From special forces agents and SexBots to getting stuff to disappear from Google, who can brands turn to when the internet turns hostile? Charles Orton-Jones explores.

Brandolini's Law states: “The amount of energy needed to refute bullshit is an order of magnitude bigger than that needed to produce it.” Lies sprint around the web. The truth limps behind. This is a challenge for brands. The internet is awash with misinformation. A single troll can wreak havoc. The question is what can be done to protect a company's reputation?

One man who knows is Rory Lynch. He is a lawyer who's acted in some of the most high profile reputation management cases of recent years. When Martin Lewis, founder of Money Saving Expert, found his face used on a crypto investment scam on Facebook, Lynch acted for Lewis. The case ended with Facebook donating £3 million to a new Citizen's Advice project to combat scams.

Lynch acted for Sir Stelios Haji-Ioannou of Easyjet against the Daily Telegraph. He worked for phone hacking victims, and derailed an online campaign designed to lower the share price of a listed company. His firm Gateley acts for 18 or the 20 largest housebuilders in the UK, who are plagued with campaigns by local community groups. If the internet is turning hostile, Lynch the man you want in your corner.

“The world is very different,” he says. “In the past, reputation management might involve writing legal letters or working with a PR. Now I have a whole suite of professionals I work with, such as ex GCHQ cyber geeks, ex Secret Service, intel people, ex special forces, and specialists such as crisis management PRs.”

The scale of the challenge is vastly bigger. Before the internet, the challenge to brands came from newspapers and magazines. Now there are forums, blogs, Substacks, Reddit and TikTok. A backlash can appear out of seemingly nowhere. Starbucks is currently subject to a boycott in the US relating to the Israel-Gaza conflict, losing $11 billion in market value. It has no branches in Israel.

“It used to be black PR or anonymous attackers,” says Lynch. “Now it is de rigueur for all manner of people to engage. Competitors, activists and bad players in the market can damage your reputation. There is trolling and fake news. They can cause malicious stories to go viral and trigger pile-ons.”

The secrets of the trade

So, what can these reputation managers actually achieve? After all, anonymous accounts are hard or impossible to identify. And websites such as Trustpilot and Tripadvisor are resistant to brands responding: otherwise everyone would be demanding negative material be removed.

Lynch reveals his secrets. Negative content can be hidden from view. “One company I know challenges the Google algorithms to get stuff removed that way. The material is still online but won't be listed in a Google search. It's very hard to get defamatory stuff removed. America has the First Amendment right to free speech. If anything borders on an opinion, American companies won't touch it. The way to do it is to point to a breach of user guidelines or an intellectual property infringement.” This method means material on Google, YouTube, Facebook and Instagram can be pulled.

Libel law varies by jurisdiction, which is helpful. “At Gateley we have a Northern Irish and Irish operation,” says Lynch. “The reason is that in England the test for defamation proceedings is 'serious harm'. It was brought in to stop libel tourism. But in Northern Ireland that doesn't exist.”

Ireland plays a different role. “The advantage of Dublin is that all the big US platforms have their EMEA headquarters there. It is difficult to get material from an anonymous attacker removed. But if you add the platform as a co-defendant and sue them in Dublin you can make progress.”

Don't send that photo

A new threat to corporate reputation is Sex Bots. Lynch explains: “Executives travel to the Far East. When there they communicate with a young lady over WhatsApp, and are persuaded to send some kind of nude photo. Of course, it's a bot. They are told to pay money or the image will be shared on social media or with your employers. It's a volume play. They send hundreds of thousands of messages from places like South Africa and Indonesia. It can be used to attack the C-Suite.”

The strategy here? “They are only interested in the ones that respond.” says Lynch. Images can be removed from platforms due to privacy laws. “Generally speaking, you are entitled to keep private whatever you wish to keep private about your private life. Sex life and family life can be protected, if it is considered you have a reasonable expectation of privacy.” It's a nightmarish, but manageable scenario.

Another attack. The internet can be used to harness activists to flash mob a shop or HQ. “Canada Goose had protests by animal rights activists at their Regent Street store,” says Lynch. The housebuilders are regularly visited by people objecting to a development.” The solution? “An injunction against persons unknown, means it doesn't matter who turns up. You are protected within a certain radius. If it is infringed, the police will remove them.”

The hardest cases of all are anonymous criminal gangs. Ransomware and extortion are common. The British Library was recently crippled for months by a ransomware attack, with user details sold online. Can brands do anything? Here Lynch turns to his army of special forces and ex GCHQ agents.

“There are James Bond types who specialise in identifying anonymous attackers. Unless you are a professional using burner phones daily you'll leave a trail of crumbs. I had a case recently of a serial attacker, who'd been around for a long time, being identified. Researchers went into the deep web, after a cyber breach, and found one of his passwords. Turns out he'd used the same password with other accounts so they could work out who he is.”

Once identified, other agents are commissioned to act. “The attacker may be located somewhere difficult, like Russia or the former CIS. Then it may help to send in intel teams or ex special forces to do on the ground intelligence work or knock on doors.”

It's a world away from old fashioned libel law-based reputation management, where injunctions or a stiff letter to a newspaper was sufficient. Lynch candidly admits the legal route is not for everyone's wallet. “Coleen Rooney and Rebecca Vardy spent £4 million to £5 million each on their libel proceedings to trial,” he says. “We encourage our clients to do a reputation audit. Various professional stress-tests review a company's systems, using ethical hackers and things like that, to do a deep dive on vulnerabilities. It's cheaper than instructing a lawyer, who may have to drop everything and work around the clock for days or weeks.”

Consider your options

It is possible to act alone. Restaurateur Steve Hoddy, owner of the Bispham Kitchen in Blackpool, noticed ten false reviews about his place on Tripadvisor. “It was a whole catalogue of bogus reviews,” said Hoddy to industry magazine The Caterer. “He later put up reviews of some of my other businesses too. But he'd made the same spelling mistakes throughout the different reviews, so it was obvious it was the same person.

“With four of the usernames, he had done about a hundred reviews of other places, so I was able to piece together a picture of who he was.” Hoddy has two law degrees and took the perpetrator to Manchester County Court for malicious falsehood, where he won £7,455 in damages and costs.

Hoddy noted that the platforms such as Tripadvisor are the in the US, so he'd need to visit Massachusetts to settle his claim the orthodox route. But ID the perpetrator, quantify the damage and victory is attainable here at home.

The truth is that reputation managers such as Lynch are going to be normal in commercial life. Reputation management is a growing force pretty much everywhere – city law-firm Schillings, who acted for Meghan Markle and Johnny Depp, recently surprised peers by launching a PR and reputation management agency, fronted by Victoria O’Byrne, who has worked for the Prince and Princess of Wales.

The ability for trolls to damage a brand is too easy. Companies need to strike back. Mastering the dark arts of reputation management is now a core part of the comms job.