriate Social Media Risk Management Program that includes the implementation of the right policies and procedures, and a process for identifying, analyzing and implementing a strategy to eliminate threats! Establishing an appropriate Social Media Risk Prevention Program There are three key elements to a good Risk Prevention Program: Prevention, Monitoring and Response. Prevention: An appropriate prevention program is the key to creating an effective Risk Management Program. What are the key components to a prevention program? 1. Appropriate policies and procedures: Having clear, comprehensive corporate policies and procedures, communicated to all employees, is an essential first step. As an example, if you want to reduce the risk or even take down a threat that was generated by one of your employees, it is essential that a policy is in place that restricts your employees from posting private or confidential corporate information on social media sites. 2. Identify the individual in your organization that is responsible for protecting the company s brand and reputation: Identify your CRO (Chief Reputation Officer) and his/her emergency response team. In many cases, the team includes the CEO the CFO and head of Sales/ Marketing. The worst time to try to figure out who should coordinate a response is after a threat has been identified. 3. Determine a process for analyzing the threshold that must be crossed for a threat to require action.
Establishing an appropriate Social Media Risk Prevention Program Monitoring: Monitoring can take many forms and can encompass a variety of internet search tools. Many of them are free. http://www.socialmediamonitoring.ca/monitoring_ tools_directory.html Respond: The ability to respond to threats is critical within a Social Media Response Program. It is generally believed that nothing can be done to eliminate Social Media threats, but that is not accurate! QUICK and DECISIVE action is required for an effective result. Given the magnitude of internet content, it s important to manage expectations. There is no way to search everywhere and monitor everything. There is no perfect tool, and you will need to go through a fair bit of junk. One of the most important elements of successful monitoring is picking the right search terms. This is somewhat of an art. You will know you have done well if your monitoring tools provide you more than 30% relevant data. (Live real-time help in this area from your Monitoring Service Provider is a significant bonus.) Monitoring should include forums, news, websites, pictures, videos and Domain registrations. Domain/URL registrations are not generally a part of normal search engines, since they are a unique service normally accessible only by registrars and brand protection companies, but critical to protecting your reputation. This is where vigilante consumers create havoc by registering websites like yourcompanysucks. com or yourcompanydisaster.com or ihateyourcompany. com. It is important to find these kinds of sites, as soon as possible, to minimize the damage they can cause. Eliminating Social Media Threats Contrary to general opinion, Social Media Threats can be eliminated! As a minimum they can be mitigated or minimized. The extent of damage a particular incident will cause, is determined by 3 factors: More importantly than just the search capabilities are case management functions that need to either be included in your program or supplemented with internal processes. We may want to consider these case management tools as part of the RESPOND program. Being able to manage, track and share information is critical, as threats will most likely span several members or functional areas of an organization. In addition, the ever-changing nature of the internet requires the ability to store a copy of offending websites and postings in a permanent, structured database for benchmarking purposes, or support a take-down process or litigation. 1. The comprehensiveness of the company s prevention measures 2. The level of analysis and expertise available to deal with the incident 3. The company s ability to act quickly and decisively BrandProtect has developed a formula for dealing with Social Media issues that will minimize, and in most instances, eliminate Social Media and other reputation threats.
Eliminating Social Media Threats The process begins with the recognition that threats can be eliminated using one of the following 4 Action Strategies 2. Respond to minimize or neutralize the threat: Getting your side of the story out is a natural response to online threats: assuming you have something to say. This 1. Turn the threat into an Opportunity 2. Respond to minimize or neutralize the impact 3. Remove the threat 4. Bury the threat is a very good strategy. Making sure that the response is appropriate, respectful and honest is key. A critical element to neutralizing a threat is making sure that the response has had the same amount of traction as the actual threat. You need to know all the sites that the initial threat was posted We have developed the I5 process as a systematic tool to help make quick decisions. The entire Emergency Response on, and make sure that the response is easily found and available in all of the corresponding social media sites. Team, including external advisors, lead by the CRO (Chief Reputation Officer), should go through the I5 process as soon as a major threat has been identified. 3. Remove the threat: This is the most common approach employed for comments, blogs and websites that are inaccurate, offensive, or use a The process requires the Team answering the following 5 questions in detail: 1. What are the facts associated with the situation? 2. What internal issues/factors are controllable by us? 3. What external issues/factors are not controllable by us? 4. Identify risk scenarios. What is the worst thing that could happen to us? What is the best thing that could happen to us? 5. Choosing an Action Strategy from above. Identify actions that are needed to mitigate or stop the worst thing that could happen, and formulate a plan to try to achieve the best thing that could happen. Examples of how Action Strategies have been used company s brand and intellectual property inappropriately. This can be done by legal means or by asking the person who posted the offensive material to remove it. All legitimate social media sites have a dispute resolution process that is appropriate and fair for inappropriate content. We have found that in most cases (80%+), a simple letter properly drafted and sent to the right person is all that is needed to remove offensive material. Only inappropriate threats will be removed in this way. Opinions that are founded on fact will not be easily deterred. Mitch Joel was recently quoted saying, You can t stop people from telling other people that your product sucks, if it does. Make your product not suck first! successfully to eliminate or mitigate Social Media Threats. 4. If you can t eliminate it, than bury it: 1. Turning a threat into an Opportunity: Domino s Pizza was severely criticized for the poor taste of their pizza and the fact that their crust tasted like cardboard. Rather than trying to fight the negative media, they chose to embrace it and use the negative comments as a rallying No one reads page 17 of a Google search. There are multiple strategies that can be employed to move offending data to the back of the bus. By leveraging organic and paid for search engine optimization techniques, you can ensure that the message you want to be heard cuts through. point to rejuvenate their brand and their company. They launched a very successful social media campaign that literally changed the company. http://www.youtube.com/ watch?v=ah5r56jilag Through understanding Social Media, its potential risks and your options in responding to these, organizations can indeed prepare, prevent and even eliminate their potentially devastating effects.
About Us internet911 Internet911 is a Social Media Risk Management Program for small to mid-sized companies, offered by BrandProtect, the leader in internet threat management. It s a combination of policies and procedures, technology and services that help Prevent, Monitor and Respond to incidents on the internet. brandprotect For over a decade, some of the world s largest and most security sensitive organizations have been relying on BrandProtect to mitigate their online threats and protect their revenues, intellectual property rights and reputation. Our customers include global brands and leading financial institutions, including five of the top 10 banks in the world, as well as many small and mid-sized organizations. Toronto Headquarters 5090 Explorer Drive, Suite 203 Mississauga ON Canada L4W 4T9 As members of the International Forum of Incident Response Security Teams (FIRST), we work alongside organizations such as Visa, the U.S. Air Force, IBM, Microsoft and Deutsche Bank to define and implement online protection and response policies and procedures. We also have relationships with over 4,000 Internet Service Providers around the world, currently supporting over 90% of Internet traffic. This, combined with our knowledge and expertise which includes dealing with Social Media Issues, helps us to manage and mitigate internet threats quickly and effectively. Local Telephone: 905.271.3725 Local Fax: 905.267.3163 Fax Toll Free: 1.866.721.3725 Mon - Fri 9AM to 5PM (EST) http://www.internet911.com http://www.brandprotect.com http://www.threatblog.org