What to Do About Online Attacks

Type the name of the world's largest retailer into an Internet search engine, and you'll discover not only the Wal-Mart Stores Inc. home page, but links to message boards, blogs, wikis and online communities that are unsparing in their criticism of Wal-Mart.

Similarly, a search for Home Depot turns up, in addition to that company's home page, a rogue Web site that features a chat room and postings of customer and employee "horror stories."

Companies have always had to deal with complaints and criticisms—both deserved and not. But the Internet has drastically increased the potential damage to a brand or a company's reputation. Frustrations with a company's practices, products and service that once were confined to relatively small circles now reach complete strangers around the world. With a very low cost of entry, disgruntled customers, workers and former workers are free to post messages, create Web sites and blog about grievances. Advocacy and special-interest groups use their Web sites to stage attacks on companies and rally support for their positions. And all of it is often archived, searchable and printable.

The potential harm from such attacks should not be underestimated. They can damage a company's reputation, hurt sales and scare off potential—and current—employees. Investors may flee, and partnerships may be put at risk.

We've analyzed the themes of many online attacks, and interviewed some of their authors to better understand their motivations. We also asked corporate executives how they deal with these kinds of Web-based attacks. The good news is strategies exist for fighting back and even inoculating companies against such attacks. Often, the first successful step is recognizing that the authors of the attacks are frustrated over what they perceive as unjust treatment.

What follows is our critique of the five basic strategies that companies use when confronted by negative consumer- and employee-generated content on the Web.

The Do-Nothing Approach

The majority of companies we contacted were either unaware their company was the subject of attacks or were taking a "wait-and-see" approach in deciding what to do about it.

More than one company spokesperson justified inaction while citing Abraham Lincoln's famous quote, "You can't please all the people all the time." Others marginalized online critics as "one of a few crazies out there" or as "someone trying to get something for nothing."

What's surprising is that while most of these companies said they conducted regular surveys of their customers and employees, they failed to recognize that online attacks could also help them identify concerns of dissatisfied employees and customers.

RECOMMENDATIONS: Companies need to monitor the Web for criticism and be able to move quickly on matters that could hurt their reputation or brands. Such monitoring should cover not only corporate, professional and industry Web sites, but also grass-roots sites, such as blogs and bulletin boards.

Putting the Lawyers on It

As the Internet was taking hold in the mid-'90s, the typical response of many companies to negative postings was a legal one: They threatened to sue the authors and Web-site hosts for libel or trademark infringement. For a while, the threat of a costly legal battle often succeeded in silencing the critics or forcing a shutdown of their online forum.

But more recently, legal threats have become practically useless in the face of increasing online attacks and the tendency of courts to regard such criticism as opinion, and thus a form of protected speech. There is risk for companies that try to initiate legal action, too. Some that have tried unsuccessfully to use the legal system have found their attorneys' letters posted on the Web for public ridicule, and the author of the original attack hailed as a martyr.

Heavy-handed threats against employee bloggers often have the same results, our research shows. Moreover, prohibiting employees from commenting on anything related to the company on a Web site, blog or forum is unrealistic. Given that the majority of our adult lives are spent at work, blogs will inevitably involve at least a mention of jobs and workplaces.

RECOMMENDATIONS: Companies should examine their current practices in dealing with grievances, gripes and concerns. Researchers have consistently found that the manner in which a company attempts to remedy a complaint and how the company interacts with dissatisfied stakeholders can either temper or exacerbate the conflict—even when the company can't provide the outcome the stakeholder desires.

As a result, companies should limit heavy-handed responses such as threats of legal action to areas in which protective measures are more justifiable—such as preventing financial disclosures, or discussions about strategic and proprietary information. They should also develop clear employee guidelines for when—and when not—to blog, post messages or generate other Web content. Much depends on the employee's position. For instance, an invite-and-engage strategy is likely best pursued by an employee whose formal role with the company will provide their comments with legitimacy. Regardless, it's a good idea to require training for those who participate in generating Web content.

Throw Money at the Problem

We found an overwhelming number of managers who said they believed that complaining employees and consumers cared only about having their grievance resolved—not about being treated with respect.

But in our analysis, throwing money at an aggrieved party is not as effective in resolving a conflict as making sure that the process used in reaching a resolution is fair.