What happens when someone is engaged in a deliberate effort to harm your organization’s reputation and disrupt your operations?
In this episode of the Managing Uncertainty Podcast, Bryghtpath Principal & CEO Bryan Strawser, along with Consultant Bray Wheeler, flip their nearly fifty years of combined experience around and talk about how they would conduct an offensive reputation management campaign against an organization.
Topics discussed include social media, protests, pre-operational surveillance, executive protection, event planning, and more.
Bryan Strawser: Hello and welcome to the Managing Uncertainty podcast. This is Bryan Strawser, principal and CEO at Bryghtpath.
Bray Wheeler: This is Bray Wheeler consultant at Bryghtpath.
Bryan Strawser: Like every episode, we do we’re almost always talking about how we can protect companies, how you can make your organization more resilient, how can you deal with disruptions, how can you detect and deal with threats that are coming at you? This episode is going to do something a little different and we’re going to talk about the other end of the equation and that is if Bray and I took all of our experience in dealing with the things we just talked about and we flipped it around and decided to come after your company, what does that offensive reputation management campaign start to look like? What if we decided that we were going to come after you as activists, what would we do?
Bray Wheeler: I think it’s important to preface to, as you said, that it’s offensive reputational campaigns, it’s not necessarily a violent attack that’s-
Bryan Strawser: Let’s talk about bombing your facility another day.
Bray Wheeler: It’s a different podcast.
Bryan Strawser: Just kidding, that’s not really the business we’re in.
Bray Wheeler: No.
Bryan Strawser: I’ll just start with something simple because I’ve been thinking about this particular one for I feel like decades and that is we’ve talked before in a couple of episodes about managing protests and how do you deal with people who want to protest at your location or get into your building and do some things.
Bryan Strawser: I remember almost every protest I ever dealt with, we knew it was coming because we had a good radar screen that showed us that this was going to happen, and 20 minutes before you were supposed to be there, we just locked the doors and we routed employees to a secured entrance and you could come protest and stand outside and press your face up into the glass all that you want, but you weren’t going to get in and disrupt the business.
Bryan Strawser: It’s not hard to make sure that doesn’t happen simply by having some operational security, getting your group of protesters together clandestinely, realizing you don’t need 200-300 people to make your point and get people into the lobby of a company’s headquarters and then do your thing to make your protests, do your sign holding or waving or screaming or whatever you’re going to do.
Bray Wheeler: Bullhorns and-
Bryan Strawser: Bullhorns and–
Bray Wheeler: Cowbells and-
Bryan Strawser: Cowbells. Cowbells are great, they’re annoying.
Bray Wheeler: Yep.
Bryan Strawser: But it’s not that hard to do that as opposed to announcing the thing, post it on social media and show up and find the door is locked. Am I wrong?
Bray Wheeler: No, and that’s, that’s always what surprised me in our previous corporate lives, the amount of forewarning and even if it was something that wasn’t popping up in social media or advanced contact of or something like that, when you’re marching in mass through a city, particularly downtown Minneapolis that had a system where different businesses could talk to each other via a radio frequency for different things, whether it’s weather or city maintenance disruptions or something like that, you would know groups of people are now marching around downtown.
Bray Wheeler: Well, who are they interested in? It was pretty easy to figure out who they were, who they were interested in, whether or not they had some kind of vested interest in you, and it always surprised me that they went so far as to take advantage of not announcing themselves, but then would show up and start marching around. Now certainly disrupting skyways in Minneapolis, pretty effective to get a message out, but if your intent really does cause a disruption at a location, it’s surprising how nobody would take advantage of a quieter entrance… you know, flash mob situation.
Bryan Strawser: Totally agree. A flash mob-like situation. I think there’s also that there are the protests. You can target a protest or another type of disruption at a softer target than the company’s main headquarters. Go to a branch, go to a store, go to a distribution center-
Bray Wheeler: An event-
Bryan Strawser: Go to an event.
Bray Wheeler: … that they’re a participant in or hosting.
Bryan Strawser: Yeah, and not like a shareholders’ meeting event, but I’m talking about an event… To me, the most effective disruption is one that the person or organization you’re trying to disrupt doesn’t see coming. So find out a conference where one of the senior leaders is presenting, go to the conference and disrupt their keynote. It won’t take more than a couple of people yelling or holding up a banner or chanting or whatever to disrupt that in a way that registers the message.
Bryan Strawser: Look at the first friend of democratic debates for democratic presidential candidates Bill de Blasio was challenged just a few weeks ago by protestors. They actually started talking when Cory Booker was on stage and I think that confused some people, but their target was the mayor of New York. They went all the way to this debate to yell at the mayor of New York about the death of Eric Garner and why the police officer who was involved in his death had not been fired and that got all kinds of attention because it was simply not expected.
Bray Wheeler: Not expected. Some of these events, particularly if you’re talking marketing events or you’re even talking a speech or a presentation of some, oftentimes there’s media right there and the thing that the people are talking about or the event that was going on, it isn’t super interesting, it’s news, they’re going to cover it, but if you’re able to insert yourself from a controversy standpoint, from a different message to take issue with something that even is unrelated, that’s far more interesting to cover and the attention becomes that much more for you in a way that is much more unexpected.
Bryan Strawser: Executive homes or another one to consider. I think a lot of focus is put on the homes of CEOs.
Bray Wheeler: Yup.
Bryan Strawser: They do tend to be, I think, better secured than others. I would look at the other executives and how can I use their probable lack of security in order to effectively protest that or something that they’re at or doing.
Bray Wheeler: Yeah, certainly executives are a good target even as you start to get down the line if you’re targeting the head of security or the head of cybersecurity or an HR person or a marketing person that’s typically out front. If you’re highlighting a key or visible person within the organization it’s going to get some attention. Now, certainly the executives draw the most, but if you have a highly visible individual within your company that’s not one of those in the C-suite, they’re far probably easier to disrupt target because they’re less secure, they just don’t have the assumed level of visibility that would require that type of security.
Bryan Strawser: Another area to look at is social… There’s a whole number of social media things that we can talk about. One that I think is particularly effective is to find the personal social media account of the CEO of another executive, of a key leader and start messaging them directly as opposed to going through corporate channels to get to them.
Bryan Strawser: Same thing on users on Facebook in terms of messaging, using Facebook messenger, you can do Instagram private messages, you can do Twitter direct messages, but that’s much more difficult to get away from than your corporate email box where their assistant or whatever can filter you out. Now I’m applying pressure and they’re getting hundreds or thousands of messages from myself and my other activists about whatever our cause is.
Bray Wheeler: And if they’re not… Typically execs aren’t super savvy at responding to those, knowing how to close up a social media account or block it off, that those are probably a rare breed and probably won’t be in the future here, but right now, demographically speaking, making some assumptions around they’re not going to know how to handle that. They’re going to freeze up, they may say something unintentionally, they may respond back, they may just let it go on not knowing how to freeze up that account or deactivate it or whatever the case is to make it stop.
Bryan Strawser: Make it stop.
Bray Wheeler: I think another offshoot to that certainly is their family. Family is highly visible in many cases for some of these execs, some have partners who are highly visible and other jobs that you’re able to work your way to that point. Children, grandchildren, brothers, sisters, moms, dads, certainly in the social media sphere. It also happens in the physical environment too that families are an easy source of information to know where they are to apply pressure, even if you want to slightly intense, some different nefarious pressure there, that’s an avenue to get some attention, but even just to show up and disrupt or to use that as part of the messaging is super easy, and we see that all the time.
Bryan Strawser: And one thing that we’ve talked about previously is that it’s often maybe more difficult to find someone’s residence, to learn some information about them or to get access to their photos on Facebook or Instagram or whatever, but it’s usually not that hard to get to their families’ correct information. Certainly I can think of a situation locally here where we were attempting to determine the home of a CEO for assessment purposes and we weren’t able to get access to see their Instagram account because they’d locked it down, but we were able to go through their daughter, find her Instagram account to find out that she’s had geolocation turn on and now not only do we know where they live, but we know the vehicle that they drove because there was a picture and the license plate, we know the school that she went to and at least three or four of her friends as a part of that because nobody ever thought, “Hey, they should lock down their accounts across the whole family.”
Bray Wheeler: Sometimes they don’t want to. Sometimes it becomes a, “Hey, that’s a personal boundary I don’t want to cross. My family should be allowed to have that freedom and that perceived anonymity online to be able to do what they want. They have nothing to do with my role as CEO of the company.” It’s not true.
Bryan Strawser: Yeah, I may think that and they may think that and you may think that, but the activist who only cares about, pick the issue, they don’t care about any of that.
Bray Wheeler: Nope.
Bryan Strawser: They care about their issue and the quickest route to get that message across.
Bray Wheeler: Right.
Bryan Strawser: With the most visibility. Hey, their 16 year old might be opposed to palm oil, for example.
Bray Wheeler: Yeah, and it is a pretty easy thing to apply pressure to kids of these families, that’s a just pepper, pepper, pepper, pepper, pepper with questions and controversy and throwing things in front of them that says, “Hey, your mom or dad is an awful human,” to get a reaction and to have them react or to trick them into saying, “Hey, what do you think of this?” Or “How do you feel?” “Oh yeah, palm oil is awful.” Well, they’re not part of the organization, they’re not always coached on what to say, what to do and now you have a golden quote.
Bryan Strawser: I can just see somebody telling one of my daughters that daddy is awful the same day that they’ve just called me the worst is daddy ever for having taken something away? It would probably work.
Bray Wheeler: Yup. If you get lucky and time it right.
Bryan Strawser: “I heard from Jeff on Facebook today who told me that you’re awful and I agree.”.
Bray Wheeler: Kids say the darnedest things.
Bryan Strawser: But yeah, social media, operational security with social media is a big deal. It’s a really easy way for people to gain access to information and such that they shouldn’t have, but I also just think social media as a whole, we talked about messaging to personal accounts, but even social media messaging, finding the viral message, getting that message out first and targeting that at a social campaign on a broad scale against a company or a personal Twitter, Facebook account, Instagram account, if you get the right viral content this becomes a really big deal.
Bryan Strawser: Just a great example I read last night. John Hopkins fired a professor over the weekend because back in May when the engineering building on their campus was being occupied by a protest and after being told not to do this, he had a malfunctioning server in the building he wanted to go fix. He showed up on his own with some friends and some bolt cutters and got into the building and then was confronted by students.
Bryan Strawser: I’m not gonna get into whether or not firing him and all this was right or wrong, except that I thought the students were brilliant in that they filmed this and before the night was over had their video out with their narrative of what happened and that has been the dominant narrative of what happened. I think that video set the foundation for the story that was used in the hearings that led to this professor being fired. I’m not taking a position on what was right or wrong here, just that I thought the use of the video and the video captioning to tell the story the way the students wanted the story told was brilliant.
Bray Wheeler: Well, that’s actually one of the notes I wrote down on my pad here was record everything. As a protester I’m recording everything because without the deep fakes and things like that that we’ve talked on other podcasts where you’re doctoring video or audio or something like that, just being able to take snippets of real content, putting a narrative to it or editing them in a certain order, or just taking a snapshot in time without the context of the proceeding minute on either side, you’re controlling the story and you have video, you have pictures, you have evidence to support the way that you’re setting up your case.
Bray Wheeler: I think that’s important for companies to realize too, that you need to assume you’re being filmed. You need to assume there are pictures being taken. You need to assume that everything that you’re doing and everything that you’re saying is being recorded in some capacity and spun against you.
Bryan Strawser: I think you’ve even got to think as a company, you got to think about communication security because even emails can be forwarded to other parties. So do you keep your communication through secure means, like a voice call, but of course, your voice calls can be recorded.
Bryan Strawser: There’s a lot of things to ponder. For example, we have clients that we only communicate electronically with. We do email, but sensitive communications happen via signal, which is an encrypted text app. If you’re not familiar with that it’s used by a lot of different people and journalists out there, but I think, thinking about that level of communication security starts to become an issue when you start thinking about how that can be compromised by people who don’t share your point of view inside of the company.
Bray Wheeler: Yeah. Well, and I think just even within social media, from an activism standpoint, if we were running, such a group no proactive information in terms of a campaign, a disruption, something like that, would be shared until after we’ve started the engagement, after we’ve conducted the protest, after it’s happening or doing, live Periscope stream of something that we’re already in the middle of it because any advanced Companies have gotten pretty savvy too, “Hey, we’ve got a monitor. We typically know who some of these groups are.” It’s not easy to pick up on some of that and, “Hey, we can just watch them or set algorithms to monitor what’s going on,” keywords and everything else.
Bray Wheeler: Protesters, they’re gonna figure out the savvy ways of getting around that and they’re going to get smart to that and they’re gonna get wise and they’ll be on the forefront of technology, to your point, until that gets used, then they’ll move on to something else. Or like we’ve talked about even at the beginning, just do it via text, do a call, set up with one of your group meetings saying, “Hey, next week we’re going there and we’re not talking… Here are the details. We’re not talking about it in any other way, shape or form.-
Bray Wheeler: … We’re just showing up, and I think that’s that flash mob. To bring it back to the physical piece that flash mob, whether it’s social or physical, it’s money. It’s money because for a lot of these places there are too many people coming in and out on a daily basis for a lot of different reasons, you have public lobbies or public areas that are easy to just access and “Hey, I’m just reading a book,” and then all of a sudden it’s boom, you have 10 people, 50 people protesting. It’s not hard to make that happen.
Bryan Strawser: Well, even think about… I know we’re back to the physical protesting thing again, but surveillance of the target that you want to protest. What are their routines? When do they open the doors in the morning? When does the security officer patrol? What happens when visitors show up?
Bray Wheeler: What happens when we did a small little protest out front three months ago?
Bray Wheeler: What did they do? Did they lock their doors? What did they do, did they call in the police? What happens? I think surveillance is a great component of that to just pin test a little bit, penetration-
Bryan Strawser: Just keep in mind companies with good security practices are looking for pre-operational surveillance.
Bray Wheeler: They should be.
Bryan Strawser: They should be and we can note that not many do.
Bray Wheeler: Because especially if you have a controlled campus or even not, even if you have a downtown city headquarters, you typically know the folks that rove around your building on a regular basis and what the activity looks like. When somebody’s standing out there with the camera, it’s out of the normal typically.
Bryan Strawser: “Why are you taking pictures of our building? It’s an office star. What’s so interesting about it?”
Bray Wheeler: Who are you interviewing? Right, the architecture isn’t that interesting in the grand scheme of things but yeah, there’s a lot of things that I think companies take for granted, that activists take for granted.
Bray Wheeler: I think that the message here is really creativity and imagination are golden and assume that just because you’ve taken all the measures to protect the executive or the company, public-facing communication channels or spaces or things like that, there are ways around it. There’s access through other tenants that are sitting in your building, there’s access through your family social media account, there’s access through your family weddings, events, parties, speeches. Anything that’s out there you got to assume is out there and you have to be prepared for that and take it accordingly.
Bryan Strawser: Even things like your home wifi. If you’re a corporate executive, lock that stuff down because have an open wifi point and have some things in your house like Nest thermostats or cameras or a Ring doorbell or whatever, and let us find that from the street the first time we pull up because you will lose control of all of that or it’ll be used against you.
Bryan Strawser: Imagine if you had a Nest or Ring doorbell and somebody got ahold of the videos off of that and what they could do with that information, deliveries, guests, you can have a heyday.
Bray Wheeler: I think that’s an interesting point just from the whole internet of things aspect. There are stoves you can turn on with Alexa now. Everything is becoming a part of that to turn on some of these things when nobody’s home, to access these things while people are home, to be able to hear what’s going on, to see what’s going on, to see what people are utilizing to see what’s being turned on, what things are set up. Technology is great, but there’s that privacy piece to it too that you have to be conscious of.
Bryan Strawser: Exactly. Well, I think we’ve run the gamut on this one, so let’s wrap up the episode here. I think the most important thing for people to think about as they listen to this episode is it would be beneficial to you to take the time to think about the current state of affairs at your company, your organization, and think about how if you were to wear the black hat, how would you attack your own organization? Even if you know the things, you have inside knowledge, even the things that you know are vulnerabilities, how would you go about attacking it? And then I would set about to close or prepare some mitigation and response tactics to those vulnerabilities. Final thoughts?
Bray Wheeler: As weird as it sounds, it’s a fun exercise to do.
Bryan Strawser: Oh, it’s a blast. It’s Red Teaming.
Bray Wheeler: Yeah, it’s not the typical, “Hey, I got to write a process.” You’ll probably get to that, but at the forefront of it, this is where you get to use your imagination. This is where you get to come up with all sorts of crazy scenarios to work yourself through to say, “Is that crazy? Is that plausible? Could that happen?”.
Bryan Strawser: Well, if you’re a publicly-traded company for fun and games, look at your five named executives on the compensation table, go pull their political donations and see if you see anything controversial there.
Bray Wheeler: Or see if you can find their social media.
Bryan Strawser: See if you find their social media, not their official company one-
Bray Wheeler: Their-
Bryan Strawser: Personal one.
Bray Wheeler: And see what their-
Bryan Strawser: And don’t tell me they don’t have one. James Comey as Director of the FBI had a clandestine Twitter account that came out after he left.
Bray Wheeler: They’re out there and I think that’s a good way to explore it too, is just to do some initial probing and just see what your exposure is. If those things aren’t necessarily there, then you can move on to other things, but it’s a great opportunity to have some fun. You can really get a lot of different people cross-functionally engaged with some of that.
Bray Wheeler: It does come at a… probably you need to make sure you give notice and give awareness to the proper people so you’re not the guy or gal that’s just searching executives like crazy, but if that’s your role and you’re able to do that, weirdly, it can be a lot of fun.
Bryan Strawser: That’s it for this black hat edition of the Managing Uncertainty podcast. We’ll be back later in the week with our BryghtCast. Hope to hear from you then.
It’s our one-hundredth episode! In this episode of the Managing Uncertainty Podcast, Bryghtpath Principal & Chief Executive Bryan Strawser, we discuss a common employee...
You won’t want to miss this episode. There are few things that have caught the attention of business leaders and individuals around the world...
In this episode of the Managing Uncertainty podcast, Bryan Strawser, Principal and Chief Executive at Bryghtpath, delves into the impacts of global political upheavals...
