And yet, also a little apprehensive. Early on I learned that conferences are alternate realities. All kinds of things happen there that wouldn’t happen in typical workaday life. As I commented on Conversation Agent Valeria Maltoni’s blog recently:

You meet people and have great, deep conversations, you brainstorm all kinds of possibilities. But when you go back to the normal schedule, after you’re all caught up and looking for a little of that ‘spark’ you found in a different time and place… you’re still constrained by schedules, responsibilities, expectations that temporarily didn’t exist at the conference.”

Valeria wrote an excellent post, “30 Connective Things You Can Do at a Conference,” about how best to manage that alternate reality, to network the way you want and need to. Because conferences and networking are so important to the DFIR community, I’d like to riff off her original post and talk about 20 connective things you can do after a conference.

1. On your day of departure—in your hotel room the night before you leave, in the airport, on the plane or train or in a coffee shop during a driving break—take the time to reconstruct your sessions, meetups, after-hours conversations, etc.

• What did you learn, and from whom?
• What ideas did you and others come up with?
• What did you observe, what did you overhear?
• What patterns do you see?

Write all this down to come back to in a week or so, after you’re caught up at work.

2. Share what you learned with your team. Remember that you’re coloring the information with your own perspective, so if possible, share the slide deck and/or handouts with them and invite their feedback.

3. Revisit your notes. Together with your team’s feedback, decide if there’s enough for new research, a new paper, blog article or podcast. Be sure to set aside time daily or weekly to work on the project (depending on how in-depth it is); when you publish it, be sure to refer to the conference, people and ideas that led you to complete it.

4. Didn’t get a chance to provide feedback to speakers? Make a point of emailing one or two speakers per day after you get back to the office. Be specific about the takeaways you gleaned. Leave the door open for further discussion.

5. Share what you learned about products and vendors with your team. Collect their questions and needs—not just about what the product(s) can do, but what they need to do their jobs better. Follow up with the vendor(s) to ask those questions and see how well they respond to your team’s needs. That response will be an important part of your purchase decision.

6. Take time to think about things you wish could’ve been different:

• More time meeting new people?
• Hanging out with old friends and colleagues?
• Lecture track you would’ve wanted to attend for yourself, rather than work?

Decide to make those changes at the next conference you attend.

7. Start a Twitter, LinkedIn group, forum/listserv or blog conversation about something you learned. (Sometimes conferences have their own LinkedIn groups.)

8. Identify the 3-5 people you connected with most strongly. Make a point of calling or emailing them every so often with things you believe they’d benefit from:

• an article that recalls your conversations
• a speaking opportunity at another conference or with the media
• a congratulations on one of their accomplishments. Comment on their blog; tweet @them; find them on Google+ Hangouts.

9. While you’re at it, think about the things that made you click.

• Particular ideas?
• Core themes that connected your conversations and ideas?
• Shared values?

Again, see if there are patterns—finding them can help you work out where you can benefit the community the most.

10. Set a goal for yourself to speak at next year’s conference, especially if your topic is based on the ideas you heard at this one.

11. Did you meet someone you thought would benefit from knowing a friend or colleague? Make sure you email-introduce them (and perhaps even conference call) the week following the conference. And be clear about the value they would have to each other.

12. Find a way to invite the best speaker(s) to your local area. A Security B-sides event, HTCIA or other association chapter meeting, or one-day training session can be ideal. See whom you can partner with to make it happen. Or, hold a virtual event. Your employer may be amenable to a webinar, or you might suggest the speaker to an event like #DFIROnline.

13. Pace yourself while reconnecting. Follow up immediately after the conference, but then let your relationship build naturally. Remember: conferences are alternate realities. Remind the other people who you are, then let the dust settle so that the ideas you built can stand by themselves for further building.

14. Who organized the event? If you can, volunteer to do something at next year’s conference, or encourage your employer to support it in some way (if they aren’t already) by sponsoring a giveaway or networking session.

15. Between this event and next year’s, you’ll network with more professionals. How might they benefit from coming to next year’s event—especially if they’re based in other countries? Invite them based on what you’d like to learn from them, and tell them you’ll be glad to introduce them to your connections.

16. Did anything you learn at the event change your mind, or send you in a new direction? Use a blog post to write not just about what, but also about how it happened—the old idea you’d never heard expressed that way before, or the unexpected angle. Did it help you solve a problem, or are you still mulling how to apply it in your own professional life? Either way, share it with the community.

17. Join a social network that’s new to you:

• Well-traveled ones like Twitter, or underrated ones like SlideShare.
• Volunteer for the SANS blog (if you’re qualified).
• Create a new Google+ Circle and spend time there daily.
• Guest blog for your favorite DFIR bloggers.

18. Publicly acknowledge the conference and what you thought was great about it. Mention by name those who made it great: organizers, speakers, people you connected with. A video testimonial can be especially powerful.

19. Traveling to where a speaker or conference connection is based? Let them know ahead of time, and tell them you’d love to get together if they’re available. Use your notes from your conversation(s) or their lecture to drive your conversation.

20. Think beyond your constraints. We get so caught up in our day to day responsibilities, we forget the things that made conferences spark for us. Make the time to recapture it, if not in conversation (that’s not always possible), then for yourself, in your own mind, from your own notes and memories.

“…follow through is key,” Valeria wrote. “Closing the gap between promises made and promises kept builds a solid reputation, and helps you make stuff happen, too.” It takes practice for sure, but the DFIR community is forgiving as long as you’re trying your best, and values face-to-face as much as virtual relationship-building.

What are some things you do to follow through with people you’ve met at a conference?

photo credit: kenteegardin

That’s why his recent post about (pseudo?) reporter Judith Miller struck a professional nerve. Having moved from trade journalism to public relations, I was especially struck by this point:

When there is a real danger people need to know about, you have to report it. That’s when people need to hear the scary truth. But I do mind, because the fear she threw around was not based on truth… if you are the writer, you should care about how people will react.

Then again, if you’re willing to write lies, you’re not really going to care about that, are you?

I have faced a lot of skepticism over my motivations in the past 10 years. To cops, I was “the media,” even if I was writing for their publications. Newsroom journalists on listservs made snide comments about “PR fluff.”

These days, I worry when journalists don’t get back to me. Did my article suggestion not meet their needs, or do they think the story I just pitched them is a cover for a sales pitch? And it always makes me cringe a little when I see the occasional tweet about marketing manipulation and PR spin.

The business of inspiring (re)action

The skeptical are right to be. The spin machine can be ugly, especially in the face of a crisis. The problem isn’t that we don’t care how people will react. The problem is that we’re paid to care about making them react a certain way.

Sometimes the two converge, and that’s when you get great PR and great journalism. But sometimes we care more about making readers and viewers react, than we do about how they actually feel.

Journalism, just as much as any PR client, is in business. Journalists sell newspapers and magazines, or pull in ratings, on the strength of their storytelling and how well it adheres to editorial guidelines. Both types of messaging are about building and sustaining a brand, which every good businessperson knows is about trust.

Judith Miller and her ilk take shortcuts, go for short-term reaction rather than long-term trust. On a lesser scale, but no better at trust-building, are those who are chronically too overworked or lazy or demotivated to spend time getting every fact right.

Some might say this makes them a perfect fit for PR. How many times have you read a white paper that referred vaguely to “statistics say…” without citing the actual research, a name and date if not a link to go with it?

But for one problem: in the last few years, since the economy coupled with social networking broadsided the media industry, the PR-journalism symbiosis has changed. We still depend on one another, but we also compete with each other.

Consider: fewer journalists at struggling publications means more PR pros are competing to provide the content. That makes it harder for us to get our clients’ stories told. Conveniently, social media provides an alternative outlet, but needs a constant stream of content to stay in followers’ minds. Therefore, we encourage our clients to become publishers of their own content.

Brand journalism requires high standards

That’s because ideally, our clients’ content provides better context for media as well as buyers. When we pitch a reporter who likes what we’ve had to say, s/he can come back to our website with its blog and videos and white papers and infographics, and use them for the article s/he’s working on. Or s/he can find them via search, including social media monitoring, and be the one to make first contact.

That’s why it’s incumbent on us to hold our content, which some call “brand journalism,” to the same high editorial standards as journalism does. Truth, as everyone knows, is subjective, based on human interpretation. Good PR is about helping our clients and their customers understand each other’s truths, and adjusting our messages accordingly, with the end goal in mind of inspiring action — sales.

Making it easier on them is a form of building trust. At some point, buyers and journalists alike take a leap of faith: they choose to believe what they’ve researched, and go forward with the purchase or the story. Shortening that leap is what will keep them coming back. Here are some ideas:

• Research, whether from a vendor or from academia, is constantly being tested, refined, even disproved. We need to be transparent about showing what has changed and how, whether we are referring to someone else’s research, or promoting our client’s own.
• The phrase “statistics show” is condescending when it stands by itself. Treat white papers like blogs long enough to link to the research that shows the point you’re trying to make. Let your reader draw his or her own conclusions. It will make for better story-telling.
• It’s the job of a good journalist to find opposing as well as complementary points of view to balance what our clients present as truth. Use these as opportunities to drive future research, content and business forward.
• Much as been written about the power of social media in correcting reporters’ errors, which can be important to reputation management both in and outside of a crisis. Twitter, LinkedIn, YouTube and your company blog are all good places for this.
• Use journalists’ own fact-checking tools for content — and remember that fact-checking still carries with it a certain degree of bias, as you look for facts that support your argument.

“Brandwashing” is alive and well, unfortunately. But if we want our content to build trust with prospects and customers, only taking the time to get our facts as right as we can — and to engage in discussion when people disagree — will keep our relationships in balance and both our businesses in the black.

photo credit: Marquis Lewis

How do you find #DFIR examiners to beta test your tools?

If you’re a small and/or unknown digital forensic tool provider, getting people to beta test your tool(s) may be a challenge. Ideally, you’re located in an area where you can partner with local labs and their experts. But what if you want to expand into a new geographical location, or you’re so new that the local experts don’t know who you are?

I asked the digital forensics/incident response experts on Twitter and Google+ what they thought:

Fill a need

“In my corporate work,” wrote Joseph Shaw on Google+, “we find that our investigations always fall within a very strict set of technologies and use cases, so the only time we look at a new tool is if it does something we really need done and can do it faster and cheaper than an existing tool we already use.”

Shaw’s lab follows the same procedures as Stacey Edwards’, who wrote: “We test both new products and new versions of old products against a standard set of data. If the results match what we would expect, and the product is affordable, more stream-lined, or runs faster, then we’ll proceed with it. If the product does nothing extra for us, then we’ll typically pass on it for the moment, but we may decide in the future to go back to it.”

“For me, it was a new product with a lot of potential, that would fill a void in email processing,” tweeted Frank McClain, “and that’s usually what gets my attention: new, potential, unique and that does something interesting; something I relate to, think I can help with.”

Filling a need is also about making it easy for the users. Any demo needs to provide full access, not limited features. “If I have time and the vendor makes it easy to obtain, I’ll test it and compare to end results [from established tools],” tweeted Daniel Parsons. “The no namers tend to be buggy and ease of use is still low, but you never know what you’ll find.”

Finally, as the “Big Kahuna” tweeted, “bragging rights” can be important. Examiners who are involved with tool testing should be able to say so, as it enhances their credibility as well as yours.

Be available

Where do users find out about new forensics tools — i.e., how might you let them know about yours? Says Edwards: “Twitter, email lists, blog posts, etc is usually how we find out about them. Or, if we have a need such as ‘products that convert OSTs to PSTs,’ we’ll poll people and do a Google search. It’s typically a need arises first, then we’ll do the searching and testing.”

This highlights the importance of two tools: SEO, and social media. Anticipate the keywords your intended customers will use. And follow — and engage — with them using social tools. Twitter and Google+ have the strongest digital forensics followings, though some LinkedIn groups may net good feedback as well. In addition, forums like Forensic Focus continue to be important to many users.

Likewise events. “I just demo’d the new Oxygen Suite 2011 because they gave it at #htciacon [the HTCIA Conference],” tweeted Parsons. Earlier in the year, at the Techno Security/Mobile Forensics Conference, Cellebrite made available a demo of its latest version of Physical Analyzer software. They made their demo part of a contest, in which participants underwent a timed analysis for the chance to win a new BlackBerry PlayBook. (Disclosure: Cellebrite is a client.)

Most of all, community

The digital forensics/incident response community is all about its relationships. Good investigators know that the time to build them is before you need them, and it’s no different for companies seeking beta testers. Get involved early and often — months before you need testers.

McClain, who seeks open source tools, looks to build relationships “with smaller developers, other forensicators (like [Andrew Case]) who build tools for the community,” he tweeted. Likewise Gilbert, who relies on word of mouth to find out about noncommercial tools, and on his relationships with vendors for commercial tools. “Usually [there are] no true betas on production work,” he tweeted.

Are you an examiner who has participated in beta testing, or a vendor who has asked examiners for help? Leave a comment — how do you prefer to make these connections?

Image: dpstyles via Flickr

• Something breaks. A piece of equipment, an aircraft, a phone tree, web hosting.
• Disgruntled customer tweets about it.
• Company rep whose product/service broke follows disgruntled customer and asks how they can make it better.
• And/or, company’s competitor also follows disgruntled customer, offering a chance to switch.

This has happened with greater frequency in the past 8-12 months. Taking cues from case studies like Comcast and Dell, companies are monitoring Twitter streams and blogs, retweeting positive comments and asking about negatives. They may monitor for business opportunities like a need for website hosting or ESI archival solutions. This is social customer service, and it’s almost machine-like in its predictability.

Which is exactly why businesses need to tread carefully when the case studies tell us we need to be responsive, to “join the conversation.” Social media may be technology, but being “social” means they are personal. Machine-like is not a good quality to bring to a social environment, and here’s why:

Response overload

More businesses being more responsive means more risk of being tuned out. Can you imagine being in a large room, surrounded by people fawning to make sure your every need was taken care of? It would get old, fast. Indeed, I was actually blocked in the last few weeks by someone I respect highly, who also blocked the client I represent.

I had a good guess as to why: he’d complained a few times about the client, and being the good social PR person that I am, I’d followed up each time. The last time, he complained that he didn’t want to hear from me every time he blew off steam. I thought this meant I needed to respect his boundaries — not that he’d block both me and the client.

Why is this important? Some people just don’t want to “be engaged,” right? In this case, the individual is someone we call an “influencer”: his opinion matters to other professionals who follow him. Not having access to his (protected) Twitter stream means that he could be driving business away, and I would never know it or have the chance to respond.

In the grand scheme of things, this is probably not a big deal; it doesn’t mean a departure from the business goals I helped the client create and work toward. But it is an uncomfortable position to be in, and that is why I say: tread gently. Don’t assume that conversation about you indicates a desire for conversation with you.

Respond to what you can control

In my Twitter stream last month, two forensics “tweeps” brought up problems they’d been having with a certain brand of hard drive. I jumped in, telling them that 15 years ago when I worked in computer support, that brand of hard drive seemed to crash on us the most often, too.

Within seconds a brand rep was following all three of us, asking how s/he could help with our “trepidation” about the brand. I didn’t respond, just tweeted to my friends that I still hesitate whenever I see the brand name in the specs of a computer I’m considering buying. I wasn’t sure what else I was supposed to say.

If you’re not making the decisions, or if the problem (say, quality control) is bigger than a simple customer-service transaction, stay in “monitor” mode (including following individuals) and work closely with those who can resolve the problem. If it’s not likely to get resolved, figure out what the lessons are to learn. We can’t all work in a Zappo’s company culture, so when it comes to communicating with your publics, how can you work with what you’ve got?

The community isn’t your personal marketing territory

A Facebook friend — a book author and church leader, not a professional marketer — recently said, “When ‘community’ is the agenda in the community, friendship itself becomes utilitarian.”

All friendships are a little bit utilitarian. We fulfill both spoken and unspoken needs through the company we keep. We may even give back, anticipating in the backs of our minds the time when we will need something. Only in the best of friendships do we give selflessly.

It’s unlikely that our marketing relationships will ever achieve that agape level — businesses exist to make money, they are inherently impersonal. However, they are still composed of human beings. And while a marketer might naturally say that of course a brand community is utilitarian, our customers might be mourning the loss of true communities in ways we don’t realize (and perhaps should be more sensitive to).

Example: a police lieutenant I know worried that social media would add to the increasing erosion of Southern front-porch values, the gift of an invitation to “come up and sit a spell” on a warm summer evening. He was the first person I thought of when I read how social media is recreating the neighborhood:

The human need to be part of something small and special — a smaller circle of special friends and family — is at the heart of everything we do as people. It can be seen in the many meetups and niche conferences we hear about daily. It’s the power to know where someone you ‘like’ is, at any given moment of the day, using Foursquare, but then using that knowledge to meet and greet them, hand to hand, face to face. We may brag about our Twitter followers and friend dozens on Facebook, but in our hearts, it’s our real-life friends who drive us to buy or not to buy, to support charities or not support them.

Granted, it can be hard to “recreate neighborhoods” when your customers are scattered far and wide. But when you form relationships online that translate into meetings, dinners and drinks at tradeshows, when you and your customers trust and think of each other as friends rather than soul-suckers who always want something… issues with response overload and things beyond our control may just be reduced.

As with any relationship, though, such business-friendships must be carefully cultivated. However, fearing them — fearing crossed boundaries and advantages given and taken — does not make for the kind of “social business” that we know can lead to better customer loyalty, and thus, sales.

How are you striving to improve your responsiveness to customers? How is it, or isn’t it, working for you?

photo credit: teamstickergiant

I plied him with the most tailored advice I could give about starting and joining in conversations, linking, curating related content, and generally being himself. He was already starting to collect followers, and I knew he’d be welcomed.

But he wasn’t posting. When he finally did, the post seemed awkward. And yet, he’d told me he was reading and parsing everything I’d written. So what was going on?

Short bursts of conversation are not for everyone

Most people who thrive on Twitter tend to do so within just a few tweets of joining. They figure out how and where to find the people they want to connect with, and before long, only their follower counts show how new they are to the space. The short form of communication doesn’t seem to bother them in the slightest.

I emailed my SME. “It’s not the conversing with people… it’s figuring out how to fit your natural patterns into Twitter syntax. How often do you text message or IM or chat with other people?” I asked.

His response: NEVER. “I hate texting and IM’ing,” he wrote. “I only text my wife and a couple of buddies. I never use IM.”

Of course it would be harder to fit into short-form messaging. And yet, there was still that niggling problem: because of the forensics community on Twitter, it was still the best place to drive traffic back to his site.

I recommended he check out Twitterfeed. Although I don’t advocate automation as a stand-in for the kind of relationship-building Twitter enables, it was clear that my SME wasn’t all that into this particular mode of relationship-building. Automation would ensure that he could tweet both his own, and related content. Enough tweets, and he’d be able to stay in front of followers.

But don’t just “set it and forget it”

Those who expect to be able to build a relationship with Twitter-based experts may be turned off when their RT or attempts to start a conversation go unanswered. They’re not likely to understand that this isn’t because the expert is a snob, but simply because s/he isn’t there to respond.

To get around this, the expert might do one of several things:

• Post a Twitter bio reflecting that the account is automated and giving users the option to email with questions or comments. This isn’t perfect — people generally won’t check before they reply to a tweet — but when they first follow you, the bio can be useful to establish a ground rule.
• If you dislike Twitter, but you’re on LinkedIn or Facebook and feed your status updates to Twitter, consider periodic tweets that ask followers to connect with you via one of those channels instead.
• Ask blog readers to email you or comment on your blog rather than tweeting you. (Twitterfeed allows you to input text before or after a tweet.)
• Use an app — my SME tells me Twitter for iPhone has one — that pops a message up whenever you’re publicly mentioned.

Twitter is well worth the time and effort to get to know, but if you hate short-form messaging in general and decide, after making an honest effort, that it really isn’t for you, then consider automation and/or combining the channel with the social sites you do prefer.

Have you chosen not to use Twitter? What have your experiences been? How do you connect with the investigative community otherwise?

photo credit: cevanoff

Time is often cited as a factor for no or low blogging activity. Yes, blogging is time consuming. I also think that sometimes, would-be bloggers think they don’t have as much to contribute as, say, the members of the SANS community. And even if they do, worry that the competition will steal their hard-won intellectual property.

Blogging, however, has been shown to drive new sales. It can help build brand awareness for new companies, and give both customers and prospects an inside look at the thought leadership that drives the company’s product development or services. Depending on whether the support team jumps in, it can even be used to help resolve customer service issues, potentially driving down costs.

The in-site blog

The most common form of company blog. You’re reading one; the blog isn’t the site’s front page, but it is linked from the main menu, and the rest of the site is navigable from there. Good example: BlackBag’s new blog, which just began on January 1. (Interestingly, BlackBag has opened its blog up to anyone within the company — marketers, customer support, engineers — a move many companies hesitate to make for fear of losing control of their message.)

The iFrame

At first blush, iFrames are a professional-looking way to pull in blog content from off site (say, WordPress.com) and make it appear as if it is in-site. However, it doesn’t embed the content, and as a result, search engines won’t index an iFramed “Blog” page. If part of the reason you’re using your blog is to attract website visitors via search, iFrames won’t help.

The microsite

Blogs-as-microsites are fairly common in the business-to-consumer space, often among businesses that want to generate community and conversation on some topic related to business. I blogged briefly for Family.com, a Disney microsite, and RaisingMaine, a site owned by MaineToday Media Inc.

Until AccessData debuted eDiscovery Insight, I hadn’t seen this in the digital forensics space. The blog is new. Technically it isn’t a microsite, because instead of drawing on a collective community, it relies on in-house subject matter experts (SMEs), including CEO Tim Leehealey. However, because it’s not a part of AccessData.com, it does maintain something of a microsite feel.

Following last year’s merger with CT Summation, AD’s microsite is a good way to keep customers’ focus solidly on e-discovery issues. In the coming months it will be interesting to see whether they blend it with more of their own branding, or reach out more to the e-discovery community at large. Depending on their goals, either one would work.

The individual representative

The sole proprietor or small-business engineer who wants to differentiate their own thoughts from their brand may choose to keep a personal-professional blog on a site like WordPress.com or Blogger. This may be similar to the many professional blogs, such as Harlan Carvey’s WindowsIR or Eric Huber’s A Fistful of Dongles; but it can help market a company as well.

Good example: Think Different, the blog of Commander Kristen Ziman of the Aurora (Ill.) Police Department. Hosted by Google’s Blogger, the blog isn’t APD’s official positioning — but it doesn’t disassociate Cmdr. Ziman from her department or her role in it. Instead, allowing her to be up front about who she is, what she does, and what she thinks about it helps bolster APD’s position as a professional law enforcement agency.

Both microsite and individual representative blogs can be good ways to “test” a blog before it goes official; even iFrames have a transitional place. If you see an uptick in page views after installing an iFrame, that’s a good time to consider bringing the separate blog under your company’s own identity.

In general, company blogs should:

• Include links to other content within the site, whether downloadable information or products. This helps with search engine ranking.
• Be written by in-house representatives, rather than outsourced. (I do help clients write blogs, but it’s a back and forth editorial process to allow for as much of their thinking as possible.)
• Never be ghostwritten. It is dishonest for a company leader to allow a professional blogger or PR person to misrepresent themselves.
• Have a comment policy. Don’t stifle criticism, but do block abusive or troll-ish comments. Be prepared to respond immediately if need be.
• Have a schedule. Sporadic and unpredictable posts happen, but they don’t look all that great. Commit to blogging as you would to an in-person event at which you’re speaking on similar topics. (Yes, I’m still working on this one.)

Do you have a company blog? What does it look like?

Image: Oriol M.J. via Flickr

I really like it when vendors engage the audience instead of just tweeting their own marketing news briefs or re-tweeting other people’s content. Engaging in actual conversations with actual people somehow breaches the corporate veil and makes large companies more … human. There are a few companies that have done this well, such as @TripwireInc with their #PCIHugItOut series….

Dahn goes on to describe these chats in a fair amount of detail, providing a new dimension to the possibilities for vendor engagement. I have blogged about the general need in the past. But Dahn gets specific.

So specific, in fact, that I’m stopping just short of saying that digital forensics and e-discovery “tweeps” should hold similar chats. In fact, the conversations I have seen among them (as well as the infosec community) are lively and organic, springing up amid the workaday grind and hardly in need of a hashtag or a set time.

Only occasionally do vendors join in, though. And so, while the natural conversations may last for 30 or 40 minutes without any need of a hashtag… what if vendors are missing an opportunity here?

Dahn continues:

Recently, @McAfeeBusiness reached out to me about organizing another kind of engaging conversation. The idea was to harness those flame-wars and schedule them so people who wanted to participate could. Thus was born #SecChat….

The chat itself was interesting, but the behind the scenes was even more interesting. Katherine Nellums (@knellums) and Haley Hebert (@haleyhebert), two of the active voices behind @McAfeeBusiness, reached out to me to discuss who would be good people to offline-invite to participate.

Dahn’s account reflects something I have been reading about in mainstream content marketing and PR blogs for months. McAfee’s actions indicate careful planning, using a Twitter chat as one tactic in their overall communication strategy. To channel all that online energy into something that was useful not just for the community at large, but also (ultimately) for McAfee’s own business. Ideally, shaping a useful conversation will help McAfee generate leads for its products and services, along with existing customers’ loyalty.

I’d love to see large digital forensics and e-discovery vendors take the same opportunity to help drive conversations away from “Oh, there they go marketing again” to “Hey, they really understand our needs.” What might these conversations look like?

photo credit: Matt From London

Although Mitch Joel at 6 Pixels of Separation agrees that being a “Twitter snob”  can be good — keeps your stream uncluttered, reinforces your credibility — Christopher Penn takes a step back from the either/or argument:

Here’s a different way to look at the question: what are your goals? Broadly, there are two different goals you could be pursuing with your social networking strategy, segmentation and serendipity.

If you have a goal of creating a tight, highly valuable network where the only interactions you have are with people you know and trust, you’re effectively pursuing a segmentation strategy. You’re looking to get maximum value out of the content that comes from the network….

If you have a goal of creating a broad, diverse network where you’re interacting with many people across many different industries and backgrounds, you’re pursuing a serendipity strategy. You’re looking to get maximum value out of the network itself….

Neither strategy is correct, writes Penn. Although arguable that this is a function of personality rather than business goals (I am deeply introverted, and prefer quality over quantity in my networks), when I take a look at the accounts I manage, I can see each strategy in play regardless of the fact that I specialize in the forensics niche.

Most of my clients specialize in different areas, and I follow accordingly. There is, of course, some overlap, as with e-discovery and forensics examiners. But it’s not all the same. One client has more interest in homeland security, especially border operations, than others do. Reading their blogs, in part to learn what their specific needs are and in part to learn which of their content is relevant to the brand, means the focus is on content.

Another’s audience includes information security professionals as well as forensics and e-discovery. This is also the fastest growing account, and although I try to retweet as much as I can from the network in the name of validating and strengthening the community, it’s the network itself that is the focus.

In the digital forensics space, most business and personal accounts will focus on quality and content rather than on quantity and networking. That said, some will want to focus more on the latter — those forensic firms serving not just other businesses, but individuals as well. (Think private investigators and data recovery firms.)

Speaking of individuals, you see these same strategies in play in other social networks. Some LinkedIn contacts, for instance, have 500+ connections — and ask more to connect with them. Likewise on Facebook, where hundreds of security and intelligence people friended Robin Sage without thinking about it. But that’s another post for another time.

How do you decide to connect with people on Twitter (and other social networks)? Where do you place value — on content, or networks?

photo credit: Marc_Smith

What can you accomplish as part of your community?

Eric Huber’s post about Guidance vs. AccessData touched a nerve (as you’ll see from the comments I left there). Over the last 18 months of business-building, I’ve read many a blog from marketing/public relations/social media people who all say the same basic things:

• If you want loyal customers who consistently buy your products and services, build relationships with them.
• Connect those customers to one another via your products and services.
• Your relationships with them, and theirs with each other, constitute a community.
• Be part of that community, not outside it or over it.

These are the values that create loyalty over the long term. They are part of an organization’s culture. And I worry that too many digital forensic solutions providers, at least the “big guns,” are not part of the community they serve. They’re too focused on competing with one another.

Community vs. competition

It’s not just what I’ve heard and read that leads me to say this. It’s the almost complete lack of presence on social networking sites. There are exceptions — the SANS Institute and AccessData, both of which  put out valuable information as well as engage customers — but most everyone else? Might have a presence via blog or Twitter or LinkedIn, but only rarely update.

Which is a shame, because they’re missing out on a phenomenal little community. A community of developers and examiners, investigators and problem-solvers, many of whom blog or podcast their thoughts and expertise. What if forensic brands regularly joined these daily conversations?

I suspect one or more of several reasons why they don’t:

• They’re afraid of getting too cozy, of the chance that an off-the-cuff comment might betray an important secret.
• Their PR staff running the social networking show aren’t privy to enough of what’s going on in the company.
• Their PR staff know plenty about what’s going on in the company, but not enough of what’s going on in the industry to be able to talk about it.
• They’re afraid the competition will go after customers with whom they actively engage online.

There are probably at least a few more reasons. But the upshot is, even if they are monitoring the blogs and podcasts, they are still too busy looking sideways to focus on things the community wants and asks for beyond product-specific features. Of such needs and desires is innovation born, and companies too focused on remaining the leader of the pack can never rock their customers’ world by breaking free and doing something truly special.

Sure, they might offer intriguing and even ground-breaking information in conference labs or lectures… but those only reach the people who are there. And you can’t earn loyalty by taking business cards and putting the email addresses you find there on an email list that spits out the same content. Loyalty comes after customers recognize that you’re trying to make their lives better: easier, faster, more efficient.

Community-building as business strategy

So whether it’s great content that teaches, great products that help them do their jobs, great customer service that solves their problems, or (best of all) some combination of the three, good value-adding, community-building strategy has got to be part of more forensic vendors’ offerings. You’re not helping digital investigations by keeping your cards close to your chest, and you may even be making them harder.

All the while, you’re leaving a gaping wide opening for community members who do understand each other’s needs to come along and take what you’ve been taking for granted all along: customer loyalty.

Because at that point it won’t be about the products anymore. It will be about all the intangibles that go with them: the things you can never compete with because your C-suite isn’t willing to share enough of its passion, values, personality, the things that drove the company into the digital investigations industry to begin with.

What can you do today to become more fully a part of the investigative community?

Image: diamondmountain via Flickr

He wanted to continue building his brand as an expert in his field, which he had started while still in law enforcement. Trouble was, the company he now worked for didn’t want him to do that—despite his considerable reputation. What if he left? they thought. He’d take it all with him.

Well guess what? The company’s lack of foresight pushed him further and further out the door as it focused on sales rather than trust. When a competitor who believes in harnessing that reputation scoops him up, that company will come out ahead.

An asset, not a threat

Organizations often view individuals’ “brands,” or the qualities that make them personally and professionally outstanding, as a threat. This is understandable in industries like digital forensics, where software code and other proprietary information is closely guarded. A nondisclosure clause in a contract can only be enforced after the damage is done.

But many organizations view professional brands as a threat to the organizational structure itself. For instance, a law enforcement agency, as a paramilitary organization, traditionally requires its officers to put aside their own identities for the sake of becoming part of a unified whole. Hence the uniform, the emphasis on standards and protocols, the information stream that comes from just one source. The officer who does his or her own thing detracts from the agency’s unified image and mission.

Connecting all individuals

This is true of all employers, to some extent. And some individuals are fine with being absorbed into a larger whole. Others, however, aren’t. Truly successful organizations recognize that there’s a place for both kinds of employees, and create an environment where they can both thrive.

Allowing those with their own ambitions and visions to have a chance to pursue them is all the more important as social media grows in popularity, not just among people who want to stay in touch with far-flung family and friends, but also among professionals who want to network with one another.

That’s because jobs nowadays are all about information rather than assembly-line process; they’re increasingly complex, especially in fields like digital forensics. The more information professionals can share with each other, the better for the industry as a whole.

What about those information leaks?

Actually, it’s already happening. Competitors in the digital forensics space are always acquiring, then reverse engineering, each other’s software. And it’s not always because of employees jumping ship. Sometimes it’s friends of friends who share the software.

And when the wrong kind of information is posted to social networking sites, it’s not always a failure of employees. Sure, there’s the code of conduct. But many people don’t understand social media’s ripple effect, the fact that what they say is viewable by a much wider audience than ever before. That’s a failure of the organization to help them understand—to provide adequate training on goal-setting and use for the various sites.

Team-building via individual-building

So rather than tamp down on employees and their intellectual assets, organizations may want to follow Arik Hanson’s advice: “But, talent’s going to come and go anyway. Why not take the best advantage of that talent while it’s in-house by encouraging and rewarding personal branding activities?”

Not only does a personal blog draw on the blogger’s own network rather than the organization’s, Hanson continues, but it also allows for connections to be made on a much more personal level. This is the difference between an official interview between detective and witness, and the story of trauma told over coffee to a caring acquaintance.

Furthermore, writes Jason Lauritsen, social media renders organizations no longer fully in control of their own brands: “Employer brand management has become a dynamic, full-contact sport that has broad implications for organizations. Embracing that the brand belongs to the people raises some sticky questions for human resources teams.”

Ultimately, the company or agency that trusts its employees to be responsible is the one that will experience less trouble from data breaches or code of conduct violations. It certainly has the right and the responsibility to set goals and expectations for employees, but even this is easier—and cheaper—than dealing with employee attrition and hiring, rules violations, and so forth.

It also strengthens the organization as a whole. Think about professional sports. Teams know they would be nothing without their individual players—the superstars as well as the less talented but still necessary positions. And when you’re a fan, it’s easier to get behind a team when you feel you know (and can respect) the players.

If you’re an employee, how can you convince your employer to take advantage of your professional brand?

If you’re an employer, what can you do to promote employees as individual parts of your team?

Image: Photomish Dan via Flickr