Как компания остановила информационное давление на CEO до сделки M&A

The enquiry came in on a weekend, which in itself says a great deal. A few weeks before the deal was due to close, selected recipients began receiving anonymous messages accusing the company's chief executive of wrongdoing. The messages were accompanied by materials: documents, correspondence, screenshots.

The executive's first reaction was predictable and, in human terms, understandable: he wanted to publicly deny everything at once and demand an investigation. That reaction was itself the main risk of the first hours - most campaigns of this kind are built precisely around it.

We started not with the substance of the accusations but with two other questions. First: which of the attached materials were authentic and which had been altered. Second: who it had already reached, and through what channels. Responding to the substance without answering these two questions has no purpose - only material whose origin is established can be denied.

There is a qualification we make at the outset of any such engagement. Establishing who is responsible falls outside the scope of a private investigation. We can reconstruct how and in what sequence the materials appeared and point to signs of editing. Only a court has the authority to state that a specific person or company is behind a campaign.

The task was set out in writing in three parts: preserve the original materials in a form usable by lawyers, verify their origin by technical means, and describe the pattern of their distribution. None of these three parts involved taking any action against anyone.

The danger here was created not by the accusations themselves but by the combination of circumstances and the typical managerial reactions to them. Below is what we discussed with the client in the first hours, before any practical steps were taken.

We do not describe a specific methodology here. A public description of how the origin of digital materials is verified would be useful primarily to someone who wants to prepare such materials more carefully next time. Below are the principles and the nature of the conclusions, but not the procedure.

First principle: what is verified is not the truthfulness of a statement, but the integrity of the carrier. The question is not "is this true" but "does this file correspond to what it claims to be". These are different questions, and the second can be resolved by technical means, while the first cannot.

Second principle: what matters is the discrepancy, not an isolated indicator. No single characteristic of a file proves anything by itself. What is significant is the discrepancy between what is claimed and what follows from the totality of technical characteristics, and only when it is consistently reproduced across several materials.

Third principle: the sequence in which information appeared is more informative than its content. The reconstructed order in which materials arose and were disseminated often says more about the nature of the campaign than the materials themselves.

The result was a division of the body of materials into three parts. Materials whose integrity raises no questions. Materials with consistent signs of editing - it was precisely this conclusion that changed the client's subsequent decisions. And materials on which no confident conclusion could be made: these turned out to be the minority, but they were expressly identified as such.

What this conclusion does not mean: it does not establish who made the changes and does not prove malicious intent. Signs of editing are a technical fact, and its legal characterisation falls within the competence of a court, not ours.

In parallel with verifying origin, a second task was addressed: understanding the actual scale. It almost never matches the perceived one - in the first days a campaign always seems larger than it is.

The work covered publicly available context and materials obtained by the client. It assessed which categories of recipients the campaign was directed at, the dynamics of materials appearing over time, and whether there was a recurring structure between individual episodes that exceeded what could be attributed to chance.

Rational interest was assessed separately: who, in principle, stands to gain from the deal being postponed or derailed during this particular period. This is an analysis of circumstances, not people. No specific individual or organisation was investigated as a suspect, and no hypothesis about a specific perpetrator was formulated or tested.

The reason is not only legal. A hypothesis about a specific perpetrator almost always starts fitting the facts to itself: what supports it gains weight, and what contradicts it is quietly discarded. At that point, an assessment stops being an assessment.

The practical result was unexpected for the client. The actual reach was considerably smaller than assumed in the first days: the recipients belonged to a narrow circle, and no signs of wide dissemination were found. This in itself changed the choice of response format - a public rebuttal would have addressed an audience that was not aware of the campaign.

The response format chosen followed from the mapping result: given that actual reach was narrow, the response had to be addressed to this circle, not to the market.

Communication was targeted and conducted through legal counsel - where required by the legal standing of the recipient. The content was limited to the factual state of affairs and to which materials showed established signs of editing. No message contained any assertion as to who was behind the campaign.

No public statement was made at all. This decision was discussed separately and was the hardest one for the client to accept: silence in such a situation feels like weakness. In fact, a public statement at that point would have increased the campaign's visibility by an order of magnitude and would have added nothing to the parties' position.

In parallel, a package for public communication was prepared but not used - in case the campaign extended beyond the established circle. Readiness to respond and the response itself are different things, and the first does not oblige the second.

We note separately what we do not assert. We did not establish, and do not assert, that the campaign was organized by a specific person or company. We do not assert that it ceased as a result of the measures taken: according to the client's observations, no new episodes have been reported since, but the causal link is not proven here and may have other explanations. This is a statement from the client, not a result of verification.

First. A procedure for a repeat occurrence was described in advance, in writing: who receives the initial signal, what is recorded immediately, who is authorized to decide on communication. In a crisis, one does not invent a procedure - one follows it.

Second. The circle of persons holding sensitive information about the executive and about the company's plans was described and narrowed. It is almost always found to be wider than necessary - not out of ill intent, but out of the inertia of working habits.

Third. Information discipline around transactions. Who knows the parameters and at what stage, through what channels terms are discussed, what information must not leave the narrow circle. Material for a campaign of this kind is most often taken not from a hack but from ordinary working carelessness.

Fourth. Separation of roles in the event of a crisis: the executive should not simultaneously be the subject of the campaign, its analyst, and the company's representative in external communications. Combining these roles is the most common reason the situation worsens.

Fifth, and this is a limitation. None of these measures guarantees that the campaign will not recur. They reduce reaction time and lessen damage, but they do not eliminate the possibility itself.

And last. Sixteen days and the described procedure are the circumstances of this example, not a standard. Another situation may require substantially more time, and an honest result of verification is often the conclusion that there are no signs of editing.

Signs of a task that is addressed by forensics and crisis management, not by a public response. This is not a diagnosis and not a promise of a result.