I'm doing online reputation management for a client. His daughter was being attacked online by classmates, and the Google algorithm ranked these websites very high. The websites contained some VERY bad stuff about this little girl, which was completely false.
The "negative websites" had the words:
(and a few other very bad words that I cannot mention in a family forum like WWW).
Her attackers created blogs, social media sites and other web properties and while I have found no evidence of "intentional SEO", by reasons I don't have time to get into....the sites got a bunch of inbound links to further boost their rankings for the teenage girls proper first and last name....in fact, the internal page that was ranking on page one has a pagerank of 5.
So I started with purchasing an EMD (eg: JaneDoe.com) and creating a bunch of web properties.
I started in August of 2012, and despite my best efforts was not able to knock down the last remaining negative website (there were 2 on the 1st page when I started).
So I changed my tactics....
I built millions of ultra-spammy "bad links" into the last remaining website. I did a few other tactics (no hacking and nothing that could even remotely be considered "illegal" was done) and within 2 weeks it had dropped off the 1st page.
I successfully used negative SEO to drop the bad page.
So, first hand experience that Penguin punishes for "bad links". It doesn't get more clearer than this.
It's the wild wild west out there with Penguin....and even though I don't consider myself a "black hat" and my "black hat" knowledge level is a "5" out of "10", I was still able to drop the last negative website relatively easy.