Let’s accept for the moment that the CEO of TalkTalk is not directly responsible for any security leaks. Dido Harding herself is not to blame. Let’s go even further: attacks happen all the time. So how come this event is blowing up in the company’s face so spectacularly?
Let’s have a look at the interview she gave to NewsNight on the BBC. You might want to skip to 40 seconds in:
She does a lot right. She is calm under pressure. She stays factual. She puts things into context. However, she’s made one fatal mistake in the briefings she’s taken: neither here nor anywhere else is she able to say whether the stolen information was encrypted.
Now, encryption is pretty vital in security terms. Essentially it means that the data is scrambled as well as protected – so if someone batters down your ultra-secure gates you’ve put up around your data, they still can’t read it without the key to the code. This is basic stuff.
Handling a crisis
To judge from other interviews, it appears that encryption is basic stuff that TalkTalk hadn’t done. This is bad news but it’s outside the remit of a blog on media tips. So, assuming you’re stuck with having to impart bad news, where do you start? Here are some thoughts – and Harding gets a lot right.
- Be honest: Don’t try to cover anything up. Declare as much as you can up front so that it doesn’t catch up with you later.
- Be open and available: The PR person will facilitate everything for you at a time like this but the press and public need to see someone senior and responsible. Go in front of the camera yourself.
- Be serious and talk about customers: Remember when the CEO of BP, Tony Hayward, reacted to an oil spill by saying he’d like his life back? So does everybody else. Harding has spoken a great deal about customers and their concerns. This is the right thing to do.
- Make a list of likely questions: And have answers ready, including answers to questions you’d rather we didn’t ask. “Was the data encrypted” is a stunningly obvious question. The answer should have been available immediately. And if the answer is “not all of it”, a better reason than “we don’t think we’re obliged to do that” should have been found. Phrases like “the situation is developing as we speak” can get you out of trouble quite reasonably if things really are changing minute by minute.
- Choose your interviews: This is a tricky one. The journalist in me thinks everyone should be allowed to ask anything. Logistically this is likely to be impossible. You might be better off with a few high-profile interviews rather than popping up everywhere. Very recently the charity, Kids Company, collapsed and Camila Batmanghelidjh was everywhere, as I pointed out here. She and now Harding might have been better off selecting their appearances more carefully. Harding, as CEO of a going concern, would have the excuse of having to go and run the business rather than spend too much time with the press. On balance, erring on the side of being accountable was probably right.
Taking better care of the data would have been a good starting point, it has to be said. In terms of communications, this hasn’t been as big a disaster as it could have been – but there were some fairly basic gaps.
Do you live in fear of what would happen to your company’s image in a crisis? I can help – fill in the form below and we’ll talk.