Case Study: Uncontrolled Reputation Damage

The issue of reputation management has now gone beyond mere brand stewardship and is at the very front lines of Internet privacy, litigation, and corporate security. A tragic but relevant example of privacy loss happened with the California Highway Patrol.¹ In October 2006, eighteen-year-old Nikki Catsouras died after losing control of her father’s Porsche 911 and colliding with a toll booth. The California Highway Patrol (CHP) took photographs of the gruesome accident scene, a standard practice in fatal vehicle accident procedures. Unfortunately for the Catsouras family, two CHP employees forwarded the photos internally and to friends via e-mail. The leaked photos quickly spread and were eventually posted across the Internet. In addition, fake MySpace accounts were created by “Griefers” and e-mails of the photos sent to Nikki’s parents, which caused further grief. The California Court of Appeal for the Fourth District on February 1, 2010, ruled that the Catsouras family has the right to sue the defendants (the CHP) for negligence and intentional infliction of emotional distress. The pending lawsuit and possible compensation for the family is expected to cost millions. The personal actions of two employees have cost the CHP its reputation and potentially millions of dollars. The question arises, could this have been avoided?

¹Christopher Goffard, “Gruesome Death Photos Are at the Forefront of an Internet Privacy Battle,” Los Angeles Times (May 15, 2010), http://articles.latimes.com/2010/may/15/local/la-me-death-photos-20100515/3.

A number of things were wrong with this process. What should have happened with these pictures? The first question to be answered is did the CHP know that they were not supposed to share those pictures and did that break any specific laws? This is an obvious question, but many organizations do not provide any training about how to handle data, especially regarding social media usage. The Pew Center on the States says that according to the 2008 Grading the States Report training hours for state employees averaged 22.1 hours per year. Per-employee training expenditures averaged $417 per year, or 1.3 percent of payroll. There is no real breakout for social media or security training.

The next question to address is how the photos are stored and who has access to transmitting that information. If the CHP was monitoring all entry and exit points for data, they could potentially have blocked the files from leaving the organization if they were labeled confidential. Security technology such as McAfee’s data loss prevention solution could have blocked outbound confidential data.

Other questions include should an organization monitor not only e-mail communication but also their employees’ social media profiles as well? What was CHP doing to monitor activity on a daily basis? Could careful monitoring of personal activity shed light on the character of these two individuals and raised suspicion as to possible future actions? Could the monitoring of online bulletin boards and forums alerted the CHP to the leaked photo, allowing for a quicker response? A search today returns over 77,000 results, including many of the horrific images. Reputation.com, hired by the family, did attempt to remove the graphic photos of the crash, but those photos are still available. Once data gets on the Internet, even active management will find it hard to remove that data. Reputation.com claims to have persuaded websites to remove 2,500 of the photographs but understands that removing them from the Internet completely is an impossible task.

A policy built on the H.U.M.O.R. Matrix would have made employees of CHP aware that they are being monitored and possibly dissuaded potentially damaging actions. This tragic case can be translated to any organization dealing with sensitive information such as hospitals, lawyers, and financial institutions. Effective reputation management means investing in the resources to monitor and react to online reputation management (ORM) issues. Once the issue has been flagged, your social media policy should identity the steps and resources needed to deal with the situation.