DISARMframeworks/DISARM_MASTER_DATA/techniques.csv

1	disarm_id	name	name_DE	tactic_id	summary	summary_DE	changes from v0.1	longname
2	T0002	Facilitate State Propaganda		TA02	Organize citizens around pro-state messaging. Coordinate paid or volunteer groups to push state propaganda.		no change	T0002 - Facilitate State Propaganda
3	T0003	Leverage Existing Narratives		TA14	Use or adapt existing narrative themes, where narratives are the baseline stories of a target audience. Narratives form the bedrock of our worldviews. New information is understood through a process firmly grounded in this bedrock. If new information is not consitent with the prevailing narratives of an audience, it will be ignored. Effective campaigns will frame their misinformation in the context of these narratives. Highly effective campaigns will make extensive use of audience-appropriate archetypes and meta-narratives throughout their content creation and amplifiction practices.		no change	T0003 - Leverage Existing Narratives
4	T0004	Develop Competing Narratives		TA14	Advance competing narratives connected to same issue ie: on one hand deny incident while at same time expresses dismiss. Suppressing or discouraging narratives already spreading requires an alternative. The most simple set of narrative techniques in response would be the construction and promotion of contradictory alternatives centered on denial, deflection, dismissal, counter-charges, excessive standards of proof, bias in prohibition or enforcement, and so on. These competing narratives allow loyalists cover, but are less compelling to opponents and fence-sitters than campaigns built around existing narratives or highly explanatory master narratives. Competing narratives, as such, are especially useful in the "firehose of misinformation" approach.		no change	T0004 - Develop Competing Narratives
5	T0007	Create Inauthentic Social Media Pages and Groups		TA15	Create key social engineering assets needed to amplify content, manipulate algorithms, fool public and/or specific incident/campaign targets. Computational propaganda depends substantially on false perceptions of credibility and acceptance. By creating fake users and groups with a variety of interests and commitments, attackers can ensure that their messages both come from trusted sources and appear more widely adopted than they actually are.		no change	T0007 - Create Inauthentic Social Media Pages and Groups
6	T0009	Create fake experts		TA16	Stories planted or promoted in computational propaganda operations often make use of experts fabricated from whole cloth, sometimes specifically for the story itself.		no change	T0009 - Create fake experts
7	T0009.001	Utilize Academic/Pseudoscientific Justifications		TA16	Utilize Academic/Pseudoscientific Justifications		no change	Utilize Academic/Pseudoscientific Justifications -
8	T0010	Cultivate ignorant agents		TA15	Cultivate propagandists for a cause, the goals of which are not fully comprehended, and who are used cynically by the leaders of the cause. Independent actors use social media and specialised web sites to strategically reinforce and spread messages compatible with their own. Their networks are infiltrated and used by state media disinformation organisations to amplify the state’s own disinformation strategies against target populations. Many are traffickers in conspiracy theories or hoaxes, unified by a suspicion of Western governments and mainstream media. Their narratives, which appeal to leftists hostile to globalism and military intervention and nationalists against immigration, are frequently infiltrated and shaped by state-controlled trolls and altered news items from agencies such as RT and Sputnik. Also know as "useful idiots" or "unwitting agents".		no change	T0010 - Cultivate ignorant agents
9	T0011	Compromise legitimate accounts		TA16	Hack or take over legimate accounts to distribute misinformation or damaging content.		no change	T0011 - Compromise legitimate accounts
10	T0013	Create inauthentic websites		TA15	Create media assets to support inauthentic organizations (e.g. think tank), people (e.g. experts) and/or serve as sites to distribute malware/launch phishing operations.		no change	T0013 - Create inauthentic websites
11	T0014	Prepare fundraising campaigns		TA15	Fundraising campaigns refer to an influence operation’s systematic effort to seek financial support for a charity, cause, or other enterprise using online activities that further promote operation information pathways while raising a profit. Many influence operations have engaged in crowdfunding services on platforms including Tipee, Patreon, and GoFundMe. An operation may use its previously prepared fundraising campaigns (see: Develop Information Pathways) to promote operation messaging while raising money to support its activities.		no change	T0014 - Prepare fundraising campaigns
12	T0014.001	Raise funds from malign actors		TA15	Raising funds from malign actors may include contributions from foreign agents, cutouts or proxies, shell companies, dark money groups, etc.		no change	Raise funds from malign actors -
13	T0014.002	Raise funds from ignorant agents		TA15	Raising funds from ignorant agents may include scams, donations intended for one stated purpose but then used for another, etc.		no change	Raise funds from ignorant agents -
14	T0015	Create hashtags and search artifacts		TA06	Create one or more hashtags and/or hashtag groups. Many incident-based campaigns will create hashtags to promote their fabricated event. Creating a hashtag for an incident can have two important effects: 1. Create a perception of reality around an event. Certainly only "real" events would be discussed in a hashtag. After all, the event has a name!, and 2. Publicize the story more widely through trending lists and search behavior. Asset needed to direct/control/manage "conversation" connected to launching new incident/campaign with new hashtag for applicable social media sites).		no change	T0015 - Create hashtags and search artifacts
15	T0016	Create Clickbait		TA05	Create attention grabbing headlines (outrage, doubt, humor) required to drive traffic & engagement. This is a key asset.		no change	T0016 - Create Clickbait
16	T0017	Conduct fundraising		TA10	Fundraising campaigns refer to an influence operation’s systematic effort to seek financial support for a charity, cause, or other enterprise using online activities that further promote operation information pathways while raising a profit. Many influence operations have engaged in crowdfunding services166 on platforms including Tipee, Patreon, and GoFundMe. An operation may use its previously prepared fundraising campaigns to promote operation messaging while raising money to support its activities.		no change	T0017 - Conduct fundraising
17	T0017.001	Conduct Crowdfunding Campaigns		TA10	An influence operation may Conduct Crowdfunding Campaigns on platforms such as GoFundMe, GiveSendGo, Tipeee, Patreon, etc.		no change	Conduct Crowdfunding Campaigns -
18	T0018	Purchase Targeted Advertisements		TA05	Create or fund advertisements targeted at specific populations		no change	T0018 - Purchase Targeted Advertisements
19	T0019	Generate information pollution		TA06	Flood social channels; drive traffic/engagement to all assets; create aura/sense/perception of pervasiveness/consensus (for or against or both simultaneously) of an issue or topic. "Nothing is true, but everything is possible." Akin to astroturfing campaign.		no change	T0019 - Generate information pollution
20	T0019.001	Create fake research		TA06	Create fake academic research. Example: fake social science research is often aimed at hot-button social issues such as gender, race and sexuality. Fake science research can target Climate Science debate or pseudoscience like anti-vaxx		no change	Create fake research -
21	T0019.002	Hijack Hashtags		TA06	Hashtag hijacking occurs when users “[use] a trending hashtag to promote topics that are substantially different from its recent context” (VanDam and Tan, 2016) or “to promote one’s own social media agenda” (Darius and Stephany, 2019).		no change	Hijack Hashtags -
22	T0020	Trial content		TA08	Iteratively test incident performance (messages, content etc), e.g. A/B test headline/content enagagement metrics; website and/or funding campaign conversion rates		no change	T0020 - Trial content
23	T0022	Leverage Conspiracy Theory Narratives		TA14	"Conspiracy narratives" appeal to the human desire for explanatory order, by invoking the participation of poweful (often sinister) actors in pursuit of their own political goals. These narratives are especially appealing when an audience is low-information, marginalized or otherwise inclined to reject the prevailing explanation. Conspiracy narratives are an important component of the "firehose of falsehoods" model.		no change	T0022 - Leverage Conspiracy Theory Narratives
24	T0022.001	Amplify Existing Conspiracy Theory Narratives		TA14	An influence operation may amplify an existing conspiracy theory narrative that aligns with its incident or campaign goals. By amplifying existing conspiracy theory narratives, operators can leverage the power of the existing communities that support and propagate those theories without needing to expend resources creating new narratives or building momentum and buy in around new narratives.		no change	Amplify Existing Conspiracy Theory Narratives -
25	T0022.002	Develop Original Conspiracy Theory Narratives		TA14	While this requires more resources than amplifying existing conspiracy theory narratives, an influence operation may develop original conspiracy theory narratives in order to achieve greater control and alignment over the narrative and their campaign goals. Prominent examples include the USSR's Operation INFEKTION disinformation campaign run by the KGB in the 1980s to plant the idea that the United States had invented HIV/AIDS as part of a biological weapons research project at Fort Detrick, Maryland. More recently, Fort Detrick featured prominently in a new conspiracy theory narratives around the origins of the COVID-19 outbreak and pandemic.		no change	Develop Original Conspiracy Theory Narratives -
26	T0023	Distort facts		TA06	Change, twist, or exaggerate existing facts to construct a narrative that differs from reality. Examples: images and ideas can be distorted by being placed in an improper content		no change	T0023 - Distort facts
27	T0023.001	Reframe Context		TA06	Reframing context refers to removing an event from its surrounding context to distort its intended meaning. Rather than deny that an event occurred, reframing context frames an event in a manner that may lead the target audience to draw a different conclusion about its intentions.		no change	Reframe Context -
28	T0023.002	Edit Open-Source Content		TA06	An influence operation may edit open-source content, such as collaborative blogs or encyclopedias, to promote its narratives on outlets with existing credibility and audiences. Editing open-source content may allow an operation to post content on platforms without dedicating resources to the creation and maintenance of its own assets.		no change	Edit Open-Source Content -
29	T0029	Online polls		TA07	Create fake online polls, or manipulate existing online polls. Data gathering tactic to target those who engage, and potentially their networks of friends/followers as well		no change	T0029 - Online polls
30	T0039	Bait legitimate influencers		TA08	Credibility in a social media environment is often a function of the size of a user's network. "Influencers" are so-called because of their reach, typically understood as: 1) the size of their network (i.e. the number of followers, perhaps weighted by their own influence); and 2) The rate at which their comments are re-circulated (these two metrics are related). Add traditional media players at all levels of credibility and professionalism to this, and the number of potential influencial carriers available for unwitting amplification becomes substantial. By targeting high-influence people and organizations in all types of media with narratives and content engineered to appeal their emotional or ideological drivers, influence campaigns are able to add perceived credibility to their messaging via saturation and adoption by trusted agents such as celebrities, journalists and local leaders.		no change	T0039 - Bait legitimate influencers
31	T0040	Demand insurmountable proof		TA14	Campaigns often leverage tactical and informational asymmetries on the threat surface, as seen in the Distort and Deny strategies, and the "firehose of misinformation". Specifically, conspiracy theorists can be repeatedly wrong, but advocates of the truth need to be perfect. By constantly escalating demands for proof, propagandists can effectively leverage this asymmetry while also priming its future use, often with an even greater asymmetric advantage. The conspiracist is offered freer rein for a broader range of "questions" while the truth teller is burdened with higher and higher standards of proof.		no change	T0040 - Demand insurmountable proof
32	T0042	Seed Kernel of truth		TA08	Wrap lies or altered context/facts around truths. Influence campaigns pursue a variety of objectives with respect to target audiences, prominent among them: 1. undermine a narrative commonly referenced in the target audience; or 2. promote a narrative less common in the target audience, but preferred by the attacker. In both cases, the attacker is presented with a heavy lift. They must change the relative importance of various narratives in the interpretation of events, despite contrary tendencies. When messaging makes use of factual reporting to promote these adjustments in the narrative space, they are less likely to be dismissed out of hand; when messaging can juxtapose a (factual) truth about current affairs with the (abstract) truth explicated in these narratives, propagandists can undermine or promote them selectively. Context matters.		no change	T0042 - Seed Kernel of truth
33	T0043	Chat apps		TA07	Direct messaging via chat app is an increasing method of delivery. These messages are often automated and new delivery and storage methods make them anonymous, viral, and ephemeral. This is a difficult space to monitor, but also a difficult space to build acclaim or notoriety.		no change	T0043 - Chat apps
34	T0043.001	Use Encrypted Chat Apps		TA07	Examples include Signal, WhatsApp, Discord, Wire, etc.		no change	Use Encrypted Chat Apps -
35	T0043.002	Use Unencrypted Chats Apps		TA07	Examples include SMS, etc.		no change	Use Unencrypted Chats Apps -
36	T0044	Seed distortions		TA08	Try a wide variety of messages in the early hours surrounding an incident or event, to give a misleading account or impression.		no change	T0044 - Seed distortions
37	T0045	Use fake experts		TA08	Use the fake experts that were set up during Establish Legitimacy. Pseudo-experts are disposable assets that often appear once and then disappear. Give "credility" to misinformation. Take advantage of credential bias		no change	T0045 - Use fake experts
38	T0046	Use Search Engine Optimization		TA08	Manipulate content engagement metrics (ie: Reddit & Twitter) to influence/impact news search results (e.g. Google), also elevates RT & Sputnik headline into Google news alert emails. aka "Black-hat SEO"		no change	T0046 - Use Search Engine Optimization
39	T0047	Censor social media as a political force		TA18	Use political influence or the power of state to stop critical social media comments. Government requested/driven content take downs (see Google Transperancy reports).		no change	T0047 - Censor social media as a political force
40	T0048	Harass		TA18	Threatening or harassing believers of opposing narratives refers to the use of intimidation techniques, including cyberbullying and doxing, to discourage opponents from voicing their dissent. An influence operation may threaten or harass believers of the opposing narratives to deter individuals from posting or proliferating conflicting content.		no change	T0048 - Harass
41	T0048.001	Boycott/"Cancel" Opponents		TA18	Cancel culture refers to the phenomenon in which individuals collectively refrain from supporting an individual, organization, business, or other entity, usually following a real or falsified controversy. An influence operation may exploit cancel culture by emphasizing an adversary’s problematic or disputed behavior and presenting its own content as an alternative.		no change	Boycott/"Cancel" Opponents -
42	T0048.002	Harass People Based on Identities		TA18	Examples include social identities like gender, sexuality, race, ethnicity, religion, ability, nationality, etc. as well as roles and occupations like journalist or activist.		no change	Harass People Based on Identities -
43	T0048.003	Threaten to Dox		TA18	Doxing refers to online harassment in which individuals publicly release private information about another individual, including names, addresses, employment information, pictures, family members, and other sensitive information. An influence operation may dox its opposition to encourage individuals aligned with operation narratives to harass the doxed individuals themselves or otherwise discourage the doxed individuals from posting or proliferating conflicting content.		no change	Threaten to Dox -
44	T0048.004	Dox		TA18	Doxing refers to online harassment in which individuals publicly release private information about another individual, including names, addresses, employment information, pictures, family members, and other sensitive information. An influence operation may dox its opposition to encourage individuals aligned with operation narratives to harass the doxed individuals themselves or otherwise discourage the doxed individuals from posting or proliferating conflicting content.		no change	Dox -
45	T0049	Flooding the Information Space		TA17	Flooding and/or mobbing social media channels feeds and/or hashtag with excessive volume of content to control/shape online conversations and/or drown out opposing points of view. Bots and/or patriotic trolls are effective tools to acheive this effect.		no change	T0049 - Flooding the Information Space
46	T0049.001	Trolls amplify and manipulate		TA17	Use trolls to amplify narratives and/or manipulate narratives. Fake profiles/sockpuppets operating to support individuals/narratives from the entire political spectrum (left/right binary). Operating with increased emphasis on promoting local content and promoting real Twitter users generating their own, often divisive political content, as it's easier to amplify existing content than create new/original content. Trolls operate where ever there's a socially divisive issue (issues that can/are be politicized).		no change	Trolls amplify and manipulate -
47	T0049.002	Hijack existing hashtag		TA17	Take over an existing hashtag to drive exposure.		no change	Hijack existing hashtag -
48	T0049.003	Bots Amplify via Automated Forwarding and Reposting		TA17	Automated forwarding and reposting refer to the proliferation of operation content using automated means, such as artificial intelligence or social media bots. An influence operation may use automated activity to increase content exposure without dedicating the resources, including personnel and time, traditionally required to forward and repost content. Use bots to amplify narratives above algorithm thresholds. Bots are automated/programmed profiles designed to amplify content (ie: automatically retweet or like) and give appearance it's more "popular" than it is. They can operate as a network, to function in a coordinated/orchestrated manner. In some cases (more so now) they are an inexpensive/disposable assets used for minimal deployment as bot detection tools improve and platforms are more responsive.		no change	Bots Amplify via Automated Forwarding and Reposting -
49	T0049.004	Utilize Spamoflauge		TA17	Spamoflauge refers to the practice of disguising spam messages as legitimate. Spam refers to the use of electronic messaging systems to send out unrequested or unwanted messages in bulk. Simple methods of spamoflauge include replacing letters with numbers to fool keyword-based email spam filters, for example, "you've w0n our jackp0t!". Spamoflauge may extend to more complex techniques such as modifying the grammar or word choice of the language, casting messages as images which spam detectors cannot automatically read, or encapsulating messages in password protected attachments, such as .pdf or .zip files. Influence operations may use spamoflauge to avoid spam filtering systems and increase the likelihood of the target audience receiving operation messaging.		no change	Utilize Spamoflauge -
50	T0049.005	Conduct Swarming		TA17	Swarming refers to the coordinated use of accounts to overwhelm the information space with operation content. Unlike information flooding, swarming centers exclusively around a specific event or actor rather than a general narrative. Swarming relies on “horizontal communication” between information assets rather than a top-down, vertical command-and-control approach.		no change	Conduct Swarming -
51	T0049.006	Conduct Keyword Squatting		TA17	Keyword squatting refers to the creation of online content, such as websites, articles, or social media accounts, around a specific search engine-optimized term to overwhelm the search results of that term. An influence may keyword squat to increase content exposure to target audience members who query the exploited term in a search engine and manipulate the narrative around the term.		no change	Conduct Keyword Squatting -
52	T0049.007	Inauthentic Sites Amplify News and Narratives		TA17	Inauthentic sites circulate cross-post stories and amplify narratives. Often these sites have no masthead, bylines or attribution.		no change	Inauthentic Sites Amplify News and Narratives -
53	T0057	Organize Events		TA10	Coordinate and promote real-world events across media platforms, e.g. rallies, protests, gatherings in support of incident narratives.		no change	T0057 - Organize Events
54	T0057.001	Pay for Physical Action		TA10	Paying for physical action occurs when an influence operation pays individuals to act in the physical realm. An influence operation may pay for physical action to create specific situations and frame them in a way that supports operation narratives, for example, paying a group of people to burn a car to later post an image of the burning car and frame it as an act of protest.		no change	Pay for Physical Action -
55	T0057.002	Conduct Symbolic Action		TA10	Symbolic action refers to activities specifically intended to advance an operation’s narrative by signaling something to the audience, for example, a military parade supporting a state’s narrative of military superiority. An influence operation may use symbolic action to create falsified evidence supporting operation narratives in the physical information space.		no change	Conduct Symbolic Action -
56	T0059	Play the long game		TA11	Play the long game refers to two phenomena: 1. To plan messaging and allow it to grow organically without conducting your own amplification. This is methodical and slow and requires years for the message to take hold 2. To develop a series of seemingly disconnected messaging narratives that eventually combine into a new narrative.		no change	T0059 - Play the long game
57	T0060	Continue to Amplify		TA11	continue narrative or message amplification after the main incident work has finished		no change	T0060 - Continue to Amplify
58	T0061	Sell Merchandise		TA10	Sell mechandise refers to getting the message or narrative into physical space in the offline world while making money		no change	T0061 - Sell Merchandise
59	T0065	Prepare Physical Broadcast Capabilities		TA15	Create or coopt broadcast capabilities (e.g. TV, radio etc).		no change	T0065 - Prepare Physical Broadcast Capabilities
60	T0066	Degrade Adversary		TA02	Plan to degrade an adversary’s image or ability to act. This could include preparation and use of harmful information about the adversary’s actions or reputation.		no change	T0066 - Degrade Adversary
61	T0068	Respond to Breaking News Event or Active Crisis		TA14	Media attention on a story or event is heightened during a breaking news event, where unclear facts and incomplete information increase speculation, rumors, and conspiracy theories, which are all vulnerable to manipulation.		no change	T0068 - Respond to Breaking News Event or Active Crisis
62	T0072	Segment Audiences		TA13	Create audience segmentations by features of interest to the influence campaign, including political affiliation, geographic location, income, demographics, and psychographics.		no change	T0072 - Segment Audiences
63	T0072.001	Geographic Segmentation		TA13	An influence operation may target populations in a specific geographic location, such as a region, state, or city. An influence operation may use geographic segmentation to Create Localized Content (see: Establish Legitimacy).		no change	Geographic Segmentation -
64	T0072.002	Demographic Segmentation		TA13	An influence operation may target populations based on demographic segmentation, including age, gender, and income. Demographic segmentation may be useful for influence operations aiming to change state policies that affect a specific population sector. For example, an influence operation attempting to influence Medicare funding in the United States would likely target U.S. voters over 65 years of age.		no change	Demographic Segmentation -
65	T0072.003	Economic Segmentation		TA13	An influence operation may target populations based on their income bracket, wealth, or other financial or economic division.		no change	Economic Segmentation -
66	T0072.004	Psychographic Segmentation		TA13	An influence operation may target populations based on psychographic segmentation, which uses audience values and decision-making processes. An operation may individually gather psychographic data with its own surveys or collection tools or externally purchase data from social media companies or online surveys, such as personality quizzes.		no change	Psychographic Segmentation -
67	T0072.005	Political Segmentation		TA13	An influence operation may target populations based on their political affiliations, especially when aiming to manipulate voting or change policy.		no change	Political Segmentation -
68	T0073	Determine Target Audiences		TA01	Determining the target audiences (segments of the population) who will receive campaign narratives and artifacts intended to achieve the strategic ends.		new	T0073 - Determine Target Audiences
69	T0074	Determine Strategic Ends		TA01	Determining the campaigns goals or objectives. Examples include achieving achieving geopolitical advantage like undermining trust in an adversary, gaining domestic political advantage, achieving financial gain, or attaining a policy change,		new	T0074 - Determine Strategic Ends
70	T0075	Dismiss		TA02	Push back against criticism by dismissing your critics. This might be arguing that the critics use a different standard for you than with other actors or themselves; or arguing that their criticism is biased.		Split from T0001	T0075 - Dismiss
71	T0075.001	Discredit Credible Sources		TA02	Plan to delegitimize the media landscape and degrade public trust in reporting, by discrediting credible sources. This makes it easier to promote influence operation content.		no change	Discredit Credible Sources -
72	T0076	Distort		TA02	Twist the narrative. Take information, or artifacts like images, and change the framing around them.		Split from T0001	T0076 - Distort
73	T0077	Distract		TA02	Shift attention to a different narrative or actor, for instance by accusing critics of the same activity that they’ve accused you of (e.g. police brutality).		Split from T0001	T0077 - Distract
74	T0078	Dismay		TA02	Threaten the critic or narrator of events. For instance, threaten journalists or news outlets reporting on a story.		Split from T0001	T0078 - Dismay
75	T0079	Divide		TA02	Create conflict between subgroups, to widen divisions in a community		Split from T0001	T0079 - Divide
76	T0080	Map Target Audience Information Environment		TA13	Mapping the target audience information environment analyzes the information space itself, including social media analytics, web traffic, and media surveys. Mapping the information environment may help the influence operation determine the most realistic and popular information channels to reach its target audience. Mapping the target audience information environment aids influence operations in determining the most vulnerable areas of the information space to target with messaging.		new	T0080 - Map Target Audience Information Environment
77	T0080.001	Monitor Social Media Analytics		TA13	An influence operation may use social media analytics to determine which factors will increase the operation content’s exposure to its target audience on social media platforms, including views, interactions, and sentiment relating to topics and content types. The social media platform itself or a third-party tool may collect the metrics.		no change	Monitor Social Media Analytics -
78	T0080.002	Evaluate Media Surveys		TA13	An influence operation may evaluate its own or third-party media surveys to determine what type of content appeals to its target audience. Media surveys may provide insight into an audience’s political views, social class, general interests, or other indicators used to tailor operation messaging to its target audience.		no change	Evaluate Media Surveys -
79	T0080.003	Identify Trending Topics/Hashtags		TA13	An influence operation may identify trending hashtags on social media platforms for later use in boosting operation content. A hashtag40 refers to a word or phrase preceded by the hash symbol (#) on social media used to identify messages and posts relating to a specific topic. All public posts that use the same hashtag are aggregated onto a centralized page dedicated to the word or phrase and sorted either chronologically or by popularity.		no change	Identify Trending Topics/Hashtags -
80	T0080.004	Conduct Web Traffic Analysis		TA13	An influence operation may conduct web traffic analysis to determine which search engines, keywords, websites, and advertisements gain the most traction with its target audience.		no change	Conduct Web Traffic Analysis -
81	T0080.005	Assess Degree/Type of Media Access		TA13	An influence operation may survey a target audience’s Internet availability and degree of media freedom to determine which target audience members will have access to operation content and on which platforms. An operation may face more difficulty targeting an information environment with heavy restrictions and media control than an environment with independent media, freedom of speech and of the press, and individual liberties.		no change	Assess Degree/Type of Media Access -
82	T0081	Identify Social and Technical Vulnerabilities		TA13	Identifying social and technical vulnerabilities determines weaknesses within the target audience information environment for later exploitation. Vulnerabilities include decisive political issues, weak cybersecurity infrastructure, search engine data voids, and other technical and non technical weaknesses in the target information environment. Identifying social and technical vulnerabilities facilitates the later exploitation of the identified weaknesses to advance operation objectives.		new	T0081 - Identify Social and Technical Vulnerabilities
83	T0081.001	Find Echo Chambers		TA13	Find or plan to create areas (social media groups, search term groups, hashtag groups etc) where individuals only engage with people they agree with.		no change	Find Echo Chambers -
84	T0081.002	Identify Data Voids		TA13	A data void refers to a word or phrase that results in little, manipulative, or low-quality search engine data. Data voids are hard to detect and relatively harmless until exploited by an entity aiming to quickly proliferate false or misleading information during a phenomenon that causes a high number of individuals to query the term or phrase. In the Plan phase, an influence operation may identify data voids for later exploitation in the operation. A 2019 report by Michael Golebiewski identifies five types of data voids. (1) “Breaking news” data voids occur when a keyword gains popularity during a short period of time, allowing an influence operation to publish false content before legitimate news outlets have an opportunity to publish relevant information. (2) An influence operation may create a “strategic new terms” data void by creating their own terms and publishing information online before promoting their keyword to the target audience. (3) An influence operation may publish content on “outdated terms” that have decreased in popularity, capitalizing on most search engines’ preferences for recency. (4) “Fragmented concepts” data voids separate connections between similar ideas, isolating segment queries to distinct search engine results. (5) An influence operation may use “problematic queries” that previously resulted in disturbing or inappropriate content to promote messaging until mainstream media recontextualizes the term.		no change	Identify Data Voids -
85	T0081.003	Identify Existing Prejudices		TA13	An influence operation may exploit existing racial, religious, demographic, or social prejudices to further polarize its target audience from the rest of the public.		no change	Identify Existing Prejudices -
86	T0081.004	Identify Existing Fissures		TA13	An influence operation may identify existing fissures to pit target populations against one another or facilitate a “divide-and-conquer" approach to tailor operation narratives along the divides.		no change	Identify Existing Fissures -
87	T0081.005	Identify Existing Conspiracy Narratives/Suspicions		TA13	An influence operation may assess preexisting conspiracy theories or suspicions in a population to identify existing narratives that support operational objectives.		no change	Identify Existing Conspiracy Narratives/Suspicions -
88	T0081.006	Identify Wedge Issues		TA13	A wedge issue is a divisive political issue, usually concerning a social phenomenon, that divides individuals along a defined line. An influence operation may exploit wedge issues by intentionally polarizing the public along the wedge issue line and encouraging opposition between factions.		no change	Identify Wedge Issues -
89	T0081.007	Identify Target Audience Adversaries		TA13	An influence operation may identify or create a real or imaginary adversary to center operation narratives against. A real adversary may include certain politicians or political parties while imaginary adversaries may include falsified “deep state”62 actors that, according to conspiracies, run the state behind public view.		no change	Identify Target Audience Adversaries -
90	T0081.008	Identify Media System Vulnerabilities		TA13	An influence operation may exploit existing weaknesses in a target’s media system. These weaknesses may include existing biases among media agencies, vulnerability to false news agencies on social media, or existing distrust of traditional media sources. An existing distrust among the public in the media system’s credibility holds high potential for exploitation by an influence operation when establishing alternative news agencies to spread operation content.		no change	Identify Media System Vulnerabilities -
91	T0082	Develop New Narratives		TA14	Actors may develop new narratives to further strategic or tactical goals, especially when existing narratives adequately align with the campaign goals. New narratives provide more control in terms of crafting the message to achieve specific goals. However, new narratives may require more effort to disseminate than adapting or adopting existing narratives.		new	T0082 - Develop New Narratives
92	T0083	Integrate Target Audience Vulnerabilities into Narrative		TA14	An influence operation may seek to exploit the preexisting weaknesses, fears, and enemies of the target audience for integration into the operation’s narratives and overall strategy. Integrating existing vulnerabilities into the operational approach conserves resources by exploiting already weak areas of the target information environment instead of forcing the operation to create new vulnerabilities in the environment.		new	T0083 - Integrate Target Audience Vulnerabilities into Narrative
93	T0084	Reuse Existing Content		TA06	When an operation recycles content from its own previous operations or plagiarizes from external operations. An operation may launder information to conserve resources that would have otherwise been utilized to develop new content.		new	T0084 - Reuse Existing Content
94	T0084.001	Use Copypasta		TA06	Copypasta refers to a piece of text that has been copied and pasted multiple times across various online platforms. A copypasta’s final form may differ from its original source text as users add, delete, or otherwise edit the content as they repost the text.		no change	Use Copypasta -
95	T0084.002	Plagiarize Content		TA06	An influence operation may take content from other sources without proper attribution. This content may be either misinformation content shared by others without malicious intent but now leveraged by the campaign as disinformation or disinformation content from other sources.		no change	Plagiarize Content -
96	T0084.003	Deceptively Labeled or Translated		TA06	An influence operation may take authentic content from other sources and add deceptive labels or deceptively translate the content into other langauges.		no change	Deceptively Labeled or Translated -
97	T0084.004	Appropriate Content		TA06	An influence operation may take content from other sources with proper attribution. This content may be either misinformation content shared by others without malicious intent but now leveraged by the campaign as disinformation or disinformation content from other sources. Examples include the appropriation of content from one inauthentic news site to another inauthentic news site or network in ways that align with the originators licensing or terms of service.		no change	Appropriate Content -
98	T0085	Develop Text-based Content		TA06	Creating and editing false or misleading text-based artifacts, often aligned with one or more specific narratives, for use in a disinformation campaign.		new	T0085 - Develop Text-based Content
99	T0085.001	Develop AI-Generated Text		TA06	AI-generated texts refers to synthetic text composed by computers using text-generating AI technology. Autonomous generation refers to content created by a bot without human input, also known as bot-created content generation. Autonomous generation represents the next step in automation after language generation and may lead to automated journalism. An influence operation may use read fakes or autonomous generation to quickly develop and distribute content to the target audience.		no change	Develop AI-Generated Text -
100	T0085.002	Develop False or Altered Documents		TA06	Develop False or Altered Documents		no change	Develop False or Altered Documents -
101	T0085.003	Develop Inauthentic News Articles		TA06	An influence operation may develop false or misleading news articles aligned to their campaign goals or narratives.		no change	Develop Inauthentic News Articles -
102	T0086	Develop Image-based Content		TA06	Creating and editing false or misleading visual artifacts, often aligned with one or more specific narratives, for use in a disinformation campaign. This may include photographing staged real-life situations, repurposing existing digital images, or using image creation and editing technologies.		new	T0086 - Develop Image-based Content
103	T0086.001	Develop Memes		TA06	Memes are one of the most important single artefact types in all of computational propaganda. Memes in this framework denotes the narrow image-based definition. But that naming is no accident, as these items have most of the important properties of Dawkins' original conception as a self-replicating unit of culture. Memes pull together reference and commentary; image and narrative; emotion and message. Memes are a powerful tool and the heart of modern influence campaigns.		no change	Develop Memes -
104	T0086.002	Develop AI-Generated Images (Deepfakes)		TA06	Deepfakes refer to AI-generated falsified photos, videos, or soundbites. An influence operation may use deepfakes to depict an inauthentic situation by synthetically recreating an individual’s face, body, voice, and physical gestures.		no change	Develop AI-Generated Images (Deepfakes) -
105	T0086.003	Deceptively Edit Images (Cheap fakes)		TA06	Cheap fakes utilize less sophisticated measures of altering an image, video, or audio for example, slowing, speeding, or cutting footage to create a false context surrounding an image or event.		no change	Deceptively Edit Images (Cheap fakes) -
106	T0086.004	Aggregate Information into Evidence Collages		TA06	Image files that aggregate positive evidence (Joan Donovan)		no change	Aggregate Information into Evidence Collages -
107	T0087	Develop Video-based Content		TA06	Creating and editing false or misleading video artifacts, often aligned with one or more specific narratives, for use in a disinformation campaign. This may include staging videos of purportedly real situations, repurposing existing video artifacts, or using AI-generated video creation and editing technologies (including deepfakes).		new	T0087 - Develop Video-based Content
108	T0087.001	Develop AI-Generated Videos (Deepfakes)		TA06	Deepfakes refer to AI-generated falsified photos, videos, or soundbites. An influence operation may use deepfakes to depict an inauthentic situation by synthetically recreating an individual’s face, body, voice, and physical gestures.		no change	Develop AI-Generated Videos (Deepfakes) -
109	T0087.002	Deceptively Edit Video (Cheap fakes)		TA06	Cheap fakes utilize less sophisticated measures of altering an image, video, or audio for example, slowing, speeding, or cutting footage to create a false context surrounding an image or event.		no change	Deceptively Edit Video (Cheap fakes) -
110	T0088	Develop Audio-based Content		TA06	Creating and editing false or misleading audio artifacts, often aligned with one or more specific narratives, for use in a disinformation campaign. This may include creating completely new audio content, repurposing existing audio artifacts (including cheap fakes), or using AI-generated audio creation and editing technologies (including deepfakes).		new	T0088 - Develop Audio-based Content
111	T0088.001	Develop AI-Generated Audio (Deepfakes)		TA06	Deepfakes refer to AI-generated falsified photos, videos, or soundbites. An influence operation may use deepfakes to depict an inauthentic situation by synthetically recreating an individual’s face, body, voice, and physical gestures.		no change	Develop AI-Generated Audio (Deepfakes) -
112	T0088.002	Deceptively Edit Audio (Cheap fakes)		TA06	Cheap fakes utilize less sophisticated measures of altering an image, video, or audio for example, slowing, speeding, or cutting footage to create a false context surrounding an image or event.		no change	Deceptively Edit Audio (Cheap fakes) -
113	T0089	Obtain Private Documents		TA06	Procuring documents that are not publicly available, by whatever means -- whether legal or illegal, highly-resourced or less so. These documents can include authentic non-public documents, authentic non-public documents have been altered, or inauthentic documents intended to appear as if they are authentic non-public documents. All of these types of documents can be "leaked" during later stages in the operation.		new	T0089 - Obtain Private Documents
114	T0089.001	Obtain Authentic Documents		TA06	Procure authentic documents that are not publicly available, by whatever means -- whether legal or illegal, highly-resourced or less so. These documents can be "leaked" during later stages in the operation.		no change	Obtain Authentic Documents -
115	T0089.002	Create Inauthentic Documents		TA06	Create inauthentic documents intended to appear as if they are authentic non-public documents. These documents can be "leaked" during later stages in the operation.		no change	Create Inauthentic Documents -
116	T0089.003	Alter Authentic Documents		TA06	Alter authentic documents (public or non-public) to achieve campaign goals. The altered documents are intended to appear as if they are authentic can be "leaked" during later stages in the operation.		no change	Alter Authentic Documents -
117	T0090	Create Inauthentic Accounts		TA15	Inauthentic accounts include bot accounts, cyborg accounts, sockpuppet accounts, and anonymous accounts.		new	T0090 - Create Inauthentic Accounts
118	T0090.001	Create Anonymous Accounts		TA15	Anonymous accounts or anonymous users refer to users that access network resources without providing a username or password. An influence operation may use anonymous accounts to spread content without direct attribution to the operation.		no change	Create Anonymous Accounts -
119	T0090.002	Create Cyborg Accounts		TA15	Cyborg accounts refer to partly manned, partly automated social media accounts. Cyborg accounts primarily act as bots, but a human operator periodically takes control of the account to engage with real social media users by responding to comments and posting original content. Influence operations may use cyborg accounts to reduce the amount of direct human input required to maintain a regular account but increase the apparent legitimacy of the cyborg account by occasionally breaking its bot-like behavior with human interaction.		no change	Create Cyborg Accounts -
120	T0090.003	Create Bot Accounts		TA15	Bots refer to autonomous internet users that interact with systems or other users while imitating traditional human behavior. Bots use a variety of tools to stay active without direct human operation, including artificial intelligence and big data analytics. For example, an individual may program a Twitter bot to retweet a tweet every time it contains a certain keyword or hashtag. An influence operation may use bots to increase its exposure and artificially promote its content across the internet without dedicating additional time or human resources. Amplifier bots promote operation content through reposts, shares, and likes to increase the content’s online popularity. Hacker bots are traditionally covert bots running on computer scripts that rarely engage with users and work primarily as agents of larger cyberattacks, such as a Distributed Denial of Service attacks. Spammer bots are programmed to post content on social media or in comment sections, usually as a supplementary tool. Impersonator bots102 pose as real people by mimicking human behavior, complicating their detection.		no change	Create Bot Accounts -
121	T0090.004	Create Sockpuppet Accounts		TA15	Sockpuppet accounts refer to falsified accounts that either promote the influence operation’s own material or attack critics of the material online. Individuals who control sockpuppet accounts also man at least one other user account.67 Sockpuppet accounts help legitimize operation narratives by providing an appearance of external support for the material and discrediting opponents of the operation.		no change	Create Sockpuppet Accounts -
122	T0091	Recruit malign actors		TA15	Operators recruit bad actors paying recruiting, or exerting control over individuals includes trolls, partisans, and contractors.		new	T0091 - Recruit malign actors
123	T0091.001	Recruit Contractors		TA15	Operators recruit paid contractor to support the campaign.		no change	Recruit Contractors -
124	T0091.002	Recruit Partisans		TA15	Operators recruit partisans (ideologically-aligned individuals) to support the campaign.		no change	Recruit Partisans -
125	T0091.003	Enlist Troll Accounts		TA15	An influence operation may hire trolls, or human operators of fake accounts that aim to provoke others by posting and amplifying content about controversial issues. Trolls can serve to discredit an influence operation’s opposition or bring attention to the operation’s cause through debate. Classic trolls refer to regular people who troll for personal reasons, such as attention-seeking or boredom. Classic trolls may advance operation narratives by coincidence but are not directly affiliated with any larger operation. Conversely, hybrid trolls act on behalf of another institution, such as a state or financial organization, and post content with a specific ideological goal. Hybrid trolls may be highly advanced and institutionalized or less organized and work for a single individual.		no change	Enlist Troll Accounts -
126	T0092	Build Network		TA15	Operators build their own network, creating links between accounts -- whether authentic or inauthentic -- in order amplify and promote narratives and artifacts, and encourage further growth of ther network, as well as the ongoing sharing and engagement with operational content.		new	T0092 - Build Network
127	T0092.001	Create Organizations		TA15	Influence operations may establish organizations with legitimate or falsified hierarchies, staff, and content to structure operation assets, provide a sense of legitimacy to the operation, or provide institutional backing to operation activities.		no change	Create Organizations -
128	T0092.002	Use Follow Trains		TA15	A follow train is a group of people who follow each other on a social media platform, often as a way for an individual or campaign to grow its social media following. Follow trains may be a violation of platform Terms of Service. They are also known as follow-for-follow groups.		no change	Use Follow Trains -
129	T0092.003	Create Community or Sub-group		TA15	When there is not an existing community or sub-group that meets a campaign's goals, an influence operation may seek to create a community or sub-group.		no change	Create Community or Sub-group -
130	T0093	Acquire/Recruit Network		TA15	Operators acquire an existing network by paying, recruiting, or exerting control over the leaders of the existing network.		new	T0093 - Acquire/Recruit Network
131	T0093.001	Fund Proxies		TA15	An influence operation may fund proxies, or external entities that work for the operation. An operation may recruit/train users with existing sympathies towards the operation’s narratives and/or goals as proxies. Funding proxies serves various purposes including: - Diversifying operation locations to complicate attribution - Reducing the workload for direct operation assets		no change	Fund Proxies -
132	T0093.002	Acquire Botnets		TA15	A botnet is a group of bots that can function in coordination with each other.		no change	Acquire Botnets -
133	T0094	Infiltrate Existing Networks		TA15	Operators deceptively insert social assets into existing networks as group members in order to influence the members of the network and the wider information environment that the network impacts.		new	T0094 - Infiltrate Existing Networks
134	T0094.001	Identify susceptible targets in networks		TA15	When seeking to infiltrate an existing network, an influence operation may identify individuals and groups that might be susceptible to being co-opted or influenced.		no change	Identify susceptible targets in networks -
135	T0094.002	Utilize Butterfly Attacks		TA15	Butterfly attacks occur when operators pretend to be members of a certain social group, usually a group that struggles for representation. An influence operation may mimic a group to insert controversial statements into the discourse, encourage the spread of operation content, or promote harassment among group members. Unlike astroturfing, butterfly attacks aim to infiltrate and discredit existing grassroots movements, organizations, and media campaigns.		no change	Utilize Butterfly Attacks -
136	T0095	Develop Owned Media Assets		TA15	An owned media asset refers to an agency or organization through which an influence operation may create, develop, and host content and narratives. Owned media assets include websites, blogs, social media pages, forums, and other platforms that facilitate the creation and organization of content.		new	T0095 - Develop Owned Media Assets
137	T0096	Leverage Content Farms		TA15	Using the services of large-scale content providers for creating and amplifying campaign artifacts at scale.		new	T0096 - Leverage Content Farms
138	T0096.001	Create Content Farms		TA15	An influence operation may create an organization for creating and amplifying campaign artifacts at scale.		no change	Create Content Farms -
139	T0096.002	Outsource Content Creation to External Organizations		TA15	An influence operation may outsource content creation to external companies to avoid attribution, increase the rate of content creation, or improve content quality, i.e., by employing an organization that can create content in the target audience’s native language. Employed organizations may include marketing companies for tailored advertisements or external content farms for high volumes of targeted media.		no change	Outsource Content Creation to External Organizations -
140	T0097	Create personas		TA16	Creating fake people, often with accounts across multiple platforms. These personas can be as simple as a name, can contain slightly more background like location, profile pictures, backstory, or can be effectively backstopped with indicators like fake identity documents.		new	T0097 - Create personas
141	T0097.001	Backstop personas		TA16	Create other assets/dossier/cover/fake relationships and/or connections or documents, sites, bylines, attributions, to establish/augment/inflate crediblity/believability		no change	Backstop personas -
142	T0098	Establish Inauthentic News Sites		TA16	Modern computational propaganda makes use of a cadre of imposter news sites spreading globally. These sites, sometimes motivated by concerns other than propaganda--for instance, click-based revenue--often have some superficial markers of authenticity, such as naming and site-design. But many can be quickly exposed with reference to their owenership, reporting history and adverstising details.		new	T0098 - Establish Inauthentic News Sites
143	T0098.001	Create Inauthentic News Sites		TA16	Create Inauthentic News Sites		no change	Create Inauthentic News Sites -
144	T0098.002	Leverage Existing Inauthentic News Sites		TA16	Leverage Existing Inauthentic News Sites		no change	Leverage Existing Inauthentic News Sites -
145	T0099	Prepare Assets Impersonating Legitimate Entities		TA16	An influence operation may prepare assets impersonating legitimate entities to further conceal its network identity and add a layer of legitimacy to its operation content. Users will more likely believe and less likely fact-check news from recognizable sources rather than unknown sites. Legitimate entities may include authentic news outlets, public figures, organizations, or state entities. An influence operation may use a wide variety of cyber techniques to impersonate a legitimate entity’s website or social media account. Typosquatting87 is the international registration of a domain name with purposeful variations of the impersonated domain name through intentional typos, top-level domain (TLD) manipulation, or punycode. Typosquatting facilitates the creation of falsified websites by creating similar domain names in the URL box, leaving it to the user to confirm that the URL is correct.		new	T0099 - Prepare Assets Impersonating Legitimate Entities
146	T0099.001	Astroturfing		TA16	Astroturfing occurs when an influence operation disguises itself as grassroots movement or organization that supports operation narratives. Unlike butterfly attacks, astroturfing aims to increase the appearance of popular support for the operation cause and does not infiltrate existing groups to discredit their objectives.		no change	Astroturfing -
147	T0099.002	Spoof/parody account/site		TA16	An influence operation may prepare assets impersonating legitimate entities to further conceal its network identity and add a layer of legitimacy to its operation content. Users will more likely believe and less likely fact-check news from recognizable sources rather than unknown sites. Legitimate entities may include authentic news outlets, public figures, organizations, or state entities.		no change	Spoof/parody account/site -
148	T0100	Co-opt Trusted Sources		TA16	An influence operation may co-opt trusted sources by infiltrating or repurposing a source to reach a target audience through existing, previously reliable networks. Co-opted trusted sources may include: - National or local new outlets - Research or academic publications - Online blogs or websites		new	T0100 - Co-opt Trusted Sources
149	T0100.001	Co-Opt Trusted Individuals		TA16	Co-Opt Trusted Individuals		no change	Co-Opt Trusted Individuals -
150	T0100.002	Co-Opt Grassroots Groups		TA16	Co-Opt Grassroots Groups		no change	Co-Opt Grassroots Groups -
151	T0100.003	Co-opt Influencers		TA16	Co-opt Influencers		no change	Co-opt Influencers -
152	T0101	Create Localized Content		TA05	Localized content refers to content that appeals to a specific community of individuals, often in defined geographic areas. An operation may create localized content using local language and dialects to resonate with its target audience and blend in with other local news and social media. Localized content may help an operation increase legitimacy, avoid detection, and complicate external attribution.		new	T0101 - Create Localized Content
153	T0102	Leverage Echo Chambers/Filter Bubbles		TA05	An echo chamber refers to an internet subgroup, often along ideological lines, where individuals only engage with “others with which they are already in agreement.” A filter bubble refers to an algorithm's placement of an individual in content that they agree with or regularly engage with, possibly entrapping the user into a bubble of their own making. An operation may create these isolated areas of the internet by match existing groups, or aggregating individuals into a single target audience based on shared interests, politics, values, demographics, and other characteristics. Echo chambers and filter bubbles help to reinforce similar biases and content to the same target audience members.		new	T0102 - Leverage Echo Chambers/Filter Bubbles
154	T0102.001	Use existing Echo Chambers/Filter Bubbles		TA05	Use existing Echo Chambers/Filter Bubbles		no change	Use existing Echo Chambers/Filter Bubbles -
155	T0102.002	Create Echo Chambers/Filter Bubbles		TA05	Create Echo Chambers/Filter Bubbles		no change	Create Echo Chambers/Filter Bubbles -
156	T0102.003	Exploit Data Voids		TA05	A data void refers to a word or phrase that results in little, manipulative, or low-quality search engine data. Data voids are hard to detect and relatively harmless until exploited by an entity aiming to quickly proliferate false or misleading information during a phenomenon that causes a high number of individuals to query the term or phrase. In the Plan phase, an influence operation may identify data voids for later exploitation in the operation. A 2019 report by Michael Golebiewski identifies five types of data voids. (1) “Breaking news” data voids occur when a keyword gains popularity during a short period of time, allowing an influence operation to publish false content before legitimate news outlets have an opportunity to publish relevant information. (2) An influence operation may create a “strategic new terms” data void by creating their own terms and publishing information online before promoting their keyword to the target audience. (3) An influence operation may publish content on “outdated terms” that have decreased in popularity, capitalizing on most search engines’ preferences for recency. (4) “Fragmented concepts” data voids separate connections between similar ideas, isolating segment queries to distinct search engine results. (5) An influence operation may use “problematic queries” that previously resulted in disturbing or inappropriate content to promote messaging until mainstream media recontextualizes the term.		no change	Exploit Data Voids -
157	T0103	Livestream		TA07	A livestream refers to an online broadcast capability that allows for real-time communication to closed or open networks.		new	T0103 - Livestream
158	T0103.001	Video Livestream		TA07	A video livestream refers to an online video broadcast capability that allows for real-time communication to closed or open networks.		no change	Video Livestream -
159	T0103.002	Audio Livestream		TA07	An audio livestream refers to an online audio broadcast capability that allows for real-time communication to closed or open networks.		no change	Audio Livestream -
160	T0104	Social Networks		TA07	Social media are interactive digital channels that facilitate the creation and sharing of information, ideas, interests, and other forms of expression through virtual communities and networks.		new	T0104 - Social Networks
161	T0104.001	Mainstream Social Networks		TA07	Examples include Facebook, Twitter, LinkedIn, etc.		no change	Mainstream Social Networks -
162	T0104.002	Dating Apps		TA07	A video livestream refers to an online video broadcast capability that allows for real-time communication to closed or open networks. Examples include Facebook Live, Instagram, Youtube, Tik Tok, and Twitter.		no change	Dating Apps -
163	T0104.003	Private/Closed Social Networks		TA07	An audio livestream refers to an online audio broadcast capability that allows for real-time communication to closed or open networks. Examples include Twitter Spaces,		no change	Private/Closed Social Networks -
164	T0104.004	Interest-Based Networks		TA07	Examples include smaller and niche networks including Gettr, Truth Social, Parler, etc.		no change	Interest-Based Networks -
165	T0104.005	Use hashtags		TA07	Use a dedicated, existing hashtag for the campaign/incident.		no change	Use hashtags -
166	T0104.006	Create dedicated hashtag		TA07	Create a campaign/incident specific hashtag.		no change	Create dedicated hashtag -
167	T0105	Media Sharing Networks		TA07	Media sharing networks refer to services whose primary function is the hosting and sharing of specific forms of media. Examples include Instagram, Snapchat, TikTok, Youtube, SoundCloud.		new	T0105 - Media Sharing Networks
168	T0105.001	Photo Sharing		TA07	Examples include Instagram, Snapchat, Flickr, etc		no change	Photo Sharing -
169	T0105.002	Video Sharing		TA07	Examples include Youtube, TikTok, ShareChat, Rumble, etc		no change	Video Sharing -
170	T0105.003	Audio sharing		TA07	Examples include podcasting apps, Soundcloud, etc.		no change	Audio sharing -
171	T0106	Discussion Forums		TA07	Platforms for finding, discussing, and sharing information and opinions. Examples include Reddit, Quora, Digg, message boards, interest-based discussion forums, etc.		new	T0106 - Discussion Forums
172	T0106.001	Anonymous Message Boards		TA07	Examples include the Chans		no change	Anonymous Message Boards -
173	T0107	Bookmarking and Content Curation		TA07	Platforms for searching, sharing, and curating content and media. Examples include Pinterest, Flipboard, etc.		new	T0107 - Bookmarking and Content Curation
174	T0108	Blogging and Publishing Networks		TA07	Examples include WordPress, Blogger, Weebly, Tumblr, Medium, etc.		new	T0108 - Blogging and Publishing Networks
175	T0109	Consumer Review Networks		TA07	Platforms for finding, reviewing, and sharing information about brands, products, services, restaurants, travel destinations, etc. Examples include Yelp, TripAdvisor, etc.		new	T0109 - Consumer Review Networks
176	T0110	Formal Diplomatic Channels		TA07	Leveraging formal, traditional, diplomatic channels to communicate with foreign governments (written documents, meetings, summits, diplomatic visits, etc). This type of diplomacy is conducted by diplomats of one nation with diplomats and other officials of another nation or international organization.		new	T0110 - Formal Diplomatic Channels
177	T0111	Traditional Media		TA07	Examples include TV, Newspaper, Radio, etc.		new	T0111 - Traditional Media
178	T0111.001	TV		TA07	TV		no change	TV -
179	T0111.002	Newspaper		TA07	Newspaper		no change	Newspaper -
180	T0111.003	Radio		TA07	Radio		no change	Radio -
181	T0112	Email		TA07	Delivering content and narratives via email. This can include using list management or high-value individually targeted messaging.		new	T0112 - Email
182	T0113	Employ Commercial Analytic Firms		TA08	Commercial analytic firms collect data on target audience activities and evaluate the data to detect trends, such as content receiving high click-rates. An influence operation may employ commercial analytic firms to facilitate external collection on its target audience, complicating attribution efforts and better tailoring the content to audience preferences.		new	T0113 - Employ Commercial Analytic Firms
183	T0114	Deliver Ads		TA09	Delivering content via any form of paid media or advertising.		new	T0114 - Deliver Ads
184	T0114.001	Social media		TA09	Social Media		no change	Social media -
185	T0114.002	Traditional Media		TA09	Examples include TV, Radio, Newspaper, billboards		no change	Traditional Media -
186	T0115	Post Content		TA09	Delivering content by posting via owned media (assets that the operator controls).		new	T0115 - Post Content
187	T0115.001	Share Memes		TA09	Memes are one of the most important single artefact types in all of computational propaganda. Memes in this framework denotes the narrow image-based definition. But that naming is no accident, as these items have most of the important properties of Dawkins' original conception as a self-replicating unit of culture. Memes pull together reference and commentary; image and narrative; emotion and message. Memes are a powerful tool and the heart of modern influence campaigns.		no change	Share Memes -
188	T0115.002	Post Violative Content to Provoke Takedown and Backlash		TA09	Post Violative Content to Provoke Takedown and Backlash.		no change	Post Violative Content to Provoke Takedown and Backlash -
189	T0115.003	One-Way Direct Posting		TA09	Direct posting refers to a method of posting content via a one-way messaging service, where the recipient cannot directly respond to the poster’s messaging. An influence operation may post directly to promote operation narratives to the target audience without allowing opportunities for fact-checking or disagreement, creating a false sense of support for the narrative.		no change	One-Way Direct Posting -
190	T0116	Comment or Reply on Content		TA09	Delivering content by replying or commenting via owned media (assets that the operator controls).		new	T0116 - Comment or Reply on Content
191	T0116.001	Post inauthentic social media comment		TA09	Use government-paid social media commenters, astroturfers, chat bots (programmed to reply to specific key words/hashtags) influence online conversations, product reviews, web-site comment forums.		no change	Post inauthentic social media comment -
192	T0117	Attract Traditional Media		TA09	Deliver content by attracting the attention of traditional media (earned media).		new	T0117 - Attract Traditional Media
193	T0118	Amplify Existing Narrative		TA17	An influence operation may amplify existing narratives that align with its narratives to support operation objectives.		new	T0118 - Amplify Existing Narrative
194	T0119	Cross-Posting		TA17	Cross-posting refers to posting the same message to multiple internet discussions, social media platforms or accounts, or news groups at one time. An influence operation may post content online in multiple communities and platforms to increase the chances of content exposure to the target audience.		new	T0119 - Cross-Posting
195	T0119.001	Post Across Groups		TA17	An influence operation may post content across groups to spread narratives and content to new communities within the target audiences or to new target audiences.		no change	Post Across Groups -
196	T0119.002	Post Across Platform		TA17	An influence operation may post content across platforms to spread narratives and content to new communities within the target audiences or to new target audiences. Posting across platforms can also remove opposition and context, helping the narrative spread with less opposition on the cross-posted platform.		no change	Post Across Platform -
197	T0119.003	Post Across Disciplines		TA17	Post Across Disciplines		no change	Post Across Disciplines -
198	T0120	Incentivize Sharing		TA17	Incentivizing content sharing refers to actions that encourage users to share content themselves, reducing the need for the operation itself to post and promote its own content.		new	T0120 - Incentivize Sharing
199	T0120.001	Use Affiliate Marketing Programs		TA17	Use Affiliate Marketing Programs		no change	Use Affiliate Marketing Programs -
200	T0120.002	Use Contests and Prizes		TA17	Use Contests and Prizes		no change	Use Contests and Prizes -
201	T0121	Manipulate Platform Algorithm		TA17	Manipulating a platform algorithm refers to conducting activity on a platform in a way that intentionally targets its underlying algorithm. After analyzing a platform’s algorithm (see: Select Platforms), an influence operation may use a platform in a way that increases its content exposure, avoids content removal, or otherwise benefits the operation’s strategy. For example, an influence operation may use bots to amplify its posts so that the platform’s algorithm recognizes engagement with operation content and further promotes the content on user timelines.		new	T0121 - Manipulate Platform Algorithm
202	T0121.001	Bypass Content Blocking		TA17	Bypassing content blocking refers to actions taken to circumvent network security measures that prevent users from accessing certain servers, resources, or other online spheres. An influence operation may bypass content blocking to proliferate its content on restricted areas of the internet. Common strategies for bypassing content blocking include: - Altering IP addresses to avoid IP filtering - Using a Virtual Private Network (VPN) to avoid IP filtering - Using a Content Delivery Network (CDN) to avoid IP filtering - Enabling encryption to bypass packet inspection blocking - Manipulating text to avoid filtering by keywords - Posting content on multiple platforms to avoid platform-specific removals - Using local facilities or modified DNS servers to avoid DNS filtering		no change	Bypass Content Blocking -
203	T0122	Direct Users to Alternative Platforms		TA17	Direct users to alternative platforms refers to encouraging users to move from the platform on which they initially viewed operation content and engage with content on alternate information channels, including separate social media channels and inauthentic websites. An operation may drive users to alternative platforms to diversify its information channels and ensure the target audience knows where to access operation content if the initial platform suspends, flags, or otherwise removes original operation assets and content.		new	T0122 - Direct Users to Alternative Platforms
204	T0123	Control Information Environment through Offensive Cyberspace Operations		TA18	Controlling the information environment through offensive cyberspace operations uses cyber tools and techniques to alter the trajectory of content in the information space to either prioritize operation messaging or block opposition messaging.		new	T0123 - Control Information Environment through Offensive Cyberspace Operations
205	T0123.001	Delete Opposing Content		TA18	Deleting opposing content refers to the removal of content that conflicts with operational narratives from selected platforms. An influence operation may delete opposing content to censor contradictory information from the target audience, allowing operation narratives to take priority in the information space.		no change	Delete Opposing Content -
206	T0123.002	Block Content		TA18	Content blocking refers to actions taken to restrict internet access or render certain areas of the internet inaccessible. An influence operation may restrict content based on both network and content attributes.		no change	Block Content -
207	T0123.003	Destroy Information Generation Capabilities		TA18	Destroying information generation capabilities refers to actions taken to limit, degrade, or otherwise incapacitate an actor’s ability to generate conflicting information. An influence operation may destroy an actor’s information generation capabilities by physically dismantling the information infrastructure, disconnecting resources needed for information generation, or redirecting information generation personnel. An operation may destroy an adversary’s information generation capabilities to limit conflicting content exposure to the target audience and crowd the information space with its own narratives.		no change	Destroy Information Generation Capabilities -
208	T0123.004	Conduct Server Redirect		TA18	A server redirect, also known as a URL redirect, occurs when a server automatically forwards a user from one URL to another using server-side scripting languages. An influence operation may conduct a server redirect to divert target audience members from one website to another without their knowledge. The redirected website may pose as a legitimate source, host malware, or otherwise aid operation objectives.		no change	Conduct Server Redirect -
209	T0124	Suppress Opposition		TA18	Operators can suppress the opposition by exploiting platform content moderation tools and processes like reporting non-violative content to platforms for takedown and goading opposition actors into taking actions that result in platform action or target audience disapproval.		new	T0124 - Suppress Opposition
210	T0124.001	Report Non-Violative Opposing Content		TA18	Reporting opposing content refers to notifying and providing an instance of a violation of a platform’s guidelines and policies for conduct on the platform. In addition to simply reporting the content, an operation may leverage copyright regulations to trick social media and web platforms into removing opposing content by manipulating the content to appear in violation of copyright laws. Reporting opposing content facilitates the suppression of contradictory information and allows operation narratives to take priority in the information space.		no change	Report Non-Violative Opposing Content -
211	T0124.002	Goad People into Harmful Action (Stop Hitting Yourself)		TA18	Goad people into actions that violate terms of service or will lead to having their content or accounts taken down.		no change	Goad People into Harmful Action (Stop Hitting Yourself) -
212	T0124.003	Exploit Platform TOS/Content Moderation		TA18	Exploit Platform TOS/Content Moderation		no change	Exploit Platform TOS/Content Moderation -
213	T0125	Platform Filtering		TA18	Platform filtering refers to the decontextualization of information as claims cross platforms (from Joan Donovan https://www.hks.harvard.edu/publications/disinformation-design-use-evidence-collages-and-platform-filtering-media-manipulation)		new	T0125 - Platform Filtering
214	T0126	Encourage Attendance at Events		TA10	Operation encourages attendance at existing real world event.		new	T0126 - Encourage Attendance at Events
215	T0126.001	Call to action to attend		TA10	Call to action to attend an event		no change	Call to action to attend -
216	T0126.002	Facilitate logistics or support for attendance		TA10	Facilitate logistics or support for travel, food, housing, etc.		no change	Facilitate logistics or support for attendance -
217	T0127	Physical Violence		TA10	Physical violence refers to the use of force to injure, abuse, damage, or destroy. An influence operation may conduct or encourage physical violence to discourage opponents from promoting conflicting content or draw attention to operation narratives using shock value.		new	T0127 - Physical Violence
218	T0127.001	Conduct Physical Violence		TA10	An influence operation may directly Conduct Physical Violence to achieve campaign goals.		no change	Conduct Physical Violence -
219	T0127.002	Encourage Physical Violence		TA10	An influence operation may Encourage others to engage in Physical Violence to achieve campaign goals.		no change	Encourage Physical Violence -
220	T0128	Conceal People		TA11	Conceal the identity or provenance of a campaign account and people assets to avoid takedown and attribution.		split from T0012	T0128 - Conceal People
221	T0128.001	Use Pseudonyms		TA11	An operation may use pseudonyms, or fake names, to mask the identity of operation accounts, publish anonymous content, or otherwise use falsified personas to conceal identity of the operation. An operation may coordinate pseudonyms across multiple platforms, for example, by writing an article under a pseudonym and then posting a link to the article on social media on an account with the same falsified name.		no change	Use Pseudonyms -
222	T0128.002	Conceal Network Identity		TA11	Concealing network identity aims to hide the existence an influence operation’s network completely. Unlike concealing sponsorship, concealing network identity denies the existence of any sort of organization.		no change	Conceal Network Identity -
223	T0128.003	Distance Reputable Individuals from Operation		TA11	Distancing reputable individuals from the operation occurs when enlisted individuals, such as celebrities or subject matter experts, actively disengage themselves from operation activities and messaging. Individuals may distance themselves from the operation by deleting old posts or statements, unfollowing operation information assets, or otherwise detaching themselves from the operation’s timeline. An influence operation may want reputable individuals to distance themselves from the operation to reduce operation exposure, particularly if the operation aims to remove all evidence.		no change	Distance Reputable Individuals from Operation -
224	T0128.004	Launder Accounts		TA11	Account laundering occurs when an influence operation acquires control of previously legitimate online accounts from third parties through sale or exchange and often in contravention of terms of use. Influence operations use laundered accounts to reach target audience members from an existing information channel and complicate attribution.		no change	Launder Accounts -
225	T0128.005	Change Names of Accounts		TA11	Changing names of accounts occurs when an operation changes the name of an existing social media account. An operation may change the names of its accounts throughout an operation to avoid detection or alter the names of newly acquired or repurposed accounts to fit operational narratives.		no change	Change Names of Accounts -
226	T0129	Conceal Operational Activity		TA11	Conceal the campaign's operational activity to avoid takedown and attribution.		split from T0012	T0129 - Conceal Operational Activity
227	T0129.001	Conceal Network Identity		TA11	Concealing network identity aims to hide the existence an influence operation’s network completely. Unlike concealing sponsorship, concealing network identity denies the existence of any sort of organization.		no change	Conceal Network Identity -
228	T0129.002	Generate Content Unrelated to Narrative		TA11	An influence operation may mix its own operation content with legitimate news or external unrelated content to disguise operational objectives, narratives, or existence. For example, an operation may generate "lifestyle" or "cuisine" content alongside regular operation content.		no change	Generate Content Unrelated to Narrative -
229	T0129.003	Break Association with Content		TA11	Breaking association with content occurs when an influence operation actively separates itself from its own content. An influence operation may break association with content by unfollowing, unliking, or unsharing its content, removing attribution from its content, or otherwise taking actions that distance the operation from its messaging. An influence operation may break association with its content to complicate attribution or regain credibility for a new operation.		no change	Break Association with Content -
230	T0129.004	Delete URLs		TA11	URL deletion occurs when an influence operation completely removes its website registration, rendering the URL inaccessible. An influence operation may delete its URLs to complicate attribution or remove online documentation that the operation ever occurred.		no change	Delete URLs -
231	T0129.005	Coordinate on encrypted/closed networks		TA11	Coordinate on encrypted/ closed networks		no change	Coordinate on encrypted/closed networks -
232	T0129.006	Deny involvement		TA11	Without "smoking gun" proof (and even with proof), incident creator can or will deny involvement. This technique also leverages the attacker advantages outlined in "Demand insurmountable proof", specifically the asymmetric disadvantage for truth-tellers in a "firehose of misinformation" environment.		no change	Deny involvement -
233	T0129.007	Delete Accounts/Account Activity		TA11	Deleting accounts and account activity occurs when an influence operation removes its online social media assets, including social media accounts, posts, likes, comments, and other online artifacts. An influence operation may delete its accounts and account activity to complicate attribution or remove online documentation that the operation ever occurred.		no change	Delete Accounts/Account Activity -
234	T0129.008	Redirect URLs		TA11	An influence operation may redirect its falsified or typosquatted URLs to legitimate websites to increase the operation's appearance of legitimacy, complicate attribution, and avoid detection.		no change	Redirect URLs -
235	T0129.009	Remove Post Origins		TA11	Removing post origins refers to the elimination of evidence that indicates the initial source of operation content, often to complicate attribution. An influence operation may remove post origins by deleting watermarks, renaming files, or removing embedded links in its content.		no change	Remove Post Origins -
236	T0129.010	Misattribute Activity		TA11	Misattributed activity refers to incorrectly attributed operation activity. For example, a state sponsored influence operation may conduct operation activity in a way that mimics another state so that external entities misattribute activity to the incorrect state. An operation may misattribute their activities to complicate attribution, avoid detection, or frame an adversary for negative behavior.		no change	Misattribute Activity -
237	T0130	Conceal Infrastructure		TA11	Conceal the campaign's infrastructure to avoid takedown and attribution.		split from T0012	T0130 - Conceal Infrastructure
238	T0130.001	Conceal Sponsorship		TA11	Concealing sponsorship aims to mislead or obscure the identity of the hidden sponsor behind an operation rather than entity publicly running the operation. Operations that conceal sponsorship may maintain visible falsified groups, news outlets, non-profits, or other organizations, but seek to mislead or obscure the identity sponsoring, funding, or otherwise supporting these entities. Influence operations may use a variety of techniques to mask the location of their social media accounts to complicate attribution and conceal evidence of foreign interference. Operation accounts may set their location to a false place, often the location of the operation’s target audience, and post in the region’s language		no change	Conceal Sponsorship -
239	T0130.002	Utilize Bulletproof Hosting		TA11	Hosting refers to services through which storage and computing resources are provided to an individual or organization for the accommodation and maintenance of one or more websites and related services. Services may include web hosting, file sharing, and email distribution. Bulletproof hosting refers to services provided by an entity, such as a domain hosting or web hosting firm, that allows its customer considerable leniency in use of the service. An influence operation may utilize bulletproof hosting to maintain continuity of service for suspicious, illegal, or disruptive operation activities that stricter hosting services would limit, report, or suspend.		no change	Utilize Bulletproof Hosting -
240	T0130.003	Use Shell Organizations		TA11	Use Shell Organizations to conceal sponsorship.		no change	Use Shell Organizations -
241	T0130.004	Use Cryptocurrency		TA11	Use Cryptocurrency to conceal sponsorship. Examples include Bitcoin, Monero, and Etherium.		no change	Use Cryptocurrency -
242	T0130.005	Obfuscate Payment		TA11	Obfuscate Payment		no change	Obfuscate Payment -
243	T0131	Exploit TOS/Content Moderation		TA11	Exploiting weaknesses in platforms' terms of service and content moderation policies to avoid takedowns and platform actions.		new	T0131 - Exploit TOS/Content Moderation
244	T0131.001	Legacy web content		TA11	Make incident content visible for a long time, e.g. by exploiting platform terms of service, or placing it where it's hard to remove or unlikely to be removed.		no change	Legacy web content -
245	T0131.002	Post Borderline Content		TA11	Post Borderline Content		no change	Post Borderline Content -
246	T0132	Measure Performance		TA12	A metric used to determine the accomplishment of actions. “Are the actions being executed as planned?”		new	T0132 - Measure Performance
247	T0132.001	People Focused		TA12	Measure the performance individuals in achieving campaign goals		no change	People Focused -
248	T0132.002	Content Focused		TA12	Measure the performance of campaign content		no change	Content Focused -
249	T0132.003	View Focused		TA12	View Focused		no change	View Focused -
250	T0133	Measure Effectiveness		TA12	A metric used to measure a current system state. “Are we on track to achieve the intended new system state within the planned timescale?”		new	T0133 - Measure Effectiveness
251	T0133.001	Behavior changes		TA12	Monitor and evaluate behaviour changes from misinformation incidents.		no change	Behavior changes -
252	T0133.002	Content		TA12	Measure current system state with respect to the effectiveness of campaign content.		no change	Content -
253	T0133.003	Awareness		TA12	Measure current system state with respect to the effectiveness of influencing awareness.		no change	Awareness -
254	T0133.004	Knowledge		TA12	Measure current system state with respect to the effectiveness of influencing knowledge.		no change	Knowledge -
255	T0133.005	Action/attitude		TA12	Measure current system state with respect to the effectiveness of influencing action/attitude.		no change	Action/attitude -
256	T0134	Measure Effectiveness Indicators (or KPIs)		TA12	Ensuring that Key Performace Indicators are identified and tracked, so that the performance and effectivess of campaigns, and elements of campaigns, can be measured, during and after their execution		new	T0134 - Measure Effectiveness Indicators (or KPIs)
257	T0134.001	Message reach		TA12	Monitor and evaluate message reach in misinformation incidents.		no change	Message reach -
258	T0134.002	Social media engagement		TA12	Monitor and evaluate social media engagement in misinformation incidents.		no change	Social media engagement -