Via The Guardian: PlayStation Network Hack Headsmack

Sony sought to explain to PlayStation owners why it has taken seven days to reveal the extent of last week’s PSN hack. In a post on the company’s blog, Nick Caplin, head of communications at Sony Computer Entertainment Europe issued this statement:

“There’s a difference in timing between when we identified there was an intrusion and when we learned of consumers’ data being compromised. We learned there was an intrusion 19th April and subsequently shut the services down. We then brought in outside experts to help us learn how the intrusion occurred and to conduct an investigation to determine the nature and scope of the incident.

It was necessary to conduct several days of forensic analysis, and it took our experts until yesterday to understand the scope of the breach. We then shared that information with our consumers and announced it publicly yesterday evening.”

In what world is it okay to have at least a reasonable suspicion of a personal data breach and then wait for seven days to inform your customers?

Where is the harm in letting people know what’s going on? “We shut down the PSN because we suspect the Network has been hacked and we’re working with forensic analysts to identify what, if any, personal data has been exposed. We’ll keep you updated as our investigation continues.”

Seems easy, right? Seems at least better than shutting down the Network and going dark for a week.

This little lesson doesn’t do much for our traditional emergency management folks. Explosion = can’t deny it. But for executive communicators, get ahead of the story! Set the tone! If you’ve got bad news coming down the pipe, let people know about it sooner rather than later. The reason why is because once you start holding off on releasing it, it becomes that much easier to continue holding off on it.

Consider Sony’s case. I’m sure the initial conversation had someone saying, wait, let’s just make sure we were hacked. Which quickly turned into, before we say anything, we should know how bad it is; and then into, I’m not breathing a word about this until we know for sure that personal data was compromised. And then–boom–it’s seven days later and the world knows you’re hiding something.

For a great example of how best to do it, check out my coverage of the WordPress.com hack.

There Are No Crisis Communications Rules

There was an article that’s been sitting in my queue for a while now about the so-called “rules” of crisis communications. Gerald Baron’s latest post on Taco Bell’s recent troubles has caused me to resurrect this post and confirm that my original feelings were correct.

An article from March in The Globe and Mail’s The Manager blog relayed an article from the Harvard Business Review that examined Apple’s so-called AntennaGate. You remember AntennaGate, right? After the release of the iPhone 4, there were complaints from across the country that if you held the phone just so, one’s connection to the network would be significantly degraded. The media, at the time, was full of stories about refunds and recalls and free cases and Apple being in turmoil. Less than a month after the launch, Apple held a press conference to address the situation.

Crisis communications experts around the globe all finished watching/reading/hearing about the press conference with their jaws on the floor. The response broke every one of their sacred rules for how to address calls for one’s company’s head. Within weeks, the issue was gone. Not in the media, not online, nowhere in any force.

Most PR folks were quickly engrossed in the next meltdown and moved on. (Experts and gurus and ninjas, hmph.) Until HBR came out with a review in mid-February, it was pretty much out of the public’s eye. And what they found was that Apple broke all the rules, and survived. And that there’s something we can learn from that.

Amongst the rules broken:

  1. Apologize and take full responsibility.
  2. Don’t create expectations with a media event.
  3. Announce the give away first.
  4. Avoid specific comparisons with competitors.
  5. Don’t air your industry’s dark secrets.

I advise you to visit the HBR or Globe and Mail pieces for the full breakdown, but the bit that I found interesting wasn’t how they broke the rules, but instead why. Plain and simple, they broke the rules because the rules didn’t satisfy their needs. They’re Apple and they’re disliked by their industry and are widely considered to be the premier cellular phone manufacturer in the world. Cowing and and bowing and scraping doesn’t do them any good—so they didn’t do it. They maintained throughout the situation that this was not their fault and not unique to their handsets. And then proved it.

This applies to all of us in PR and emergency public information not because it means we can throw away the rulebook, but because we should understand why the rules are what they are. What are you trying to accomplish by apologizing right off the bat? Does that set you up poorly for future problems? What are you saying when you minimize the problem and why are you saying it that way? If the problem has always been around, say so.

This applies to the Taco Bell piece because they did something similar. Instead of cowering when accused of having not enough “meat” in their meat, Taco Bell grabbed the offensive. Not only did they use the crisis as an opportunity to educate the public about their product (Geez, how many times can I push the whole “take advantage of the media attention” bit?), but they fought back because they were right.

What I’ve learned from all of this? There are no crisis communications rules. There is only your response to your crisis. And that should change according to the situation, the players and the world around you. In emergency planning, they say the first casualty of a situation is the plan. Why do we feel that communicating in a crisis should be any different?

Quick Response Bar Codes for Emergency Preparedness

Do you want to know what I consider a missed opportunity? All of the great work that folks in public health and emergency management put into poster development. See Something, Say Something. Get Yourself Tested. Be Ready. The Flu Ends with U. Great slogans each of them. And frankly, they look great on posters. Edgy images, bright (or dark) coloring, extreme close-ups, all caps san serif fonts; they can be really well done.

The problem is that the messages above are all that really fits on these posters. And I don’t think anyone would believe that these messages are the full amount of what we need to tell our publics about them. Get Yourself Tested is, as an example, pleading for more information to be included: tested for what, is it safe, is it private, I don’t sleep around, etc., etc., etc. See Something, Say Something? Say what, about what, to whom, is it wasting time, what if the police are the ones that are doing something weird, and on and on.

Our normal reaction to this obvious shortcoming (besides minuscule text at the bottom of the poster) is to print a website address on the poster and direct people for more information. For people with so-called “dumbphones” this is completely unhelpful unless they take out a pad and paper and jot the information down and hope to get it to later. Double-u, double-u, double-u, dot, pea, aitch, eye, el, ay… People with smartphones, though, have it a bit easier. All they have to do is type the address into their phone’s browser and get instant access to all of the relevant information when they need it most. Double-u, double-u, double-u, dot, pea, aitch, eye, el, ay…

There is another way to do it, though. So-called Quick Response Bar Codes, or QR codes, are increasingly finding their way into recent ad campaigns. They are being included for the same reasons I complain about above. Signs about, “Big Sale!” don’t really give all of the necessary details, and rather than refer people to some website or handout with all of the rules and regulations of the sale, stores have been including QR codes as a way to get deeper response from their customers. Special deals, the latest styles and more information is right at your fingertips.

How do QR codes work? Well, they’re just like the barcodes you see on every product you buy. But instead of some fifteen- or twenty-digit number identifying the product, they can hold oodles of information, like a website address or really anything else (What if it held an entire offline website accessible only by those who scan the code? I totally believe that QR codes are going to explode in use as coders continue to learn how best to use them). Using any of dozens of QR code readers freely downloadable to smartphones, the phone’s camera “scans” the QR code and “does” whatever the code says to. For the most part right now, they instruct the phone to open a browser and head to a particular website. Even with that rudimentary level of interaction, it is miles better than our current efforts. Couple that with it being free to create QR codes, essentially free to include on our posters and free to download QR code readers and this should be a no-brainer.

The End of Crisis Communications

About a month ago, there were a couple of posts that I came across that really resonated with me. I know that the majority of my posts here deal with crisis communications and emergency public information, but this post kind of turns that whole thread on its head. Or reinforces my thinking. It’s not very straightforward, which is why this post has sat so long without being published.

On March 8th, Gerald Baron asked his readers if they thought crisis communication was, “going the way of the dodo.” Was it becoming obsolete? A quick scan of the internet shows that as a career, there are few specialties as hot as crisis communication right now. And there are a million people (myself included) who spout off on who did what right and (more likely of the two) wrong in response to a crisis. Self-proclaimed “experts” and “gurus” and even “ninjas.” So, one has to wonder, why the disconnect? Why does someone whose made a sawbuck or two in this field think it might be over?

Gerald says:

Because as companies and organizations shift from a mass mediated engagement with their audiences, to a far more direct engagement, crisis communication becomes simply a part of the on-going, direct conversation that they have established with the people important to them.

And

Organizational communication is becoming more and more like an on-going conversation. In a crisis, the event that occurs becomes the dominant topic of conversation. But it is just seen as a continuation of the conversation—faster, more intense, more important—but not substantially different from the day to day conversation you have been having.

The thing is, I think I agree with him. Granted, this is a ways down the road. Crisis communication will continue to be a hot thing to have on your resume or LinkedIn profile. But as day-to-day communication gets better and easier (see the slowly blossoming field of Community Managers) and the public begins to realize, en masse, that communicating directly with companies and agencies is more effective than anything else out there, the need for crisis communicators will start to fade away.

The biggest reason that I think this might be happening is because of single, disparate tests and efforts and beta tests and rogue bloggers (points at self) trying this stuff out. Take, for example, the work done by the Walsall Council, a dot in the middle of the English island. (West Midlands? Apologies for my poor understanding of English geography, but I’m on a bus here.) They recently held an event dubbed, “Walsall24.” The idea was that local government employees would take 24 hours, beginning at 6am March 4th, and tweet everything they did. And they did, 1,400 times. On police deployments, on noise complaint investigation, on classes being held, on meetings, on materials being made available to the public, on what’s going right (and I hope what could be done better), you name it, they tweeted it.

The idea behind the effort was to give the folks who live in Walsall an idea of what local government does for them. (On a side note, I LOVE this project for that single reason. The vast, vast majority of people have no clue what their government does for them. They think we just sit around and play Solitaire all day, when the truth is that we work harder and do more to protect and support them than they could possibly imagine. We should all strive to tell those good stories about the great work we do.) They’ve established that local government can be open as possible and still get stuff done. The next time something like this happens, perhaps the tweeters will be allowed to engage in discussions with the public. Why they’re doing something, why they’re not doing it differently, what can be done better or faster or cheaper, and on and on. (We’re already seeing some of that in Cory Booker’s snowstorm tweets.) Combine Walsall24 with Mayor Booker, and well, you can see where things are heading in government. It’ll take a while, no doubt, but I totally see the dodo-esque nature of what we’re all doing.

Via National Clearinghouse on Families & Youth: A Media Emergency Plan Can Help You Survive a Crisis

Form Alliances

One thing that saved Family Youth Interventions from greater public misunderstanding was their long-established relationship with local media, specifically the Detroit Free Press. In a situation like theirs—which quickly escalated into a public disagreement with the Sheriff about the proper response to runaway youth—it helped to have reporters who knew how seriously the FYI staff took their work and their youths’ safety. “There’s a reporter there who knows to contact us when writing about the area’s runaway population,” claims Baarck, and that trust carried over to the coverage of this delicate situation.

Moreover, your program can approach an unexpected media crisis as an opportunity to publicly share the work you do. Baarck, acknowledging that most nonprofit agencies lack a means of mass communication, says that “any time the media wants to talk with you, it can be a good thing. We took the opportunity to tell our local media and police what exactly we do. And we got quite a bit of support from the community. People came out of nowhere, saying, ‘We had no idea that you were doing that kind of work.’”

Few programs would choose to be thrust into the media spotlight during a moment of such turmoil, but with preparation, you can spring into action with a plan—and maybe even turn a moment of crisis into a moment to shine. By showcasing your organization’s competence and core mission, you can publicly assert your program’s strength and commitment to helping local youth.

This is a great article about how a runaway shelter dealt with a situation involving the sheriff, a runaway and the media. I’m sure your first thought when reading that sentence is that’s a recipe for disaster, but they handled it with aplomb.

The reason /why/ they were able to is the cool part. Relationships, relationships, relationships. Based almost solely on their relationship with a local reporter, they were able to clarify the situation in the print media the first time. It really would’ve been impressive if everyone knew what the agency’s role was beforehand, but one reporter is better than none. Especially when your “internal” disagreement is with the police.