Admiral Group is a FTSE 100 listed financial services company, with offices and operations in the UK, Italy, France and Spain. So, it came as something of a shock when a news article popped up, claiming Admiral had been sanctioned for its operations in Iran.

As Addy Frederick, group head of corporate affairs at Admiral, told delegates at the Corporate Affairs Summit in London, her first thought was that it was a hallucination. But she also needed to understand where it had come from.

She explained: ‘We’re a listed business, so we know that our investors and analysts are tracking everything about us. We couldn’t dismiss it out of hand, which I think historically we would have done because it wasn’t in a tier one publication.’

In fact, it was a case of mistaken identity: the Foreign Office had got the wrong Admiral. Admiral Group was named on the sanctions list, rather than Admiral Group Shipping, which operates in the Middle East, including Iran.

It took a frantic call to the Foreign Office, impressing on them the urgent need to fix the error, to secure a swift correction. But the LLMs took rather longer to catch up, repeating the error for a further two weeks.

In all, it took ‘a month to be resolved, part of that was waiting for the authoritative source to no longer be treated as an authoritative source’, explained Frederick.

In the meantime, the error was having real-world consequences. Suppliers that used AI for due diligence were telling Admiral that they could no longer work with the business because their systems said it was sanctioned.

‘The only reason we didn’t come to a halt was because we had relationships with people,’ she explained. ‘Account managers could say: ‘You know us. You know we don’t have any operations in Iran. You can circumvent the AI.’’

For Frederick, the error was something of a mixed blessing. It enabled the corporate affairs team to demonstrate its value by demonstrating how it acted to protect Admiral Group’s licence to operate, but it also emphasised how much wider the response needed to be.

‘We prioritised risk, just in case the regulator came; legal, because it’s good practice; and investor relations, because the market community is tracking whatever is said about us, so we wanted to make sure that if we did receive anything inbound from those stakeholders, we could provide a reassuring message,’ she explained.

‘In future, we’d look at a wider employee base.’

She admitted she hadn’t realised that suppliers were using AI for due diligence, calling it ‘a learning for me and our team’. Next time, supplier-facing colleagues will be in the loop from the start.

Because, as she pointed out, Admiral’s operations in the UK, Italy, France and Spain made it ‘provable to a human’ that it wasn’t operating in Iran. ‘But to AI, they just took it as read.’

The rise of pink slime

While Admiral Group’s sanctions scare was a genuine mistake, Charlie Bain, managing partner at Digitalis, warned of something altogether more sinister: the so-called ‘pink slime’ attacks.

Speaking on the same panel, which was hosted by Alex Northcott, CEO of the summit’s ‘in association with’ sponsor Roxhill Media, Bain described these attacks as ‘sophisticated for-profit disinformation networks’, comprising ‘cheap websites made by AI’ and designed to look like credible news sites, albeit filled with AI slop.

‘In amongst that, they will run a hit piece, a disinformation, defamatory piece.’

These sites are often based in places such as India and Pakistan, beyond the easy reach of lawyers. Getting them to take content down is extremely hard, and they simply ignore calls and emails from frantic comms professionals.

Bain explained that once these stories are published, an army of X accounts starts to amplify them ‘in a very inauthentic way’. Digitalis has built technology that allows it to quickly identify disinformation campaigns, spotting coordinated, inauthentic behaviour such as batch creation, age clustering or sudden spikes in posting rhythms.

But pink slime attacks are not the only disinformation campaigns that comms professionals need to worry about. Bain has seen black PR operations involving petitions. ‘We had a client with a petition against it, which was signed by a few hundred people, and then one day it suddenly spiked to 3,000 signatures,’ he recalled. The culprit was an ‘army of bots’.

Slacktivism is also on the rise. This can involve barrages of AI-generated emails targeting comms and public affairs functions to pressurise organisations into changing course. It is ‘essentially an agenda, and it’s overwhelming,’ he said.

For example, a recent slacktivism campaign against the new Sacha Baron Cohen mockumentary, Ali G: Who Iz I?, prompted more than 50,000 messages to cinemas, demanding its cancellation.

A new trend emerging, which Bain admitted he has yet to see, is LLM poisoning where bad actors try to influence large language models. He cited a recent study by the Alan Turing Institute which worked out that it took around 250 malicious documents to influence an LLM. ‘It’s something which is on our radar for the future,’ he admitted.

All of which is enough for most comms professionals to yearn for those pre-internet days of pagers and fax machines. Alas, there are no easy fixes to these issues. But the panel did offer some practical steps.

• Learn to identify a campaign rather than a few negative posts. Bain’s red flags were batch-created accounts, dormant accounts suddenly active, AI or stock photos, usernames full of numbers, and accounts all posting at once. Train your team to recognise these.

• Report to the platforms with evidence. Build a case that the accounts break the platform’s terms of service. But Bain also pointed out that they can be slow to respond, if at all.

• Go after the source. If false information is being repeated by LLMs, identify where it originated and correct it there. As the Admiral case demonstrated, an authoritative but incorrect source can continue feeding incorrect information into AI systems. Bain advised targeting the source where possible, rather than the LLM itself: legal action against the models is slow and uncertain.

• Monitor constantly. Check your tools catch things. Admiral’s free Google Alert beat its paid monitoring.

• War-game a disinformation campaign. Addy Frederick is running scenario planning with the wider workforce, not just comms, because as she pointed out, this is not just a comms issue. Keep media lawyers on standby.

• Audit your digital footprint. If someone wants to attack your company or its executives, Bain warned that their digital footprint is one of the first places they will look for vulnerabilities. Images, video and voice recordings can also provide the raw material for deepfakes.

• Make the investment case internally. If your organisation hasn't yet experienced a disinformation attack, the risk can feel remote. Map out what an attack could look like and the operational damage it could cause.

• Don't underestimate human relationships. Admiral was able to reassure suppliers because account managers could explain what had happened and override the technology with something distinctly old-fashioned: knowledge, judgement and trust.

Ultimately, the solution isn't eliminating disinformation. That would be impossible. It's about building organisational resilience to it: spotting it early, understanding what is happening and being ready to respond.

NB Before anybody @s me, I haven’t forgotten Adrian Cox, managing director and thematic strategist at Deutsche Bank, who was also on this panel. He had plenty of interesting things to say, and I will be returning to them at a later date. There are only so many newsletters one woman can write.

Disinformation with unintended consequences

In October 2024, thousands of people descended on O’Connell Street, one of Dublin’s most famous thoroughfares, to watch a Halloween parade that, unbeknownst to them, did not exist.

Yet as they waited, people noticed some oddities. There were no barriers. No stewards. And traffic was still moving along the street. It did not take long before the Gardaí arrived and told the disappointed crowds to go home. There was nothing to see.

But this year there was. For the second year running, Dublin hosted a Halloween parade featuring Macnas, the Galway-based theatre company famous for its spectacular street performances, after the local council realised just how much appetite there was for one.

The 2024 parade, however, wasn’t an innocent mistake. It was a hoax, created by a man in Pakistan who runs websites promoting fake events.

As Dr Eileen Culloty, associate professor at Dublin City University and an expert on disinformation and media literacy, told delegates at the Corporate Affairs Summit in Dublin: ‘He promoted the idea that there was going to be a Macnas parade for Halloween, and that the footballer Ronaldo was going to turn up, which should have been the biggest red flag.’

The disinformation campaign was driven by money. All the Pakistan-based operator wanted was clicks. ‘He'll promote [the parade] across social media into Facebook groups, and if people are clicking on it, there's traffic going to his website. He can then sell advertising on that website and make money. This happens all the time. It's a major strategy,’ explained Culloty.

But what was striking was that people did not visit an official source, such as Dublin City Council’s website, to check whether a parade was taking place. They relied on word of mouth because it wasn’t an outlandish idea. Macnas had previously staged Halloween parades in Dublin. ‘It's like people have lost the ability to check: where should I go to find that out?’ she added.

It is also a neat illustration of the difference between disinformation and misinformation. The parade gained traction because people shared its details with friends and family.

‘Nobody was intending to fool anybody when they were passing that on, so we call it misinformation. It's false, but there's no bad intentions behind it,’ explained Culloty. ‘But the person who created the fake story, that's disinformation. He is setting out to deceive people for his own ends. He just wanted to make some money.’

Some light relief

I’ve long wanted to write a column entitled It shouldn’t happen to a PR professional, partly because it would be fun to do so, and partly because you couldn’t make some of these stories up.

For example, several years ago an old buddy of mine arrived at work to find the exec team in a state of panic. Seasoned professional that she was, she immediately swung into crisis mode.

‘Just let me take my coat off and I’ll be right there,’ she said, tossing it onto a seat.

Oddly, this did not have the calming effect she had hoped for.

Instead, she was greeted by looks of horror.

Unbeknown to her, the wraparound dress she was wearing had, er, unwraparounded itself as she took off her coat, leaving her dressed only in sexy underwear and hold-up stockings.

I don’t know what the original crisis was, but I’m willing to bet nobody was thinking about it after that. She certainly wasn’t!

Have you got an It shouldn’t happen to a PR professional moment of your own? Please send it across. I promise names will be changed to protect the mortified.