Government Must Respond Rapidly to Social Media Hacking

[Editor’s note: Please watch the Jan. 15 , 2015, webinar on How Government Can Prepare for and Respond to Social Media Hacks. on our Youtube channel]

The hacking of an Associated Press news account on Twitter this week, and its fallout, underscored the need for agencies to prepare for similar obstacles. Especially in public service, misinformation from rogue accounts can create damaging impact. Following these steps can help you mitigate the risk of not only rogue posts from your own account, but also respond to rogue posts from outside accounts that could harm your mission.

The most recent incident occurred because of an email phishing scam that could have targeted anyone. There may seem like more opportunities for slip-ups in the fast paced world of social media, but following standard rules will still keep you out of trouble in most cases.

In fact, what’s often blamed on social media hacking is rooted in poor account management: easy-to-guess passwords; passwords that aren’t changed periodically or after staff changes; or lazy device security such as unlocked computers or mobile devices. Luckily it’s often easy for government to prevent “social media hacking” using simple precautions, and regain control of the situation when it does occur.

Protecting Your Account from Hacking

Twitter’s website has recommendations for avoiding security pitfalls you will recognize from many other Internet technologies you use at your agency, including:

• Use a strong password.
• Use different passwords for your social media accounts.
• Watch out for suspicious links, and always make sure you’re on Twitter.com before you enter your login information.
• Never give your username and password out to untrusted third parties, especially those promising to get you followers or make you money.
• Make sure your computer and operating system is up-to-date with the most recent patches, upgrades, and anti-virus software.

The bottom line is to use the same common sense you use elsewhere.

Repairing Your Account After Hacking

Let’s say that the damage is already done and you’ve lost control of your Twitter account — what then? If you follow these steps, you can minimize the trouble caused and get your mission back on track quickly.

1. Have a plan ahead of time: Don’t wait for the unknown to happen. Make certain your social media strategy has a contingency plan for a compromised account, and that all parties who need to make a decision when it counts are prepared to carry it out quickly and efficiently.
2. Inform Twitter: First fill out a Twitter support request for the hacked account. Then email the ticket number to the Center for Excellence in Digital Government so we can pass it along and monitor for widespread incidents. Timing is critical in these initial minutes.
3. Change all other social media passwords: Even if you think the security breach is limited to the one account, it is prudent to immediately change the passwords of all other social media accounts, as they are often linked. If you find you’re losing control of other accounts, contact those platforms immediately as well.
4. Alert your followers to hacking: If you don’t have access to your account yet, use other accounts to alert your community that a breach occurred. Chances are if rogue tweets are sent to your community they will already suspect something is wrong and this will help prevent the spread of false information. Make sure this is sent within four minutes of the initial breach, at most, and that your strategies and policies allow you to respond quickly when it counts.
5. Dispel rumors: Once your account is regained, make a record of the rogue tweets, delete them from your stream, and communicate to your community what happened. Yours won’t be the first account hacked, but citizens rely on you to handle it best.

Responding to Rogue Tweets from a Hacked Account

Sometimes the best preparation can’t protect you from misinformation when someone else’s hacked account is spreading misinformation about your agency. Just like when repairing your own account, time is of the essence and citizens need you ready to dispel rumors.

1. Have a plan ahead of time: Again, don’t wait for the unknown to happen: Make sure your agency is ready to respond quickly and effectively.
2. Dispel rumors: Once you confirm that the information is in fact false, quickly communicate to your community the correct information. Timing is critical in these initial minutes.
3. Inform Twitter: As the other party may not be aware they are hacked yet, connect with Twitter and let them know your concerns. If there is a security breach, this may help get the wheels in motion sooner to fix the problem.

While handling a hacked account can be a big fear for agencies, social media also gives you the ability to quickly and efficiently mitigate risk and fallout — if you’re prepared for it. Check out DigitalGov University’s training on cybersecurity and social media, and look forward to more guidance and recommendations as agencies continue to use Twitter to engage with citizens.