What to Do When You Are Attacked Online: “You’re a No-Good, Lying, Cheating Crook”

The value of social media for corporations is unquestionable. As a communications tool, it allows businesses to engage with customers, recruit brand advocates, promote services and products, and obtain valuable feedback. Whether companies have a robust social media presence or are simply the subject of discourse, there is also the potential for it to cause harm to a business’s most valuable asset: its reputation. This is especially true when comments move from legitimate critique to defamation.Imagine the following scenario: You arrive at your office, open your e-mail inbox, and discover Google Alerts filled with web content about your company. When you click the links to various “comment sites” and other social media channels, you find anonymous posts of negative comments about your company, including allegations that your colleagues are “thieves,” that your business provides “shoddy service,” that your technicians “purposely broke a customer’s equipment so they could charge to fix it,” and that you are a “dishonest crook.”

After briefly pondering whether being called an “honest crook” might have been slightly more palatable, you quickly think about damage control—how to get these posts removed—as well as possible legal action since none of the statements are true.While you can’t believe your misfortune, you are but the latest victim of an increasingly common cyber-attack by disgruntled customers, competitors posing as customers, and other antagonists. The number of websites allowing for spontaneous venting, coupled with the ease of sharing one’s displeasure with the rest of the world, has created a dangerous environment for individuals and businesses trying to protect and foster their reputation.  Moreover, once the bad information is out there, it is difficult to eradicate. Thus, readily detecting, addressing, and minimizing these attacks is critical.

Having an “early warning system” (like Google Alerts), staff members dedicated to media monitoring, and a comprehensive crisis communications plan, allows for early detection and proactive response. What action to take will be determined by where the negative rants appear, the willingness of websites to remove them, what is driving the poster’s criticism, and your ability to identify him or her.

While it never hurts to ask for the removal of the offending posts, many large comment websites are reluctant to limit content, preferring to provide a forum where both sides can share views. This is to be expected in a society that values freedom of expression.

In cases of legitimate gripes, swift action to address the issue may not only soothe the unhappy customer, but also allow for positive recognition for your attentiveness.  If handled well, this can turn an initial negative into a significant positive. A good example is Domino’s Pizza’s 2009 handling of a viral YouTube video showing employees doing disgusting things to customer pizzas. Domino’s quickly responded with its own video, noting that the employees in question had been fired, warrants had been issued for their arrest, and the store in question had been closed until it was completely sanitized. Domino’s is now a common case study for best practices in responding to social media crises.

In some situations, the ugly commentary crosses into defamation. Even if you want to hold the culprits legally responsible, a large hurdle may be identifying whom to sue since postings are often anonymous. To protect confidentiality and encourage participation, website operators generally will not provide identifying information absent a subpoena, creating a dilemma because, typically, there needs to be an active lawsuit before a subpoena can be issued.

Thus, many courts allow for “John Doe lawsuits”—that is, lawsuits against unnamed people. From there, you can subpoena the website, which may know only the poster’s IP address and Internet Service Provider. Armed with that information, you must then subpoena the ISP, and hope that the data leads to a customer and not a library, Starbucks, or other public place. Some states require a showing of a legally sound defamation claim before you can get the information.

Rather than wasting time, you may think, why not sue the website, particularly if it refuses to identify the bad actor or remove the defamatory content? Federal law, however, shields online forums from liability when the operators are not actively engaged in content creation or editing. As a result, many cautious operators will not remove objectionable content for fear that they will be considered content creators and become exposed to liability, even though the law provides a “safe harbor” from liability for removal of certain offensive content.

That brings you back to the anonymous poster. Assuming you can identify him or her, you will need to prove defamation. Internet defamation law is the same as for other speech: there must be a false and defamatory statement that injured your reputation. If you are a public figure, you must prove that the poster knew the offending statement was false. If, however, the court finds a statement to be opinion or hyperbole—both protected by the First Amendment—your claim will fail.

Thus, the statements above about your colleagues being “thieves” and your providing “shoddy service” may be opinion and/or hyperbole, while the statement that your people broke something so they could charge to fix it may be actionable.

Ultimately, you must decide whether the cost of litigation makes it worthwhile. There are often less drastic, proactive alternatives to counter the criticism and minimize its impact. In addition, you must consider the public relations impact of pursuing a lawsuit. A company can win in the courtroom and lose in the court of public opinion. In many cases, it may be most effective to simply respond prominently and publicly to assuage the public anger. This will show that you are responsive to and care about your customers’ opinions, and could actually improve your reputation and bottom line.

Because of the risks associated with Internet attacks on your business, delivering high customer service to ensure satisfaction should be an even higher priority in today’s world of instant communications to avoid the poisonous commentary altogether.