Online Investigations in an Era of Manipulated Search Engine Results

November 5, 2020

By Daniel Greenberg, Partner of Forward Risk and Intelligence

Online due diligence investigations – vetting potential business partners, investments, or key hires on behalf of investors, law firms, financial institutions, or corporate clients – need to be conducted in line with the latest best practices, in order to ensure that all pertinent risk issues are identified and highlighted. Scammers and fraudsters, however, have become savvier at manipulating search engine results and other sources of online information, hiding accurate but unflattering content under the aegis of “reputation management.”

Investigators have a responsibility to counter these techniques and provide accurate, non-sanitized facts to their clients. This entails spotting the often-subtle signs that something is “off,” and working carefully to separate truth from fiction.

Reputation management is similar to digital marketing, but with a key difference. Whereas digital marketing involves efforts to promote a brand online, reputation management is an attempt to influence or even control what others will see about a company or an individual.

There are certainly valid reasons why reputation management may be carried out. For example, if a defamatory claim or sensitive personal information is posted online, it is only natural to want the offending content removed. As another example, some companies respond to negative employee posts or customer reviews to give their perspective.

On the other hand, reputation management can also be used to prevent the public from viewing accurate but negative news stories, blog posts, and reviews. For example, a fraudster can seek to bury an article in the local press about criminal charges filed against them. A June 2019 Buzzfeed News feature highlighted “Google-savvy reputation consultants” who can “cover up arrests, poor customer reviews, and other image-killing content.” The article discussed various techniques used to manipulate search results and ultimately “enable people to hide important details about their lives from potential employers, customers, and romantic partners.” While not necessarily illegal, these methods are fundamentally deceptive.

This unsavory form of reputation management is primarily intended to mislead both search engine algorithms and the general public, but even investigative professionals can be fooled. In the context of investigative due diligence, such a mistake would ultimately deprive a client of an accurate understanding of whom they are getting into business with.

Any investigator should already know how to approach online claims with a critical eye, but they may not always recognize some of the tell-tale signs of a whitewashed online profile. Drawing from our own research, we have compiled some tips that can help investigators to identify and sidestep common reputation management tactics:

1. Spotting Fake Web Content

The easiest way to determine that the online reputation of a company or individual has been “managed” is to spot artificial, positive content.

A reputation consultant may create fake webpages, press releases, customer reviews, or blog posts meant to both bolster their client’s reputation and hide unflattering stories. The fake web content is carefully designed using search engine optimization (SEO) techniques that trick an algorithm into featuring the content at the top of search results, pushing down other, legitimate, sources of information. One controversial SEO technique is to pay for other websites to link to the fake web content, making it appear to be a legitimate and popular destination for web traffic.

Spotting this artificial positive content requires an investigator to be at least as media-savvy as the reputation manager. There are so many news sites on the internet that it can be hard to tell at first that any particular source is fake. Also, in the era of “sponsored content” masquerading as news stories, it is common for a promotional article to visually appear like a legitimate news story. On a similar note, the Wall Street Journal recently discussed how political organizations have created networks of websites that purport to be genuine local news sources, while actually pushing highly partisan agendas.

For a potentially fake news site, an investigator should look at the homepage and a few other news articles to determine whether there is a legitimate news service being offered. Do the articles focus on news related to a specific industry or location, or are the topics seemingly random? Is there any odd or unnatural writing, which could be a sign of bot-generated content? The article’s byline should have the name of the writer, and an investigator can assess whether this is a real person with a discernible track record in journalism.

For a potentially fake press release, an investigator should consider whether the announcement is truly a newsworthy event. For example, a reputation management firm may attempt to hype up a charitable donation or scholarship that is either for a small amount or entirely fake. Investigators should be aware that some well-known news websites will publish paid press releases without vouching for their accuracy.

Fake customer reviews and blog posts can be harder to distinguish. Still, if the tone is overly promotional, the investigator should take a skeptical approach. One tell-tale sign of a fake post is finding the same exact text repeated on multiple, ostensibly unrelated, websites. A sudden spike in the frequency of posts is another indicator of fake content. An investigator can also use web domain registration data (registrant name, IP address, etc.) to uncover connections between purportedly separate websites and blogs that are actually managed by the same actor.

In order to get past a mountain of fake web content, a media-savvy investigator can include the use of targeted search terms to more quickly find relevant content. In addition, Boolean operators can be used to filter out artificial content or “noise.”

2. Spotting Fake Social Media Followers

If a company or individual has numerous followers on Twitter or Instagram, that can appear to lend them an air of credibility. However, many people – including fraudsters seeking credulous investors – purchase fake followers on social media platforms. The two easiest ways for an investigator to spot fake social media followers are to examine the followers, and to examine the quality of the followers’ engagement.

Legitimate follower activity (e.g., likes and shares) should be somewhat proportional to the number of followers. If an account has 800,000 followers but recent posts are only receiving a handful of likes, that is an obvious sign of fake followers. Comments can also be reviewed for signs of genuine engagement. An investigator can also scan the accounts of a sample of followers and determine whether they appear to share interests with the social media account. If, for example, followers of a biotechnology company seem to have expressed no other interest in the biotech or pharma sectors, that is an indication of fake accounts.

Likewise, an investigator should be able to recognize low-quality social media posts and accounts. A social media account for a relatively unknown person or company, with only a couple dozen posts, is very unlikely to attract thousands of legitimate followers. Also, if a recently created account has made thousands of posts already, that is probably the work of a bot, not a real person.

3. Finding What is Intentionally Hidden

The most challenging aspect of investigating a person or company with an actively managed online reputation is finding web content that has been removed, or “scrubbed,” from the internet.

Web content can sometimes be removed from a search engine’s results through a process called “de-indexing.” A reputation management consultant can ask a search engine provider to remove a link from its results, although usually they require a legitimate reason – like copyright violations or sensitive content – before removing the link. A website owner could also be pressured into de-indexing a page through coding changes. While investigators often have a favorite search engine, they should also run searches on competing platforms and compare results.

Perhaps the hardest content to identify is a page that has been taken down from the internet. A reputation management consultant may have pressured a publisher, like a local news website, to take down negative content about a person or company. For the investigator, they may find that a potentially significant lead runs up against a broken link. One perennially useful solution is the Internet Archive’s Wayback Machine, which has a huge collection of archived web pages that can be reviewed. Investigators should also search within subscription-based news media databases, which contain older articles that often do not appear in normal search engine results.

4. Intuition vs. “Checking Boxes”

The increasing sophistication of online reputation management techniques puts into sharp relief the difference between a surface-level review and a deep-dive investigation. The key finding in an investigation may be based on a subtle indication that something is amiss, rather than an article or legal filing plainly stating allegations of wrongdoing.

Online reputation management could also expose the limits of artificial intelligence (AI) tools that purport to automate the due diligence process. Such tools, which scan large datasets and carry out natural language processing for unstructured web content, are touted as able to highlight risk issues. However, these scans are typically targeted at risks in the form of government sanctions or major news stories that contain certain key words, like “fraud.” While results from automated scans could be useful for investigators to review as one part of a larger process, it is not clear how these tools will be able to adapt to an information landscape that has been intentionally manipulated.

Ultimately, an investigator’s most important ally against online reputation management techniques is their own instinct. Research must never become an exercise in rote “box-checking.”

While investigators often shy away from providing subjective opinions, that does not mean setting aside their own analysis and common sense. Doing so would unwittingly play into the hands of deceptive practices like those outlined above. Instead, no matter the scope of any particular assignment, investigators must always approach all claims with professional skepticism and apply their own knowledge, experience, and intuition to their research.