Team Jorge: how companies and brands should protect themselves

The research findings of the Forbidden Stories network of investigative journalists have rightly caused an uproar. Companies like Team Jorge use state-of-the-art technologies and social media platforms such as Facebook, Instagram, and Twitter to influence elections and votes to the advantage of their clients. To this end, they hack accounts, steal data, spread messages in the name of the victim, and run disinformation and smear campaigns through a very large number of seemingly credible fake accounts. Team Jorge follows three basic rules: first, no campaigns in their home country of Israel; second, no interference in US government policy (this apparently doesn’t apply to elections in the US, though); and third, no campaigns against Putin or Russia. At this point, you might philosophize about where the clients come from, but that would not generate any new insights.

Any major votes are potential targets

Team Jorge is obviously a threat to democracy in general, but that is not the only danger. Not only are there some companies similar to Team Jorge that are also very professional; what’s more, these techniques can be (and probably are) used for purposes beyond election campaigns in the Second and Third Worlds. Any major votes are potentially at risk of being influenced by unfair means. Take the introduction of the Euro 7 emission standard or the ban on internal combustion engines in cars and small trucks from 2035 – there may well be some interested parties that would like to influence these upcoming votes in ways that go beyond traditional lobbying.

Awkward individuals in politics and business may also be worthwhile targets of this kind of campaign. The aim is to destroy a person’s reputation and make them permanently, or at least temporarily, withdraw from public life.

Big international brands are worthwhile targets for hackers

Disinformation and smear campaigns and the hacking of accounts to obtain data and use the accounts for fake messaging may also be an attractive option beyond politics and individuals. International B2C brands (fashion, automotive, food & beverages, etc.) in particular are at great risk here, as social media platforms can cause massive damage to a company’s image within a very short period of time. The resulting drop in sales can only be remediated, if at all, through a major effort and a massive long-term marketing campaign.

Urgent need for action: use technologies, be consistent

How can you make it harder, and ideally impossible, for companies like Team Jorge to operate? This is obviously not trivial, but there are technologies that at least make it more difficult for those organizations to succeed:

• Multi-factor authentication – Hacking accounts is much more difficult if you use not only simple passwords, but also a second factor is checked. This can be a token (not a PIN sent via SMS, as this is not secure enough) or an authentication app on a smartphone. Automatically generated one-time passwords are also generally considered to be secure. It is important to point out that this requirement not only applies to business or government e-mail accounts, but to all accounts that are used, including private e-mail accounts and social media platforms. If a provider does not support this function, the account has to be deleted.
• Encryption – Data that has been encrypted with suitable algorithms makes it much more difficult for thieves to use. With data that might still be kompromat in a few years’ time, you should make sure to deploy quantum-safe procedures today.
• Delete fake accounts – Social media platforms play a key part in spreading fake news. Few other methods allow to spread news so quickly and so widely, regardless of its validity. That is why platform providers must be obliged to identify and delete fake accounts. That’s not easy to do, but banks have established video identification procedures, so social media platform operators and users should also be able to adopt them. This would make it much more difficult to set up and operate fake accounts. As a positive side effect, it would be much easier to prosecute cyberbullying and similar offenses.

One thing is clear: social media platforms will do their best to torpedo the fight against fake accounts. There is also a risk that legal requirements, if they exist at all, will not be precise enough to really solve the problem. However, brands that want to avoid being sales drivers for organizations like Team Jorge should define clear standards for multi-factor authentication. The same applies to all private users.