Companies fight back against Internet attacks

From...

by Mitch Betts

(IDG) -- This summer, the Yahoo message boards were full of postings that insinuated that Titan Corp.'s stock was headed south. "Very very bad earnings surprise coming today?" said one. "[Titan] is getting nailed with huge sell orders! Jump the sinking ship," said another, posted by someone with the screen name "CCRibber."

If the goal was to scare investors and drive the stock price even lower, it worked. Messages like that - plus a fake analyst report criticizing Titan - sent Titan's shares plummeting from $44 on June 20 to $21 on Aug. 22. It was a staggering 50% loss in market value, totaling $1.3 billion.

Then Titan got mad.

	MESSAGE BOARD
Security on the Net

The San Diego-based high-tech company filed suit on Aug. 30, angrily charging that the posters were "unscrupulous short sellers" who conspired to depress the stock for their own profits. The company got a subpoena to "smoke out" the people behind the three dozen screen names that had torpedoed Titan's stock.

The case hasn't wrapped up, but it's yet another episode in which corporate reputations have taken a real beating from Internet messages, fake press releases and "gripe sites." Of course, critical opinions are legally protected as free speech, but when the messages are false, defamatory or trying to manipulate the stock, corporate America is fighting back.

MORE COMPUTING INTELLIGENCE

IDG.net home page

Computerworld's home page

Buying security

Etrade makes the 'hit' parade: Client-side hacking nabs big one

Inside the world of a 'hactivist'

Reviews & in-depth info at IDG.net

E-BusinessWorld

TechInformer

Questions about computers? Let IDG.net's editors help you

Subscribe to IDG.net's free daily newsletter for IT leaders

Search IDG.net in 12 languages

News Radio

Fusion audio primers

Computerworld Minute

To do that, companies are hiring Internet monitoring firms that use software that scans the Internet to find out what's being said about business clients. They're also hiring private investigators to track the perpetrators.

"We get requests for that all the time," said J. Christopher Racich, director of high-tech investigations at Kroll Associates in Washington. "But it's not something you want to do if you're just aggravated [about the messages], because the investigation can be very expensive" - say, $30,000 to $40,000.

The investigations usually turn up former employees, disgruntled insiders or stock manipulators, Racich said. The big challenge is identifying the people behind the anonymous screen names. A flurry of messages may actually be the work of only one or two people who use different handles to make it look like they're a crowd.

One approach is to file a "John Doe" lawsuit and use subpoena power to obtain the identity of the mischief maker from his Internet service provider. That's what Titan is doing, but it's a strategy that has to be used with caution, Racich warned. "It should be a serious lawsuit, based on a cost/benefit analysis, not just a fishing expedition," he said.

Another technique employs "forensic psycholinguists" - the same folks who analyze hate mail sent to the White House - who look for signs that the messages came from the same poison keyboard.

In one recent Kroll case, a psycholinguist studied 30 messages from two screen names and concluded that they came from the same writer because they had the same format: a question in the headline and the answer in the body. The messages also used the same vulgarities.

Based on the analysis, the psycholinguist surmised that the writer was probably 40, white, professional and perhaps a day trader. Furthermore, the report said, he suffered from low self-esteem and felt his regular job was threatened by the acquisitions of the company he was lambasting.

Private eyes can also engage suspects in online conversations to seek clues about their identities, but there's a danger that the undercover gumshoe could tip his hand or cross the line into entrapment, Racich said.

Michael D. Allison, CEO of Internet Crimes Group in Princeton, N.J., said there are even better investigation tricks.

For example, perpetrators may have left some electronic footprints behind by filling out a Web site guest book with the same cybersignature they use later for derogatory messages.

Sometimes the text of a message itself provides clues. "If they say it's snowing outside, we'll check [weather records] to find out where on the planet it's snowing right now, to narrow the suspect pool. If they say they have a green Jaguar and live in Rhode Island, we'll get a database that lists every green Jaguar owner in the state," Allison said.

Apparently, companies are willing to go to great lengths to identify Internet content that besmirches their corporate reputation or infringes on their intellectual property.

The Associated Press news wire service in Washington hired Cyveillance Inc. in Arlington, Va., to identify Web sites making unauthorized use of copyrighted articles.

And Nintendo of America Inc. in Redmond, Wash., retained Cyveillance to identify pornographic Web sites that use its video-game brands such as Pokemon or Mario Bros. to draw visitors to their sites.

"We are continuously working to have all Nintendo content removed from URLs, metatags and Web pages of the inappropriate sites identified by Cyveillance," Nintendo spokeswoman Beth Llewelyn said. Nintendo will take legal action if the Web site operators don't cooperate, she added.

Cyveillance uses both human and artificial intelligence to monitor "online brand abuse" for clients. First, the company's Web crawler looks for information that meets customer-defined criteria. Then a team of e-commerce analysts studies the automated reports and recommends a plan of action. The cost ranges from $80,000 to $400,000 per year.

But such services can be used for much more than just defending against defamation and piracy. "Clients start off having a defensive mind-set, but then they transition to more of an offensive approach," said Brian H. Murray, director of Cyveillance's strategy center.

In other words, they begin to use Internet surveillance for benchmarking and competitive intelligence, such as finding out when a competitor adds a new feature, like online customer chat, to its Web site.

Internet surveillance can even help companies gather soft information like "marketing buzz" from the world's largest focus group.

NetCurrents Inc. in Burlingame, Calif., uses artificial-intelligence technology that scans Internet message traffic in order to provide a real-time graphical display of public sentiment about a company. Positive messages show up as a green bar, and negative ones as a red bar. But NetCurrents may not stop there. Theoretically, the technology could be used to gauge customer reaction to a new product or voter reaction to a presidential debate.

"You get an ongoing perception meter," said Irwin Meyer, chairman and CEO of NetCurrents. He's now testing the technology on Internet discussions about TV programs, in which fans of particular shows chat about the pros and cons of plot lines, actors and even clothing.

"The key is that it's real time," Meyer said. "We could deliver a report the following morning, in time to alter scripts or kill off a character that nobody likes."

Report: Half of smaller and midsize companies will suffer Internet attack
October 12, 2000
Senate committee approves watered-down anti-hacker bill
October 10, 2000
Web sites unite to fight denial-of-service war
September 27, 2000
New denial-of-service attack tool uses chat programs
September 6, 2000
U.S. official: Superpower status risks cyberattack
August 25, 2000

Denial-of-service attacks still a big threat
(Computerworld)
Password protection problems in Windows products
(InfoWorld)
Plan to develop Carnivore continues
(IDG.net)
FBI urges companies to trust Feds
(NW Fusion)
Business spy threat is real, former CIA chief says
(NW Fusion)
Inside the world of a 'hactivist'
(Computerworld)
Etrade makes the 'hit' parade: Client-side hacking nabs big one
(InfoWorld)
Buying security
(NW Fusion)

Kroll Associates
Internet Crimes Group
Cyveillance

Note: Pages will open in a new browser window

External sites are not endorsed by CNN Interactive.