Organizations that want to stop unofficial messaging usually start with a rule. The rule usually fails. In most documented cases, staff who write their own version of the organization’s message are filling a gap: nobody gave them an approved answer in time, the official channel went quiet, or the line between a personal account and an employer’s account was never drawn. A smaller set of cases involves real misuse of an official channel. The two call for different responses, and treating them as one problem is the most common mistake.
What counts as unofficial
| Type | Example | What went wrong |
|---|---|---|
| Wrong-account posts | American Red Cross, February 2011 | A multi-account tool and a late-night post from the wrong profile |
| Unauthorised use of an official channel | UK Civil Service account, May 2020; Badlands National Park, January 2017 | Someone posted who should not have, and ownership of access was unclear |
| Parallel accounts that look official | “Alt” National Park Service accounts, 2017 | Staff concluded the official channels had gone silent |
| Personal accounts read as the organization’s | Addressed in Wikimedia and Charity Commission guidance | Employees are visibly tied to an employer |
| Homemade boilerplate, decks and taglines | Rarely reaches the news | Approved material is out of date or slow to obtain |
Why staff do it
The American Red Cross case shows how ordinary the cause can be. On a Tuesday night in February 2011, social media specialist Gloria Huang posted a tweet about Dogfish Head beer to the Red Cross account through HootSuite, a tool that handles several accounts at once. Vice president of public relations Laura Howe later said the employee believed she was tweeting from a personal account. Social media director Wendy Harman was woken by a call from a colleague in Chicago, and the two settled on a joking reply saying the tweet was deleted and the organization was sober. Donations that week were, by Harman’s account, slightly above average.
No policy would have prevented that tweet. Separating personal and organizational accounts in the tooling might have. The response is what limited the damage.
Staff voices also carry weight that official ones do not. Edelman’s 2022 workplace report found that co-workers were trusted to do what is right by 79 percent of employees, and communications from “my employer” were believed by 63 percent, against 36 percent for social media. The same report found that lower and middle-level staff trust co-workers and direct managers most as spokespeople. An employee posting about the organization is borrowing credibility the organization depends on, which is why the posts are both useful and risky.
Technology departments have seen the same pattern. The IEEE Computer Society, citing Gartner, reports that 41 percent of employees acquire, modify or create technology their IT departments do not know about, and that workarounds multiply when approved options are cumbersome. The comparison to communications is direct. If the approved boilerplate is two years old and sign-off takes a week, someone will write a new paragraph at 4 p.m. on a Thursday.
What bans produce
The strongest evidence that prohibition backfires comes from the National Park Service in January 2017. After the Interior Department reportedly ordered Park Service accounts to go quiet, the Badlands National Park account posted climate science tweets, which were then deleted. The Park Service said they came from a former employee who was not authorized to use the account. Within days, an unofficial account describing itself as the “resistance” team of the Park Service was running, and CBS Miami later counted more than 50 similar accounts across federal agencies, with the Park Service imitator reaching 1.25 million followers. The Park Service’s chief spokesman, Tom Crosson, told the Associated Press the agency had no restrictions on social media use.
Whatever the merits of the underlying dispute, the mechanics apply to any organization. Restricting an official voice does not remove the demand for one. It moves the supply somewhere the organization cannot see.
Deletion fared no better in the UK. When the Civil Service account posted a post-press-conference tweet calling the prime minister’s defense of an adviser “arrogant and offensive”, the Cabinet Office said an unauthorised tweet had been posted and the government opened an investigation. The tweet was removed within minutes, but it had already been read out on BBC News. Early reports could not say whether an insider or an outside party was responsible, a gap that is itself an account-security finding.
What works
Controls that address causes tend to outperform controls that address behavior. The table maps each one to the problem it solves.
| Control | Problem addressed | Precedent |
|---|---|---|
| A register of official accounts with named owners, and access removed when roles change | Unauthorized use | The Charity Commission’s guidance says a policy should set out who manages accounts and who can post. It should be regularly maintained with access clearly regulated. |
| Personal and organizational accounts kept in separate apps or profiles | Wrong-account posts | The Red Cross incident |
| A current message bank with a short turnaround for new requests | Homemade boilerplate | The shadow IT pattern above |
| A label rule for affiliated but unofficial accounts | Parallel accounts | Wikimedia asks community accounts to state plainly that they are unofficial |
| Guidance for personal accounts, without monitoring | Personal voice read as organizational | The Charity Commission, below |
| A pre-agreed response for the first hour of an incident | Every type | The Red Cross reply |
Wikimedia’s guidance is a useful model because it separates three groups instead of issuing one rule. Official accounts follow strict conduct rules. Employees’ personal accounts are, in the Foundation’s words, their own business unless they interfere with their jobs, with a request to consult the communications team before posting anything that could appear to be part of their work. Volunteer-run accounts that use Wikimedia branding are asked to check with the social media team first and to say they are unofficial.
The Charity Commission’s path to its current position is also instructive. Its draft guidance in January 2023 was read by some lawyers as expecting trustees to oversee personal accounts, and Withers warned it could force staff to keep two separate accounts. The final guidance, published in September 2023, states that individuals have a right to freedom of expression within the law and that trustees are not expected to monitor personal accounts, while noting that personal posts can still be associated with the charity. That is the better line. Monitoring personal accounts spends the trust that Edelman’s data suggests is the organization’s main asset with its own staff.
Where the line goes
Hard rules belong on official channels and on anything that claims to speak for the organization: who holds access, who may post, what needs sign-off. Everything else is better handled with guidance, examples and a fast route to an answer. Staff who can get an approved line in an hour have little reason to invent one.
The cheapest place to start is an audit. List every account, template and slide deck that carries the organization’s name, then ask the people who made them why. In most organizations the answers will point to something missing or out of date, and fixing that costs less than enforcing a prohibition.
Sources
- American Red Cross tweet: CNN Money, Chronicle of Philanthropy, Brewbound
- UK Civil Service tweet: LBC, PublicTechnology, The New World
- National Park Service accounts: CBS News, Fortune, CBS Miami
- Employee trust: Edelman, 2022 Trust Barometer special report on trust in the workplace
- Shadow IT: IEEE Computer Society, “Shadow IT in 2024”
- Wikimedia guidance: Wikimedia Meta-Wiki, Social media best practices
- Charity Commission guidance: Law & Religion UK, Directory of Social Change, Withers consultation response
