As with much of the rest of our world, the Internet is having a profound effect on the securities markets. Many institutional investors are now using corporate Web sites as a primary source for information about companies. Retail investors, empowered by on-line brokerage services, are becoming a more significant stockholder base. In response to these trends, companies are increasingly using the Internet to communicate with investors.

At the same time, institutional investors have joined retail investors, short sellers and others in the "wild west" of on-line investing, -- Internet message boards and chat rooms. The growth of these forums raises a number of questions for companies:

• Should we respond to false rumors posted on Internet message boards?
• Should we monitor chat rooms to see what is being posted about our company?
• Can we prohibit employees from posting messages on the Internet?
• Is it possible to identify people who anonymously post false or confidential information about our company?

What are Message Boards and Chat Rooms?
Broadly defined, "message boards" (also known as "bulletin boards"), are information centers accessible via the Internet. Users of the boards can post messages, which can then be read by anyone who accesses the board. There are a number of specialized message boards that focus on investment-related topics, including Silicon Investor, The Motley Fool, and Yahoo! Finance. Some of these boards are open to the general public, while others are only available to subscribers. These message boards are typically organized by company so that users can easily access all the messages posted about any company in which they have an interest.

"Chat rooms" are real-time versions of message boards. In chat rooms, participants can communicate with others who are logged onto the service.
Participants in message boards and chat rooms frequently conceal their identities, making it impossible for readers to assess the biases and motives underlying their messages. This apparent anonymity also tends to encourage the posting of messages that are derogatory in content and tone.

What Issues are Raised by Message Boards and Chat Rooms?
From a securities law perspective, these forums raise several concerns:

Inaccurate or Misleading Disclosures
Anything said in these forums by someone identified as being from the company could be viewed as a disclosure of information by the company. Therefore, any inaccurate or misleading statements (whether authorized or unauthorized) could form a basis for liability for the company under the general anti-fraud provisions of the federal securities laws.

Selective Disclosure
Since not every investor has access to these forums, a disclosure made exclusively in one of these forums could constitute "selective disclosure," which has implications for insider trading/tipper liability. For this reason, among others, it is generally not advisable for companies to participate in these forums.

Security
Anyone sending a message from a company's e-mail address could appear to be speaking for the company, regardless of whether they are in fact authorized to do so. Therefore, access to these forums from within the company should be restricted by company policy. Precautions should also be taken to make sure that outsiders cannot improperly access the company's computers and send unauthorized messages.

Rumors and Market Manipulation
Another common issue arises when someone, from either inside or outside the company, posts inaccurate messages in an attempt to manipulate the stock price (either up or, in the case of short sellers, down). John Reed Stark, head of the SEC's Internet Enforcement Office, calls the act of posting false Internet rumors a "corporate cybersmear." In recent years, there have been a number of prominent examples of this phenomena.

PairGain . Recently, PairGain, Inc., a California company, was the target of an Internet hoax. On April 7, 1999, someone posted a forged Web site that looked like part of the Bloomberg News site. The forged site purported to announce that PairGain would be acquired by ECI Telecom Ltd., a competitor. Within minutes, PairGain's Yahoo message board referred to the bogus announcement and provided a link to the forged Web site.

This triggered a flurry of trading activity, causing PairGain's stock to rise 30 percent in the first few hours of trading. By the time the announcement was debunked several hours later, trading moderated, but the stock still closed up 10 per cent for the day. ¹

Nine days later, the FBI arrested and charged a 25-year-old computer engineer employed by PairGain with securities fraud for creating the forged Bloomberg News Web site. His motive was unclear, however, as the charges did not allege that he engaged in any profit-taking on the false information.

Comparator Systems . Another notable instance of Internet hype occurred in May 1996, when the stock price of Comparator Systems Corporation went from 6 cents a share to $1.88 a share in three days. During that time, more than 449 million shares of this tiny company changed hands before trading was halted. In the days proceeding this flurry of trading activity, Internet chat rooms and user forums were filled with rumors about the stock. One report from the NASD stated that brokers and corporate insiders may have been the source of some of these rumors, presumably in an attempt to drive up the share price while the insiders sold their stock.

Should We Respond to False Rumors?
Generally, it is not advisable to respond to rumors about the company, whether these rumors appear on television, in the newspapers or on the Internet. While a company's instinct may be to respond, especially when the rumor is derogatory in nature (as many message board posts are), turning the other cheek is usually the best course of action.

There Is No General Duty to Respond to Rumors
There is no general legal duty to respond to rumors in the marketplace unless those rumors can be attributed to the company. Similarly, a company is not required to police statements by third parties for accuracy. However, if a company chooses to respond (for public relations or other reasons), whatever it says will constitute a disclosure by the company for which it may be held liable if the response is inaccurate or incomplete.

As a practical matter, the obligation to speak accurately and completely may make it very difficult for a company to frame a response even if it wishes to do so because many false rumors contain at least a sliver of truth.

Moreover, the company's response might be dissected and distorted -- resulting in an escalation of attacks on the company.

You May Create a Duty to Update or Correct
By responding to a rumor, a company might create for itself a "duty to update" or a "duty to correct" the information contained in its response. These duties, which would not exist but for the fact that the company issued a response, flow from statements that are "alive" (that is, still capable of influencing the investing public) and on which a reasonable investor might rely. A "duty to update" may exist when a statement that was true when made is later overtaken by events and is no longer true. A "duty to correct" may exist when a statement believed to be true when made is later discovered to have been untrue when made.

Use Your "No Comment" Policy
Most public companies have a "no comment" policy that prohibits the company from responding to inquiries or commenting upon rumors concerning prospective developments or transactions involving the company (such as rumors relating to an acquisition of or by the company). ² A "no comment" policy enables the company to "respond" to rumors in a manner that minimizes the awkwardness of a refusal to respond, and avoids premature disclosure of a potential development or transaction. Without such a policy, the company spokesperson would not be able to respond truthfully if a potential development or transaction that was not yet ripe for public disclosure was pending. Such a policy also helps the company avoid an obligation to update prior public statements (such as a statement refuting a rumor that the company is for sale) when, as a result of intervening events, the prior response is no longer accurate.

Unfortunately, many companies overlook the obvious - "no comment" policies apply to all inquiries and rumors, including those occurring over the Internet.

SRO Rules May Require You to Speak
Despite the dangers of commenting on rumors, in certain circumstances the company may be required to address rumors publicly if the rumors result in heavy market activity. The New York Stock Exchange, the Nasdaq Stock Market and other self regulatory organizations (SROs), impose an independent duty on listed companies to respond to rumors in certain circumstances. The New York Stock Exchange Company Manual, for example, requires that a company should be prepared to make an announcement of important corporate activity if unusual market activity occurs prior to its announcement. If the rumors are correct, the company may be required to make "an immediate, candid statement to the public as to the state of negotiations or the state of development of corporate plans." If the rumors are false, "they should be promptly denied or clarified."

In practice, the operation of the self regulatory organization rules is less than certain. In many cases, no disclosure will be required if the company has a valid business reason for not making the disclosure. A company should, therefore, seek the assistance of counsel before acceding to a request to comment on rumors in the marketplace.

How Do You Stop Responding?
One risk of voluntarily responding to Internet rumors results from the volume of messages (and therefore potential false rumors) that exist. Very few companies have the resources to review and respond to all posted messages. But once a company starts responding to rumors, how does it select which ones are worthy of response and which ones are not? In addition, the failure to respond to a message (whether it is favorable or unfavorable) may be an implied affirmation that the message is accurate.

Should We Monitor What Is Posted About Us?
Assuming a company plans to adhere to its "no comment" policy and, therefore, not to respond to Internet rumors, should the company nevertheless monitor the message boards and chat rooms?

Benefits of Monitoring
There may be good business reasons to monitor popular sites that discuss the company. By monitoring such sites, the company may become aware of general issues that are important to investors or areas where the company has failed to tell its story adequately. With this knowledge, the company can prospectively adjust its investor relations program. For example, if investors are erroneously questioning the company's procedures for recognizing revenues, additional information about the company's policy could be added to future SEC filings. This kind of indirect response can be helpful in reducing future rumors and result in improved investor relations.

If a company chooses to monitor, the extent of any monitoring will be largely a function of the company's resources. Internal personnel may be assigned to perform the monitoring or public relations firms or other outside businesses can be retained.

Pitfalls of Monitoring
There are, however, factors that argue against monitoring. Perhaps chief among them is cost. It may be simply too burdensome to monitor the boards and chat rooms, and the amount of useful information generated by such monitoring may not justify the cost of gathering it.

Also, monitoring the boards will undoubtedly uncover comments by irate and misinformed investors. Such persons have been known to severely criticize, or "flame," executives and officers of companies with heated, yet unjustified, attacks. It may be simply too hard for persons within the company to resist the temptation to respond to these unwarranted attacks. ³ In addition, companies that spend too much time focused on the message boards may begin to suffer from a distorted view of the significance (or, more often, insignificance) of particular messages.

Finally, if a company is monitoring, it may need to acknowledge that fact if asked, for example, by the SEC. This could lead to requests for information about what rumors the company is aware of and questions about whether additional disclosure is required in response to such rumors.

The decision of whether or not to monitor should be made as part of the company's overall assessment of how it wishes to conduct and fund its investor relations program. However, if any monitoring is to be done, the company should first adopt a clear policy regarding the applicability of its no-comment policy to any false rumors the company may encounter.

Can We Prohibit Employees from Posting to Message Boards?
As a matter of policy, a company can probably prohibit its employees from posting any information to a message board or chat room dedicated to discussing the company. ⁴ Consistent enforcement of such a prohibition, however, may be impossible. Such a ban might also be inconsistent with the company's corporate culture.

Every company should, regardless of its stand on prohibiting posting, provide employees with clear guidelines that proscribe discussions of internal corporate matters and other confidential business information on the Internet. Additionally, the company should train its employees about the importance of following those guidelines and the damage that can result to themselves and the company from their failure to abide by those policies. For example, employees should be taught that they may have personal liability if they discuss rumors or other corporate matters on the Internet -- even if their intent is to defend the company . To the extent that such postings hype the company's stock, contain material misrepresentations, or omit material information, the posting employee may be violating the antifraud provisions of the federal securities laws -- exposing the employee and the company to civil or criminal liability. Employees should also be periodically reminded that misuse of confidential company information can result in termination of employment.

Given the risk that any messages sent from a company computer may be attributed to the company, employees should also be reminded about the company's general policies regarding the personal use of company equipment and that such policies apply to Internet postings.

Can We Uncover Who Is Posting False or Confidential Information?

Although the Internet appears to be an anonymous medium, in reality, every Internet user leaves behind a trail of identifying information. By using this information, the identity of an individual who is improperly posting information frequently can be uncovered.

Generally, formal legal proceedings should be a last resort. Lawsuits are very public matters and, lately, the news media has taken special interest in Internet-related litigation. Fortunately, there are several effective private means by which a company can discover the identity of an offending poster. For example, if the posting is being done through the company's computer network, the company's IT department may be able to review its logs and piece together enough information to identify the poster.

Private Investigators
Alternatively, several private investigation firms specialize in discovering the identities of people who post information on the Internet. These private investigators use procedures such as "data mining" to survey the Internet for older postings on other sites by the individual in question. Remember - no one starts on the Internet as an expert. At one time, even the most sophisticated poster was a novice who left all sorts of identifying information about himself on web sites or USENET newsgroups.

In other situations, private investigators can use "Web stings" and "E-mail stings" to lure the offending poster to a site that is maintained by the private investigators. Once the poster arrives at the private investigator's site, the site records a variety of identifying information, such as the poster's IP Address, Internet gateway, and date and time of the visit. ⁵

"John Doe" Litigation
If attempts at private discovery fail, a company will probably have to obtain formal discovery through the judicial process. Typically, this is accomplished by filing a "John Doe" action against the offending poster. Such lawsuits are being brought with increasing frequency. Hale and Dorr LLP recently represented several publicly held companies in such suits.

The procedure for obtaining formal discovery in a "John Doe" action is easy to understand but sometimes difficult to accomplish. Usually, a lawsuit is brought against the individual poster stating the harm caused by the poster (typically, breach of contract, misappropriation of trade secrets, or defamation). Because the company does not know the identity of the poster, it will have to subpoena the poster's internet service provider (ISP) or the Web site through which the user posted the offending material (such as Yahoo!) for identifying information. Depending on the court, such a subpoena might only issue subject to a court order. Courts typically grant such discovery requests, however, because, without it, the suit cannot go forward (e.g., the lawsuit cannot be served on the defendant because the company is unaware of the defendant's identity).

ISPs and Web sites typically comply with subpoenas for discovery in a timely manner. ⁶ Upon learning the identity of the offending poster, the company may either amend its complaint and serve the party, or, if the poster is a current employee, may use the information to enforce its company policies.

Conclusion
Chat rooms and message boards present a number of challenges and opportunities for companies. Companies which invest the time to understand and consider the various issues raised by these forums stand the best chance not only of successfully co-existing with these forums, but of proactively addressing how these forums fit into the company's overall investor relations program.

Jeffrey C. Morgan

Jonathan Wolfman
[email protected]

¹ The day of the bogus announcement, both PairGain and ECI Telecom issued statements denying any such deal. Bloomberg News also put out a news story late the same morning saying that it had run no such article on its newswire.

² Adherence to this policy requires that the company respond to such inquiries or rumors with a statement to the effect that it is the company’s policy not to comment upon or respond to such inquiry or rumor. A statement that the company does not know of any basis for such a rumor, or is not aware of any pending transaction, is not consistent with this policy and, if inaccurate, such a false statement could subject the company to liability.

³ For example, posters to the Franklin Resources mutual-fund Yahoo! message board were recently surprised to learn that a frequent poster (and ardent defender of the fund) actually turned out to be the son of the fund’s CEO. It appears that the son, who posted messages like: “[a]ttacking men like Charlie Johnson [the fund’s CEO] just makes you look stupid and uneducated,” was motivated by family loyalty and posted in response to recent “flames” against his father.

⁴ Whether this policy could be enforced in all circumstances is another matter. Although a company could enforce a prohibition on posting with respect to confidential business or proprietary information, a company could not, for example, enforce it against employees who use the board as a means for organizing a labor union.

⁵ The investigator may also use “tracing” software that will display the electronic path used to access the site. This can usually identify the city in which the poster resides, and perhaps, even the company from which he/she is posting.

⁶ America Online, as a matter of policy, notifies its users upon receiving a subpoena for identifying information, and will not act on the subpoena for 14 days. During that time, the user may attempt to quash the subpoena.