It's had a few days so far to shake out from the latest infection, and here's my final review:

GOOD: The company responded more promptly than last time. They took the web site down for longer. They're continuing to talk to a security expert and hopefully will have a better security plan going forward.

BAD: It still took far too long. Most folks know that the MINUTE you suspect your computer is infected with a virus, you unplug from the Internet and scan and fix the computer. And yet it still took the better part of two days and some really-over-the-top reader intervention to convince them.

WORSE: Most people don't know about these problems or how they've been handled, because they've once again chosen to provide VERY little additional information, in a hidden post made several days ago and are continuing to post (what few updates they've put up there) in the comments. Translation: hundreds or thousands of their visitors may be infected and have NO idea that they are, nor where they got it from.

EPIC FAIL: They have not responded to their readership in a manner that will ensure minimum damage to their reputation but instead have handled it in a way that trashes their reputation and trustworthiness with readers and that, frankly, I'd expect of a slow moving organization (TTC anyone?) rather than a lean, supposedly "up to the minute and BETTER than traditional media" company.

The way I see it, they'll lose readership. Probably a significant percentage. The only reason they might not lose as much? Because of how few readers might actually stumble upon their hidden and nearly invisble virus posts. Good for them, you might say, protecting their readership, but it's also underhanded and unethical. And that is no way to run a business.

The most ironic part of all of this is that it is their handling of the situation - i.e. their communication with their readers, their lack of professionalism in alerting their readers, advising their readers, and otherwise dealing with the problem from a reputation management standpoint - that has so enraged their readers. With better communication and a more user-friendly handling of the situation, they'd have lost far fewer readers. When you botch up a communications job this badly, you teach your readers that you don't value them.

For myself, I've now removed the site from my feed reader and don't intend to return any time soon. Local news is good and vital and very important, but their site is not the only game in town; perhaps my readership will be more highly valued elsewhere. Trying to help this company try to be the company I need it to be is just too hard; voting with my feet, in the end, is the only power left to me.

(If you're just starting into this conversation and want to follow along at blogTO, please do yourself a favour. For the time being, please disable all JavaScript, Flash, and Java code from executing in your browser BEFORE visiting the web site. If you don't know how to do this, I'd strongly suggest avoiding the web site until it's clear that they have sustainably removed the threat.)

After some back-and-forth on Twitter, and also in my blog post, the owner of blogTO invited me to call him to discuss further. Which I did. We spoke for over a half an hour about the issue and, while I could see that some of these points were hard for him to consider, he was giving them their due.

Getting stuck into plodding, slow-response (I'd almost deem "corporate") thinking needn't be permanent.

The one thing the owner DID do was listen, as hard as it was for him to do. He thanked me for my time and my passion, and posted an update on the web site asking others if they, too, had had a problem.

By this morning there were over twenty responses, many of them echoing what we'd already heard. I followed up with a comment of my own asking what the company intended to do differently this time?

Within an hour, the web site was taken down (finally!) while the company investigated this problem, and remains down as of this writing.

What's important to take away here is that while it took in my opinion FAR more effort on the part of their users to get the company to listen, they did, in fact, listen. They were far more transparent and responsive than they had been up until this point.

And that's a shift in the right direction. Crisis management can be learned.

There are so many things wrong in the last paragraph it makes me want to bang my head against something hard and spiky.

Which is why I tweeted today that they'd finally lost me as a reader for how they've handled this issue. After a bit of back and forth, the site admins tweeted in response: What would you like us to do?

Two words, folks: crisis management.

The reason we still have Tylenol today and not just some fond memories of an old brand of pain reliever is because when the chips hit the fan in 1982, the company responded with good crisis management.

Obviously, a small independently owned media web site trying to run with the big boys isn't going to have Tylenol's team of advisors or PR people. So here's my advice:

1. Don't bury important site news by making it small, grey and in regular-sized text in your sidebar but make it a large and visible notice to readers. (Think about how heavily product recalls are publicized.) This promotes reader confidence in your ability to deal with the problem, and any more than result from it.

2. Provide, right near the top of the notice, clear and unambiguous information on how to detect (am I infected?) and fix the infection (how do I get rid of it?) to your readers. Providing links to software. Advise folks on what NOT to do, etc. Many folks reported that their virus scanners were not able to remove the infection. Yet you suggested no specific software to cleanse the problem. Be the expert on this infection, since you were the one who passed it on to your readers. They look to you for this expertise. If you don't know for sure if what you know is ALL the information, say so: We're not sure. This is what we know. We'll keep you updated as we learn more information.

3. Own it. Don't hide the words "we apologize" at the end of a single sentence. Put it right up top and make it big. We're so sorry. You trusted us and it turns out we may have infected many of you, making you lose time and even money restoring your computers. We're going to do everything we can to win your trust back.

4. Be proactive. If you're receiving additional complaints, take down the site for a half an hour - WITH explanation, not just "technical difficulties be back soon!" - and scan it again. Even if you find nothing. You promised your readers you wouldn't leave the site up to possibly infect them again in the event of a reoccurence. Live that promise. Mention the problems again not just in a comment at that bottom of a post but with a NEW notice on the web site. Sure, say you believe it's a cache related problem if that's your conclusion, but also invite folks to let you know of any other weirdnesses.

5. Stop handling the problems, queries and concerns via email and other private or less public communication. That's not how to promote transparency with your readers. It doesn't do anything but make you look sneaky.

But hey, I'm not an expert on crisis management; I'm just a consumer and uber-fan-level reader of your blog (I've blogged, tweeted, and emailed links to your web site for years) who knows a thing or two about PR and marketing, and how NOT to use up the precious faith your readers place in you with hamhanded management of a crisis.

I'd suggest you try reading these links which have FAR more info on how to deal with a crisis effectively:

Blogging in a crisis (particularly pay attention to the example with the subway)
Crisis Manager newsletter archive
Crisis management articles
Crisis management for small business