Our own message house, read aloud

What happened

In November we were asked to help a client prepare for the disclosure of a data breach. Among the documents we wrote was a message house: a single page setting out what the client could truthfully say, in what order, and what it would point to as evidence. It went through four drafts. The third was shared with the client’s team through a link to a folder that did not require a passphrase. At some point after that the link was forwarded, and on 10 February the third draft was published, with the client’s name, by a newsletter read by people in our trade and by a good many journalists.

We told the client within the hour, before we told anyone else, and that afternoon we wrote to every client for whom we held documents in the same system. We have not named the client here and will not. The newsletter did, and its readers will draw their own conclusions about why we have not.

The sentence people quoted

Most of the comment concerned one line in the roof of the house: “Your data is as safe with us today as it has ever been.” It was a draft. It was not used. It was also true, which is a different thing from being right, and the fourth draft replaced it with a sentence about what had been taken and what the client was doing about it.

We draft badly before we draft well; so does everyone. The question a message house answers is not “what is the best sentence?” but “what is true, what matters most and what can we prove?”, and the early drafts are where those questions are argued out. A draft that has been argued over looks worse than a finished document, and should.

What a message house is

Because a number of the pieces written about the leak described the document as a script, it is worth saying what it is. A message house has a roof, which is the one thing the organisation most needs people to understand; three or four pillars, which are the things that support it; and a footing of facts, figures and actions that anyone can check. It is a plan of an argument. It does not tell anyone what to say word for word, and a spokesperson who recites one sounds exactly as you would expect.

We have written message houses for twenty-two years and will go on writing them. We think that every organisation preparing for a difficult announcement should have one, and should assume, as we now do, that it may one day be read by people it was not written for. A message house that would embarrass its author if published is usually a sign that the argument in it is weak, not that the document should have been better hidden.

What we have changed

From April, every document we prepare for a client will be held in a client extranet rather than in shared folders, with a named account for each person who needs access and nothing shared by link. Every document will carry its matter’s codename rather than the client’s name, as our internal documents have since 2004. Helen Barraclough, our chief operating officer, is leading a review of how we hold and share client material, and we will say what it finds.

None of this would have prevented someone determined from forwarding a document they had been sent. It will make it harder to do by accident, and easier to know who did it on purpose.

We are grateful to the clients who wrote to us that week. Several of them pointed out, with some pleasure, that we had been given the opportunity to take our own advice.