In late January of 2014, a series of social media accounts for CNN were hacked. “Some of the posts claimed that the Syrian Electronic Army, a group of pro-Syrian regime hackers that has aggressively targeted major news organizations and activists, was responsible” (CNN, 2014). In all, 9 accounts were hacked that included “CNN’s main Facebook account, CNN Politics’ Facebook account and the Twitter pages for CNN and CNN’s Security Clearance. Blogs for Political Ticker, The Lead, Security Clearance, The Situation Room and Crossfire were also hacked” (CNN, 2014). Luckily for CNN, this breach had a minimal effect on their reputation or in any other capacity. The minimal effect was due in large part to CNN’s ability to quickly identify and respond to the security breach. Within 24 hours CNN recognized what had happened, quickly deleted the posts, secured the accounts, and then reported on what had happened. In regards to crisis management, “…the response typically includes such steps as gathering facts, reporting facts quickly (even if the fact is that nothing is known), give the name of a spokesperson, acknowledge people’s deep emotions, and communicate regularly” (Scott, 2013, pg275).
In
this instance, CNN didn’t need an entire room solely dedicated for situation
because they handled the situation masterfully and in a timely fashion (See
what I did there? Play on words regarding CNN’s show The Situation Room… No?...
Ok, moving on).
Worries
about security breaches have been on the minds of many for years. According to an article from 2011 that
discussed a new survey at that time, “About 42 percent of the respondents are ‘moderately
concerned’ to ‘extremely concerned’ about the security threats associated with
employees using social media in the workplace. Social media was defined in the
survey as social networking sites, blogs, online video services, micro-sharing
and widgets” (eWeek, 2011).
The
article went on to say that a major point of concern was the accidental
downloading of viruses and the need for updated policies to be put in
place. “Approximately 36 percent of
network administrators said employees have unlimited access to social media. In
contrast, 48 percent said employees have limited access, and 16 percent claimed
no access to social media. Around 60 percent of administrators said their
organizations have a formal policy about employee access to social media at
work” (eWeek, 2011).
So
a few years prior to the hacking at CNN, various network administrators were
discussing the need for better policies to be in place regarding the use of social
media at work. Clearly, in the case of
CNN, as a news organization they need to have a social media presence. There was not much that CNN could have done
differently to prevent the hacking of their accounts as they covered all of their
bases prior to this attack. Maybe more training
or an updated installation of malware would be helpful to prevent such a
situation from happening again. Can you
think of any other ways in which they could prevent hacking in the future?
References
Rashid,
Fahmida Y. (May 4, 2011). eWeek. Network Breaches, Social Media, Smartphones
Worry Administrators: Survey. Retrieved on February 25, 2015 from http://www.eweek.com/c/a/Security/Network-Breaches-Social-Media-Smartphones-Worry-Administrators-Survey-430279
Scott, David
M. (2013). The New Rules of Marketing & PR. (4th ed.). Hoboken,
New Jersey: John Wiley & Sons, Inc.
Shoichet,
Catherine E. (January 24, 2014). CNN. Some CNN social media accounts hacked.
Retrieved on February 25, 2015 from http://www.cnn.com/2014/01/23/tech/cnn-accounts-hacked/index.html
Good afternoon Joe! Looks like we both picked politically motivated attacks for this week, though yours looks far more severe than mine or Alina's.
ReplyDeleteWith so many of their pages and accounts compromised this one looks like far more of a concerted and planned effort than either of the other examples from our group. The Syrian Electronic Army has hit a lot of other news websites, I know, but have their postings actually amounted to anything? The most hilariously weird effect I could find was back in 2013, when a Tweet from a hacked Reuters account said the White House was bombed and made the stock market tumble for a few minutes before it recovered itself back to earlier values (Foster, 2013).
That case may also raise questions about the power news agencies can have with instantaneous postings, without any form of vetting or fact checking, but that's not really a discussion for this topic.
I had gone into the best practices for preventing something like this from happening, but the simplest ones are to constantly rotate passwords, have different passwords for each account, and make sure that all work devices and personal devices employees are expected to work from have up to date security and are regularly scanned.
The SEA seem more sophisticated than your average "hackers," but that is pretty much all public relations/marketing people can really do. Preventing DDoS attacks on web-pages and the like are far outside of our realm and fall to the webmaster and IT department.
References
Foster, P. (2013, April 23). 'Bogus' AP tweet about explosion at the White House wipes billions off US markets. Retrieved February 27, 2015, from http://www.telegraph.co.uk/finance/markets/10013768/Bogus-AP-tweet-about-explosion-at-the-White-House-wipes-billions-off-US-markets.html
Thank you for responding to my post, Harley. Hacking into social media accounts is a serious breach of security and shouldn’t be taken lightly. CNN did a great job with the way they handled the situation. Thanks again for the response.
DeleteThis comment has been removed by the author.
ReplyDeleteI really like your post because I think it shows the potential for a serious problem. With 9 accounts hacked, its amazing how quickly CNN was able to get the situation under control.
ReplyDeleteIt seems like the moral of the story this week is that hacks likely to happen and difficult to prevent, but if a company has a plan in place, then they can react quickly and prevent any potential damages. News sites, in particular, are extremely vulnerable to hacks due to their ability to reach a large number of people. If they don't have a plan to get the social media sites under control quickly, the impact could be much more devastating.
Thanks for the reply to my post, Sabrina. You are absolutely correct that the moral of the story this week is the likelihood of having a social media account getting hacked into is pretty significant. CNN handled it perfectly, and was lucky enough to have someone monitoring their accounts to be able to catch it so quickly, remove the posts and respond appropriately. Thank you again for responding.
DeleteHi Joe – Your post is well-written and insightful. My group (4) focused on influencers (i.e. celebrities) and how both they and employees need to adhere to guidelines when participating in social media, as it relates to their company of employment. Your post shed light into another aspect of social media that companies now need to focus on, social media security. A lot of companies hire employees or companies to try and hack their systems to make sure they’re safe and updated with the highest security possible. This is usually focused at data and not necessarily social media, but the times have changed and it is a necessity. Having a paid influencer, i.e. Gilbert Gottfried, saying something insensitive on Twitter is one thing; however, having someone infiltrate your security to hack the company’s Facebook is a double-whammy! Do you think that there needs to be government regulations on security for social media platforms, or can the regulations stay internal and decided by the organization? How important is it for companies to have this sort of support? What kind of strategy or plans should a company have in the event that they are attacked by cyber hackers?
ReplyDeleteHi Andrew! Thank you for your response to my post. I respectfully disagree with you on two fronts. The first is your argument that it is necessary to have a company’s social media account hacked into. I believe it is necessary for companies to have paid outside consultants try to break into their data systems, because that is something a lot more serious than just a PR problem as a social media hacking would be. However, to say that it’s now necessary for companies to pay people to break into their social media accounts does not make sense. On the second front, I disagree that having a Facebook account in addition to a Twitter account hacked into would be a ‘double-whammy’. It is possible to link both accounts so that when one posts on Twitter it then shows up on their Facebook page. Also, contrary to popular belief, not everyone is on the Internet, let alone Facebook and Twitter. At the end of the day, we are talking about a PR problem that would probably be noticed right away and be corrected. This is not the equivalent to Armageddon. Thank you again for your interesting post!
DeleteThis is a really scary example. If hackers, or disgruntled employees, had harmful intentions, they could create a situation that could impact communities considering that many people look to CNN as a reliable news source. More specifically, they could create a large state of fear about a government related event, a large scale tragedy or even a wide spread health scare that could easily send the masses into panic mode. Thankfully CNN was able to regain control over the situation, but I think this is a very clear reason why these types of news sources need to have an excellent form of security on their sites. I also believe that they should definitely also have teams solely responsible for monitoring these sites and have a crisis plan prepared for various types of situations.
ReplyDeleteAn recent example is the group calling itself the "CyberCaliphate” that took over the Twitter feeds of two American news outlets, the website of a Maryland-based TV news station and an Albuquerque Journal newspaper. (CBS News, 2015) The banner of the Twitter feeds displayed pro-Isis propaganda. The feeds remained under the hackers control for almost a full day before the stations were able to regain control. During that time more extremist messages were posted along with personal information from individuals and organizations within the database. (CBS News, 2015) Imagine if similar groups hacked these social media sites to try to organize people on a destructive path. I think 24 hours is way to much time to have lost control over a news social media site. Even an hour seems like far to much time. This sites should have continuous monitoring. These type of hacks need to be prevented and if they occur, controlled within a shorter amount of time.
We live in delicate times and news organizations need to place more effort on screening employees, establishing clear cybersecurity policies and protecting networks. The growth of social media use will inevitably increase over time along with new types of technology. All companies and organizations that are active on the internet and social media need to have social media teams for the same reasons stated before. Hopefully this doesn’t make me sound paranoid. Maybe I’ve seen too many movies...
References
CBS News (2015, January, 6)News websites, Twitter feeds hacked with pro-ISIS message. Retrieved at:http://www.cbsnews.com/news/albuquerque-journal-wboc-websites-twitter-feeds-hacked-with-pro-isis-message/
Hi Alina! Thank you for your interesting response to my blog post. I agree with some aspects of your response, but also disagree with you on some points. I disagree that this is a really scary example. As I noted in the above comment to Andrew, at the end of the day we are talking about a social media hack and not Armageddon. Now, if the hackers issued some sort of threat on social media, then it would be a different discussion. Also, in regards to the reference regarding disgruntled employees with harmful intentions, I have firsthand knowledge of several friends that have worked for CNN and they have expressed that they haven’t seen any employee (current or past) that has been ‘disgruntled’. If top executives at CNN didn’t do anything wrong or if they hadn’t treated any of their employees unjustly, then they have nothing to worry about in that regard. Since they didn’t treat their employees unjustly, they wouldn’t be proactive in trying to control the conversation regarding employees (current or past)…
DeleteI do agree with you that 24 hours is a long time for a social media hack to go unnoticed, especially for news organizations like CNN. However, if there is no one to monitor all of the accounts then I could easily see how narratives could be out there for prolonged periods of time without the victim knowing. I disagree with your inference that there is a lack of proper screening of employees and that that could be one reason for the hacking of social media accounts. Organizations such as CNN know the employees they hire extremely well. If certain employees were such a problem, then a.) they wouldn’t be hired to begin with or b.) they would be fired right away or c.) they definitely wouldn’t be promoted within the organization or d.) the organization would let everyone know right away that the employee was a problem. The last thing an organization like CNN would do is hire an employee, and then wait until things didn’t go their way to let everyone know that the employee was not a good one… I do agree with you that companies need to have social media teams, maybe as part of their communications department, to monitor and react to social media activity. And no your post does not make you sound paranoid. No one here has been diagnosed with paranoia. I am a BIG fan of movies though… ;-) Thank you again for your response!