Disinformation and Influence Campaigns on the Rise

The RSA Conference 2021 Virtual Experience is happening May 17-20 and Symantec, as a division of Broadcom, will be providing a summary of some of the leading stories from the conference to help you stay informed.

Over the last few years, we’ve seen a surge in online disinformation campaigns foster confusion and hurt public trust in companies and government institutions. But as experts learn more about the motives and tactics of the groups behind these campaigns, they say there are lessons that organizations can apply to avoid becoming direct or collateral targets.

“You don’t want to give the bad guys more gasoline (to throw on a fire),” said Melissa O’Leary, chief strategy officer, Fortalice Solutions.

O’Leary, speaking during a panel discussion at the RSA Conference 2021 titled “Responding to Disinformation and Influence Campaigns,” cited the example of a hospital providing information about free Covid-19 vaccinations. The hospital was subsequently hit by a slate of bad reviews coming from anti-vaxxers who included fraudulent vaccine information in their messages. O’Leary said a campaign of quiet de-escalation was implemented to bolster the hospital’s reputation and repudiate the negative disinformation.

Indeed, how a company responds to a negative campaign often turns out to be more important than the substance of the disinformation efforts against the organization, according to J.D. Work, a professor in cyber conflict and security at Marine Corps University.

“In a number of cases, the (negative) messaging will fade,” Work said. “Unfortunately, the story often becomes as much about a company’s response as the problem itself.”

As panel members grappled with the question of how best to identify disinformation campaigns and what steps to take in response, there was broad agreement about one point: to counter a disinformation campaign that’s already underway, the different areas of businesses and organizations need to collaborate and take a united front against the bad actors’ actions.

“We have to respond to the disinformation,” said Mark Aysta, the managing director of enterprise security at Duke Energy. “We have a responsibility to vet it – and even in the case of misinformation, where it might not be accurate, we have an obligation to find the facts quickly and respond to it,” he said.

O’Leary added that it’s important for an organization to be pragmatic how it goes about putting measures in place to fight back against disinformation campaigns.

“A company has a certain responsibility to protect itself,” O’Leary said. “Companies as end users certainly should have more robust intelligence centers. But many don’t have (those centers) in place because they haven’t had that moment (a disinformation attack), yet.”

O’Leary also said that when it comes to approaching company executives about a disinformation campaign, “showing, not telling” about the matter, with actual evidence, should be a priority.

“Look at competitors, and others in your industry,” he said, “and see if they are facing similar issues.”

Seeking methods to quickly respond to such threats, or even keep them from taking off, is only going to become a bigger matter for organizations who want to avoid being known for getting caught up in the disinformation industry.

“It’s not going to get any better,” Aysta said. “You have to fight with knowing what the facts are and with relationships at hand.”