White Paper Protecting Against, Preventing and Planning for Online Reputation Attacks
Today, consumers typically form first impressions of businesses based on what they read about them on the internet, particularly on search engines such as Google. In fact, according to a study released by PricewaterhouseCoopers in 2012, 80 percent of the 7,005 consumers interviewed worldwide indicated they researched products online before making purchases. And this figure was even higher, at 88 percent, among U.S. respondents. Naturally, given the rise in use of and reliance on smartphones since 2012, these numbers may be even greater. But more than consumers research businesses online; other parties including prospective employees/job seekers, investors, and even other businesses seeking B2B relationships do too. A business s online reputation often is that business s reputation. As such, online reputations truly matter, and to the extent possible businesses must try to limit or mitigate the effects of negative content that is published about them online. The problem, of course, is that businesses do not have as much control over their online reputations as they might have had several years ago. Given the rise in social media and the ability of anyone with internet access to publish content online whether on social media, a review website, a blog, or the comments section of a news article, for example businesses are incredibly vulnerable online today. This is because virtually anyone with a motive can seriously harm a business and its online reputation: competitors, former employees, disgruntled customers, ex-business partners and many others. Disgruntled parties often publish damaging online reviews on Google or Yelp, and the aggregate star ratings of each are displayed prominently in search results. One or two negative false reviews can greatly impact a company s star rating, which can create a misleading first impression of that company. Moreover, it must be factored in that consumers are increasingly trusting online reviews, meaning they may be wrongfully influenced by false information. According to Nielsen s 2002 Global Trust in Advertising survey of 28,000-plus people in 56 countries, online consumer reviews are the second most-trusted form of advertising. Yet, surprising to no one, many studies have shown that a large percentage of online reviews are false. Another common scenario that often plays out online is a bad-acting party publishing false content on a consumer complaint website such as Ripoff Report. Ripoff Report posts are particularly harmful because they tend to rank very highly in search results partially because of Ripoff Report s high domain authority and also because individual reviews have their own URLs. Yelp, on the other hand, aggregates all of its reviews for a particular business on a single business listing page, occupying just one URL. Moreover, Ripoff Report posts are difficult to remove, as Ripoff Report s policy is to never delete any content even if the author is otherwise willing to take it down or if a court rules the content is false and defamatory. With all of this in mind, it is critical that businesses work to prevent, plan for, and protect themselves against online reputation attacks, including false reviews. However, most businesses are not using best practices, as they are lacking the necessary knowledge or experience when faced with a dilemma. Moreover, the online reputation management market is filled with service providers, many of whom offer ineffective services or ones that create legal risks. Given the speed with which information can travel online, the tendency of bad news to spread virally, and the permanency of information online, responding to online reputation attacks is necessary even if often quite challenging. Moreover, people can post anonymously or pseudonymously, and many bad actors go much further in masking their identities such as by utilizing proxy IP
addresses which makes it difficult for harmed parties to pursue their claims. Thus, businesses must prepare for the fact that it may not be possible to stop others from attacking their reputations online, and that harmful information may be difficult to remove. Protection One way a business can protect itself online is by positively impacting its search results. This will thwart potentially high-ranking negative content. In the United States, most Internet users use Google to find information online. In fact, according to January 2015 data released by comscore, 64.4 percent of U.S. desktop search engine market share is owned by Google. When you add in that a 2013 study from Chitika revealed that 91.5 percent of traffic on Google is on the first page (32.5 percent for the first result and 50.1 percent for the first two results combined), it is easy to see why businesses should be concerned about the Google search results relating to them. Thus, a business should try to generate positive (or at least neutral) content to populate its first pages on Google, and simultaneously Bing and Yahoo! This can prevent damage from occurring by others publishing negative, and potentially false, content about the business that would otherwise rank highly on the search engines. There are several websites today on which people can attack businesses that, by their very nature, have significant search engine strength. This means content posted to those websites tends to rank well. Consequently, for businesses to successfully control their search results, they have to invest significant time and resources to create positive content which outranks the potential negative posts. This includes investing in a strong company website, possibly creating an affiliate website or websites (including a blog on which high quality content should be regularly published), establishing and utilizing social media profiles, and contributing guest articles on other quality websites. Beyond creating and maintaining high-quality websites, businesses should also consider having an active PR strategy that includes generating positive press stories and highlighting good company news through press releases. Press releases can pertain to anything newsworthy and can be submitted to various newswires and news organizations. Note that businesses should not solely rely on traditional company news, but rather they should always be looking for additional opportunities to create some buzz. For smaller businesses with limited budgets, blogging and publishing guest articles can be very impactful (and less expensive). One of the most common methods disgruntled parties are using to attack businesses is posting harmful reviews. To protect against harmful reviews or simply negative reviews in general, businesses need to ensure they have a sufficient number of online reviews. Studies have shown that online review pages tend to start out as disproportionately negative, and level out as more reviews are submitted. Businesses should implement a content-neutral program in order to generate a higher quantity of reviews, meaning striving to generate more reviews without specifically soliciting positive reviews. Such a program will help businesses protect their reputations online by ensuring that their ratings (likely to appear high in search results) will not be destroyed by a few fake and/or negative reviews. A recommended practice for generating a high quantity of reviews is to send a professional email to a customer shortly after they leave the business, perhaps within 24 hours, asking for feedback. It may be a good idea to utilize a neutral review platform that simplifies the review process for customers, verifies that the reviewers are actual customers, and gathers statistics for management
not only star-ratings, but also the number of people opening the emails and clicking on the survey links. The text of the email may be to the tune of: To help us continue our high quality of service, we invite you to [click here] to submit a review and take a brief survey. The goal here is to solicit feedback without asking for (positive) reviews. The helpful feedback can be helpful to the company itself, while also contributing to an aggregate profile of the business (which would rank highly on Google and lead to helpful information for prospective customers). A business asking for feedback should be careful not to do anything that would make the solicitation of feedback not content-neutral, in particular offering gift cards or discounts. A second option would be to share a URL to the desired review website or platform, whether by handing out a small card/half sheet of paper, having a stack of cards or sheets located somewhere prominent inside the business, or simply tactfully including the URL on the business s website. Similarly, the businesses will ask customers to help make them better by leaving a review, which will not only be used for internal purposes but also will overcome the inherent flaws that come with having a small number of reviews. Prevention Unsurprisingly, the best way to prevent customers from posting harmful content online is to make them and keep them happy by providing quality products, quality services, and outstanding customer service. In this day and age, angry customers often go online and post harmful comments about businesses. Accordingly, businesses should ensure they keep their customers happy. But even the best businesses are not immune from disgruntled parties (often not even customers) attacking their reputations online. Therefore, businesses today should evaluate their customer service policies and factor in that disgruntled parties can cause significant damage to businesses on the internet. Businesses should give their customer service representatives the ability to resolve customer complaints. It makes sense to develop extremely customer-friendly customer service policies to avoid customers damaging their online reputations. Of course, how a business handles customer complaints will certainly depend on a range of factors, including the type or extent of the complaint. Businesses must also consider how they would respond to someone threatening to post damaging content online, such as a bad review. In particular, they should have someone trained in dealing with such persons handle these situations if and when they do occur. When individuals make these threats, businesses are often dealing with people that do, in fact, have the capability of causing serious damage online. Someone who makes an extortion-type threat on a business is a person that might carry out the threatened action. After a fact-gathering process, the trained individual(s) can decide the best approach to resolve the matter. If a business is dealing with what appears to be an insignificant threat, the best practice may be for its representatives to hold their ground and: 1) communicate the company s policy/policies; 2) state that they do not give into blackmail; and, when applicable, 3) send a cease and desist letter to those making these threats stating they will respond aggressively to extortion. When the threat is significant, the trained person could agree to give the person what they request and ask them to sign a confidentiality agreement Another way businesses can help prevent online reputation attacks is to implement social media policies that require employees to conduct themselves in a certain manner while running a company Twitter account or Facebook page. For example employees should not: respond to offensive or negative comments online unless trained to do so (including communicating a pre-
planned response); demonstrate any anger or hostility; or publish anything online where emotions tend to run high (e.g. statements about politics, religion, or social issues) and where an individual or group could be upset. Social media should be used to have a dialogue but that dialogue is best when a company s account(s) are run by an appropriate employee. Preparation In order to prepare for online reputation attacks, businesses must know what is being said about them online. More specifically, businesses should have a monitoring system in place that helps them identify potential threats as soon as possible. The sooner threats are addressed, the greater the opportunity a business has of stopping them. For most businesses, monitoring involves keeping a watchful eye out for anything that could impact them: bad reviews, complaint websites, blogs, and social media posts, for example. In theory, a small company may not need to monitor its online mentions quite as frequently as a larger company. However, it is important for every business to keep an eye out for threats and attacks. Businesses must also be able to differentiate the real threats from the noise, whether using internal personnel or a third party company who can manage this. Once a business has a plan in place to detect potential attacks, it must administer effective responses as quickly as possible. The complexity of these response plans will vary greatly among businesses and risks. For some larger businesses that handle everything internally, they may need to hire a consultant that helps them create a detailed decision tree providing diagrammed recommendations for responding in many different situations. Smaller businesses may just have an expert on call that they consult with when their monitoring system detects potential attacks. Regardless of how complex or simple a response plan may be, most should incorporate the following three elements: 1) a method for quickly gathering relevant facts; 2) trusted experts to select and implement responses; and 3) a list of potential ready-to-execute responses. As far as potential responses, these include: The Carrot approach (offering the attacker something to convince him or her to stop the attack and remove the damaging material) Responding to the attack online (attempting to diffuse the complaint, flipping the script and asking the attacker to contact them offline) Communicating with online audiences (i.e. through social media accounts or press releases) Directly contacting the websites hosting the harmful content Sending a cease and desist letter (potentially with a drafted complaint that could be filed should the attacker not cease his or her harmful actions) Actually filing a lawsuit seeking damages against the attacker Pursuing a court order to get defamatory posts removed from the websites or search indexes Doing nothing at all If a business is adequately prepared based on the aforementioned recommendations, it should be able to swiftly detect an attack, gather the appropriate information, and go through the list of potential responses and determine the best one. While some of the planning and preventative measures may be relatively straightforward, businesses and experts often find it challenging to
decide the appropriate response. After all, there are various costs associated with each option, and some of them carry slight risks of not being effective or even worsening the problem. To help decide on the correct approach, businesses should begin by evaluating the potential harms of an attack. Then, they should go through each of the above potential responses (and perhaps others they develop) and evaluate the costs of implementing the solutions, the risks of implementing them, and also their likelihood of success. Of course, businesses must understand there is no 100 percent-guaranteed effective solution or no completely risk-free solution. However, if the harm from an attack is significant, it is often worth taking these risks. A business that takes the time, effort, and money to prepare for an online reputation attack must test its plans. An incident response plan may look good on paper, but no business can foresee everything, so it is crucial for a business to test its plan and team. Running simulations will help employees test and develop their skills and instincts to successfully respond in real life. The best case scenario is that a business will have a tested top-notch plan in place that is never actually needed in real life. However, virtually every business will face some sort of attack although some may be on a much smaller-scale than others. In sum, online reputation attacks should be taken very seriously. Any person with a bone to pick has the potential to single-handedly damage a business s online reputation. Small- and mediumsized businesses in particular cannot afford to have their search engine results pages filled with anything but positive and neutral content. Thus, businesses must strive to prevent the preventable, and plan for the unpreventable. Businesses that are not planning for these attacks and taking preventative measures upfront are risking greater harm on the backend. Considering how easy it is for wrongdoers to harm businesses online, it only makes sense for businesses to be proactive in their approach to protecting and defending against online reputation attacks. This white paper is for general information purposes and should not be regarded as legal advice. Please contact the author if you want more information or have questions about how these developments apply to your situation.
About the Author Whitney Gibson is a partner at Vorys, Sater, Seymour and Pease LLP and leader of the firm s internet defamation group. The group has worked on hundreds of internet related cases from across the country and develops unique solutions for companies being damaged or attacked online. Mr. Gibson has experience in all aspects of internet of law, including defamation, false reviews, traffic diversion, product diversion, trademark infringement, SEO manipulation, copyright infringement and public disclosure of private facts. He can be reached at 855.542.9192 or at wcgibson@vorys.com. About the Firm The Vorys 18-attorney internet defamation group has unique experience assisting clients who are being damaged on the internet. The group focuses on these cases daily and continually refines their strategies and tactics to best suit their clients. They are often working on dozens of cases across the country at any one time, and are constantly using the most up-to-date technologies and approaches to solve their clients internet problems. Vorys was established in 1909 and has grown to be one of the largest Ohio-based law firms with nearly 375 attorneys in seven offices in Columbus, Cincinnati, Cleveland and Akron, Ohio; Washington, D.C.; Houston, Texas; and Pittsburgh, Pennsylvania. Vorys currently ranks as one of the 200 largest law firms in the United States according to American Lawyer magazine.