Digital assassination is getting easier to launch and harder to ward off.
The menacing term, used by reputation experts Richard Torrenzano and Mark Davis in their book “Digital Assassination: Protecting Your Reputation, Brand or Business Against Online Attacks,” describes anonymous online assaults designed to smear companies and individuals.
“It’s becoming increasingly easy for people to anonymously publish false statements about other people and other businesses online,” said Ed Hopkins, managing attorney for HopkinsWay PLLC, whose practice is in defamation, privacy and computer crimes. “There’s all sorts of technology that’s making it easy for people to hide their tracks. I think the world has always been filled with dishonest people, corrupt people who want to publish fake stories and bring down other people’s reputations — but the internet makes it easier for them to hide.”
Incidents are wreaking havoc close to home.
On Nov. 3 the Colorado Springs Business Journal was served with a subpoena to produce information relating to the “limited discovery aimed at determining the identity of Defendant John Doe” in Centura Health Corp. and Peter D. Banko v. John Doe.
In short, the plaintiffs — Centura Health and Banko, its president and CEO — needed to find the person who had anonymously created a fake Twitter account to pose as Banko in his role with Centura. The fake account posted tweets, replies and likes that included numerous links to pornographic images and pornographic websites.
The same person, according to the complaint, is believed to be responsible for other online accounts that were used to target Centura and Banko, and posed as Banko to post “false and disparaging statements related to Centura and/or Banko” on news sites.
The fake Twitter account also linked to professional organizations affiliated with Centura, giving “the false understanding that the Unauthorized Centura Account reflected Centura’s and Banko’s opinions and beliefs,” according to the complaint. Centura and Banko alleged it was a “systematic and targeted plan to harm Plaintiffs’ reputations.”
The lawsuit was filed Oct. 20, asserting claims for trademark infringement, defamation per se, civil harassment, intentional infliction of emotional distress, invasion of privacy by appropriation, and for injunctive relief. According to the complaint, the unknown defendant could not be identified based solely on publicly available information.
Several other publications and sites, including Twitter, were also served with subpoenas “for the express purpose of identifying Defendant John Doe.”
Magistrate Judge Nina Y. Wang granted the plaintiffs’ motion for expedited discovery Oct. 30.
Attorneys for Centura and Banko filed an amended complaint and jury demand Dec. 15 against “Jeffrey A. Radabaugh and John Doe,” and the deputy clerk of the U.S. District Court for the District of Colorado issued a summons in a civil action Dec. 18, on Jeffrey A. Radabaugh of Castle Rock. According to the amended complaint, Radabaugh joined Centura in 2011 as an analyst and later became a business operations manager.
When reached for comment Dec. 14, Centura Health said it was unable to speak about current litigation.
Many businesses are familiar with the problem of malicious online reviews, and know to look out for cybercriminals faking online identities for phishing and scamming — but posing as another person online to harass and defame them is different.
Steven Fulton, director of the Center for Information Assurance Studies at Regis University, who was not asked to comment specifically on the Centura case, said he had not personally heard of any case in which someone with a personal grudge posed as their victim online in order to harass them. But, he said, the amount of information available on social media and elsewhere on the internet makes it easier than ever to build a fake profile.
“It still takes a lot of work to attack an individual … so that has to be a personal vendetta against that person or that company,” Fulton said. “If I’m angry at an individual or an organization, there’s nothing to stop me — and it’s certainly not difficult to set things up to appear as if I’m that individual.”
Hopkins, of course, is no stranger to the tactics used to anonymously defame people and businesses online, nor to the difficulties of identifying and stopping offenders.
There’s “no question,” he said, that the time and expense involved in pursuing these cases is onerous.
Much depends on where the offender is — laws and remedies differ between states and countries, and “there’s a very wicked web of things that you have to be aware of in order to address these problems,” Hopkins said.
“But [jurisdiction] is not even the hardest part of the problem. The hardest part of the problem [is] … the folks who want to be anonymous for whatever reason, they can make it very difficult for you to hold them accountable.
“They can use software like the onion router, the Tor web browser to hide their identity; they can use virtual private networks — VPNs — to hide their identities. … When they do that, even if you are able to discover the IP address that was used to publish the statement, it might not be the real IP address from which it was published. So you have to resort to other means to try to find out who did it, and that’s when you get in the realm of traditional investigation, some of it forensic.”
Sometimes computer forensics help, “but in order to know where to start, you have to have good enough grounds to allege that a specific individual did it, and that’s where it’s difficult,” Hopkins said. “If you truly don’t know who did it, you’re in the worst possible case — especially if they were smart enough to hide their tracks.”
The investigative steps are “arduous and difficult,” Hopkins said, and the cases are expensive and hard to litigate.
“It’s harder to litigate these things for two reasons. They’re very fact-intensive, which means it’s difficult to decide these cases as pure matters of law. …[I]f the other side wants to continue to lie, or obfuscate or hide evidence, it can force you to go all the way to trial, making litigation very expensive … and people just don’t have the money oftentimes to take it all the way. That’s one big barrier.”
Another major barrier is that not a lot of attorneys practice in this area of the law, meaning it draws less attention from appellate courts and thought leaders, he said.
“I think that’s another reason why you don’t see this stuff get resolved a lot: Not a lot of lawyers do it, and it costs too much to do it when they do.”
Hopkins said when a person uses someone’s identity without their permission and publishes disparaging statements about them or poses as them online, they are “not only doing things that can get you sued in civil court, you are also committing criminal offenses.
“The criminal offense you are committing, at the very minimum, is probably a violation of the Computer Fraud and Abuse Act, which is a federal law.”
The problem: “Even though it’s a crime, very few people actually convince the law enforcement agencies who can enforce the CFAA to actually enforce it,” he said.
The laws are complex, but other offenses can include violating the false advertising provisions of the United States trademark laws, invasion of privacy under misappropriation of likeness theory, violation of right to publicity, and defamation.
“Those are all the different legal theories you can use to hold someone accountable,” Hopkins said. “Unfortunately none of those legal theories is something you can use against someone unless you sue them.”
Every case is an uphill battle in terms of time and money, and in Colorado many would-be plaintiffs decide not to sue because of a statute that awards attorneys’ fees and costs to a defendant if they convince a trial court to dismiss the case using a motion to dismiss.
“That fear is probably the biggest hurdle. … People who are well informed, by attorneys who understand what can happen, tend not to want to sue unless they are very, very confident that they will survive a motion to dismiss,” Hopkins said. “You don’t want to sue, lose a motion to dismiss, and not only have to pay the attorney who wrote your lawsuit but the other side’s attorney.”