DISARMframeworks/CODE/DISARM Merged (Internal) - DISARM Framework Merged.csv

,DISARM Phase,DISARM Tactic,DISARM Technique,DISARM Subtechnique,Description,DISARM ID,Feedback from EEAS,Action to Do,Action Taken,Where did it come from?,Where from more info
1,Plan,n/a,n/a,n/a,"Envision the desired outcome. Lay out effective ways of achieving it. Communicate the vision, intent, and decisions, focusing on expected results.",P01,,,,AMITT,
36,Prepare,n/a,n/a,n/a,"Activities conducted before execution to improve the ability to conduct the action. Examples include: development of the ecosystem needed to support the action: people, network, channels, content etc.",P02,,,,,
126,Execute,n/a,n/a,n/a,"Run the action, from initial exposure to wrap-up and/or maintaining presence etc.",P03,,,,,
263,Assess,n/a,n/a,n/a,"Assess effectiveness of action, for use in future plans ",P04,,,,,
7,Plan,Plan Objectives,Dismiss,Discredit Credible Sources,"Plan to delegitimize the media landscape and degrade public trust in reporting, by discrediting credible sources. This makes it easier to promote influence operation content.",ST0001,,,,AMITT,T0067 Plan to Discredit Credible Sources
16,Plan,Target Audience Analysis,Map Target Audience Information Environment,Monitor Social Media Analytics,"An influence operation may use social media analytics to determine which factors will increase  the operation content’s exposure to its target audience on social media platforms, including  views, interactions, and sentiment relating to topics and content types. The social media platform  itself or a third-party tool may collect the metrics.  ",ST0002,,,,SPICE,
17,Plan,Target Audience Analysis,Map Target Audience Information Environment,Evaluate Media Surveys,"An influence operation may evaluate its own or third-party media surveys to determine what type  of content appeals to its target audience. Media surveys may provide insight into an audience’s  political views, social class, general interests, or other indicators used to tailor operation messaging to its target audience.",ST0003,,,,SPICE,
18,Plan,Target Audience Analysis,Map Target Audience Information Environment,Identify Trending Topics/Hashtags,An influence operation may identify trending hashtags on social media platforms for later use in  boosting operation content. A hashtag40 refers to a word or phrase preceded by the hash symbol  (#) on social media used to identify messages and posts relating to a specific topic. All public  posts that use the same hashtag are aggregated onto a centralized page dedicated to the word or  phrase and sorted either chronologically or by popularity. ,ST0004,,,,SPICE,
19,Plan,Target Audience Analysis,Map Target Audience Information Environment,Conduct Web Traffic Analysis,"An influence operation may conduct web traffic analysis to determine which search engines,  keywords, websites, and advertisements gain the most traction with its target audience.",ST0005,,,,SPICE,
20,Plan,Target Audience Analysis,Map Target Audience Information Environment,Assess Degree/Type of Media Access,"An influence operation may survey a target audience’s Internet availability and degree of media  freedom to determine which target audience members will have access to operation content and  on which platforms. An operation may face more difficulty targeting an information  environment with heavy restrictions and media control than an environment with independent  media, freedom of speech and of the press, and individual liberties. ",ST0006,,,,SPICE,
22,Plan,Target Audience Analysis,Identify Social and Technical Vulnerabilities,Find Echo Chambers,"Find or plan to create areas (social media groups, search term groups, hashtag groups etc) where individuals only engage with people they agree with. ",ST0007,,,,AMITT,
23,Plan,Target Audience Analysis,Identify Social and Technical Vulnerabilities,Identify Data Voids,"A data void refers to a word or phrase that results in little, manipulative, or low-quality search  engine data. Data voids are hard to detect and relatively harmless until exploited by an entity  aiming to quickly proliferate false or misleading information during a phenomenon that causes a  high number of individuals to query the term or phrase. In the Plan phase, an influence operation  may identify data voids for later exploitation in the operation.  
A 2019 report by Michael Golebiewski identifies five types of data voids. (1) “Breaking news”  data voids occur when a keyword gains popularity during a short period of time, allowing an  influence operation to publish false content before legitimate news outlets have an opportunity to  publish relevant information. (2) An influence operation may create a “strategic new terms” data  void by creating their own terms and publishing information online before promoting their  keyword to the target audience. (3) An influence operation may publish content on “outdated  terms” that have decreased in popularity, capitalizing on most search engines’ preferences for  recency. (4) “Fragmented concepts” data voids separate connections between similar ideas,  isolating segment queries to distinct search engine results. (5) An influence operation may use  “problematic queries” that previously resulted in disturbing or inappropriate content to promote  messaging until mainstream media recontextualizes the term.  ",ST0008,,,,SPICE,
24,Plan,Target Audience Analysis,Identify Social and Technical Vulnerabilities,Identify Existing Prejudices,"An influence operation may exploit existing racial, religious, demographic, or social prejudices to further polarize its target audience from the rest of the public.",ST0009,,,,SPICE,
25,Plan,Target Audience Analysis,Identify Social and Technical Vulnerabilities,Identify Existing Fissures,"An influence operation may identify existing fissures to pit target populations against one  another or facilitate a “divide-and-conquer"" approach to tailor operation narratives along the  divides.",ST0010,,,,,
26,Plan,Target Audience Analysis,Identify Social and Technical Vulnerabilities,Identify Existing Conspiracy Narratives/Suspicions,An influence operation may assess preexisting conspiracy theories or suspicions in a population  to identify existing narratives that support operational objectives.  ,ST0011,,,,SPICE,
27,Plan,Target Audience Analysis,Identify Social and Technical Vulnerabilities,Identify Wedge Issues,"A wedge issue is a divisive political issue, usually concerning a social phenomenon, that  divides individuals along a defined line. An influence operation may exploit wedge issues by  intentionally polarizing the public along the wedge issue line and encouraging opposition  between factions.",ST0012,,,,SPICE,
28,Plan,Target Audience Analysis,Identify Social and Technical Vulnerabilities,Identify Target Audience Adversaries,"An influence operation may identify or create a real or imaginary adversary to center operation  narratives against. A real adversary may include certain politicians or political parties while  imaginary adversaries may include falsified “deep state”62 actors that, according to conspiracies,  run the state behind public view. ",ST0013,,,,SPICE,
29,Plan,Target Audience Analysis,Identify Social and Technical Vulnerabilities,Identify Media System Vulnerabilities,"An influence operation may exploit existing weaknesses in a target’s media system. These  weaknesses may include existing biases among media agencies, vulnerability to false news  agencies on social media, or existing distrust of traditional media sources. An existing distrust  among the public in the media system’s credibility holds high potential for exploitation by an  influence operation when establishing alternative news agencies to spread operation content. ",ST0014,,,,SPICE,
31,Plan,Target Audience Analysis,Segment Audiences,Geographic Segmentation,"An influence operation may target populations in a specific geographic location, such as a  region, state, or city. An influence operation may use geographic segmentation to Create  Localized Content (see: Establish Legitimacy).  ",ST0015,,,,SPICE,
32,Plan,Target Audience Analysis,Segment Audiences,Demographic Segmentation,"An influence operation may target populations based on demographic segmentation, including  age, gender, and income. Demographic segmentation may be useful for influence operations  aiming to change state policies that affect a specific population sector. For example, an influence  operation attempting to influence Medicare funding in the United States would likely target U.S.  voters over 65 years of age. ",ST0016,,,,SPICE,
33,Plan,Target Audience Analysis,Segment Audiences,Economic Segmentation,"An influence operation may target populations based on their income bracket, wealth, or other  financial or economic division. ",ST0017,,,,SPICE,
34,Plan,Target Audience Analysis,Segment Audiences,Psychographic Segmentation,"An influence operation may target populations based on psychographic segmentation, which uses  audience values and decision-making processes. An operation may individually gather  psychographic data with its own surveys or collection tools or externally purchase data from  social media companies or online surveys, such as personality quizzes.  ",ST0018,,,,SPICE,
35,Plan,Target Audience Analysis,Segment Audiences,Political Segmentation,"An influence operation may target populations based on their political affiliations, especially  when aiming to manipulate voting or change policy.",ST0019,,,,SPICE,
42,Prepare,Develop Narratives,Leverage Conspiracy Theory Narratives,Amplify Existing Conspiracy Theory Narrative,,ST0020,,,,,
43,Prepare,Develop Narratives,Leverage Conspiracy Theory Narratives,Develop Original Conspiracy Theory Narratives,,ST0021,,,,,
49,Prepare,Develop Content,Reuse Existing Content,Use Copypasta,"Copypasta refers to a piece of text that has been copied and pasted multiple times across various online platforms. A copypasta’s final form may differ from its original source text as users add, delete, or otherwise edit the content as they repost the text. ",ST0022,,,,,
50,Prepare,Develop Content,Reuse Existing Content,Plagiarize Content,,ST0023,,,,,
51,Prepare,Develop Content,Reuse Existing Content,Deceptively Labeled or Translated,,ST0024,,,,,
52,Prepare,Develop Content,Reuse Existing Content,Appropriate Content,,ST0025,,,,,
54,Prepare,Develop Content,Develop Text-based Content,Develop AI-Generated Text,"AI-generated texts refers to synthetic text composed by computers using text-generating AI  technology. Autonomous generation refers to content created by a bot without human  input, also known as bot-created content generation. Autonomous generation represents  the next step in automation after language generation and may lead to automated  journalism. An influence operation may use read fakes or autonomous generation to  quickly develop and distribute content to the target audience.",ST0026,,,,,
55,Prepare,Develop Content,Develop Text-based Content,Develop False or Altered Documents,,ST0027,,,,,
56,Prepare,Develop Content,Develop Text-based Content,Develop Inauthentic News Articles,,ST0028,,,,,
58,Prepare,Develop Content,Develop Image-based Content,Develop Memes,"Memes are one of the most important single artefact types in all of computational propaganda. Memes in this framework denotes the narrow image-based definition. But that naming is no accident, as these items have most of the important properties of Dawkins' original conception as a self-replicating unit of culture. Memes pull together reference and commentary; image and narrative; emotion and message. Memes are a powerful tool and the heart of modern influence campaigns.",ST0029,,,,,T0021 Develop Memes (AMITT)
59,Prepare,Develop Content,Develop Image-based Content,Develop AI-Generated Images (Deepfakes),"Deepfakes refer to AI-generated falsified photos, videos, or soundbites. An influence operation may use deepfakes to depict an inauthentic situation by synthetically recreating an individual’s face, body, voice, and physical gestures.",ST0030,,,,,
60,Prepare,Develop Content,Develop Image-based Content,Deceptively Edit Image (Cheap fakes),"Cheap fakes utilize less sophisticated measures of altering an image, video, or audio for example, slowing, speeding, or cutting footage to create a false context surrounding an image or event.",ST0031,,,,,
61,Prepare,Develop Content,Develop Image-based Content,Aggregate Information into Evidence Collages,image files that aggregate positive evidence (Joan Donovan),ST0032,,,,,
63,Prepare,Develop Content,Develop Video-based Content, Develop AI-Generated Videos (Deepfakes),"Deepfakes refer to AI-generated falsified photos, videos, or soundbites. An influence operation may use deepfakes to depict an inauthentic situation by synthetically recreating an individual’s face, body, voice, and physical gestures.",ST0033,,,,,
64,Prepare,Develop Content,Develop Video-based Content,Deceptively Edit Video (Cheap fakes),"Cheap fakes utilize less sophisticated measures of altering an image, video, or audio for example, slowing, speeding, or cutting footage to create a false context surrounding an image or event.",ST0034,,,,,
66,Prepare,Develop Content,Develop Audio-based Content,Develop AI-Generated Audio (Deepfakes),"Deepfakes refer to AI-generated falsified photos, videos, or soundbites. An influence operation may use deepfakes to depict an inauthentic situation by synthetically recreating an individual’s face, body, voice, and physical gestures.",ST0035,,,,,
67,Prepare,Develop Content,Develop Audio-based Content,Deceptively Edit Audio (Cheap fakes),"Cheap fakes utilize less sophisticated measures of altering an image, video, or audio for example, slowing, speeding, or cutting footage to create a false context surrounding an image or event.",ST0036,,,,,
69,Prepare,Develop Content,Generate information pollution,Create fake research,"Create fake academic research. Example: fake social science research is often aimed at hot-button social issues such as gender, race and sexuality. Fake science research can target Climate Science debate or pseudoscience like anti-vaxx",ST0037,,,,,T0026 Create fake research (AMITT)
70,Prepare,Develop Content,Generate information pollution,Hijack Hashtags,,ST0038,,,,,
72,Prepare,Develop Content,Distort facts,Reframe Context,"Reframing context refers to removing an event from its surrounding context to distort its  intended meaning. Rather than deny that an event occurred, reframing context frames an event in  a manner that may lead the target audience to draw a different conclusion about its intentions. ",ST0039,,,,,
73,Prepare,Develop Content,Distort facts,Edit Open-Source Content,"An influence operation may edit open-source content, such as collaborative blogs or  encyclopedias, to promote its narratives on outlets with existing credibility and audiences. Editing open-source content may allow an operation to post content on platforms without  dedicating resources to the creation and maintenance of its own assets. ",ST0040,,,,,
76,Prepare,Develop Content,Obtain Private Documents,Leak Authentic Documents,,ST0041,,,,,
77,Prepare,Develop Content,Obtain Private Documents,Leak False Documents,,ST0042,,,,,
78,Prepare,Develop Content,Obtain Private Documents,Leak Altered Documents,"Obtain documents (eg by theft or leak), then alter and release, possibly among factual documents/sources.",ST0043,,,,,T0025 Leak altered documents (AMITT)
81,Prepare,Establish Social Assets,Create Inauthentic Accounts,Create Anonymous Accounts,Anonymous accounts or anonymous users refer to users that access network resources without  providing a username or password. An influence operation may use anonymous accounts to spread content without direct attribution to the operation. ,ST0044,,,,SPICE,
82,Prepare,Establish Social Assets,Create Inauthentic Accounts,Create Cyborg Accounts,"Cyborg accounts refer to partly manned, partly automated social media accounts. Cyborg  accounts primarily act as bots, but a human operator periodically takes control of the account to  engage with real social media users by responding to comments and posting original content.  Influence operations may use cyborg accounts to reduce the amount of direct human input  required to maintain a regular account but increase the apparent legitimacy of the cyborg account  by occasionally breaking its bot-like behavior with human interaction. ",ST0045,,,,SPICE,
83,Prepare,Establish Social Assets,Create Inauthentic Accounts,Create Bot Accounts,"Bots refer to autonomous internet users that interact with systems or other users while imitating  traditional human behavior. Bots use a variety of tools to stay active without direct human  operation, including artificial intelligence and big data analytics. For example, an individual may  program a Twitter bot to retweet a tweet every time it contains a certain keyword or hashtag. An  influence operation may use bots to increase its exposure and artificially promote its content  across the internet without dedicating additional time or human resources.  
Amplifier bots promote operation content through reposts, shares, and likes to increase the  content’s online popularity. Hacker bots are traditionally covert bots running on computer  scripts that rarely engage with users and work primarily as agents of larger cyberattacks, such as  a Distributed Denial of Service attacks. Spammer bots are programmed to post content on  social media or in comment sections, usually as a supplementary tool. Impersonator bots102 pose as real people by mimicking human behavior, complicating their detection.  ",ST0046,,,,SPICE,
84,Prepare,Establish Social Assets,Create Inauthentic Accounts,Create Sockpuppet Accounts,Sockpuppet accounts refer to falsified accounts that either promote the influence operation’s  own material or attack critics of the material online. Individuals who control sockpuppet  accounts also man at least one other user account.67 Sockpuppet accounts help legitimize  operation narratives by providing an appearance of external support for the material and  discrediting opponents of the operation. ,ST0047,,,,SPICE,
86,Prepare,Establish Social Assets,Recruit bad actors,Recruit Contractors,,ST0048,,,,,
87,Prepare,Establish Social Assets,Recruit bad actors,Recruit Partisans,,ST0049,,,,,
88,Prepare,Establish Social Assets,Recruit bad actors,Enlist Troll Accounts,"An influence operation may hire trolls, or human operators of fake accounts that aim to provoke  others by posting and amplifying content about controversial issues. Trolls can serve to discredit  an influence operation’s opposition or bring attention to the operation’s cause through debate.  
Classic trolls refer to regular people who troll for personal reasons, such as attention-seeking or  boredom. Classic trolls may advance operation narratives by coincidence but are not directly  affiliated with any larger operation. Conversely, hybrid trolls act on behalf of another institution, such as a state or financial organization, and post content with a specific ideological  goal. Hybrid trolls may be highly advanced and institutionalized or less organized and work for a  single individual. ",ST0050,,,,,
91,Prepare,Establish Social Assets,Build Network,Create Organizations,"Influence operations may establish organizations with legitimate or falsified hierarchies, staff, and content to structure operation assets, provide a sense of legitimacy to the operation, or provide institutional backing to operation activities.",ST0051,,,,,
92,Prepare,Establish Social Assets,Build Network,Follow Trains,,ST0052,,,,,
93,Prepare,Establish Social Assets,Build Network,Create Community or Sub-group,,ST0053,,,,,
95,Prepare,Establish Social Assets,Acquire/ recruit Network,Fund Proxies,"An influence operation may fund proxies, or external entities that work for the operation. An  operation may recruit/train users with existing sympathies towards the operation’s narratives  and/or goals as proxies. Funding proxies serves various purposes including: 
- Diversifying operation locations to complicate attribution  
- Reducing the workload for direct operation assets  ",ST0054,,,,,
96,Prepare,Establish Social Assets,Acquire/ recruit Network,Botnets,,ST0055,,,,,
98,Prepare,Establish Social Assets,Infiltrate Existing Networks,Identify susceptible targets in networks,,ST0056,,,,,TK0016 Identify susceptible targets in networks (AMITT)
99,Prepare,Establish Social Assets,Infiltrate Existing Networks,Utilize Butterfly Attack,"Butterfly attacks occur when operators pretend to be members of a certain social group, usually  a group that struggles for representation. An influence operation may mimic a group to insert  controversial statements into the discourse, encourage the spread of operation content, or promote harassment among group members. Unlike astroturfing, butterfly attacks aim to  infiltrate and discredit existing grassroots movements, organizations, and media campaigns.  ",ST0057,,,,,
105,Prepare,Establish Social Assets,Prepare fundraising campaigns,From bad actors,,ST0058,,,,,
106,Prepare,Establish Social Assets,Prepare fundraising campaigns,From ignorant agents,,ST0059,,,,,
108,Prepare,Establish Social Assets,Leverage Content Farm,Create a Content Farm,,ST0060,,,,,
109,Prepare,Establish Social Assets,Leverage Content Farm,Outsource Content Creation to External Organizations,"An influence operation may outsource content creation to external companies to avoid  attribution, increase the rate of content creation, or improve content quality, i.e., by employing an organization that can create content in the target audience’s native language. Employed  organizations may include marketing companies for tailored advertisements or external content  farms for high volumes of targeted media.  ",ST0061,,,,,
113,Prepare,Establish Legitimacy,Create fake experts,Utilize Academic/Pseudoscientific Justifications,,ST0062,,,,,
115,Prepare,Establish Legitimacy,Create personas,Backstop personas ,"Create other assets/dossier/cover/fake relationships and/or connections or documents, sites, bylines, attributions, to establish/augment/inflate crediblity/believability",ST0063,,,,,T0030 Backstop personas (AMITT)
117,Prepare,Establish Legitimacy,Establish Inauthentic News Sites,Create Inauthentic News Sites,,ST0064,,,,,T0008 Create fake or imposter news sites (AMITT)
118,Prepare,Establish Legitimacy,Establish Inauthentic News Sites,Leverage Existing Inauthentic News Sites,"An influence operation may prepare assets impersonating legitimate entities to further conceal its  network identity and add a layer of legitimacy to its operation content. Users will more likely  believe and less likely fact-check news from recognizable sources rather than unknown sites.  Legitimate entities may include authentic news outlets, public figures, organizations, or state  entities.  
An influence operation may use a wide variety of cyber techniques to impersonate a legitimate  entity’s website or social media account. Typosquatting87 is the international registration of a  domain name with purposeful variations of the impersonated domain name through intentional  typos, top-level domain (TLD) manipulation, or punycode. Typosquatting facilitates the creation  of falsified websites by creating similar domain names in the URL box, leaving it to the user to  confirm that the URL is correct.  ",ST0065,,,,,
120,Prepare,Establish Legitimacy,Prepare Assets Impersonating Legitimate Entities,Astroturfing,"Astroturfing occurs when an influence operation disguises itself as grassroots movement or  organization that supports operation narratives. Unlike butterfly attacks, astroturfing aims to  increase the appearance of popular support for the operation cause and does not infiltrate existing  groups to discredit their objectives.  ",ST0066,,,,,
121,Prepare,Establish Legitimacy,Prepare Assets Impersonating Legitimate Entities,Spoof/parody account/site,,ST0067,,,,,
123,Prepare,Establish Legitimacy,Co-opt Trusted Sources,Co-Opt Trusted Individuals,,ST0068,,,,,
124,Prepare,Establish Legitimacy,Co-opt Trusted Sources,Co-Opt Grassroots Groups,,ST0069,,,,,
125,Prepare,Establish Legitimacy,Co-opt Trusted Sources,Co-opt Influencers,,ST0070,,,,,TK0013 Find Influencers (AMITT)
132,Execute,Microtarget,Leverage Echo Chambers/Filter Bubbles,Use existing Echo Chambers/Filter Bubbles,,ST0071,,,,,
133,Execute,Microtarget,Leverage Echo Chambers/Filter Bubbles,Create Echo Chambers/Filter Bubbles,,ST0072,,,,,
134,Execute,Microtarget,Leverage Echo Chambers/Filter Bubbles,Exploit Data Voids,"A data void refers to a word or phrase that results in little, manipulative, or low-quality search  engine data. Data voids are hard to detect and relatively harmless until exploited by an entity  aiming to quickly proliferate false or misleading information during a phenomenon that causes a  high number of individuals to query the term or phrase. In the Plan phase, an influence operation  may identify data voids for later exploitation in the operation.  
A 2019 report by Michael Golebiewski identifies five types of data voids. (1) “Breaking news”  data voids occur when a keyword gains popularity during a short period of time, allowing an  influence operation to publish false content before legitimate news outlets have an opportunity to  publish relevant information. (2) An influence operation may create a “strategic new terms” data  void by creating their own terms and publishing information online before promoting their  keyword to the target audience. (3) An influence operation may publish content on “outdated  terms” that have decreased in popularity, capitalizing on most search engines’ preferences for  recency. (4) “Fragmented concepts” data voids separate connections between similar ideas,  isolating segment queries to distinct search engine results. (5) An influence operation may use  “problematic queries” that previously resulted in disturbing or inappropriate content to promote  messaging until mainstream media recontextualizes the term.  ",ST0073,,,,,
137,Execute,Select Channels and Affordances,Chat apps,Use Encrypted Chat Apps,,ST0074,,,,,
138,Execute,Select Channels and Affordances,Chat apps,Use Unencrypted Chats Apps,,ST0075,,,,,
140,Execute,Select Channels and Affordances,Livestream,Video Livestream,,ST0076,,,,,
141,Execute,Select Channels and Affordances,Livestream,Audio Livestream,,ST0077,,,,,
143,Execute,Select Channels and Affordances, Social Networks,Mainstream Social Networks,"Examples include Facebook, Twitter, LinkedIn, VK, ",ST0078,,,,,
144,Execute,Select Channels and Affordances, Social Networks,Dating Apps,,ST0079,,,,,
145,Execute,Select Channels and Affordances, Social Networks,Private/Closed Social Networks,,ST0080,,,,,
146,Execute,Select Channels and Affordances, Social Networks,Interest-Based Networks,"Examples include smaller and niche networks including Gettr, Truth Social, Parler, etc.",ST0081,,,,,
147,Execute,Select Channels and Affordances, Social Networks,Use hashtags,"Use a dedicated, existing hashtag for the campaign/incident.",ST0082,,,,,T0055 Use hashtags (AMITT)
148,Execute,Select Channels and Affordances, Social Networks,Create dedicated hashtag,Create a campaign/incident specific hashtag.,ST0083,,,,,
150,Execute,Select Channels and Affordances,Media Sharing Networks,Photo Sharing,"Examples include Instagram, Snapchat, Flickr, etc",ST0084,,,,,
151,Execute,Select Channels and Affordances,Media Sharing Networks,Video Sharing,"Examples include Youtube, TikTok, ShareChat, Rumble, etc",ST0085,,,,,
152,Execute,Select Channels and Affordances,Media Sharing Networks,Audio sharing,"Examples include podcasting apps, Soundcloud, etc.",ST0086,,,,,
154,Execute,Select Channels and Affordances,Discussion Forums,Anonymous Message Boards,Examples include the Chans,ST0087,,,,,
161,Execute,Select Channels and Affordances,Traditional Media,TV,,ST0088,,,,,
162,Execute,Select Channels and Affordances,Traditional Media,Newspaper,,ST0089,,,,,
163,Execute,Select Channels and Affordances,Traditional Media,Radio,,ST0090,,,,,
175,Execute,Deliver Content,Deliver Ads,Social media,,ST0091,,,,,
176,Execute,Deliver Content,Deliver Ads,Traditional Media,"Examples include TV, Radio, Newspaper, billboards",ST0092,,,,,
178,Execute,Deliver Content,Post Content,Share Memes,"Memes are one of the most important single artefact types in all of computational propaganda. Memes in this framework denotes the narrow image-based definition. But that naming is no accident, as these items have most of the important properties of Dawkins' original conception as a self-replicating unit of culture. Memes pull together reference and commentary; image and narrative; emotion and message. Memes are a powerful tool and the heart of modern influence campaigns.",ST0093,,,,,
179,Execute,Deliver Content,Post Content,Post Violative Content to Provoke Takedown and Backlash,,ST0094,,,,,
180,Execute,Deliver Content,Post Content,One-Way Direct Posting,"Direct posting refers to a method of posting content via a one-way messaging service, where the  recipient cannot directly respond to the poster’s messaging. An influence operation may post  directly to promote operation narratives to the target audience without allowing opportunities for  fact-checking or disagreement, creating a false sense of support for the narrative. ",ST0095,,,,,
182,Execute,Deliver Content,Comment or Reply on Content,Post inauthentic social media comment,"Use government-paid social media commenters, astroturfers, chat bots (programmed to reply to specific key words/hashtags) influence online conversations, product reviews, web-site comment forums.",ST0096,,,,,T0051 Fabricate social media comment (AMITT)
186,Execute,Maximize Exposure,Flooding the Information Space,Trolls amplify and manipulate,"Use trolls to amplify narratives and/or manipulate narratives. Fake profiles/sockpuppets operating to support individuals/narratives from the entire political spectrum (left/right binary). Operating with increased emphasis on promoting local content and promoting real Twitter users generating their own, often divisive political content, as it's easier to amplify existing content than create new/original content. Trolls operate where ever there's a socially divisive issue (issues that can/are be politicized).",ST0097,,,,,T0053 Trolls amplify and manipulate (AMITT)
187,Execute,Maximize Exposure,Flooding the Information Space,Hijack existing hashtag,Take over an existing hashtag to drive exposure.,ST0098,,,,,
188,Execute,Maximize Exposure,Flooding the Information Space,Bots Amplify via Automated Forwarding and Reposting,"Automated forwarding and reposting refer to the proliferation of operation content using  automated means, such as artificial intelligence or social media bots. An influence operation may  use automated activity to increase content exposure without dedicating the resources, including  personnel and time, traditionally required to forward and repost content. 
Use bots to amplify narratives above algorithm thresholds. Bots are automated/programmed profiles designed to amplify content (ie: automatically retweet or like) and give appearance it's more ""popular"" than it is. They can operate as a network, to function in a coordinated/orchestrated manner. In some cases (more so now) they are an inexpensive/disposable assets used for minimal deployment as bot detection tools improve and platforms are more responsive.",ST0099,,,,,
189,Execute,Maximize Exposure,Flooding the Information Space,Utilize Spamoflauge,"Spamoflauge refers to the practice of disguising spam messages as legitimate. Spam refers to  the use of electronic messaging systems to send out unrequested or unwanted messages in bulk.  Simple methods of spamoflauge include replacing letters with numbers to fool keyword-based  email spam filters, for example, ""you've w0n our jackp0t!"". Spamoflauge may extend to more complex techniques such as modifying the grammar or word choice of the language, casting  messages as images which spam detectors cannot automatically read, or encapsulating messages  in password protected attachments, such as .pdf or .zip files. Influence operations may use spamoflauge to avoid spam filtering systems and increase the likelihood of the target audience  receiving operation messaging. ",ST0100,,,,,
190,Execute,Maximize Exposure,Flooding the Information Space,Conduct Swarming,"Swarming refers to the coordinated use of accounts to overwhelm the information space with  operation content. Unlike information flooding, swarming centers exclusively around a specific  event or actor rather than a general narrative. Swarming relies on “horizontal communication”  between information assets rather than a top-down, vertical command-and-control approach. ",ST0101,,,,,
191,Execute,Maximize Exposure,Flooding the Information Space,Conduct Keyword Squatting,"Keyword squatting refers to the creation of online content, such as websites, articles, or social  media accounts, around a specific search engine-optimized term to overwhelm the search results  of that term. An influence may keyword squat to increase content exposure to target audience  members who query the exploited term in a search engine and manipulate the narrative around  the term.  ",ST0102,,,,,
192,Execute,Maximize Exposure,Flooding the Information Space,Inauthentic Sites Amplify News and Narratives,"Inauthentic sites circulate cross-post stories and amplify narratives. Often these sites have no masthead, bylines or attribution.",ST0103,,,,,
195,Execute,Maximize Exposure,Cross-Posting,Post Across Groups,,ST0104,,,,,
196,Execute,Maximize Exposure,Cross-Posting,Post Across Platform,,ST0105,,,,,
197,Execute,Maximize Exposure,Cross-Posting,Post Across Disciplines,,ST0106,,,,,
199,Execute,Maximize Exposure,Incentivize Sharing,Use Affiliate Marketing Programs,,ST0107,,,,,
200,Execute,Maximize Exposure,Incentivize Sharing,Use Contests and Prizes,,ST0108,,,,,
202,Execute,Maximize Exposure,Manipulate Platform Algorithm,Bypass Content Blocking,"Bypassing content blocking refers to actions taken to circumvent network security measures that  prevent users from accessing certain servers, resources, or other online spheres. An influence  operation may bypass content blocking to proliferate its content on restricted areas of the  internet. Common strategies for bypassing content blocking include:
- Altering IP addresses to avoid IP filtering  
- Using a Virtual Private Network (VPN) to avoid IP filtering 
- Using a Content Delivery Network (CDN) to avoid IP filtering 
- Enabling encryption to bypass packet inspection blocking 
- Manipulating text to avoid filtering by keywords 
- Posting content on multiple platforms to avoid platform-specific removals - Using local facilities or modified DNS servers to avoid DNS filtering ",ST0109,,,,,
206,Execute,Drive Online Harms,Harass,"Boycott/""Cancel"" Opponents","Cancel culture refers to the phenomenon in which individuals collectively refrain from  supporting an individual, organization, business, or other entity, usually following a real or  falsified controversy. An influence operation may exploit cancel culture by emphasizing an  adversary’s problematic or disputed behavior and presenting its own content as an alternative. ",ST0110,,,,,
207,Execute,Drive Online Harms,Harass,Harass People Based on Identities,"Examples include social identities like gender, sexuality, race, ethnicity, religion, ability, nationality, etc. as well as roles and occupations like journalist or activist.",ST0111,,,,,
208,Execute,Drive Online Harms,Harass,Threaten to Dox,"Doxing refers to online harassment in which individuals publicly release private information  about another individual, including names, addresses, employment information, pictures, family  members, and other sensitive information. An influence operation may dox its opposition to  encourage individuals aligned with operation narratives to harass the doxed individuals  themselves or otherwise discourage the doxed individuals from posting or proliferating  conflicting content. ",ST0112,,,,,
209,Execute,Drive Online Harms,Harass,Dox,"Doxing refers to online harassment in which individuals publicly release private information  about another individual, including names, addresses, employment information, pictures, family  members, and other sensitive information. An influence operation may dox its opposition to  encourage individuals aligned with operation narratives to harass the doxed individuals  themselves or otherwise discourage the doxed individuals from posting or proliferating  conflicting content. ",ST0113,,,,,
212,Execute,Drive Online Harms,Control Information Environment through Offensive Cyberspace Operations,Delete Opposing Content,"Deleting opposing content refers to the removal of content that conflicts with operational  narratives from selected platforms. An influence operation may delete opposing content to  censor contradictory information from the target audience, allowing operation narratives to take  priority in the information space.",ST0114,,,,,
213,Execute,Drive Online Harms,Control Information Environment through Offensive Cyberspace Operations,Block Content,Content blocking refers to actions taken to restrict internet access or render certain areas of the  internet inaccessible. An influence operation may restrict content based on both network and  content attributes. ,ST0115,,,,,
214,Execute,Drive Online Harms,Control Information Environment through Offensive Cyberspace Operations,Destroy Information Generation Capabilities,"Destroying information generation capabilities refers to actions taken to limit, degrade, or  otherwise incapacitate an actor’s ability to generate conflicting information. An influence operation may destroy an actor’s information generation capabilities by physically dismantling  the information infrastructure, disconnecting resources needed for information generation, or  redirecting information generation personnel. An operation may destroy an adversary’s  information generation capabilities to limit conflicting content exposure to the target audience  and crowd the information space with its own narratives. ",ST0116,,,,,
215,Execute,Drive Online Harms,Control Information Environment through Offensive Cyberspace Operations,Conduct Server Redirect,"A server redirect, also known as a URL redirect, occurs when a server automatically forwards a  user from one URL to another using server-side scripting languages. An influence operation may  conduct a server redirect to divert target audience members from one website to another without  their knowledge. The redirected website may pose as a legitimate source, host malware, or  otherwise aid operation objectives.",ST0117,,,,,
217,Execute,Drive Online Harms,Suppress Opposition,Report Non-Violative Opposing Content,"Reporting opposing content refers to notifying and providing an instance of a violation of a  platform’s guidelines and policies for conduct on the platform. In addition to simply reporting  the content, an operation may leverage copyright regulations to trick social media and web  platforms into removing opposing content by manipulating the content to appear in violation of  copyright laws. Reporting opposing content facilitates the suppression of contradictory  information and allows operation narratives to take priority in the information space. ",ST0118,,,,,
218,Execute,Drive Online Harms,Suppress Opposition,Goad People into Harmful Action (Stop Hitting Yourself),Goad people into actions that violate terms of service or will lead to having their content or accounts taken down. ,ST0119,,,,,
219,Execute,Drive Online Harms,Suppress Opposition,Exploit Platform TOS/Content Moderation,,ST0120,,,,,
223,Execute,Drive Offline Activity,Encourage Attendance at Events,Call to action to attend ,,ST0121,,,,,
224,Execute,Drive Offline Activity,Encourage Attendance at Events,Facilitate logistics or support for attendance,"Facilitate logistics or support for travel, food, housing, etc.",ST0122,,,,,
226,Execute,Drive Offline Activity,Organize Events,Pay for Physical Action,"Paying for physical action occurs when an influence operation pays individuals to act in the  physical realm. An influence operation may pay for physical action to create specific situations  and frame them in a way that supports operation narratives, for example, paying a group of  people to burn a car to later post an image of the burning car and frame it as an act of protest. ",ST0123,,,,,
227,Execute,Drive Offline Activity,Organize Events,Conduct Symbolic Action,"Symbolic action refers to activities specifically intended to advance an operation’s narrative by  signaling something to the audience, for example, a military parade supporting a state’s narrative  of military superiority. An influence operation may use symbolic action to create falsified  evidence supporting operation narratives in the physical information space.  ",ST0124,,,,,
229,Execute,Drive Offline Activity,Conduct fundraising,Conduct Crowdfunding Campaigns,,ST0125,,,,,
231,Execute,Drive Offline Activity,Physical Violence,Conduct Physical Violence,,ST0126,,,,,
232,Execute,Drive Offline Activity,Physical Violence,Encourage Physical Violence,,ST0127,,,,,
234,Execute,Drive Offline Activity,Merchandising/ Advertising,Sell Merchandise,"Selling merchandise refers to the sale of often branded items to the target audience. An influence  operation may sell merchandise to raise funds and promote its messaging in the physical  information space, for example, by selling t-shirts with operational messaging displayed on the clothing. ",ST0128,,,,,
237,Execute,Persist in the Information Space,Conceal People,Use Pseudonyms,"An operation may use pseudonyms, or fake names, to mask the identity of operation accounts,  publish anonymous content, or otherwise use falsified personas to conceal identity of the  operation. An operation may coordinate pseudonyms across multiple platforms, for example, by  writing an article under a pseudonym and then posting a link to the article on social media on an  account with the same falsified name.  ",ST0129,,,,,
238,Execute,Persist in the Information Space,Conceal People,Conceal Network Identity,"Concealing network identity aims to hide the existence an influence operation’s network  completely. Unlike concealing sponsorship, concealing network identity denies the existence of  any sort of organization. ",ST0130,,,,,
239,Execute,Persist in the Information Space,Conceal People,Distance Reputable Individuals from Operation,"Distancing reputable individuals from the operation occurs when enlisted individuals, such as  celebrities or subject matter experts, actively disengage themselves from operation activities and  messaging. Individuals may distance themselves from the operation by deleting old posts or  statements, unfollowing operation information assets, or otherwise detaching themselves from  the operation’s timeline. An influence operation may want reputable individuals to distance  themselves from the operation to reduce operation exposure, particularly if the operation aims to remove all evidence.",ST0131,,,,,
240,Execute,Persist in the Information Space,Conceal People,Launder Accounts,Account laundering occurs when an influence operation acquires control of previously legitimate  online accounts from third parties through sale or exchange and often in contravention of terms  of use. Influence operations use laundered accounts to reach target audience members from an  existing information channel and complicate attribution.  ,ST0132,,,,,
241,Execute,Persist in the Information Space,Conceal People,Change Names of Accounts,Changing names of accounts occurs when an operation changes the name of an existing social  media account. An operation may change the names of its accounts throughout an operation to  avoid detection or alter the names of newly acquired or repurposed accounts to fit operational  narratives.  ,ST0133,,,,,
243,Execute,Persist in the Information Space,Conceal Operational Activity,Conceal Network Identity,"Concealing network identity aims to hide the existence an influence operation’s network  completely. Unlike concealing sponsorship, concealing network identity denies the existence of  any sort of organization. ",ST0134,,,,,
244,Execute,Persist in the Information Space,Conceal Operational Activity,Generate Content Unrelated to Narrative,"An influence operation may mix its own operation content with legitimate news or external  unrelated content to disguise operational objectives, narratives, or existence. For example, an  operation may generate ""lifestyle"" or ""cuisine"" content alongside regular operation content.  ",ST0135,,,,,
245,Execute,Persist in the Information Space,Conceal Operational Activity,Break Association with Content,"Breaking association with content occurs when an influence operation actively separates itself  from its own content. An influence operation may break association with content by  unfollowing, unliking, or unsharing its content, removing attribution from its content, or  otherwise taking actions that distance the operation from its messaging. An influence operation may break association with its content to complicate attribution or regain credibility for a new operation.  ",ST0136,,,,,
246,Execute,Persist in the Information Space,Conceal Operational Activity,Delete URLs,"URL deletion occurs when an influence operation completely removes its website registration,  rendering the URL inaccessible. An influence operation may delete its URLs to complicate  attribution or remove online documentation that the operation ever occurred.",ST0137,,,,,
247,Execute,Persist in the Information Space,Conceal Operational Activity,Coordinate on encrypted/ closed networks,,ST0138,,,,,
248,Execute,Persist in the Information Space,Conceal Operational Activity,Deny involvement,"Without ""smoking gun"" proof (and even with proof), incident creator can or will deny involvement. This technique also leverages the attacker advantages outlined in ""Demand insurmountable proof"", specifically the asymmetric disadvantage for truth-tellers in a ""firehose of misinformation"" environment.",ST0139,,,,,T0041 Deny involvement (AMITT)
249,Execute,Persist in the Information Space,Conceal Operational Activity,Delete Accounts/Account Activity,"Deleting accounts and account activity occurs when an influence operation removes its online  social media assets, including social media accounts, posts, likes, comments, and other online  artifacts. An influence operation may delete its accounts and account activity to complicate  attribution or remove online documentation that the operation ever occurred.  ",ST0140,,,,,
250,Execute,Persist in the Information Space,Conceal Operational Activity,Redirect URLs,"An influence operation may redirect its falsified or typosquatted URLs to legitimate websites to  increase the operation's appearance of legitimacy, complicate attribution, and avoid detection.  ",ST0141,,,,,
251,Execute,Persist in the Information Space,Conceal Operational Activity,Remove Post Origins,"Removing post origins refers to the elimination of evidence that indicates the initial source of  operation content, often to complicate attribution. An influence operation may remove post  origins by deleting watermarks, renaming files, or removing embedded links in its content.  ",ST0142,,,,,
252,Execute,Persist in the Information Space,Conceal Operational Activity,Misattribute Activity,"Misattributed activity refers to incorrectly attributed operation activity. For example, a state sponsored influence operation may conduct operation activity in a way that mimics another state  so that external entities misattribute activity to the incorrect state. An operation may misattribute  their activities to complicate attribution, avoid detection, or frame an adversary for negative  behavior. ",ST0143,,,,,
253,Execute,Persist in the Information Space,Conceal Infrastructure,Conceal Sponsorship,"Concealing sponsorship aims to mislead or obscure the identity of the hidden sponsor behind an operation rather than entity publicly running the operation. Operations that conceal sponsorship  may maintain visible falsified groups, news outlets, non-profits, or other organizations, but seek  to mislead or obscure the identity sponsoring, funding, or otherwise supporting these entities.  
Influence operations may use a variety of techniques to mask the location of their social media  accounts to complicate attribution and conceal evidence of foreign interference. Operation  accounts may set their location to a false place, often the location of the operation’s target  audience, and post in the region’s language",ST0144,,,,,
255,Execute,Persist in the Information Space,Conceal Infrastructure,Utilize Bulletproof Hosting,"Hosting refers to services through which storage and computing resources are provided to an  individual or organization for the accommodation and maintenance of one or more websites and  related services. Services may include web hosting, file sharing, and email distribution.  Bulletproof hosting refers to services provided by an entity, such as a domain hosting or web  hosting firm, that allows its customer considerable leniency in use of the service. An influence  operation may utilize bulletproof hosting to maintain continuity of service for suspicious, illegal,  or disruptive operation activities that stricter hosting services would limit, report, or suspend. ",ST0145,,,,,
256,Execute,Persist in the Information Space,Conceal Infrastructure,Use Shell Organizations,,ST0146,,,,,
257,Execute,Persist in the Information Space,Conceal Infrastructure,Use Cryptocurrency,,ST0147,,,,,
258,Execute,Persist in the Information Space,Conceal Infrastructure,Obfuscate Payment,,ST0148,,,,,
260,Execute,Persist in the Information Space,Exploit TOS/Content Moderation,Legacy web content,"Make incident content visible for a long time, e.g. by exploiting platform terms of service, or placing it where it's hard to remove or unlikely to be removed.",ST0149,,,,,
261,Execute,Persist in the Information Space,Exploit TOS/Content Moderation,Post Borderline Content,,ST0150,,,,,
266,Assess,Assess Effectiveness,Measure Performance,People Focused,,ST0151,,,,,
267,Assess,Assess Effectiveness,Measure Performance,Content Focused,,ST0152,,,,,
268,Assess,Assess Effectiveness,Measure Performance,View Focused,,ST0153,,,,,
270,Assess,Assess Effectiveness,Measure Effectiveness,Behavior changes,Monitor and evaluate behaviour changes from misinformation incidents. ,ST0154,,,,,T0062 Behaviour changes (AMITT)
271,Assess,Assess Effectiveness,Measure Effectiveness,Content,,ST0155,,,,,
272,Assess,Assess Effectiveness,Measure Effectiveness,Awareness,,ST0156,,,,,
273,Assess,Assess Effectiveness,Measure Effectiveness,Knowledge,,ST0157,,,,,
274,Assess,Assess Effectiveness,Measure Effectiveness,Action/attitude,,ST0158,,,,,
276,Assess,Assess Effectiveness,Measure Effectiveness Indicators (or KPIs),Message reach,Monitor and evaluate message reach in misinformation incidents. ,ST0159,,,,,T0063 Message reach (AMITT)
277,Assess,Assess Effectiveness,Measure Effectiveness Indicators (or KPIs),Social media engagement,Monitor and evaluate social media engagement in misinformation incidents.,ST0160,,,,,T0064 Social media engagement (AMITT)
3,Plan,Plan Strategy,Determine Target Audiences,n/a,,T0001,,,,DISARM Revision Process,
4,Plan,Plan Strategy,Determine Strategic Ends,n/a,,T0002,,,,DISARM Revision Process,
6,Plan,Plan Objectives,Dismiss,n/a,Push back against criticism by dismissing your critics. This might be arguing that the critics use a different standard for you than with other actors or themselves; or arguing that their criticism is biased.,T0003,,,,,
8,Plan,Plan Objectives,Distort,n/a,"Twist the narrative. Take information, or artifacts like images, and change the framing around them.",T0004,,,,AMITT,T0001 5Ds
9,Plan,Plan Objectives,Distract,n/a,"Shift attention to a different narrative or actor, for instance by accusing critics of the same activity that they’ve accused you of (e.g. police brutality).",T0005,,,,AMITT,T0001 5Ds
10,Plan,Plan Objectives,Dismay,n/a,"Threaten the critic or narrator of events. For instance, threaten journalists or news outlets reporting on a story.",T0006,,,,AMITT,T0001 5Ds
11,Plan,Plan Objectives,Divide,n/a,"Create conflict between subgroups, to widen divisions in a community",T0007,,,,AMITT,T0001 5Ds
12,Plan,Plan Objectives,Degrade Adversary,n/a,Plan to degrade an adversary’s image or ability to act. This could include preparation and use of harmful information about the adversary’s actions or reputation.,T0008,,,,AMITT,T0066 Degrade Adversary
13,Plan,Plan Objectives,Facilitate State Propaganda,n/a,Organize citizens around pro-state messaging. Coordinate paid or volunteer groups to push state propaganda.,T0009,,,,AMITT,T0002 Facilitate State Propaganda
15,Plan,Target Audience Analysis,Map Target Audience Information Environment,n/a,"Mapping the target audience information environment analyzes the information space itself,  including social media analytics, web traffic, and media surveys. Mapping the information  environment may help the influence operation determine the most realistic and popular  information channels to reach its target audience. 
Mapping the target audience information environment aids influence operations in determining  the most vulnerable areas of the information space to target with messaging.",T0010,,,,SPICE,TA04 Map Target Audience Information Environment
21,Plan,Target Audience Analysis,Identify Social and Technical Vulnerabilities,n/a,"Identifying social and technical vulnerabilities determines weaknesses within the target audience  information environment for later exploitation. Vulnerabilities include decisive political issues,  weak cybersecurity infrastructure, search engine data voids, and other technical and non technical weaknesses in the target information environment.  
Identifying social and technical vulnerabilities facilitates the later exploitation of the identified  weaknesses to advance operation objectives. ",T0011,,,,SPICE,
30,Plan,Target Audience Analysis,Segment Audiences,n/a,"Create audience segmentations by features of interest to the influence campaign, including political affiliation, geographic location, income, demographics, and psychographics. ",T0012,,,,AMITT,
38,Prepare,Develop Narratives,Develop New Narratives,n/a,,T0013,,,,,
39,Prepare,Develop Narratives,Leverage Existing Narratives,n/a,"Use or adapt existing narrative themes, where narratives are the baseline stories of a target audience. Narratives form the bedrock of our worldviews. New information is understood through a process firmly grounded in this bedrock. If new information is not consitent with the prevailing narratives of an audience, it will be ignored. Effective campaigns will frame their misinformation in the context of these narratives. Highly effective campaigns will make extensive use of audience-appropriate archetypes and meta-narratives throughout their content creation and amplifiction practices. ",T0014,,,,AMITT,T0003 Leverage Existing Narratives (AMITT)
40,Prepare,Develop Narratives,Develop Competing Narratives,n/a,"Advance competing narratives connected to same issue ie: on one hand deny incident while at same time expresses dismiss. Suppressing or discouraging narratives already spreading requires an alternative. The most simple set of narrative techniques in response would be the construction and promotion of contradictory alternatives centered on denial, deflection, dismissal, counter-charges, excessive standards of proof, bias in prohibition or enforcement, and so on. These competing narratives allow loyalists cover, but are less compelling to opponents and fence-sitters than campaigns built around existing narratives or highly explanatory master narratives. Competing narratives, as such, are especially useful in the ""firehose of misinformation"" approach.",T0015,,,,AMITT,T0004 Develop Competing Narratives (AMITT)
41,Prepare,Develop Narratives,Leverage Conspiracy Theory Narratives,n/a,"""Conspiracy narratives"" appeal to the human desire for explanatory order, by invoking the participation of poweful (often sinister) actors in pursuit of their own political goals. These narratives are especially appealing when an audience is low-information, marginalized or otherwise inclined to reject the prevailing explanation. Conspiracy narratives are an important component of the ""firehose of falsehoods"" model. ",T0016,,,,AMITT,T0022 Leverage Conspiracy Theory narratives (AMITT)
44,Prepare,Develop Narratives,Integrate Target Audience Vulnerabilities into Narrative,n/a,"An influence operation may seek to exploit the preexisting weaknesses, fears, and enemies of the  target audience for integration into the operation’s narratives and overall strategy. Integrating  existing vulnerabilities into the operational approach conserves resources by exploiting already  weak areas of the target information environment instead of forcing the operation to create new  vulnerabilities in the environment.",T0017,,,,,
45,Prepare,Develop Narratives,Respond to Breaking News Event or Active Crisis,n/a,"Media attention on a story or event is heightened during a breaking news event, where unclear facts and incomplete information increase speculation, rumors, and conspiracy theories, which are all vulnerable to manipulation. ",T0018,,,,,
46,Prepare,Develop Narratives,Demand insurmountable proof,n/a,"Campaigns often leverage tactical and informational asymmetries on the threat surface, as seen in the Distort and Deny strategies, and the ""firehose of misinformation"". Specifically, conspiracy theorists can be repeatedly wrong, but advocates of the truth need to be perfect. By constantly escalating demands for proof, propagandists can effectively leverage this asymmetry while also priming its future use, often with an even greater asymmetric advantage. The conspiracist is offered freer rein for a broader range of ""questions"" while the truth teller is burdened with higher and higher standards of proof.",T0019,,,,,T0040 Demand insurmountable proof (AMITT)
48,Prepare,Develop Content,Reuse Existing Content,n/a,When an operation recycles content from its own previous  operations or plagiarizes from external operations. An operation may launder information to  conserve resources that would have otherwise been utilized to develop new content. ,T0020,,,,,
53,Prepare,Develop Content,Develop Text-based Content,n/a,,T0021,,,,,
57,Prepare,Develop Content,Develop Image-based Content,n/a,,T0022,,,,,
62,Prepare,Develop Content,Develop Video-based Content,n/a,,T0023,,,,,
65,Prepare,Develop Content,Develop Audio-based Content,n/a,,T0024,,,,,
68,Prepare,Develop Content,Generate information pollution,n/a,"Flood social channels; drive traffic/engagement to all assets; create aura/sense/perception of pervasiveness/consensus (for or against or both simultaneously) of an issue or topic. ""Nothing is true, but everything is possible."" Akin to astroturfing campaign.",T0025,,,,,T0019 Generate information pollution
71,Prepare,Develop Content,Distort facts,n/a,"Change, twist, or exaggerate existing facts to construct a narrative that differs from reality. Examples: images and ideas can be distorted by being placed in an improper content",T0026,,,,,T0023 Distort facts (AMITT)
74,Prepare,Develop Content,Create hashtags and search artifacts,n/a,"Create one or more hashtags and/or hashtag groups. Many incident-based campaigns will create hashtags to promote their fabricated event. Creating a hashtag for an incident can have two important effects: 1. Create a perception of reality around an event. Certainly only ""real"" events would be discussed in a hashtag. After all, the event has a name!, and 2. Publicize the story more widely through trending lists and search behavior. Asset needed to direct/control/manage ""conversation"" connected to launching new incident/campaign with new hashtag for applicable social media sites). ",T0027,,,,,T0015 Create hashtags and search artifacts (AMITT)
75,Prepare,Develop Content,Obtain Private Documents,n/a,,T0028,,,,,
80,Prepare,Establish Social Assets,Create Inauthentic Accounts,n/a,,T0029,,,,,
85,Prepare,Establish Social Assets,Recruit bad actors,n/a,,T0030,,,,,
89,Prepare,Establish Social Assets,Cultivate ignorant agents,n/a,"Cultivate propagandists for a cause, the goals of which are not fully comprehended, and who are used cynically by the leaders of the cause. Independent actors use social media and specialised web sites to strategically reinforce and spread messages compatible with their own. Their networks are infiltrated and used by state media disinformation organisations to amplify the state’s own disinformation strategies against target populations. Many are traffickers in conspiracy theories or hoaxes, unified by a suspicion of Western governments and mainstream media. Their narratives, which appeal to leftists hostile to globalism and military intervention and nationalists against immigration, are frequently infiltrated and shaped by state-controlled trolls and altered news items from agencies such as RT and Sputnik. Also know as ""useful idiots"" or ""unwitting agents"".",T0031,,,,,T0010 Cultivate ignorant agents (AMITT)
90,Prepare,Establish Social Assets,Build Network,n/a,,T0032,,,,,TK0014 Build Network (AMITT)
94,Prepare,Establish Social Assets,Acquire/ recruit Network,n/a,,T0033,,,,,
97,Prepare,Establish Social Assets,Infiltrate Existing Networks,n/a,,T0034,,,,,
100,Prepare,Establish Social Assets,Create Inauthentic Social Media Pages and Groups,n/a,"Create key social engineering assets needed to amplify content, manipulate algorithms, fool public and/or specific incident/campaign targets. Computational propaganda depends substantially on false perceptions of credibility and acceptance. By creating fake users and groups with a variety of interests and commitments, attackers can ensure that their messages both come from trusted sources and appear more widely adopted than they actually are.",T0035,,,,,
101,Prepare,Establish Social Assets,Create inauthentic websites,n/a,"Create media assets to support inauthentic organizations (e.g. think tank), people (e.g. experts) and/or serve as sites to distribute malware/launch phishing operations.",T0036,,,,,T0013 Create fake websites  (AMITT)
102,Prepare,Establish Social Assets,Prepare Physical Broadcast Capabilities,n/a,"Create or coopt broadcast capabilities (e.g. TV, radio etc).",T0037,,,,,T0065 Prepare Physical Broadcast Capabilities (AMITT)
103,Prepare,Establish Social Assets,Develop Owned Media Assets,n/a,"An owned media asset refers to an agency or organization through which an influence operation  may create, develop, and host content and narratives. Owned media assets include websites,  blogs, social media pages, forums, and other platforms that facilitate the creation and  organization of content.",T0038,,,,,
104,Prepare,Establish Social Assets,Prepare fundraising campaigns,n/a,"Fundraising campaigns refer to an influence operation’s systematic effort to seek financial  support for a charity, cause, or other enterprise using online activities that further promote  operation information pathways while raising a profit. Many influence operations have engaged  in crowdfunding services on platforms including Tipee, Patreon, and GoFundMe. An operation  may use its previously prepared fundraising campaigns (see: Develop Information Pathways) to  promote operation messaging while raising money to support its activities.  ",T0039,,,,,T0014 Prepare fundraising campaigns (AMITT)
107,Prepare,Establish Social Assets,Leverage Content Farm,n/a,,T0040,,,,,
111,Prepare,Establish Legitimacy,Compromise legitimate accounts,n/a,Hack or take over legimate accounts to distribute misinformation or damaging content.,T0041,,,,,T0011 Compromise legitimate accounts (AMITT)
112,Prepare,Establish Legitimacy,Create fake experts,n/a,"Stories planted or promoted in computational propaganda operations often make use of experts fabricated from whole cloth, sometimes specifically for the story itself. ",T0042,,,,,T0009 Create fake experts (AMITT)
114,Prepare,Establish Legitimacy,Create personas,n/a,,T0043,,,,,TK0010 Create personas (AMITT)
116,Prepare,Establish Legitimacy,Establish Inauthentic News Sites,n/a,"Modern computational propaganda makes use of a cadre of imposter news sites spreading globally. These sites, sometimes motivated by concerns other than propaganda--for instance, click-based revenue--often have some superficial markers of authenticity, such as naming and site-design. But many can be quickly exposed with reference to their owenership, reporting history and adverstising details.",T0044,,,,,
119,Prepare,Establish Legitimacy,Prepare Assets Impersonating Legitimate Entities,n/a,"An influence operation may prepare assets impersonating legitimate entities to further conceal its  network identity and add a layer of legitimacy to its operation content. Users will more likely  believe and less likely fact-check news from recognizable sources rather than unknown sites.  Legitimate entities may include authentic news outlets, public figures, organizations, or state  entities.  
An influence operation may use a wide variety of cyber techniques to impersonate a legitimate  entity’s website or social media account. Typosquatting87 is the international registration of a  domain name with purposeful variations of the impersonated domain name through intentional  typos, top-level domain (TLD) manipulation, or punycode. Typosquatting facilitates the creation  of falsified websites by creating similar domain names in the URL box, leaving it to the user to  confirm that the URL is correct.  ",T0045,,,,,
122,Prepare,Establish Legitimacy,Co-opt Trusted Sources,n/a,"An influence operation may co-opt trusted sources by infiltrating or repurposing a source to  reach a target audience through existing, previously reliable networks. Co-opted trusted sources  may include:  
- National or local new outlets  
- Research or academic publications  
- Online blogs or websites ",T0046,,,,,
128,Execute,Microtarget,Create Clickbait,n/a,"Create attention grabbing headlines (outrage, doubt, humor) required to drive traffic & engagement. This is a key asset.",T0047,,,,,T0016 Create Clickbait (AMITT)
129,Execute,Microtarget,Purchase Targeted Advertisements,n/a,Create or fund advertisements targeted at specific populations,T0048,,,,,T0018 Purchase Targeted Advertisements (AMITT)
130,Execute,Microtarget,Create Localized Content,n/a,"Localized content refers to content that appeals to a specific community of individuals, often in defined geographic areas. An operation may create localized content using local language and dialects to resonate with its target audience and blend in with other local news and social media. Localized content may help an operation increase legitimacy, avoid detection, and complicate external attribution.",T0049,,,,,
131,Execute,Microtarget,Leverage Echo Chambers/Filter Bubbles,n/a,"An echo chamber refers to an internet subgroup, often along ideological lines, where  individuals only engage with “others with which they are already in agreement.” A filter bubble refers to an algorithm's placement of an individual in content that they agree with or regularly  engage with, possibly entrapping the user into a bubble of their own making. An operation may  create these isolated areas of the internet by match existing groups, or aggregating individuals  into a single target audience based on shared interests, politics, values, demographics, and other  characteristics. Echo chambers and filter bubbles help to reinforce similar biases and content to  the same target audience members. ",T0050,,,,,
136,Execute,Select Channels and Affordances,Chat apps,n/a,"Direct messaging via chat app is an increasing method of delivery. These messages are often automated and new delivery and storage methods make them anonymous, viral, and ephemeral. This is a difficult space to monitor, but also a difficult space to build acclaim or notoriety.",T0051,,,,,T0043 Use SMS/ WhatsApp/ Chat apps (AMITT)
139,Execute,Select Channels and Affordances,Livestream,n/a,,T0052,,,,,
142,Execute,Select Channels and Affordances, Social Networks,n/a,,T0053,,,,,
149,Execute,Select Channels and Affordances,Media Sharing Networks,n/a,"Media sharing networks refer to services whose primary function is the hosting and sharing of specific forms of media. Examples include Instagram, Snapchat, TikTok, Youtube, SoundCloud.",T0054,,,,,
153,Execute,Select Channels and Affordances,Discussion Forums,n/a,"Platforms for finding, discussing, and sharing information and opinions. Examples include Reddit, Quora, Digg, message boards, interest-based discussion forums, etc.",T0055,,,,,
155,Execute,Select Channels and Affordances,Bookmarking and Content Curation,n/a,"Platforms for searching, sharing, and curating content and media. Examples include Pinterest, Flipboard, etc.",T0056,,,,,
156,Execute,Select Channels and Affordances,Blogging and Publishing Networks,n/a,"Examples include WordPress, Blogger, Weebly, Tumblr, Medium, etc. ",T0057,,,,,
157,Execute,Select Channels and Affordances,Consumer Review Networks,n/a,"Platforms for finding, reviewing, and sharing information about brands, products, services, restaurants, travel destinations, etc.  Examples include Yelp, TripAdvisor, etc.",T0058,,,,,
158,Execute,Select Channels and Affordances,Online polls,n/a,"Create fake online polls, or manipulate existing online polls. Data gathering tactic to target those who engage, and potentially their networks of friends/followers as well",T0059,,,,,T0029 Manipulate online polls (AMITT)
159,Execute,Select Channels and Affordances,Formal Diplomatic Channels,n/a,,T0060,,,,,
160,Execute,Select Channels and Affordances,Traditional Media,n/a,"Examples include TV, Newspaper, Radio, etc.",T0061,,,,,
164,Execute,Select Channels and Affordances,Email,n/a,,T0062,,,,,
166,Execute,Conduct Pump Priming,Trial content,n/a,"Iteratively test incident performance (messages, content etc), e.g. A/B test headline/content enagagement metrics; website and/or funding campaign conversion rates",T0063,,,,AMITT,T0020 Trial content (AMITT)
167,Execute,Conduct Pump Priming,Bait legitimate influencers,n/a,"Credibility in a social media environment is often a function of the size of a user's network. ""Influencers"" are so-called because of their reach, typically understood as: 1) the size of their network (i.e. the number of followers, perhaps weighted by their own influence); and 2) The rate at which their comments are re-circulated (these two metrics are related). Add traditional media players at all levels of credibility and professionalism to this, and the number of potential influencial carriers available for unwitting amplification becomes substantial. By targeting high-influence people and organizations in all types of media with narratives and content engineered to appeal their emotional or ideological drivers, influence campaigns are able to add perceived credibility to their messaging via saturation and adoption by trusted agents such as celebrities, journalists and local leaders.",T0064,,,,AMITT,T0039 Bait legitimate influencers (AMITT)
168,Execute,Conduct Pump Priming,Seed Kernel of truth,n/a,"Wrap lies or altered context/facts around truths. Influence campaigns pursue a variety of objectives with respect to target audiences, prominent among them: 1. undermine a narrative commonly referenced in the target audience; or 2. promote a narrative less common in the target audience, but preferred by the attacker. In both cases, the attacker is presented with a heavy lift. They must change the relative importance of various narratives in the interpretation of events, despite contrary tendencies. When messaging makes use of factual reporting to promote these adjustments in the narrative space, they are less likely to be dismissed out of hand; when messaging can juxtapose a (factual) truth about current affairs with the (abstract) truth explicated in these narratives, propagandists can undermine or promote them selectively. Context matters.",T0065,,,,AMITT,T0042 Seed Kernel of truth (AMITT)
169,Execute,Conduct Pump Priming,Seed distortions,n/a,"Try a wide variety of messages in the early hours surrounding an incident or event, to give a misleading account or impression. ",T0066,,,,AMITT,T0044 Seed distortions (AMITT)
170,Execute,Conduct Pump Priming,Use fake experts,n/a,"Use the fake experts that were set up during Establish Legitimacy. Pseudo-experts are disposable assets that often appear once and then disappear. Give ""credility"" to misinformation. Take advantage of credential bias",T0067,,,,AMITT,T0045 Use fake experts (AMITT)
171,Execute,Conduct Pump Priming,Use Search Engine Optimization,n/a,"Manipulate content engagement metrics (ie: Reddit & Twitter) to influence/impact news search results (e.g. Google), also elevates RT & Sputnik headline into Google news alert emails. aka ""Black-hat SEO"" ",T0068,,,,AMITT,T0046 Search Engine Optimization (AMITT)
172,Execute,Conduct Pump Priming,Employ Commercial Analytic Firms,n/a,"Commercial analytic firms collect data on target audience activities and evaluate the data to  detect trends, such as content receiving high click-rates. An influence operation may employ  commercial analytic firms to facilitate external collection on its target audience, complicating attribution efforts and better tailoring the content to audience preferences.  ",T0069,,,,SPICE,Employ Commercial Analytic Firms
174,Execute,Deliver Content,Deliver Ads,n/a,Delivering content via any form of paid media or advertising.,T0070,,,,,
177,Execute,Deliver Content,Post Content,n/a,Delivering content by posting via owned media (assets that the operator controls). ,T0071,,,,,
181,Execute,Deliver Content,Comment or Reply on Content,n/a,Delivering content by replying or commenting via owned media (assets that the operator controls). ,T0072,,,,,
183,Execute,Deliver Content,Attract Traditional Media,n/a,Deliver content by attracting the attention of traditional media (earned media).,T0073,,,,,
185,Execute,Maximize Exposure,Flooding the Information Space,n/a,Flooding and/or mobbing social media channels feeds and/or hashtag with excessive volume of content to control/shape online conversations and/or drown out opposing points of view. Bots and/or patriotic trolls are effective tools to acheive this effect.,T0074,,,,,T0049 Flooding
193,Execute,Maximize Exposure,Amplify Existing Narrative,n/a,An influence operation may amplify existing narratives that align with its narratives to support operation objectives. ,T0075,,,,,
194,Execute,Maximize Exposure,Cross-Posting,n/a,"Cross-posting refers to posting the same message to multiple internet discussions, social media platforms or accounts, or news groups at one time. An influence operation may post content  online in multiple communities and platforms to increase the chances of content exposure to the  target audience. ",T0076,,,,,
198,Execute,Maximize Exposure,Incentivize Sharing,n/a,"Incentivizing content sharing refers to actions that encourage users to share content themselves,  reducing the need for the operation itself to post and promote its own content.",T0077,,,,,
201,Execute,Maximize Exposure,Manipulate Platform Algorithm,n/a,"Manipulating a platform algorithm refers to conducting activity on a platform in a way that  intentionally targets its underlying algorithm. After analyzing a platform’s algorithm (see: Select  Platforms), an influence operation may use a platform in a way that increases its content  exposure, avoids content removal, or otherwise benefits the operation’s strategy. For example, an  influence operation may use bots to amplify its posts so that the platform’s algorithm recognizes  engagement with operation content and further promotes the content on user timelines.  ",T0078,,,,,
203,Execute,Maximize Exposure,Direct Users to Alternative Platforms,n/a,"Direct users to alternative platforms refers to encouraging users to move from the  platform on which they initially viewed operation content and engage with content on alternate  information channels, including separate social media channels and inauthentic websites. An  operation may drive users to alternative platforms to diversify its information channels and ensure the target audience knows where to access operation content if the initial  platform suspends, flags, or otherwise removes original operation assets and content.  ",T0079,,,,,
205,Execute,Drive Online Harms,Harass,n/a,"Threatening or harassing believers of opposing narratives refers to the use of intimidation  techniques, including cyberbullying and doxing, to discourage opponents from voicing their  dissent. An influence operation may threaten or harass believers of the opposing narratives to  deter individuals from posting or proliferating conflicting content.  ",T0080,,,,,
210,Execute,Drive Online Harms,Censor social media as a political force,n/a,Use political influence or the power of state to stop critical social media comments. Government requested/driven content take downs (see Google Transperancy reports).,T0081,,,,,T0047 Censor social media as a political force (AMITT)
211,Execute,Drive Online Harms,Control Information Environment through Offensive Cyberspace Operations,n/a,Controling the information environment through offensive cyberspace operations uses cyber tools and techniques to alter the trajectory of  content in the information space to either prioritize operation messaging or block opposition  messaging.,T0082,,,,,
216,Execute,Drive Online Harms,Suppress Opposition,n/a,,T0083,,,,,
220,Execute,Drive Online Harms,Platform Filtering,n/a,Platform filtering refers to the decontextualization of information as claims cross platforms (from Joan Donovan https://www.hks.harvard.edu/publications/disinformation-design-use-evidence-collages-and-platform-filtering-media-manipulation),T0084,,,,,
222,Execute,Drive Offline Activity,Encourage Attendance at Events,n/a,Operation encourages attendance at existing real world event.,T0085,,,,,
225,Execute,Drive Offline Activity,Organize Events,n/a,"Coordinate and promote real-world events across media platforms, e.g. rallies, protests, gatherings in support of incident narratives.",T0086,,,,,T0057 Organise remote rallies and events (AMITT)
228,Execute,Drive Offline Activity,Conduct fundraising,n/a,"Fundraising campaigns refer to an influence operation’s systematic effort to seek financial  support for a charity, cause, or other enterprise using online activities that further promote  operation information pathways while raising a profit. Many influence operations have engaged  in crowdfunding services166 on platforms including Tipee, Patreon, and GoFundMe. An operation  may use its previously prepared fundraising campaigns to promote operation messaging while raising money to support its activities.  ",T0087,,,,,
230,Execute,Drive Offline Activity,Physical Violence,n/a,"Physical violence refers to the use of force to injure, abuse, damage, or destroy. An influence operation may conduct or encourage physical violence to discourage opponents from promoting conflicting content or draw attention to operation narratives using shock value.  ",T0088,,,,,
233,Execute,Drive Offline Activity,Merchandising/ Advertising,n/a,Merchandising/Advertising refers to getting the message or narrative into physical space in the offline world,T0089,,,,,
236,Execute,Persist in the Information Space,Conceal People,n/a,Conceal the identity or provenance of the account and people assets.,T0090,,,,,
242,Execute,Persist in the Information Space,Conceal Operational Activity,n/a,,T0091,,,,,
254,Execute,Persist in the Information Space,Conceal Infrastructure,n/a,,T0092,,,,,
259,Execute,Persist in the Information Space,Exploit TOS/Content Moderation,n/a,,T0093,,,,,
262,Execute,Persist in the Information Space,Play the long game,n/a,Play the long game refers to two phenomena: 1. To plan messaging and allow it to grow organically without conducting your own amplification. This is methodical and slow and requires years for the message to take hold 2. To develop a series of seemingly disconnected messaging narratives that eventually combine into a new narrative.,T0094,,,,,T0059 Play the long game
265,Assess,Assess Effectiveness,Measure Performance,n/a,,T0095,,,,,
269,Assess,Assess Effectiveness,Measure Effectiveness,n/a,,T0096,,,,,
275,Assess,Assess Effectiveness,Measure Effectiveness Indicators (or KPIs),n/a,,T0097,,,,,
2,Plan,Plan Strategy,n/a,n/a,"Define the desired end state, i.e. the set of required conditions that defines achievement of all objectives.",TA01,,,,AMITT,TA01: Strategic Planning
5,Plan,Plan Objectives,n/a,n/a,"Set clearly defined, measurable, and achievable objectives. Achieving objectives ties execution of tactical tasks to reaching the desired end state. There are four primary considerations: 
- Each desired effect should link directly to one or more objectives 
- The effect should be measurable 
- The objective statement should not specify the way and means of accomplishment 
- The effect should be distinguishable from the objective it supports as a condition for success, not as another objective or task.",TA02,,,,AMITT,TA02: Objective Planning
14,Plan,Target Audience Analysis,n/a,n/a,"Identifying and analyzing the target audience examines target audience member locations,  political affiliations, financial situations, and other attributes that an influence operation may incorporate into its messaging strategy. During this tactic, influence operations may also identify  existing similarities and differences between target audience members to unite like groups and  divide opposing groups. Identifying and analyzing target audience members allows influence operations to tailor  operation strategy and content to their analysis. ",TA03,,,,SPICE and AMITT,T0005 Center of Gravity Analysis
37,Prepare,Develop Narratives,n/a,n/a,"The promotion of beneficial master narratives is perhaps the most effective method for achieving long-term strategic narrative dominance. From a ""whole of society"" perspective the promotion of the society's core master narratives should occupy a central strategic role. From a misinformation campaign / cognitive security perpectve the tactics around master narratives center more precisely on the day-to-day promotion and reinforcement of this messaging. In other words, beneficial, high-coverage master narratives are a central strategic goal and their promotion constitutes an ongoing tactical struggle carried out at a whole-of-society level. Tactically, their promotion covers a broad spectrum of activities both on- and offline.
",TA04,,,,,
47,Prepare,Develop Content,n/a,n/a,,TA05,,,,,
79,Prepare,Establish Social Assets,n/a,n/a,"Establishing information assets generates messaging tools, including social media accounts,  operation personnel, and organizations, including directly and indirectly managed assets. For assets under their direct control, the operation can add,  change, or remove these assets at will.  
Establishing information assets allows an influence operation to promote messaging directly to  the target audience without navigating through external entities. Many online influence operations create or compromise social media accounts as a primary vector of information  dissemination.",TA06,,,,,
110,Prepare,Establish Legitimacy,n/a,n/a,,TA07,,,,,
127,Execute,Microtarget,n/a,n/a,Target very specific populations of people,TA08,,,,,"TA05 ""Microtargeting"""
135,Execute,Select Channels and Affordances,n/a,n/a,"Selecting platforms and affordances assesses which online or offline platforms and their associated affordances maximize an influence operation’s  ability to reach its target audience. To select the most appropriate platform(s), an operation may  assess the technological affordances including platform algorithms, terms of service, permitted content types, or other attributes that  determine platform usability and accessibility. Selecting platforms includes both choosing platforms on which the operation will publish its own  content and platforms on which the operation will attempt to restrict adversarial content.",TA09,,,,,
165,Execute,Conduct Pump Priming,n/a,n/a,"Release content on a targetted small scale, prior to general release, including releasing seed. Used for preparation before broader release, and as message honing. Used for preparation before broader release, and as message honing. ",TA10,,,,,
173,Execute,Deliver Content,n/a,n/a,Release content to general public or larger population,TA11,,,,,
184,Execute,Maximize Exposure,n/a,n/a,"Maximize exposure of the target audience to incident/campaign content via flooding, amplifying, and cross-posting.",TA12,,,,,
204,Execute,Drive Online Harms,n/a,n/a,"Actions taken by an influence operation to harm their opponents in online spaces through harassment, suppression, releasing private information, and controlling the information space through offensive cyberspace operations. ",TA13,,,,,
221,Execute,Drive Offline Activity,n/a,n/a,"Move incident/campaign from online to offline. Encouraging users to move from the platform on which they initially viewed operation content and engage in the physical information space or offline world. This may include operation-aligned rallies or protests, radio, newspaper, or billboards. An influence  operation may drive to physical forums to diversify its information channels and facilitate spaces where the target audience can engage with both operation content and like-minded individuals offline.  ",TA14,,,,,
235,Execute,Persist in the Information Space,n/a,n/a,Persist in the Information Space refers to taking measures that allow an operation to maintain its presence and avoid takedown by an external entity. Techniques in Persist in the Information Space help campaigns operate without detection and appear legitimate to the target audience and platform monitoring services. Influence operations on social media often persist online by varying the type of information  assets and platforms used throughout the campaign.,TA15,,,,,
264,Assess,Assess Effectiveness,n/a,n/a,,TA16,,,,,