‘Going Viral’ is a marketing dream, but it can spiral into a PR nightmare. A rumor, a false accusation or negative review can catch wind on social media and sail far from your grasp. The fall out can impact your P&L and disrupt your organization from the board level and down. When this occurs, who’s accountable and what recourse do you have? This is the world of Digital Risk. We recently sat down with Desiree Moore, Partner at K&L Gates and co-founder of the firm’s Digital Crisis Planning & Response practice, to explore these questions, and more.
What led to the rise of K&L Gates Digital Crisis Planning & Response Practice?
In 2012, I wrote the book ‘Thrive: A New Lawyer’s Guide to Law Firm Practice’. As I began to market the book and establish myself on social media, an idea ‘clicked’--I realized that law firms would need social media-focused practices as corporations and individuals began to leverage social media for business. I approached the firm’s global managing partner sometime later and proposed that K&L Gates start a social media practice.
Almost as soon as the social media practice launched, clients came with inquiries not only about social media, but about digital risk. My partner Elisa D’Amico and I decided that we should expand our focus, and created a more holistic client solution, Digital Crisis Planning & Response.
What is a digital crisis?
Today, and in recent years, having a ‘digital identity’ is a matter of fact.
Many businesses and individuals are prolific users of social media and other digital platforms. However, even if you are a business owner that has never connected to the Internet, your customers, clients, and business partners do. Websites like Glassdoor and Facebook and others will automatically create company pages (for example, if a former or existing employee writes about the company, or when their algorithms pick up that someone has visited a business that isn’t in their network). Therefore, digital risk is also a matter of fact.
Every person and every company has a ‘digital profile’. The only difference is that some choose to manage that profile and others do not.
A digital crisis is a crisis that occurs online or offline but that is discussed, disseminated, or otherwise transmitted via digital means, or via technology. A digital crisis is indiscriminate in terms of industry or size and can impact an individual just as much as a Fortune 50 company.
Often, a digital crisis is related to negative news about a company or executive that goes viral. Data breaches and ransomware are also examples of digital crisis.
Are your clients typically proactive or reactive in their preparation and response to a Digital Crisis?
Generally speaking, clients are reactive. This makes sense in light of the trajectory of digital platforms for business. Specifically, in recent years, businesses saw that their clients began to move on to digital and social platforms, and they naturally joined in as well to ensure they were a part of the conversation. There is a low barrier to entry on virtually all digital platforms, so it is not intuitive that a business or individual would seek out the advice of a lawyer before creating an account. As a result, most businesses began to cultivate a digital identity without considering the risks.
As we built our digital practice, first-time clients were typically reactive. Something bad had happened - a disgruntled employee misappropriated passwords or other trade secrets; there was a data-breach; some form of negative press had gone viral, etc.- and the client was looking for a legal course of action to protect their interests and hold others accountable.
In reactive circumstances, we move quickly to assess the situation and plot a course of action. In cases where there is an identifiable bad actor, for example, we will issue a cease and desist letter within 24 hours, and prepare a complaint as quickly as we need to if the behavior does not cease. We carefully craft our communications so that if they are leaked digitally, as they often are in digital crises situations, only the message we want communicated gets out.
When clients are proactive, we are able to put measures in place from the outset that protect against digital crises, and that mobilize teams instantly in the event of a crisis.
What does a ‘crisis’ typically look like/ What’s a ‘worst case scenario’?
A crisis involves the spread of news or negative information in some fashion. For example, you can have a clandestine breach in your data, but you will need to communicate that incident to those who have been compromised (at a minimum - and potentially others by law). If not handled correctly, this can result in loss of clients and critical relationships.
Other crises center one negative information (true or false) that is spread virally on the Internet and showing signs of gaining traction. In this scenario, companies without a plan in place are potentially going to react in a way that exacerbates the situation.
Reactions without a plan often trigger viral responses because they acknowledge a problem.
Companies and individuals often run up against two scenarios. Either they don’t respond at all to a crisis that requires a response, which creates its own crisis, including the spread of speculative information (on top of the negative information), or they respond without thinking through the consequences of the response, thereby legitimizing or highlighting an event that may not have been a crisis at all on its own.
Different businesses will have different levels of tolerance for negative exposure on digital platforms. When our clients are being pro-active, the first very first thing we advise them to do is to determine what constitutes a crisis. Once this is defined, we can track the narrative and determine what level of traction i is gaining, if any, and what kind of response is required, if any.
If a story defamatory and we don’t like it, but its traction is below our defined tolerance threshold, we don’t respond. On the other hand, where a story is going viral, we issue a response that takes control of the narrative, without delay.
Once the ‘cat is out of the bag’ how does a company respond to best mitigate the risk?
Think back to the McDonald’s ‘Hot Coffee’ scenario that dominated the news cycle in the 90s. How would that have played out today? Photos of coffee burns on Instagram? Opinion videos shared on YouTube? Long form rants on Reddit?
Here’s the better question: How long would the McDonald’s ‘Hot Coffee’ crisis dominate the news cycle today? When that story broke in the 90s, people had more limited sources of news and they couldn’t interact with it. They couldn’t swipe one big story for the next. As a result, the story stuck around in people’s minds. Today, there’s a new crisis or outrage ever hour. People’s attention spans are shorter and it’s easier to weather a storm.
In some cases, when a story gains traction and shows signs of going viral, depending on the circumstances sometimes I advise my clients to strategically let it ride. There is so much information and distraction out there. People are still wading through content. The first thing to do is let the aggregate of the narrative take form and assess its impact. Many times, the narrative trends and dies out before ever becoming a legitimate threat.
When you are facing a crisis like an airline safety issue or a pharma recall, however, you can’t stay silent. Once the story is firmly in the public eye, they will want to hear from those responsible or in charge, and so companies need to dig deep and muster a communication that will give the public comfort. Internally, there is a lot of work to be done to ensure the message is accurate, truthful, consistent, and compelling. But no response, or a delayed response, will put the company at risk.
You can come out immediately and say “we are aware, we are working on it. We care about you. These are our core values, etc.” You have to have a voice, even if you haven’t mastered all of the facts in the immediate aftermath of a crisis.
Are there prescribed ‘proactive’ steps a business can take to manage digital risk?
Yes. The Digital Crisis Planning & Response client solution fosters proactive diligence. You can’t protect against every crisis, but you can have a plan in place. Here are the basic steps I would advise any company or individual take :
Digital Security- Ensure that all the data that your business collects is appropriately and sufficiently protected. Read the literature on policies and best practices as it relates to your industry and rely on an attorney for guidance.
Assess your digital profile- Be strategic about your digital presence. Track any and all accounts you have created in real time, but don’t stop there. Identify and monitor any forums and sites where your business is discussed or reviewed.
Strategize- With the help of an attorney, write a play-book for what a digital crisis might look like for your business and craft a plan around protecting against it and addressing a crisis if it does arise.
Create a task force: prepare a team to mobilize in the event of a digital crisis, including legal, PR, social media managers, and more.
Whom can a company hold responsible/ accountable, when slanderous/ libel news trends?
The only liable parties in the event of online defamation are the posters or users themselves. There is little to no recourse against social media platforms for defamatory conduct. You can’t sue Facebook or Twitter or Instagram for a defamatory post. There are protections in place by law that prevent taking any legal action - or at least having success with such a legal action.
With that said, social media platforms will at times work with lawyers or users to have content removed that violates their policies and terms of use. They are not obligated to do so by law, but they can and do in some instances.
GDPR has passed in Europe, and there is increasing scrutiny of the large social media enterprises use of data in the USA. Are there foreseeable changes, or upcoming cases in US legislation that could have an impact on how a person or company plans for a digital crisis?
GDPR and other data security and privacy laws will be key in shaping the way we engage with social media platforms going forward. They will also steward in new and more robust protections for users of digital platforms, as the door has swung wide open and all of us have put our own privacy and security at risk inadvertently by participating in digital platforms so readily, without regard for the consequences. Digital crisis lawyers can help navigate these changes as they arise.