# counter

disarm_id: C00006
tactic_id: TA01
metatechnique_id: M004
name: Charge for social media
summary:
  Include a paid-for privacy option, e.g. pay Facebook for an option of them not collecting your personal information.  There are examples of this not work, e.g. most people don’t use proton mail etc. 


disarm_id: C00008
tactic_id: TA01
metatechnique_id: M006
name: Create shared fact-checking database
summary:
  Share fact-checking resources - tips, responses, countermessages, across respose groups.  Snopes is best-known example of fact-checking sites. 


disarm_id: C00009
tactic_id: TA02
metatechnique_id: M001
name: Educate high profile influencers on best practices
summary:
  Find online influencers. Provide training in the mechanisms of disinformation, how to spot campaigns, and/or how to contribute to responses by countermessaging, boosting information sites etc. 


disarm_id: C00012
tactic_id: TA01
metatechnique_id: M007
name: Platform regulation
summary:
  Empower existing regulators to govern social media. Also covers Destroy.  Includes: Include the role of social media in the regulatory framework for media - The European Union created significant new regulations in 2018; the U.S. approach will need to be carefully crafted to protect First Amendment principles, create needed transparency, ensure liability, and impose costs for noncompliance. Includes Create policy that makes social media police disinformation - example: German model: facebook forced to police content by law. Includes: Use fraud legislation to clean up social media


disarm_id: C00013
tactic_id: TA01
metatechnique_id: M006
name: Rating framework for news
summary:
  This is "strategic innoculation", raising the standards of what people expect in terms of evidence when consuming news. Example: journalistic ethics, or journalistic licensing body.  Include full transcripts, link source, add items. 


disarm_id: C00014
tactic_id: TA06
metatechnique_id: M006
name: Real-time updates to fact-checking database
summary:
  Update fact-checking databases and resources in real time.  Especially import for time-limited events like natural disasters.  Existing examples at Buzzfeed and Fema.


disarm_id: C00016
tactic_id: TA01
metatechnique_id: M005
name: Censorship
summary:
  Alter and/or block the publication/dissemination of information controlled by disinformation creators. Not recommended. 


disarm_id: C00017
tactic_id: TA01
metatechnique_id: M010
name: Repair broken social connections
summary:
  For example, use a media campaign to promote in-group to out-group in person communication / activities . Technique could be in terms of forcing a reality-check by talking to people instead of reading about bogeymen. 


disarm_id: C00019
tactic_id: TA01
metatechnique_id: M003
name: Reduce effect of division-enablers
summary:
  includes Promote constructive communication by shaming division-enablers, and Promote playbooks to call out division-enablers


disarm_id: C00024
tactic_id: TA01
metatechnique_id: M001
name: Promote healthy narratives
summary:
  Includes promoting constructive narratives i.e. not polarising (e.g. pro-life, pro-choice, pro-USA).  Includes promoting identity neutral narratives. 


disarm_id: C00026
tactic_id: TA01
metatechnique_id: M010
name: Shore up democracy based messages
summary:
  Messages about e.g. peace, freedom. And make it sexy. Includes Deploy Information and Narrative-Building in Service of Statecraft: Promote a narrative of transparency, truthfulness, liberal values, and democracy. Implement a compelling narrative via effective mechanisms of communication. Continually reassess U.S. messages, mechanisms, and audiences over time. Counteract efforts to manipulate media, undermine free markets, and suppress political freedoms via public diplomacy


disarm_id: C00028
tactic_id: TA02
metatechnique_id: M011
name: Make information provenance available
summary:
  Blockchain audit log and validation with collaborative decryption to post comments.  Use blockchain technology to require collaborative validation before posts or comments are submitted.

  This could be used to adjust upvote weight via a trust factor of people and organisations you trust, or other criteria.


disarm_id: C00029
tactic_id: TA02
metatechnique_id: M002
name: Create fake website to issue counter narrative and counter narrative through physical merchandise
summary:
  Create websites in disinformation voids - spaces where people are looking for known disinformation. 


disarm_id: C00030
tactic_id: TA02
metatechnique_id: M002
name: Develop a compelling counter narrative (truth based)
summary:
  Example: Reality Team.
  https://www.isdglobal.org/wp-content/uploads/2016/06/Counter-narrative-Handbook_1.pdf 


disarm_id: C00031
tactic_id: TA02
metatechnique_id: M009
name: Dilute the core narrative - create multiple permutations, target / amplify
summary:
  Create competing narratives. Included "Facilitate State Propaganda" as diluting the narrative could have an effect on the pro-state narrative used by volunteers, or lower their involvement.


disarm_id: C00044
tactic_id: TA03
metatechnique_id: M004
name: Keep people from posting to social media immediately
summary:
  Platforms can introduce friction to slow down activities, force a small delay between posts, or replies to posts.


disarm_id: C00047
tactic_id: TA04
metatechnique_id: M008
name: Honeypot with coordinated inauthentics
summary:
  Flood disinformation spaces with obviously fake content, to dilute core misinformation narratives in them. 


disarm_id: C00048
tactic_id: TA03
metatechnique_id: M003
name: Name and Shame Influencers
summary:
  Think about the different levels: individual vs state-sponsored account.  Includes “call them out” and “name and shame”.  Note that USAID operations were at a different level. Identify social media accounts as sources of propaganda—“calling them out”— might be helpful to prevent the spread of their message to audiences that otherwise would consider them factual. USAID has been restructuring its programs to address predatory Chinese development projects and the information operations that support them. USAID’s new strategy has tailored programs to counter Chinese educational exchange programs and to support free and fair elections, youth empowerment, democratic governance, and free press. USAID’s Russia regional teams have also been compiling a strategy for Russia’s information operations. One strong point of USAID’s programming is a system of indicators and measurements for a country’s vulnerability to foreign influence and information operations.  Identify, monitor, and, if necessary, target externally-based nonattributed social media accounts.  Impact of and Dealing with Trolls - "Chatham House has observed that trolls also sometimes function as decoys, as a way of “keeping the infantry busy” that “aims to wear down the other side” (Lough et al., 2014). Another type of troll involves “false accounts posing as authoritative information sources on social media”.


disarm_id: C00053
tactic_id: TA04
metatechnique_id: M012
name: Delete old accounts / Remove unused social media accounts
summary:
  remove or remove access to (e.g. stop the ability to update) old social media accounts, to reduce the pool of accounts available for takeover, botnets etc. 


disarm_id: C00059
tactic_id: TA04
metatechnique_id: M011
name: Verification of project before posting fund requests
summary:
  third-party verification of projects posting funding campaigns before those campaigns can be posted. 


disarm_id: C00062
tactic_id: TA04
metatechnique_id: M010
name: Free open library sources worldwide
summary:
  Open-source libraries could be created that aid in some way for each technique. Even for Strategic Planning, some open-source frameworks such as DISARM can be created to counter the adversarial efforts.


disarm_id: C00066
tactic_id: TA05
metatechnique_id: M009
name: Co-opt a hashtag and drown it out (hijack it back)
summary:
  Flood a disinformation-related hashtag with other content. Examples include kPop stans flooding extremist hashtags with pop videos and images. 


disarm_id: C00070
tactic_id: TA02
metatechnique_id: M005
name: Block access to disinformation resources
summary:
  Resources = accounts, channels etc.  Block access to platform. DDOS an attacker.

  TA02*: DDOS at the critical time (ie. midterm-2018 elections DDOS against troll farms) to deny an adversary's time-bound objective.

  T0008: A quick response to a proto-viral story will affect it's ability to spread and raise questions about their legitimacy.

  Hashtag: Against the platform, by drowning the hashtag.

  T0046 - Search Engine Optimization: Sub-optimal website performance affect its search engine rank, which I interpret as "blocking access to a platform".


disarm_id: C00072
tactic_id: TA06
metatechnique_id: M005
name: Remove non-relevant content from special interest groups - not recommended
summary:
  Check special-interest groups (e.g. medical, knitting) for unrelated and misinformation-linked content, and remove it. 


disarm_id: C00073
tactic_id: TA01
metatechnique_id: M001
name: Inoculate populations through media literacy training
summary:
  Use training to build the resilience of at-risk populations. Educate on how to handle info pollution. Push out targeted education on why it's pollution.  Build cultural resistance to false content, e.g. cultural resistance to bullshit.  Influence literacy training, to inoculate against “cult” recruiting.  Media literacy training: leverage librarians / library for media literacy training. Inoculate at language.   Strategic planning included as inoculating population has strategic value. Example is the "Learn to Discern" Program, funded by the Canadian government, operated in Ukraine from July 2015 to March 2016. The program trained 15,000 Ukrainians in ‘’safe, informed media consumption techniques,’’ including avoiding emotional manipulation, verifying sources, identifying hate speech, verifying expert credentials, detecting censorship, and debunking news, photos, and videos.”  Example: NGO Baltic Centre for Media Excellence, with some international funding, provides training to journalists in the Baltics and conducts media literacy training in the region. In addition to helping journalists avoid becoming “unwitting multipliers of misleading information,” the organization works with school teachers in the region to help them “decode media and incorporate media research into teaching.” concepts of media literacy to a mass audience that authorities launch a public information campaign that teaches the program will take time to develop and establish impact, recommends curriculum-based training.  Covers detect, deny, and degrade. 


disarm_id: C00075
tactic_id: TA06
metatechnique_id: M010
name: normalise language
summary:
  normalise the language around disinformation and misinformation; give people the words for artifact and effect types. 


disarm_id: C00077
tactic_id: TA03
metatechnique_id: M013
name: Active defence: run TA03 "develop people” - not recommended
summary:
  Develop networks of communities and influencers around counter-misinformation. Match them to misinformation creators 


disarm_id: C00078
tactic_id: TA06
metatechnique_id: M002
name: Change Search Algorithms for Disinformation Content
summary:
  Includes “change image search algorithms for hate groups and extremists” and “Change search algorithms for hate and extremist queries to show content sympathetic to opposite side”


disarm_id: C00080
tactic_id: TA06
metatechnique_id: M002
name: Create competing narrative
summary:
  Create counternarratives, or narratives that compete in the same spaces as misinformation narratives.  Could also be degrade


disarm_id: C00081
tactic_id: TA06
metatechnique_id: M003
name: Highlight flooding and noise, and explain motivations
summary:
  Discredit by pointing out the "noise" and informing public that "flooding" is a technique of disinformation campaigns; point out intended objective of "noise"


disarm_id: C00082
tactic_id: TA06
metatechnique_id: M010
name: Ground truthing as automated response to pollution
summary:
  e.g. RealityTeam work that adds clear information to spaces with disinformation in.  Also inoculation.


disarm_id: C00084
tactic_id: TA06
metatechnique_id: M002
name: Modify disinformation narratives, and rebroadcast them
summary:
  Includes “poison pill recasting of message” and “steal their truths”.  Many techniques involve promotion which could be manipulated. For example, online fundings or rallies could be advertised, through compromised or fake channels, as being associated with "far-up/down/left/right" actors. "Long Game" narratives could be subjected in a similar way with negative connotations.  Can also replay technique T0003. 


disarm_id: C00085
tactic_id: TA06
metatechnique_id: M003
name: Mute content
summary:
  Rate-limit disinformation content.  Reduces its effects, whilst not running afoul of censorship concerns.

  Online archives of content (archives of websites, social media profiles, media, copies of published advertisements; or archives of comments attributed to bad actors, as well as anonymized metadata about users who interacted with them and analysis of the effect) is useful for intelligence analysis and public transparency, but will need similar muting or tagging/ shaming as associated with bad actors.


disarm_id: C00086
tactic_id: TA06
metatechnique_id: M002
name: Distract from noise with addictive content
summary:
  Example: Interject addictive links or contents into discussions of disinformation materials and measure a "conversion rate" of users who engage with your content and away from the social media channel's "information bubble" around the disinformation item. Use bots to amplify and upvote the addictive content. 

  Note: This sounds eerlily like many Reddit communities where the most upvoted comments are all jokes, preventing serious discussion from being discovered by those who filter by upvotes.


disarm_id: C00090
tactic_id: TA07
metatechnique_id: M002
name: Fake engagement system
summary:
  Create honeypots for misinformation creators to engage with, and reduce the resources they have available for misinformation campaigns. 


disarm_id: C00092
tactic_id: TA02
metatechnique_id: M006
name: Establish a truth teller reputation score for influencers
summary:
  Includes "Establish a truth teller reputation score for influencers” and “Reputation scores for social media users”.  Influencers are individuals or accounts with many followers. 


disarm_id: C00093
tactic_id: TA03
metatechnique_id: M001
name: Influencer code of conduct
summary:
  Establish tailored code of conduct for individuals with many followers.  Can be platform code of conduct; can also be community code, e.g. the Pro-Truth Pledge. 


disarm_id: C00125
tactic_id: TA09
metatechnique_id: M001
name: Prebunking
summary:
  Produce material in advance of misinformation incidents, by anticipating the narratives used in them, and debunking them. 


disarm_id: C00126
tactic_id: TA09
metatechnique_id: M003
name: Social media amber alert
summary:
  Create an alert system around disinformation and misinformation artifacts, narratives, and incidents 


disarm_id: C00128
tactic_id: TA09
metatechnique_id: M009
name: Create friction by marking content with ridicule or other "decelerants"
summary:
  Repost or comment on misinformation artifacts, using ridicule or other content to reduce the likelihood of reposting. 


disarm_id: C00136
tactic_id: TA08
metatechnique_id: M010
name: Microtarget most likely targets then send them countermessages
summary:
  Find communities likely to be targetted by misinformation campaigns, and send them countermessages or pointers to information sources. 


disarm_id: C00138
tactic_id: TA11
metatechnique_id: M014
name: Spam domestic actors with lawsuits
summary:
  File multiple lawsuits against known misinformation creators and posters, to distract them from disinformation creation. 


disarm_id: C00140
tactic_id: TA12
metatechnique_id: M008
name: "Bomb" link shorteners with lots of calls
summary:
  Applies to most of the content used by exposure techniques except "T0055 - Use hashtag”. Applies to analytics


disarm_id: C00142
tactic_id: TA06
metatechnique_id: M004
name: Platform adds warning label and decision point when sharing content
summary:
  Includes “this has been disproved: do you want to forward it”. Includes “"Hey this story is old" popup when messaging with old URL” - this assumes that this technique is based on visits to an URL shortener or a captured news site that can publish a message of our choice.  Includes “mark clickbait visually”. 


disarm_id: C00148
tactic_id: TA12
metatechnique_id: M008
name: Add random links to network graphs
summary:
  If creators are using network analysis to determine how to attack networks, then adding random extra links to those networks might throw that analysis out enough to change attack outcomes. Unsure which DISARM techniques.


disarm_id: C00149
tactic_id: TA12
metatechnique_id: M008
name: Poison the monitoring & evaluation data
summary:
  Includes Pollute the AB-testing data feeds: Polluting A/B testing requires knowledge of MOEs and MOPs. A/B testing must be caught early when there is relatively little data available so infiltration of TAs and understanding of how content is migrated from testing to larger audiences is fundamental.


disarm_id: C00153
tactic_id: TA01
metatechnique_id: M013
name: Take pre-emptive action against actors' infrastructure
summary:
  Align offensive cyber action with information operations and counter disinformation approaches, where appropriate.


disarm_id: C00154
tactic_id: TA08
metatechnique_id: M005
name: Ask media not to report false information
summary:
  Train media to spot and respond to misinformation, and ask them not to post or transmit misinformation they've found. 


disarm_id: C00156
tactic_id: TA02
metatechnique_id: M010
name: Better tell your country or organization story
summary:
  Civil engagement activities conducted on the part of EFP forces. In Latvia, for example, U.S. soldiers have reportedly conducted numerous civil engagements with the local populations. In one example, soldiers cut firewood for local Russian-speaking Latvians. Locals were reportedly overheard saying, “A Russian soldier wouldn’t do that.” NATO should likewise provide support and training, where needed, to local public affairs and other communication personnel. Local government and military public affairs personnel can play their part in creating and disseminating entertaining and sharable content that supports the EFP mission. 


disarm_id: C00159
tactic_id: TA01
metatechnique_id: M007
name: Have a disinformation response plan
summary:
  e.g. Create a campaign plan and toolkit for competition short of armed conflict (this used to be called “the grey zone”). The campaign plan should account for own vulnerabilities and strengths, and not over-rely on any one tool of statecraft or line of effort.  It will identify and employ a broad spectrum of national power to deter, compete, and counter (where necessary) other countries’ approaches, and will include understanding of own capabilities, capabilities of disinformation creators, and international standards of conduct to compete in, shrink the size, and ultimately deter use of competition short of armed conflict.


disarm_id: C00160
tactic_id: TA03
metatechnique_id: M001
name: find and train influencers
summary:
  Identify key influencers (e.g. use network analysis), then reach out to identified users and offer support, through either training or resources.


disarm_id: C00161
tactic_id: TA01
metatechnique_id: M007
name: Coalition Building with stakeholders and Third-Party Inducements
summary:
  Advance coalitions across borders and sectors, spanning public and private, as well as foreign and domestic, divides. Improve mechanisms to collaborate, share information, and develop coordinated approaches with the private sector at home and allies and partners abroad.


disarm_id: C00162
tactic_id: TA04
metatechnique_id: M013
name: Unravel/target the Potemkin villages
summary:
  Kremlin’s narrative spin extends through constellations of “civil society” organizations, political parties, churches, and other actors. Moscow leverages think tanks, human rights groups, election observers, Eurasianist integration groups, and orthodox groups. A collection of Russian civil society organizations, such as the Federal Agency for the Commonwealth of Independent States Affairs, Compatriots Living Abroad, and International Humanitarian Cooperation, together receive at least US$100 million per year, in addition to government-organized nongovernmental organizations (NGOs), at least 150 of which are funded by Russian presidential grants totaling US$70 million per year.


disarm_id: C00164
tactic_id: TA02
metatechnique_id: M013
name: compatriot policy
summary:
  protect the interests of this population and, more importantly, influence the population to support pro-Russia causes and effectively influence the politics of its neighbors


disarm_id: C00169
tactic_id: TA02
metatechnique_id: M010
name: develop a creative content hub
summary:
  international donors will donate to a basket fund that will pay a committee of local experts who will, in turn, manage and distribute the money to Russian-language producers and broadcasters that pitch various projects.


disarm_id: C00170
tactic_id: TA01
metatechnique_id: M007
name: elevate information as a critical domain of statecraft
summary:
  Shift from reactive to proactive response, with priority on sharing relevant information with the public and mobilizing private-sector engagement. Recent advances in data-driven technologies have elevated information as a source of power to influence the political and economic environment, to foster economic growth, to enable a decision-making advantage over competitors, and to communicate securely and quickly.


disarm_id: C00174
tactic_id: TA01
metatechnique_id: M007
name: Create a healthier news environment
summary:
  Free and fair press: create bipartisan, patriotic commitment to press freedom.  Note difference between news and editorialising.  Build alternative news sources: create alternative local-language news sources to counter local-language propaganda outlets. Delegitimize the 24 hour news cycle.  includes Provide an alternative to disinformation content by expanding and improving local content: Develop content that can displace geopolitically-motivated narratives in the entire media environment, both new and old media alike.


disarm_id: C00176
tactic_id: TA01
metatechnique_id: M007
name: Improve Coordination amongst stakeholders: public and private
summary:
  Coordinated disinformation challenges are increasingly multidisciplinary, there are few organizations within the national security structures that are equipped with the broad-spectrum capability to effectively counter large-scale conflict short of war tactics in real-time. Institutional hurdles currently impede diverse subject matter experts, hailing from outside of the traditional national security and foreign policy disciplines (e.g., physical science, engineering, media, legal, and economics fields), from contributing to the direct development of national security countermeasures to emerging conflict short of war threat vectors. A Cognitive Security Action Group (CSAG), akin to the Counterterrorism Security Group (CSG), could drive interagency alignment across equivalents of DHS, DoS, DoD, Intelligence Community, and other implementing agencies, in areas including strategic narrative, and the nexus of cyber and information operations. 


disarm_id: C00178
tactic_id: TA05
metatechnique_id: M009
name: Fill information voids with non-disinformation content
summary:
  1) Pollute the data voids with wholesome content (Kittens! Babyshark!). 2) fill data voids with relevant information, e.g. increase Russian-language programming in areas subject to Russian disinformation.  Examples include using Current Time videos (viewed 40 million times online) to draw viewers away from Russian TV programming in RT and Sputnik. POtential content for this includes conventional entertainment programming (source: The conomist, “America’s Answer to Russian Propaganda TV,” 2017).


disarm_id: C00182
tactic_id: TA09
metatechnique_id: M005
name: Redirection / malware detection/ remediation
summary:
  Detect redirction or malware, then quarantine or delete.  Example: (2015) Trustwave reported that a Bedep Trojan malware kit had begun infecting machines and forcing them to browse certain sites, artificially inflating traffic to a set of pro-Russia


disarm_id: C00188
tactic_id: TA08
metatechnique_id: M001
name: Newsroom/Journalist training to counter influence moves
summary:
  Includes SEO influence.  August 2014, Russian news agency Rossiya Segodnya commissioned a poll in France with poorly worded questions and a statistically insignificant subsample that RT used to back a story titled “15% of French people back ISIS [Islamic State of Iraq and Syria] militants, poll finds.” The story and summary infographic circulated on the internet, initially appearing primarily on French sites. After a week, the generally respectable digital U.S. news outlet Vox ran the story, now titled “One in Six French People Say They Support ISIS.” Although this effect has now worn off or been overwritten, for a time—despite a later story from The Washington Post debunking the claim—typing “ISIS France” into Google resulted in an autosuggestion of “ISIS France support” (Borthwick, 2015). Includes promotion of a “higher standard of journalism”: journalism training “would be helpful, especially for the online community.  Includes Strengthen local media: Improve effectiveness of local media outlets. Using eastern Latvia media outlets as an example, one expert noted that the media outlets are “very weak,” are often politically affiliated, or have “little local oligarchs that control them.”


disarm_id: C00189
tactic_id: TA03
metatechnique_id: M003
name: Ensure that platforms are taking down flagged accounts
summary:
  Use ongoing analysis/monitoring of "flagged" profiles.  Confirm whether platforms are actively removing flagged accounts, and raise pressure via e.g. government organizations to encourage removal


disarm_id: C00190
tactic_id: TA01
metatechnique_id: M001
name: open engagement with civil society
summary:
  Government open engagement with civil society as an independent check on government action and messaging. Government seeks to coordinate and synchronize narrative themes with allies and partners while calibrating action in cases where elements in these countries may have been co-opted by competitor nations. Includes “fight in the light”: Use leadership in the arts, entertainment, and media to highlight and build on fundamental tenets of democracy.


disarm_id: C00195
tactic_id: TA07
metatechnique_id: M002
name: Redirect searches away from disinformation or extremist content
summary:
  Use Google AdWords to identify instances in which people search Google about particular fake-news stories or Russian propaganda themes. Taking advantage of the technology behind Google AdWords, this method identifies potential ISIS recruits through their Google searches and exposes them to curated YouTube videos debunking ISIS recruiting themes. Apply this method to Russian propaganda. Includes Monetize centrist SEO by subsidizing the difference in greater clicks towards extremist content. 


disarm_id: C00197
tactic_id: TA03
metatechnique_id: M005
name: remove suspicious accounts
summary:
  Standard reporting for false profiles (identity issues).  Includes detecting hijacked accounts and reallocating them - if possible, back to original owners. 


disarm_id: C00202
tactic_id: TA06
metatechnique_id: M002
name: Set data 'honeytraps'
summary:
  Set honeytraps in content likely to be accessed for disinformation.   NB Macron election team modified docs to spike a hack and leak. 


disarm_id: C00205
tactic_id: TA01
metatechnique_id: M007
name: strong dialogue between the federal government and private sector to encourage better reporting
summary:
  Increase civic resilience by partnering with business community to combat gray zone threats and ensuring adequate reporting and enforcement mechanisms. 


disarm_id: C00211
tactic_id: TA09
metatechnique_id: M010
name: Use humorous counter-narratives
summary:
  Examples:
   
  * Baltic Elves.
  https://balkaninsight.com/2019/06/07/disinformation-nation-the-slovaks-fighting-in-defence-of-facts/ 
  * Taiwan humor over rumor strategy.https://www.theguardian.com/commentisfree/2021/feb/17/humour-over-rumour-taiwan-fake-news 
  *  Taiwan “humor over rumour" 
  https://internews.org/story/using-comedy-and-social-media-educate-disinformation 


disarm_id: C00220
tactic_id: TA01
metatechnique_id: M007
name: Develop a monitoring and intelligence plan
summary:
  Create a plan for misinformation and disinformation response, before it's needed.  Include connections / contacts needed, expected counteremessages etc. 


disarm_id: C00222
tactic_id: TA02
metatechnique_id: M007
name: Tabletop simulations
summary:
  Simulate misinformation and disinformation campaigns, and responses to them, before campaigns happen. 


disarm_id: C00223
tactic_id: TA01
metatechnique_id: M001
name: Strengthen Trust in social media platforms
summary:
  Improve trust in the misinformation responses from social media and other platforms.  Examples include creating greater transparancy on their actions and algorithms. 


# detection

disarm_id: F00001
tactic_id: TA01
name: Analyse aborted / failed campaigns
summary:
  Examine failed campaigns. How did they fail? Can we create useful activities that increase these failures? 


disarm_id: F00015
tactic_id: TA03
name: Detect anomalies in membership growth patterns
summary:
  I include Fake Experts as they may use funding campaigns such as Patreon to fund their operations and so these should be watched.


disarm_id: F00016
tactic_id: TA03
name: Identify fence-sitters
summary:
  Note: In each case, depending on the platform there may be a way to identify a fence-sitter. For example, online polls may have a neutral option or a "somewhat this-or-that" option, and may reveal who voted for that to all visitors. This information could be of use to data analysts.

  In TA08-11, the engagement level of victims could be identified to detect and respond to increasing engagement.


disarm_id: F00037
tactic_id: TA06
name: News content provenance certification.
summary:
  Original Comment: Shortcomings: intentional falsehood. Doesn't solve accuracy. Can't be mandatory. 

  Technique should be in terms of "strategic innoculation", raising the standards of what people expect in terms of evidence when consuming news.


disarm_id: F00038
tactic_id: TA06
name: Social capital as attack vector
summary:
  Unsure I understood the original intention or what it applied to. Therefore the techniques listed (10, 39, 43, 57, 61) are under my interpretation - which is that we want to track ignorant agents who fall into the enemy's trap and show a cost to financing/reposting/helping the adversary via public shaming or other means.


disarm_id: F00052
tactic_id: TA09
name: Discover sponsors
summary:
  Discovering the sponsors behind a campaign, narrative, bot, a set of accounts, or a social media comment, or anything else is useful.


disarm_id: F00058
tactic_id: TA10
name: Deplatform (cancel culture)
summary:
  *Deplatform People: This technique needs to be a bit more specific to distinguish it from "account removal" or DDOS and other techniques that get more specific when applied to content.

  For example, other ways of deplatforming people include attacking their sources of funds, their allies, their followers, etc.


disarm_id: F00059
tactic_id: TA10
name: Identify susceptible demographics
summary:
  All techniques provide or are susceptible to being countered by, or leveraged for, knowledge about user demographics.


disarm_id: F00060
tactic_id: TA10
name: Identify susceptible influencers
summary:
  I assume this was a transcript error. Otherwise, "Identify Susceptible Influences" as in the various methods of influences that may work against a victim could also be a technique. Nope, wasn't a transcript error: original note says influencers, as in find people of influence that might be targetted. 


disarm_id: F00068
name: Resonance analysis
summary:
  a developing methodology for identifying statistical differences in how social groups use language and quantifying how common those statistical differences are within a larger population. In essence, it hypothesizes how much affinity might exist for a specific group within a general population, based on the language its members employ


disarm_id: F00069
name: Track Russian media and develop analytic methods.
summary:
  To effectively counter Russian propaganda, it will be critical to track Russian influence efforts. The information requirements are varied and include the following: • Identify fake-news stories and their sources. • Understand narrative themes and content that pervade various Russian media sources. • Understand the broader Russian strategy that underlies tactical propaganda messaging.


disarm_id: F00071
name: Network analysis Identify/cultivate/support influencers
summary:
  Local influencers detected via Twitter networks are likely local influencers in other online and off-line channels as well. In addition, the content and themes gleaned from Russia and Russia-supporting populations, as well as anti-Russia activists, likely swirl in other online and off-line mediums as well.


disarm_id: F00072
name: network analysis to identify central users in the pro-Russia activist community.
summary:
  It is possible that some of these are bots or trolls and could be flagged for suspension for violating Twitter’s terms of service.


disarm_id: F00073
name: collect intel/recon on black/covert content creators/manipulators
summary:
  Players at the level of covert attribution, referred to as “black” in the grayscale of deniability, produce content on user-generated media, such as YouTube, but also add fear-mongering commentary to and amplify content produced by others and supply exploitable content to data dump websites. These activities are conducted by a network of trolls, bots, honeypots, and hackers. 


disarm_id: F00074
name: identify relevant fence-sitter communities
summary:
  brand ambassador programs could be used with influencers across a variety of social media channels. It could also target other prominent experts, such as academics, business leaders, and other potentially prominent people. Authorities must ultimately take care in implementing such a program given the risk that contact with U.S. or NATO authorities might damage influencer reputations. Engagements must consequently be made with care, and, if possible, government interlocutors should work through local NGOs.


disarm_id: F00075
name: leverage open-source information
summary:
  significant amounts of quality open-source information are now available and should be leveraged to build products and analysis prior to problem prioritization in the areas of observation, attribution, and intent. Successfully distinguishing the gray zone campaign signal through the global noise requires action through the entirety of the national security community. Policy, process, and tools must all adapt and evolve to detect, discern, and act upon a new type of signal


disarm_id: F00076
name: Monitor/collect audience engagement data connected to “useful idiots”
summary:
  Target audience connected to "useful idiots rather than the specific profiles because - The active presence of such sources complicates targeting of Russian propaganda, given that it is often difficult to discriminate between authentic views and opinions on the internet and those disseminated by the Russian state.


disarm_id: F00080
tactic_id: TA07
name: Hack the polls/ content yourself
summary:
  Two wrongs don't make a right? But if you hack your own polls, you do learn how it could be done, and learn what to look for


disarm_id: F00085
name: detection of a weak signal through global noise
summary:
  Gray zone threats are challenging given that warning requires detection of a weak signal through global noise and across threat vectors and regional boundaries.Three interconnected gray zone elements characterize the nature of the activity: 
  Temporality: The nature of gray zone threats truly requires a “big picture view” over long timescales and across regions and functional topics.
  Attribution: requiring an “almost certain” or “nearly certain analytic assessment before acting costs time and analytic effort
  Intent: judgement of adversarial intent to conduct gray zone activity. Indeed, the purpose of countering gray zone threats is to deter adversaries from fulfilling their intent to act. While attribution is one piece of the puzzle, closing the space around intent often means synthesizing multiple relevant indicators and warnings, including the state’s geopolitical ambitions, military ties, trade and investment, level of corruption, and media landscape, among others.


disarm_id: F00086
tactic_id: TA02
name: Outpace Competitor Intelligence Capabilities
summary:
  Develop an intelligence-based understanding of foreign actors’ motivations, psychologies, and societal and geopolitical contexts. Leverage artificial intelligence to identify patterns and infer competitors’ intent


disarm_id: F00087
name: Improve Indications and Warning
summary:
  United States has not adequately adapted its information indicators and thresholds for warning policymakers to account for gray zone tactics. Competitors have undertaken a marked shift to slow-burn, deceptive, non-military, and indirect challenges to U.S. interests. Relative to traditional security indicators and warnings, these are more numerous and harder to detect and make it difficult for analysts to infer intent.


disarm_id: F00088
name: Revitalize an “active measures working group,”
summary:
  Recognize campaigns from weak signals, including rivals’ intent, capability, impact, interactive effects, and impact on U.S. interests... focus on adversarial covert action aspects of campaigning.


disarm_id: F00089
tactic_id: TA04
name: target/name/flag "grey zone" website content
summary:
  "Gray zone" is second level of content producers and circulators, composed of outlets with uncertain attribution. This category covers conspiracy websites, far-right or far-left websites, news aggregators, and data dump websites


disarm_id: F00091
tactic_id: TA01
name: Partner to develop analytic methods & tools
summary:
  This might include working with relevant technology firms to ensure that contracted analytic support is available. Contracted support is reportedly valuable because technology to monitor social media data is continually evolving, and such firms can provide the expertise to help identify and analyze trends, and they can more effectively stay abreast of the changing systems and develop new models as they are required


disarm_id: F00092
tactic_id: TA09
name: daylight
summary:
  Warn social media companies about an ongoing campaign (e.g. antivax sites).  Anyone with datasets or data summaries can help with this


# framework

disarm_id: FW01
name: DISARM Red
summary:
  incident creation framework. All the things that an incident creator will need to do to create, run, and assess the effectiveness of a disinformation incident.


disarm_id: FW02
name: DISARM Blue
summary:
  incident counters framework. All the things that a response team, people outside the team, and organisations outside the team, will need to do to mitigate the effects of an incident, slow down an incident, stop an incident etc.


disarm_id: FW03
name: DISARM Green
summary:
  counter counters framework. All the things that an incident creation team might do to reduce the effectiveness of mitigations, counters, and responders to an incident. This framework doesn't officially exist yet: this id is for future work. 


# metatechnique

disarm_id: M001
name: resilience
summary:
  Increase the resilience to disinformation of the end subjects or other parts of the underlying system


disarm_id: M012
name: cleaning
summary:
  Clean unneeded resources (accounts etc) from the underlying system so they can't be used in disinformation


# phase

disarm_id: P01
name: Plan
rank: 1
summary:
  Envision the desired outcome. Lay out effective ways of achieving it. Communicate the vision, intent, and decisions, focusing on expected results.


disarm_id: P02
name: Prepare
rank: 2
summary:
  Activities conducted before execution to improve the ability to conduct the action. Examples include: development of the ecosystem needed to support the action: people, network, channels, content etc.


# playbook

disarm_id: PB00001
object_id: C00011
name:
  Game Mechanics: show examples of fake news and train the user to identify them on the basis of various types of indicators


disarm_id: PB00002
object_id: C00011
name:
  Game mechanics: use a crowd-sourced mechanism so that the public can categorize newly spreading news sources or articles a la Re-Captcha


disarm_id: PB00003
object_id: C00012
name:
  Develop a regulatory body like the CFPB to regulate and enforce regulation for digital organizations. 


disarm_id: PB00007
object_id: C00019
name:
  Spread Infographics & Training Material teaching ways to identify and counter divisive rhetorical techniques and content, by stimulating their sense of outrage at being manipulated. Show them how to address the rhetorical technique rather than the content


disarm_id: PB00010
object_id: C00019
name:
  Popularize (via memes, infographics) and get the centrists demographic who are tired of polarization to identify such messaging, call it out and display their outrage on the basis of divisive rhetorical techniques rather than merely arguing about the content


disarm_id: PB00017
object_id: C00029
name:
  Secondary Objective: Obtain real-life identity of ignorant agents, to further disrupt their influence activities


disarm_id: PB00022
object_id: C00036
name:
  -Discredit via backstopped blogs/websites showing their past activity and opinions as being opposite to their current ingroup


disarm_id: PB00033
object_id: C00053
name:
  Influencers encourage people to remove their inactive accounts "Do you really need that old account" campaign, world-war-two poster-style. 


disarm_id: PB00034
object_id: C00053
name:
  Create alternative memorial websites for accounts of deceased people, so their accounts can't be reactivated on 'live' sites. 


disarm_id: PB00035
object_id: C00053
name:
  Educate/scare users on the risks of losing control over a dormant account (would their employer be forgiving if an account associated with the user suddenly starting posting extremist content?).


disarm_id: PB00036
object_id: C00074
name:
  Platform adds a hash of the post to the post metadata and make it publicly available (content addressing). Scrape for duplicate content and deplatform the content/users across affected. In all cases some checks need to prevent deplatforming of highly correlated organic traffic such as a community group copy/pasting their bake sale advert. 


disarm_id: PB00037
object_id: C00074
name:
  Platform adds plagiarism score metadata to a post and makes it publicly available. Scrape for duplicate content and deplatform the content/users across affected platforms.


disarm_id: PB00040
object_id: C00074
name:
  Use basic web scraping techniques, Google dorks, etc to identify similar head lines, uniques phrases, authorship, embedded links and any other correlating data point.


disarm_id: PB00043
object_id: C00136
name:
  Use a platform's publicly available advertising/targeting capabilities to enumerate a list of possible microtargeted demographics. Compare these to known TAs of past/ongoing influence ops to identify the vulnerable demographics. 


disarm_id: PB00046
object_id: C00148
name:
  Degrade TA engagement using bots; direct the adversary to engage insular bot communities-within-communities rather than the authentic target audience.


disarm_id: PB00049
object_id: C00149
name:
  Work with the media platform to distort publicly available metrics. Can we work with Twitter to get crappy off-brand memes artificially bumped without needing to create fake accounts, etc.?


disarm_id: PB00050
object_id: C00149
name:
  Use adtech to promote content inconsistent with TA demographics. If the adversary is reverse engineering a groups demographics by analyzing ads placed on the platform/group, by spamming ads for out-group stuff it may distort analysis of the group.


disarm_id: PB00053
object_id: C00149
name:
  Promote damp squibs. Within a known TA promote/inflate crappy off-brand memes which are unlikley to resonate.


disarm_id: PB00054
object_id: C00149
name:
  Detect early trending/engagement and undermine the content by responding with 5Ds, toxic community behaviour, satirical responses, etc.


disarm_id: PB00056
object_id: C00174
name:
  Elected officials lead return to First Amendment norms that embrace free and fair media as central to democracy.


disarm_id: PB00057
object_id: C00188
name:
  TechCamp bringing together local journalists, with a several-day training program that includes a sponsored yearlong investigative project


disarm_id: PB00059
object_id: C00197
name: Determine whether account might be compromised
summary:
  Questions: - Is the account compromised? 
  - Is it known to be associated with threat actors 
  - common/random name 
  - Names violate terms of service 
  - Dormant account 
  - Change of country IP
  - Social network growth patterns (number of friends etc) 
  - Evidence of linguistic artifacts (multiple fingerprints, terms/idiosyncrasies )
  - Community vs. narrative vs. individuals 


disarm_id: PB00061
object_id: C00197
name:
  Report ToS violations. In all playbooks the platform must force user verification, credential reset and enable MFA. Suspend the account if it cannot be verified.


disarm_id: PB00064
object_id: C00197
name:
  Detect sudden deviation in user sentiment such as suddenly dropping hashtags linked to extremist content.


disarm_id: PB00065
object_id: C00197
name:
  Purchase "likes", "retweets" and other vehicles which identify a bot and/or hijacked account. Ban the account.


disarm_id: PB00066
object_id: C00197
name:
  Detect hijacked account and spam their posts. "OP is a known disinformation bot. http://link.to.proof[.]com"


disarm_id: PB00069
object_id: F00003
name: Destroy Desire to Work for Propaganda Businesses
summary:
  -Identify non-committed actors (ie. IRA 2$/h employees)
  -Identify where they reside (ie. postal code level)
  -Send a viral message that clarifies the risk of working in influence ops. 


disarm_id: PB00072
object_id: F00005
name:
  -Model communities on the basis of behavior and identity, etc
  -Model different online behaviors in terms of how these groups interact with propaganda
  -Model how these group-based behaviors are affected by the tech platform they are using
  -This research can feed into later-stage playbooks to adapt them to communities/platforms


disarm_id: PB00073
object_id: F00006
name: Model each major platform
summary:
  Determine:
  a) Moderation Method (global, subcommunity level, none -ie. twitter, reddit, 8chan)
  b) Access Model (friend request, open, real-life identity)
  c) Communication Model (global, friends only, subcommunity, hybrid)
  Determine how the combination of the above (and other characteristics) allow different technical methods to communicate and influence various audiences
  This will allow to adapt playbooks to specific platforms


disarm_id: PB00075
object_id: F00014
name:
  - Hashes
  - Data voids
  - User handles 
  - Domains + link shortener
  - TinEye For video (visual artifact)


disarm_id: PB00077
object_id: F00018
name:
  Ad tech 
  - De-platform funding sites 
  - Blockchain transaction 
  - Sell items
  - Identify manufacturers 
  - Pay to play meetings 


disarm_id: PB00079
object_id: F00018
name: Identify re-use of ads
summary:
  Look at Ad trackers, Tracking ids, Tracking ads, Re-use of as features (language, name, themes, plug-in, re-use/versions)


disarm_id: PB00083
object_id: F00092
name:
  Build a reporting system for the public, so they can report disinformation artefacts and have them available to channels etc for action. 


# responsetype

disarm_id: D02
name: Deny
summary:
  Prevent disinformation creators from accessing and using critical information, systems, and services. Deny is for an indefinite time period. 


disarm_id: D03
name: Disrupt
summary:
  Completely break or interrupt the flow of information, for a fixed amount of time. (Deny, for a limited time period).  Not allowing any efficacy, for a short amount of time. 


disarm_id: D04
name: Degrade
summary:
  Reduce the effectiveness or efficiency of disinformation creators’ command and control or communications systems, and information collection efforts or means, either indefinitely, or for a limited time period. 


disarm_id: D05
name: Deceive
summary:
  Cause a person to believe what is not true. military deception seeks to mislead adversary decision makers by manipulating their perception of reality.


disarm_id: D06
name: Destroy
summary:
  Damage a system or entity so badly that it cannot perform any function or be restored to a usable condition without being entirely rebuilt. Destroy is permanent, e.g. you can rebuild a website, but it’s not the same website. 


# tactic

disarm_id: TA01
phase_id: P01
name: Strategic Planning
rank: 1
summary:
  Define the desired end state, i.e. the set of required conditions that defines achievement of all objectives.


disarm_id: TA02
phase_id: P01
name: Objective Planning
rank: 2
summary:
  Set clearly defined, measurable, and achievable objectives. Achieving objectives ties execution of tactical tasks to reaching the desired end state. There are four primary considerations:
  - Each desired effect should link directly to one or more objectives
  - The effect should be measurable
  - The objective statement should not specify the way and means of accomplishment
  - The effect should be distinguishable from the objective it supports as a condition for success, not as another objective or task.


disarm_id: TA13
phase_id: P01
name: Conduct Center of Gravity Analysis
rank: 3
summary:
  Recon/research to identify "the source of power that provides moral or physical strength, freedom of action, or will to act." Thus, the center of gravity is usually seen as the "source of strength". Includes demographic and network analysis of communities


disarm_id: TA04
phase_id: P02
name: Develop Networks
rank: 5
summary:
  Develop online and offline communities and transmission methods and cultivate assets and unwitting agents


disarm_id: TA07
phase_id: P02
name: Channel Selection
rank: 8
summary:
  Set up specific delivery, amplification and manipulation channels for incident, including channels to attack. Each channel serves as an atomic surface (test bed) location/site for adversary to hide/conceal the work/content that goes into setting up for this channel and/or other specific platforms. Contributes to building out a connected ecosystem where this channel can operate as part of a whole campaign/incident


disarm_id: TA08
phase_id: P03
name: Pump Priming
rank: 9
summary:
  Release content on a targetted small scale, prior to general release, including releasing seed. Used for preparation before broader release, and as message honing.  Used for preparation before broader release, and as message honing. 


# technique

disarm_id: T0001
tactic_id: TA01
name: 5Ds (dismiss, distort, distract, dismay, divide)
summary:
  Nimmo's "4Ds of propaganda": dismiss, distort, distract, dismay (MisinfosecWG added divide in 2019). Misinformation promotes an agenda by advancing narratives supportive of that agenda. This is most effective when the advanced narrative pre-dates the revelation of the specific misinformation content. This is often not possible.


disarm_id: T0002
tactic_id: TA01
name: Facilitate State Propaganda
summary:
  Organize citizens around pro-state messaging. Coordinate paid or volunteer groups to push state propaganda.


disarm_id: T0003
tactic_id: TA01
name: Leverage Existing Narratives
summary:
  Use or adapt existing narrative themes, where narratives are the baseline stories of a target audience. Narratives form the bedrock of our worldviews. New information is understood through a process firmly grounded in this bedrock. If new information is not consitent with the prevailing narratives of an audience, it will be ignored. Effective campaigns will frame their misinformation in the context of these narratives. Highly effective campaigns will make extensive use of audience-appropriate archetypes and meta-narratives throughout their content creation and amplifiction practices. 


disarm_id: T0004
tactic_id: TA01
name: Devise Competing Narratives
summary:
  Advance competing narratives connected to same issue ie: on one hand deny incident while at same time expresses dismiss. 

  Suppressing or discouraging narratives already spreading requires an alternative. The most simple set of narrative techniques in response would be the construction and promotion of contradictory alternatives centered on denial, deflection, dismissal, counter-charges, excessive standards of proof, bias in prohibition or enforcement, and so on.

  These competing narratives allow loyalists cover, but are less compelling to opponents and fence-sitters than campaigns built around existing narratives or highly explanatory master narratives. Competing narratives, as such, are especially useful in the "firehose of misinformation" approach.


disarm_id: T0006
tactic_id: TA02
name: Develop Narrative Concepts
summary:
  The promotion of beneficial master narratives is perhaps the most effective method for achieving long-term strategic narrative dominance. From a "whole of society" perspective the promotion of the society's core master narratives should occupy a central strategic role. From a misinformation campaign / cognitive security perpectve the tactics around master narratives center more precisely on the day-to-day promotion and reinforcement of this messaging. In other words, beneficial, high-coverage master narratives are a central strategic goal and their promotion consitutes an ongoing tactical struggle carried out at a whole-of-society level.  Tactically, their promotion covers a broad spectrum of activities both on- and offline.


disarm_id: T0007
tactic_id: TA03
name: Create fake Social Media Profiles / Pages / Groups
summary:
  Create key social engineering assets needed to amplify content, manipulate algorithms, fool public and/or specific incident/campaign targets. 

  Computational propaganda depends substantially on false perceptions of credibility and acceptance. By creating fake users and groups with a variety of interests and commitments, attackers can ensure that their messages both come from trusted sources and appear more widely adopted than they actually are. 


disarm_id: T0008
tactic_id: TA03
name: Create fake or imposter news sites
summary:
  Modern computational propaganda makes use of a cadre of imposter news sites spreading globally. These sites, sometimes motivated by concerns other than propaganda--for instance, click-based revenue--often have some superficial markers of authenticity, such as naming and site-design. But many can be quickly exposed with reference to their owenership, reporting history and adverstising details.


disarm_id: T0009
tactic_id: TA03
name: Create fake experts
summary:
  Stories planted or promoted in computational propaganda operations often make use of experts fabricated from whole cloth, sometimes specifically for the story itself. 


disarm_id: T0010
tactic_id: TA04
name: Cultivate ignorant agents
summary:
  Cultivate propagandists for a cause, the goals of which are not fully comprehended, and who are used cynically by the leaders of the cause. Independent actors use social media and specialised web sites to strategically reinforce and spread messages compatible with their own. Their networks are infiltrated and used by state media disinformation organisations to amplify the state’s own disinformation strategies against target populations. Many are traffickers in conspiracy theories or hoaxes, unified by a suspicion of Western governments and mainstream media. Their narratives, which appeal to leftists hostile to globalism and military intervention and nationalists against immigration, are frequently infiltrated and shaped by state-controlled trolls and altered news items from agencies such as RT and Sputnik. Also know as "useful idiots" or "unwitting agents".


disarm_id: T0012
tactic_id: TA04
name: Use concealment
summary:
  Use anonymous social media profiles. Examples include page or group administrators, masked "whois" website directory data, no bylines connected to news article, no masthead connect to news websites. 


disarm_id: T0013
tactic_id: TA04
name: Create fake websites
summary:
  Create media assets to support fake organizations (e.g. think tank), people (e.g. experts) and/or serve as sites to distribute malware/launch phishing operations.


disarm_id: T0014
tactic_id: TA04
name: Prepare fundraising campaigns
summary:
  Generate revenue through new or existing funding campaigns. e.g. Gather data, advance credible persona via Gofundme; Patreon; or via fake website connecting via PayPal or Stripe.


disarm_id: T0015
tactic_id: TA04
name: Create hashtags
summary:
  Create one or more hashtags and/or hashtag groups. Many incident-based campaigns will create hashtags to promote their fabricated event.  Creating a hashtag for an incident can have two important effects: 1. Create a perception of reality around an event. Certainly only "real" events would be discussed in a hashtag. After all, the event has a name!, and 2. Publicize the story more widely through trending lists and search behavior.  Asset needed to direct/control/manage "conversation" connected to launching new incident/campaign with new hashtag for applicable social media sites). 


disarm_id: T0016
tactic_id: TA05
name: Clickbait
summary:
  Create attention grabbing headlines (outrage, doubt, humor) required to drive traffic & engagement. This is a key asset


disarm_id: T0017
tactic_id: TA05
name: Conduct Fundraising Campaigns
summary:
  Drive traffic/engagement to funding campaign sites; helps provide measurable metrics to assess conversion rates


disarm_id: T0019
tactic_id: TA06
name: Generate information pollution
summary:
  Flood social channels; drive traffic/engagement to all assets; create aura/sense/perception of pervasiveness/consensus (for or against or both simultaneously) of an issue or topic. "Nothing is true, but everything is possible." Akin to astroturfing campaign.


disarm_id: T0020
tactic_id: TA06
name: Trial content
summary:
  Iteratively test incident performance (messages, content etc), e.g. A/B test headline/content enagagement metrics; website and/or funding campaign conversion rates


disarm_id: T0021
tactic_id: TA06
name: Memes
summary:
  Memes are one of the most important single artefact types in all of computational propaganda. Memes in this framework denotes the narrow image-based definition. But that naming is no accident, as these items have most of the important properties of Dawkins' original conception as a self-replicating unit of culture. Memes pull together reference and commentary; image and narrative; emotion and message. Memes are a powerful tool and the heart of modern influence campaigns.


disarm_id: T0022
tactic_id: TA06
name: Conspiracy narratives
summary:
  "Conspiracy narratives appeal to the human desire for explanatory order, by invoking the participation of poweful (often sinister) actors in pursuit of their own political goals. These narratives are especially appealing when an audience is low-information, marginalized or otherwise inclined to reject the prevailing explanation. Conspiracy narratives are an important component of the ""firehose of falsehoods"" model. 


disarm_id: T0023
tactic_id: TA06
name: Distort facts
summary:
  Change, twist, or exaggerate existing facts to construct a narrative that differs from reality. Examples: images and ideas can be distorted by being placed in an improper content


disarm_id: T0024
tactic_id: TA06
name: Create fake videos and images
summary:
  Create fake videos and/or images by manipulating existing content or generating new content (e.g. deepfakes). 


disarm_id: T0025
tactic_id: TA06
name: Leak altered documents
summary:
  Obtain documents (eg by theft or leak), then alter and release, possibly among factual documents/sources. 


disarm_id: T0026
tactic_id: TA06
name: Create pseudoscientific or disingenuous research
summary:
  Create fake academic research. Example: fake social science research is often aimed at hot-button social issues such as gender, race and sexuality. Fake science research can target Climate Science debate or pseudoscience like anti-vaxx


disarm_id: T0027
tactic_id: TA06
name: Adapt existing narratives
summary:
  Adapting existing narratives to current operational goals is the tactical sweet-spot for an effective misinformation campaign. Leveraging existing narratives is not only more effective, it requires substantially less resourcing, as the promotion of new master narratives operates on a much larger scale, both time and scope. Fluid, dynamic & often interchangeable key master narratives can be ("The morally corrupt West") adapted to divisive (LGBT propaganda) or to distort (individuals working as CIA operatives). For Western audiences, different but equally powerful framings are available, such as "USA has a fraught history in race relations, especially in criminal justice areas."


disarm_id: T0028
tactic_id: TA06
name: Create competing narratives
summary:
  Misinformation promotes an agenda by advancing narratives supportive of that agenda. This is most effective when the advanced narrative pre-dates the revelation of the specific misinformation content. But this is often not possible. 

  Suppressing or discouraging narratives already spreading requires an alternative. The most simple set of narrative techniques in response would be the construction and promotion of contradictory alternatives centered on denial, deflection, dismissal, counter-charges, excessive standards of proof, bias in prohibition or enforcement, and so on. 

  These competing narratives allow loyalists cover, but are less compelling to opponents and fence-sitters than campaigns built around existing narratives or highly explanatory master narratives. Competing narratives, as such, are especially useful in the *firehose of misinformation* approach.


disarm_id: T0029
tactic_id: TA07
name: Manipulate online polls
summary:
  Create fake online polls, or manipulate existing online polls. Data gathering tactic to target those who engage, and potentially their networks of friends/followers as well


disarm_id: T0030
tactic_id: TA07
name: Backstop personas
summary:
  Create other assets/dossier/cover/fake relationships and/or connections or documents, sites, bylines, attributions, to establish/augment/inflate crediblity/believability


disarm_id: T0039
tactic_id: TA08
name: Bait legitimate influencers
summary:
  Credibility in a social media environment is often a function of the size of a user's network. "Influencers" are so-called because of their reach, typically understood as: 1) the size of their network (i.e. the number of followers, perhaps weighted by their own influence); and 2) The rate at which their comments are re-circulated (these two metrics are related). Add traditional media players at all levels of credibility and professionalism to this, and the number of potential influencial carriers available for unwitting amplification becomes substantial.

  By targeting high-influence people and organizations in all types of media with narratives and content engineered to appeal their emotional or ideological drivers, influence campaigns are able to add perceived credibility to their messaging via saturation and adoption by trusted agents such as celebrities, journalists and local leaders.


disarm_id: T0040
tactic_id: TA08
name: Demand unsurmountable proof
summary:
  Campaigns often leverage tactical and informational asymmetries on the threat surface, as seen in the Distort and Deny strategies, and the "firehose of misinformation". Specifically, conspiracy theorists can be repeatedly wrong, but advocates of the truth need to be perfect. By constantly escalating demands for proof, propagandists can effectively leverage this asymmetry while also priming its future use, often with an even greater asymmetric advantage. The conspiracist is offered freer rein for a broader range of "questions" while the truth teller is burdened with higher and higher standards of proof.


disarm_id: T0041
tactic_id: TA08
name: Deny involvement
summary:
  Without "smoking gun" proof (and even with proof), incident creator can or will deny involvement. This technique also leverages the attacker advantages outlined in T0040 "Demand unsurmountable proof", specifically the asymmetric disadvantage for truth-tellers in a "firehose of misinformation" environment.


disarm_id: T0042
tactic_id: TA08
name: Kernel of Truth
summary:
  Wrap lies or altered context/facts around truths. 

  Influence campaigns pursue a variety of objectives with respect to target audiences, prominent among them: 1. undermine a narrative commonly referenced in the target audience; or 2. promote a narrative less common in the target audience, but preferred by the attacker. In both cases, the attacker is presented with a heavy lift. They must change the relative importance of various narratives in the interpretation of events, despite contrary tendencies. 

  When messaging makes use of factual reporting to promote these adjustments in the narrative space, they are less likely to be dismissed out of hand; when messaging can juxtapose a (factual) truth about current affairs with the (abstract) truth explicated in these narratives, propagandists can undermine or promote them selectively. Context matters.


disarm_id: T0043
tactic_id: TA08
name: Use SMS/ WhatsApp/ Chat apps
summary:
  Direct messaging via encypted app is an increasing method of delivery. These messages are often automated and new delivery and storage methods make them anonymous, viral, and ephemeral. This is a diffucult space to monitor, but also a difficult space to build acclaim or notoriety.


disarm_id: T0044
tactic_id: TA08
name: Seed distortions
summary:
  Try a wide variety of messages in the early hours surrounding an incident or event, to give a misleading account or impression. 


disarm_id: T0045
tactic_id: TA08
name: Use fake experts
summary:
  Use the fake experts that were set up in T0009. Pseudo-experts are disposable assets that often appear once and then disappear. Give "credility" to misinformation. Take advantage of credential bias


disarm_id: T0046
tactic_id: TA08
name: Search Engine Optimization
summary:
  Manipulate content engagement metrics (ie: Reddit & Twitter) to influence/impact news search results (e.g. Google), also elevates RT & Sputnik headline into Google news alert emails. aka "Black-hat SEO" 


disarm_id: T0047
tactic_id: TA09
name: Muzzle social media as a political force
summary:
  Use political influence or the power of state to stop critical social media comments. Government requested/driven content take downs (see Google Transperancy reports.


disarm_id: T0049
tactic_id: TA09
name: Flooding
summary:
  Flooding and/or mobbing social media channels feeds and/or hashtag with excessive volume of content to control/shape online conversations and/or drown out opposing points of view. Bots and/or patriotic trolls are effective tools to acheive this effect. 


disarm_id: T0050
tactic_id: TA09
name: Cheerleading domestic social media ops
summary:
  Deploy state-coordinated social media commenters and astroturfers. Both internal/domestic and external social media influence operations.


disarm_id: T0051
tactic_id: TA09
name: Fabricate social media comment
summary:
  Use government-paid social media commenters, astroturfers, chat bots (programmed to reply to specific key words/hashtags) influence online conversations, product reviews, web-site comment forums.


disarm_id: T0052
tactic_id: TA09
name: Tertiary sites amplify news
summary:
  Create content/news/opinion web-sites to cross-post stories. Tertiary sites circulate and amplify narratives. Often these sites have no masthead, bylines or attribution. 


disarm_id: T0053
tactic_id: TA09
name: Twitter trolls amplify and manipulate
summary:
  Use trolls to amplify narratives and/or manipulate narratives. Fake profiles/sockpuppets operating to support individuals/narratives from the entire political spectrum (left/right binary). Operating with increased emphasis on promoting local content and promoting real Twitter users generating their own, often divisive political content, as it's easier to amplify existing content than create new/original content. Trolls operate where ever there's a socially divisive issue (issues that can/are be politicized).


disarm_id: T0054
tactic_id: TA09
name: Twitter bots amplify
summary:
  Use bots to amplify narratives above algorithm thresholds. Bots are automated/programmed profiles designed to amplify content (ie: automatically retweet or like) and give appearance it's more "popular" than it is. They can operate as a network, to function in a coordinated/orchestrated manner. In some cases (more so now) they are an inexpensive/disposable assets used for minimal deployment as bot detection tools improve and platforms are more responsive.


disarm_id: T0055
tactic_id: TA09
name: Use hashtag
summary:
  Use a dedicated hashtag for the incident - either create a campaign/incident specific hashtag, or take over an existing hashtag.


disarm_id: T0056
tactic_id: TA09
name: Dedicated channels disseminate information pollution
summary:
  Output information pollution (e.g. articles on an unreported false story/event) through channels controlled by or related to the incident creator. 


disarm_id: T0057
tactic_id: TA10
name: Organise remote rallies and events
summary:
  Coordinate and promote real-world events across media platforms, e.g. rallies, protests, gatherings in support of incident narratives. 


disarm_id: T0058
tactic_id: TA11
name: Legacy web content
summary:
  Make incident content visible for a long time, e.g. by exploiting platform terms of service, or placing it where it's hard to remove or unlikely to be removed.


disarm_id: T0059
tactic_id: TA11
name: Play the long game
summary:
  Play the long game can mean a couple of things:
  1. To plan messaging and allow it to grow organically without conducting your own amplification. This is methodical and slow and requires years for the message to take hold
  2. To develop a series of seemingly disconnected messaging narratives that eventually combine into a new narrative.


# example

disarm_id: E000001
object_id: T0002
name: Diba Facebook Expedition
summary:
  2016 Diba Facebook Expedition, coordinated to overcome China’s Great Firewall, to flood the Facebook pages of Taiwanese politicians and news agencies with a pro-PRC message).


disarm_id: E000003
object_id: T0004
name: MH17 competing narratives
summary:
  "Russian Foreign Ministry again claimed that “absolutely groundless accusations are put forward against the Russian side, which are aimed at discrediting Russia in the eyes of the international community" (deny); "The Dutch MH17 investigation is biased, anti-Russian and factually inaccurate" (dismiss). 


disarm_id: E000007
object_id: T0007
name: Paying for access to existing accounts
summary:
  Ukraine elections (2019) circumvent Facebook’s new safeguards by paying Ukrainian citizens to give a Russian agent access to their personal pages. 


disarm_id: E000008
object_id: T0007
name: Avaaz-reported pages and groups
summary:
  EU Elections (2019) Avaaz reported more than 500 suspicious pages and groups to Facebook related to the three-month investigation of Facebook disinformation networks in Europe. 


disarm_id: E000009
object_id: T0007
name: Fakes listed in the US Mueller report
summary:
  Mueller report (2016) The IRA was able to reach up to 126 million Americans on Facebook via a mixture of fraudulent accounts, groups, and advertisements, the report says. Twitter accounts it created were portrayed as real American voices by major news outlets. It was even able to hold real-life rallies, mobilizing hundreds of people at a time in major cities like Philadelphia and Miami. 


disarm_id: E000010
object_id: T0008
name: Denver Guardian
summary:
  A prominent case from the 2016 era was the _Denver Guardian_, which purported to be a local newspaper in Colorado and specialized in negative stories about Hillary Clinton.


disarm_id: E000011
object_id: T0009
name: Jade Helm fake experts
summary:
  For example, in the Jade Helm conspiracy theory promoted by SVR in 2015, a pair of experts--one of them naming himself a “Military Intelligence Analyst / Russian Regional CME” and the other a “Geopolitical Strategist, Journalist & Author”--pushed the story heavily on LinkedIn.


disarm_id: E000012
object_id: T0011
name: White House explosions
summary:
  Syrian Electronic Army (2013) series of false tweets from a hijacked Associated Press Twitter account claiming that President Barack Obama had been injured in a series of explosions near the White House. The false report caused a temporary plunge of 143 points on the Dow Jones Industrial Average.


disarm_id: E000013
object_id: T0012
name: Ten_GOP
summary:
  2016 @TEN_GOP profile where the actual Tennessee Republican Party tried unsuccessfully for months to get Twitter to shut it down, and 2019 Endless Mayfly is an Iran-aligned network of inauthentic personas and social media accounts that spreads falsehoods and amplifies narratives critical of Saudi Arabia, the United States, and Israel.


disarm_id: E000014
object_id: T0014
name: VaccinateUS gofundme
summary:
  2016: #VaccinateUS Gofundme campaigns to pay for Targetted facebook ads (Larry Cook, targetting Washington State mothers, $1,776 to boost posts over 9 months).


disarm_id: E000017
object_id: T0016
name: FBI director rumours
summary:
  2016: "FBI director received millions from Clinton Foundation, his brother’s law firm does Clinton’s taxes”.


disarm_id: E000018
object_id: T0022
name: Qanon conspiracy
summary:
  Example: QAnon: conspiracy theory is an explanation of an event or situation that invokes a conspiracy by sinister and powerful actors, often political in motivation, when other explanations are more probable "


disarm_id: E000021
object_id: T0025
name: Sekondary Infektion
summary:
  2019: DFRLab report "Secondary Infektion” highlights incident with key asset being a forged “letter” created by the operation to provide ammunition for far-right forces in Europe ahead of the election.


disarm_id: E000023
object_id: T0029
name: fake engagement metrics
summary:
  Creating fake engagement metrics of Twitter/Facebook polls to manipulate perception of given issue. 


disarm_id: E000024
object_id: T0044
name: Canadians arrested for spying
summary:
  (2019) China formally arrests Canadians Spavor and Kovrig, accuses them of spying (in retaliation to detention of Hauwei CFO). 


disarm_id: E000025
object_id: T0044
name: Rumour about syrian rebels gassing their own people
summary:
  (2018) The Russian ministry of defence put out a press release, claiming that they had intelligence Syrian rebel forces were about to gas their own people in Idlib province as part of a “false flag” operation to frame the Syrian government.


disarm_id: E000026
object_id: T0047
name: Singapore act
summary:
  2019 Singapore Protection from Online Falsehoods and Manipulation Bill would make it illegal to spread "false statements of fact" in Singapore, where that information is "prejudicial" to Singapore's security or "public tranquility." 


disarm_id: E000027
object_id: T0047
name: Social media cut off in Kashmir
summary:
  India/New Delhi has cut off services to Facebook and Twitter in Kashmir 28 times in the past five years, and in 2016, access was blocked for five months -- on the grounds that these platforms were being used for anti-social and "anti-national" purposes.


disarm_id: E000028
object_id: T0048
name: Rappler
summary:
  Philippines, Maria Ressa and Rappler journalists targeted Duterte regime, lawsuits, trollings, banned from the presidential palace where press briefings take place. 


disarm_id: E000030
object_id: T0049
name: Saudi bots
summary:
  2018: bots flood social media promoting messages which support Saudi Arabia with intent to cast doubt on allegations that the kingdom was involved in Khashoggi’s death.


disarm_id: E000032
object_id: T0050
name: Positive images of China
summary:
  technique used by Chinese English-language social media influence operations are seeded by state-run media, which overwhelmingly present a positive, benign, and cooperative image of China. 


disarm_id: E000033
object_id: T0051
name: FCC comments
summary:
  2017: the FCC was inundated with nearly 22 million public comments on net neutrality (many from fake accounts)


disarm_id: E000034
object_id: T0052
name: Tertiary sites
summary:
  Examples of tertiary sites include Russia Insider, The Duran, geopolitica.ru, Mint Press News, Oriental Review, globalresearch.ca.


disarm_id: E000035
object_id: T0052
name: Star News Digital Media
summary:
  2019, US Domestic news: Snopes reveals Star News Digital Media, Inc. may look like a media company that produces local news, but operates via undisclosed connections to political activism. 


disarm_id: E000036
object_id: T0052
name: Iranian sites including Liberty Front Press
summary:
  (2018) FireEye reports on Iranian campaign that created between April 2018 and March 2019 sites used to spread inauthentic content from websites such as Liberty Front Press (LFP), US Journal, and Real Progressive Front during the 2018 US mid-terms.


disarm_id: E000041
object_id: T0057
name: IRA organising US political rallies
summary:
  (Example) Mueller's report, highlights, the IRA organized political rallies in the U.S. using social media starting in 2015 and continued to coordinate rallies after the 2016 election


disarm_id: E000042
object_id: T0057
name: Facebook groups coordinating public space activities
summary:
  Facebook groups/pages coordinate/more divisive/polarizing groups and actvities into the public space.


# incident

disarm_id: I00005
name: Brexit vote
year_started: 2016
attributions_seen: Russia
found_in_country: UK
objecttype: campaign
summary:
  In early 2014, then UK PM David Cameron outlined the changes he aimed to bring about in the EU and in the UK's relationship with it. These were: additional immigration controls, especially for citizens of new EU member states; tougher immigration rules for present EU citizens; new powers for national parliaments collectively to veto proposed EU laws; new free-trade agreements and a reduction in bureaucracy for businesses; a lessening of the influence of the European Court of Human Rights on British police and courts; more power for individual member states, and less for the central EU; and abandonment of the EU notion of "ever closer union".He intended to bring these about during a series of negotiations with other EU leaders and then, if re-elected, to announce a referendum.
  European Union Referendum Act was passed by the Parliament of the United Kingdom. It extended to include and take legislative effect in Gibraltar,and received royal assent on 17 December 2015.

  Conservative-led Department for Culture, Media and Sport select committee concluded (2018) Russia engaged in ‘unconventional warfare’ during the Brexit campaign. This included ‘156,252 Russian accounts tweeting about #Brexit’ and posting ‘over 45,000 Brexit messages in the last 48 hours of the campaign.’ As it said, Kremlin-controlled media, ‘RT and Sputnik had more reach on Twitter for anti-EU content than either Vote Leave or Leave.EU, during the referendum campaign’.

  The report by Democrats on the Senate foreign relations committee, titled Putin’s asymmetric assault on democracy in Russia and Europe: implications for US national security, pinpoints the way in which UK campaign finance laws do not require disclosure of political donations if they are from “the beneficial owners of non-British companies that are incorporated in the EU and carry out business in the UK”.

  The senators point out that Ukip and its then-leader, Nigel Farage, did not just fan anti-EU sentiment but also “criticised European sanctions on Russia, and provided flattering assessments of Russian President Putin”.

  The report adds that although officially the Russian government asserted its neutrality on Brexit, its English-language media outlets RT and Sputnik covered the referendum campaign extensively and offered ‘’systematically one-sided coverage’’.


disarm_id: I00009
name: PhilippinesExpert
year_started: 2017
attributions_seen: Russia
found_in_country: Philippines
objecttype: incident
summary:
  President of the Philippine visited Moscow and forged ties on information strategy in 2017, and afterwards a series of disinformation campaign was noted in Philippine social media and mainstream media, mostly in favor of Philippine president and promoting Russian propaganda. Among this is the appearance of an unknown-before expert on global affairs who was cited frequently in Russian IRA-connected outlets. 


disarm_id: I00010
name: ParklandTeens
year_started: 2018
attributions_seen: Unknown
found_in_country: USA
objecttype: incident
summary:
  IRA trolls amplified the far right messaging around the attack. Most notably they amplified social media speculation that many of the teens involved were “crisis actors” nefariously injected into the conversation by outside actors with an anti-gun poltical agenda. Other amplifications included ongoing harassment of survivors and claims that the event is a hoax from the right; and fatalist cynicism about gun reform from the left.


disarm_id: I00015
name: ConcordDiscovery
year_started: 2019
attributions_seen: Russia
found_in_country: USA
objecttype: incident
summary:
  The Office of Special Counsel accused Concord Management (an IRA funder/handler) and its counsel of abusing the discovery process by leaking discovery materials under false pretences: the documents were altered; the documents were portrayed as material obtained by hacking, rather than legal process; the released documents are selected to maximize exposure targets and methods. 


disarm_id: I00017
name: US presidential elections
year_started: 2016
attributions_seen: Russia
found_in_country: USA
objecttype: campaign
summary:
  Make Clinton look bad or unpopular, and Trump look good over a long period, to change individuals’ voting intentions. 


disarm_id: I00019
name: MacronTiphaine
year_started: 2017
found_in_country: France
objecttype: incident
summary:
  Far-right trolls on 4chan and Twitter spreading misinformation about French candidate Macron and spur support for rival candidate Le Pen.


disarm_id: I00025
name: EU Army
year_started: 2018
attributions_seen: Russia
found_in_country: EU
objecttype: incident
summary:
  Traces back to 2016: Guardian “Is there a secret plan to create an EU army?” French President Emmanuel Macron has warned that Europeans cannot be protected without a "true, European army", as he marks the centenary of the World War One Armistice. On a visit to the former Western Front in Verdun, he said Russia had shown it could be a threat and Europe had to be able "to defend itself better alone". German Chancellor Angela Merkel backed the idea of an intervention force in June, but said it would have to be part of "the structure of defence co-operation".

  Verdict: “An EU army marching out to war under Brussels’ command is a fantasy shared by Eurosceptics and a small number of federalists. Europe will continue down the road of defence cooperation in a halting way, but an EU army is only for armchair generals.”


disarm_id: I00029
name: MH17 investigation
year_started: 2016
attributions_seen: Russia
found_in_country: Ukraine
objecttype: campaign
summary:
  Since the shooting down of Malaysia Airlines Flight 17 (MH17) a scheduled passenger flight from Amsterdam to Kuala Lumpur on 17 July 2014 while flying over eastern Ukraine, killing all 283 passengers and 15 crew on board… wreckage of the aircraft fell near Hrabove in Donetsk Oblast, Ukraine, 40 km (25 mi) from the border.The shoot-down occurred in the War in Donbass, during the Battle of Shakhtarsk, in an area controlled by pro-Russian rebels. This has proven to be an ongoing example of Russia and their proxies ability to wage a disinformation campaign, and exemplify the use of the 4 D’s (dismiss, distort, distract, and dismay) 


disarm_id: I00032
name: Kavanaugh
year_started: 2018
attributions_seen: Russia
found_in_country: USA
objecttype: incident
summary:
  Before the Senate SCOTUS confirmation hearings of Brett Kavanaugh, professor Christine Blasey Ford--first anonymously, then publicly--accused Kavanaugh of inappropriate or criminal sexual behavior. Amplified by Russian trolls Right wing operatives first tried to doxx Ford, then to discredit her. Many observers suggest that the Kavanaugh hearings were the largest anti-US Russian online operation for months. 


disarm_id: I00033
name: China 50cent Army
year_started: 2014
attributions_seen: China
found_in_country: China
objecttype: apt
summary:
  50cent Army is a CCP “tool” - “massive secret operation” in China pumping out an estimated 488 million fabricated social media posts per year, part of an effort to “regularly distract the public and change the subject” from any policy-related issues that threaten to anger citizens enough to turn them out onto the streets. But the research finds no evidence these 50-centers are, in fact, paid 50 cents, nor does it find they engage in direct and angry argument with their opponents. Instead, they are mostly bureaucrats already on the public payroll, responding to government directives at a time of heightened tension to flood social media with pro-government cheerleading.


disarm_id: I00034
name: DibaFacebookExpedition
year_started: 2016
attributions_seen: China
found_in_country: Taiwan
objecttype: incident
summary:
  In the Expedition, Diba engaged in a highly organized cyber-attack of a Taiwanese political leader. On January 20, 2016 (the day of President Tsai Ing-wen’s inauguration) featuring the posting of an overwhelming number of social media comments in support of a PRC-sanctioned message. Netizens from one of the largest discussion forums in China, known as Diba, coordinated to overcome China’s Great Firewall to flood the Facebook pages of Taiwanese politicians and news agencies with a pro-PRC message, a cyberattack referred to as the “Diba Expedition to Facebook.” 

  Unique for taking place outside of the Chinese Internet system, both transgressing technical and political norms while exposing their actions to an international audience. In spite of the transgressive nature of the action, “Diba Expedition” was highly praised by Chinese official media, in contrast to comparable activities in the past that lacked its explicit pro-government ideology. Yet—reflecting the complexity of Diba’s relationship with the PRC government—the Expedition was shut down after a few days.


disarm_id: I00039
name: MerkelFacebook
year_started: 2017
attributions_seen: Unknown
found_in_country: Germany
objecttype: incident
summary:
  Top stories about Merkel in both German and English were negative and misleading, most published from fake news sites.


disarm_id: I00042
name: Saudi/Qatar bot dispute
year_started: 2017
attributions_seen: SaudiArabia
found_in_country: Qatar
objecttype: incident
summary:
  In the summer of 2017, Twitter bots—automated accounts—were deployed to boost messaging on both sides of the diplomatic dispute between Saudi Arabia and Qatar.” Calling this a “diplomatic dispute” understates the complexity of regional dynamics, at the center is an alleged report that Qatar’s emir, Sheikh Tamim bin Hamad al-Thani, had made an astonishing speech, and alleged “hack” of Qatar’s official news agency, and further woven into concerns Saudi Arabia has about the influence of public perception, the role of Al Jazeera. 


disarm_id: I00044
name: JadeHelm exercise
year_started: 2015
attributions_seen: Russia
found_in_country: USA
objecttype: incident
summary:
  In the summer of 2015, thousands of troops from the US Army Special Operations command conducted and multi-state, weeks-long training operation across the southwest. Russian trolls amplified conspiracy theories promoted by far right media operatives such as Alex Jones, specifically: the Jade Helm 15 exercise was a precursor to domestic invasion and subsequent martial law by the Obama Administration in coordination with China. Some versions have deus ex machina such as an asteroid strike. Ultimately the Governor of Texas, Greg Abbot, was forced to speak out on the conspiracy theory, but he hedged on Obama’s motives.


disarm_id: I00045
name: Skripal
year_started: 2018
attributions_seen: Russia
found_in_country: UK
objecttype: incident
summary:
  On 4 March 2018, Sergei Skripal, a former Russian military officer and double agent for the UK's intelligence services, and his daughter Yulia Skripal were poisoned in Salisbury, England, with a Novichok nerve agent known as A-234, according to official UK sources and the Organisation for the Prohibition of Chemical Weapons (OPCW)


disarm_id: I00047
name: Sea of Azov
year_started: 2018
attributions_seen: Russia
found_in_country: World
objecttype: incident
summary:
  An international incident occurred on 25 November 2018 when the Russian Federal Security Service (FSB) coast guard fired upon and captured three Ukrainian Navy vessels attempting to pass from the Black Sea into the Sea of Azov through the Kerch Strait on their way to the port of Mariupol. In 2014, Russia had annexed the nearby Crimean Peninsula, which is dominantly internationally recognised as Ukrainian territory. It later constructed the Crimean Bridge across the strait. Under a 2003 treaty, the strait and the Azov Sea are intended to be the shared territorial waters of both countries, and freely accessible.
  The Russian Federal Security Service (FSB), which is also responsible for border protection, claims that the ships illegally entered Russian waters. The FSB alleges that crews did not comply with demands to stop. In the scuffle, a Russian border patrol ship rammed and damaged a Ukrainian Navy tugboat. Russian forces later seized all three Ukrainian ships, confiscating them for violating Russia's border. Six Ukrainian navy soldiers were injured, the Ukrainian navy reported. 


disarm_id: I00049
name: White Helmets: Chemical Weapons
year_started: 2017
attributions_seen: Russia
found_in_country: World
objecttype: incident
summary:
  On 7 April 2018, a high number of civilians were killed in the besieged Syrian city of Douma, with evidence pointing towards another chemical attack by the regime, according to the EU. Subsequent to this event, a series of images "prove" that the White Helmets "staged" the chemical attack in Syria.


disarm_id: I00050
name: #HandsOffVenezuela
year_started: 2019
attributions_seen: Russia
found_in_country: World
objecttype: incident
summary:
  Venezuela has been thrown into turmoil after Guaidó declared himself interim president Jan. 23. The 35-year-old president of the National Assembly says Venezuela's constitution grants him power to take control of the government because Maduro was re-elected last year by fraud. Guaidó has called for Maduro to leave office and call new elections.

  More than 50 nations, including the United States and most of Latin America, concluded that Maduro's re-election last year was a fraud. They have recognized Juan Guaidó, president of the opposition-led National Assembly, as Venezuela's legitimate head of state, endorsing his mission to establish a transitional government and hold fresh elections.
  Maduro has remained defiant in the face of domestic and international pressure, securing the support of the governments of Iran and Russia, as well as the loyalty of the Venezuelan military.


disarm_id: I00051
name: Integrity Initiative
year_started: 2018
attributions_seen: Russia
found_in_country: World
objecttype: incident
summary:
  The UK Foreign Office has accused Russian state media of trying to discredit a government-funded body that works to counter Kremlin disinformation. A spokesperson said the Institute for Statecraft was hacked several weeks ago and documents were "published and amplified by Kremlin news channels".
  The FCO comments on the IfS were issued after a news report said the group had retweeted stories critical of Labour. Western officials believe the group involved in the hack is linked to the Russian state. Since then internal documents have been leaked to the Russian media about the organisation's activities, including lists of journalists it had contacted. The Foreign Office has provided £2.2m in funding to the institute over the last two years supported its work to counter disinformation overseas and not in the UK


disarm_id: I00053
name: China Huawei CFO Arrest
year_started: 2018
attributions_seen: China
found_in_country: World
objecttype: incident
summary:
  Dec. 1: Canadian authorities arrest Huawei's chief financial officer Meng Wanzhou at Vancouver’s airport while she is en route from Hong Kong to Mexico, after an extradition request from the Americans. The news becomes public on Dec. 5. Dec. 7: In Vancouver, Meng appears in court, where allegations of fraud are laid out. The U.S. alleges Meng misled American banks in a bid to get around American sanctions on Iran. 
  Geopolitically complex issue combines US/China trade; Security concerns/issues related to Huawei’s 5G wireless equipment; diplomacy between Canada & China as Chinese subsequently arrest Canadian citizens.


disarm_id: I00056
name: Iran Influence Operations
year_started: 2012
attributions_seen: Iran
found_in_country: World
objecttype: campaign
summary:
  Iranian interference in the politics of Arab countries has become more self-evident since the Arab Spring of 2011. Iran has been trying to widen its influence in the region in a political confrontation with Saudi Arabia. Factor long-held hostility to US (Iran as a member of the “Axis of Evil”) & Isreal; it’s funding of proxies (Hezbolla) and Shia militia’s in Iraq; and most recently having the Revolutionary Guard being designated a terror organization; the seeming collapse of the Joint Comprehensive Plan of Action (nuclear programme) and expanding economic sanctions all add up to an increased likihood of Iran expanding their information operations.
  While there is history to Iran’s information/influence operations, starting with FireEye’s report about Iranian “fake news” websites, and subsequent reports by DFRLab (Jan 31, 2019 and March 26, 2019) we have strong document proof and assets that highlight Iran’s activities.


disarm_id: I00063
name: Olympic Doping Scandal
year_started: 2016
attributions_seen: Russia
found_in_country: World
objecttype: campaign
summary:
  On 18 July 2016, Richard McLaren, a Canadian attorney retained by WADA to investigate Grigor Rodchenkov (the former head of Russia's national anti-doping laboratory, the Anti-Doping Center, which was suspended by the World Anti-Doping Agency (WADA) in November 2015 for facilitating Russia's elaborate state-sponsored doping program. Rodchenkov helped develop and distribute banned performance-enhancing substances for thousands of Russian Olympians from 2005 to 2015. He made headlines in 2016 as a whistleblower, helping expose the complex and extensive nature of Russia's doping program. His revelations lead to Russia's partial ban from the 2016 Summer Olympics and total ban from the 2018 Winter Olympics.). These allegations led to a 97-page report covering significant state-sponsored doping in Russia. 

  The investigation found corroborating evidence after conducting witness interviews, reviewing thousands of documents, analysis of hard drives, forensic analysis of urine sample collection bottles, and laboratory analysis of individual athlete samples, with "more evidence becoming available by the day." The report concluded that it was shown "beyond a reasonable doubt" that Russia's Ministry of Sport, the Centre of Sports Preparation of the National Teams of Russia, the Federal Security Service (FSB), and the WADA-accredited laboratory in Moscow had "operated for the protection of doped Russian athletes" within a "state-directed failsafe system" using "the disappearing positive [test] methodology" (DPM) after the country's poor medal count during the 2010 Winter Olympic Games in Vancouver. McLaren stated that urine samples were opened in Sochi in order to swap them "without any evidence to the untrained eye". The official producer of BEREG-KIT security bottles used for anti-doping tests, Berlinger Group, stated, "We have no knowledge of the specifications, the methods or the procedures involved in the tests and experiments conducted by the McLaren Commission."


# tool

disarm_id: TL00052
name: Ghostery
externalgroup: Ghostery
category: Browser Plugin
url:
  https://chrome.google.com/webstore/detail/ghostery-%E2%80%93-privacy-ad-blo/mlomiejdfkolichcflejclcbmpeaniij


disarm_id: TL00090
name: Opensanctions
externalgroup: Opensanctions
url: https://www.opensanctions.org/
category: Corporate/Business Tools
function:
  Global database of persons and companies of political, criminal, or economic interest. It combines the most important sanctions lists, databases of politically exposed persons etc


disarm_id: TL00033
name: e-witness
externalgroup: CUNY
url: https://ewitness.commons.gc.cuny.edu/
category: Image analysis
disinformation_use: Potentially useful
function: image provenance
artifacts: images
summary:
  eWitness uses blockchain to establish provenance of images and videos taken from a smart phone camera. eWitness can be used to gather evidence of crime, human rights violation, domestic violence, corruption, traffic violations and more. An eWitness user is protected behind a pseudo-identity which is hidden even from the eWitness backend, until the user is ready to reveal themselves or to quietly pass the evidence on to their case-worker, trusted friend or sponsor. The purpose of eWitness is to create images and videos that can be trusted. The technology behind eWitness, provides the proof of location and time the media was taken and the proof that the media was not altered to misinform or deform the fact in any manner.


disarm_id: TL00139
name: Twren
url: https://twren.ch/
category: Social Media Search and Account Analysis
function:
  Tool that lists the accounts that retweeted a specific account, with lots of sorting and filtering options


disarm_id: TL00030
name: DNSlytics
url: https://dnslytics.com/
category: Website Analysis
function:
  DNSlytics is another great tool for connecting websites together via AdSense, Google Analytics, IP etc. Reasonably-priced paid verison, too


disarm_id: TL00099
name: Publicwww
url: https://publicwww.com/
category: Website Analysis
function:
  Publicwww, search to see how many websites have the same source code or snippet of text (looks in HTML, JS and CSS code as well as webpages)


disarm_id: TL00140
name: URLScan
url: https://urlscan.io/
category: Website Analysis
function:
  URLScan is a free tool that gives an overview of a site, the tools used to build it, and other useful info


disarm_id: TL00018
name: Check browser add-on
externalgroup: Meedan
url: https://chrome.google.com/webstore/detail/check/pjfgpbclkfjkfiljlcfehjmpafeoafdi?hl=en
category: Analysis tracking and support
disinformation_use: Designed for disinfo
artifacts: artifacts
platform: browser extension
summary:
  Browse the internet, and find a Tweet, YouTube video, Facebook post or an Instagram photo that you want your team to fact-check and investigate. Click the Check icon, choose one of the projects you want to add this item to, and save it


disarm_id: TL00034
name: Emergent
externalgroup: Columbia University: Tow Center
url: http://www.emergent.info/about
disinformation_use: Designed for disinfo
function: rumor tracker
summary:
  Emergent is a real-time rumor tracker. It's part of a research project with the Tow Center for Digital Journalism at Columbia University that focuses on how unverified information and rumor are reported in the media. It aims to develop best practices for debunking misinformation.


disarm_id: TL00040
name: Feed Reflect (browser extension)
url: https://chrome.google.com/webstore/detail/feedreflect/bigmeipgaifggglelcnpnpbaefimpooc?hl=en-US
disinformation_use: Potentially useful
platform: browser extension
summary:
  Browser extension designed to promote awareness when reading news on Twitter. This browser extension changes twitter feed by making posts more or less visible and help users distinguish news with differing level of reliability. 


disarm_id: TL00053
name: Giant Language Model Test Room (GLTR)
url: http://gltr.io
disinformation_use: Designed for disinfo
function: text forensics
artifacts: text
summary:
  The aim of GLTR is to take the same models that are used to generated fake text as a tool for detection. GLTR has access to the GPT-2 117M language model from OpenAI, one of the largest publicly available models. It can use any textual input and analyze what GPT-2 would have predicted at each position. Since the output is a ranking of all of the words that the model knows, we can compute how the observed following word ranks. We use this positional information to overlay a colored mask over the text that corresponds to the position in the ranking. A word that ranks within the most likely words is highlighted in green (top 10), yellow (top 100), red (top 1,000), and the rest of the words in purple. Thus, we can get a direct visual indication of how likely each word was under the model.


disarm_id: TL00094
name: PimEyes: Face Recognition Search Engine and Reverse Image Search
externalgroup: PimEyes
url: https://pimeyes.com/en
function:
  Advanced face recognition search engine, a reverse image search tool, and a photo search mechanism used to find out where your face appears online


disarm_id: TL00123
name: TIES
externalgroup: Facebook
disinformation_use: Designed for disinfo
accessibility: closed
url:
  https://www.socialmediatoday.com/news/facebook-outlines-new-system-for-detecting-fake-accounts-and-misinformation/584228/


# incident_technique

disarm_id: IT00000044
incident_id: I00010
technique_id: T0010
name:
  cultivate, manipulate, exploit useful idiots (Alex Jones... drives conspiracy theories; false flags, crisis actors)


disarm_id: IT00000026
name: Fake video/images
incident_id: I00006
technique_id: T0024
summary:
  Fake youtube video of ISIS claiming responsibility for the chemical attack. Faked screenshot of local newspaper website article on the explosion. 


disarm_id: IT00000040
incident_id: I00009
technique_id: T0052
name:
  News circulated/amplifed by tertiary sites (Russia Insider, The Duran, Geopolitica.ru, Mint Press News, Oriental Review, globalresearch.ca)


disarm_id: IT00000081
incident_id: I00029
technique_id: T0001
name:
  4 D's (dismiss, distort, distract, dismay...Official channels ie: Embassies & Defence Ministry; TASS


disarm_id: IT00000129
incident_id: I00047
technique_id: T0001
name:
  Russian FSB security service blamed Ukraine for sparking the clashes, saying their "irrefutable" evidence would "soon be made public


disarm_id: IT00000168
incident_id: I00053
technique_id: T0001
name:
  Chinese ambassador Lu Shaye accused Canada of applying a double standard, and has decried what he sees as “Western egotism and white supremacy” in the treatment of detained Huawei executive Meng Wanzhou.” 


disarm_id: IT00000179
incident_id: I00063
technique_id: T0001
name:
  4 D's (dismiss, distort, distract, dismay...Official channels ie: Putin himself; Embassies & Sports Ministry; TASS


disarm_id: IT00000107
incident_id: I00033
technique_id: T0050
name:
  domestic social media influence operations focus primarily on “cheerleading” or presenting or furthering a positive narrative about the Chinese state


disarm_id: IT00000111
incident_id: I00034
technique_id: T0002
name:
  Netizens from one of the largest discussion forums in China, known as Diba, coordinated to overcome China’s Great Firewall


disarm_id: IT00000130
incident_id: I00047
technique_id: T0023
name:
  (Distort) Kremlin-controlled RT cited Russian Minister of Foreign Affairs Sergei Lavrov suggesting that Ukraine deliberately provoked Russia in hopes of gaining additional support from the United States and Europe.


