FMC Fast Chat with Richard Torrenzano, Reputation Expert

FMC Fast Chat takes you inside the news so you can be in the know in 30 minutes. Hosted by Fair Media Council CEO and Executive Director Jaci Clement, Fast Chat features notables in news, media, and business.

We're very fortunate to have with us today Richard Tornzano, the Chief Executive of the Tornzano Group, which helps organizations take control of how they are perceived. Rich is a sought-after expert and leading commentator on crisis, brands, reputation, and financial markets. He also co-authored the award-winning bestselling book on reputation management called Digital Assassination: Protecting Your Reputation, Brand, or Business Online Against Online Attacks. And now we're going to spend the next 30 minutes discussing how you can protect yourself and your organization.

Good afternoon, Jaci. How are you? Good to see you.

I'm great. Thank you so much for doing this. We appreciate your time.

You're very welcome.

And there's a lot to discuss, so let's just get right into it because I'm sure a lot of organizations out there think that, you know, digital assassination sounds like something that should only or could only happen to large organizations or whatever they would think would be an important organization. So let's talk about who's at risk and how risky is it out there today.

Well, it's very risky out there today. And I think any size organization or any individual is at risk today, whether you're a CEO or a board member, a celebrity, a teacher, a journalist, a lawyer, a doctor, anybody is at risk today, including many corporations, of digital assassination. Digital assassination comes in 2 flavors. There's cyberattacks, and then there's just purely digital attacks. But let me take you through the 3 types of attacks, they generally are. There are cyber attacks from the outside to companies. These are usually by state actors, by crime syndicates, by other trolls who want to either destroy or steal data, money, or intellectual property from a company. We have seen this happen all through the the last couple of years. You look at companies like Boeing, Facebook, Equifax, United Airlines, British Petroleum, Toyota, Sony Pictures, Target, Domino's Pizza, and many others, all have been— have had to deal with significant digital attacks. The streets on Wall Street are lined with the debris of companies who were ill-prepared for this. The second type of attack is really a reputation attack. And this comes from companies, company operations or managements that do something wrong, or there's a product liability, or harm somebody, whatever, or shoot themselves in the foot. The poster child for that is United Airlines. When they dragged— that Sunday, they dragged the person off the airplane a few years back, and compounded that by just terrible communications. And the third type of attack is kind of the sneak attack. Those are not the attacks that we generally see a lot of, but we're seeing more of. And these are the attacks from within. These are current or former disgruntled employees that have an ax to grind about the workplace or about their job promotion or their salary, or even worse, commit commercial espionage. So on the corporate side, what we've seen is that early on, 3, 4 years ago—

excuse me—

you saw giant corporations being attacked, and we still see some of that, but it's getting harder to do that because corporations have spent billions of dollars over the last few years to protect themselves from From attacks. Now, in saying that, let me also say that any corporation with a brand name today is attacked hundreds of times a day. I'll say that again, is attacked hundreds of times a day, in some cases maybe hundreds of times an hour, but they have the defenses up today to protect themselves from those random attacks. Individuals are the same way, and I think we're going to talk a little bit about more about individuals a bit later.

Yeah, but basically, if I'm hearing you correctly, anybody with an online presence today is at risk?

Anybody with an online presence is at risk, you know, and I think corporations spend a great deal of money and resources to protect themselves. Some, some are helpful, some are not. But, but if you look at our personal digital house, if you would, when you have a home or you have a You have an apartment, you may have an alarm system, you have maybe one or two locks on your doors, you have, you have your windows closed and locked, you have, you may have a dog, you may have a digital dog that when the postman comes to the door, the digital dog barks. You may have, you may have a system that turns lights on and off in your house when you're away. If you're in a small community, you may stop your mail, or you may even alert the local police department that you're going to be gone for a couple weeks. to watch your home. So we do all those things necessary that we can do to protect our physical home, but we don't do the same things to protect our digital home. Your computer or computers or your handheld devices are your digital home, and they can be attacked in many, many different ways today, from sending emails to get you to open them up in a phishing exposition, or just other ways to attack you and infiltrate you. for ransom, to steal your data, to steal your money, all sorts of things. I think we've seen so much of this in the press, in the headlines, the last 5 years. Everyone really needs to be on their guard, whether it's for their business or their personal environment.

Okay. Let's dissect this a little bit. Give an example of an organization that has handled of these situations well? And then talk a little bit about the opposite end of the spectrum, which is an organization that just totally blew it from start to finish.

There's a lot of organizations— the streets are lined with organizations that have not handled it well. And we will talk about those who have handled it well and have not. And the key difference, I think, in handling something well and not handling it well or managing it is really preparation, having a response plan, and rehearsing that plan. I can count on multiple hands how many CEOs I've heard say, well, that will never happen here. And weeks or months or years later, sure enough, it's happened there. Pepsi as a company has done very, very well with attacks on several occasions. The poster child for not doing it well, as I mentioned before, is United Airlines. Not only did they have an operational issue that they did not handle well, but they put out statements which were not correct, which were not true. They tried to— did not understand the digital world and the instantaneous nature of it today. When we have an attack or when we have a crisis in a company, we're on an accelerated clock. And in my book, Digital Assassination, I coined a phrase, the 8-hour digital day. An 8-hour digital day means that you have somewhere between 2 to 4 to 8 hours to respond to a crisis that's happening that's attacking you. Now, all attacks should not have a response, but if you had to, could you respond in a thoughtful, analytical way in that period of time? Most companies, most boards, most managements, most advisors have not been trained or able to handle that in an accelerated timeframe. So I think we have to rethink, we have to have a rethinking about time, and not so much about media cycles as we used to think 3 or 4 or 5 years ago, but digital cycles. And I think we have to look at that and understand that if we are attacked, we have to be able to respond very, very quickly. And it United and Boeing are 2 good examples of how not to do it. United not only had to put out several announcements over a 3 or 4-day period because their announcements were not correct, they did not jive, if you would, with what the video of passengers on the plane were actually showing and saying. So they were saying there was no problem when indeed there was a huge problem. And more importantly, they let the lawyers take charge. Now, lawyers are a very important dynamic in any process like this. They are part of the process and not the sum of the process. And when you have lawyers speaking to the public, particularly the general public, that does not work well, especially when they use words and information that no one understands what they're saying. There were words in those 3 United Airlines statements that I had to look up. So you had saying there was not a problem, there were false issues by the airline. You had to put multiple statements out because you weren't speaking in plain English. And you lost enormous credibility with your audience, with your passengers, with your sales. You had class action lawsuits, you had loss of equity value, you have people no longer wanting to work for the airline anymore. They're going to have difficulty not only retaining but attracting new people and so forth. Boeing is another good example of shooting themselves in the foot. In the last year, they had huge problems with their MAX airplane. As you know, it had to be taken offline. There again, they said there were no safety problems when indeed there were safety problems. You can't be putting out statements when you don't have the facts available just for the sake of putting them out. They too had emails that were released that basically had their executives saying that there were no safety problems. They were making fun of safety problems, and they were mocking some of the regulators. Not a very smart thing to do. So as you look at a crisis, you have to look at all the constituencies that participate in that crisis with you. If you're a public company, you have shareholders and lenders. If you're a private company, you have lenders. and investors. You have customers and employees, all levels of employees from the board to the management to all employees throughout the company. They may be in different geographic locations and have different needs and need different information. You have all sorts of other people which are very, very important to the organization. So you have to think about all these things, and most importantly, which very few people think about, you also want to think about your competitors because your competitors are going to comment. They're going to be part of the mix of constituents that, that comment on you in a good time. They're surely going to be part of the mix of constituents that, that comment about you in a bad time.

Yeah, okay. But give us some insight on what should be happening internally. in an organization when something bad happens online to an organization? It sounds like some of these examples are statements coming directly out of the upper tier of management who didn't have any idea what was actually happening on the ground.

Well, let's take a step back. Again, before something happens, before you have whether it's a digital attack or a crisis or anything happening going on, You need to have a response plan in place and you need to have a team, a crisis team in place, which needs to be led by a C-suite executive. Not necessarily the CEO. The CEO will have a role to play, but he or she should probably not lead the crisis team. He or she should be part of the crisis team.

Right.

And that crisis team should involve marketing and operations and communications and HR and all the different people involved In, in a crisis team internally, as well as outside advisors. If it's a digital attack, you're going to need operational forensic people in the digital space. You're going to need lawyers with expertise in that space. You're going to, you're going to want to look at your insurance to see what is covered, what, what your costs are covered in that space. And you're going to need outside people like our firm to deal with— help you deal with reputation. Most internal organizations, not all, but the vast majority of internal organizations do not have the experience or the expertise in place to, to deal with a crisis. They just haven't been through it. So, and these other organizations that I've mentioned all have multiple experience with multiple crises. All crises are different. All attacks are different. They're different because of geography, they're different because of industries, they're different because of personalities, they're different because of how the attack happens. Attacks generally don't happen during 9 to 5 business hours.

Right.

They tend to happen in the evenings, on weekends, and now I've seen lately on holiday weekends when they're least expected and when corporations have the least amount of resources To throw at the problem. And that's very, very important to think about. Most corporations are not thinking about it that way. They think everyone's going to be around. So, so the first step is to get— is to have a plan in place and to really develop what are the what-ifs that are apt to happen to your organization. Larger organizations are going to have more what-ifs, smaller organizations are going to have less what-ifs, but you need to— what are the what-ifs and how do you plan scenarios against those? Then you got to rehearse the plan. You have to rehearse scenarios. You have to have tabletop exercises and other situations. And we always find that in these exercises, when you know that 11 o'clock next Tuesday, we're going to have a drill, and whether that be a gun on campus or a cyberattack or whatever the drill you want to be—

Yeah.

an active shooter or a cyberattack, you're going to be there at 11 o'clock, you're going to be smiling, you're going to be engaged, everyone knows about it, everyone's going to be present, it's going to work very well, everyone's going to be very proud of the work they did. And then 3 or 4 or 5 months later, you're going to do an unscheduled attack.

Okay.

It's not going to be real, of course, but it's going to be unscheduled. Who's on vacation? Who's not around? Whose phone number changed? who can't be reached, etc., etc., etc., because it's on a holiday or a weekend, and really the only one knows about that unscheduled exercise is probably the CEO. So, so it's not just a matter of having a plan. It's not just a matter of understanding what the what-ifs are in your organization or your industry, your geography. It's not only a matter of rehearsing the plan, but it's being on guard that when these attacks can happen, which is usually, not always, But usually at night or on holidays or on weekends, you have to be prepared and ready to throw resources at them to deal with it. United, for example, the poster child in this area, the attack happened on a Sunday. The situation happened on a Sunday. Other situations happen over a period of time, but all of these situations either begin or end up online. They either begin or end up on social media. None of this today is just done— is done without what's happening in social media. And that's whether it's consumer companies, small companies, large companies, or companies that do business to business. It all gets back to digital today, just like all of our lives get back to digital, whether it's in business or personal or whatever.

Yeah. Okay. So if we talk about a plan, though, I know a lot of organizations, they'll create a plan. They put it in the drawer for safekeeping, and it kind of stays there. So how long can a plan be considered good before it needs to be gone over again?

I spoke in London last year to a couple of dozen CEOs just about this subject. And I basically said to them, if you had a plan that was hatched in the last 12 months, you should throw it into your trash icon. And I use the word trash icon, not book or your wastepaper basket, Because plans today that are on a shelf in a loose-leaf binder have no value. Because if you need that plan at 9 o'clock in the evening or on a Saturday morning or on a Monday of a holiday, you have no access to it. So plans today, like what's being attacked to you, have to be digital. They have to be in a cloud. They have to be on a website. They have to be somewhere that through your name and a code and your email, you have access to that plan. So if you're putting it on a shelf, and I can't tell you today how many people are still planning for crisis or digital attacks as they did in the 1980s.

Yeah.

This is 2021, and nothing should be on a shelf today collecting dust. It should be digital, and everyone should have access to it, whether they're in their office, their home office today, where many of us are, or on vacation or on a business trip. If you don't have access to that plan instantly, the plan is of no value.

Okay. And should every employee have access?

No. The crisis team needs access to it, of course, and those who need access should have access. The plan should be there, phone numbers should be there, a process of who's doing what should be there. This is a big undertaking to develop that technical plan, that digital plan. You'll need approval levels of statements. Different people, of course, in any company have to approve a statement, and you want to see what that process is, who approves it first, second, third, fourth, and fifth and last. You want to have a process to who's going to be drafting what, who's going to be doing what, who's going to be finding out what. One of the most important things in normal times for a company is to have relationships, a two-way conversation, or two-way communications rather, with your various constituents. That's just not the obvious ones of investors and maybe customers. There are vendors and suppliers. There are lenders. There are regulators. There are local— regional and community leaders, depending on the crisis, that need communication. There's a great story about Rudy Giuliani. And you may recall when Rudy was mayor, there was a terrible plane crash in Queens. I believe the plane was going down somewhere in the Caribbean. And Rudy had— it was American Airlines. And Rudy tried all day, several times, because I even got a call from one of his staff at the time saying, how do we reach these people? They kept calling American Airlines and no one at American responded to them. Well, at 4 o'clock and at 6 o'clock and at 9 o'clock, Rudy was on the air talking about the crisis, what, what the city had done. No lives had been saved, but how they were going to manage the cleanup, how they were handling the grief of people. And oh, by the way, he just kicked American Airlines down the road repeatedly on every press conference.

Why?

because the mayor of the city of New York, where the plane crashed, could not get a return call back from American Airlines. So constituents, in normal times or in a crisis, can be very helpful to you in getting your messages out there about what the good things you're doing in a terrible situation. In this case, he had no— he could not get communications from the company. So all of your constituents have to be prioritized and show the importance of it. If you're a manufacturing company and you're going through a— a financial situation. You could, you could have vendors and suppliers not supply you with, with, with goods and services, so you can't manufacture things. Every constituent you look at is important to a company's makeup. And all these people need time and care and, and to have a good constituent— good relationship with. Those who have good relationships in normal times will do very well in a crisis. Those that do not have this kind of honesty and two-way communication in normal times will not fare well in a crisis.

Okay, it sounds like you also need quite a bit of redundancies built into your plan. And by that, I mean, okay, I have a designated spokesperson, but if you're doing something unscheduled, spokesperson could be drunk, on vacation, whatever, you still need someone who's the face. So what do you do when the main person is out?

The spokesperson is just one person of a much larger plan because a company is going to have many spokespeople. One spokesperson to the media may be public, but you're also going to have a spokesperson to investors. You're going to have someone in the legal department talking to your insurance companies. You're going to have someone talking to your lenders. You're going to have someone talking to employees from HR. You're going to have someone talking to all sorts of constituencies. So while we may only see a spokesperson that faces media, there are, there are many faces that reach out to constituencies from a corporation or from an organization, whether it be public or private, that have to address multiple constituencies.

Okay, how often do you recommend that it's actually the CEO that is the public face when there's a crisis going on?

You know, there's no one-size-fits-all, and I think there are times when the CEO's visibility is helpful, and there are times when the CEO's visibility is not helpful. Let's go back in time a little bit, and let's look at the Exxon Valdez, which is probably now more than 25 or 30 years ago. You will remember that Rawls, who was the CEO, chose on lawyers' advice not to go to Alaska when that happened. Now, he could have gone and he could have said, gee, I don't know what happened here, but we're going to look into this. We're going to cooperate with all local, regional, and federal authorities. We're going to do everything we can to make this better. Now, let me tell you the action items that we have going on right now, okay, to try to solve this problem of what's been taking place and to try to help the community that's being affected by this problem. He did not do that. He did not have to go and accept blame or responsibility, but he needed to go up and show a presence. In that case, the CEO was necessary. Okay, in another case, the CEO may not be necessary. So you don't Immediately drag out the CEO, but you have to have somebody who is knowledgeable and has the understanding of the business and has an understanding of what's taking place and have— and has been prepped about all of these various options during a plan. So, so it's not just one face or go right to the CEO. There's a lot of steps along the way, and there are judgment calls based on experience and wisdom of who should be involved at what point when.

Okay, I want to segue to individuals now because we're running short on time. So if I were to take this idea that I am the CEO of my own life, how should— what should I be doing to be protecting my personal reputation?

Well, as I said before, you should have all of the necessary safeguards on your computer systems, whether they be handheld systems or or laptops or stable systems. I don't sponsor or I'm not engaged with any of the systems, but one of the great systems that I use is LifeLock, and I can't think of the name, it starts with an N.

Norton?

Sorry?

The Norton one?

Norton, yeah. They have a good system. There are others out there, but you have to have one of those systems on your on your computers. Second thing you should do, which always rolls eyes when I say this, and this is, this is really vitally important. This is, this is one of the most important things I can leave with you today. Every channel that you have, every platform that you have, every website that you engage with needs a different password. It should not be your cat or your dog or your first child or your husband's name or your middle name or your birthdate. So many celebrities' and personalities' passwords have been broken because hackers put those words through stories and research and put those in and broke the passwords, whether they would be nude pictures or losing of information. So you want to have every single channel, every single engagement you have to have a different password. Now, this is where I get the eye rolls. Every password should be between 15 and 25 characters. I say characters.

Wow.

They should be numbers, they should be letters, they should be upper and lowercase, and they should be hash signs or exclamation points or question marks. There should be no rhyme or reason to the words that you use because there are programs that can that can crack that if you don't. Now, this is not going to say that you can't be broken into, but you won't— like the lights going off in your house, like this, like the alarm system, like the dog barking, you want to do all the things that you can do to protect your digital house. Those passwords should not be on your computer. They indeed should be in a binder next to your desk or in a safe place. I have them in a binder in a safe place in my home, and I have them not only for myself but for my company. And I will tell you, there's probably about 50 pages of passwords there for both. And those passwords need to be on a rotation basis to change every 6 or 9 months. Now, I know that's a lot. I know people say, well, I don't need to do that. Well, if you don't need to do it, and when you get hacked in the next year or two, Please remember you said that.

Yeah.

So it is really a process today. It is something that you need to spend time with to protect yourself. You shouldn't be opening emails from people that you don't know who they are. I delete them. And if somebody really needs to get in touch with me, I don't know, they'll either call or send me another email, or I'll start looking them up if I see a multitude of emails. But I don't open every email. If I don't know the person involved, and even if you do, there are people who can, who can send you ghost emails, fraudulent emails, saying they're somebody else and not really them. You should look— you'll see emails come all the time from, from so-and-so, but it's at a very strange URL. You look at the URL, see where they're coming from. Don't just, don't just open emails up, but you have to spend the time and care to protect yourself and to protect your personal life as well as your professional life.

Okay, let's wrap up with what are the 3 main things people should take away from this, whether it's protecting their organization or themselves personally?

Well, for the organization, it's real simple. Have a plan, create the scenarios based on your company, your geography, your circumstances, your constituents, and then rehearse the plan not only once but more than once. And don't just do it at a time when everyone knows it's going to happen. For yourself, review your emails, get them in one place, put them in a binder. I say a binder. Don't have them on the computer because if your computer is hacked, they're going to have all your passwords. Put them in a binder, organize them however you want, and then change them every so often to protect yourself. These are the kind of things that are basic breathing functions today. They're not new. They're not something that, that we did in the '90s or the early part of the, of this century. These are things you have to be doing today to protect, protect yourself, your family, your brand, your business, and your personal life.

The Fair Media Council is a 501 nonprofit organization advocating for quality news and working to create a media-savvy society. For more information about the Fair Media Council, and upcoming Fast Chat shows, check out fairmediacouncil.org.