Crisis Plan For A Facebook Attack

Jeremiah Owyang says organisations should have a social media crisis plan for when, say, their Facebook fanpage is subject to attack, as was Nestle's a few days ago.

What is a Social Media attack?

A co-ordinated set of activities to ensure the normal business of a site is ineffective.  For a Facebook fanpage this would usually mean that large volumes of comments with a particular viewpoint are being posted.  It is interesting that the same activity would not be an effective attack on a blog post, your viewpoint in a blog  post remains dominant at the top of the page, and large volumes of comments primarily draw attention to your viewpoint.  On a Facebook fanpage your comments are forced off of the page by the volume of other comments. 

Why do you need a crisis plan for a Social Media attack?

When a crisis occurs, rapid reaction can defuse the situation. Working out what the appropriate reaction is when under pressure is not always easy.  Reaching for a pre-thought plan and following the instructions intelligently, until a more considered response is available is a much better option.

What would a crisis plan for a Facebook fanpage attack, such as what Nestlé experienced , look like?

Your crisis plan should be consistent with other crises plans for your organisation.  And our comments below focus on how to use the technology rather than any internal decison making processes needed e.g. such as when or how to invoke the crisis plan.  These are initial thoughts which could be expanded into a more detailed plan.  A crises plan should cover other eventualities as well - such as when unauthorised people use your Twitter account to spread inappropriate remarks.  In fact all embarrassing stories that have you toe curling , thinking about how you would respond, should be an opportunity to review and update your crises plans.

Image by pasukaru76

When you notice a co-ordinated attack, distinguished by volume, frequency, content and consistency of comments from a coincidental set of complaints from real fans. A judgement call. 

1. Go into the Wall settings and change the default view for wall from  - "Bright Beehive and Fans" to "Bright Beehive".  This means you can can ensure that your viewpoint is not drowned out by volume of "fan" comments.  People can still see those fan comments with an extra click. Explain, in one of your own comments, why you have made this change in default settings, and direct people to the Info tab.
2. Change your LOGO picture temporarily to include the words "This page is under attack", change  the next box down (the INFO BOX)  to include more information and directing people to click the Info tab for more detail.
3. On the Info TAB, insert in front of your previous material the following
   1. Apology to real fans that their page has been hijacked, 
   2. Explain the nature of the attack 
   3. Explain the claims of the attackers, 
   4. Highlight your response, and,
   5. How you will moderate the discussion and how you will respond.
4. Suggested moderation and response principles to use:
   1. Obscene or defamatory (of third parties) comments will be removed.
   2. Comments abusing our logo will be removed.
   3. Other comments that are critical of us will remain.
   4. We will respond to comments, but if the same message is being delivered repeatedly, we will repeat our reponse at sensible intervals, i.e. often enough for it to remain on the top two pages.

As pre-planning for a crisis, it would be worth while explaining how you will manage the site - your house rules.  These should be consistent with the moderation principles you use for the attack response. So if you are sensitive to defacement of your logo then say so and say that you won't permit it. If you are regarded as too draconian in your house rules, don't expect too many fans.
 
What's missing, or wrong, from the outline plan for this scenario?

Update on Thursday, April 1, 2010 at 10:45AM by Bright Beehive

It seems to me that there are three stages to dealing with a social media attack like Nestles experienced:

1. Response - What to do when it happens, hopefully informed by a crisis plan that you can pull down off of the shelf.
2. Recovery - Getting back to normality so that, in this case, real fans can get back to whatever they were doing before
3. Learning
   
   • What would we do to avoid this kind of attack, if that is a realistic option
   • How might we respond better - update the crisis plan

The following blog post focuses more on the recovery aspects: How to salvage your brand on Facebook: Lessons for Nestle

Comments

[Jon Russell]

Excellent article, well structured and hugely informative. Well done Nick. I would like to add some further queries / comments.

As we all know, getting hit by a malicious attack is not the sunny day on the beach it would seem to be. Attacks can be personal attacks against an individual, attacks against the company or just spammers having some fun. The information you have in this article gives a great guide to what you should do during an attack, but not what you should do in the aftermath.

Is it best practice to go through and remove all the offending comments in their entirety, or go in and just remove the body (can that even be done in Facebook). Once you've done that and your website is running as usual, do you then offer additional apologies to your other fans - should you be slightly unfriendly to the perpetrator, or take the higher ground? And probably most importantly, do you remove that person from your fan list - can you exclude someone in Facebook without clamping down so much on the security (i.e. making it invite only), that you lose some potential future users?

As I said, excellent blog. Will you be following up with one on how to attract people to become fans in the first place, and what sort of content should you have. My company has recently entered this space (http://www.facebook.com/pages/IndexUniverse/94566025597?ref=ts) and I am exploring best practices. Do you just throw all your content up on your fan page as links, only select what you think is most important, or add information there that is not on your site - maybe it becomes a less formal medium to speak with your users on. I have a niggling worry that people would become fans on Facebook, then stop entering the main site as they can find all the headlines straight on their news feed. Whilst this is excellent news for the users, it would reduce the page views / visitors to the main site. For sites that display ad campaigns for their clients based on the number of page views, this could have a dramatically negative effect on their revenue stream.

Looking forward to the next installment.

[Nick O'Doherty]

Thanks for your kind words and comments Jon.

I agree that the aftermath and recovery is a different subject, and a good subject for another post and will use your comments as a basis for it. My initial thoughts are that behaving too heavy handedly is counterproductive, and that maybe an important issue to address is recovering the lost conversations. The comments and replies from genuine fans that have got drowned in the volume of comments that was the attack. This enables the page to get back to normal.

Your comments about balancing your presence on Facebook and visits to your web-site are a much bigger subject and maybe a topic for several posts and discussions. Perhaps one consideration is: Do you expect the same audience on Facebook as the audience visiting your blogs and web-site? In part that depends on the material you post on Facebook and the conversations that you encourage there. Skype me and we can talk some more about it.