It is axiomatic that reputations take decades to establish and an instant to collapse. Benjamin Franklin understood it (‘It takes many good deeds to build a reputation and only one bad one to lose it.’) and with dependable regularity companies prove it – Boeing being one of the most recent. But what the many quotations and examples do not address is what happens next. If your reputation is in peril or worse, and the effects are so calamitous, what, if anything, can be done?
Investigators in the private sector consider matters of reputation all the time. Due diligence assesses the effect a counterparty’s reputation will have on a client’s good name. Dispute support work frequently requires a detailed understanding of the reputations of counterparties and witnesses. But there are certain categories of investigation that help directly to build, protect or repair reputation, and each, in its own way, is part of the answer to the question above: (1) due diligence conducted on a client to determine its own reputation and, if necessary, correct it (in the jargon of the investigations industry, ‘self-due diligence’); (2) investigations into incidents that threaten a client’s reputation; and (3) investigations of black public relations (PR) campaigns conducted by competitors or litigation opponents, which are an increasingly common phenomenon.
Self-due diligence: understanding (and correcting) how others see you
Sometimes, to forestall a difficult situation or to repair one, a client needs to investigate itself. Public companies do this in anticipation of unwanted market attention, engaging an investigative firm to mimic the work conducted by activist investors, short-sellers or hostile acquirers to identify performance problems, ethical concerns and weak board members. In this case, the investigator gives the client the worst possible account of its reputation – all the ugliest news – so that the company can plan and adapt. Savvy clients may do something similar in the context of litigation, so as not to give their opponents an easy edge.
That work prepares for an attack on reputation; similar methods can be used to recover from one. In the early 2000s, a prominent Russian company asked an investigations firm whether it could repair some of the damage done by a decade of mudslinging by its peers, which had led to it being routinely turned down for loans by western banks. The situation was made complicated by the fact that not all of the kompromat was without merit, but the investigation that followed established that, among other things, the principal’s brother had not, despite press reports, been imprisoned for espionage in Israel (the principal was an only child) and that the journalist who had written that the company had routinely smuggled arms into North Korea had been paid US$5,000 for submitting the story and for inventing it from scratch.
Investigative firms have conducted many similar exercises for clients that believe that they have been misrepresented publicly in some way. The typical client has had its reputation challenged or impugned, either generally or in relation to some allegation, which might include claims of unclear sources of wealth, controversial business partners, contentious business conduct, corporate governance problems or proximity to state officials. Some may have been targets of disinformation campaigns, while others are haunted by something real in their past. Whatever the background, the aim of a self-due diligence exercise is to produce an objective record of an inquiry so transparently and thoroughly conducted that it can be relied upon by others. Audiences vary, but the most common are regulators, financial services providers and prospective business partners.
Clients must commit to being part of the exercise – to be interviewed directly about their career and business interests and to provide documentary evidence about areas of interest. They have to be comfortable with their business partners and associates – and even their adversaries and competitors – being approached for comment. The more information the subject discloses, the more the result is likely to stand up to scrutiny. The biggest advantage of self-due diligence over third-party due diligence is that it can build a far deeper picture of the subject’s career and business interests, which can then be used to communicate with various audiences. However, clients often feel uncomfortable sharing the whole picture. Sometimes they are wary of disclosing details that might damage their reputation or potential business prospects; sometimes they do have something to hide that will need to be addressed if the outcome is to be beneficial. A properly conducted self-due diligence exercise will take all this into account.
Investigators are often asked how self-due diligence engagements can avoid becoming a whitewash, given that the subject of the investigation also happens to be paying for it. How can we include negative information when the client wants us to produce a report that enhances their reputation – especially if such information has not previously reached the public domain? The answer lies in the client fully understanding the goal of self-due diligence and the methodology applied by investigators. A report is valuable to the client only if it can be shown to third parties in the knowledge that it is accurate and complete – even if it contains unflattering information. Clients, lawyers and investigators alike need to rely not just on the accuracy of the report but on the completeness of its findings.
A crystal-clear methodology is necessary to win the trust of both clients and audiences. This will vary from case to case but will combine exhaustive open-source research, interviews with the subject, and both open and discreet interviews with others, including business partners, counterparties and competitors. Typically, work builds to a final stage, where allegations against the subjects are investigated in great detail and findings presented to them for a final opportunity to correct any remaining inaccuracies before the report is written.
Self-due diligence reports often become the deepest, most detailed account of a subject’s career, because a good investigator will leave no stone unturned to produce a full and objective narrative in this scenario. This allows subjects to demonstrate, with evidence, exactly how their businesses have grown and how they operate, which can be critical in informing a favourable regulatory decision or gaining approval for a transaction that might otherwise fail. It also enables them to show that they have addressed, rather than suppressed, matters of reputational concern – to omit the difficult issues is to undermine trust in the whole investigation. A good self-due diligence creates the fullest picture possible of an individual and, in so doing, unlocks the greatest value.
Self-investigation: understanding and communicating what has happened
The self-investigation is distinct from the self-due diligence, in that the client is hoping to preserve its reputation in response to a particular incident. Potential causes are limitless and, by their nature, hard to predict, for example a hole in the accounts, a major accident on site, a chief executive behaving inappropriately, a bribe revealed, or a series of loans made to terrorists or drug cartels. Crises tend to come from the least expected direction and seldom announce themselves.
The first reason for conducting an investigation in response is almost always to determine the size and true nature of the problem. Beyond that, most investigations of this kind seek to meet some or all of a simple set of objectives, each of which serves to protect reputation: to establish responsibility or blame; to demonstrate to various audiences, internal and sometimes external, that the matter is being seriously addressed and, if necessary, remediated; to forestall or prepare to mitigate a nastier investigation; and to learn, or at least appear to want to learn, lessons arising from the incident. Ideally, the self-investigation substitutes for, and hopefully prevents, investigations by regulators, law enforcement or journalists, and allows the client to demonstrate that it can be trusted to remedy its own affairs.
Sometimes it is clear at the outset that the fact or outcome of the investigation will be shared outside the client organization; sometimes it becomes apparent during the course of the work that regulators, law enforcement or others will need to be informed. In either case, trust is the critical element. As with all kinds of reputational investigation, part of what the investigator brings to the client is its own reputation. That is why the lion’s share of such cases is conducted by highly reputable law firms that engage specialist investigations firms as needed and provide the protection of legal privilege to all findings. The respected professional vouches for the facts that can then be used to safeguard or help repair the latter’s reputation.
To do this credibly, of course, the professional must produce work that is not just good but demonstrably good. Scope and reporting are crucial: areas of clear interest cannot be off-limits, and unfavourable findings should be reported alongside favourable ones. These judgements tend to be more clear-cut when the external audience is a regulator but become harder to call when the public is involved. It can be tempting for clients to err on the side of caution by limiting reporting of the methodology and findings, but this can lead to an erosion of trust in the system. The United Kingdom’s Solicitors Regulation Authority, which is updating its guidance on this kind of investigation, has expressed concerns about a growing perception of potential conflicts of interest. In short, if the self-investigation is perceived to be even slightly a self-whitewash, trust in the system suffers and the value of such exercises falls. Like antibiotics incorrectly administered, they slowly but steadily lose efficacy.
To counter this, an effective self-investigation in the public sphere might adopt a few simple measures, each of which addresses the central tension inherent in engagements where client and subject are the same. For instance, the client’s principal law firm should not conduct the investigation itself. Even if there is no conflict of interest, and even if the process is conducted with crystal transparency, the appearance or assumption of a conflict can create doubt in audiences.
Great care should be applied at the outset to the question of how much information will be reported at the conclusion of the work. People are curious, and simply reporting that an investigation has taken place and found nothing of concern tends to pique that curiosity rather than satisfy it. Conversely, a transparent methodology applied to a clearly communicated scope, coupled with findings that match, go a long way to convincing audiences that an investigation is legitimate. Scope and methodology should be appropriately broad. An investigation that relies solely on email review, for instance, or on interviews, will be less effective and persuasive than one that also draws on forensic accounting, open-source research and fieldwork.
One final measure might be worth considering: payment for services should be made in advance – not all upfront, necessarily, but enough so that the investigating law firm and any investigative specialists retained by them, at least, are always in funds. This allows everyone to say that there was no direct financial risk to them in finding whatever facts needed to be found, or in reporting them as they saw fit. Critically, this should be communicated to stakeholders at the outset of the project and throughout, as this one measure can go a long way to persuading audiences that advisers and investigators are operating with true independence.
Black PR campaigns and how to counter them
In the aftermath of a reputational attack, clients often wonder: Will we ever recover? Even if allegations are proven to be false, will we be able to repair the reputational damage? Does mud always stick? Black PR or disinformation campaigns can be horribly effective in inflicting damage, as targets find it difficult to fan away the smoke and convince the world that there is no fire. However, a comprehensive investigation, one that impeaches both the content and techniques employed by hostile actors, can be used as a platform to effectively and definitively expose a campaign.
In this digital age, false allegations – of labour rights violations, collusion with sanctioned parties, anticompetitive practices, sexual liaisons or even criminal offences – can be disseminated by the unscrupulous ever more rapidly and with apparent authority. Artificial intelligence and deep fake technology are accelerating and making ever more convincing what is possible. Recent experience indicates that competitors and counterparties in disputes, in particular, are not above engaging in such skullduggery. As the opportunities to conduct black PR campaigns proliferate, so do the ranks of those willing to advise on how to conduct them effectively. The initiators of these campaigns have an expanding array of platforms at their disposal, from broadsheet newspapers to bot farms, and are adept at using ‘amplifiers’ – outlets, organizations or individuals with their own agenda – to propagate rumours and falsehoods.
The most effective disinformation campaigns are those where the target and the audience are unaware that negative press is by design. Businesses and high-profile individuals face critical press or social media attention on a constant basis. Sifting the organic and unpleasant from the hostile and directed is an art, not a science. In determining whether events are part of a campaign, investigators look for certain hallmarks: planted stories; inorganic distribution on social media; sustained coverage across platforms that suggests manipulation; and parties conveniently ‘left out’ of the coverage.
Clients that do know or suspect that a campaign is in play are often unaware of its extent, or the mechanisms involved, and in the dark as to the actors. Following the thread to its origin – an article, social media post or market rumour – is one way of sorting initiators from amplifiers and assessing the strategy being deployed. This determines the correct response strategy, as, for example, a competitor requires different treatment from a vindictive former executive.
Black PR campaigns frequently emerge in the context of multi-jurisdictional litigation. Knowing that their chances in the courtroom are slim – and that litigation is likely to be protracted and expensive – an unethical opponent may seek an edge by attacking a client’s reputation, disrupting operations and inflicting potentially irreparable financial damage. Business partners may put projects on hold and banks may block or freeze accounts over compliance concerns. In the worst cases, the reputational damage can extend to individual executives and shareholders.
Initiators of such campaigns are often enterprising. They will engage tabloids eager for a ‘sexy’ story, knowing that some journalists may be less than thorough about verification if it generates sufficient attention. Hostile actors will also make use of ‘pay-for-defamation’ websites masquerading as bona fide media outlets. Articles published on these platforms can then be laundered as a ‘source’ when picked up by unsuspecting mainstream media. Compliance databases may inadvertently cite these false allegations, distributing them to financial institutions, lenders and business partners.
An effective response will target both source and content. In our experience, even the most sophisticated disinformation campaigns have vulnerabilities.
- Initiators need to be diligent every step of the way; we need only to identify a single weakness: A major European corporate was the subject of a multi-jurisdictional, sophisticated black PR campaign, both online and through leaflet distribution and protests in various European and North American cities. The online campaign was waged on a variety of platforms, including a complex web of defamatory websites and legal entities in different countries with links to, among other things, bot farms. A single reuse of an email account used to establish one of the myriad defamatory websites was enough to identify and expose the multinational competitor behind the campaign.
- Uncovering manipulation of news outlets: Initiators plant false allegations or other damaging material in the public domain using various methods. Some confidential company information taken out of context or presented in a different light is too tantalising for news outlets not to make public, especially where there are established relationships between PR firms and the media. Understanding those relationships can help identify who is guiding the campaign.
- Using data analytics to identify inorganic content on social media: Mapping the links and exchange of information between many hundreds of accounts and posts on social media creates patterns that strongly indicate a single, coordinating source for the activity. These can include overlapping followers, bursts of activity at a single time, and common turns of phrase or other linguistic features and errors. In a recent investigation, it became apparent that multiple bot farms were being employed to further damaging untruths about a major UK corporation on social media. Investigation found a central axis of X, formerly knowns as Twitter, users who were, effectively, mercenaries engaged by hostile parties to target companies and individuals on demand. Their lengthy resumés included attacks on entirely unrelated companies and political campaigning in the lead-up to general elections in a sub-Saharan country.
With an ever-growing range of platforms at their disposal, hostile actors can use social media to ‘amplify’ false allegations in mainstream media, or vice versa. Social media platforms, which allow damaging material to spread like wildfire, can be difficult to tame and direct, even when mercenary bot farms have been engaged to pull strings. Whether their methods are traditional or modern, black PR campaigns can still be countered by impeaching their content and mapping the routes by which disinformation is spread. Exposed to the light, campaigns can become a great liability for those who would commission them.
Conclusion
Reputation is an asset and, like any other, is susceptible to harm. In each of these kinds of due diligence exercises, the investigator has the opportunity to protect or restore the value of that asset by closing the gap between perception and reality. As with all investigative work, only facts can accomplish the goal. A self-due diligence that skews or omits critical information will end up harming client and investigator. A disinformation campaign has to be based on clear falsehoods if it is to be discredited. While reputations may be more vulnerable to distortion in our age than in any before, facts are as powerful as they have always been, and the role of investigators in professionally and transparently developing such facts is critical.
*The authors thank Finn Duggan for his contribution to this article.
*This article was first published on Global Investigations Review in June 2024; for further in-depth analysis, please visit GIR Europe, Middle East and Africa Investigations Review.
