XVII

CYBERWARFARE

BATTLING IT OUT ONLINE

Companies should expect a full-scale, organized attack from critics. One that will simultaneously overrun blog comments, Facebook fan pages, and an onslaught of blogs, resulting in mainstream press appeal. Start by developing a social media crises plan and developing internal fire drills to anticipate what would happen.

—JEREMIAH OWYANG, ALTIMETER GROUP, WEB-STRATEGIST.COM

Never forget, the press is the enemy, the press is the enemy. . . . Write that on a blackboard one hundred times.

—RICHARD NIXON

IN BYGONE DAYS A COMPANY MIGHT HIRE A PR MAN to make sure people talked about their company. Today, even a company with little interest in self-promotion must hire one, simply to make sure people don’t say untrue things about their company. If it was once about spreading the word, now it’s as much about stopping the spread of inaccurate and damaging words.

When the entire system is designed to quickly repeat and sensationalize whatever random information it can find, it makes sense that companies would need someone on call 24/7 to put out fires before they start. That person is often someone like me.

One of my first big contracts was a ten-thousand-dollar gig to handle a group of trolls who had been vandalizing a client’s Wikipedia page and filling it with lies and rumors. These “facts” were then showing up in major newspapers and on blogs that were eager for any gossip they could find about the company. “How do we just make it stop?” the company pleaded. “We just want to be left alone.”*

It’s the same predicament Google found itself in when Facebook hired a high-profile PR agency to execute an anonymous whisper campaign against them through manufactured warnings about privacy. Bloggers of all stripes had been pitched, with the idea of building enough buzz for the grand finale: editorials in the Washington Post, Politico, USA Today, and the Huffington Post. Like my client, Google was stunned by the plot. Imagine a $200 billion company saying, “Make it stop. We just want to be left alone.” But they were effectively reduced to that. “We’re not going to comment further,” Google told reporters during the firestorm of controversy. “Our focus is delighting people with great products.”

Sure, go ahead and focus on that, Google, but it doesn’t matter. Once this arms race has begun, things can’t just go back to normal. It escalates: A company sees how easy it is to plant stories online and hires a firm to attack its competitor. Blindsided by the bad publicity, the rival hires a firm to protect itself—and then to strike back. Thus begins an endless loop of online manipulation that can cost hundreds of thousands of dollars. And that’s the easiest of the PR battles a company may have to face.

Consider what happened to the French yogurt giant Danone, which was approached by Fernando Motolese, a video producer in Brazil, with two hypothetical videos.

One, he said, was a fun spoof of their yogurt, which was designed to improve digestive health and, um, other bodily functions. The other, he said, was a disgusting version of the first video, with all the indelible scatological images implied by such a spoof. He might be more inclined to release the first version, he said, if Danone was willing to pay him a fee each time it was seen.

“It felt sort of like blackmail,” said Renato Fischer, the Danone representative who fielded the inquiry, to the MIT Technology Review.1 Well, that’s because it was blackmail. It was extortion via viral video.

Nor is a profit motive the only thing that might make someone utilize these tactics. The hacking of the DNC in 2016—potentially by Russian operatives—and the hacking of Sony Pictures—potentially by North Korea—were both attempts to intimidate and influence through this kind of media shakedown.

THE IMPLICIT SHAKEDOWN

Motolese’s hustle is one of many styles of a shakedown that happens across the web countless times a day. Its only distinguishing feature was its brazenness. It’s usually couched in slightly more opaque terms.

Take Michael Arrington’s TechCrunch post entitled “Why We Often Blindside Companies.” What begins as an apparent discussion of the site’s news policy I see as a veiled threat to the Silicon Valley tech scene. After a start-up founder had, for the “second time,” publicly announced news about her own life before Arrington’s site had a chance to write about it (TechCrunch told her they were writing a story about her, so she broke the news herself), Arrington decided to make an example out of her. First he told his readers that he had nasty personal information on the founder that he had been reluctant to publish. This was a not-so-subtle reminder that he had dirt on everyone and that his personal whim decided whether it got out or not. Then Arrington took his stand, saying the founder would no longer be “getting any calls from [him] in the future to give her a heads up that [TechCrunch is] breaking news about her start up.” As though the journalist’s job to speak to sources they are writing about were a courtesy. He concluded on a friendlier note: “Treat us with respect and you’ll get it back. That’s all we ask.”* He may have ended his post nicely, but his message sounds no less extortionary to me than Motolese’s.2

Afghan warlords have a name for this strategy: ghabban, which

I would ask the same question of him that I once posed to a blogger who kept getting a story about American Apparel wrong. “When you find a mistake,” he’d said, “e-mail me and point it out.” I had to ask: Hey, man, why is it my job to do your job?

A while back, a plane of a major airline experienced potentially catastrophic trouble in the air. Despite a flaming engine and poor odds, the pilot managed to land it safely, saving the lives of four-hundred-plus passengers. Yet, as events transpired, Twitter users went berserk and reported that the plane had tragically crashed. In reality, not only had the plane landed safely, but the pilot acted like a gentleman from another generation, offering the passengers his personal telephone number if they had more questions or wanted someone to talk to. He exuded humble and quiet heroism that should have been recognized.

Only nobody knew about it, because the story online was so different. The Harvard Business Review criticized the airline for not responding quickly enough with marketing spin and for not magically stopping the rampant online speculation. They wrote: “What a pity that social media users, in their well-known enthusiasm for being first to share breaking news to their followers, would unwittingly conspire to obscure the big story of a pilot’s life-saving landing” [emphasis mine].

Yes, a pity. A word a neighborhood thug might use in the hypothetical “It’d be a pity if something ever happened to this nice little shop of yours,” and then try to collect monthly protection. These are the economics of extortion. The threat is less overt than “pay us or else,” but it’s a demand nonetheless. You must provide more fuel to the story and get out in front of it (even when there are more important things going on, like, you know, not letting the jet crash), or your reputation will be ruined. To not do this is to risk a vivid misperception that is impossible to correct with the truth, or anything else.

A CULTURE OF FEAR

Most social media experts have accepted this paradigm and teach it to their clients without questioning it: Give blogs special treatment or they’ll attack you. At any time, a hole could be dug by blogs, Twitter, or YouTube that the company must pay to fill in. And depending on the intentions of the person who dug it, they may also ask to be paid to not dig any more.

The Russian tactic of kompromat—releasing controversial information about public figures—is real and only more dangerous in an era where blogs publish first and verify second (if at all). When the public has been primed to jump on and share salacious gossip on social media, even upstanding citizens are vulnerable. In fact, it’s the good people who are most vulnerable since it’s more interesting to gawk at sordid revelations when they are least expected than it is to, say, hear about the one millionth instance of corruption or dishonesty emanating from the Trump family. The essence of kompromat is that it doesn’t matter if the information is true or not, or whatever disturbing means it was acquired, it just matters that it can intimidate and embarrass. And the media enables this tactic—they thrive on it.

Being right is more important to the person being written about than to the person writing. So who do you think blinks first? Who has to spend thousands of dollars advertising online to counteract undeserved bad press? Who ultimately hires a spinmaster like me to start filling the discussions with good things just to drown out the bullshit? It’s certainly not the media who is beefing up their fact-checking department to make sure innocent people are hurt.

Today there are dozens of firms that offer reputation-management services to companies and individuals. Though they dress up their offerings with jargon about performance metrics and customer feedback, their real service is to handle the disturbing, nasty, and corrupt dealings I’ve talked about in this book, so you don’t have to. Navigating this terrain has become a critical part of brand management. The constant threat of being blindsided by a false controversy, or crucified unfairly for some misconstrued remark, hovers over everyone in the public sphere. Employees, good, bad, or disgruntled and desperate for money, know that they have the means to massively embarrass their employers with well-placed accusations of mistreatment or harassment. People know that going to a blog like Consumerist is the fastest way to get revenge for any perceived customer-service slight.

That there are a million eyes watching, each incentivized to demagogue their way to a traffic payday, dominates discussions in corporate boardrooms, design departments, and political strategy sessions. What effect does it have? Aside from making them rightly cynical, it forces them to act in two ways—deliberately provocative or conservatively fake. In a word: unreal.

Blogs criticize companies, politicians, and personalities for being artificial but mock them ruthlessly for engaging in media stunts and blame them for even the slightest mistake. Nuance is a weakness. As a result, politicians must stick even more closely to their prepared remarks. Companies bury their essence in even more convoluted marketing-speak. Public figures cannot answer a question with anything but “No comment.” Everyone limits their exposure to risk by being fake.*

It’s now common for indie bands to avoid or turn down as much online press as possible, with some even going as far as obscuring their likenesses or withholding their names. Why? They are petri-fied of the backlash that has sunk so many promising “blog-buzz” bands that came before them. With the hype comes the threat of hate, and I don’t think this is limited to music blogs.

Overstock.com was compelled to address this unpredictable and aggressive web culture in a 10-K filing with the SEC. It is a precautionary measure many companies will have to take in the future—to let investors know how blogs could impact their financials with little warning and little recourse. Designating it as one of three major risk factors to the company, Overstock.com wrote,

Use of social media may adversely impact our reputation. There has been a marked increase in use of social media platforms and similar devices, including weblogs (blogs), social media websites, and other forms of internet-based communications which allow individuals access to a broad audience of consumers and other interested persons. Consumers value readily available information concerning retailers, manufacturers, and their goods and services and often act on such information without further investigation, authentication and without regard to its accuracy. The availability of information on social media platforms and devices is virtually immediate as is its impact. Social media platforms and devices immediately publish the content their subscribers and participants post, often without filters or checks on accuracy of the content posted. The opportunity for [the] dissemination of information, including inaccurate information, is seemingly limitless and readily available. Information concerning the Company may be posted on such platforms and devices at any time. Information posted may be adverse to our interests, it may be inaccurate, and may harm our performance, prospects or business. The harm may be immediate, without affording us an opportunity for redress or correction. Such platforms also could be used for dissemination of trade secret information, compromise of valuable company assets all of which could harm our business, prospects, financial condition and [the] results of operations.

Alarmist? Maybe. But I have seen hundreds of millions of dollars of market cap evaporate on the news of some bogus blog post. When the blog Engadget posted a fake e-mail announcing a supposed delay in the release of a new iPhone and Apple operating system, it knocked more than $4 billion off Apple’s stock price.

Maybe you’re not sympathetic to big corporations. What about when Eater LA* published a report from an anonymous reader stating that a popular Los Angeles wine bar not only had egregious health code violations, but also was advertising gourmet items on its menu while really serving generic substitutes?

Besides not adhering to simple food saftey [sic] standards, such as soap, sanitizing, and throwing out chicken salad that’s 2 weeks old, 90% of all “ fresh” menu items are cooked days beforehand and sit in the fridge.

Like so many online reports, this one turned out to be wrong. Completely wrong. So Eater added an update that said the proprietors disputed the story. Yet the post—the disgusting hygiene allegations and the headline—remained the same. The post stayed up for people to read and comment on. Only after a second update—prompted by the threat of a lawsuit—did Eater begin to admit any wrongdoing. It said, in part:

We ran this tip without contacting the owners of the restaurant, who have since refuted the tip in its entirety. We apologize to the owners of the restaurant, and our readers, for not investigating our source’s claims before airing them on the site. The resulting post didn’t rise to our standards, and we shouldn’t have published it.

Imagine if the restaurant had been a larger, publicly traded company. Stocks move on news—any news—and rumors passed on by high-profile blogs are no exception. It does not matter if they are updated or corrected or part of a learning curve; blogs are read by real people who form opinions and make decisions as they read.

I was once invited to a lunch at Spago with the then-CEO of the Huffington Post, Eric Hippeau. Some of the site’s editors attended for a bit of a roundtable discussion about the media during lunch. It was 2010, and the internet and national media were in a frenzy over reports of accelerator malfunctions causing unintended accelerations in Toyota cars. While we were eating, Eric asked the group a question: How could Toyota have better responded to the wildly out of control PR crisis?

Given that this was a room full of internet folks, as soon as the answers started, the pontification became overwhelming: “I think transparency is critical.” “These companies need to be proactive.” “They needed to get out in front of this thing.” “The key is reaching out to bloggers.” Blah, blah, blah.

It was a conversation I’d heard a thousand times and seen online almost every day. Finally I interrupted. “None of you know what you’re talking about,” I said. “None of you have been in a PR crisis. You’ve never seen how quickly they get out of hand. None of you have come to terms with the fact that sites like yours, the Huffington Post, pass along rumors as fact and rehash posts from other blogs without checking them. It’s impossible to fight back against that. The internet is the problem here, not the solution.”

In subsequent months I would be vindicated more than I could have anticipated at the time. First, the Huffington Post was hit with a PR crisis and failed miserably at responding by the standards they laid out at lunch. When sued by a cadre of former and current writers for their unpaid contributions, the Huffington Post was anything but “transparent.” They clammed up, likely on the advice of their lawyers, and didn’t cover the lawsuit on their own site. It was not until a few days later that Arianna Huffington posted her first—and the only—statement about it on the Huffington Post. Hardly “being proactive” or “getting out in front of it.” What else could she have done? The lawsuit was probably a money grab, but the Huffington Post had to mostly stand there and take a public beating, watching powerlessly as other blogs gleefully dissected and discussed the lawsuit without a shred of empathy.

Second, and most important, Toyota was largely exonerated after a full investigation by NASA, no less. Many of the cases of computer issues supposedly causing unintended acceleration were disproved entirely, and most were found to be caused by driver error. Drivers had been hammering the accelerator instead of the brakes! And then blaming the car! In other words, the scandal that Toyota was so heavily criticized for not handling right had been baseless. Toyota hadn’t been reckless; the media had. It was sites like the Huffington Post, so quick to judge, that had disregarded their duties to their customers and to the truth. As journalist Ed Wallace wrote for Businessweek in an apology to Toyota, “[A]ll the reasons why the public doesn’t trust the media crystallized in the Toyota fiasco.”

But of course none of that really matters because there is still that residual stain. Even in telling this story I am unintentionally hurting Toyota. I am repeating those unforgettable words in the same sentence: Toyota. Accelerator malfunction. Scandal. Which leaves Toyota asking the same question that wrongly disgraced former U.S. secretary of labor Ray Donovan asked the court when he was acquitted of false charges that ruined his career: “Which office do I go to to get my reputation back?”

WHERE THERE IS SMOKE THERE IS FIRE

The real trick in this game is to repeat something enough times that it begins to sound true. One of the things I noticed during the 2016 election was anytime I said something negative about Trump, I would suddenly get hit with tweets from accounts with no followers. By that I mean literally zero followers. How hard is it to get one friend?

Hard when you’re a fake account. Increasingly, smart media manipulators have realized that one way to make things seem real is by straight up gaslighting. Political campaigns, CEOs, and foreign governments can pay to create accounts that bombard influencers like journalists with information. Say something negative about Trump, and you’ll hear from what look like legitimate Trump supporters who try to intimidate you. Write something about a company, and watch as the comments section fills up with barely literate praise.

Russia is a well-known user of this tactic as well. They call it dezinformatsiya— essentially disinformation via trolling. In the United States we call it “astroturfing”—using fake accounts or supporters to create what appear to be shows of real opinion around the internet. Another word for this is “shitposting”—whenever you see an online conversation suddenly interrupted by what seems like an unhinged person ranting about this issue or that issue. You might dismiss them, but they still managed to catch your attention for a second.

This manages to fool even seemingly skeptical readers. Professor Kate Starbird at the University of Washington explained to the Seattle Times, “Your brain tells you ‘Hey, I got this from three different sources,’ ” she says. “But you don’t realize it all traces back to the same place, and might have even reached you via bots posing as real people. If we think of this as a virus, I wouldn’t know how to vaccinate for it.”

You can see why these strategies would work if done on a large scale. If you were a reporter and saw that a petition had sixty thousand signatures, would you bother to investigate where those signatures came from? If you were an editor and you suddenly got fifteen e-mails pointing you to the same link, might you pass it along to a writer to cover? If you were a public figure and you kept getting tweets about something, maybe you’d reply and ask, “Has anyone heard about this?” and even in questioning it you’ve helped push that fake idea along.

This isn’t a conspiracy theory. During the election, it was found that both candidates had large numbers of fake followers on Twitter. It was also revealed that one of the very wealthy founders of Oculus Rift had put money behind a group dedicated to shitposting anti-Hillary memes. When caught, he would tell the Daily Beast, “You can’t fight the American elite without serious firepower. They will outspend you and destroy you by any and all means.”

WEAPONIZING INFORMATION

Let me tell you about another unbelievable media event that happened over a meal. I wasn’t at this one but apparently Ben Smith, the editor of BuzzFeed, was. It was hosted by Uber at the Waverly Inn in New York City. At the dinner, Uber executive Emil Michael spoke candidly about the company’s plans to deal with the unfair and biased media coverage it believed it was receiving. Smith, a guest at the event, recounted what he heard the next day:

Over dinner, he outlined the notion of spending “a million dollars” to hire four top opposition researchers and four journalists. That team could, he said, help Uber fight back against the press—they’d look into “your personal lives, your families,” and give the media a taste of its own medicine.

He even named specific journalists and editors he would want to go after. This was alarming to many in the media because of how closely it came on the heels of a leaked internal report from Uber about its plans to “weaponize facts” in its fight against the taxi industry.

Not only can the media be a tool to attack others, but it can also itself attack people and be attacked in turn.

We are starting to see this in politics—little events here or there that the conspiratorially minded might suspect had deeper backing than it appeared. The 2008 election was nearly derailed when the same “citizen reporter,” on separate occasions, tricked both Obama and a campaigning Bill Clinton into saying something vulnerable and honest by misrepresenting herself. The sixty-one-year-old woman later admitted that the two figures had “had no idea [she] was a journalist,” nor that she was recording them with a hidden device. Then, angered by the lack of compensation from the Huffington Post for her “scoops,” she resigned by publishing private e-mails between herself and Arianna Huffington—just to get one last blast of attention at someone else’s expense. Anyone can write for the Huffington Post, which means anyone could potentially have the same impact. One blog, one recorder, and bam.

Even Trump himself was badly damaged when a clip of him recorded without his knowledge a decade earlier was leaked to the media. It’s also interesting to see how hard he was hit by the so-called Trump dossier, which made all sorts of sensational allegations about Trump’s dealings in Russia, purportedly based on high-level intelligence sources and research.

Who was originally responsible for funding and creating this report? The answer is almost too good to be true. The report was funded first by Republicans who sought to keep Trump from getting the party’s nomination and then by Clinton’s supporters trying to beat him in the general election. In other words, it was partisan-funded opposition research. And who ran it, despite admitting they were unable to verify its content? BuzzFeed! That’s right—the very same site who scored headlines by revealing exactly how malicious organizations might undermine and attack their enemies by doing opposition research and weaponizing it.

Without irony, Ben Smith defended the decision to run the report by saying, “The instinct to suppress news of this significance is precisely the wrong one for journalism in 2017.” But here’s the thing—it’s only significant news if it is true! How can any person prepare for or defend themselves against scandal or innuendo when the media have utterly abdicated their role in vetting the information they publish?

Whether the United States and its elections were interfered with by the Russians I cannot say—but it is pretty obvious how they could have been. The media has admitted they’re open for business and will take even the most suspect information. Apparently the only validation needed—as BuzzFeed showed with their publication of the Trump dossier—is that there is already significant chatter about something online. (And we know how easy that is to fake.)

I’ll give you one last example of how information can be weaponized, and it’s one from personal experience. A few years ago, a friend was screwed over by a famous talent agent (with a legendarily bad temper and a reputation for screwing people over). His chances of actually beating such an opponent in court were slim—he didn’t have the resources. So we worked through how he could have a lawyer draft a letter announcing his intention to file a lawsuit, which he could then leak to gossip blogs after sending it to the agent. He didn’t need to file an actual lawsuit, mind you; in such a small industry, simply the public airing of the claims—that someone had stolen someone else’s work project like that—through an intention letter and the subsequent media coverage (on TMZ, ESPN, and a host of other blogs) was its own form of leverage.

I ran into the friend later and learned the outcome of the tactic: The agency paid him $500,000 and admitted defeat. I think about this often. That agent might have screwed my friend over, but how easily could this tactic used in response be abused, used against an innocent party? What strikes me is not that it was some elaborate, orchestrated con—I don’t feel like I discovered some criminal instinct inside myself either—it’s that the tools were so accessible and easy to use, it was almost difficult not to do so. In fact, it came so effortlessly that I didn’t even remember doing it until he reminded me.

The way someone can be exploited through both the legal and political systems (anyone can be sued for anything and anyone can be accused of anything) and the media, when they cover it (claiming libel of a public figure generally requires malicious intent or reckless disregard of the truth), reminds me of the gruesome accident in Meet Joe Black in which Brad Pitt’s character is hit by a car, tossed up in the air, and hit by another car going in the other direction.

To not be petrified of a shakedown, a malicious lie, or an unscrupulous rival planting stories is to be unimportant. You only have nothing to fear if you’re a nobody. And even then, well, who knows?

*I heard an even more anguished version of this cry from the family of a celebrity who contacted me after their son’s death. They wanted help with Wikipedia users who were inserting speculative and untrue information about his tragic accident.

*Before he ran for president, then-senator Barack Obama advised his fellow politicians about the burgeoning political blogosphere: “If you take these blogs seriously, they’ll take you seriously.” As long as we can all admit that we have to assuage bloggers’ egos in order to be treated fairly. . . . means to demand protection from a threat that you create. Many blogs employ it subtly, extorting through a combination of a sense of entitlement and laziness. A mostly positive 2010 Financial Times article about the rising influence of blogs covering the luxury watch market featured a small complaint from a watch manufacturer about a blogger who often got important details and product specifications wrong, in addition to having typos and bad grammar. In response, the editor of another watch-industry blog, TheWatch-Lounge, leaped to the site’s defense: “What is the luxury watch industry doing to help him become a better writer?” he demanded to know. “And for that matter what is the industry doing to help any of these bloggers become better writers?”3

*In his book The Psychopath Test, Jon Ronson, a journalist, suggests that the real way to get away with “wielding true, malevolent power” is to be boring. Why? Journalists love writing about eccentrics and hate writing about dull or boring people—because it’s boring.

*Eater is now owned by Vox Media.