Dealing With Kirk Accusations

Compliance officers might be hoping to avoid the vicious political fallout from the assassination of right-wing provocateur Charlie Kirk. Well, no such luck: online activists are now trying to out supposed anti-Kirk critics, sometimes getting it wrong, and heaping a pile of investigative and due process headache onto your doorstep. 

The headache happens as follows. First, online activists are compiling lists of people who supposedly made offensive statements about Kirk after his death. The activists match those online user identities to the personal data of actual people, such as their names, home addresses, phone numbers, and employers. More online activists then barrage the alleged Kirk critic with phone calls, emails, and voicemails about how heartless and terrible they are — and contact the person’s employer as well, demanding that the alleged Kirk critic be fired. 

The problem: the online activists are sometimes accusing the wrong people, who haven’t said anything at all about Kirk or his death. 

One example is a man named Ali Nasrati, a 30-year-old IT worker for Walmart. As now described in several news articles, last Friday a Twitter account run by someone calling himself “Bad Hombre” posted that Nasrati had made multiple online statements attacking Kirk. Bad Hombre included the real Nasrati’s employer (Walmart) and Walmart’s corporate office line. Bad Hombre then encouraged his 182,000 followers to call Walmart and ask why it was employing a supposed Kirk hater. 

Except, Nasrati never made the statements about Kirk that caught Bad Hombre’s eye; he’s never said anything about Kirk at all. Still, Walmart was flooded with calls, so it suspended Nasrati (with pay) while it conducts an investigation.

Nasrati isn’t the only one caught in this Kafkaesque mess. An elementary school teacher in Wisconsin had also been doxxed by mistake, leading to a flood of complaints to her school district. (To his credit, her accuser later retracted his call for online followers to target her.) More innocent people are bound to be caught in the crossfire as well.

A New Type of Allegation Risk

If a company wants to fire an employee who made a statement about Kirk (or any other public figure), generally the company is within its rights to do so. The challenge for compliance professionals today is how your company can ascertain whether the employee actually said those supposed statements, when it’s now so easy to fabricate social media users and statements. 

In the fraud world, this is known as creating a synthetic identity. Fraudsters combine actual data from real people with fictional data about a non-existent person, to make that fictional personae more convincing. The goal is to create a synthetic person who seems so real and legitimate that you, the victim, fall sucker for whatever scheme the fraudster is pushing.  

What we have here is something like a synthetic allegation: online activists taking questionable data from unverified social media accounts, combining it with actual data about real people, and submitting all of that as one allegation to your hotline.

To be clear, fraudsters deliberately create synthetic identities to commit wrongdoing, while most online activists submitting synthetic allegations probably have no idea that’s what they’re doing. We don’t even know how widespread this problem is — but then again, that is the problem for compliance officers; you need to study each allegation on its merits to determine which ones are true and which ones aren’t.

Of course, unsubstantiated allegations are nothing new for compliance officers. So what makes these synthetic allegations about Kirk postings different? At least two factors.

First, confirming synthetic allegations will be harder. Typically when an allegation arrives on the compliance or HR team’s doorstep, it relates to some sort of corporate misconduct that happened within your enterprise. Verifying the allegation won’t necessarily be easy, but you do have access to other sources of information — email messages, transaction records, audit findings, and so forth — that you can use to confirm or disprove what’s in the complaint. 

Synthetic allegations aren’t like that because they will include lots of inherently unverifiable data. Maybe somebody used a bot to create legions of Twitter or Facebook accounts, and your employee’s photo was simply scooped up at random. Maybe somebody had a grudge with your employee, and deliberately created a set of false accounts to smear him or her. 

What if an online activist attacks your employee with seemingly damning online evidence from one social media account, and your employee responds with seemingly convincing evidence from another social media account? 

How will you decide which one is right? How much forensic research will you invest in this effort? How much risk are you willing to accept that you reach the wrong conclusion — with all the online firestorms, wrongful termination lawsuits, or bad headlines that might follow? 

Performing Under Pressure

The second and even worse challenge is the sheer ferocity of the online pressure that your company might endure while it tries to figure out the truth. Take our example of Bad Hombre, above. Whoever he is, he has 182,000 followers. He told that crowd to call Walmart and complain about one of its employees, and lots of them did. 

If your employee actually did make a statement (online or anywhere else) that your company finds problematic, then you can handle the matter as you see fit. But how are you going to investigate that question while working under potentially fierce online pressure? 

For an internal investigation about corporate misconduct, you typically can take your time to reach the right answer. You should do the same with allegations of personal employee misconduct — but the online activists defending Kirk don’t seem much in the mood for thorough, careful investigations. They are a self-appointed jury that wants people fired (and often worse), double-quick.

That puts compliance and HR teams in a tough spot. You want to preserve the integrity of your investigation, and to uphold the ethical priority of giving all employees a fair hearing. Fulfilling both goals when you have less procedural breathing space because online activists are sucking up all the oxygen in the room — that’s going to be tough. 

Compliance officers have other concerns, too, such as how you communicate your decisions post-investigation and how you document your work, because it’s quite likely that somebody somewhere will be unhappy with the decision you make. Maybe you’ll need to defend that decision in a wrongful termination lawsuit. Maybe you’ll need to defend it to employees suspecting the company has partisan political bias. Maybe you’ll need to defend it to online activists and political figures unhappy that you found their synthetic allegation baseless. 

Investigations teams are in for a rough ride. Buckle up, because it’s likely to last a good long while.