What is Black PR? A tour of the black arts.

Last month, I saw Black PR mentioned for the first time on GNUCITIZEN. I never heard of it and it intrigued me. We all know that PR stand for Public Relations but what is Black PR?

Black Public Relations (BPR) or negative PR is a process of destroying someone's reputation and corporate identity. In other words, instead of concentrating your efforts in the maintenance and the creation of a positive reputation/ image of your clients, you are trying to discredit someone' else (usually your business rivals). Unlike the regular services in Public Relations, those in BPR rely on the development of industries such as IT security, industrial espionage, social engineering and competitive intelligence. Their main objective is finding all of the dirty secrets of their target and turning them against their very own holder. (Wikipedia)

So I started going through the blog of Spin Hunters who specialize in PR security. Let's have a look at their 10 simple rules for detecting Black PR attacks:

Keep a good eye on your business rivals.

Have a good understanding of the SWOT trends of your competitor. Be aware of what they are up to and what they are willing to achieve. Know their allies and managing practices. It is also a good idea to make an attachment to your risk assessment plan, showing how each security vulnerability could be related to some of your corporate enemies.

Monitor your company’s activities.

Do no wait for a crisis to happen to realize that something is wrong with your organization. Try to be updated of every ongoing process and conflict affecting your business and people working with/for you. I mean everything - relationships, frictions, ideas, ambitions and so on. I know that this sounds like too much, but having as much information as possible will always help you respond promptly to any in/out-coming threats and more importantly to define the source of the information leakage, if it occurs.

Know the basic methodology of Black PR campaigns.

Usually BPR practitioners operate in two major ways - stealing information and behavior provocation. Spend some time analyzing your own vulnerabilities and what kind of data is valuable to the attacker.

Check your computer networks regularly.

Information is the digital-age equivalent of gold. It is everything and it must be protected at all costs. But guess what? Computers, just like humans are vulnerable to attacks.

Performing regular security checks on your computer networks is a must, as it will provide you with information about the potential ways hackers could get in and alert you to what resource they may have access to. In case your systems’ security perimeter has been compromised, hire a tiger team to perform a forensic analysis that will give you further insights on the damages. This information is essential for the anti-BPR campaign.

Rely on your own contacts.

Maintaining a good network of contacts is always helpful in cases of malicious identity attacks. Spend some time investing in good professional relationships. Let your allies know that you appreciate all information related to you or your organization. Don’t forget to pay them back with the same integrity.

Investigate every minor complaint.

One of the most common tricks used by black-hat PRs is to submit a vast number of complaints in consumer complaint reports ( both internal and public ). If you find their claims are false or a bit exaggerated, trace the message to the original author and see if there is a possible reason why this person would want to discredit you or your organization, or contact the users directly for more detailed information. There are lots of power tools out there (like Patevra), showing the relationship between emails and user names.

Know your employees.

AAs I have mentioned above, most cases of negative public relations start from inside the organization. Needless to say, it is important to know the people working for you, especially those having access to the most sensitive information in the company. Also, keep in mind that the greatest risks are coming from those with short - term contacts with the organization, such as cleaners, interns and office improvement staff.

Analyze the media coverage.

The idea here is to find out who stands behind the negative coverage your company is receiving. This could be a single person, a whole corporate entity or just someone who anonymously is trying to set you up. One of the easiest ways to find out is to analyze the sponsors/allies of the particular media or just call the editor’s office and ask how they got this information.

If the exposed information is not true you can either seek an injunction or sue for reputation damages. However, if the story about you is true, your next move should be to urgently call your crisis team and try to predict your rivals’ further intentions.

Setup traps.

Here is a little strategic game. If you wanna make sure that all of your problems are due to an intended negative campaign, place bait all over your networking systems and see who falls into the trap. You can do this by posting specific juicy information (it could be true or false, but definitely something that is not a threat to your business) in some of your internal applications. If this information is leaked after that, you can always check your networks and find the IP address of the intruder. Additional hacker/hi-tech tricks can also be used.

Personal BPR.

Here is the good news. Unlike corporate defamation, negative personal attacks are easier to detect. Their main aim is to destroy personal reputation and involves all of the methods used for other types of organizational violation.

Usually one the most common signs of BPR, is that the target suddenly becomes involved in many unpleasant situations.

If you want to have a real world example of a Black PR campaign, have a look at their analysis of British Airways against Virgin Airlines. For me it was a real eye opener.

Moving a bit back to IT Security, they have another really interesting post: Darksites hide many security threats:

By definition, a dark website is a pre-made, non-visible website, that can be activated online when a particular crisis occurs. It is common for most companies to have several ones and all of them are customized according to certain vulnerabilities and corporate risks. They store written-in-advance news releases, pictures, official statements and other background information, as the specific details will only be added right before their release.

The dark site can be placed on a separate domain, be a distinct section of the main website or totally replace the original. It could be saved on any of the corporate servers or be kept safely on a preferred external device.

How this is related to Black PR

Because of the significance of dark websites, they have also become targets of many malicious scenarios. Probably the scariest threat for companies is someone intentionally triggering the content of the site online, without the permission of management. The system administrators will soon repair the “mistake”, but the point here is totally different. The actual goal of the attackers is not to create a false appearance of crisis, but to make a destructive buzz and to lower the public trust towards the target. Even if instantly refuted by the corporate crisis team, the situation will still be strong enough to cause a massive confusion among the audience, especially when all of the Web 2.0 applications allow you to achieve that in a matter of minutes. And remember - the information on the Internet always remains cached, so the chances of someone going back to those issues are actually pretty high.

So Black PR and Dark websites, some things I never heard before. Fascinating. So beware, not all of information security has to do with firewalls.