commit 5135bf5a4538eb34c5641c67d4420ef77f906511 Author: SJ Terp Date: Sun Dec 13 13:00:29 2020 +0000 merged AMITT framework and AMITT countermeasures repos diff --git a/.DS_Store b/.DS_Store new file mode 100644 index 0000000..3ecc2a3 Binary files /dev/null and b/.DS_Store differ diff --git a/AMITT logo v03.png b/AMITT logo v03.png new file mode 100644 index 0000000..dbce5f1 Binary files /dev/null and b/AMITT logo v03.png differ diff --git a/AMITT logo v03.svg b/AMITT logo v03.svg new file mode 100644 index 0000000..f30e3fa --- /dev/null +++ b/AMITT logo v03.svg @@ -0,0 +1,65 @@ + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + diff --git a/AMITT_HISTORY/2019-03-06_misinfosec_sent_for_publication.pdf b/AMITT_HISTORY/2019-03-06_misinfosec_sent_for_publication.pdf new file mode 100644 index 0000000..d975e68 Binary files /dev/null and b/AMITT_HISTORY/2019-03-06_misinfosec_sent_for_publication.pdf differ diff --git a/AMITT_HISTORY/2019-08-27_MisinfosecWG-2019-1.pdf b/AMITT_HISTORY/2019-08-27_MisinfosecWG-2019-1.pdf new file mode 100644 index 0000000..bb2d3b9 Binary files /dev/null and b/AMITT_HISTORY/2019-08-27_MisinfosecWG-2019-1.pdf differ diff --git a/AMITT_HISTORY/AMITT_v1.0.png b/AMITT_HISTORY/AMITT_v1.0.png new file mode 100644 index 0000000..88907e0 Binary files /dev/null and b/AMITT_HISTORY/AMITT_v1.0.png differ diff --git a/AMITT_HISTORY/AMITT_v2.0draft.xlsx b/AMITT_HISTORY/AMITT_v2.0draft.xlsx new file mode 100644 index 0000000..34ee71d Binary files /dev/null and b/AMITT_HISTORY/AMITT_v2.0draft.xlsx differ diff --git a/AMITT_MASTER_DATA/CountersPlaybook_MASTER.xlsx b/AMITT_MASTER_DATA/CountersPlaybook_MASTER.xlsx new file mode 100644 index 0000000..1e0251f Binary files /dev/null and b/AMITT_MASTER_DATA/CountersPlaybook_MASTER.xlsx differ diff --git a/AMITT_MASTER_DATA/amitt_metadata_v3.xlsx b/AMITT_MASTER_DATA/amitt_metadata_v3.xlsx new file mode 100644 index 0000000..8c93a86 Binary files /dev/null and b/AMITT_MASTER_DATA/amitt_metadata_v3.xlsx differ diff --git a/HTML_GENERATING_CODE/.DS_Store b/HTML_GENERATING_CODE/.DS_Store new file mode 100644 index 0000000..1da7f2b Binary files /dev/null and b/HTML_GENERATING_CODE/.DS_Store differ diff --git a/HTML_GENERATING_CODE/AMITT_create_counters_summaries.ipynb b/HTML_GENERATING_CODE/AMITT_create_counters_summaries.ipynb new file mode 100644 index 0000000..db46321 --- /dev/null +++ b/HTML_GENERATING_CODE/AMITT_create_counters_summaries.ipynb @@ -0,0 +1,1860 @@ +{ + "cells": [ + { + "cell_type": "markdown", + "metadata": {}, + "source": [ + "# Create counters summaries\n", + "Create summaries of disinfo countermeasures for use in dataset cleaning etc." + ] + }, + { + "cell_type": "code", + "execution_count": 1, + "metadata": {}, + "outputs": [ + { + "name": "stdout", + "output_type": "stream", + "text": [ + "Writing ../tactics/ALcounters.md\n", + "Writing ../tactics/TA01counters.md\n", + "Writing ../tactics/TA02counters.md\n", + "Writing ../tactics/TA03counters.md\n", + "Writing ../tactics/TA04counters.md\n", + "Writing ../tactics/TA05counters.md\n", + "Writing ../tactics/TA06counters.md\n", + "Writing ../tactics/TA07counters.md\n", + "Writing ../tactics/TA08counters.md\n", + "Writing ../tactics/TA09counters.md\n", + "Writing ../tactics/TA09counters.md\n", + "Writing ../tactics/TA10counters.md\n", + "Writing ../tactics/TA11counters.md\n", + "Writing ../tactics/TA12counters.md\n", + "updated ../tactic_counts.md\n", + "Writing ../metatag/cleaningcounters.md\n", + "Writing ../metatag/countermessagingcounters.md\n", + "Writing ../metatag/data pollutioncounters.md\n", + "Writing ../metatag/daylightcounters.md\n", + "Writing ../metatag/dilutioncounters.md\n", + "Writing ../metatag/diversioncounters.md\n", + "Writing ../metatag/frictioncounters.md\n", + "Writing ../metatag/metatechniquecounters.md\n", + "Writing ../metatag/reduce resourcescounters.md\n", + "Writing ../metatag/removalcounters.md\n", + "Writing ../metatag/resiliencecounters.md\n", + "Writing ../metatag/scoringcounters.md\n", + "Writing ../metatag/targetingcounters.md\n", + "Writing ../metatag/verificationcounters.md\n", + "updated ../metatag_counts.md\n" + ] + }, + { + "data": { + "text/html": [ + "
\n", + "\n", + "\n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + "
IDmetatechniqueTitleDetailsPlaybook(s)Resources neededHow foundReferencesIncidentsTacticResponseTechniquesNOTES
0C00043cleaningDetect hijacked accounts and reallocate themNaNIn all playbooks the platform must force user ...platform_admin,activists,civil_society,money2019-11-workshopNaNNaNTA03 Develop PeopleD3 DisruptT0011 - Hijack accountsNaN
1C00053cleaningDelete old accounts / Remove unused social med...NaNSocial media companies remove inactive account...platform_admin,platform_admin:socialmedia,publ...2019-11-workshop,2019-11-searchNaNI00004TA04 Develop NetworksD4 DegradeT0011 - Hijack accounts\\nTA06 - Develop Conten...NaN
2C00074cleaningIdentify identical content and mass deplatform\\nIn all cases some checks need to prevent depla...platform_admin,platform_admin:socialmedia2019-11-workshopNaNNaNTA06 Develop ContentD2 DenyT0022 - Conspiracy narratives\\nT0026 - Create ...NaN
3C00026countermessagingShore up democracy based messages (peace, free...UnsureNaNNaN2019-11-workshopNaNNaNTA01 Strategic PlanningD4 DegradeT0002 - Facilitate State PropagandaNaN
4C00082countermessagingGround truthing as automated response to pollu...NaNNaNNaN2019-11-workshopNaNNaNTA06 Develop ContentD3 DisruptNaNNaN
5C00136countermessagingMicrotarget most likely targets then send them...NaNPlaybook 1: Work with platform to identify act...NaN2019-11-workshopNaNNaNTA11 PersistenceD3 DisruptTA08 - Pump Priming\\nTA09 - Exposure\\nTA10 - G...NaN
6C00169countermessagingdevelop a creative content hubinternational donors will donate to a basket f...NaNNaN2019-11-searchRand2237NaNTA09 - ExposureD3 DisruptNaNNaN
7C00211countermessagingUse humorous counter-narrativesNaNNaNNaN2019-11-searchNaNI00004TA09 - ExposureD3 DisruptNaNNaN
8C00137data pollutionPollute the AB-testing data feedsPolluting A/B testing requires knowledge of MO...Playbook 1: Promote damp squibs. Within a kno...NaN2019-11-workshopNaNNaNTA11 PersistenceD3 DisruptT0020 - Trial contentNaN
9C00140data pollution\"Bomb\" link shorteners with lots of callsApplies to most of the content used by exposur...Playbook 1: DDoS adversary link shorteners by ...NaN2019-11-workshopNaNNaNTA11 PersistenceD4 DegradeTA05 - Microtargeting\\nTA09 - Exposure*\\nTA10 ...NaN
10C00145data pollutionPollute the data voids with wholesome content ...NaNNaNNaN2019-11-workshopNaNNaNTA11 PersistenceD4 DegradeT0015 - Create hashtag\\nT0046 - Search Engine ...NaN
11C00148data pollutionAdd random links to network graphsIf creators are using network analysis to dete...Playbook 1: Degrade TA engagement using bots; ...platform_algorithms2019-11-workshopNaNNaNTA12 Measure EffectivenessD4 DegradeNaNNaN
12C00149data pollutionPoison the monitoring & evaluation dataNaNPlaybook 1: Distort TA demographics by posting...NaN2019-11-workshopNaNNaNTA12 Measure EffectivenessD4 DegradeTA12 - Measure Effectiveness\\nT0020 - Trial co...NaN
13C00018daylightPromote constructive communication by shaming ...Duplicate of \"Promote playbooks to call out di...NaNNaN2019-11-workshopNaNNaNTA01 Strategic PlanningD3 DisruptTA08 - Pump Priming\\nTA09 - Exposure\\nTA10 - G...NaN
14C00019daylightPromote playbooks to call out division-enablersDuplicate of \"Promote constructive communicati...Spread Infographics & Training Material teachi...NaN2019-11-workshopNaNNaNTA01 Strategic PlanningD3 DisruptTA08 - Pump Priming\\nTA09 - Exposure\\nTA10 - G...NaN
15C00048daylightName and ShameNaNIdentify the accounts, the real person's name ...NaN2019-11-workshopNaNNaNTA03 Develop PeopleD7 DeterTA08 - Pump Priming\\nT0048 - Cow online opinio...NaN
16C00068daylightExpose online funding as fakeNaNNaNNaN2019-11-workshopNaNNaNTA05 MicrotargetingD3 DisruptT0017 - Promote online funding\\nT0061 - Sell m...NaN
17C00069daylightMark clickbait visuallyNaNNaNNaN2019-11-workshopNaNNaNTA05 MicrotargetingD3 DisruptT0016 - ClickbaitNaN
18C00081daylightDiscredit by pointing out the \"noise\" and info...NaNNaNNaN2019-11-workshopNaNNaNTA06 Develop ContentD3 Disruptinfo pollutionNaN
19C00094daylightForce full disclosure on corporate sponsor of ...NaNNaNNaN2019-11-workshopNaNNaNTA06 Develop ContentD7 DeterT0026 - Create fake researchNaN
20C00113daylightDebunk and defuse a fake expert / credentials....NaNNaNNaN2019-11-workshopNaNNaNTA08 Pump PrimingD2 DenyT0045NaN
21C00115daylightExpose actor and intentionsNaNNaNNaN2019-11-workshopNaNNaNTA08 Pump PrimingD2 DenyT0046\\nT0048\\nT0052\\nT0053\\nT0054\\nT0055\\nT0056NaN
22C00116daylightProvide proof of involvementNaNNaNNaN2019-11-workshopNaNNaNTA08 Pump PrimingD2 DenyT0041 - Deny involvementNaN
23C00126daylightSocial media amber alertNaNNaNNaN2019-11-workshopNaNNaNTA09 ExposureD3 DisruptT0052\\nT0053\\nT0054\\nT0055\\nT0056NaN
24C00150daylight“calling them out”Identify social media accounts as sources of p...NaNNaN2019-11-searchRand2237NaNTA03 Develop PeopleD2 DenyNaNNaN
25C00151daylight“fight in the light”Use leadership in the arts, entertainment, and...NaNNaN2019-11-searchHicks19NaNTA09 ExposureD3 DisruptNaNNaN
26C00152daylight“name and shame”USAID has been restructuring its programs to a...NaNNaN2019-11-searchDalton19NaNTA04 Develop NetworksD2 DenyNaNNaN
27C00184daylightMedia exposureNaNNaNNaN2019-11-searchNaNI00010,I00015,I00032,I00044TA09 ExposureD4 DegradeNaNNaN
28C00189daylightOngoing analysis/monitoring of \"flagged\" profilesConfirm whether platforms are actively removin...NaNNaN2019-11-searchRand2237NaNTA03 Develop PeopleD6 DestroyNaNNaN
29C00031dilutionDilute the core narrative - create multiple pe...Create competing narratives. Included \"Facilit...Playbook 1: Create multiple versions of the na...NaN2019-11-workshopNaNNaNTA02 Objective PlanningD3 DisruptT0002 - Facilitate State Propaganda\\nT0003 - L...CAVEAT: some element of disinformation is simp...
..........................................
156C00122frictionContent moderation. Censorship?NaNNaNplatform_admin2019-11-workshopNaNNaNTA09 ExposureD2 DenyNaNNaN
157C00123frictionBot controlNaNNaNNaN2019-11-workshopNaNNaNTA09 ExposureD3 DisruptT0049\\nT0051\\nT0052\\nT0053\\nT0054\\nT0055\\nT0056NaN
158C00124frictionDon't feed the trollsNaNNaNpublic,media2019-11-workshopNaNNaNTA09 ExposureD3 DisruptTA08 - Pump Priming\\nTA09 - ExposureNaN
159C00139frictionWeaponise youtube content matricesNaNNaNNaN2019-11-workshopNaNNaNTA11 PersistenceD3 DisruptNaNNaN
160C00143targeting(botnet) DMCA takedown requests to waste group...NaNNaNpublic,elves2019-11-workshopNaNNaNTA11 PersistenceD4 DegradeNaNNaN
161C00153targetingUse offensive cyber actionAlign offensive cyber action with information ...NaNinfosec2019-11-searchDalton19NaNTA01 Strategic PlanningD3 DisruptNaNNaN
162C00156countermessagingBetter tell the U.S., NATO, and EU story.Civil engagement activities conducted on the p...NaNgovernment,military2019-11-searchRand2237NaNTA09 ExposureD3 DisruptNaNNaN
163C00157countermessagingBuild alternative news sourcesCreate alternative local-language news sources...NaNNaN2019-11-searchp143 of Corker18NaNTA04 Develop NetworksD2 DenyNaNNaN
164C00159metatechniqueCampaign mindset and associated toolboxA campaign plan for the gray zone must account...NaNNaN2019-11-searchHicks19NaNTA01 Strategic PlanningD3 DisruptNaNNaN
165C00160resiliencefind and train influencersIdentify key influencers (e.g. use network ana...NaNdata scientist,influencers2019-11-searchRand2237NaNTA03 Develop PeopleD2 DenyNaNNaN
166C00161metatechniqueCoalition Building and Third-Party Inducements:Advance coalitions across borders and sectors,...NaNNaN2019-11-searchDalton19NaNTA01 Strategic PlanningD7 DeterNaNNaN
167C00162targetingcollect data/map constellations of Russian“civ...Kremlin’s narrative spin extends through const...NaNNaN2019-11-searchRand2237NaNTA04 Develop NetworksD3 DisruptNaNNaN
168C00164targetingcompatriot policyprotect the interests of this population and, ...NaNNaN2019-11-searchRand2237NaNTA03 Develop PeopleD3 DisruptNaNNaN
169C00165frictionLimit access to alterable documentse.g. for leaked legal documents, use court mot...NaNNaN2019-11-searchNaNI00015TA06 Develop ContentD2 DenyT00025NaN
170C00167countermessagingDeploy Information and Narrative-Building in S...Promote a narrative of transparency, truthfuln...NaNNaN2019-11-searchHicks19NaNTA06 Develop ContentD2 DenyNaNNaN
171C00176metatechniqueImprove Coordination with and feedback from th...gray zone challenges are increasingly multidis...NaNNaN2019-11-searchDalton19NaNTA01 Strategic PlanningD7 DeterNaNNaN
172C00179removalIdentify, monitor, and, if necessary, target R...Impact of and Dealing with Trolls - \"Chatham H...NaNNaN2019-11-searchRand2237NaNTA03 Develop PeopleD3 DisruptNaNNaN
173C00182removalmalware detection/quarantine/deletion(2015) Trustwave reported that a Bedep Trojan ...NaNinfosec2019-11-searchRand2237NaNTA09 ExposureD2 DenyNaNNaN
174C00196metatechniqueInclude the role of social media in the regula...The European Union created significant new reg...NaNgovernment2019-11-searchHicks19NaNTA07 Channel SelectionD3 DisruptNaNNaN
175C00200countermessagingRespected figure (influencer) disavows misinfoHas been done in e.g. IndiaNaNinfluencers2019-11-searchNaNI00044TA09 ExposureD3 DisruptNaNNaN
176C00202diversionSet data 'honeytraps'NaNNaNNaN2019-11-searchNaNI00004,I00022TA06 Develop ContentD2 DenyT0025 leak altered documentsNaN
177C00203frictionStop offering press credentials to propaganda ...NaNNaNgovernment2019-11-searchNaNI00022TA08 Pump PrimingD3 DisruptNaNNaN
178C00205metatechniquestrong dialogue between the federal government...Increase civic resilience by partnering with b...NaNcompanies,government2019-11-searchHicks19NaNTA01 Strategic PlanningD3 DisruptNaNNaN
179C00207targetingtit-for-tat campaignAs used by Saudis?NaNgovernment,platforms2019-11-searchNaNI00042TA01 Strategic PlanningD7 DeterNaNNaN
180C00210resilienceUse encrypted apps for confidential communicationNaNNaNNaN2019-11-searchNaNI00022TA06 Develop ContentD2 DenyT0025NaN
181C00214metatechniqueCreate policy that makes social media police d...German model: facebook forced to police conten...NaNgovernment:policymakers2019-11-workshopNaNNaNTA07 Channel SelectionD3 DisruptNaNNaN
182C00215metatechniqueUse fraud legislation to clean up social mediaNaNNaNgovernment:policymakers2019-11-workshopNaNNaNTA07 Channel SelectionD3 DisruptNaNNaN
183C00217daylightRegistries alert when large batches of newsy U...NaNNaNplatform_admingrugqNaNNaNTA07 Channel SelectionD2 DenyNaNNaN
184C00218removalCensorshipAlter and/or block the publication/disseminati...NaNplatform_admingrugqTaylor81NaNTA09 ExposureD2 DenyNaNNaN
185C00219daylightAdd metadata to content - out of the control o...NaNAdd date and source to imagesNaNgrugqNaNNaNTA06 Develop ContentD3 DisruptNaNNaN
\n", + "

186 rows × 13 columns

\n", + "
" + ], + "text/plain": [ + " ID metatechnique \\\n", + "0 C00043 cleaning \n", + "1 C00053 cleaning \n", + "2 C00074 cleaning \n", + "3 C00026 countermessaging \n", + "4 C00082 countermessaging \n", + "5 C00136 countermessaging \n", + "6 C00169 countermessaging \n", + "7 C00211 countermessaging \n", + "8 C00137 data pollution \n", + "9 C00140 data pollution \n", + "10 C00145 data pollution \n", + "11 C00148 data pollution \n", + "12 C00149 data pollution \n", + "13 C00018 daylight \n", + "14 C00019 daylight \n", + "15 C00048 daylight \n", + "16 C00068 daylight \n", + "17 C00069 daylight \n", + "18 C00081 daylight \n", + "19 C00094 daylight \n", + "20 C00113 daylight \n", + "21 C00115 daylight \n", + "22 C00116 daylight \n", + "23 C00126 daylight \n", + "24 C00150 daylight \n", + "25 C00151 daylight \n", + "26 C00152 daylight \n", + "27 C00184 daylight \n", + "28 C00189 daylight \n", + "29 C00031 dilution \n", + ".. ... ... \n", + "156 C00122 friction \n", + "157 C00123 friction \n", + "158 C00124 friction \n", + "159 C00139 friction \n", + "160 C00143 targeting \n", + "161 C00153 targeting \n", + "162 C00156 countermessaging \n", + "163 C00157 countermessaging \n", + "164 C00159 metatechnique \n", + "165 C00160 resilience \n", + "166 C00161 metatechnique \n", + "167 C00162 targeting \n", + "168 C00164 targeting \n", + "169 C00165 friction \n", + "170 C00167 countermessaging \n", + "171 C00176 metatechnique \n", + "172 C00179 removal \n", + "173 C00182 removal \n", + "174 C00196 metatechnique \n", + "175 C00200 countermessaging \n", + "176 C00202 diversion \n", + "177 C00203 friction \n", + "178 C00205 metatechnique \n", + "179 C00207 targeting \n", + "180 C00210 resilience \n", + "181 C00214 metatechnique \n", + "182 C00215 metatechnique \n", + "183 C00217 daylight \n", + "184 C00218 removal \n", + "185 C00219 daylight \n", + "\n", + " Title \\\n", + "0 Detect hijacked accounts and reallocate them \n", + "1 Delete old accounts / Remove unused social med... \n", + "2 Identify identical content and mass deplatform \n", + "3 Shore up democracy based messages (peace, free... \n", + "4 Ground truthing as automated response to pollu... \n", + "5 Microtarget most likely targets then send them... \n", + "6 develop a creative content hub \n", + "7 Use humorous counter-narratives \n", + "8 Pollute the AB-testing data feeds \n", + "9 \"Bomb\" link shorteners with lots of calls \n", + "10 Pollute the data voids with wholesome content ... \n", + "11 Add random links to network graphs \n", + "12 Poison the monitoring & evaluation data \n", + "13 Promote constructive communication by shaming ... \n", + "14 Promote playbooks to call out division-enablers \n", + "15 Name and Shame \n", + "16 Expose online funding as fake \n", + "17 Mark clickbait visually \n", + "18 Discredit by pointing out the \"noise\" and info... \n", + "19 Force full disclosure on corporate sponsor of ... \n", + "20 Debunk and defuse a fake expert / credentials.... \n", + "21 Expose actor and intentions \n", + "22 Provide proof of involvement \n", + "23 Social media amber alert \n", + "24 “calling them out” \n", + "25 “fight in the light” \n", + "26 “name and shame” \n", + "27 Media exposure \n", + "28 Ongoing analysis/monitoring of \"flagged\" profiles \n", + "29 Dilute the core narrative - create multiple pe... \n", + ".. ... \n", + "156 Content moderation. Censorship? \n", + "157 Bot control \n", + "158 Don't feed the trolls \n", + "159 Weaponise youtube content matrices \n", + "160 (botnet) DMCA takedown requests to waste group... \n", + "161 Use offensive cyber action \n", + "162 Better tell the U.S., NATO, and EU story. \n", + "163 Build alternative news sources \n", + "164 Campaign mindset and associated toolbox \n", + "165 find and train influencers \n", + "166 Coalition Building and Third-Party Inducements: \n", + "167 collect data/map constellations of Russian“civ... \n", + "168 compatriot policy \n", + "169 Limit access to alterable documents \n", + "170 Deploy Information and Narrative-Building in S... \n", + "171 Improve Coordination with and feedback from th... \n", + "172 Identify, monitor, and, if necessary, target R... \n", + "173 malware detection/quarantine/deletion \n", + "174 Include the role of social media in the regula... \n", + "175 Respected figure (influencer) disavows misinfo \n", + "176 Set data 'honeytraps' \n", + "177 Stop offering press credentials to propaganda ... \n", + "178 strong dialogue between the federal government... \n", + "179 tit-for-tat campaign \n", + "180 Use encrypted apps for confidential communication \n", + "181 Create policy that makes social media police d... \n", + "182 Use fraud legislation to clean up social media \n", + "183 Registries alert when large batches of newsy U... \n", + "184 Censorship \n", + "185 Add metadata to content - out of the control o... \n", + "\n", + " Details \\\n", + "0 NaN \n", + "1 NaN \n", + "2 \\n \n", + "3 Unsure \n", + "4 NaN \n", + "5 NaN \n", + "6 international donors will donate to a basket f... \n", + "7 NaN \n", + "8 Polluting A/B testing requires knowledge of MO... \n", + "9 Applies to most of the content used by exposur... \n", + "10 NaN \n", + "11 If creators are using network analysis to dete... \n", + "12 NaN \n", + "13 Duplicate of \"Promote playbooks to call out di... \n", + "14 Duplicate of \"Promote constructive communicati... \n", + "15 NaN \n", + "16 NaN \n", + "17 NaN \n", + "18 NaN \n", + "19 NaN \n", + "20 NaN \n", + "21 NaN \n", + "22 NaN \n", + "23 NaN \n", + "24 Identify social media accounts as sources of p... \n", + "25 Use leadership in the arts, entertainment, and... \n", + "26 USAID has been restructuring its programs to a... \n", + "27 NaN \n", + "28 Confirm whether platforms are actively removin... \n", + "29 Create competing narratives. Included \"Facilit... \n", + ".. ... \n", + "156 NaN \n", + "157 NaN \n", + "158 NaN \n", + "159 NaN \n", + "160 NaN \n", + "161 Align offensive cyber action with information ... \n", + "162 Civil engagement activities conducted on the p... \n", + "163 Create alternative local-language news sources... \n", + "164 A campaign plan for the gray zone must account... \n", + "165 Identify key influencers (e.g. use network ana... \n", + "166 Advance coalitions across borders and sectors,... \n", + "167 Kremlin’s narrative spin extends through const... \n", + "168 protect the interests of this population and, ... \n", + "169 e.g. for leaked legal documents, use court mot... \n", + "170 Promote a narrative of transparency, truthfuln... \n", + "171 gray zone challenges are increasingly multidis... \n", + "172 Impact of and Dealing with Trolls - \"Chatham H... \n", + "173 (2015) Trustwave reported that a Bedep Trojan ... \n", + "174 The European Union created significant new reg... \n", + "175 Has been done in e.g. India \n", + "176 NaN \n", + "177 NaN \n", + "178 Increase civic resilience by partnering with b... \n", + "179 As used by Saudis? \n", + "180 NaN \n", + "181 German model: facebook forced to police conten... \n", + "182 NaN \n", + "183 NaN \n", + "184 Alter and/or block the publication/disseminati... \n", + "185 NaN \n", + "\n", + " Playbook(s) \\\n", + "0 In all playbooks the platform must force user ... \n", + "1 Social media companies remove inactive account... \n", + "2 In all cases some checks need to prevent depla... \n", + "3 NaN \n", + "4 NaN \n", + "5 Playbook 1: Work with platform to identify act... \n", + "6 NaN \n", + "7 NaN \n", + "8 Playbook 1: Promote damp squibs. Within a kno... \n", + "9 Playbook 1: DDoS adversary link shorteners by ... \n", + "10 NaN \n", + "11 Playbook 1: Degrade TA engagement using bots; ... \n", + "12 Playbook 1: Distort TA demographics by posting... \n", + "13 NaN \n", + "14 Spread Infographics & Training Material teachi... \n", + "15 Identify the accounts, the real person's name ... \n", + "16 NaN \n", + "17 NaN \n", + "18 NaN \n", + "19 NaN \n", + "20 NaN \n", + "21 NaN \n", + "22 NaN \n", + "23 NaN \n", + "24 NaN \n", + "25 NaN \n", + "26 NaN \n", + "27 NaN \n", + "28 NaN \n", + "29 Playbook 1: Create multiple versions of the na... \n", + ".. ... \n", + "156 NaN \n", + "157 NaN \n", + "158 NaN \n", + "159 NaN \n", + "160 NaN \n", + "161 NaN \n", + "162 NaN \n", + "163 NaN \n", + "164 NaN \n", + "165 NaN \n", + "166 NaN \n", + "167 NaN \n", + "168 NaN \n", + "169 NaN \n", + "170 NaN \n", + "171 NaN \n", + "172 NaN \n", + "173 NaN \n", + "174 NaN \n", + "175 NaN \n", + "176 NaN \n", + "177 NaN \n", + "178 NaN \n", + "179 NaN \n", + "180 NaN \n", + "181 NaN \n", + "182 NaN \n", + "183 NaN \n", + "184 NaN \n", + "185 Add date and source to images \n", + "\n", + " Resources needed \\\n", + "0 platform_admin,activists,civil_society,money \n", + "1 platform_admin,platform_admin:socialmedia,publ... \n", + "2 platform_admin,platform_admin:socialmedia \n", + "3 NaN \n", + "4 NaN \n", + "5 NaN \n", + "6 NaN \n", + "7 NaN \n", + "8 NaN \n", + "9 NaN \n", + "10 NaN \n", + "11 platform_algorithms \n", + "12 NaN \n", + "13 NaN \n", + "14 NaN \n", + "15 NaN \n", + "16 NaN \n", + "17 NaN \n", + "18 NaN \n", + "19 NaN \n", + "20 NaN \n", + "21 NaN \n", + "22 NaN \n", + "23 NaN \n", + "24 NaN \n", + "25 NaN \n", + "26 NaN \n", + "27 NaN \n", + "28 NaN \n", + "29 NaN \n", + ".. ... \n", + "156 platform_admin \n", + "157 NaN \n", + "158 public,media \n", + "159 NaN \n", + "160 public,elves \n", + "161 infosec \n", + "162 government,military \n", + "163 NaN \n", + "164 NaN \n", + "165 data scientist,influencers \n", + "166 NaN \n", + "167 NaN \n", + "168 NaN \n", + "169 NaN \n", + "170 NaN \n", + "171 NaN \n", + "172 NaN \n", + "173 infosec \n", + "174 government \n", + "175 influencers \n", + "176 NaN \n", + "177 government \n", + "178 companies,government \n", + "179 government,platforms \n", + "180 NaN \n", + "181 government:policymakers \n", + "182 government:policymakers \n", + "183 platform_admin \n", + "184 platform_admin \n", + "185 NaN \n", + "\n", + " How found References \\\n", + "0 2019-11-workshop NaN \n", + "1 2019-11-workshop,2019-11-search NaN \n", + "2 2019-11-workshop NaN \n", + "3 2019-11-workshop NaN \n", + "4 2019-11-workshop NaN \n", + "5 2019-11-workshop NaN \n", + "6 2019-11-search Rand2237 \n", + "7 2019-11-search NaN \n", + "8 2019-11-workshop NaN \n", + "9 2019-11-workshop NaN \n", + "10 2019-11-workshop NaN \n", + "11 2019-11-workshop NaN \n", + "12 2019-11-workshop NaN \n", + "13 2019-11-workshop NaN \n", + "14 2019-11-workshop NaN \n", + "15 2019-11-workshop NaN \n", + "16 2019-11-workshop NaN \n", + "17 2019-11-workshop NaN \n", + "18 2019-11-workshop NaN \n", + "19 2019-11-workshop NaN \n", + "20 2019-11-workshop NaN \n", + "21 2019-11-workshop NaN \n", + "22 2019-11-workshop NaN \n", + "23 2019-11-workshop NaN \n", + "24 2019-11-search Rand2237 \n", + "25 2019-11-search Hicks19 \n", + "26 2019-11-search Dalton19 \n", + "27 2019-11-search NaN \n", + "28 2019-11-search Rand2237 \n", + "29 2019-11-workshop NaN \n", + ".. ... ... \n", + "156 2019-11-workshop NaN \n", + "157 2019-11-workshop NaN \n", + "158 2019-11-workshop NaN \n", + "159 2019-11-workshop NaN \n", + "160 2019-11-workshop NaN \n", + "161 2019-11-search Dalton19 \n", + "162 2019-11-search Rand2237 \n", + "163 2019-11-search p143 of Corker18 \n", + "164 2019-11-search Hicks19 \n", + "165 2019-11-search Rand2237 \n", + "166 2019-11-search Dalton19 \n", + "167 2019-11-search Rand2237 \n", + "168 2019-11-search Rand2237 \n", + "169 2019-11-search NaN \n", + "170 2019-11-search Hicks19 \n", + "171 2019-11-search Dalton19 \n", + "172 2019-11-search Rand2237 \n", + "173 2019-11-search Rand2237 \n", + "174 2019-11-search Hicks19 \n", + "175 2019-11-search NaN \n", + "176 2019-11-search NaN \n", + "177 2019-11-search NaN \n", + "178 2019-11-search Hicks19 \n", + "179 2019-11-search NaN \n", + "180 2019-11-search NaN \n", + "181 2019-11-workshop NaN \n", + "182 2019-11-workshop NaN \n", + "183 grugq NaN \n", + "184 grugq Taylor81 \n", + "185 grugq NaN \n", + "\n", + " Incidents Tactic Response \\\n", + "0 NaN TA03 Develop People D3 Disrupt \n", + "1 I00004 TA04 Develop Networks D4 Degrade \n", + "2 NaN TA06 Develop Content D2 Deny \n", + "3 NaN TA01 Strategic Planning D4 Degrade \n", + "4 NaN TA06 Develop Content D3 Disrupt \n", + "5 NaN TA11 Persistence D3 Disrupt \n", + "6 NaN TA09 - Exposure D3 Disrupt \n", + "7 I00004 TA09 - Exposure D3 Disrupt \n", + "8 NaN TA11 Persistence D3 Disrupt \n", + "9 NaN TA11 Persistence D4 Degrade \n", + "10 NaN TA11 Persistence D4 Degrade \n", + "11 NaN TA12 Measure Effectiveness D4 Degrade \n", + "12 NaN TA12 Measure Effectiveness D4 Degrade \n", + "13 NaN TA01 Strategic Planning D3 Disrupt \n", + "14 NaN TA01 Strategic Planning D3 Disrupt \n", + "15 NaN TA03 Develop People D7 Deter \n", + "16 NaN TA05 Microtargeting D3 Disrupt \n", + "17 NaN TA05 Microtargeting D3 Disrupt \n", + "18 NaN TA06 Develop Content D3 Disrupt \n", + "19 NaN TA06 Develop Content D7 Deter \n", + "20 NaN TA08 Pump Priming D2 Deny \n", + "21 NaN TA08 Pump Priming D2 Deny \n", + "22 NaN TA08 Pump Priming D2 Deny \n", + "23 NaN TA09 Exposure D3 Disrupt \n", + "24 NaN TA03 Develop People D2 Deny \n", + "25 NaN TA09 Exposure D3 Disrupt \n", + "26 NaN TA04 Develop Networks D2 Deny \n", + "27 I00010,I00015,I00032,I00044 TA09 Exposure D4 Degrade \n", + "28 NaN TA03 Develop People D6 Destroy \n", + "29 NaN TA02 Objective Planning D3 Disrupt \n", + ".. ... ... ... \n", + "156 NaN TA09 Exposure D2 Deny \n", + "157 NaN TA09 Exposure D3 Disrupt \n", + "158 NaN TA09 Exposure D3 Disrupt \n", + "159 NaN TA11 Persistence D3 Disrupt \n", + "160 NaN TA11 Persistence D4 Degrade \n", + "161 NaN TA01 Strategic Planning D3 Disrupt \n", + "162 NaN TA09 Exposure D3 Disrupt \n", + "163 NaN TA04 Develop Networks D2 Deny \n", + "164 NaN TA01 Strategic Planning D3 Disrupt \n", + "165 NaN TA03 Develop People D2 Deny \n", + "166 NaN TA01 Strategic Planning D7 Deter \n", + "167 NaN TA04 Develop Networks D3 Disrupt \n", + "168 NaN TA03 Develop People D3 Disrupt \n", + "169 I00015 TA06 Develop Content D2 Deny \n", + "170 NaN TA06 Develop Content D2 Deny \n", + "171 NaN TA01 Strategic Planning D7 Deter \n", + "172 NaN TA03 Develop People D3 Disrupt \n", + "173 NaN TA09 Exposure D2 Deny \n", + "174 NaN TA07 Channel Selection D3 Disrupt \n", + "175 I00044 TA09 Exposure D3 Disrupt \n", + "176 I00004,I00022 TA06 Develop Content D2 Deny \n", + "177 I00022 TA08 Pump Priming D3 Disrupt \n", + "178 NaN TA01 Strategic Planning D3 Disrupt \n", + "179 I00042 TA01 Strategic Planning D7 Deter \n", + "180 I00022 TA06 Develop Content D2 Deny \n", + "181 NaN TA07 Channel Selection D3 Disrupt \n", + "182 NaN TA07 Channel Selection D3 Disrupt \n", + "183 NaN TA07 Channel Selection D2 Deny \n", + "184 NaN TA09 Exposure D2 Deny \n", + "185 NaN TA06 Develop Content D3 Disrupt \n", + "\n", + " Techniques \\\n", + "0 T0011 - Hijack accounts \n", + "1 T0011 - Hijack accounts\\nTA06 - Develop Conten... \n", + "2 T0022 - Conspiracy narratives\\nT0026 - Create ... \n", + "3 T0002 - Facilitate State Propaganda \n", + "4 NaN \n", + "5 TA08 - Pump Priming\\nTA09 - Exposure\\nTA10 - G... \n", + "6 NaN \n", + "7 NaN \n", + "8 T0020 - Trial content \n", + "9 TA05 - Microtargeting\\nTA09 - Exposure*\\nTA10 ... \n", + "10 T0015 - Create hashtag\\nT0046 - Search Engine ... \n", + "11 NaN \n", + "12 TA12 - Measure Effectiveness\\nT0020 - Trial co... \n", + "13 TA08 - Pump Priming\\nTA09 - Exposure\\nTA10 - G... \n", + "14 TA08 - Pump Priming\\nTA09 - Exposure\\nTA10 - G... \n", + "15 TA08 - Pump Priming\\nT0048 - Cow online opinio... \n", + "16 T0017 - Promote online funding\\nT0061 - Sell m... \n", + "17 T0016 - Clickbait \n", + "18 info pollution \n", + "19 T0026 - Create fake research \n", + "20 T0045 \n", + "21 T0046\\nT0048\\nT0052\\nT0053\\nT0054\\nT0055\\nT0056 \n", + "22 T0041 - Deny involvement \n", + "23 T0052\\nT0053\\nT0054\\nT0055\\nT0056 \n", + "24 NaN \n", + "25 NaN \n", + "26 NaN \n", + "27 NaN \n", + "28 NaN \n", + "29 T0002 - Facilitate State Propaganda\\nT0003 - L... \n", + ".. ... \n", + "156 NaN \n", + "157 T0049\\nT0051\\nT0052\\nT0053\\nT0054\\nT0055\\nT0056 \n", + "158 TA08 - Pump Priming\\nTA09 - Exposure \n", + "159 NaN \n", + "160 NaN \n", + "161 NaN \n", + "162 NaN \n", + "163 NaN \n", + "164 NaN \n", + "165 NaN \n", + "166 NaN \n", + "167 NaN \n", + "168 NaN \n", + "169 T00025 \n", + "170 NaN \n", + "171 NaN \n", + "172 NaN \n", + "173 NaN \n", + "174 NaN \n", + "175 NaN \n", + "176 T0025 leak altered documents \n", + "177 NaN \n", + "178 NaN \n", + "179 NaN \n", + "180 T0025 \n", + "181 NaN \n", + "182 NaN \n", + "183 NaN \n", + "184 NaN \n", + "185 NaN \n", + "\n", + " NOTES \n", + "0 NaN \n", + "1 NaN \n", + "2 NaN \n", + "3 NaN \n", + "4 NaN \n", + "5 NaN \n", + "6 NaN \n", + "7 NaN \n", + "8 NaN \n", + "9 NaN \n", + "10 NaN \n", + "11 NaN \n", + "12 NaN \n", + "13 NaN \n", + "14 NaN \n", + "15 NaN \n", + "16 NaN \n", + "17 NaN \n", + "18 NaN \n", + "19 NaN \n", + "20 NaN \n", + "21 NaN \n", + "22 NaN \n", + "23 NaN \n", + "24 NaN \n", + "25 NaN \n", + "26 NaN \n", + "27 NaN \n", + "28 NaN \n", + "29 CAVEAT: some element of disinformation is simp... \n", + ".. ... \n", + "156 NaN \n", + "157 NaN \n", + "158 NaN \n", + "159 NaN \n", + "160 NaN \n", + "161 NaN \n", + "162 NaN \n", + "163 NaN \n", + "164 NaN \n", + "165 NaN \n", + "166 NaN \n", + "167 NaN \n", + "168 NaN \n", + "169 NaN \n", + "170 NaN \n", + "171 NaN \n", + "172 NaN \n", + "173 NaN \n", + "174 NaN \n", + "175 NaN \n", + "176 NaN \n", + "177 NaN \n", + "178 NaN \n", + "179 NaN \n", + "180 NaN \n", + "181 NaN \n", + "182 NaN \n", + "183 NaN \n", + "184 NaN \n", + "185 NaN \n", + "\n", + "[186 rows x 13 columns]" + ] + }, + "execution_count": 1, + "metadata": {}, + "output_type": "execute_result" + } + ], + "source": [ + "import counter\n", + "\n", + "counter = counter.Counter()\n", + "counter.write_tactics_markdown()\n", + "counter.write_metacounts_markdown()\n", + "counter.dfcounters" + ] + }, + { + "cell_type": "code", + "execution_count": 2, + "metadata": {}, + "outputs": [ + { + "name": "stdout", + "output_type": "stream", + "text": [ + " index Res\n", + "0 DHS 1\n", + "1 NGO 1\n", + "2 activists 2\n", + "3 adtech 1\n", + "4 civil_society 1\n", + "5 community_groups 1\n", + "6 companies 1\n", + "7 content_creators 1\n", + "8 data scientist 1\n", + "9 data_scientist 1\n", + "10 datastreams 1\n", + "11 developers 2\n", + "12 educators 11\n", + "13 elves 1\n", + "14 factcheckers 2\n", + "15 funding 1\n", + "16 gamesdesigners 1\n", + "17 government 7\n", + "18 government:policymakers 8\n", + "19 influencers 3\n", + "20 influencers:trusted_authority 1\n", + "21 infosec 2\n", + "22 libraries 1\n", + "23 media 10\n", + "24 military 1\n", + "25 money 2\n", + "26 platform_admin 11\n", + "27 platform_admin:adtech 1\n", + "28 platform_admin:fundingsites 1\n", + "29 platform_admin:socialmedia 5\n", + "30 platform_algorithms 8\n", + "31 platform_outreach 1\n", + "32 platforms 1\n", + "33 public 4\n", + "34 public:account_owners 1\n", + "35 religious_organisations 1\n", + "36 schools 1\n", + "37 server_admin 1\n" + ] + } + ], + "source": [ + "import pandas as pd\n", + "\n", + "print('{}'.format(counter.idresource['Res'].value_counts().sort_index().reset_index()))" + ] + }, + { + "cell_type": "code", + "execution_count": 3, + "metadata": {}, + "outputs": [ + { + "name": "stdout", + "output_type": "stream", + "text": [ + "Writing ../resource/DHScounters.md\n", + "Writing ../resource/NGOcounters.md\n", + "Writing ../resource/activistscounters.md\n", + "Writing ../resource/adtechcounters.md\n", + "Writing ../resource/civil_societycounters.md\n", + "Writing ../resource/community_groupscounters.md\n", + "Writing ../resource/companiescounters.md\n", + "Writing ../resource/content_creatorscounters.md\n", + "Writing ../resource/data scientistcounters.md\n", + "Writing ../resource/data_scientistcounters.md\n", + "Writing ../resource/datastreamscounters.md\n", + "Writing ../resource/developerscounters.md\n", + "Writing ../resource/educatorscounters.md\n", + "Writing ../resource/elvescounters.md\n", + "Writing ../resource/factcheckerscounters.md\n", + "Writing ../resource/fundingcounters.md\n", + "Writing ../resource/gamesdesignerscounters.md\n", + "Writing ../resource/governmentcounters.md\n", + "Writing ../resource/government:policymakerscounters.md\n", + "Writing ../resource/influencerscounters.md\n", + "Writing ../resource/influencers:trusted_authoritycounters.md\n", + "Writing ../resource/infoseccounters.md\n", + "Writing ../resource/librariescounters.md\n", + "Writing ../resource/mediacounters.md\n", + "Writing ../resource/militarycounters.md\n", + "Writing ../resource/moneycounters.md\n", + "Writing ../resource/platform_admincounters.md\n", + "Writing ../resource/platform_admin:adtechcounters.md\n", + "Writing ../resource/platform_admin:fundingsitescounters.md\n", + "Writing ../resource/platform_admin:socialmediacounters.md\n", + "Writing ../resource/platform_algorithmscounters.md\n", + "Writing ../resource/platform_outreachcounters.md\n", + "Writing ../resource/platformscounters.md\n", + "Writing ../resource/publiccounters.md\n", + "Writing ../resource/public:account_ownerscounters.md\n", + "Writing ../resource/religious_organisationscounters.md\n", + "Writing ../resource/schoolscounters.md\n", + "Writing ../resource/server_admincounters.md\n", + "updated ../resource_counts.md\n" + ] + } + ], + "source": [ + "import os\n", + "import numpy as np\n", + "\n", + "def create_resource_file(index, rowtype, datadir):\n", + " oid = index\n", + " counterrows = counter.idresource[counter.idresource['Res'] == index]['ID'].to_list()\n", + " html = '''# {} counters: {}\\n\\n'''.format(rowtype, index)\n", + " html += '## by action\\n\\n'\n", + " omatrix = counter.dfcounters[counter.dfcounters['ID'].isin(counterrows)].groupby('Response')\n", + " for resp, clist in omatrix:\n", + " html += '\\n### {}\\n'.format(resp)\n", + " for c in clist.iterrows():\n", + " html += '* {}: {} (needs {})\\n'.format(c[1]['ID'], c[1]['Title'],\n", + " c[1]['Resources needed'])\n", + "\n", + " datafile = '{}/{}counters.md'.format(datadir, oid)\n", + " print('Writing {}'.format(datafile))\n", + " with open(datafile, 'w') as f:\n", + " f.write(html)\n", + " f.close()\n", + " return(oid, omatrix)\n", + "\n", + "\n", + "def write_resource_markdown(outfile = '../resource_counts.md'):\n", + "\n", + " coltype = 'Response'\n", + " rowtype = 'resource'\n", + " rowname = 'resource'\n", + "\n", + " html = '''# AMITT {} courses of action\n", + "\n", + "\n", + "\n", + "\n", + "'''.format(rowtype)\n", + "\n", + " # Table heading row\n", + " colvals = counter.dfcounters[coltype].value_counts().sort_index().index\n", + " for col in colvals:\n", + " html += '\\n'.format(col)\n", + " html += '\\n'\n", + "\n", + " # Data rows\n", + " datadir = '../{}'.format(rowname)\n", + " if not os.path.exists(datadir):\n", + " os.makedirs(datadir)\n", + " for index in counter.idresource['Res'].value_counts().sort_index().index:\n", + " (oid, omatrix) = create_resource_file(index, rowtype, datadir) #self\n", + " row = pd.DataFrame(omatrix.apply(len), index=colvals).fillna(' ')\n", + " html += '\\n'.format(\n", + " rowname, oid, index)\n", + " if len(row.columns) > 0:\n", + " for val in row[0].to_list():\n", + " html += '\\n'.format(val)\n", + " html += '\\n\\n'.format('')\n", + "\n", + " html += '\\n
{}TOTALS
{2}{}{}
\\n' \n", + "\n", + " with open(outfile, 'w') as f:\n", + " f.write(html)\n", + " print('updated {}'.format(outfile))\n", + "\n", + " return\n", + "\n", + "write_resource_markdown()" + ] + }, + { + "cell_type": "code", + "execution_count": null, + "metadata": {}, + "outputs": [], + "source": [] + } + ], + "metadata": { + "kernelspec": { + "display_name": "Python 3", + "language": "python", + "name": "python3" + }, + "language_info": { + "codemirror_mode": { + "name": "ipython", + "version": 3 + }, + "file_extension": ".py", + "mimetype": "text/x-python", + "name": "python", + "nbconvert_exporter": "python", + "pygments_lexer": "ipython3", + "version": "3.7.3" + } + }, + "nbformat": 4, + "nbformat_minor": 2 +} diff --git a/HTML_GENERATING_CODE/AMITT_create_incident_visualisations.ipynb b/HTML_GENERATING_CODE/AMITT_create_incident_visualisations.ipynb new file mode 100644 index 0000000..b591a5c --- /dev/null +++ b/HTML_GENERATING_CODE/AMITT_create_incident_visualisations.ipynb @@ -0,0 +1,135 @@ +{ + "cells": [ + { + "cell_type": "markdown", + "metadata": {}, + "source": [ + "# Create AMITT incident visualisations\n", + "\n", + "Many thanks to https://python-graph-gallery.com/91-customize-seaborn-heatmap/" + ] + }, + { + "cell_type": "code", + "execution_count": 3, + "metadata": {}, + "outputs": [ + { + "data": { + "text/plain": [ + "" + ] + }, + "execution_count": 3, + "metadata": {}, + "output_type": "execute_result" + }, + { + "data": { + "image/png": "iVBORw0KGgoAAAANSUhEUgAAAV0AAAD8CAYAAADUv3dIAAAABHNCSVQICAgIfAhkiAAAAAlwSFlzAAALEgAACxIB0t1+/AAAADl0RVh0U29mdHdhcmUAbWF0cGxvdGxpYiB2ZXJzaW9uIDMuMC4zLCBodHRwOi8vbWF0cGxvdGxpYi5vcmcvnQurowAAIABJREFUeJzsnXd4FNXbhu/JbrK76b3RIr03QweltyjYUBGRKgjSQQRREKQpqKAiFprYESlKx9AJEHonVGnphPTN1vn+2JBsQrK7YAL8+M59XXtdmTOzz5w9M/Puydlz3keSZRmBQCAQPBicHnYFBAKB4P8TIugKBALBA0QEXYFAIHiAiKArEAgEDxARdAUCgeABIoKuQCAQPEBE0BUIBIIHiAi6AoFA8AARQVcgEAgeIMrSPsGIsFdKZcnbJ3/2LA1ZnHxCS0UXIKrZnFLRDe+lKxXdtH2ZpaIL0OeGc6norn0rqFR0zy5MLxVdgJtG11LRPaMqnT7Vhwk7S0UXQJdzXfqvGobkyw7HHGf/iv/5fPeK6OkKBALBA6TUe7oCgUDwQDGbHnYNbCKCrkAgeLwwGR92DWwigq5AIHiskGXzw66CTUTQFQgEjxdmEXQFAoHgwSF6ugKBQPAAET+kCQQCwQPkf72nK0lSdaA7UAaQgVjgL1mWz97PCV00KnpMH4BJb+Ti/jMcWrsHgPZDuuNfPgjPAG9WvL+InEwtvT4dSlZKBrosLaun/2hTNztHz8ylq3FWKgivUYmIlg0A2LTvOLuPnkOpdKJPxFNULBPEtEV/cvzCNf78eLRDdc7OyWHGVz/g7KwkvE51nmnbwqK9cz+7Dh5DqVDQ98WuVCxfhtWbd3L20lXc3TSM6NPDpq6Tq4qqswdiNhhJjTpN4p978va51ShPvZWTOdBoGKqy/pQd2AUAn6frcqDJcIfqDYCLCtWLQ8BkwHTxFMYjlontyiYdUJSrjOTtjznuKvr1yx2Sk9RqvN8ZiWwwojtyDO2WSAA8BvRBGVYeOSOD9CU/Imdr8Zk8AXNqGnJ2NmlfLLSpq9aoGDFjOEaDkWP7jrNtzXYAGrdpRPe+3YjedpC1P/yFk5MTE+aPJyc7B6WzkjljP8Wm5ZSzCy6d+4LJiOnqWUyn91k+f72ncAqtiOTpiznhOoYdf1iaq0tf0Oegj/zNofYAcNKoKD9zMLLBSMa+U6Ss3gVA6JhXUVcuizEtk7h5v2NIuO2QnsJVRd3Z/TDrjdyKOsuNVXvz9nlUL0eLle+xtfEoFK4qaozvgdJdTeaVeGLm/GlT11mjotP0vpgMRq7tP8vpNVEAVOn4JBWfrotnqB97v1hN7NFLAHSa0Q9Ddg7bZvxapJ6rq4YvvpiBXm9g1659/PbbGgBq1qzG+PFvA/DJJws4cyaGBV/NomnTcJ4M7wDA+++Ppnq1KqSmpjJj5nzi4hIcahtHkB/x2Qs2F0dIkvQu8BsgAdHAwdy/f5UkacL9nLBe58Yc37Cf3yZ+R+0OT+aV/7NwLb9N/I79f2ynSrNaePh7kXgplt8mfoe7r6dd3ciDp2jfuA5T3nyJHUfO5JdHn+TDQS8x4pUuLF+/G4DJA18kLMTf4TpH7j1Eh5aN+HDkAHYcOJpXvnXvQaaOGsjIfi/zw6qN3EpNY9OuA2jUKgJ8ve3qBnRtQtK6/Zwf+y3+nRrllUtKBSG92pESaTlX9vkbnB//PbE/bCVxbZTD9QZQ1mmG8fhedCsWoKjVOK/ceGArupULMSfFYoiOdFhP3boV2u27SJ39KepWzfN3mExgMCIbTcgZmTj5+mC8eo3U2Z/i5G2/LVp2acmuDbv57N15NO/YLK88evtBViz8I2/bRe2CXm/gs3fnoc3WonZV2/781cIxnYtGv2EJyqoN8z//8V3oNy5DvhWP8YTlvlBUb4Q57oqjTZGHd9dm3F6/j6vjv8a7Q34by0YTcm6bmNKyHNYL6dqI2L+jOT5uEcGd8ussKRVU6NWGhG3HAdAnp3N8/GIOD12Aa1n793O1zuGc2xDNxgmLqdw+X/fClsNsnrSUXXP/ILR+ZcuxXRsRf9J2Wzz3XBdWr9rA0KHv8kxEx7zyYcP6M3Lk+4wYMYm3h/YF4O1hEzl//lLeMUajCb1Bj8FgJDU1zX6j3Atms+Ovh4C9FWkDgEayLM+WZfmn3NdsoHHuviKRJGmQJEmHJEk6dCrjUoF93iF+3I67BYDZVPBDu7iqaBDRjBNbDpIad4vgKmV4a9kEkq/Z/xZMTEkj2M/ycCuc8j/WGxFPM/uHtazYuo/0LK1dnaJISE4hOMAPACcr7b4vdmXWwh/5fV0k6ZlZ3IhLwsvDjdH9XyEuMZnrsbbrrQr1RXfT0hayVVuUG/osNxdttPxfYUVIr3bE/7L9nuouefsjpyZbNgr/26V0xsk3CDnppsN6ikB/TAmJlg2rmzbjh5+5PW0WuujDuHbriikpCWVYBfw+m4XxZqxd3YAQf5JikyyypuIfBp1WB7LMjGXTcHZxRmvnmkqevsjpKXfV1/JhnJG8A5BT4sHNE6fgCpiunLZb18K4BPuhj7W0sWx1jrgvV3Jl5DzSdx3D/7UODutpQnzRxt59X1QeEsGVxZvBqmfv27gazX6fSMYF+23sEeJLeu6zJxdqiyaDI+jy8UD+3XsaV39PgmqF8e+eUzb1ypQJ4foNy3lNVuOoXp4epKWlk56egbuHe5Hv/fjjL+nffxSRkbvp36+El/TLZsdfDwF7QdcMFJWMICR3X5HIsvydLMvhsiyH1/aoVGBfatwtvIMtAUyyCmBqdw2vTB/I2lk/o8vKoVbbhhzbGM03fWfjGeiDq5ebzYoG+nqRkGL5xjRb3VB1KpfjgwEvENGyAcF+XnY+btEE+fuSkGx5cK1v1jrVKjF5eD+eaduCYH8/gvx98PSw1NPDzY3snByburrYFFShvgBITvlLwN1rP0GZAZ3xaFCZkDfaA+CkccEl2Aftv/H3VHc5NRnJ29LeSAWXmSvrtcB4ct896ZkSk1EEBtytlxsITLdvI7lqUDdvinbHLm6NmYjC3w/J08OmblJcMv4hFl3rtihMlTqVib+ewKS+k0m4kUClmhVt6srpKUgevnfXF1DUaIQp5pDl7/LVkVw9cW71HE4VaiD5BtvUtUYffwuXkNx7uog2Md5Kw8lV47CeNi4FTe59gdUz4lW7Ak/074hPg0qEvdEOgJToGPa9Mgu/xtXARrsBZMSl4Bnse3c9gQPfrmdFnzk0ebMr5ZvUwM3PkxYjn6d8s5r4PlF0W9y8GUfZMiGWakr59UxLz8DT0wMPD3cyM4rO33FnSCgxKRk3d9vP9j1jNjn+eghItsbDJEnqDHwFXACu5xaXByoDw2RZ3mTvBIUT3rhoVLw0rT9GnZ7LB2Oo8XQ9fhyzgAHfjEWhVJCakMLRdfuIv3iDHlP7k3ErHWe1C7+8U3BMsHDCm+wcPbOWrUHl7EyDamHsPRHDzKGvsvvoOXYeOUu2TseY1yLw9/bgy983sWnfcZrWqcK7b3TDxTl/aLuohDfZOTnM/Hq5RbtWVfYePsmsd95iV/Qxdh44SnaOjrEDXsXf15svl69Em6PDYDQyaWifAjqFE944uaqoMnMAZp2BtOiz+LZpwLlhX+btrz7/bS5MXIwpO4fgV1tj1htJXLWHwthMeOOiQvXCYDAYMF05g6J6Q3S/fA6Auv8kcn6cAwZ9kW8tKuGNpFbjNXYEsl6P/vhJ1E0bc3vaLNz7vIYiMBCFtxepn30Jsoz32BGYbqciqVSkzvikgE7hhDdqjYph04dh0Ok5GX2KRq3D+XjUHGo0rEHPYa/g4eXBqkWrid5+kLFzR5OZlomXjxdzxs4lR5v/+e9KeOPsgkunN8BowHT9PMpKddH99S0Aqh6j0K1eAEZD/ufz8sc5vP1dY7q2Et44aVSUnz4Is05P5sGzeLVuyJWR8wge9hIuoX4ofT25PnkRhsSix3QLJ7xRuKqoO7MvJp2BlAMxBLapy5Hh+fd/g/mDOTFxGa7lAwnr3RZJ4YQuOZ2YuQXHdAsnvHHWqOg4rQ9GnZ4bh85T8em6/D36G+q92prAGuVReWg49usObhyMAcCrrD9P9ulw15junYQ3rq4a5s2bji5Hx96oaDp2bE3//qOoWbMaY8YMRpIkPv30G86ciWHq1PG83KMbkZG7GDP2Q0aNGkS5sqH4+fkwZuwU4uMt/z2VRMIb3dntDie8UdVo88AT3tgMugCSJDlhGU4og2U89wZwUJZlh74mRJaxfESWsXxElrF8RJaxfEok6J7a6njQrd3hgQddu7MXZMuauv0PoC4CgUDw3xEr0gQCgeDB4eA/4Q8NEXQFAsHjxf/64giBQCD4n0IMLwgEAsEDRPR0BQKB4AFiMtg/5iEigq5AIHi8+P8+vDBn41uloruxzfelolsvKKlUdAHGOdleoXa/7NQ4vnrqXlA4l97c1FfkgFLRnfh96cxZ3mlMLBVdgNUBRS+V/a/0unShVHS/9n+6VHRLDDG8IBAIBA+Q/+89XYFAIHigiKArEAgEDw5Z/JAmEAgEDxAxpisQCAQPEDG8IBAIBA8Q0dMVCASCB4jo6RYkO0fHjG9/xVmpoFHtqkQ83QSATXsOsevQSZwVCvo814GK5SwZ6T9a+DMatYpx/V6yqatwVVEv18wvuZCZn2eumd+WQmZ+WVfiOWfHzA9A0qjxe284GIxoDx0na8M2ALzf6o1zxfKY0zNJ/fYnTEm38OrTA0VwAMab8aT/tMqmrlqjZsLsMRgMRg5HHWXTqq0AtGjblJf7v8DeyP2sWLoKSZKY+PFYVGoVOdocZr37qe0KO6tw6TbQYsZ45TSm45bE58on2+JUthKSlz/m+KsYj+zA+anuSEoXzHH/Yti91m5b5LWJWo3nmFHIBiP6Y8fI2foPAE5+vrj16gWSRE7kNgynbFu+3EGpUdFiZl/MBiOx+85yabXFC65Cpycp17oubqF+HJ2/mltnrtPqkwEYMrRkJ9zm6Be261xaRqgAGlc1780eh0Fv5FDUETas2gJAy3bNeLX/i+yJ3MdvS/5EkiTe//gdVBoVOdk5TH/Xdl5lSaPGf9JwZIOBnEMnyFxvud98hvTGuWI5zOmZ3P7mJyRnZ4Lmf4juxFm0+46Q9c/dCe7Bkmz883kfoTcY2L1rPyt+t7RZzZpVGTtuCACfzl2IwWBk9NjBqFUqTp48y+effcvQoX2pVac6sgzTps4lMSG5yHMoNSqa516/uELXr0zrurjnXr+UM9dpaXX9jtm5fvfFI97TLZ0sxzaI3HeUDs0a8uHbvdkRfSKv/J+oI0wd9gYjej/HD2stD/CWqMPUrFzBId3QXDO/YyVs5gfg1q4lWf/sJnna57i2zjdNzDdjNGLOyMSleiVU9Wsh6/SYcu19bNE24mki1+1gxrhPeKpji7zyvdv2s3zBL3nbsiwzc/xcpoyYgbOz811WK4VR1mqC6fR+9Gu+RVk93/DSeHgb+rXfIyfHYjyyAzk5Fv2qhehWzMepXBWH2uIOqqdakbNjJ+lz5qJqkW9Q6fbqK8jZ2SCbMSU5vtAkrGs4V9ZHs3v8Yip0yL9+VzcfZs/EpRz65A8CGlTGp0ooaZfi2DtpGZpAb9xCfG3qlpYRKkC7rq355+/tTBs3m9adWuaV74ncx7IFP+dty7LMR+M/4f3hH+HsYv/6ubVrQdbW3SRPnYdr66b5OqY7RpdGzBkWo0s5W4ukVmGMK37xRrfunVmzZiPD355IRET7vPIhb/djzOjJjB41mbeG9OHChcsMfetd+vcbRaNG9QFo9VRT3h4ygaVLfqVv31eLPced67dn/GLKF7p+UROXcviTPwhsUBnv3OsX5eD1uy+MRsdfD4H7DrqSJPW7n/cl3Eol2N/HcnIr/6c+z3Vg9ve/8fvGnaRnZnMrNZ1zl6/TtG51h3TVNsz8Lhdh5tfcQTM/yDVjjM8NIFbaqYt+JWnSx+TsO4LHC11wDiuH4co1bs9bhGurJkgqF5u6gSEBJMRaHhZbZowAT1QN45PF08nJ0dm2HCfXjDHN0hZFmVFKPoHIyfmfXVGnOaaLx21qFkYREIAp8e42UYY9gXbzFjKXLMO9zxsO67kF+5IZW7RpYt23Img1ZyCxe06TfOoqChclTSf3wi3YB7cQH5u6pWWECpbrF597/Ux2rl/FqmF8tnimQ9dPGRSAMf5u88/U738l6b1P0Obeb8bYBGL7jCH5oy/wHtyrWL0yZYK5ccdA0lTYQDLDYiBp5VP20kvPEBlpcUhesuRXPp83jYiI9pQpU/zKR9dgX7KKuX513oqgZe71u5V7/ZpM7oVrsA+udq7fffE/bkxpi6nF7bB2A160Yl2BfUF+3iTcsnhFWd98dao+wQdDevFM6yYE+/tw6NR5UtIy+HbFBg6ePM+/N20/CDlxKajzTB4LmvlV7N8R7waVeMLKzC/KQTM/yDVjDMrtFTsVYcaYkoqk0WBMSMKcbrG4MefkILnYtqRJjEsiMCTQIutk+1JcOf8v4we8jyRJBJe1bUkjp6cgeRZjxlirKabTB/K36zTHyTsAY/RWm5qFMSUloQjIXcprVXdTUhJyRgayVovkYvtLx5qs+BTcQ4o2TTzxzXo29Z5DnUFdQZY5NGcl+6f9jC41i/SrtnvTpWWECpbrFxRqaQN71+/y+X8ZM+A9JEkipKztZdvGhCSUQXfMP610re43JyvreTnH9tLnmzfjKXPHQNKpGAPJTEvP+aWXnqFc+TIsXmT5T2vrlp2MHjWZXTv3ERNz6W7xXLLjU/J6rYWv38lv1rO59xxq516/w3NWcmDaz+hTs8iwc/3ui0fcgt2eMeWJ4nYBVWVZVtk7QWGTuOwcHbO++w0XF2ca1qjE3iNnmDm6H7sPnWTHoZNotTrG9H0Bfx+Lc+/NhGR+3bDjrjHdwrkX7pj5mXUGbh2IIahNXQ5bmfk1nD+Y4xOX4ZZr5ofCCX1yOucKmfkVlXtB0qjxmzgMWacn5+gpXFs0ImnSx3gN6IkyOACFtxe3Pl6AKTkFv4nDkQ16zFlaUhcuL6DTI7Fg7gW1Rs34maPR6/Qciz5B8zZNmDx8OnWerEW/4a/j4e3Br9//wYlDp+g3vDeSk4TZZObTyV8U+MLa2b/QQ+yswuXZARYzxqtnUVZpgG6lxfBS9fp4dL/NA6Mep5AwVL0nYIo5DHo9+o0/FJDJ2F38AyGp1XiMGml538mTqBo3Jm3GTBQVKuD+Wk9kWUa7bn2xY7p/Xy5bYFupUdF8eh9MOj3xB89TrnVddoz8hmo9W+NXszwuHhrO/bKD+OgYWszoi5OzguRTVzm7/J8COieVBSfGl5QR6s6c6xRG46pm4syx6HQ6jh44QYs2TZk0fBp1n6zNgBG98fTy4KfvV3Di0CkGjOiN5OSE2WTmkw/mFbh+hXMvSBo1/u+9nXu/nUbTIpyk9z7Be+CrKIMDcPLx4tasr3EuH4p7tw5IahXZO/aTtWlHAZ26ubkXXF01fPr5VHQ5OqKiDtGhw9O8OXAMNWtWZeSoQUiSxLzPv0XprOSPlYvYtHEb2dlaJk6Ywas9n6dJkwa4qFx4Z+xUsrO1zPdtQWGUGhXNcq9fwsHzlG1dl50jv6Fqz9b45l6/mF92kBAdQ/Pc63eriOs34MZP/9mzTLv2E4c90jTdxz9axpSSJCUAnYDCNqYSECXLsl0Xx3tx5rwX/hcT3hQOuiXFXUG3hLAVdP8rhYNuSVE46JYURQXdkqK0Et7ULaWEN0UF3ZKiRILu6tmOB93nJzxyxpTrAHdZlo8V3iFJ0o5SqZFAIBD8Fx7x2Qs2g64sywNs7Hut5KsjEAgE/5GHNCvBUcTiCIFA8HhhZ3bIw0YEXYFA8HjxiK9Ie+CLIwQCgaBUKcEpY5IkdZYkKUaSpIuSJE0oYn95SZK2S5J0VJKkE5IkdbWnKYKuQCB4vCihxRGSJCmABUAXoCbQU5KkmoUOex9YIctyA+BV4Gt71RPDCwKB4PHCatXdf6QxcFGW5csAkiT9BnQHzlgdIwN31o17AXaXuZZ60F3VblGp6D73hWPLg++ZHMdyPdwPu50dX6F1L0iV65aK7vofVpeKLkDHwPhS0e2qKp3xvDM3PEpFFyDk0+6lohvWe7n9g+6DZ6uV3pzlEuEexnQlSRoEDLIq+k6W5e9y/y4DWH/YG0CTQhIfAlskSRoOuAHtsYPo6QoEgseLewi6uQH2u2J2F7VwovDUiJ7AMlmWP5UkqRnwoyRJtWW5+LELEXQFAsHjRcktjrgBlLPaLsvdwwcDgM4AsizvkyRJDfgDxaZ9Ez+kCQSCxwrZLDv8ssNBoIokSU9IkuSC5Yeyvwodcw1oByBJUg1ADdhcPy96ugKB4PGihObpyrJslCRpGLAZUABLZFk+LUnSNOCQLMt/AWOB7yVJGo1l6KGvbCd3pwi6AoHg8aLkZi8gy/IGYEOhsslWf58B7ikDkAi6AoHg8eIRX5Emgq5AIHi8EEFXIBAIHiD/6wlvJEmqjmWS8AFZljOtyjvLsrzpXk+o0KhoNKsvJoOJxKgzXM11DQXwql6Otism8nfT0UgKJxpOfR23coFs6zHDrq5Wb2TG39E4K5wIfyKIiHpPALD7/E3WHr6EJEk8H16ZphWDmfF3NDqDCbWLgve7FZ7rXIz2pmMW7Qr+RNQub9G+GM/a4/9atOuH0bxiEB9tOMLxGymsHGR3jrRFd/0hi25YIBF1w3LrHMvao5ctug0rEurtxtI9Z9EZTVQL9qFfyxo2dbNz9MxcthZnpYLwGhWJaGExGdy0/wS7j8WgVDjRp2srKpYJZNri1Ry/cI0/Z4+0W18oPddXSa3Gd+IIZIMR3eFjZG20OOB6DX4D5yfKY07PIO27n3DycMOj5/MAqJs8SWx32z5sklqN9zsjLbpHjqHdEgmAx4A+KMPKI2dkkL7kR+RsLT6TJ2BOTUPOzibti4U2dQHUGhUjZgzHaDBybN9xtq3ZDkDjNo3o3rcb0dsOsvaHv3BycmLC/PHkZOegdFYyZ+ynNn3StDoDM1Zst9wXVcoS0ciyEGj36Sus3X/Gcl80q0W1Mv4s3LAfgD1n/mXlxNdx1xRv5qJxVfP+7HcwGIwcjDrC+j83A9CqXTN69u/B7sgofl2ykrBK5RkwvDcuKhdiTl9kyVf2nZHzG0WNx8jRYDCiP34UXWSuS7SvL649XwdJQrc9EsNpx1yi74tHvKdrc8qYJEkjgLXAcOCUJEnWS2dm3s8Jy3VtxLX10Rx8ZxFlOuW7s0pKBZVea01crmuvIUPLgTHfo7udWZxUASLPXKNDrfJMea4pO8/dyCs/fi2JYe3rMz4inOhL8Tg5SXzQvQnTX2qOwWTGbH/aCJExsXSoXoYpEQ3ZeT4uX/vGLYa1rsX4DnWJ/tcyS+SDrg0J83PMCSDy7HU61CzHlG6N2RlzM1/3ejLD2tVlfJeGRF9JIMzfk6nPNWH2S805eeOWfd1Dp2nfuDZTBr7AjiNn88ujT/HhwBcY8XInlm+w2HVPHvA8YSGOuSJD6bm+urZrSXbkLlKmf4bm6Xx3YYwmZIMB2WjCnJmJ4co1UmbOJ2PlOrK37rBbX3XrVmi37yJ19qeoW1np5jk5m5AzMnHy9cF49Rqpsz/FydvbobZo2aUluzbs5rN359G8Y75LdPT2g6xY+EfetovaBb3ewGfvzkObrUVt5W9WFJHHL9KhfmWmvNaenScv55UfvxLHsGeaM/7Fp4k+fx0/Tzfef7UdQyOaEV6lnM2AC9C+a2u2rNvOh2Nn0aZTq7zy3ZH7WLrgp7ztfy9d44NRM3h3yBTqNqzlUFvcQd3yKXS7dpLx2RxUzfJ/X3J9+VVk7b27RN8XZtnx10PAXk/3TeBJWZYzJUkKA1ZKkhQmy/J8il6tYRfXEF9Sz1lW1lm79tZ4K4LzS7ZQa+Rz9yNLQlo2lYMsD4uTlTFe2xrlmLx6H2ZZZnJ3S6/2UmIaC/45jr+HGicHjCkT0rVUrmRZXm19fNtqoUz++7BFu2vD4t5uWzewqDqXZfKaAxbdZxvnlW86eZVmlexb8ySmpFGlnMW8UmFV3zciWjF7+d/4e7mTnq295/qCxfU15Wzu9SvC9bVit6bsGv0tt8/fJKxzeAHX16y44m3pFYEB6C9csWxY3RdpS34BWUbzVDPcn+tCxm9rAHB/vgsZv6yyW19FoD+6S7mBy6q+GT/8DLKMumVzXLt1Jeuv9SjDKuD32Sz0p8851BYBIf5cOWepsy03Z51WB7LMjGXTuJWYgjbLdtsnpGZSOdTyRVjgfqtbick/bbHcFz3b5ZWvPXCGbo1t//cDEBQayPmzFnNJkwO/8Hd5rj1ROw7YPc4ap4AAjFfubm9FhTAyF3yJOfU27oOHkPHpnHvSvSdKcPZCaWBvcYTizpCCLMv/Aq2BLpIkfYaNoGvtBhyZfbHAvuy4FFzvuIZa3VDetStQtV8H/BpUonLvdtwrQV6uJKZnY6lrfvmSXadZ3L89Swd0YMmu0wBUCvTis9eeQgZiU+33pIM8NSRmaO/Wjophce+nWPrG0yzZF3PvdfbUFF3n3WdY3LctS/u1Y8keS26NTSevEpeWTY9Gle3qBvp6kZCSDoDZ2nG5Ujk+6P8cES0aEOzrdc/1hdJzfTUlJqG05bh8OxXJVWM5r1qFMsAP43W7uUUsTs6Bd5x1i9K9jeSqQd28Kdodu7g1ZiIKfz8kT/u5FpLikvEPsWhLNr68q9SpTPz1BCb1nUzCjQQq1axoUzfI253E1AzragKwZOshFo98iaWjerBk66Hc/TKHzt+gUVX7nnMJsYkEhzrmPt3lufaElA1hxfJ7y79hTkrCKc8lOr9NzMlJmDPv3SX6fpDNZodfDwN7xpTbgDHWHmmSJCmBJUAvWZYV9k7wa2ivAidQaFSEz+yDKcdAUnQMIW3qsX9E/vhZk88Hc3jSMozZOsJn9yf4qdrc2HSIY9N+KaD73LxqBba1eiOz1h1EpVRQv0IAURdimfFSCzYcv0LUxTiQoUmlYJpUCmbJrtOYZRmFkxPvdHmyYG835+5eiFZvZNbmYxbtcn5EXUpgRvd0LaaZAAAgAElEQVRGbDh1najLFmv4JmEBPFu3Al9uP83mMzdo+kQg4zvWxUVp1USFEt5o9UZmbThs0S3vT9TFOGa80IwNJ/4l6lK8pc4Vg6gS5M2IX3bxVNVQ1M5KxnVuUECncMKb7Bw9s374C5WLkgZVw9h74jwzh7zM7mMx7Dx6luwcPWN6dsHf24MvV2xh0/4TNK1dmXd7P4OLc/4/Pz8/f/cDV1Kur+0LJbyR1Gp8JwxD1hnQHTuJunkjbn3wMZ79e6IMCsTJ25PbcyyOy27dOiHrDWRv2nZ3/QolvJHUarzGjkDW69EfP4m6aWNuT5uFe5/XUAQGovD2IvWzL0GW8R47whLcVSpSZ3xSQKfPDee7zqXWqBg2fRgGnZ6T0ado1Dqcj0fNoUbDGvQc9goeXh6sWrSa6O0HGTt3NJlpmXj5eDFn7FxytPm26X8vLpjwRqszMOuP7aicldSvGErU2avMeKMTGw6dI+rsNZBlmlQrz7NNanDw/HWOX4ljYKfGhatHo0IJbzSuat6bOQ69Ts+R6OO0bNOUicOmUi+8NgNH9MHTy4Mfv/udG1dv8tWPc9m1dQ9arY45U+YX0NlW28YwhlqNx/BRyHo9hlMnUDVqQvrsGSgqVMD1lZ4gQ86GdcWO6QZG7vzPRpFZM95weNzAbdLyR84NuCxglGX5rpRQkiS1kGV5r70TFA66JUXhoFtiFBF0S4z/sSxjRQXdkqJw0C0pCgfdkqKooFtSFA66JUXhoFtS2Ay6/5ESCbrTX3c86L7/392H7xV7xpQ3bOyzG3AFAoHggfOQfiBzFDFPVyAQPF4YH+0f0kTQFQgEjxcll9qxVBBBVyAQPF6I4QWBQCB4cDysqWCOIoKuQCB4vBA9XYFAIHiA/H8PuqU1n9a/75LS0dV42j/oPhnkXqdUdE9wvFR0v++UVSq6ANrLhlLR9fp4WKnovtV9TanoApAUZ/+Y+2BneOnMp915uEyp6AK8UBIij/gyYNHTFQgEjxUOeJ89VETQFQgEjxci6AoEAsEDRMxeEAgEggeI6OkKBALBA0QEXYFAIHhwyDYSyj8KiKArEAgeL0RPVyAQCB4c//NTxiRJagzIsiwflCSpJtAZOCfL8ob7OWFJu/a6umqYN286eoOe3bv28/vvFtfZmjWrMm7cUADmzv0ag8HImLFvoVapOHnyLJ999g3VqlVi8Ft9MJlMLF70M+fO5VsLaVw1TJ8zCYPewP69B1mz0vJxq1avzNujBgCwYN5iLp6/zLyFM8nO1uLs4sy4YR/Qul0L+gzsyfZ/dvPDot+KbQtnjYrO0y3OyFf3n+H0GouzbtWOT1Lp6Xp4hvqy+4s1xB67RJcZ/VCqXTBq9WycZHthiEqjYsD0wRgNRs7sP8WeNbsA6D7kBYIqBOMd4MOiSd8QUDaQ1j3a4urpxuGt0exatcPe5QMXNerXh4PJiPHccYwHLO4NkpcvLl1fRZIkDNE7MCfeRNW9DwDKOo3JnPwm5GTb11er8Rw1GtlgxHD8KDn/5LvJuvV6HZDI2R6J4ZRjbrLZOXpm/vCXxRm5+hNWzsgnrZyRW1qckZes4fiF6/w5a7hD2gqNigaz+2I2mEiKOsP1VfnO1p7Vy/HUHxPZ2GQ03rUrEPbyUzh7uRG75TDX/thjU1erNzJjw+F8l+g6FQDYfSGOtceuIEnwfIOKhHq5sjTqHDqjmWpBXvRrYccnTaXGbehoMBoxnDyKfoelbSUfXzQvW5x69TsjMaenoXnpNSQXF4xXLpKz8lf7beGqov7sfpj1RpKjznJ9VX66bc/q5Wi58j02Nx6F0lVFzfE9ULqrybwSz9k5f9rVvmce8aBrzw14CvAFsFCSpFnAV4A7MEGSpEn3c8KSdu3t3r0zq9dsYNjbE+ka0SGvfOjb/Rg9ejKjRn3AW0P6cuHCZYa8NZ5+/UYS3sjy4I0cNYj09AyMBiMJCQU9vDo/044Nf21lwuiptO/cOq+8/+BefDB+Ju+/M4O+b/ZErVGh0+uZMHoq2VnZuLpp2P7PHr75cqndtqjWuRHnNkSzYcIiqrbPd0Y+v+UwGyctYcfcPyhTvxLIMhvfW8LfY75B4aIo6PVVBI07N2P/hn18N+Frnmyfb+OyduEqvpvwNdtX/EOtZnWIOXSWb99dwOdDPiG8o30regDnJ1tiPLybnB8+x7l+vgOuS6cekKNFlmXMt5OQ01PJ+XE+utXLMJ475ljABdStniJn504yPp2DqrmVm+wrr2LOvnc32chDp2nfqDZTBjzPjqP5hpORB0/z4cDnGfFyR5ZvtASIyf2fuydn5DIRjbi5Lpoj4xYR2rGgs/UTvVoTn+tsfSv6PIfHLWL/m/MJtXLALrbO527QoUY5pjzbiJ0x+T5wx68nM6xNbcZ3apDvEt2tMbNfaMrJm8Wbft7BpflT6PfuJOvLObg0yW9bzQu5Tr1ms8XL7OZ1suZ/TOacj1BWq+lQW4R2bcTNv6M5Om4RIZ3yTVolpYKwXm1IyG0LXXI6R8cv5uDQBbiWdbyt7wnzPbweAvaMKV8CWgBPAW8Dz8myPA3oBLxS3JusjSkX/3OowL6EtGyCvFwtJy/CtXf0LzvpWi8MsLj2jvllFyqloljX3jJlQrh5w7KM0my1/M/T04O0tHTS0zPwcHfL/0AvPUtk5G4AGjSow2effsPy5St4e1j/ArohoUHE3YzP1c2/Oh6e7qSnZ5CRkYm7uxva7ByQZZb++hUuLi5kZToWXAA8Q3xJz3XINReaW9h0cAQRH7/Jv3stZpr+Vcrw4rejMOQYCroVFoFfiB+34pKL1FW5qmkW0YKDW/bnlT07+Dl2rIh0qM6Sjz/mlNygZ+32GloBQ9RWdGuXo3rm9bxy55adMERtdUgbLG6y5sREoGC2KGVYGDlbNpO5bCnuvd9wWC8xJZ1gP4sJp8LKjPGNri2Z/eM6VkQeIN2OO29xaEJ8yY61XD/rH2+qDong4uItUOgyVR0SwdXfdtnVTUjXEuRlMeEs4AZcvQyT1x5k9O976Zrb+wXYdOoazSoG2dV18g/AnGxp28JOvbrIzWh/WYqmZ37bujzVFsORg3Z1wdIW2thbQMG2qDIkgkuLNxe4Z/0aV6PF7xPJuGDfWPR+kI1mh18PA3tB1yjLskmW5WzgkizL6QCyLGux8T0hy/J3siyHy7IcPqB9eIF9Je3ae/NmHKFlLLbkktVDlZ6egaenBx4e7mRkWnIIvPTSs5QvX4bFi34G4MqVa2RlZXM7NQ0Pd/cCunGxCQSHBuXq5t/4GemZeHi44+7hRmZmFrXr1eD6tVj69RzGjes3qVnb8VwT6XEpeAQX7ay7/9v1/NbnE5q82RWA5As3+XPwPCQJPMvY7iHciruFX7AfUPCLTeOuYeCMt/h51nJysnIAiBjYjdTEVI5sO1SkVmHk28k4+dzt2mu+nYycnQk6LTjn+4kpq9fDdO5YYZlisXaTtW4Tc1IS5gyLmyz34CYb6OtJQkqaRcPqv6U6lcryQb/uRLSonxeU7xVtcc7WtSpQuX8HfBtUomKus3WVwV3ISUoj7p+jdnUtLtF33Kfz67xk7zkW923N0n5tWLLX0mvfdOoacWlZ9Ai37xJtTk7Cye9uZ2RzchJyIadel6fa4hQYhG7jX3Z1wdIWmlBLW2D1HHrXrkCl/h3xaVCJJ96wtMWt6Bj2vjILv8bVCjo/lxSPeE/XnjHlAaCNLMvZkiQ5ybIlJbskSV7AdlmWGxb75ly0K6YVOEFJufbeSXjj6qrhs8+nkZOjY1/UQTp0eJqBA8dQs2ZVRo0ajCTB559/i7OzM3+sXMTGjdvQZmuZMGE6LVo0ptfrL+Li7MzHH3/FhQuX8xLeaFw1TPt4IjqdnkP7j/B0uxaMHjKJqtUrM3h4XyRJ4psvlnLt6g0+mT+V9LR0fHy9GTd8MjVqVmHoqIF4eXuy5Nuf2Pi3ZeyscMIbZ42KTtP6YNQZuH4ohkpP1+Ov0Qup/2prAmuUR+XhyrFft3P7agLN3+6G5OSEbDKzZeqPBb6xTlAwMY1Ko6L/tEHodXpiDp2l3tMNWTB6HmO/fReFUklK/C32rd+L2lXN65P6cjrqJLfikln91coCOt+3LyLhjYsada9hYNBjvHAKZZ1G5Cz6GKeQ8rh0eQVkGcPujZgunkZRrR6KSjXRb7h7TFB7WV/0DaNW4zki303WpVET0mdZ3GTdXrW4yWo3rCt2TLdwwpvsHD2zlv+NytmZBlXLs/fkBWa+1SPXGTmGbJ2OMa92tjgj/7E13xn59YgCzsjrikh4o9CoaDCzDyadgeToGILb1OPg8Hxn6/B5gzn63jICW9ai7uTXSNx7Bm3sLc7NX1tAJ2JuQUt2rd7IrI1HrFyi45nxfBM2nLxqcYkGmjwRRJVAL0b8toenqoagVioZ16l+wc/+S6FetUqN25BRoNdjOHMClyebkPnpDBTlKqB+ydK2us3rkHU6PKbMxBC9D1mnI3vRggIyRSW8UbiqqD+zLyadgVsHYghqU5dDVm3x5PzBHJu4DLfygTzRuy2Swgldcjpn5xYc030h/pf/HIVv92jt8KCuzx87Hjk3YJUsy7oiyv2BEFmWT9o7QeGgW1KILGP5FA66JUWRQbeEKDbo/kdKK8tYUUG3pCgcdEuKu4JuCVGqWcZKIui+eA9B988HH3TtuQHfFXBzy5OB5FKpkUAgEPwH/uenjAkEAsH/FI/2gjQRdAUCweOFbHzYNbCNvdkLAoFA8D+FbHb8ZQ9JkjpLkhQjSdJFSZImFHPMy5IknZEk6bQkSb/Y0xQ9XYFA8HhRQsMLkiQpgAVAB+AGcFCSpL9kWT5jdUwVYCLQQpbl25IkBdrTFT1dgUDwWFGCPd3GwEVZli/LsqwHfgO6FzrmTWCBLMu3AWRZTrQnKoKuQCB4rCjBoFsGuG61fSO3zJqqQFVJkvZKkrRfkqTO9kRLfXhhzaiYUtE9XNaxNeH3SpvEf0tFF2DMsjalont96Er7B90H6kkzSkUXoHmzEaWi+9eA70tFt1X1ImdPlgjKTh+Viu6L7+4rFd2/X0otFd2SQjY5PvVWkqRBwCCrou9kWf7uzu6i5AttK4EqQGugLLBbkqTasiwX20hiTFcgEDxWOPIDWd6xlgD7XTG7bwDlrLbLAoUTRtwA9suybACuSJIUgyUIF5u0QgwvCASCxwrZLDn8ssNBoIokSU9IkuQCvAoUTkaxBmgDeSt1qwKXbYmKnq5AIHisuJeerk0dWTZKkjQM2AwogCWyLJ+WJGkacEiW5b9y93WUJOkMYALekWX5li1dEXQFAsFjhSyXXDqFXLOGDYXKJlv9LQNjcl8OIYKuQCB4rCipnm5pIYKuQCB4rDDfw+yFh4EIugKB4LHCgR/IHioi6AoEgseKxy7oSpK0XJZlx02qCqHQqGg0y+KAmxh1hqur8x1UvaqXo+2KifzddDSSwomGU1/HrVwg23rYn6QvaVQEf/g2ssFI9oETpP+9AwD/4b1wqVQOU1omtxb8gjExBSSJst9OIXPXIVJ/WleknsZVw+xPP8CgNxC15yCr/rAcV61GZUaMtsyl/uLz74g5e5FXX3+B2nVrkJGWwcczviAwyJ/hYwYhSRJr/9zAwQNFW7RodXpm/PoPzgoF4VXLEdHEsuBj98nLrI06aXFGblmHJtUrMGnpBjQuzhhMJqa90aVYz7g7bRE4eRgYjGRHnyBj3XYA/N5+Pb8tvv4ZU5KlLUIXTiV710FSf/nbbjtn5+Qw46sfcHZWEl6nOs+0tRgcbtq5n10Hj6FUKOj7Ylcqli/D6s07OXvpKu5uGkb06WFTV+Oq5v3Z72AwGDkYdYT1f24GoFW7ZvTs34PdkVH8umQlYZXKM2B4b1xULsScvsiSr360qStp1PhPGo5sMJBz6ASZ6y3uxT5DeuNcsRzm9Exuf/MTkrMzQfM/RHfiLNp9R8j6x7ZjbwFK2MG4OK7fjOO75b+RmZnF5zPev+f3qzVqRs0cgdFg5Ni+Y/yz2tIWTdo25vm+3TmwLZrVy9bi4+9Nv7F9cvc1oV+7gWTb8/5zUaF+5W1koxHThRMYD+0AQPL0waXjyyBJGA/vwnT9Euqew5FzspHTUtBvLt4t+36xYyH40LHnBvxXodffwAt3tu/nhOW6NuLa+mgOvrOIMp0KOqhWeq01cbmuoYYMLQfGfI/udtHeaIXx6NiCjE17iH//C9zbNc0rl40mZIMRjEZM6RYnBJ/XnyVzh23DvYhn27Nu7RbGjZxCxy75K8nefKs3E9/5iAnjpjFg0Ov4+fvS/fnOZGdl5zkKDxnen6yMLGSzmbjYhGLPEXn0Ah0aVmVK707sPJFv/3788k2GdW/F+FfaEn3uGjq9ERelgim9O+GqckarN9isu3uHlmRu3kPC5Pm4t7VqC5OlLWSjEXOGpS28e3Uja2e0Tb0Cdd57iA4tG/HhyAHssPoy2br3IFNHDWRkv5f5YdVGbqWmsWnXATRqFQG+3nZ123dtzZZ12/lw7CzadGqVV747ch9LF/yUt/3vpWt8MGoG7w6ZQt2GtezqurVrQdbW3SRPnYdra9ttIWdrkdQqjHF2l88XoKQdjIujXJkQPpo4+r7f36prS3au38Xc8Z/RvEPzvPID26L5beGKvO3byal8NnE+i+cs42jUMfsBF1DWa4Hh6B50v36Bsk5+O7u0exFZpwWzjPl2Mk7B5TAn3kS34mskL18k75J3BC7Bebqlgr3FEWWBdOAz4NPcV4bV30Vi7QYcmX2xwD7XYhxUa7wVwfklW+77W0oZ7I8hPvku3Vvf/E7cO3PJ2nsU7x6dcKlcHhRO6C9es6kXEhpMbK4bsMnKZdjD04P0tAwy0jNxc3elQlhZbt9OY+bUzylbLpQKYeWoVr0Sf/y2lrmzFjDqnbeKPUdCagZBPh4AOFmZ+bWtX4XJP2xg9MI1dG1cA7WLM5IEw776E4PRhJvatjGjMsgfY3zSXW2R8u1vxL87h+yoo3i91BmXyhUcaosCdU5OITjA7646932xK7MW/sjv6yJJz8ziRlwSXh5ujO7/CnGJyVy38eUDEBQaSPxNyzHW7V0cXZ5rT9SOA3aPUwYFYIy/2wE39ftfSXrvE7T7juDxQheMsQnE9hlD8kdf4D24l11da0rawbi0CAgOICnWcl8Udokuii6vdGLzH1sc0nby8Ue+nWsmYzV9wCmkPIYDkeg2/IxLl56Yb1wCpTOqF97MDbp+9/5B7CDLksOvh4G9oBsOHAYmAWmyLO8AtLIs75RleWdxb7J2A27nWtClNLs4B9XaFajarwN+DSpROddB9V4wxiejDPK/S/dOFDfeSsXJTY1b8wa4lA/B+/Vn8ejYAoVP0Z5ocbHxhOS6AVsHl4z0DDw8LW7AWZnZxMclknrb4jabnpaBm7srsbEJpKamk5WVjVqlKrbOQd4eJOb25Au4vm46wOKxPVk6ridLNkdz9noCoX5efDXsRUL9vDh33XYAMyYkowy+27H3TluYUlJxclXj2qw+LuVC8O71LO4dW+Lkbd8fLsjfl4Tk3C9Nqwe3TrVKTB7ej2fatiDY348gfx88PdwA8HBzIzsnx6ZuQmwiwaGWrHjW7V0UXZ5rT0jZEFYsX223vsaEJJRBdxxwrXQLtUVecc6951goaQfj0iIpPomAEMt94STZDzgNmtfnaJRjTs7m28lId1yirdsg9RbkukRLSmeQZfTrlqNb9T1kZyInx9/7B7GDySQ5/HoY2DSmzDtIksoCnwMJQDdZlss7eoJfQ3sVOIFCoyJ8Zh9MOQaSomMIaVOP/SPyXUObfD6Yw5OWYczWET67P8FP1ebGpkMcm1YwN3AD99sF66hRETR5KLJOj/bwadyeCifunbn4vfUyyuAAFD6eJEz/BlOS5X2ujevgUrXCXWO6dxLeaFw1zJzzProcHdH7j9CmfUuGD55AtRqVGTqiP5IksWD+YmLOXmT8pOG4umpwdnZm0vgZVK1WiaEj+yPL8MvylXljupdXF5w/rdXpmfVbJCpnBfUrlSXqzBVm9ItgQ/QZos78C7JMkxoVaN+wGlOXb8LDVU1qppZpfTqjUeU/xIUT3kgaFYHvv42sz22LVuHEvzsH30GvoAwJQOHtReLMhZYxXUDTqC6qKhXuGtMNWz/truuZnZPDzK+XW9x1a1Vl7+GTzHrnLXZFH2PngaNk5+gYO+BV/H29+XL5SrQ5OgxGI5OG9img07BQwhuNq5r3Zo5Dr9NzJPo4Lds0ZeKwqdQLr83AEX3w9PLgx+9+58bVm3z141x2bd2DVqtjzpT5BXT+Ciz4xSFp1Pi/9zayTk/O0dNoWoST9N4neA98FWVwAE4+Xtya9TXO5UNx79YBSa0ie8d+sjbtKKDj5m8jGP9HB2PfP5YWr21Falo687/9gX0Hj/Dis515841XbB7fof6gAttqjZqR04eh1xk4efAkjVs3YubIj6nZsAa9hvXEw8uDlYtXsWvDbuo3r0ethjX5+au7nZz/fq6ILxAXFeqXhyIb9JgunUZZM5yc5XNxCi6HS/uXADBEbcZ0+Qyql4eCQon5xiUMu9cXkPH4asN/joQx1bs4/P9ytXMbHy034LsOlqQILMl633P0PYWDbklROOiWFKWZZaxw0C0pSivLWFFBt6QoHHRLisJBt6SwGXT/I44G3XulcNAtKYoMuiVESQTdc1W7Ohxzqp//7+e7V+5p9oIsy+uB9XYPFAgEgofEoz57QczTFQgEjxWP3TxdgUAgeJQxmR/tjLUi6AoEgscKMbwgEAgEDxDzQ5p/6ygi6AoEgseKh7XowVFE0BUIBI8V/++HF7wcWNJ5P5QfFFoquudvKEpFF2Bjz22lojso26Yl032zvuXsUtEFODijuf2D7gOpVqNS0R3ec1Wp6AJ8EWk7ac/9kmkqnbnF61YFlYouQM+v/ruGGF4QCASCB4iYvSAQCAQPkEd8dEEEXYFA8HghhhcEAoHgASJmLwgEAsED5BE3AxZBVyAQPF7IiJ6uQCAQPDCMYnihIApXFbVm98dsMJISdYbYP/fm7fOoUY7GK99nR6MRuPh58uSysaQevkDyzpPEr7fj4+Xsgkv718FkxHQ9BtNZi5WLonZLnILDcPL0xZx0A8PuVShqt8ApsDzotBj2rnG88i4q1C8NQTYZMV08ifGwxTzDuUkHnMpXwcnbH1Pcv+jXLXe4LerP7odZbyQ56izXV+W3hWf1crRc+R6bG49C6aqi5vgeKN3VZF6J5+ycP4vUc3XV8MlnH2LQG9i75wArV1iSklevUYVRYwcDMO/Tbzl39gIAcz+fSlZWNlPe/5hBQ96gZq1qIMPMjz4nMTG5yHM4aVSEzRqEbDCSHnWaW6t35e3TVC9PjRVTOdZ0CE6uKsKmD8SYkkH22X9J/NG27YtWb2TGP6dwVjgRXs6PiJplAFh94hqn49OIz9BSNcCTN5tV4aPNJ3BTKQl0V/NmsyoOtXW2Ts/M5estJqDVw4hoXheATQdOsfv4eZQKBX26NKdiaIBDegAuGhW9pg/EqDdyfv9pDqy1mFl2HvIcAeWD8Arw5uf3v+d2fAodB3XDN8SP5BuJ/LPYdnZUrd7IjHUHLW0RFkhEvScA2H3+JmuPXLYYlj5ZiVBvN5buPoPOaKJasA/9WtW0qavWqJkwewwGg5HDUUfZtGorAC3aNuXl/i+wN3I/K5bmz0ee+PFYsrO0zJ/2td22KC3D2fvhUe/p3tOENkmSWkqSNEaSpI73e8Kgro2JX3eAU2O/J7BTeL62UkHZXm1Jisy3BzFm5eCkUaG9WXQAsEZRpSGmmMPotyxHUal+Xrnp1B4M//yEOSUB46m94OqBslojMOiRs9Luqe7Kus0xHN+L7vevUNZuklduOLAV3R9fY06KxRAd6bBeaNdG3Pw7mqPjFhHSqWFeuaRUENarDQm5Jp265HSOjl/MwaELcC1bvJFfRLeO/L1mE6NHvE/nLvmWR4OH9GH82Km8M+ZD3hzcG4Bnu3fi2NF8J4MWLZswatgkflj2O6/bcO717dqUlPX7uPLOQnw65S9EkJQKAl9rT+q2IwB4NK5B6tZD/Pved3i1qoektL3oJPJCPB2qhjClU112Xsy3I3q+bnne71iHCj7udKtdliu3MgnzdWdShzokZeqIT9fa1M3TP3SW9uE1mdK/GzuOxViVn+HD/t0Z0aMdyzdF2VC4m4adm3B4w35+nPgt9Trkt8WmhWv4ceK37P1jO9Wa1aZcrTAqh1fDoNOTlmg/+X7kmet0qFmOKd2bsDPmZl758WvJDGtfj/FdnyT6cjxh/p5Mfb4ps3u04OQN+89I24iniVy3gxnjPuGpjvkGmnu37Wf5goLOLO0iWnPmeExhiWIpLcPZ+8F8D6+HgT034Girv98EvgI8gCmSJE24nxNqQn3R3rxl2bAyTaw49BmuLtqUN8lOez2J/d0+5NT4RVQe84JdXcndB3OGxX7G2hgPAIUSycsf+XYCTl4ByDlZGHb/ieTph+TleM/GydsPOTX35i5s7Kd0RvILQk68efcbi0ET4os21tIW1gaSVYZEcGnx5gLrGf0aV6PF7xPJuBBbrF5oaDA375hpmq3NNN3zzDTdPdwICPCjTt2a7NyRH2SWL/udTz6bQueubQkNDS72HC4hfuhj7xiA5p8j5K3uxC/ZkFfn1G1HcK1TkfKT+6LwckOZa8BZHAkZOQR5WLzKCtvL64wmbqZlE+brTvUgT/QmM3O3nSEpM4fETNvea3dIvJ1OsK/FVUJhpf9Gl+bM/mkDKyIPkp7lmNYdfEJ8uR1nuX5mU8H7QeWqJjyiGUe3RBNcMZS4izf5c/bP1GnzJM4q284LCenZBHlZ/OWsvcza1izH5FX7GP3LLrrWDcsr33TyX5pVDrFb38CQABJiE4usrzW+/j5Uq1OF6MLzsEMAACAASURBVF2H7GreobQMZ+8HGcnh18PAXk/X2ervQUAHWZanAh2BYi1Trd2AN2ovFdinjU1BE5rrAGp183vUDqPCgE54NahE+Tfa55WbtXqHPoiceRvJw+dOBQrsU1QNx3ThSN5xck6u5bYuG1yKN44sjDn1FpLX3eZ7YLGgNp64t56SNi4FTajFpBMrM0bv2hWo1L8jPg0q8cQblh7rregY9r4yC7/G1QqaTVoRGxtPaJmizDQz88w0MzOyaN6yMQEBfox7921atmpCpcphRG7dxfgxU9mz6wAXLhS/rFgfdwuXEMv1k6zO4Vr7CYL6dcW9QRUCe3dEztFz7cOlXJu2DHN2DoZk2/9VBHmo8wJoYQupf2LiaFfF8kXgJEkMa1WNcW1r4ql2pqyXq03dOwT6eJJwOx0Aszlfv07FsnzQ91kimtfNC8qOcjsuBZ/gu01W1e4aek1/k5WzfkKXlcPtuBSy0yw9O32ODqXK9qhekKcriekW2/MChqW7TrO4f3uWDmjPkt1nAEvAjUvNpkcj+8MsiXFJBIbYN/9s2Kw+Pv4+vDmmL+EtGlK+Yjm72qVlOHs/POo9XZseaZIkHQdaYwnOm2VZDrfad1SW5Qb2TrAh6NWCxpSuKmrN7IdJZ+B29DkC2tTn+LAFefvrzh/C6YlL8KzzBGVfeQontQuJWw4Tt2ZfAd3W77gXPJGzCy7teiEbDZhvXkARVhv9/7V33uFRFQ8XfmezNZCEhEAIJBQF6U1CVREQkKLwQ0VAkSJFUUBARRHFRsDeUEEUEMSOInwUASmhBEjoEJr0FkJCCQlJts73x13SyQbYQMB5ffYxe+/dc4e5d8/Ozs7MWTwNAOP/nse2YCo47Nqh93QFgwl89NiX5/xa5TxRQNKu0YT50WeRDhvOQ7vR12hExo+fAGAeMJaMWR+C/cofEst+ydna8/E10WBCP5xWO2c37iOkdT02DcsK6Wz0+TNsG/M9JSqWpcpTbRA+OqxJF9nzUc4+3cFpWovE19fCex+Nw5phZeOGzbRp25LnBr9MjZrVGPrCQIQQTPrs28w+3fCKFRg4uDdvvv4+3Xt2pXGTBhiNRl4bPZ60tHQWlqyT59+gs5ioPGEQrgwbKTF7KdW6AQeHf5G5/45Ph3Jk7HcgJZUiByJ0Os4vieH84pxx6fXeqZzjebrNwcTlcZh8dDQICyL6cCKRnbVuohFzN/HeQw0xG7QuishlO3G4JDXK+tOjYU6dK629kGa1MfGHRZgMehpWq8i6nQeY8MwjrNm+n6ht+0nLsDGqRzuCS+XfIs9v7QWjxcQT7wzAbrVzIHYPte9vyPRRkxgy5SV89D5cSDjHpgXr2bt+F0+8MwCHzUHGpXTmf/pbDp0v3s9Zz+k2BxMXbsKk19GgYhmiD8QT+WgLFu04QvSBeC2w9M5yVAspxfAfo2h5VwXMBh9e6tgoh859I/7J8dxsMTN6wkhsVhvbYnbQonVTxg0bT91Gtek/rDd+pfz4+dvfWbFQ+60iNKwcjz/9SJ4+3RdF3lxabwXO9jr143U3PxeG9Cp0u7pzws/FK5hSCHEE7QNBoH3xbyGlPC2EKAmslVI2uOKL3eQ2XW+Rx3S9RIGme53kNl1vcdl0vU1+pustcpuut7glF7x5v2jqObfpeov8TNdbeMN0/69c4U334dM33nQL/J4jpax8hV0uoJvXS6NQKBTXiauYj164piFjUso04LCXy6JQKBTXjVrwRqFQKG4gahqwQqFQ3EBconh3LxTv1X4VCoXiKnFexcMTQogOQoh9QogDBc1NEEI8JoSQQoiIKx1zGdXSVSgUtxUuLzV0hRA+wFdAO+AEECuEmC+l3J3rOD9gOLAxr0peVEtXoVDcVrgQhX54oAlwQEp5SEppA34BuuZz3LvAB0ChpjQWeUu37fpRRaJ7ptc1zUL2SOmxnYpEF6C96epmrBWWnr96nKNyTVStfbpIdAHSF54tEl05d3OR6H7SwVIkugB7X95SJLrrt31XJLqW8DZFogvQywsaXhy9UAE4nu35CaBp9gOEEA2BcCnlAiHES4URVd0LCoXituJquheEEIPRlji4zFQp5dTLu/N5SaanCyF0wKdAv6spnzJdhUJxW3E1Q8bcBjv1CrtPANkXnggDsq845QfUAVYJbcREOWC+EKKLlPKK00SV6SoUitsKp/dGjMUC1YQQVYCTQE/gics7pZTJQOZaq0KIVcBLBRkuqB/SFArFbYa3VhmTUjqAocASYA/wm5QyTgjxjhCiy7WWT7V0FQrFbYU3Z6RJKRcBi3JtG3eFY1sVRlOZrkKhuK0o5hFpynQVCsXthVp7QaFQKG4ghZneezMp0HSFEE2BPVLKi0IIC/AqcDewG5jg/vXuqkjLyCDyy5kYDHoi6tbgoTZaQN7fURtYHbsNvY8P/R7txB0VKzB3SRR7Dh6lZAkLwwsISwQQZjOlRr+AtDuwbtlG+hItINJ/YF/0lSviSknh4rQfkOnpBI17FeeFZGRaGsmfTy5QFyDdZifyz3VaOuud5el8d1UA1uw5xrzY/QgB3ZrUoEX1MB6a+AvN7qpAjQrBPNasZsHCBhOmboO1BOODcTi2acm6+sYP4BNWFREQjOv0EWx//4jpkWfRVaxO+mcjPZbXaDHRY7yWVPDvht1scqfUthvSleCKIfiXKcWvr39HRmo6T338HKnnUrBeSufP8T941MZkpsRzI8HhwL5zK7ZV2kLZIjAIy+O9QQhsUctxXUzG8tgTCKMRx+EDZMz52bPuMyORDgeOXVuxrc6m+4hbd+1yHPvi8H1mFMJoQtoySJvyyc0pL2hJIr2GaunQ+3fgiFmpafsHYezQAwQ4NkXhPLQXc/+XkbYMhI+ejFmfUFBomM5iIizyWaTdQer6XZz/S0tyKDeyJ+aq4TiTU4n//FdcaRmEjRuAMTyEAz1f91jctPQMxn8yGYPBQOMGdXiofSsAFi9fw+oNm7T3Xs9ulC9Xlrc+/JKSJXwpWzqIZ/r2cCsIfPxDmDL5A6JWr+fnn+cCULt2dV4ZPRSA9z/4kri4fUyIHIPFYiE9PZ3Xxk7Mc8yhQ0eZMvkDLl5MJT4+gQkTP6djhzag9Z8uQstjvCa8NQ24qPA0emE6kOb++3MgAHjfvW3GtZxw+bpNtLu3MW+9MIBVG7dmbl+2Lpa3Rwzkhf6PM/PPxZy9kMzfqzdiMZsoE1TKo66l9X2kr1jNhYkfY7mvReZ26XQiHQ5wOJEpqfgEBWI/eowLEz9GF+hZF2D5ziO0q1eFN7u3JGr30czt248mMLRDBKO7tiDmgBZI6WsykGF3Uq6U52QLfZ1mOHaux/rHZHxqZSUeOGKXY537Da6kU9g3aW9k659TkElXDqXMTv0OTdi6aAM/j5lK3XZZES7LJs/j5zFTWf/7Sqo1r41fcAAJB0/x85iplCxkPpixRUts66K4NOlDjE2zEmUtj/REpqeBy4UrKRHXyeNc+vx9Uj98F331gqPBAYzNWmKLjiLt6w8xNM7SNXfticxIA+nCdTYRpCRtysdc+mICQm/Ik1V3o8oLoG94L/Yta7HO/hx9vWZZ52z3qJa/JyWu80lgNILDjnX250hrBhjNBeoGdGzOhUXRHH/lKwLaNcncLh1OpN2OtDtwJqfiSknj2MuTcFxIKVR5/1m9nvat7uHt0UNZuS4m2/Zo3nllGCOe6cPMX//i0NHjVKlYgTdGDSHx7HniExIBEGY/XBkpPDtkNA8/lBUIPmzoAIYNH8vQYa/x/HNPEx5eHoPewMhR4/DR+RAWVj7PMTVrVGP//kMMG/4a5cqVJSysPIv/XgHadNrrorhnpHkyXZ172ARAhJRyhJRyrTuc8o5rOWFC0jnKldGCDbOH4/V7tBMTJ//ArwuWczH1EifiEwnwK8HIp3sQfyaJ46cKjtHxKRuMM0FLOs2e1Jvy/Y+cf2siGTGbKdG1E44ziRiqVCL404k4TxTOxBKSLxESoJlojnTWOpUZ92sUI79fSqeGWuv3lxGP8PbjLflpza58tbIjArKnC+f6UqQ3oAsqW2ijzU5gaOnMlFqZK/XV6Gvi7s7N2bE0lgvxZylXrQJDvn+VpGOFiynSBZfBlZS3nn0qVca6fAnpP83A0qtP1vlatsG+Jdazbukr6IZXxrpyCem/zMDcXdPVhVWi5CvvIm3WAluMRVleAF2pYOT5xDzauvKVsG9YjnXBbIydngB3OS3PvwN6A1gLjo03hpbGnk/icsKXczg64jMurt1OcK/2V3r5FUlITKJcWW1YqY9Ptvdej25M+Gwqv8xdxMWUVGpWuwObzcEHX07jzNlznEnS7iWh0yNdmh04s5UrIMCf5OSLXLyYgp9fCSqUD+W4+7117PhJwiqE5jlm67ZdmExGPvrgTcqXD6FCAQnUV8utbrq7hBD93X9vv7xsmRDiLsB+pRdlTwP+zv0V5DIhwUEkJLmjmrPdqHWr38m4Yf15qM09lAsuTUhwIP5+Wgy1X4kSpGUUvJaE80wSPmXdcerZ03Ldb0rX+fMIiwXLPc1IX7GapJFj0JUpjfD3nFsWElCCM+401xzprCu2M23IQ8x47mGmr9yunVon8NHpMBp8cqTO5odMPosIuJyMnPNS6Os2x7GrUIsW5eF8/FkCy+VN7DWXtNBz/ED+mvgj1ksZ1G5zN9sWxzC533sElA3E1x37XRCupER0pd31nO0DyJWUiExNQaanI4xaxLixZRt0ZUOwLp7vWfdsIrrgfHTPJiIvpSAzsnRdJ46S+v4bgEBXJuSmlBfAdSEJEZg3Hdp1PgnSUiAjHWEwoguviutsAulfjUOeTUAXVnB7xRZ/FkM+icuX72VH0gV0vgW3lvMjpEwwpxPdkfHZE5Fr3cWbLz3Hw+1bUa5sMDqdjuGDejN66AD8/UoQ5jZE6XIgdFqPZPYGU3LyRfz9/fDzK0lKyiVOnoonrIIWCR8eXp4TJ+PzHCOlZNybH/DS6Lc5fz6ZQ4ezvkFeL/IqHjcDT8GUAWjdCvcBSWj9ucfdj+FSyu2eTmA7FJPjBGkZGUz4ehYmg4GGte9i3eadTHz5WVbHbCNq41bSMqy8OKAnwUGlmDRrDukZVuwOB2Of65tDN/eCN8JsptTLw5FWG9btOzE3b8L5tybi1/cJfELKoisVwIWPJ4GUlHp5OK5zFxBmE+ffzfltJr8Fb9JtdibOjcak96FBlXJE7ztOZK/WLNp6gOh9J7R01moVqFuxLDNWaVVSLTSI3vfVzaHjXJdrwRuDCdP/BoHdhvPIXnyqN8D6q5asa+7zKhk/fQIOLV3Y+OAT6Ovfi/Pf7VjnTwOnI1Pm1V8NOWSNFhOPv/M0dquNg7H7qHV/fWaN+oqBU17ER+9DcsI5tixYT/yBEzz+9tOknL2I0Wxk9ss5+7ffzm/BG5OZEkNGgM2GffcOjI2akvpxJD7hlTA/1gskWJcsQFqt+L05AXvMeqTVStp3X+WQEcZ8dAeNQNptOPbswNCwKZc+j0QXVglLN7fuPwtwJsRjebS39sHqdJE2fVKO1q7MHcbspfIaw/NZ8MZowtzzeaTdhvNgHPpaEWR8/yG60IoY23cHKbGv+xvnsYOY+4xEpqUgSgaQMfNjrfXr5sAiUw5ZncVE2LvP4LLauBS7B/9WDTk64jNCnn8MQ/lg9EH+nHjzWxxnzhM+YQh+99Xnwt8bOBX5fQ6dOrE57+209AwmfPYNRqOBu+vWYm3MFt57fRSr129iVXQMaekZvDSkP8GlA3n3k8k4HE5qVruDnt0uvye0Pt2ps+axLjqGB9u3pl//4dSuXZ0XRw1BCMFHH39NXNw+Ise/islowmqzMvb19/I9ZtIXEzAY9GzbFseUb2bSrGkj1q6Z/39AIPAZkDP2upB8UKl3of109NHZxSsNOPMgbb3IO9B+eDshpSx0ZG5u0/UWt+IqY3lM10vkNl1vka/peok8pusl8piul8jXdL1EbtP1FrlN11sU5SpjDtvJ6zbBiVdhumNugukWasiYlDIF8NiqVSgUipuNq5hHU6pxugqF4rZCTY5QKBSKG0jxbucq01UoFLcZqqWrUCgUNxCHKN5tXWW6CoXitqJ4W64yXYVCcZvxn+9e+OW+L4pG1+fqZ+QUhvLDNxSJLoAfRTM49YMXg4pE17HrQpHoAhj79SsS3YZdPy0S3U0NyhaJLkDlpolFoju90btForsiqIXng24iasiYQqFQ3ECKt+Uq01UoFLcZ//nuBYVCobiROIt5W1eZrkKhuK1QLV2FQqG4gUjV0lUoFIobh2rpKhQKxQ1EDRlTKBSKG0jxtlzPacDDgblSyuNeP7HFRNOJ/XDZHJxev4fDc7MW+C5VI4x2v45hbvNRONKsBahkYbKYeD7yeRx2BzvW72DVX6sAiGgdwcN9HyZ2ZSwLZi7AZDYx7L1hpKWmcS7hHL9M+sWjttFiovf4QThsDvZtiGPjvDUAdBzyP8pULEdAmVLMfn0q50+f48HBXQgKDSbpxBmWTVvgUfex8U/jsDk4sGE3W+atA+CBIV0o7U7t/f31aTgdTh59qx+p51OI33uM6B//KVA33e5kwqq9WnpxhUA6VdfiVubuPkVcwkUSUjOoVrokzze7k9eXxWEx+GB3uni7ba0cGXD5F9qE+Ylh4HDg2L89ZwJuxx4IIbDHrsJ5aC+Wp0drQYx6vZaWUIgF89OsNibMWojBx4eIGpXp3KIeAH9v3MWa7fvR+/jQt2ML7ihfxqMWgMXXzLj3X8FusxMTvZkFfywBoOUDLXhyQHei/onmp+m/A/DWR6/SMKIeXVs9UShtDCaMXQZqac6H43Bu11KX9Y3aoAu7053mfBTHllUYWnZF6I244o9gXzOvYF2TGd+BI7Q6jtuGba07wbhUEOZuT2oJxutW4Nyn5fD5DhqFzEgn/YeCk631FhP3TuiHy+7g1Po9HHC/5yo/2IjwVvUoUb40Wz6fS+K2Q7T+YgiONCs6g55Vo6Z6zqLzNVHtvYG4bA6So+M48+fazH2+NSpSb844YpoMxRwWTPkBHQEIvL8esc2GFVwX14CjmNuup4y0d4GNQog1QojnhBCFu9MLQcVOERxdGMP60dMIb3935nah96Far9acWrnjqvTu6XgPaxet5YtXvqBZu6xk1k0rNzFnypzM5+HVwjl56CRfv/41QWWDCA4N9qh9d4embF60nlljptCgXUTm9sWT/2LWmCms/X0F1ZvXIbx2FapG1MBmtXHhzHmPuvU6NGH7oo38NuZb6mTTXT55Pr+N+ZaNv6+iWvPa3BFRnbjlW/jjjencdU9ddHqfAnWXHzxD26plGdemJlGHs2Y7datVntdb16BSKV+61AzF6nBi9NExrk1NfI0+pNudBahqGBrei2PLGjJmf4ahfvPM7cb2j0FGOtLlykzAlQ47GbM/04IYPSTgZpZ90x7aRtTizae7sGrbvmzbd/PW010Z3v0BZv1d+ASOdp1bs+T/ljPuxQm0ebBl5vbVy6P57suckfNvvfQehw8WPqtLX7spzrgN2P76Bn2NbGnOm1dgm/ctMukUji2rkEmnsP05Getvn6MLr+ZR19j0Puwbokj75iMMjbNmf5m79MhMRpZntetqaHY/joP7riSVgyqdIji8MIbVo6dRuV3We+7Iks2sGTOD2A9+p2zDqviYjbisDlaPnobjUgYGX8/JFsGdmpL4fxv496VvCHowqy6E3ofQJx/g/Aot+Ttt/wkOvPIt8bOWkTivaJJU5FX8dzPwZLqHgDA0820E7BZC/C2E6OuO8MmX7MGUKy/9m+8xvqFBXDqVN7G29rOd2DtjKYWJEcpOcGgwSe4EVZfzyl3pB3cdxGA0MOiNQQSFBFHaHeBYEIGhpTnnTtfNrW3yNRPRuQVbl8ZQ7o7yxB84wR/vzaZe67sxmAqe9hsQGpSZ2ptb1+hrokHnZuxcGsuelVsJq1OFLmN7YwkoQYnAguPdE1KtlCupmVzulqvV4eTkxXQqB5bAbPBBCBj2f9uwOSUljJ57m0RgMK5zeRNwfcpXwr7hH6wLZmPqnC0Bd2jhEnAvc+b8Rcq54+B9sgWM9unYgvdmL+K35bFcvFRwSGl2QkLLctqdJO0s4L64FoR/EDJZu37IXNp6AyIwZ5qzT90WOA94DmDRBZXR4uYhVzJyFWxRS8n47XvMj/VBBATiU6Uqjp2bC1XeEuWCSD11OZgyZ3nrP9uZ+z8cyMm1cTjSbUgp6TDzJXQmA/ZC1LcpNAirW5ts9Rw25GFOTlucp6Fc7skHOP3zykKV+2q51dOApZTSJaVcKqUcAJQHvgY6oBnylV40VUoZIaWMaF0i/0/2tPhz+Ia61wzI9uYKql2J6v3bEdzgTu56qvBZTEnxSZmtVqG78ldkKSWzPprFt+9+S2pyKqePec4BKyhdt/f4QcyZ+APWSxmcjz9LWvIlAGwZVvSmgk0sOf4cpTJ1s8psKmmh+/iB/N/En7BeysButfPXu7OYHzkba1oGqUkXC9QNKWkiIVXrlsn9o8I/B8/Q5k5tHYE9Z1II9TMz6eEGlPczsy8xxWNdyPNJ6ALzSdc9n4h0J+BiMKKr6E7A/XIcrkIk4F6mbKA/Cee1f1+OxNo7wnij38N0blEv05QLQ0L8GcqFaonBugLui2tBXjyH8Hffw7k+3HxqN8MZl5Xm7FO3BbpSZXDELPOo6zqXiC7och1n3W+us+4EY3cd62vVR+cfiPmxPujrNEAXGlag7qXT5yjhfs+JXOXdPmUhi576kPqDOxFctzIpJxL5u+9HpBxPpHStih7LbI0/h6l83vdziTpVKP90B/waViW0T1ttt8WIKSSQjCNFk8FX3Fu6ntKAt0opG15hn0VK6bH5MqtC/iFxeouJJpF9cVptnInZT/nW9Vg3fErm/hafDiZm7Mwr9un+4nMux3OTxcRz7z6HzWojLjaOiFYRfDTiI2rcXYPHn3+ckgElmTdtHusWr+O58c+hN+g5uOsgC39YmEOnvM43z7mMFhNPvjMAu9XOv7F7qXN/A6aNmsRzU17GR+/D+YRzbFoQzd71u3jinYE4bHYyLqUz/9Pfcuj45epCN1pMPPJOfxxWO4di91Lz/gb8OOor+k8ZlZnau3XBBo5tO8Ajb/dD56Nj59JN7FwSm0MnMteCN+l2J+9F7cOo19EwtBTRx84yvl1tAEYs3M57D9bBrNe6E95esQd/k54LGXbefqAWFkNW14Vj18G8FW80Ye41FOw2HAd2oa8dQcaMbAm4gH3tYpzHDmLpMxKZloooGUD6zI9yJOBeacGbNKuNiT8swmTQ07BaRdbtPMCEZx5hzfb9RG3bT1qGjVE92hFcKv8vWrkXvLH4mnl94svYrDY2b9zGfW2a88rzb9Egoi6DhvfFv5Q/s6b+zLIFK3lhzBA6dWtHdFQME8Z+jN1mz9TZNKhS3pMZTBgfHgAOO86je9BXa4h1ziQATL1HY/3lM3DY0IVWxvTUqzj3bQabDdvimTlkbPtzLXhjMuM74AWtjvfsRN+wCWmTJqALq4S5ay+QEuvyhZl9uroy5TB16JanT/e39TlNWG8xce/4vjisNk7H7ie8VT1WvjCFGr1aUbpWRYx+Fvb8tIqkHYe5/6NBWJMvYQ7yY9WoqTjSs65dTUfe96TO10TVCQNwWe1c3LiHwNYN2TdsUub+uz5/ngNjpuFKyyCkZytcVgeJc9fm0Wl5+vfr/mTsW/nRQrvpzCN/FK80YCHEXVLK/ddzgiuZ7vWS23S9RX6m6y1ym663yG263iJf0/USt9wqY/mZrpfIY7peIrfpeov8TNdbeMN0e1d6pNCeM/von8UrDfh6DVehUChuNGqcrkKhUNxA1DRghUKhuIGoacAKhUJxAynu3QuehowpFArFLYU3h4wJIToIIfYJIQ4IIV7NZ/8oIcRuIcQOIcRyIYTHX1yV6SoUitsKp5SFfhSEEMIH+AroCNQCegkhauU6bCsQIaWsB8wBPvBUPmW6CoXitsKFLPTDA02AA1LKQ1JKG/AL0DX7AVLKlVLKNPfTDWgzeAukyPt0e64ZXiS6R1p/XiS6L3/T3PNB14ht9twi0Z38YdFcxv6NCj/d9mp5rufvRaK7ddlbRaKb8tL7RaILUHJg4WdeXg19hxduFuDVsrd30Vw7b3E1P6QJIQYDg7NtmiqlnOr+uwKQfbGvE0DTAuQGAIs9nVP9kKZQKG4rrmbImNtgp15hd34TJ/IVF0L0BiKA+z2dU5muQqG4rfDi6IUTQHi252HAqdwHCSHaAmOB+6WUHqfrKdNVKBS3FVe7QmEBxALVhBBVgJNATyDHYstCiIbAN0AHKeWZwogq01UoFLcV3opgl1I6hBBDgSWADzBdShknhHgH2CSlnA98CJQEfnev3HZMStmlIF1lugqF4rbCm5MjpJSLgEW5to3L9nfbq9VUpqtQKG4rvNi9UCQo01UoFLcVxX0asDJdhUJxW3FLrzImhDCi/WJ3Skr5jxDiCaAFsAdtELG9oNfnR1pGBpFfzsRg0BNRtwYPtbkHgL+jNrA6dht6Hx/6PdqJOypWYO6SKPYcPErJEhaG9+1eoK7BYqLT+H447U6ObNjNrr+00Lvq7Rtx5/31CSgfxOov/uLktoN0juyP3mzEnm5j0djpHsucbrUT+fsqLV23ahidG1cHYE3cEeZt2I0Qgm7Na9OiZkX+Wr+bvScTKWk2MvQhDxMtTGYsfV8Ahx3H3u3Yo5cDIAKCMHXpBQjsG1bi/DcOQ8sO+FSqiky/hHXOjAJl9RYTbSP74bQ7OL5+D3vddVG1fSMqt6qHX2hpNnwxl/itBxmw5mOOrtlFwq4j7PypEJlVJjMlnhmJdDhw7NqKbbU7qTYwCMsjvbWk2rXLceyLw/eZUQijCWnLIG3KJwXLWkz0Gz8Yh93Bng1xRP+1GoCHh3SjrMzOrgAAGTBJREFUbCUtcfn7sVM5d/osQghenP4a21dtYdnMgseip2VYmfDdHAx6PRG1q9L5vkYA/B29lTVbdmvpwg+3pnL5Moz/bg5Wmx2z0cAbgx/3XBdmM37DtLqwb9+KdYVWF7qgICw9eyOEIGPVchxxuyj5wosYatfh/OD+HmXTbQ4iF8Rq91vlsnSuXwWANftPMm/LIe1+a3Qn5UuVYMaa3VgdTqqXC6T/fblnqOaqC6uNCbMXY9D7EFG9Ep2b1dV0dxzgr3Xb0AlBt/sa0LBqRd6ZtZCSFhNlSpVk8EP3eSyzzmIibPwQpN1O6oZdnP8rCoByI3phqhqGMzmV05//iis9gwrjBmIML8vBnq971L0WPE3vvdl4mgY8A+gMvCCE+AHoDmwEGgPfXcsJl6/bRLt7G/PWCwNYtXFr5vZl62J5e8RAXuj/ODP/XMzZC8n8vXojFrOJMkGlPOrW6NCYPYtiWPDqd1Rv2yhz+76lm1k0djorP/qdCg3uBClZ+Np05o2ago/RJ0+2Vb5l3n6QdvWr8mavB4jalRUNt/1wPEMfas7oR1sSs/8451LSWLL1XyxGPcH+JTzqGiLuxR67mvTpn6BvmGXQpk6PI9PTQUpc5xIR/qUwNG2FtGYgL3hOzKjWMYL9i2JY9so0qmZLfT2wdDP/vDaDdR/9TrmGVQGwXcpAbzaScjlU0APGZi2xRUeR9vWHGBrfk7nd3LVnZlKt62wiSEnalI+59MUEhN7gsZ4jOjQjZtF6pr06mbvbZqXJ/t/kuUx7dTKrf1tBzeZ1AGjXtyPbVhQujHF5zA7aNqvPm8/2YNWmXVnbN2znrWd7MvyJzsxasBKdTse4wY8TOfRJ7A5nnuDG/DDd2xLrmihSP/0QY/OsurB074lMT0NKF65ELRUi9fOPcR4/Vrgy7z5Ou1rhvNm1KVH7TmZu334siaFt6zO6UyNiDp2mcrA/b3drxnvd72HniSTPulv20rZRTd7s+xCrtmUFxm4/eJxh3Vozumd7Nu45wuH4JCqXK83Y3h1JSk7l9Llkj9oBHZpzYdE6jr/6Ff5tm2Rul04n0u5AOpw4L6biSknj+Mtf4DzvOY/vWvHiNOAiwZPp1pVS9gC6Ae2Bx6SUPwD9gXyz0yBnGvB3P+ec+pqQdI5yZbQwRl22kMd+j3Zi4uQf+HXBci6mXuJEfCIBfiUY+XQP4s8kcdyd6Hol/EODSI7XDCn3G6b5M5156P1BHF4XB0BwtQp0/2YEjgw7eWJK8yHhQioh7gTe7GVuU+9Oxv34DyO/W0iniOqcSLpIgK+JF7rcQ/z5FI4nFnyzaqmv7qF92cqsC6uEfe1SMv6cifl/T6ErE4q8lIL1t+/QBYegKxtaoK5faFCmieZOGY54pjPtPxjIsbVaXfzQ8XWWvDSVu5/u4LEeAHSly+BKyltmn/DKWFcuIf2XGZi798n8d5R85V2kOxm4IIJCS3M23p3m7MoZBW/yNdO0cws2L91IhWrh6Hx0nPz3eH4yeThzNplywYFaGbNduz5dWvPe9D/4bck6LqZqUX8HT5xm5EfTMRsNOa7zldAFl8GZmLcu9JUqY122hLRZM/Dt3adQ5cxOwsU0QgK0D+3sac5taoUz7s/1jPxpNZ3qVc7c/vfOIzSvWvA9AXDmfEq+ScttGtbgjenzGfHV73RuWocaFcthdzj48NdlnLmQyplCGKQhNBi7+/plr4uEL3/n2MhPSVmzjdI923vU8Qa3uunq3F0MfoAvEODebgIMV3pR9jTggb265dgXEhxEQpJmjjLbxalb/U7GDevPQ23uoVxwaUKCA/H30248vxIlSMsoeB2Ai/Hn8C+Xf9Lp+m8W8lPfD2g+qBMASf+e5PdnPgMBARWCPVQBhJQqyZkLqZf/bZnbpy/bxLThjzDjhUeZ/s9mypYqgb+vFn3uZzGSZrMVqJsj9TXbm1yeS0KmpWqx5QYjrvNJyEvajS8vpYLZUqBuSvw5/C6nvuZKwN30zUL+6PMhEYM7uU8mkS6J02orVKvfdTYRXXA+acBnE5GXtKRaYdSi510njpL6/huAQFcmpEDdc/FnCbqcjJwtAddS0kL/yMH8PHEWGZcyqHNvPcpWKke7vp1o3LEZJQPzD6i8TNnSASScvaCVJ9u1q1u1Em8MfpzOLRtRLlj7JnVnWDk+felpJHAq0fM3CldSIj751IUzKRFXagoyPR1hMHrUyU2Ivy9nLmprqOS431bHMe3ptswY0Jbpa3YDmuHGX0ije+P8U7ezUzbQjwS3gWavi2mL1zF9dB++f6Uv0xdHo9MJhnZrzcs92uHva6ZCmUCP2vb4JAzu65fjPnKfx3E2GV2Jgu9bbyGlLPTjZuApmHIkMAxtYPDHaCvsHAKaAXOklG97OoHtUEyOE6RlZDDh61mYDAYa1r6LdZt3MvHlZ1kds42ojVtJy7Dy4oCeBAeVYtKsOaRnWLE7HIx9rm8O3fdyLXhjsJjo+E5fHFY7xzbto+r99flr5GQa9mxFSM2KmPx82frzSs4dTeDe57sgdDpcThdL3v4hRyvs5al5+2HTrXYmzonCpPehwR3lid5zlMg+7Vm0aR/Re4+BlDStHs7DTWry1cINpFvt2J1OxnRvlbMuci94YzJj6TMMabfh3L8Lfd3GpH/zHrrylTA91AOkxLZqEc5/4zA92g9hsoBeT8asSTlkvovK2crRW0w88K6W+noydj9VWtVj8Ygp1O3ZijI1K2L0t7Dz51WkJV2kyZCHAEjce4wt05bk0OnfKJ/WpMlMiUEjkHYbjj07MDRsyqXPI9GFVcLSrRdIsP6zAGdCPJZHe2tx3E4XadMn5ajn4VtK55S1mOj7ziBsVhv7N+2l3v0NmDLyC174ZrSWuHz6HBsXrmN3tNZFULNZbcKqV8zTp/vd/IE5nqdlWJk4/U8tXbjGHazbtocJw3qzZstuojbHkZZhZdRTXXC5JNP++gfpkuh0Okb3+1+O1m6+C96YzfgNHYG02bDv2oGxcVNS3o/Ep2IlfHtodZG+eAGOuF349h+IuVUbbFs2kfr1JLBn/RySe8GbdJuDiQs3YdLraFCxDNEH4ol8tAWLdhwh+kC8dr/dWY5qIaUY/mMULe+qgNngw0sdG+XQEeVzLniTZrUx8ce/3UnL4azbdZAJA//Hoo27iN51EAk0q1mFh1vUI3L2YhxOJzUqlqNH64gcOvkteKOzmKjwzjNIq51Lm3bjd//dHBv5KWWf744xNBh9kD8n3pqK48x5wiKH4HdfA5KXbOBUZM7fJxocnX/dQZFNyt9faDeNORVVvNKAAYQQ5QGklKeEEKWAtmizLmIKc4Lcpustcpuut8jPdL1FUa0yltt0vUW+puslcpuut8htut7iVlxlLLfpeouiXGXMG6bbuHzLQntO7KnVxSsNGDSzzfb3BbSFehUKhaJY4pTFOyVNjdNVKBS3FWpGmkKhUNxA1Iw0hUKhuIHc0jPSFAqF4lbDpboXFAqF4sahWroKhUJxA/nPj15wRhXNCLPKjqIZXrdn4LIi0QV4ypZaJLqhxsQi0T24teBZZNdDe8fVz9QqDHLX+iLRHb7f86ysa+XbTduKRNdxKqpIdCs1Kd6mproXFAqF4gaiuhcUCoXiBqJaugqFQnEDUS1dhUKhuIE4pdPzQTcRZboKheK2Qk0DVigUihuImgasUCgUNxDV0r0C6TYHkUt3aOF7FUvTuXY4AGsOJjBvx1EtfK9+JVpUKXvV2nqLiaYT++GyOTi9fg+H50Zn7itVI4x2v45hbvNRONKshdLTWUyERz6LtDtIWZ8Vuhc6sifmauE4Lmihe860DMLeHIApPIR/e3gO3bP4mnnjvdHY7XZiorew8A9tEfH7HmjBE093Z83ydfw0XRvn/OaHr9KgcV26tXrSo67ZYmJ45DAcdgfb1m9nxV9a4GST1o3p2q8LMStimTdzPjqdjlc/H01GWgZ6g54PX/zY4w1rtJjoOX4gDpuDfzfEETtvLQDth3QluKIWIPnz699iLmmhdX8tnaLGvXV58/7hHssN3r926TYHkYs2Z4U81q0EwJp/45m37TBCQLeGd1A+wJcZ0XuxOlxUDwmg/z01PWqbLCaeHv8MDruD3Rt2sc4dptllyCOEVCpHQJlApo+dgsPuoPuLT2ApaeH04VPM+fSXgoUNJkyPPANOB86Du3Bs1XT1jR/AJ7waolRpXPFHsS2ejenRZ9FVqkH6JyM8V4bJjG+/F5BOB47d27KCUEsFYe7yBCCwbViBc38cfp/MxrFrE87D/2JbubBw2gNHgMOBI24btrX/ZGl3e1ILLF23Auc+bRF630GjkBnppP8w2bP2VVLcRy94DIISQtwphHhJCPG5EOJjIcSzQogAT6/zxPL98bSrXp43OzYg6t/Tmdu3nzzH0JY1Gd22LjFHrm3Qf8VOERxdGMP60dMIb58VzCj0PlTr1ZpTK3dclV6pjs25sCiaY698Ran2OUP3XDa7loybrIXuHXtpEo5Chu617dSapQtW8OaLE2n9YFbi6prl0Uz/6occx7798nscOVC4YMN7O97L6kVr+OSVz2jRPmtR9piVsfw2OWsBaqPZiM1m55NXPiM9LR2zO2qoIBp0aMLWRRv4acw31GuXlSiwdPI8fhrzDdG/r+Cu5rU5feAkP4/9ljU/LmXzgsJPWPD2tVu+9wTtaobz5sONidqXuTQ0248nMbR1HUY/2JCYwwlayGOXJrz3SDN2nvQc1QPQuENzNi5az7evfk2jbGGM8yf/ybevfs2q3/6hVvO6XDybzLTXJvPl8E8IruC5EaGv2wzHjmisc77Gp1ZWSKcjdjnWP6fgSjyFfdMKAKx/TEEmnrySVA4Mje/DFrOa9O8+xtCoReZ2U+fHkenuUNFz7pyzjHSEwYTrXOHeg8am92HfEEXaNx9haJylbe7SIzOwVJ7VtAzN7sdxcF+hdK8FeRX/3QwKNF0hxHBgCmBGSwC2AOHAeiFEq+s5cUJKOiH+WmaSLntI3l2hjFu4lZF/bKRT7bBr0vYNDeKSO5hRZgtmrP1sJ/bOWHrVXz8MoaWxnUpy62X9Mnp60hyOjviMlDXbCe519aF7IeXLcvqkFriZO0DyeigTGkziqUSPutZ0LTAy8vt3MBgNpF9K96gdGFqa85cDJHNpm3xN3N25BduXxmZua9HjAdb/tqLQZff2tUu4mE5IQD73WY0KjJsXy8hf19HJ3foF+HvXMZrfUbiZeKVzhGnmrgszzTvfw6alGwCoHlGT12a/xckDntM4REBpZLLb/HJPadUb0AWFIBNP5X2hB3RBwchz+YSKVqiMbe0yMv6Yifl/vQFIGTuYtKkfYnrwkUJql9FSoHNrh1fBFrWUjN++x/xYH0RAID5VquLYWbg052vBKV2FftwMPLV0BwEdpJTj0WJ6akkpxwIdgE+v9KLsacDTVm3P95gQPwtnUrQ3efb30fT1+5n25L3M6H0f0zf8m+9rPZEWfw5fdzAj2d5oQbUrUb1/O4Ib3MldTxU+IsUefxZDqDteJntKrLvg9qQL6Ep4biXmJuHUGULKay0fUYj02cKSGJ9EcGgZt+6Vp0tXq1uV08cTGNtvHAknErizlud4l/PxZyl1OUAym7a5pIWe4wfx18TZWC9pIaIGs5FSIYEkHi04yTk73r52If4Wzly8fJ9lC3lct5dp/Voxo39rpq/bC2iGG598ie4RVQulfTZHmGZWWS0lLQyIfJYf3WGaAPs27WFC77eo3riWx2stk88iAtyBqbnCQvX1WuDYtaFQ5cuN61wSIiifUNFz7lBRa7YgTSk1w7cXMrA0e8hqtmBR19lEZKoWWIrBiL5WfXT+gZgf64O+TgN0odfWsCqIWz2YcicQIaW0CiECgX+klI3c+3ZJKet4OkH6jNH5niDd5mDish1a2GNYENGHzhD5cCMWxZ0g+vAZLXyvchkerlsxX93fX7/yJ73eYqJJZF+cVhtnYvZTvnU91g2fkrm/xaeDiRk7M99+wTq6vF0DOouJ8PHP4LLaSI3Zg3+rhhwd8RkhQx/DWD4YfaA/x9/8FseZ84RPGIJ/y/pc+HsDJ8d/n0PnKdvpHM8tvmbGTngZq9XKlpjt3Nu6OWOGvkX9iDoMGt4X/wB/fpj6C8sWrmT4mGfp+L92rI+KYeLrn2C3ZQUbhhpL5dA1W0wMHT8Uu9XGzphdNG4VwfsjPqTm3TXpNbQHfgF+/PndXGJWxvLiRyNJTU4lIDCAD1/8iIz0rDq5yydvL5LRYqLHO09jt9o5GLuXWvc3YOaoLxk85UV89HouJJxj84Jo9q+Po1n3VjisdjbNX5dHp5k9/7UXrufaAXT/oEqO5+k2BxMXb9Hus4rBRB84TWS3pizaeZTog9r1aFolhGplAxj+y1pa3hWKWa/npQcb5NB5+rWdec5lspjo985g7FYb+zbtof79d/P1yM8Y+c0r+Oj1nD99lg0L13Hx7EUeeKI9Oh8dyUnJ/PFZzj7dbx/PZWoGE6Zug8Bhx3l4Dz7VG2L9RcsENPcbQ8bsj8GhJU0bOzyJvsG9OPdvxzrvO3A6MmUcp5JzFdiMpe9wsNtw7NuJoX4T0iZPRFehEuaHeiAl2FYtRKZcxPRQTwBcxw9h/fuPHDLSlk8L0WTGd8ALmvaenegbNiFt0gR0YZUwd+0FUmJdvjCzT1dXphymDt3y9OkG/r7quhdVCfKrVmg3PZfyb/EKphRCvAAMADYALYH3pZQzhBBlgD+klC09neBKpnu9FGS610N+pustcpuut8htut4iP9P1Flcy3eslt+l6i/xM11vkMV0vkcd0vUS+puslvGG6gSWrFtpzzqceKF7BlFLKz4UQ/wA1gU+klHvd2xPRTFihUCiKFbf8OF0pZRwQdwPKolAoFNeNGqerUCgUN5D//CLmCoVCcSO55SdHKBQKxa2EN4eMCSE6CCH2CSEOCCFezWe/SQjxq3v/RiFEZU+aynQVCsVthbdmpAkhfICvgI5ALaCXEKJWrsMGAOellFXR5i6876l8ynQVCsVthRdbuk2AA1LKQ1JKG/AL0DXXMV2Bme6/5wAPCFHwbBJlugqF4rbCJWWhHx6oAGSft33CvS3fY6SUDiAZKF2g6tV8KhT1Axh8q2nfarq3YplVXai6KMp/M7Ap22Nwtn3dge+yPX8KmJTr9XFAWLbnB4HSBZ2zuLV0B9+C2reablFq32q6Ral9q+kWpXZRlvm6kFJOlVJGZHtMzbb7BNoCX5cJA3JPhc08RgihBwKAApepK26mq1AoFMWFWKCaEKKKEMII9ATm5zpmPtDX/fdjwArpbvJeCTVOV6FQKPJBSukQQgwFlgA+wHQpZZwQ4h1gk5RyPjAN+EEIcQCthdvTk25xM92png8pdtq3mm5Rat9qukWpfavpFqV2UZa5SJFSLgIW5do2LtvfGWh9v4WmwFXGFAqFQuFdVJ+uQqFQ3EBua9MVQlQWQuy62eW4HoQQbwkhXrrZ5fCEEGK4EGKPEOLHm10WTxT1fSGEiPZ8VPHRL8r6EEKkFoXurUxx69NV3Lo8B3SUUh6+2QW52UgpW3g+qvjqK4qWYtPSFUL8JYTYLISIE0J4c1yfXggxUwixQwgxRwjh6y1hIUQft+52IcQPnl9RaN2x7kU2/gGqe1G3txAiRgixTQjxjXtuuTd0pwB3APOFECO9oZlN+w0hxF4hxDIhxM9ebPX7CCG+dd9vS4UQFi/pFnnrrij1hRB3CCG2CiEaez5acU3c7Bkh2WZyBLn/bwF24WFWRyE1KwMSuMf9fDrwkpfKWxvYBwRnL78XdBsBOwFfwB844I0yo6V//B9gcD//Gujjxet35HJdeFEzAtjmvif8gH+9VBeVAQfQwP38N6C3F8ud6s16KGp9d33sQvuA33q5XopjWW+HR7Fp6QLDhRDb0fLYwoFqXtI9LqW8nIw4G7jXS7ptgDlSyiQAKWWBs1CugvuAuVLKNCnlRfIOxr5WHkAz9FghxDb3c8/xvzeXe4F5Usp0KWUK2oeGtzgspdzm/nszmvH8lykDzEP78Nnm6WDFtVMs+nSFEK3QIt6bSynThBCrgKvPNM+f3GPivDVGTnhRKzdFoSuAmVLKMUWgXVQUZWhg9jhhJ1pr+r9MMtrCLfeg4rmKlOLS0g1AW5MyTQhRA2jmRe2KQojm7r97AWu9pLsceFwIURpACBHkJd3VQDchhEUI4Qc87CXd5cBjQoiyoJVXCFHJS9pFxVrgYSGEWQhREuh8swt0G2MD/gf0EUI8cbMLcztTLFq6wN/As0KIHWj9pBu8qL0H6CuE+AatT3CyN0SlNh0wEogSQjjR+sL6eUF3ixDiV7S+zKPAmuvVdOvuFkK8DiwVQugAO/C8+xzFEillrBBiPrAdrZyb0Fpk/3WK5BuWlPKSEOIhYJkQ4pKUcl5RnOe/jpqRpijWCCFKSilT3aNOVqMtvbflZpfrZuH+ZrVFSlncv6UorkBxaekqFFdiqjsixYzWJ/1fNtzywCrgo5tcFMV1oFq6CoVCcQMpLj+kKRQKxX8CZboKhUJxA1Gmq1AoFDcQZboKhUJxA1Gmq1AoFDcQZboKhUJxA/l/8LqM1yhBaZUAAAAASUVORK5CYII=\n", + "text/plain": [ + "
" + ] + }, + "metadata": { + "needs_background": "light" + }, + "output_type": "display_data" + } + ], + "source": [ + "import seaborn as sns\n", + "import pandas as pd\n", + "import numpy as np\n", + "import amitt\n", + "\n", + "# Check that heatmap works\n", + "df = pd.DataFrame(np.random.random((10,12)), columns=[\"a\",\"b\",\"c\",\"d\",\"e\",\"f\",\"g\",\"h\",\"i\",\"j\",\"k\",\"l\"])\n", + "sns.heatmap(df, annot=True, annot_kws={\"size\": 7})" + ] + }, + { + "cell_type": "code", + "execution_count": 2, + "metadata": {}, + "outputs": [ + { + "data": { + "text/plain": [ + "array([[ 5, 0, 8, 11, 1, 12, 2, 3, 1, 4, 2, 0],\n", + " [ 2, 0, 1, 1, 1, 4, 2, 2, 1, 0, 0, 0],\n", + " [ 0, 0, 1, 0, 3, 4, 10, 0, 2, 0, 0, 0],\n", + " [ 0, 0, 0, 0, 0, 1, 10, 0, 2, 0, 0, 0],\n", + " [ 0, 0, 0, 0, 0, 2, 2, 1, 1, 0, 0, 0],\n", + " [ 0, 0, 0, 1, 0, 2, 3, 1, 5, 0, 0, 0],\n", + " [ 0, 0, 0, 0, 0, 4, 3, 1, 14, 0, 0, 0],\n", + " [ 0, 0, 0, 0, 0, 0, 3, 12, 15, 0, 0, 0],\n", + " [ 0, 0, 0, 0, 0, 0, 0, 0, 1, 0, 0, 0],\n", + " [ 0, 0, 0, 0, 0, 0, 0, 0, 13, 0, 0, 0]])" + ] + }, + "execution_count": 2, + "metadata": {}, + "output_type": "execute_result" + }, + { + "data": { + "image/png": "iVBORw0KGgoAAAANSUhEUgAAAWQAAAD8CAYAAABAWd66AAAABHNCSVQICAgIfAhkiAAAAAlwSFlzAAALEgAACxIB0t1+/AAAADl0RVh0U29mdHdhcmUAbWF0cGxvdGxpYiB2ZXJzaW9uIDMuMC4zLCBodHRwOi8vbWF0cGxvdGxpYi5vcmcvnQurowAAIABJREFUeJzt3XucVXW9//HXBxjuDIIXREZNk7S8hIYcEEU6qD8gE2/9vJVWJGnH1NLyUonasbRjejQyD3lJszALOaJiSV7TUEQEBUElRRxBEJSrCMzsz/ljr5Et7pm9ZvZ3DWtt3k8f6zH7svZnfV3s/ZnvfPd3fT/m7oiIyNbXZms3QERE8pSQRURSQglZRCQllJBFRFJCCVlEJCWUkEVEUkIJWUSkEWZ2m5ktM7M5BY9dbmZvm9msaBvZyGuHm9krZrbAzC6OdTzNQxYRKc7MhgBrgTvdfb/oscuBte5+bROvawu8ChwJ1ALPAae4+8tNHU89ZBGRRrj7k8B7LXjpAGCBu7/u7huBu4FRpV7UrgUHapardj8tkS742CWPJxGWl3b/fCJxAXY7rXsicT9zw4uJxF1w7YhE4gIc9uNnE4nbuyqZczxzzRuJxAU4pvu+icR9bsOSROLOWvF6InEB6ja+beXG2LT89dg5p/2On/42MKbgofHuPj7GS88xs9OBGcAF7v7+Fs/3Ad4quF8L/FupoOohi8g2y93Hu3v/gi1OMv4N8GmgH7AE+GWRfYr9Yin5iyLxHrKISKvK1Sca3t2XNtw2s98CDxTZrRbYteB+DbC4VGwlZBGpLPV1iYY3s97u3jAedBwwp8huzwF9zWwP4G3gZODUUrGVkEWkorjngsUyswnAUGAHM6sFxgJDzawf+SGIhcC3o313AW5x95HuXmdm5wB/A9oCt7n73FLHU0IWkcqSC5eQ3f2UIg/f2si+i4GRBfenAFOaczwlZBGpLAF7yK1NCVlEKkvCX+olSQlZRCpLJfeQzWwf8leY9CE/iL0YmOzu80I2ZLeBn+XwC05k+atvM/f+aSx6Jkz4zp07Me5XP2fjxo088eQ0JkyYFCRuu947svPYs6l/fzUb33ibFeP/XHZM67ETVYcdi3XszIZ7/pt2g0bS7oBD2TDpJnxZbdnxd9u9hnMvGEN1dTfGfP17ZcerXbmOW6a9xtoNdVx7bH8umzILgJw7V4zoR9s2Zc/x5/Dhh3HoEYPouf123PO7STz7xHNlxwSo2auGY745iuqe1cx+ahYP3fVQkLihz3Gh9p06cME9V3D/9fcw59GZweImdY6T+uyV4gnPskhSkxeGmNlF5C/5M2A6+akcBkyIu1hGbO5s+mADbTtUsWZJS65ULO6440Zy770PctbZP+TLRx8VLG77Pfqw9vHnWHLJf9N+r92CxPT3l7Fx8uZ56XXTplD/yvNBYgMserOWC8+9LFi8mu26cPmIfh/dv3JkP64c2Y9uHat4d+2HQY7xxF//wVUX/oLLz/8ZRx3z70FiAtQuqOWmS3/NNWdfzV4H9A0WN/Q5LnTUWaN4/sFpweMmdY6T+uyVlMvF31KmVA95NLCvu28qfNDMrgPmAlcXe5GZjSG6HHFUzwEc3HWvkg1ZNP0VFj37C7rsUM0RP/kq9513U5z2l1TTpzdz5swHoL4+3NjShpf/xQ5nn0T1yCGsuu/RYHGz7o0Va9hUl2Pn6k5B444+/wzu+V3YHtaAIwdw4tlf4cE7is3rT5d9Bu/POwtqadehKrFjhD7HSX32SsrwkEWpS6dzwC5FHu8dPVdU4eWIcZJx9CIA1q9aR9v24d50tW8voaZPbwDatAl3pXj3E47k3Rv/wKLTL6Hr0IODxc2yBe+u5s7pr3PREfsFjfvdH53FPx99hldeejVo3OlTp/PD43/A4ccODRo3CZ8ZtC97HNiXg485lENPGYZZ+cNBhZI4x0l99krK1cffUqZUD/l84BEze43NC2XsBuwFnBOyIXsP78+eQw6gY3UXZtzxcLC4kyZN4cYbrmLEiGE88ODUYHHXPfk8O5x7GvVfHsqm2qWlXxBHp660H3YSbXb+FFWHjsLXvE/bzxxEmx36sPHJSfiyt0rHaEKPHt256Cfnse8B+3DO977FuOtvKSveyvUbGffkfOYvW8Vvp73Kn2YuZPCeO3HN3+dw5iF96dWt/F7ySaNPYMCQ/nSt7sKue9Qw8c77yo4JsN/A/TlkxCCq2lcx47EZQWJC+HPcYPK1dwMw8MTDWfveGkIum5vUOU7qs1dShnvIJddDNrM25JeS60N+/LgWeM7dY/160Wpvm2m1t8202ttmWu1tsxCrvW2YMzV2zumw35Fh/9QoU8lZFp6/DvGZVmiLiEj5UvhlXVyahywiFSXmH++ppIQsIpUlw2PISsgiUlk0ZCEikhLqIYuIpET9ptL7pJQSsohUFg1ZNG7SxkVJHyKoI5a/mVzwG5ILnYTv/zRb/3YASzat2tpNaLbfLn56azehsmjIQkQkJdRDFhFJCSVkEZF0cH2pJyKSEhpDFhFJCQ1ZiIikhHrIIiIpoR6yiEhKqIdcvixWvk2qwnDW4kL2KiInFTepc5zk+zip2Fur6jR1FVp1uilm9o2QDcli5dukKgxnLS5kryJyUnGTOsdJvo+Tir3Vqk57Lv6WMuVUHryisSfMbIyZzTCzGe9+8E6zgiZR+fat2sVAK1e+3YY0VERevXxlYsdIoup0knFDS/J9nFTsrfbZy+XibyWY2W1mtszM5hQ89l9mNt/MXjSzSWa2XSOvXWhmL5nZLDOLVbixyYQcHbDY9hLQq7HXFVad3rHzznHaAVRY5dttSBYrIicZNwlJvo+Tir3VPnthe8i/A4Zv8dhUYD93PwB4Fbikidd/0d37uXv/OAcrdZZ6AacDXy6yrYhzgLgaKt8OO3ooJ5w+KljcSZOmcNxxIxn3q58Hr3zbo0d3rr7uso8qDG+rcSdfezd/vvIOnpv8FE9NeCSRisih3xdJxU3qHCf5Pk4qdpJtblLAHrK7Pwm8t8VjD7t7w0D1M0BNqKY3WXXazG4Fbnf3p4o890d3P7XUAfr3PiyRqtNJVb7t1aXoXx/bpKSqIUNyFZGTsuTD90rv1EJL1yU31JM1IapOr7/3Z7FzTqfjLy15PDP7FPCAu+9X5Ln7gT+5+11FnnsDeB9w4H/cfXypYzU5y8LdRzfxXMlkLCLS6poxy8LMxgBjCh4aHydxRq/9EVAH/KGRXQa7+2Iz2wmYambzox53o1Iz7U1EJIhmDJlFyTdWAi5kZmcARwPDvJFhBndfHP1cZmaTgAFAkwlZ33KJSGUJOIZcjJkNBy4CjnH3DxrZp4uZdWu4DRwFzCm2byElZBGpLGGnvU0ApgF7m1mtmY0GxgHdyA9DzDKzm6N9dzGzKdFLewFPmdlsYDrwoLv/tdTxNGQhIpUl4AUf7n5KkYdvbWTfxcDI6PbrwOebezwlZBGpLBm+ACzxhJzU9LQsSmp604idD0wkbpIeGd4hkbjb/2FeInH7bb9nInFB096C02pvIiIpoYQsIpISKVw0KC4lZBGpKJ5L5OLgVqGELCKVRUMWIiIpoVkWIiIpoR6yiEhKKCGLiKREwPW4W5sSsohUlkruIZvZPkAf4Fl3X1vw+PA4i2XElcXKt1mrMFyzVw3HfHMU1T2rmf3ULB6666EgcSF81WnbsTcdjz4V69SFD266kqqB/067ffpBuyrW33kDbPywrPhJneMsVk/P4mevSRme9laqpt65wH3Ad4E5ZlZY6+ZnIRuSxcq3WaswXLuglpsu/TXXnH01ex3QN1hcCF912t9dwvrbf/nR/aqDBrP+d9ex6bnHqfrCoWXHT+ocZ7F6ehY/e02qr4+/pUyp5TfPBL7g7scCQ4GfmNl50XONlj4prDqdy62L1ZCKq3xbhiTbPODIAVwz8Re8+PTsYDFbo+p0w7BgbsUy2vTcsex4Sb8vslQ9vdI+e57Lxd7SplRCbtswTOHuC8kn5RFmdh1NJOTCqtNt2nSJ1ZCKq3xbhiTbPH3qdH54/A84/NihwWImXXW6UJueO5F7792y4yR5jrNWPb3iPns5j7+lTKkx5HfMrJ+7zwJw97VmdjRwG7B/yIZMmjSFG2+4ihEjhgWvfJtEXMhXGL7oJ+d9VGF43PW3BImbVJv3G7g/h4wYRFX7KmY8NiNY3MnX3g3AwBMPZ+17a4JUnbYu1XQ44Ru02X0vOnzpFOpeeJqOXzsPa9+e9b//VdnxkzrHDdWsu1Z3Ydc9aph4531B4ib5Ps7iZ69JGV7LolTV6Rqgzt3fKfLcYHd/utQB2rXvk75fQ01Isup01pbfrGnTOZG4AFd/MZkqzllcflNL1G4Wour0uitPi51zulz2h+T+nGuBUlWna5t4rmQyFhFpdXXZ+K6oGM1DFpHKkuEhCyVkEaksKfyyLi4lZBGpKGmczhaXErKIVBb1kEVEUkIJuXJksQLwQ++8kEjcJKcAXk3vxGLLNi4jV+QWo4QsIhVFNfVERNJCCVlEJCU0y0JEJCUy3EPOxvJnIiJxBVztzcxuM7NlZjan4LGeZjbVzF6LfvZo5LVnRPu8ZmZnxGm6ErKIVBSvz8XeYvgdMHyLxy4GHnH3vsAj0f2PMbOewFjg34ABwNjGEnchJWQRqSwBe8ju/iSw5dKEo4A7ott3AMcWeen/A6a6+3vu/j4wlU8m9k9QQhaRiuI5j70VVjeKtjExDtHL3ZcARD93KrJPH+Ctgvu10WNNSs2XelkrtKiik5slUexVRU4/Tu+3ZmjGl3ruPh4Yn0Ariq2zXLJhJXvIZjbAzA6Obn/OzL5vZiNb0MAmZa3QoopObpZEsVcVOf04vd+aIdeMrWWWmllvgOjnsiL71AK7FtyvARaXClyq6vRY4EbgN2b2c2Ac0BW42Mx+1MTrKr7IqYpOti4VOdX7LS6vy8XeWmgy0DBr4gygWJ2uvwFHmVmP6Mu8o6LHmlSqh3wiMBgYAvwHcKy7X0l+wPqkxl60LRQ5VdHJrUNFTvV+KylgD9nMJgDTgL3NrNbMRgNXA0ea2WvAkdF9zKy/md0C4O7vAT8Fnou2K6PHmj5eiZp6L7j7gVveju7Pcvd+pQ4Qt6Ze586duPGGq/jwww08/c/pQcexshQ3ydjNjRt3caGGYq+HDR3EhN9PjFXs9eVjm15cqKHIabt9v8CmJx8it2Ipbfvuv7nIaSNjyHFr6jX3XMStqXfS6BM4+v+P4OVZ83h17oJYRU7j1NTbFt5vEKam3vtfGRp7ELnHnx9PVU29Ugn5WeCL7v6BmbVxz9dGMbPuwGPuflCpA2StyKlsluRqb6USckupyGm2BUnIJzQjIU9MV0IuNctiiLtvAGhIxpEqNo+hiIikRsWu9taQjIs8vhxYnkiLRETKkd21hdIzD1lEJASv29otaDklZBGpKK4esohISighi4ikg3rIIiIpoYQsFal3x56JxR7216ITeMqW1NzpJR+WvMhKUsLrUzW1uFmUkEWkoqiHLCKSEp5TD1lEJBXUQxYRSQl39ZBFRFJBPWQRkZTIaZaFiEg66Es9EZGU2KYSspnd6e6nh25I1irfqgrwZklVWk4ydhKVspOMq/dbfE3U3Ei9UkVOJ2+x3Q8c33A/ZEOyVvlWVYA3S6rScpKxk6iUnWRcvd/i85zF3tKmVOXBGmA1cB3wy2hbU3C7KFWdTmfsrFVabq3YWaD3W3zuFntLm1IJuT/wPPAjYJW7Pw6sd/cn3P2Jxl6kqtPpjJ21SsutETsr9H6Lr77eYm9p02SR0492MqsBrgeWAse4+25xD6Cq0+mJnaZKy3E1N3bcRYBaUik7qbhL160suc+28H6DMEVOX9lnROxR5L3nP5SqrBwrIX+0s9mXgMHufmnc16jqdHYlWWk5KVlclS1OQt5WhEjI8z8zMnbO2efVKalKyM2aZeHuDwIPJtQWEZGyZXmWheYhi0hFSePsibiUkEWkotTnWu8LxNCUkEWkomR5yCK7v0pERIrIucXemmJme5vZrIJttZmdv8U+Q81sVcE+ZV0VpB6yiFSUUBd8uPsrQD8AM2sLvA0Um7v3D3c/OsQxlZBFpKIkNGQxDPiXu7+ZSPSIEnIrSqoichbnsfau6p5I3KTmIX+nul8icQHGrns8sdjbolJDEYXMbAwwpuCh8e4+vsiuJwMTGgkzyMxmA4uBC919buwGbEEJWUQqSnNmWUTJt1gC/oiZtQeOAS4p8vRMYHd3X2tmI4H/BfrGb+3H6Us9Eako3owtphHATHdf+oljua9297XR7SlAlZnt0NK2q4csIhWlOUMWMZ1CI8MVZrYzsNTd3cwGkO/krmjpgZSQRaSihFxW08w6A0cC3y547Kz8cfxm4ETgbDOrA9YDJ3tzFgjaghKyiFSUkEWn3f0DYPstHru54PY4YFyo4ykhi0hFcbSWhYhIKtSlsBJIXErIIlJRtpkespkdCgwA5rj7wyEbkrXKt0lW1M1a5eIkq07X7FXDMd8cRXXPamY/NYuH7nooSNzEqk4P/CyHX3Aiy199m7n3T2PRM/OCxFXV6fhCjiG3tlJVp6cX3D6T/OB1N2CsmV0csiFZq3ybZEXdrFUuTrLqdO2CWm669Ndcc/bV7HVAi+fbf0JS5xh3Nn2wgbYdqlizJNxVg6o6HZ9jsbe0KXVhSFXB7THAke5+BXAUcFpjL1LV6XTKatXpAUcO4JqJv+DFp2cHjx3aoumvcPcZv+Cxqycw5PsnBIurqtPx5ZqxpU2phNzGzHqY2fbk6++9C+Du64C6xl6kqtPplNWq09OnTueHx/+Aw48dGjx2cNEU1PWr1tG2fVWJneNT1en46rHYW9qUGkPuDjwPGOBmtrO7v2NmXaPHgpk0aQo33nAVI0YM44EHp26zcWFz5eJ9D9iHc773rWAVkZNq80mjT2DAkP50re7CrnvUBK06vd/A/TlkxCCq2lcx47EZweImdY73Ht6fPYccQMfqLsy4I9zXLEm+37L4GWlKhis4Na/q9Ecvyl+90svd3yi1r6pOb5a11d6SrDqd1GpvM9eUfEu2SKKrvS15PLHYWROi6vR9O58aO+eMeuePqUrfLZr2Fl29ksw7X0SkDFnuAWoesohUlDR+WReXErKIVJScpWoUolmUkEWkomRjEmpxSsgiUlGyPMtCCVlEKkouhfOL41JCbkVZK0Z6cIfeicWuzX2QWOwkXHj/6YnFHtv/8cRib4s0y0JEJCU0ZCEikhKa9iYikhL16iGLiKSDesgiIimhhCwikhIZLqmnhCwilUU9ZBGRlNCl0yIiKVGx85DN7N+Aee6+2sw6ARcDBwEvAz9z91WhGpK1yreqAvxx7Tt14IJ7ruD+6+9hzqMzg8XNStXp2qXL+e3Eh1nzwXquu3A0APc+Mo37n5jO7VeeV3Z8vd/iy/KQRalCV7cBDde43kC+pNM10WO3h2xI1irfqgrwxx111iief3Ba0JiQnarTNb124IrvnPrR/dqlK1i5dh09qrsGia/3W3wVXeTU3RuKmfZ39/Pd/amo8nSj9X1UdTqdsZOKu8/g/XlnQS2rlyezVkeWqk4D5HI57rz/Ub42cmiwmHq/xefN2Eoxs4Vm9pKZzTKzTxR1tLwbzWyBmb1oZgeV0/ZSCXmOmX0juj3bzPpHjfgMsKmxF6nqdDpjJxX3M4P2ZY8D+3LwMYdy6CnDsMALhGeq6jT53vH7q9dy3V338eqbi/nHzLnlx9T7Lbacxd9i+qK793P3/kWeGwH0jbYxwG/KaXupL/W+BdxgZj8GlgPTzOwt4K3ouWCyVvlWVYA3m3zt3QAMPPFw1r63hpYUzm1MVqpOr1yzjl9NeID5C2t5+JkX+K/v5/sxS1es5LCD9i27vXq/xdfKsyxGAXd6/k3/jJltZ2a93X1JS4LFqjptZt3ID1G0A2rdfWncA6jqdHaducvgxGIntfxmUlWnX3/iukTiAnTp/83EYmdNiKrTV+1+Wuyc8+NFf/w2+Z5tg/HuPr7hjpm9AbxPfoTjfwqfi55/ALja3Z+K7j8CXOTuLeo9xJr25u5rgGwM4InINq05X9ZFCXZ8E7sMdvfFZrYTMNXM5rv7kwXPF/sF0uJOaOsN7IiItIKQX+q5++Lo5zJgEjBgi11qgV0L7tcAi1vadiVkEakooaa9mVmXaLgWM+sCHAXM2WK3ycDp0WyLgcCqlo4fg67UE5EKU2fBvrbqBUyKZg21A/7o7n81s7MA3P1mYAowElhA/vqMbzQSKxYlZBGpKKHSsbu/Dny+yOM3F9x24D8CHVIJWUQqSxqvwItLCVka9dvFTycWe8TOByYSd8G1IxKJ22aXcJdtS7JyGa47rYQsIhUlu+lYCVlEKoyGLEREUqI+w31kJWQRqSjqIYuIpISrhywikg7qIYuIpISmvYmIpER203GKEnLWCi2q6GTycSF8kdPaleu4ZdprrN1Qx7XH9ueyKbMAyLlzxYh+tG3TsuV433p7CePvvJu1a9dx/VU/5qwLfkLvXjvRuXNHfnDOmWW1GfR+a466DKfkJld7M7NzzWzXpvYJJWuFFlV0Mvm4EL7Iac12Xbh8RL+P7l85sh9XjuxHt45VvLv2wxbH3bVPb356yebq1R07dMA9x/Y9epTV3gZ6v8XnzfgvbUotv/lT4Fkz+4eZfcfMdowTVEVO0xk7a3EbJF3k9I0Va9hUl2Pn6k7BYl73n5dy+UXnsXzFe7yyoPwqJnq/xVfJVadfJ7/g8k+BLwAvm9lfzeyMhnVCi1GR03TGzlrcBkkWOV3w7mrunP46Fx2xX9C4DeehZ4/t+GD9+rLj6f0WX5Z7yE3W1DOzme5+UMH9KvJVVk8BjnD3kj3muDX1OnfuxI03XMWHH27g6X9ODzqOlaW4ScZOU9y4iwsVFjl9Y95Cptz5YJP73zN2nyafX7l+I+OenM8zb77LqP135U8zFzJ4z52oatOGMw/pS69uxXvJ7UZ9p+m4q1Zzw//cwbTnZnLCl4fzxptv0bFjB+rrc4z94XebTEiddjmsydiw7bzfQtTUO+NTJ8TOtHcsnBi2RHqZSiXkF9y96CfHzDq5e8lf/SpyKsUktdpbqYTcUqUScjniJORtRYiE/NXdj4+dc+56895UJeRSsyxOauyJOMlYRKS1Vew8ZHd/tbUaIiISQhrHhuNKzTxkEZEQ0jh7Ii4lZBGpKBU7ZCEikjUashARSYn6JmaOpZ0SsohUFA1ZiDTTQ++8kEjcbmcnE7fXheUtaiStR1/qiYikhMaQRURSQkMWIiIp0dRyEGnXekswiYi0gno89tYUM9vVzB4zs3lmNtfMziuyz1AzW2Vms6LtsnLarh6yiFSUgEMWdcAF7j4zWm74eTOb6u4vb7HfP9z96BAHVEIWkYoSasjC3ZcAS6Lba8xsHtAH2DIhB6MhCxGpKDk89haXmX0KOBB4tsjTg8xstpk9ZGb7ltN29ZBFpKI0Z9qbmY0BxhQ8NN7dx2+xT1dgInC+u6/eIsRMYHd3X2tmI4H/BVpc/LHJhGxm7YGTgcXu/nczOxU4BJgXNXxTSw+8paxVvlUV4OTjJhk7qbi77V7DuReMobq6G2O+/r3SL4hJ5zi+5lw6HSXf8Y09H1VJmgj8wd3vLfL61QW3p5jZTWa2g7svb16r80oNWdwOfAk4z8x+D3yFfJf9YOCWlhywMVmrfKsqwMnHTTJ2UnEXvVnLheeW9UV7UTrH8YUasjAzA24F5rn7dY3ss3O0H2Y2gHxOXdHStpcastjf3Q8ws3bA28Au7l5vZncBjZYALvwzwNp2J06h05o+vZkzZz4QvvJtluImGTtrcZOMnWSbk6BzHF/AWRaDga8BL5nZrOixS4HdANz9ZuBE4GwzqwPWAyd7Gd8qluoht4mGLboBnYHu0eMdgKrGXqSq0+mMnbW4ScbeWhWRW0rnOD53j72ViPOUu5u7H+Du/aJtirvfHCVj3H2cu+/r7p9394Hu/s9y2l6qyOn3gO8CbYFfAqOA14GBwF/c/YpSB1DV6fTEzlrcJGM3N26vLtvFitujR3cu+sl5HDZ0EBN+P5Fx15ce2Vu6bmXw9jZHWs4xhClyOmCXw2P3UKcvfiJVRU6bTMgAZrYLgLsvNrPtgCOARe4+Pc4BVHVaKkHchNwScRLytiJEQj54lyGxc85zi59MVUIuOe3N3RcX3F4J/CXRFomIlKHes7sAp+Yhi0hFyfLiQkrIIlJRtPymiEhKaIF6EZGUyGnIQkQkHdRDFhFJCc2yEKlwC+4+O7HY3b7888Rib4s0ZCEikhIashARSQn1kEVEUkI9ZBGRlKj39C+n2hglZBGpKLp0WkQkJXTptIhISqiHLCKSEhU9y8LMPg0cB+wK1AGvARPcfVXIhmSt8q2qACcfN8nYoePWLl/FLQ/PYO36DVw7eiS3//15Fi1byftr13PFaUfQvUvHVLW3NWJvrarTWZ5l0WShKzM7F7gZ6Ei+0nQn8ol5mpkNDdmQrFW+VRXg5OMmGTt03JodunP5qcM+uv+NI77A2FOH8YW+fXhn5Zqy4+scx1fvudhb2pSqPHgmMNzd/5N86abPufuPgOHA9Y29yMzGmNkMM5uRy62L1ZCaPr15qzZfnCR05dssxU0ydtbiJhk7yTYDbKqr54o/PsJTcxfSu0d12fF0juMLVeR0a4hTCrZhWKMD+erTuPsiVHVaVYATjptk7KQrIle1a8vYU4dx/CH78fhLr5cdT+c4vpx77C1tSlWdPg8YDTwDDAGucffbzWxHYKK7Dyl1AFWdTk/srMVNMnZz4665/5Imn1+5bj3jHniGZ+Yv4rhB+7Jm/QY+3FTH6g82cMGxh7J9dedGXxtncaFt4RxDmCKnPbruFTvTvr92QaqKnMapOr0v8FlgjrvPb+4BVHVaKkGphFwOrfa2WYiE3L3rp2PnnFVr/5WqhByn6vRcYG4rtEVEpGxpHBuOS/OQRaSipHH2RFxKyCJSUdL4ZV1cSsgiUlGyPGTRenNRRERagTfjv1LMbLiZvWJmC8zs4iLPdzCzP0XPP2tmnyqn7UrIIlJRQl0YYmZtgV8DI4DPAaeY2ee22G008L6770XVksi+AAAFS0lEQVT+Yrlrymm7ErKIVJSAF4YMABa4++vuvhG4Gxi1xT6jgDui238BhplZy6fSNee3SdIbMCZrsbMWN4tt1rnQuUjy/xmYUbCNKXjuROCWgvtfA8Zt8fo5QE3B/X8BO7S0PWnrIY/JYOysxU0ydtbiJhk7a3GTjJ1km8viBcs8RNv4gqeL9XS37FbH2Se2tCVkEZG0qCW/umWDGmBxY/uYWTugO/BeSw+ohCwiUtxzQF8z28PM2gMnA5O32GcycEZ0+0TgUY/GLloibfOQx5feJXWxsxY3ydhZi5tk7KzFTTJ2km1OjLvXmdk5wN+AtsBt7j7XzK4EZrj7ZOBW4PdmtoB8z/jkco5ZcnEhERFpHRqyEBFJCSVkEZGUSE1CLnWJYhlxbzOzZWY2J1TMKO6uZvaYmc0zs7nRYv4h4nY0s+lmNjuKe0WIuAXx25rZC2b2QOC4C83sJTObZWYzAsbdzsz+Ymbzo3M9KEDMvaN2Nmyrzez8QO39XvTvNsfMJphZedVNPx77vCju3HLaW+wzYWY9zWyqmb0W/ewRMPZXojbnzKx/S9u9TdjaE7OjMey25CdU7wm0B2aTr98XIvYQ4CDyC+yHbHNv4KDodjfg1RBtJj+vsWt0uwp4FhgYsN3fB/4IPBD4fCykjAnxTcS9A/hWdLs9sF3g+G2Bd4DdA8TqA7wBdIru3wN8PVA79yN/EUJn8l/G/x3o28JYn/hMAL8ALo5uX0y+OlCo2J8F9gYeB/qHfo9U0paWHnKcSxRbxN2fpIx5gU3EXeLuM6Pba4B55D+Q5cZ1d18b3a2KtiDfvJpZDfAl4JYQ8ZJmZtXkP+C3Arj7RndfGfgww4B/ufubgeK1AzpFc1I788l5qy31WeAZd//A3euAJ4DjWhKokc9E4SXAdwDHhort7vPc/ZWWxNvWpCUh9wHeKrhfS4Dk1lqiFZ4OJN+bDRGvrZnNApYBU909SFzgv4EfAkms4O3Aw2b2vJmFujJrT+Bd4PZomOUWM4tXNTe+k4EJIQK5+9vAtcAiYAmwyt0fDhGbfO94iJltb2adgZF8/KKFcvVy9yWQ72wAOwWMLTGlJSEHvfywNZlZV2AicL67rw4R093r3b0f+SuDBpjZfuXGNLOjgWXu/nzZDSxusLsfRH5lrP8ws5IFcGNoR/7P39+4+4HAOvJ/TgcRTfY/BvhzoHg9yPc09wB2AbqY2VdDxHb3eeRXEpsK/JX8sF5diNiSHmlJyHEuUUwdM6sin4z/4O73ho4f/Xn+ODA8QLjBwDFmtpD8kNC/m9ldAeIC4O6Lo5/LgEnkh6HKVQvUFvyF8BfyCTqUEcBMd18aKN4RwBvu/q67bwLuBQ4JFBt3v9XdD/J8tff3gNdCxQaWmllvgOjnsoCxJaa0JOQ4lyimSrTE3q3APHe/LmDcHc1su+h2J/If8mZX+96Su1/i7jXu/iny5/dRdw/SezOzLmbWreE2cBT5P7HL4u7vAG+Z2d7RQ8OAl8uNW+AUAg1XRBYBA82sc/T+GEb+u4UgzGyn6OduwPGEbXvhJcBnAPcFjC1xbe1vFRs28mNir5KfbfGjgHEnkB/P20S+xzU6UNxDyQ+rvAjMiraRAeIeALwQxZ0DXJbAuR5KwFkW5Md6Z0fb3MD/fv3IL4v4IvC/QI9AcTsDK4Dugc/tFeR/gc4Bfg90CBj7H+R/Ic0GhpUR5xOfCWB74BHyve5HgJ4BYx8X3d4ALAX+FvKcV9KmS6dFRFIiLUMWIiLbPCVkEZGUUEIWEUkJJWQRkZRQQhYRSQklZBGRlFBCFhFJif8Dq/0o573PiKYAAAAASUVORK5CYII=\n", + "text/plain": [ + "
" + ] + }, + "metadata": { + "needs_background": "light" + }, + "output_type": "display_data" + } + ], + "source": [ + "amitt = amitt.Amitt()\n", + "\n", + "techcounts = amitt.it[['id_incident','id_technique']].drop_duplicates().groupby('id_technique').count().to_dict()['id_incident']\n", + "techlabels = amitt.grid[2:][:]\n", + "nrows = len(techlabels)\n", + "ncols = len(techlabels[0])\n", + "techgrid = np.zeros([nrows, ncols], dtype = int)\n", + "\n", + "for row in range(nrows):\n", + " for col in range(ncols):\n", + " if techlabels[row][col] in techcounts:\n", + " techgrid[row][col] = techcounts[techlabels[row][col]]\n", + "\n", + "sns.heatmap(techgrid, annot=True, annot_kws={\"size\": 7})\n", + "techgrid" + ] + }, + { + "cell_type": "code", + "execution_count": null, + "metadata": {}, + "outputs": [], + "source": [] + } + ], + "metadata": { + "kernelspec": { + "display_name": "Python 3", + "language": "python", + "name": "python3" + }, + "language_info": { + "codemirror_mode": { + "name": "ipython", + "version": 3 + }, + "file_extension": ".py", + "mimetype": "text/x-python", + "name": "python", + "nbconvert_exporter": "python", + "pygments_lexer": "ipython3", + "version": "3.7.3" + } + }, + "nbformat": 4, + "nbformat_minor": 2 +} diff --git a/HTML_GENERATING_CODE/amitt.py b/HTML_GENERATING_CODE/amitt.py new file mode 100644 index 0000000..a4bad9c --- /dev/null +++ b/HTML_GENERATING_CODE/amitt.py @@ -0,0 +1,383 @@ +''' Manage AMITT metadata + +Create a page for each of the AMITT objects, if it doesn't already exist. +If it does exist, update the metadata on it, and preserve any hand- +created notes below the metadata area in it. + +* todo: add all framework comments to the repo issues list +''' + +import pandas as pd +import numpy as np +import os + + +class Amitt: + + + def __init__(self, infile = 'amitt_metadata_v3.xlsx'): + + # Load metadata from file + metadata = {} + xlsx = pd.ExcelFile(infile) + for sheetname in xlsx.sheet_names: + metadata[sheetname] = xlsx.parse(sheetname) + + # Create individual tables and dictionaries + self.phases = metadata['phases'] + self.techniques = metadata['techniques'] + self.tasks = metadata['tasks'] + self.incidents = metadata['incidents'] + self.it = self.create_incident_technique_crosstable(metadata['incidenttechniques']) + + tactechs = self.techniques.groupby('tactic')['id'].apply(list).reset_index().rename({'id':'techniques'}, axis=1) + self.tactics = metadata['tactics'].merge(tactechs, left_on='id', right_on='tactic', how='left').fillna('').drop('tactic', axis=1) + + self.phasedict = self.make_object_dict(self.phases) + self.tacdict = self.make_object_dict(self.tactics) + self.techdict = self.make_object_dict(self.techniques) + + self.ngridrows = max(tactechs['techniques'].apply(len)) +2 + self.ngridcols = len(self.tactics) + self.grid = self.create_display_grid() + + + def create_incident_technique_crosstable(self, it_metadata): + # Generate full cross-table between incidents and techniques + + it = it_metadata + it.index=it['id'] + it = it['techniques'].str.split(',').apply(lambda x: pd.Series(x)).stack().reset_index(level=1, drop=True).to_frame('technique').reset_index().merge(it.drop('id', axis=1).reset_index()).drop('techniques', axis=1) + it = it.merge(self.incidents[['id','name']], + left_on='incident', right_on='id', + suffixes=['','_incident']).drop('incident', axis=1) + it = it.merge(self.techniques[['id','name']], + left_on='technique', right_on='id', + suffixes=['','_technique']).drop('technique', axis=1) + return(it) + + + def make_object_dict(self, df): + return(pd.Series(df.name.values,index=df.id).to_dict()) + + + def create_display_grid(self, tofile=True): + # Create the master grid that we make all the framework visuals from + # cols = number of tactics + # rows = max number of techniques per tactic + 2 + + arr = [['' for i in range(self.ngridcols)] for j in range(self.ngridrows)] + for index, tactic in self.tactics.iterrows(): + arr[0][index] = tactic['phase'] + arr[1][index] = tactic['id'] + if tactic['techniques'] == '': + continue + for index2, technique in enumerate(tactic['techniques']): + arr[index2+2][index] = technique + + #Save grid to file + if tofile: + matrixdir = '../matrices' + if not os.path.exists(matrixdir): + os.makedirs(matrixdir) + pd.DataFrame(arr).to_csv(matrixdir + '/matrix_arr.csv', index=False, header=False) + + return(arr) + + + def create_incidentstring(self, techniqueid): + + incidentstr = ''' +| Incident | Descriptions given for this incident | +| -------- | -------------------- | +''' + incirow = '| [{0} {1}](../incidents/{0}.md) | {2} |\n' + its = self.it[self.it['id_technique']==techniqueid] + for index, row in its[['id_incident', 'name_incident']].drop_duplicates().sort_values('id_incident').iterrows(): + techstring = ', '.join(its[its['id_incident']==row['id_incident']]['name'].to_list()) + incidentstr += incirow.format(row['id_incident'], row['name_incident'], techstring) + return incidentstr + + + def create_techstring(self, incidentid): + + techstr = ''' +| Technique | Description given for this incident | +| --------- | ------------------------- | +''' + techrow = '| [{0} {1}](../techniques/{0}.md) | {2} {3} |\n' + techlist = self.it[self.it['id_incident'] == incidentid] + for index, row in techlist.sort_values('id_technique').iterrows(): + techstr += techrow.format(row['id_technique'], row['name_technique'], + row['id'], row['name']) + return techstr + + + def create_taskstring(self, tacticid): + + taskstr = ''' +| Task | +| ---- | +''' + tasklist = self.tasks[self.tasks['tactic']==tacticid] + taskrow = '| [{0} {1}](../tasks/{0}.md) |\n' + for index, row in tasklist.sort_values('id').iterrows(): + taskstr += taskrow.format(row['id'], row['name']) + return taskstr + + + def create_techtacstring(self, tacticid): + + techstr = ''' +| Technique | +| --------- | +''' + techlist = self.techniques[self.techniques['tactic']==tacticid] + techrow = '| [{0} {1}](../techniques/{0}.md) |\n' + for index, row in techlist.sort_values('id').iterrows(): + techstr += techrow.format(row['id'], row['name']) + return techstr + + + def generate_datasheets(self): + # Generate datafiles + warntext = 'DO NOT EDIT ABOVE THIS LINE - PLEASE ADD NOTES BELOW' + warnlen = len(warntext) + + metadata = { + 'phase': self.phases, + 'tactic': self.tactics, + 'technique': self.techniques, + 'task': self.tasks, + 'incident': self.incidents + } + + for entity, df in metadata.items(): + entities = entity + 's' + entitydir = '../{}'.format(entities) + if not os.path.exists(entitydir): + os.makedirs(entitydir) + + template = open('template_{}.md'.format(entity)).read() + for index, row in df[df['name'].notnull()].iterrows(): + + # First read in the file - if it exists - and grab everything + # below the "do not write about this line". Will write this + # out below new metadata. + datafile = '../{}/{}.md'.format(entities, row['id']) + oldmetatext = '' + if os.path.exists(datafile): + with open(datafile) as f: + filetext = f.read() + warnpos = filetext.find(warntext) + if warnpos == -1: + print('no warning text found in {}: adding to file'.format(datafile)) + usertext = filetext + else: + oldmetatext = filetext[:warnpos+warnlen] + usertext = filetext[warnpos+warnlen:] + else: + usertext = '' + + # Now populate datafiles with new metadata plus old userdata + if entity == 'phase': + metatext = template.format(id=row['id'], name=row['name'], summary=row['summary']) + if entity == 'tactic': + metatext = template.format(id=row['id'], name=row['name'], + phase=row['phase'], summary=row['summary'], + tasks=self.create_taskstring(row['id']), + techniques=self.create_techtacstring(row['id'])) + if entity == 'task': + metatext = template.format(id=row['id'], name=row['name'], + tactic=row['tactic'], summary=row['summary']) + if entity == 'technique': + metatext = template.format(id=row['id'], name=row['name'], + tactic=row['tactic'], summary=row['summary'], + incidents=self.create_incidentstring(row['id'])) + if entity == 'incident': + metatext = template.format(id=row['id'], name=row['name'], + type=row['type'], summary=row['summary'], + yearstarted=row['Year Started'], + fromcountry=row['From country'], + tocountry=row['To country'], + foundvia=row['Found via'], + dateadded=row['When added'], + techniques=self.create_techstring(row['id'])) + + # Make sure the user data goes in + if (metatext + warntext) != oldmetatext: + print('Updating {}'.format(datafile)) + with open(datafile, 'w') as f: + f.write(metatext) + f.write(warntext) + f.write(usertext) + f.close() + return + + + def write_grid_markdown(self, outfile = '../matrix.md'): + # Write HTML version of framework diagram to markdown file + # Needs phasedict, tacdict, techdict, grid + + html = '''# AMITT Latest Framework: + + + +''' + + for col in range(self.ngridcols): + html += '\n'.format( + self.grid[0][col], self.phasedict[self.grid[0][col]]) + html += '\n' + + html += '\n' + for col in range(self.ngridcols): + html += '\n'.format( + self.grid[1][col], self.tacdict[self.grid[1][col]]) + html += '\n\n' + + for row in range(2,self.ngridrows): + for col in range(self.ngridcols): + if self.grid[row][col] == '': + html += '\n' + else: + html += '\n'.format( + self.grid[row][col], self.techdict[self.grid[row][col]]) + html += '\n\n' + html += '\n
{0} {1}
{0} {1}
{0} {1}
\n' + + with open(outfile, 'w') as f: + f.write(html) + print('updated {}'.format(outfile)) + return + + + def write_incidentlist_markdown(self, outfile='../incidents.md'): + # Write HTML version of incident list to markdown file + + html = '''# AMITT Incidents: + + + +''' + + cols = ['name', 'type', 'Year Started', 'From country', 'To country', + 'Found via'] + + html += '\n'.format('id') + for col in cols: + html += '\n'.format(col) + html += '\n' + + for index, row in self.incidents[self.incidents['name'].notnull()].iterrows(): + html += '\n' + html += '\n'.format(row['id']) + for col in cols: + html += '\n'.format(row[col]) + html += '\n' + html += '
{}{}
{0}{}
\n' + with open(outfile, 'w') as f: + f.write(html) + print('updated {}'.format(outfile)) + return + + + def write_grid_message_generator(self, outfile='../matrix_to_message.html'): + # Write clickable html version of the matrix grid to html file + + html = ''' + + + AMITT + + + + + +

AMITT

+ + +''' + + html += '\n' + for col in range(self.ngridcols): + html += '\n'.format(self.grid[0][col], self.phasedict[self.grid[0][col]]) + html += '\n' + + html += '\n' + for col in range(self.ngridcols): + html += '\n'.format(self.grid[1][col], self.tacdict[self.grid[1][col]]) + html += '\n' + + liststr = '' + html += '\n' + for row in range(2,self.ngridrows): + for col in range(self.ngridcols): + techid = self.grid[row][col] + if techid == '': + html += '\n' + else: + html += '\n'.format( + techid, self.techdict[techid]) + liststr += '\n'.format( + techid, self.techdict[techid]) + + html += '\n\n' + html += '\n
{0} {1}
{0} {1}
{0} {1}
\n
\n' + + html += '
    \n{}
\n'.format(liststr) + html += ''' + + +''' + + with open(outfile, 'w') as f: + f.write(html) + print('updated {}'.format(outfile)) + return + + + def print_technique_incidents(self): + for id_technique in self.techniques['id'].to_list(): + print('{}\n{}'.format(id_technique, + self.create_incidentstring(id_technique))) + return + + + def print_incident_techniques(self): + for id_incident in self.incidents['id'].to_list(): + print('{}\n{}'.format(id_incident, + self.create_techstring(id_incident))) + return + + + def generate_datafiles(self): + + self.generate_datasheets() + self.write_grid_markdown() + self.write_incidentlist_markdown() + self.write_grid_message_generator() + + return + + +def main(): + amitt = Amitt() + amitt.generate_datafiles() + + +if __name__ == "__main__": + main() diff --git a/HTML_GENERATING_CODE/counter.py b/HTML_GENERATING_CODE/counter.py new file mode 100644 index 0000000..608c7e0 --- /dev/null +++ b/HTML_GENERATING_CODE/counter.py @@ -0,0 +1,214 @@ +''' Manage AMITT counters + +Create a page for each of the AMITT counter objects. +Don't worry about creating notes etc for these - they'll be in the generating spreadsheet +''' + +import pandas as pd +import numpy as np +import os +from sklearn.feature_extraction.text import CountVectorizer + + +class Counter: + def __init__(self, infile = 'CountersPlaybook_MASTER.xlsx'): + + # Load metadata from counters excelfile + # FIXIT: Ungodly hack = please fix + xlsx = pd.ExcelFile(infile) + allamitts = xlsx.parse(['AMITT_objects']) + dfa = allamitts['AMITT_objects'] + self.dftactics = dfa[3:15].copy() + self.dfresponses = dfa[18:25].copy() + self.dfactors = dfa[28:36].copy() + self.dftechniques = dfa[39:100].copy() + + # Get counters data + self.dfcounters = pd.read_excel(infile, sheet_name='Countermeasures') + + # Create cross-tables + crossidtechs = self.splitcol(self.dfcounters[['ID', 'Techniques']], + 'Techniques', 'Techs', '\n') + crossidtechs = crossidtechs[crossidtechs['Techs'].notnull()] + crossidtechs['TID'] = crossidtechs['Techs'].str.split(' ').str[0] + crossidtechs.drop('Techs', axis=1, inplace=True) + self.idtechnique = crossidtechs + + crossidres = self.splitcol(self.dfcounters[['ID', 'Resources needed']], + 'Resources needed', 'Res', ',') + crossidres = crossidres[crossidres['Res'].notnull()] + self.idresource = crossidres + + + def analyse_counter_text(self, col='Title'): + # Analyse text in counter descriptions + alltext = (' ').join(self.dfcounters[col].to_list()).lower() + count_vect = CountVectorizer(stop_words='english') + word_counts = count_vect.fit_transform([alltext]) + dfw = pd.DataFrame(word_counts.A, columns=count_vect.get_feature_names()).transpose() + dfw.columns = ['count'] + dfw = dfw.sort_values(by='count', ascending=False) + return(dfw) + + + def splitcol(self, df, col, newcol, divider=','): + # Thanks https://stackoverflow.com/questions/17116814/pandas-how-do-i-split-text-in-a-column-into-multiple-rows?noredirect=1 + return (df.join(df[col] + .str.split(divider, expand=True).stack() + .reset_index(drop=True,level=1) + .rename(newcol)).drop(col, axis=1)) + + + # Print list of counters for each square of the COA matrix + # Write HTML version of framework diagram to markdown file + def write_tactics_markdown(self, outfile = '../tactic_counts.md'): + + coacounts = pd.pivot_table(self.dfcounters[['Tactic', 'Response', + 'ID']], index='Response', columns='Tactic', aggfunc=len, fill_value=0) + + html = '''# AMITT Courses of Action matrix: + + + + +''' + #Table heading = Tactic names + for col in coacounts.columns.get_level_values(1): + tid = self.create_tactic_file(col) + html += '\n'.format( + tid, col) + html += '\n' + + # number of counters per response type + for response, counts in coacounts.iterrows(): + html += '\n'.format(response) + for val in counts.values: + html += '\n'.format(val) + html += '\n\n' + + # Total per tactic + html += '\n' + for val in coacounts.sum().values: + html += '\n'.format(val) + html += '\n
{1}
{}{}
TOTALS{}
\n' + + with open(outfile, 'w') as f: + f.write(html) + print('updated {}'.format(outfile)) + return + + def create_tactic_file(self, tname): + if not os.path.exists('../tactics'): + os.makedirs('../tactics') + + tid = tname[:tname.find(' ')] + html = '''# Tactic {} counters\n\n'''.format(tname) + + html += '## by action\n\n' + for resp, counters in self.dfcounters[self.dfcounters['Tactic'] == tname].groupby('Response'): + html += '\n### {}\n'.format(resp) + + for c in counters.iterrows(): + html += '* {}: {} (needs {})\n'.format(c[1]['ID'], c[1]['Title'], + c[1]['Resources needed']) + + html += '\n## by technique\n\n' + tactecs = self.dftechniques[self.dftechniques['super'] == tid]['Id'].to_list() + for tech in [tid] + tactecs: + if tech == tid: + html += '\n### {}\n'.format(tech) + else: + techname = self.dftechniques[self.dftechniques['Id']==tech]['key'] + html += '\n### {}\n'.format(techname) + + taccounts = self.idtechnique[self.idtechnique['TID'] == tech] +# html += '\n{}\n'.format(taccounts) + for c in self.dfcounters[self.dfcounters['ID'].isin(taccounts['ID'])].iterrows(): + html += '* {}: {} (needs {})\n'.format(c[1]['ID'], c[1]['Title'], + c[1]['Resources needed']) + + datafile = '../tactics/{}counters.md'.format(tid) + print('Writing {}'.format(datafile)) + with open(datafile, 'w') as f: + f.write(html) + f.close() + return(tid) + + + def create_object_file(self, index, rowtype, datadir): + + oid = index + html = '''# {} counters: {}\n\n'''.format(rowtype, index) + + html += '## by action\n\n' + for resp, clist in self.dfcounters[self.dfcounters[rowtype] == index].groupby('Response'): + html += '\n### {}\n'.format(resp) + + for c in clist.iterrows(): + html += '* {}: {} (needs {})\n'.format(c[1]['ID'], c[1]['Title'], + c[1]['Resources needed']) + + datafile = '{}/{}counters.md'.format(datadir, oid) + print('Writing {}'.format(datafile)) + with open(datafile, 'w') as f: + f.write(html) + f.close() + return(oid) + + + def write_metacounts_markdown(self, outfile = '../metatag_counts.md'): + + coltype = 'Response' + rowtype = 'metatechnique' + rowname = 'metatag' + mtcounts = pd.pivot_table(self.dfcounters[[coltype, rowtype,'ID']], + index=rowtype, columns=coltype, aggfunc=len, + fill_value=0) + mtcounts['TOTALS'] = mtcounts.sum(axis=1) + + html = '''# AMITT {} courses of action + + + + + '''.format(rowtype) + + # Table heading row + for col in mtcounts.columns.get_level_values(1)[:-1]: + html += '\n'.format(col) + html += '\n' + + # Data rows + datadir = '../{}'.format(rowname) + if not os.path.exists(datadir): + os.makedirs(datadir) + for index, counts in mtcounts.iterrows(): + tid = self.create_object_file(index, rowtype, datadir) + html += '\n'.format( + rowname, tid, index) + for val in counts.values: + html += '\n'.format(val) + html += '\n\n' + + # Column sums + html += '\n' + for val in mtcounts.sum().values: + html += '\n'.format(val) + html += '\n
{}TOTALS
{2}{}
TOTALS{}
\n' + + with open(outfile, 'w') as f: + f.write(html) + print('updated {}'.format(outfile)) + + return + + + +def main(): + counter = Counter() + counter.write_tactics_markdown() + counter.write_metacounts_markdown() + + +if __name__ == "__main__": + main() diff --git a/HTML_GENERATING_CODE/template_incident.md b/HTML_GENERATING_CODE/template_incident.md new file mode 100644 index 0000000..42de7da --- /dev/null +++ b/HTML_GENERATING_CODE/template_incident.md @@ -0,0 +1,20 @@ +# {name} + +* Type: {type} + +* Name: {name} + +* Id: {id} + +* Summary: {summary} + +* Year started: {yearstarted} + +* From country / To country: {fromcountry} / {tocountry} + +* Found via: {foundvia} + +* Date added: {dateadded} + +* Techniques used: +{techniques} diff --git a/HTML_GENERATING_CODE/template_phase.md b/HTML_GENERATING_CODE/template_phase.md new file mode 100644 index 0000000..bee5aed --- /dev/null +++ b/HTML_GENERATING_CODE/template_phase.md @@ -0,0 +1,10 @@ +# {name} + +* Type: Phase + +* Name: {name} + +* Id: {id} + +* Summary: {summary} + diff --git a/HTML_GENERATING_CODE/template_tactic.md b/HTML_GENERATING_CODE/template_tactic.md new file mode 100644 index 0000000..40a20f9 --- /dev/null +++ b/HTML_GENERATING_CODE/template_tactic.md @@ -0,0 +1,17 @@ +# {name} + +* Type: Tactic + +* Name: {name} + +* Id: {id} + +* Summary: {summary} + +* Phase: {phase} + +* Tasks: +{tasks} + +* Techniques: +{techniques} diff --git a/HTML_GENERATING_CODE/template_task.md b/HTML_GENERATING_CODE/template_task.md new file mode 100644 index 0000000..5429b98 --- /dev/null +++ b/HTML_GENERATING_CODE/template_task.md @@ -0,0 +1,11 @@ +# {name} + +* Type: Task + +* Name: {name} + +* Id: {id} + +* Summary: {summary} + +* Tactic: {tactic} diff --git a/HTML_GENERATING_CODE/template_technique.md b/HTML_GENERATING_CODE/template_technique.md new file mode 100644 index 0000000..e596b6a --- /dev/null +++ b/HTML_GENERATING_CODE/template_technique.md @@ -0,0 +1,14 @@ +# {name} + +* Type: Technique + +* Name: {name} + +* Id: {id} + +* Summary: {summary} + +* Tactic: {tactic} + +* Incidents: +{incidents} diff --git a/LICENSE.md b/LICENSE.md new file mode 100644 index 0000000..33bec29 --- /dev/null +++ b/LICENSE.md @@ -0,0 +1,427 @@ +Attribution-ShareAlike 4.0 International + +======================================================================= + +Creative Commons Corporation ("Creative Commons") is not a law firm and +does not provide legal services or legal advice. Distribution of +Creative Commons public licenses does not create a lawyer-client or +other relationship. Creative Commons makes its licenses and related +information available on an "as-is" basis. Creative Commons gives no +warranties regarding its licenses, any material licensed under their +terms and conditions, or any related information. Creative Commons +disclaims all liability for damages resulting from their use to the +fullest extent possible. + +Using Creative Commons Public Licenses + +Creative Commons public licenses provide a standard set of terms and +conditions that creators and other rights holders may use to share +original works of authorship and other material subject to copyright +and certain other rights specified in the public license below. The +following considerations are for informational purposes only, are not +exhaustive, and do not form part of our licenses. + + Considerations for licensors: Our public licenses are + intended for use by those authorized to give the public + permission to use material in ways otherwise restricted by + copyright and certain other rights. Our licenses are + irrevocable. Licensors should read and understand the terms + and conditions of the license they choose before applying it. + Licensors should also secure all rights necessary before + applying our licenses so that the public can reuse the + material as expected. Licensors should clearly mark any + material not subject to the license. This includes other CC- + licensed material, or material used under an exception or + limitation to copyright. More considerations for licensors: + wiki.creativecommons.org/Considerations_for_licensors + + Considerations for the public: By using one of our public + licenses, a licensor grants the public permission to use the + licensed material under specified terms and conditions. If + the licensor's permission is not necessary for any reason--for + example, because of any applicable exception or limitation to + copyright--then that use is not regulated by the license. Our + licenses grant only permissions under copyright and certain + other rights that a licensor has authority to grant. Use of + the licensed material may still be restricted for other + reasons, including because others have copyright or other + rights in the material. A licensor may make special requests, + such as asking that all changes be marked or described. + Although not required by our licenses, you are encouraged to + respect those requests where reasonable. More_considerations + for the public: + wiki.creativecommons.org/Considerations_for_licensees + +======================================================================= + +Creative Commons Attribution-ShareAlike 4.0 International Public +License + +By exercising the Licensed Rights (defined below), You accept and agree +to be bound by the terms and conditions of this Creative Commons +Attribution-ShareAlike 4.0 International Public License ("Public +License"). To the extent this Public License may be interpreted as a +contract, You are granted the Licensed Rights in consideration of Your +acceptance of these terms and conditions, and the Licensor grants You +such rights in consideration of benefits the Licensor receives from +making the Licensed Material available under these terms and +conditions. + + +Section 1 -- Definitions. + + a. Adapted Material means material subject to Copyright and Similar + Rights that is derived from or based upon the Licensed Material + and in which the Licensed Material is translated, altered, + arranged, transformed, or otherwise modified in a manner requiring + permission under the Copyright and Similar Rights held by the + Licensor. For purposes of this Public License, where the Licensed + Material is a musical work, performance, or sound recording, + Adapted Material is always produced where the Licensed Material is + synched in timed relation with a moving image. + + b. Adapter's License means the license You apply to Your Copyright + and Similar Rights in Your contributions to Adapted Material in + accordance with the terms and conditions of this Public License. + + c. BY-SA Compatible License means a license listed at + creativecommons.org/compatiblelicenses, approved by Creative + Commons as essentially the equivalent of this Public License. + + d. Copyright and Similar Rights means copyright and/or similar rights + closely related to copyright including, without limitation, + performance, broadcast, sound recording, and Sui Generis Database + Rights, without regard to how the rights are labeled or + categorized. For purposes of this Public License, the rights + specified in Section 2(b)(1)-(2) are not Copyright and Similar + Rights. + + e. Effective Technological Measures means those measures that, in the + absence of proper authority, may not be circumvented under laws + fulfilling obligations under Article 11 of the WIPO Copyright + Treaty adopted on December 20, 1996, and/or similar international + agreements. + + f. Exceptions and Limitations means fair use, fair dealing, and/or + any other exception or limitation to Copyright and Similar Rights + that applies to Your use of the Licensed Material. + + g. License Elements means the license attributes listed in the name + of a Creative Commons Public License. The License Elements of this + Public License are Attribution and ShareAlike. + + h. Licensed Material means the artistic or literary work, database, + or other material to which the Licensor applied this Public + License. + + i. Licensed Rights means the rights granted to You subject to the + terms and conditions of this Public License, which are limited to + all Copyright and Similar Rights that apply to Your use of the + Licensed Material and that the Licensor has authority to license. + + j. Licensor means the individual(s) or entity(ies) granting rights + under this Public License. + + k. Share means to provide material to the public by any means or + process that requires permission under the Licensed Rights, such + as reproduction, public display, public performance, distribution, + dissemination, communication, or importation, and to make material + available to the public including in ways that members of the + public may access the material from a place and at a time + individually chosen by them. + + l. Sui Generis Database Rights means rights other than copyright + resulting from Directive 96/9/EC of the European Parliament and of + the Council of 11 March 1996 on the legal protection of databases, + as amended and/or succeeded, as well as other essentially + equivalent rights anywhere in the world. + + m. You means the individual or entity exercising the Licensed Rights + under this Public License. Your has a corresponding meaning. + + +Section 2 -- Scope. + + a. License grant. + + 1. Subject to the terms and conditions of this Public License, + the Licensor hereby grants You a worldwide, royalty-free, + non-sublicensable, non-exclusive, irrevocable license to + exercise the Licensed Rights in the Licensed Material to: + + a. reproduce and Share the Licensed Material, in whole or + in part; and + + b. produce, reproduce, and Share Adapted Material. + + 2. Exceptions and Limitations. For the avoidance of doubt, where + Exceptions and Limitations apply to Your use, this Public + License does not apply, and You do not need to comply with + its terms and conditions. + + 3. Term. The term of this Public License is specified in Section + 6(a). + + 4. Media and formats; technical modifications allowed. The + Licensor authorizes You to exercise the Licensed Rights in + all media and formats whether now known or hereafter created, + and to make technical modifications necessary to do so. The + Licensor waives and/or agrees not to assert any right or + authority to forbid You from making technical modifications + necessary to exercise the Licensed Rights, including + technical modifications necessary to circumvent Effective + Technological Measures. For purposes of this Public License, + simply making modifications authorized by this Section 2(a) + (4) never produces Adapted Material. + + 5. Downstream recipients. + + a. Offer from the Licensor -- Licensed Material. Every + recipient of the Licensed Material automatically + receives an offer from the Licensor to exercise the + Licensed Rights under the terms and conditions of this + Public License. + + b. Additional offer from the Licensor -- Adapted Material. + Every recipient of Adapted Material from You + automatically receives an offer from the Licensor to + exercise the Licensed Rights in the Adapted Material + under the conditions of the Adapter's License You apply. + + c. No downstream restrictions. You may not offer or impose + any additional or different terms or conditions on, or + apply any Effective Technological Measures to, the + Licensed Material if doing so restricts exercise of the + Licensed Rights by any recipient of the Licensed + Material. + + 6. No endorsement. Nothing in this Public License constitutes or + may be construed as permission to assert or imply that You + are, or that Your use of the Licensed Material is, connected + with, or sponsored, endorsed, or granted official status by, + the Licensor or others designated to receive attribution as + provided in Section 3(a)(1)(A)(i). + + b. Other rights. + + 1. Moral rights, such as the right of integrity, are not + licensed under this Public License, nor are publicity, + privacy, and/or other similar personality rights; however, to + the extent possible, the Licensor waives and/or agrees not to + assert any such rights held by the Licensor to the limited + extent necessary to allow You to exercise the Licensed + Rights, but not otherwise. + + 2. Patent and trademark rights are not licensed under this + Public License. + + 3. To the extent possible, the Licensor waives any right to + collect royalties from You for the exercise of the Licensed + Rights, whether directly or through a collecting society + under any voluntary or waivable statutory or compulsory + licensing scheme. In all other cases the Licensor expressly + reserves any right to collect such royalties. + + +Section 3 -- License Conditions. + +Your exercise of the Licensed Rights is expressly made subject to the +following conditions. + + a. Attribution. + + 1. If You Share the Licensed Material (including in modified + form), You must: + + a. retain the following if it is supplied by the Licensor + with the Licensed Material: + + i. identification of the creator(s) of the Licensed + Material and any others designated to receive + attribution, in any reasonable manner requested by + the Licensor (including by pseudonym if + designated); + + ii. a copyright notice; + + iii. a notice that refers to this Public License; + + iv. a notice that refers to the disclaimer of + warranties; + + v. a URI or hyperlink to the Licensed Material to the + extent reasonably practicable; + + b. indicate if You modified the Licensed Material and + retain an indication of any previous modifications; and + + c. indicate the Licensed Material is licensed under this + Public License, and include the text of, or the URI or + hyperlink to, this Public License. + + 2. You may satisfy the conditions in Section 3(a)(1) in any + reasonable manner based on the medium, means, and context in + which You Share the Licensed Material. For example, it may be + reasonable to satisfy the conditions by providing a URI or + hyperlink to a resource that includes the required + information. + + 3. If requested by the Licensor, You must remove any of the + information required by Section 3(a)(1)(A) to the extent + reasonably practicable. + + b. ShareAlike. + + In addition to the conditions in Section 3(a), if You Share + Adapted Material You produce, the following conditions also apply. + + 1. The Adapter's License You apply must be a Creative Commons + license with the same License Elements, this version or + later, or a BY-SA Compatible License. + + 2. You must include the text of, or the URI or hyperlink to, the + Adapter's License You apply. You may satisfy this condition + in any reasonable manner based on the medium, means, and + context in which You Share Adapted Material. + + 3. You may not offer or impose any additional or different terms + or conditions on, or apply any Effective Technological + Measures to, Adapted Material that restrict exercise of the + rights granted under the Adapter's License You apply. + + +Section 4 -- Sui Generis Database Rights. + +Where the Licensed Rights include Sui Generis Database Rights that +apply to Your use of the Licensed Material: + + a. for the avoidance of doubt, Section 2(a)(1) grants You the right + to extract, reuse, reproduce, and Share all or a substantial + portion of the contents of the database; + + b. if You include all or a substantial portion of the database + contents in a database in which You have Sui Generis Database + Rights, then the database in which You have Sui Generis Database + Rights (but not its individual contents) is Adapted Material, + + including for purposes of Section 3(b); and + c. You must comply with the conditions in Section 3(a) if You Share + all or a substantial portion of the contents of the database. + +For the avoidance of doubt, this Section 4 supplements and does not +replace Your obligations under this Public License where the Licensed +Rights include other Copyright and Similar Rights. + + +Section 5 -- Disclaimer of Warranties and Limitation of Liability. + + a. UNLESS OTHERWISE SEPARATELY UNDERTAKEN BY THE LICENSOR, TO THE + EXTENT POSSIBLE, THE LICENSOR OFFERS THE LICENSED MATERIAL AS-IS + AND AS-AVAILABLE, AND MAKES NO REPRESENTATIONS OR WARRANTIES OF + ANY KIND CONCERNING THE LICENSED MATERIAL, WHETHER EXPRESS, + IMPLIED, STATUTORY, OR OTHER. THIS INCLUDES, WITHOUT LIMITATION, + WARRANTIES OF TITLE, MERCHANTABILITY, FITNESS FOR A PARTICULAR + PURPOSE, NON-INFRINGEMENT, ABSENCE OF LATENT OR OTHER DEFECTS, + ACCURACY, OR THE PRESENCE OR ABSENCE OF ERRORS, WHETHER OR NOT + KNOWN OR DISCOVERABLE. WHERE DISCLAIMERS OF WARRANTIES ARE NOT + ALLOWED IN FULL OR IN PART, THIS DISCLAIMER MAY NOT APPLY TO YOU. + + b. TO THE EXTENT POSSIBLE, IN NO EVENT WILL THE LICENSOR BE LIABLE + TO YOU ON ANY LEGAL THEORY (INCLUDING, WITHOUT LIMITATION, + NEGLIGENCE) OR OTHERWISE FOR ANY DIRECT, SPECIAL, INDIRECT, + INCIDENTAL, CONSEQUENTIAL, PUNITIVE, EXEMPLARY, OR OTHER LOSSES, + COSTS, EXPENSES, OR DAMAGES ARISING OUT OF THIS PUBLIC LICENSE OR + USE OF THE LICENSED MATERIAL, EVEN IF THE LICENSOR HAS BEEN + ADVISED OF THE POSSIBILITY OF SUCH LOSSES, COSTS, EXPENSES, OR + DAMAGES. WHERE A LIMITATION OF LIABILITY IS NOT ALLOWED IN FULL OR + IN PART, THIS LIMITATION MAY NOT APPLY TO YOU. + + c. The disclaimer of warranties and limitation of liability provided + above shall be interpreted in a manner that, to the extent + possible, most closely approximates an absolute disclaimer and + waiver of all liability. + + +Section 6 -- Term and Termination. + + a. This Public License applies for the term of the Copyright and + Similar Rights licensed here. However, if You fail to comply with + this Public License, then Your rights under this Public License + terminate automatically. + + b. Where Your right to use the Licensed Material has terminated under + Section 6(a), it reinstates: + + 1. automatically as of the date the violation is cured, provided + it is cured within 30 days of Your discovery of the + violation; or + + 2. upon express reinstatement by the Licensor. + + For the avoidance of doubt, this Section 6(b) does not affect any + right the Licensor may have to seek remedies for Your violations + of this Public License. + + c. For the avoidance of doubt, the Licensor may also offer the + Licensed Material under separate terms or conditions or stop + distributing the Licensed Material at any time; however, doing so + will not terminate this Public License. + + d. Sections 1, 5, 6, 7, and 8 survive termination of this Public + License. + + +Section 7 -- Other Terms and Conditions. + + a. The Licensor shall not be bound by any additional or different + terms or conditions communicated by You unless expressly agreed. + + b. Any arrangements, understandings, or agreements regarding the + Licensed Material not stated herein are separate from and + independent of the terms and conditions of this Public License. + + +Section 8 -- Interpretation. + + a. For the avoidance of doubt, this Public License does not, and + shall not be interpreted to, reduce, limit, restrict, or impose + conditions on any use of the Licensed Material that could lawfully + be made without permission under this Public License. + + b. To the extent possible, if any provision of this Public License is + deemed unenforceable, it shall be automatically reformed to the + minimum extent necessary to make it enforceable. If the provision + cannot be reformed, it shall be severed from this Public License + without affecting the enforceability of the remaining terms and + conditions. + + c. No term or condition of this Public License will be waived and no + failure to comply consented to unless expressly agreed to by the + Licensor. + + d. Nothing in this Public License constitutes or may be interpreted + as a limitation upon, or waiver of, any privileges and immunities + that apply to the Licensor or You, including from the legal + processes of any jurisdiction or authority. + + +======================================================================= + +Creative Commons is not a party to its public +licenses. Notwithstanding, Creative Commons may elect to apply one of +its public licenses to material it publishes and in those instances +will be considered the “Licensor.” The text of the Creative Commons +public licenses is dedicated to the public domain under the CC0 Public +Domain Dedication. Except for the limited purpose of indicating that +material is shared under a Creative Commons public license or as +otherwise permitted by the Creative Commons policies published at +creativecommons.org/policies, Creative Commons does not authorize the +use of the trademark "Creative Commons" or any other trademark or logo +of Creative Commons without its prior written consent including, +without limitation, in connection with any unauthorized modifications +to any of its public licenses or any other arrangements, +understandings, or agreements concerning use of licensed material. For +the avoidance of doubt, this paragraph does not form part of the +public licenses. + +Creative Commons may be contacted at creativecommons.org. \ No newline at end of file diff --git a/README.md b/README.md new file mode 100644 index 0000000..6e8b87e --- /dev/null +++ b/README.md @@ -0,0 +1,53 @@ +# AMITT Disinformation Tactics, Techniques and Processes (TTP) Framework + +* [Framework diagram](matrix.md) +* [List of incidents](incidents.md) +* [Counters matrix](counter_tactic_counts.md) + +AMITT (Adversarial Misinformation and Influence Tactics and Techniques) is a framework designed for describing and understanding disinformation incidents. AMITT is part of work on adapting information security (infosec) practices to help track and counter misinformation, and is designed to fit existing infosec practices and tools. + +AMITT's style is based on the [MITRE ATT&CK framework](https://github.com/mitre-attack/attack-website/); STIX templates for AMITT objects are available in the [AMITT_CTI repo](https://github.com/cogsec-collaborative/amitt_cti] - these make it easy for AMITT data to be passed between ISAOs and similar bodies using standards like TAXI. + +AMITT design documents are available in the AMITT_HISTORY folder, and in [The AMITT Design Guide](https://docs.google.com/document/d/1D1VM5l496pUjN8B5Pq6fAh9mgeeEaYTKHdAG5BEXBiA/edit#). + +## RAW DATA + +If you want to do your own thing with AMITT data, all the master data for it is in directory [AMITT_MASTER_DATA}(AMITT_MASTER_DATA). Look for [the TTP framework](AMITT_MASTER_DATA/amitt_metadata_v3.xlsx) and [countermeasures](AMITT_MASTER_DATA/CountersPlaybook_MASTER.xlsx) spreadsheets. + +## Red Team Tactics (TTP Framework) HTML pages + +The disinformation creating framework is shown in [Framework diagram](matrix.md). Its entities are: +* Tactics: stages that someone running a misinformation incident is likely to use +* Techniques: activities that might be seen at each stage +* Tasks: things that need to be done at each stage. In Pablospeak, tasks are things you do, techniques are how you do them. +* Phases: higher-level groupings of tactics, created so we could check we didn't miss anything + +There's a directory for each of these entities, containing a datasheet for each individual entity (e.g. [technique T0046 Search Engine Optimization](techniques/T0046.md)). The details above "DO NOT EDIT ABOVE THIS LINE" are generated from the code and spreadsheet in folder generating_code, which you can use to update framework metadata; you can add notes below "DO NOT EDIT ABOVE THIS LINE" and they won't be removed when you do metadata updates. (Yes, this is an unholy hack, but it's one that lets us generate all the messages we need, and keep notes in the same place.) + +The framework was created by finding and analysing a set of existing misinformation [incidents](incidents.md), which also have room for more notes. + +## Blue Team Tactics (Countermeasures) HTML pages + +What you'll see in here is a [spreadsheet](GENERATING_CODE/CountersPlaybook_MASTER.xlsx). In there are defences and mitigations for disinformation, categorised by disinformation technique, the resources needed for it etc. There's also . So far, we have: + +* lists by tactic stage and technique (see https://github.com/misinfosecproject/amitt_framework for descriptions of these) in directory [tactics](tactics), with a clickable grid for this in [counter_tactic_counts.md](counter_tactic_counts.md) +* lists by a higher-level label, "metatechnique",in directory [counter_metatag](counter_metatag), with a clickable grid for this in [counter_metatag_counts.md](counter_metatag_counts.md) (To be fair this is mostly so we can group and make sure we're getting the cleaning right.) +* - lists of what each type of person can do in [counter_resource_counts.md](counter_resource_counts.md). + +## Updating the HTML pages + +The code to create all the HTML datasheets is in directory [HTML_GENERATING_CODE](HTML_GENERATING_CODE) + +* If you change something in the metadata file, go into generating_code, and type "python amitt.py" - this will update the metadata in all the datasheets, and create a datasheet each for any new objects you've added to the spreadsheet. +* If you change anything in the countermeasures spreadsheet, typing "python counter.py" creates all html pages for countermeasures. + +## Provenance + +The AMITT Framework and Countermeasures were created by the Credibility Coalition's [Misinfosec working group](https://github.com/credcoalition/community-site/wiki/Working-Groups). The Framework was started in December 2018 and refined in a Credibility Coalition Misinfosec seminar; the collection of potential disinformation countermeasures was started at a Credibility Coalition Misinfosec seminar in November 2019. + +AMITT is currently maintained by the [CogSecCollab](http://cogsec-collab.org/), who've used it in the CTI League's Covid19 responses, and tested it in trials with NATO, the EU, and several other countries' disinformation units. + +We would like to thank everyone who's contributed to, and continues to contribute to AMITT over the years. We'd also love any and all suggestions for improvements, comments and offers of help - either reach out to us, or add to this repo's issues list. + + +AMITT is licensed under [CC-BY-4.0](LICENSE.md) \ No newline at end of file diff --git a/counter_metatag/cleaningcounters.md b/counter_metatag/cleaningcounters.md new file mode 100644 index 0000000..fdcb891 --- /dev/null +++ b/counter_metatag/cleaningcounters.md @@ -0,0 +1,14 @@ +# metatechnique counters: cleaning + +## by action + + +### D2 Deny +* C00074: Identify identical content and mass deplatform (needs platform_admin,platform_admin:socialmedia) +* C00016: Social media as a privilege not right (needs nan) + +### D3 Disrupt +* C00043: Detect hijacked accounts and reallocate them (needs platform_admin,activists,civil_society,money) + +### D4 Degrade +* C00053: Delete old accounts / Remove unused social media accounts (needs platform_admin,platform_admin:socialmedia,public:account_owners) diff --git a/counter_metatag/countermessagingcounters.md b/counter_metatag/countermessagingcounters.md new file mode 100644 index 0000000..32c9153 --- /dev/null +++ b/counter_metatag/countermessagingcounters.md @@ -0,0 +1,31 @@ +# metatechnique counters: countermessaging + +## by action + + +### D2 Deny +* C00075: normalise language (needs nan) +* C00157: Build alternative news sources (needs nan) +* C00167: Deploy Information and Narrative-Building in Service of Statecraft (needs nan) + +### D3 Disrupt +* C00082: Ground truthing as automated response to pollution (needs nan) +* C00136: Microtarget most likely targets then send them countermessages (needs nan) +* C00169: develop a creative content hub (needs nan) +* C00211: Use humorous counter-narratives (needs nan) +* C00017: Media campaign promoting in-group to out-group in person communication / activities (needs media) +* C00042: Address truth contained in narratives (needs nan) +* C00156: Better tell the U.S., NATO, and EU story. (needs government,military) +* C00200: Respected figure (influencer) disavows misinfo (needs influencers) + +### D4 Degrade +* C00026: Shore up democracy based messages (peace, freedom) - make it sexy (needs nan) +* C00025: Promote identity neutral narratives (needs nan) +* C00117: Downgrade de-amplify label promote counter to disinformation (needs nan) +* C00118: Repurpose images with new text (needs nan) + +### D6 Destroy +* C00062: Free open library sources worldwide (needs nan) + +### D7 Deter +* C00119: Engage payload and debunk. Provide link to facts. (needs nan) diff --git a/counter_metatag/data pollutioncounters.md b/counter_metatag/data pollutioncounters.md new file mode 100644 index 0000000..ab797d1 --- /dev/null +++ b/counter_metatag/data pollutioncounters.md @@ -0,0 +1,16 @@ +# metatechnique counters: data pollution + +## by action + + +### D3 Disrupt +* C00137: Pollute the AB-testing data feeds (needs nan) + +### D4 Degrade +* C00140: "Bomb" link shorteners with lots of calls (needs nan) +* C00145: Pollute the data voids with wholesome content (Kittens! Babyshark!) (needs nan) +* C00148: Add random links to network graphs (needs platform_algorithms) +* C00149: Poison the monitoring & evaluation data (needs nan) + +### D5 Deceive +* C00047: Coordinated inauthentics (needs nan) diff --git a/counter_metatag/daylightcounters.md b/counter_metatag/daylightcounters.md new file mode 100644 index 0000000..22488ff --- /dev/null +++ b/counter_metatag/daylightcounters.md @@ -0,0 +1,33 @@ +# metatechnique counters: daylight + +## by action + + +### D2 Deny +* C00113: Debunk and defuse a fake expert / credentials. Attack audience quality of fake expert (needs nan) +* C00115: Expose actor and intentions (needs nan) +* C00116: Provide proof of involvement (needs nan) +* C00150: “calling them out” (needs nan) +* C00152: “name and shame” (needs nan) +* C00217: Registries alert when large batches of newsy URLs get registered together (needs platform_admin) + +### D3 Disrupt +* C00018: Promote constructive communication by shaming division-enablers (needs nan) +* C00019: Promote playbooks to call out division-enablers (needs nan) +* C00068: Expose online funding as fake (needs nan) +* C00069: Mark clickbait visually (needs nan) +* C00081: Discredit by pointing out the "noise" and informing public that "flooding" is a technique of disinformation campaigns; point out intended objective of "noise" (needs nan) +* C00126: Social media amber alert (needs nan) +* C00151: “fight in the light” (needs nan) +* C00219: Add metadata to content - out of the control of the adversary (needs nan) + +### D4 Degrade +* C00184: Media exposure (needs nan) +* C00085: Demuting content (needs nan) + +### D6 Destroy +* C00189: Ongoing analysis/monitoring of "flagged" profiles (needs nan) + +### D7 Deter +* C00048: Name and Shame (needs nan) +* C00094: Force full disclosure on corporate sponsor of research (needs nan) diff --git a/counter_metatag/dilutioncounters.md b/counter_metatag/dilutioncounters.md new file mode 100644 index 0000000..b88399e --- /dev/null +++ b/counter_metatag/dilutioncounters.md @@ -0,0 +1,14 @@ +# metatechnique counters: dilution + +## by action + + +### D3 Disrupt +* C00031: Dilute the core narrative - create multiple permutations, target / amplify (needs nan) +* C00066: Co-opt a hashtag and drown it out (hijack it back) (needs nan) +* C00105: Buy more advertising than the adversary to shift influence and algorithms (needs money,adtech) +* C00128: Create friction by marking content with ridicule or other "decelerants" (needs influencers:trusted_authority) +* C00178: Fill information voids with non-disinformation content (needs nan) + +### D4 Degrade +* C00087: Make more noise (needs nan) diff --git a/counter_metatag/diversioncounters.md b/counter_metatag/diversioncounters.md new file mode 100644 index 0000000..141eff6 --- /dev/null +++ b/counter_metatag/diversioncounters.md @@ -0,0 +1,29 @@ +# metatechnique counters: diversion + +## by action + + +### D2 Deny +* C00195: Redirect Method (needs nan) +* C00202: Set data 'honeytraps' (needs nan) + +### D3 Disrupt +* C00029: Create fake website to issue counter narrative and counter narrative through physical merchandise (needs nan) +* C00030: Develop a compelling counter narrative (truth based) (needs nan) +* C00032: Hijack content and link to truth- based info (platform) (needs nan) +* C00078: Change Search Algorithms for Disinformation Content. More specifically, change image search algorithms for hate groups and extremists (needs nan) +* C00079: Change search algorithms for hate and extremist queries to show content sympathetic to opposite side (needs nan) +* C00080: Create competing narrative (needs nan) +* C00084: Steal their truths (needs nan) +* C00100: Hashtag jacking (needs nan) +* C00106: Click-bait centrist content (needs nan) +* C00194: Provide an alternative to Russian information by expanding and improving local content. (needs nan) + +### D4 Degrade +* C00088: Poison pill recasting of message (needs nan) +* C00086: Distract from noise with addictive content (needs nan) + +### D5 Deceive +* C00090: Fake engagement system (needs nan) +* C00091: Honeypot social community (needs nan) +* C00103: Create a bot that engages / distract trolls (needs developers) diff --git a/counter_metatag/frictioncounters.md b/counter_metatag/frictioncounters.md new file mode 100644 index 0000000..9428a18 --- /dev/null +++ b/counter_metatag/frictioncounters.md @@ -0,0 +1,36 @@ +# metatechnique counters: friction + +## by action + + +### D2 Deny +* C00006: Charge for social media (needs platform_admin:socialmedia) +* C00034: Create more friction at account creation (needs nan) +* C00035: Friction (needs nan) +* C00056: Get off social media (needs nan) +* C00097: Require use of verified identities to contribute to poll or comment (needs platform_algorithms) +* C00098: Revocation of "verified" (needs platform_admin) +* C00099: Strengthen verification methods (needs platform_algorithms) +* C00010: Enhanced privacy regulation for social media (needs government:policymakers) +* C00110: Monetize centrist SEO by subsidizing the difference in greater clicks towards extremist content (needs funding) +* C00112: "Prove they are not an op!" (needs nan) +* C00114: Don't engage with payloads (needs public) +* C00122: Content moderation. Censorship? (needs platform_admin) +* C00165: Limit access to alterable documents (needs nan) + +### D3 Disrupt +* C00044: Keep people from posting to social media immediately (needs platform_algorithms) +* C00147: Make amplification of social media ports expire (e.g. can't like/ retweet after n days) (needs platform_algorithms) +* C00045: S4d detection and re-allocation approaches (needs nan) +* C00123: Bot control (needs nan) +* C00124: Don't feed the trolls (needs public,media) +* C00139: Weaponise youtube content matrices (needs nan) +* C00203: Stop offering press credentials to propaganda outlets (needs government) + +### D4 Degrade +* C00089: Throttle number of forwards (needs nan) +* C00101: Create participant friction (needs platform_algorithms) +* C00102: Make repeat voting harder (needs platform_admin) +* C00141: "Hey this story is old" popup when messaging with old URL (needs platform_algorithms) +* C00142: "This has been disproved - do you want to forward it" (needs platform_algorithms) +* C00020: Deligitimise the 24 hour news cycle (needs media) diff --git a/counter_metatag/metatechniquecounters.md b/counter_metatag/metatechniquecounters.md new file mode 100644 index 0000000..107688c --- /dev/null +++ b/counter_metatag/metatechniquecounters.md @@ -0,0 +1,28 @@ +# metatechnique counters: metatechnique + +## by action + + +### ALL +* C00001: Better models of info spread up the layers (needs nan) +* C00003: How can we safeguard against extremists using the tools that we will produce? (needs nan) +* C00004: Managing like a chronic disease (needs nan) +* C00005: Policy: makers, terminology, elements: a) broad, b) specific (needs nan) + +### D2 Deny +* C00012: Platform regulation (needs government:policymakers) +* C00055: Empower existing regulators to govern social media (needs government:policymakers,government,platform_admin) +* C00174: Free and Fair Press (needs nan) + +### D3 Disrupt +* C00170: elevate information as a critical domain of statecraft (needs nan) +* C00159: Campaign mindset and associated toolbox (needs nan) +* C00196: Include the role of social media in the regulatory framework for media (needs government) +* C00205: strong dialogue between the federal government and private sector to encourage better reporting (needs companies,government) +* C00214: Create policy that makes social media police disinformation (needs government:policymakers) +* C00215: Use fraud legislation to clean up social media (needs government:policymakers) + +### D7 Deter +* C00120: Open dialogue about design of platforms to produce different outcomes (needs nan) +* C00161: Coalition Building and Third-Party Inducements: (needs nan) +* C00176: Improve Coordination with and feedback from the U.S. private sector (needs nan) diff --git a/counter_metatag/reduce resourcescounters.md b/counter_metatag/reduce resourcescounters.md new file mode 100644 index 0000000..e92e7cd --- /dev/null +++ b/counter_metatag/reduce resourcescounters.md @@ -0,0 +1,14 @@ +# metatechnique counters: reduce resources + +## by action + + +### D2 Deny +* C00129: Use banking to cut off access (needs nan) +* C00216: Use advertiser controls to stem flow of funds to bad actors (needs platform_admin:adtech) + +### D3 Disrupt +* C00138: Spam domestic actors with lawsuits (needs nan) + +### D4 Degrade +* C00144: Buy out troll farm employees / offer them jobs (needs nan) diff --git a/counter_metatag/removalcounters.md b/counter_metatag/removalcounters.md new file mode 100644 index 0000000..a84f69e --- /dev/null +++ b/counter_metatag/removalcounters.md @@ -0,0 +1,27 @@ +# metatechnique counters: removal + +## by action + + +### D2 Deny +* C00039: Standard reporting for false profiles (needs nan) +* C00070: Block access to platform. DDOS an attacker. (needs nan) +* C00071: Block source of pollution (needs nan) +* C00072: Content censorship in non-relevant domains e.g. Pinterest antivax (needs nan) +* C00131: Seize and analyse botnet servers (needs server_admin) +* C00154: Ask media not to report false information (needs media) +* C00155: Ban incident actors from funding sites (needs platform_admin:fundingsites) +* C00171: social media content take-downs (needs platform_admin:socialmedia) +* C00172: social media page removal (needs platform_admin:socialmedia) +* C00197: remove suspicious facebook accounts (needs nan) +* C00058: Report crowdfunder as violator (needs nan) +* C00063: Ban political microtargeting (needs government:policymakers) +* C00076: Prohibit images in political discourse channels (needs nan) +* C00182: malware detection/quarantine/deletion (needs infosec) +* C00218: Censorship (needs platform_admin) + +### D3 Disrupt +* C00133: Deplatform Account* (needs platform_admin) +* C00135: Deplatform message groups and/or message boards (needs platform_admin) +* C00065: Ban political ads (needs government:policymakers) +* C00179: Identify, monitor, and, if necessary, target Russia-based nonattributed social media accounts (needs nan) diff --git a/counter_metatag/resiliencecounters.md b/counter_metatag/resiliencecounters.md new file mode 100644 index 0000000..2c250bd --- /dev/null +++ b/counter_metatag/resiliencecounters.md @@ -0,0 +1,40 @@ +# metatechnique counters: resilience + +## by action + + +### D2 Deny +* C00009: Educate high profile influencers on best practices (needs influencers,educators) +* C00011: Media literacy. Games to identify fake news (needs educators,gamesdesigners,developers) +* C00033: Build cultural resistance to false content (needs nan) +* C00049: Influence literacy training (needs educators) +* C00050: Anti-elicitation training (needs educators) +* C00051: Phishing prevention education etc (needs educators) +* C00073: Educate on how to handle info pollution. Push out targeted education on why it's pollution (needs educators) +* C00204: Strengthen local media (needs media) +* C00160: find and train influencers (needs data_scientist,influencers) +* C00210: Use encrypted apps for confidential communication (needs nan) + +### D3 Disrupt +* C00061: Innoculating at language (needs nan) +* C00125: Prepare the population with pre-announcements (needs nan) +* C00188: Newsroom/Journalist training to counter SEO influence (needs media,educators) +* C00190: open engagement with civil society (needs public) +* C00193: promotion of a “higher standard of journalism” (needs media,educators) +* C00212: build public resilence by making civil society more vibrant (needs educators,government) +* C00109: De-escalation (needs nan) + +### D4 Degrade +* C00022: Innoculate. Positive campaign to promote feeling of safety - to counter ability and fear based attacks (needs nan) +* C00023: Promote civility as an identity that people will defend (needs nan) +* C00024: Promote constructive narratives i.e. not polarising. Pro-life, pro-choice, or pro-USA? (needs nan) +* C00054: Media literacy training. (needs educators,libraries,schools,DHS,NGO,platform_outreach,media,community_groups,religious_organisations) +* C00158: Use training to build the resilience of at-risk populations. (needs educators,media) +* C00021: Encourage in-person communication (needs nan) +* C00111: Present sympathetic views of opposite side (needs media,content_creators) + +### D7 Deter +* C00130: Mentorship: elders, youth, credit. Learn vicariously. (needs nan) +* C00027: Create culture of civility (needs nan) +* C00093: Establish tailored code of conduct for individuals with many followers (needs nan) +* C00121: Tool transparency and literacy for channels people follow. (needs nan) diff --git a/counter_metatag/scoringcounters.md b/counter_metatag/scoringcounters.md new file mode 100644 index 0000000..53c5372 --- /dev/null +++ b/counter_metatag/scoringcounters.md @@ -0,0 +1,18 @@ +# metatechnique counters: scoring + +## by action + + +### D2 Deny +* C00007: Create framework for BetterBusinessBureau (BBB) for news media (needs nan) +* C00008: Create shared fact-checking database (needs factcheckers) +* C00013: Rating framework for news - full transcripts, link source, add items, BBB for news (needs nan) +* C00014: Real-time updates to fact-checking database (needs factcheckers) +* C00015: Reputation scores for social media users (needs data_scientist,datastreams) +* C00057: Privacy standards (needs nan) +* C00107: Content moderation (needs nan) + +### D7 Deter +* C00092: Establish a truth teller reputation score for individuals with many followers (needs nan) +* C00095: Keep score (needs nan) +* C00096: Strengthen institutions that are always truth tellers (needs nan) diff --git a/counter_metatag/targetingcounters.md b/counter_metatag/targetingcounters.md new file mode 100644 index 0000000..e69d901 --- /dev/null +++ b/counter_metatag/targetingcounters.md @@ -0,0 +1,23 @@ +# metatechnique counters: targeting + +## by action + + +### D2 Deny +* C00036: Infiltrate the in-group to discredit leaders (divide) (needs nan) + +### D3 Disrupt +* C00060: Enhanced legal enforcement against for-profit follower/engagement factories (needs government:policymakers) +* C00067: Denigrate the recipient/ project (of online funding) (needs nan) +* C00077: Active defence: replay "develop people" (needs nan) +* C00153: Use offensive cyber action (needs infosec) +* C00162: collect data/map constellations of Russian“civil society”. Unravel/target the Potemkin villages (needs nan) +* C00164: compatriot policy (needs nan) + +### D4 Degrade +* C00046: Marginalise and discredit extremist (needs nan) +* C00052: Infiltrate platforms (needs activists) +* C00143: (botnet) DMCA takedown requests to waste group time (needs public,elves) + +### D7 Deter +* C00207: tit-for-tat campaign (needs government,platforms) diff --git a/counter_metatag/verificationcounters.md b/counter_metatag/verificationcounters.md new file mode 100644 index 0000000..d020c44 --- /dev/null +++ b/counter_metatag/verificationcounters.md @@ -0,0 +1,11 @@ +# metatechnique counters: verification + +## by action + + +### D2 Deny +* C00040: third party verification for people (needs nan) +* C00059: Verification of project before posting (counters funding campaigns) (needs nan) + +### D3 Disrupt +* C00028: Blockchain audit log and validation with collaborative decryption to post comments (needs nan) diff --git a/counter_metatag_counts.md b/counter_metatag_counts.md new file mode 100644 index 0000000..51c56d7 --- /dev/null +++ b/counter_metatag_counts.md @@ -0,0 +1,178 @@ +# AMITT metatechnique courses of action + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +
ALLD2 DenyD3 DisruptD4 DegradeD5 DeceiveD6 DestroyD7 DeterTOTALS
cleaning02110004
countermessaging038401117
data pollution00141006
daylight068201219
dilution00510006
diversion0210230017
friction0137600026
metatechnique436000316
reduce resources02110004
removal0154000019
resilience0107700428
scoring070000310
targeting016300111
verification02100003
TOTALS46665314214186
diff --git a/counter_resource/DHScounters.md b/counter_resource/DHScounters.md new file mode 100644 index 0000000..0e49723 --- /dev/null +++ b/counter_resource/DHScounters.md @@ -0,0 +1,7 @@ +# resource counters: DHS + +## by action + + +### D4 Degrade +* C00054: Media literacy training. (needs educators,libraries,schools,DHS,NGO,platform_outreach,media,community_groups,religious_organisations) diff --git a/counter_resource/NGOcounters.md b/counter_resource/NGOcounters.md new file mode 100644 index 0000000..d47c09d --- /dev/null +++ b/counter_resource/NGOcounters.md @@ -0,0 +1,7 @@ +# resource counters: NGO + +## by action + + +### D4 Degrade +* C00054: Media literacy training. (needs educators,libraries,schools,DHS,NGO,platform_outreach,media,community_groups,religious_organisations) diff --git a/counter_resource/activistscounters.md b/counter_resource/activistscounters.md new file mode 100644 index 0000000..58f27d3 --- /dev/null +++ b/counter_resource/activistscounters.md @@ -0,0 +1,10 @@ +# resource counters: activists + +## by action + + +### D3 Disrupt +* C00043: Detect hijacked accounts and reallocate them (needs platform_admin,activists,civil_society,money) + +### D4 Degrade +* C00052: Infiltrate platforms (needs activists) diff --git a/counter_resource/adtechcounters.md b/counter_resource/adtechcounters.md new file mode 100644 index 0000000..11d4750 --- /dev/null +++ b/counter_resource/adtechcounters.md @@ -0,0 +1,7 @@ +# resource counters: adtech + +## by action + + +### D3 Disrupt +* C00105: Buy more advertising than the adversary to shift influence and algorithms (needs money,adtech) diff --git a/counter_resource/civil_societycounters.md b/counter_resource/civil_societycounters.md new file mode 100644 index 0000000..39716bf --- /dev/null +++ b/counter_resource/civil_societycounters.md @@ -0,0 +1,7 @@ +# resource counters: civil_society + +## by action + + +### D3 Disrupt +* C00043: Detect hijacked accounts and reallocate them (needs platform_admin,activists,civil_society,money) diff --git a/counter_resource/community_groupscounters.md b/counter_resource/community_groupscounters.md new file mode 100644 index 0000000..d6b46e6 --- /dev/null +++ b/counter_resource/community_groupscounters.md @@ -0,0 +1,7 @@ +# resource counters: community_groups + +## by action + + +### D4 Degrade +* C00054: Media literacy training. (needs educators,libraries,schools,DHS,NGO,platform_outreach,media,community_groups,religious_organisations) diff --git a/counter_resource/companiescounters.md b/counter_resource/companiescounters.md new file mode 100644 index 0000000..839644b --- /dev/null +++ b/counter_resource/companiescounters.md @@ -0,0 +1,7 @@ +# resource counters: companies + +## by action + + +### D3 Disrupt +* C00205: strong dialogue between the federal government and private sector to encourage better reporting (needs companies,government) diff --git a/counter_resource/content_creatorscounters.md b/counter_resource/content_creatorscounters.md new file mode 100644 index 0000000..3ef7101 --- /dev/null +++ b/counter_resource/content_creatorscounters.md @@ -0,0 +1,7 @@ +# resource counters: content_creators + +## by action + + +### D4 Degrade +* C00111: Present sympathetic views of opposite side (needs media,content_creators) diff --git a/counter_resource/data scientistcounters.md b/counter_resource/data scientistcounters.md new file mode 100644 index 0000000..3b3ee8d --- /dev/null +++ b/counter_resource/data scientistcounters.md @@ -0,0 +1,7 @@ +# resource counters: data scientist + +## by action + + +### D2 Deny +* C00160: find and train influencers (needs data scientist,influencers) diff --git a/counter_resource/data_scientistcounters.md b/counter_resource/data_scientistcounters.md new file mode 100644 index 0000000..1ce117e --- /dev/null +++ b/counter_resource/data_scientistcounters.md @@ -0,0 +1,8 @@ +# resource counters: data_scientist + +## by action + + +### D2 Deny +* C00015: Reputation scores for social media users (needs data_scientist,datastreams) +* C00160: find and train influencers (needs data_scientist,influencers) diff --git a/counter_resource/datastreamscounters.md b/counter_resource/datastreamscounters.md new file mode 100644 index 0000000..0018a53 --- /dev/null +++ b/counter_resource/datastreamscounters.md @@ -0,0 +1,7 @@ +# resource counters: datastreams + +## by action + + +### D2 Deny +* C00015: Reputation scores for social media users (needs data_scientist,datastreams) diff --git a/counter_resource/developerscounters.md b/counter_resource/developerscounters.md new file mode 100644 index 0000000..da92a1f --- /dev/null +++ b/counter_resource/developerscounters.md @@ -0,0 +1,10 @@ +# resource counters: developers + +## by action + + +### D2 Deny +* C00011: Media literacy. Games to identify fake news (needs educators,gamesdesigners,developers) + +### D5 Deceive +* C00103: Create a bot that engages / distract trolls (needs developers) diff --git a/counter_resource/educatorscounters.md b/counter_resource/educatorscounters.md new file mode 100644 index 0000000..dd1099a --- /dev/null +++ b/counter_resource/educatorscounters.md @@ -0,0 +1,21 @@ +# resource counters: educators + +## by action + + +### D2 Deny +* C00009: Educate high profile influencers on best practices (needs influencers,educators) +* C00011: Media literacy. Games to identify fake news (needs educators,gamesdesigners,developers) +* C00049: Influence literacy training (needs educators) +* C00050: Anti-elicitation training (needs educators) +* C00051: Phishing prevention education etc (needs educators) +* C00073: Educate on how to handle info pollution. Push out targeted education on why it's pollution (needs educators) + +### D3 Disrupt +* C00188: Newsroom/Journalist training to counter SEO influence (needs media,educators) +* C00193: promotion of a “higher standard of journalism” (needs media,educators) +* C00212: build public resilence by making civil society more vibrant (needs educators,government) + +### D4 Degrade +* C00054: Media literacy training. (needs educators,libraries,schools,DHS,NGO,platform_outreach,media,community_groups,religious_organisations) +* C00158: Use training to build the resilience of at-risk populations. (needs educators,media) diff --git a/counter_resource/elvescounters.md b/counter_resource/elvescounters.md new file mode 100644 index 0000000..da95132 --- /dev/null +++ b/counter_resource/elvescounters.md @@ -0,0 +1,7 @@ +# resource counters: elves + +## by action + + +### D4 Degrade +* C00143: (botnet) DMCA takedown requests to waste group time (needs public,elves) diff --git a/counter_resource/factcheckerscounters.md b/counter_resource/factcheckerscounters.md new file mode 100644 index 0000000..4f56076 --- /dev/null +++ b/counter_resource/factcheckerscounters.md @@ -0,0 +1,8 @@ +# resource counters: factcheckers + +## by action + + +### D2 Deny +* C00008: Create shared fact-checking database (needs factcheckers) +* C00014: Real-time updates to fact-checking database (needs factcheckers) diff --git a/counter_resource/fundingcounters.md b/counter_resource/fundingcounters.md new file mode 100644 index 0000000..b87daca --- /dev/null +++ b/counter_resource/fundingcounters.md @@ -0,0 +1,7 @@ +# resource counters: funding + +## by action + + +### D2 Deny +* C00110: Monetize centrist SEO by subsidizing the difference in greater clicks towards extremist content (needs funding) diff --git a/counter_resource/gamesdesignerscounters.md b/counter_resource/gamesdesignerscounters.md new file mode 100644 index 0000000..0dd776a --- /dev/null +++ b/counter_resource/gamesdesignerscounters.md @@ -0,0 +1,7 @@ +# resource counters: gamesdesigners + +## by action + + +### D2 Deny +* C00011: Media literacy. Games to identify fake news (needs educators,gamesdesigners,developers) diff --git a/counter_resource/government:policymakerscounters.md b/counter_resource/government:policymakerscounters.md new file mode 100644 index 0000000..a36fbb4 --- /dev/null +++ b/counter_resource/government:policymakerscounters.md @@ -0,0 +1,16 @@ +# resource counters: government:policymakers + +## by action + + +### D2 Deny +* C00012: Platform regulation (needs government:policymakers) +* C00055: Empower existing regulators to govern social media (needs government:policymakers,government,platform_admin) +* C00010: Enhanced privacy regulation for social media (needs government:policymakers) +* C00063: Ban political microtargeting (needs government:policymakers) + +### D3 Disrupt +* C00060: Enhanced legal enforcement against for-profit follower/engagement factories (needs government:policymakers) +* C00065: Ban political ads (needs government:policymakers) +* C00214: Create policy that makes social media police disinformation (needs government:policymakers) +* C00215: Use fraud legislation to clean up social media (needs government:policymakers) diff --git a/counter_resource/governmentcounters.md b/counter_resource/governmentcounters.md new file mode 100644 index 0000000..f6ef5e0 --- /dev/null +++ b/counter_resource/governmentcounters.md @@ -0,0 +1,17 @@ +# resource counters: government + +## by action + + +### D2 Deny +* C00055: Empower existing regulators to govern social media (needs government:policymakers,government,platform_admin) + +### D3 Disrupt +* C00212: build public resilence by making civil society more vibrant (needs educators,government) +* C00156: Better tell the U.S., NATO, and EU story. (needs government,military) +* C00196: Include the role of social media in the regulatory framework for media (needs government) +* C00203: Stop offering press credentials to propaganda outlets (needs government) +* C00205: strong dialogue between the federal government and private sector to encourage better reporting (needs companies,government) + +### D7 Deter +* C00207: tit-for-tat campaign (needs government,platforms) diff --git a/counter_resource/influencers:trusted_authoritycounters.md b/counter_resource/influencers:trusted_authoritycounters.md new file mode 100644 index 0000000..df9dcf1 --- /dev/null +++ b/counter_resource/influencers:trusted_authoritycounters.md @@ -0,0 +1,7 @@ +# resource counters: influencers:trusted_authority + +## by action + + +### D3 Disrupt +* C00128: Create friction by marking content with ridicule or other "decelerants" (needs influencers:trusted_authority) diff --git a/counter_resource/influencerscounters.md b/counter_resource/influencerscounters.md new file mode 100644 index 0000000..a2ff92c --- /dev/null +++ b/counter_resource/influencerscounters.md @@ -0,0 +1,11 @@ +# resource counters: influencers + +## by action + + +### D2 Deny +* C00009: Educate high profile influencers on best practices (needs influencers,educators) +* C00160: find and train influencers (needs data_scientist,influencers) + +### D3 Disrupt +* C00200: Respected figure (influencer) disavows misinfo (needs influencers) diff --git a/counter_resource/infoseccounters.md b/counter_resource/infoseccounters.md new file mode 100644 index 0000000..1010e80 --- /dev/null +++ b/counter_resource/infoseccounters.md @@ -0,0 +1,10 @@ +# resource counters: infosec + +## by action + + +### D2 Deny +* C00182: malware detection/quarantine/deletion (needs infosec) + +### D3 Disrupt +* C00153: Use offensive cyber action (needs infosec) diff --git a/counter_resource/librariescounters.md b/counter_resource/librariescounters.md new file mode 100644 index 0000000..1b6ea8f --- /dev/null +++ b/counter_resource/librariescounters.md @@ -0,0 +1,7 @@ +# resource counters: libraries + +## by action + + +### D4 Degrade +* C00054: Media literacy training. (needs educators,libraries,schools,DHS,NGO,platform_outreach,media,community_groups,religious_organisations) diff --git a/counter_resource/mediacounters.md b/counter_resource/mediacounters.md new file mode 100644 index 0000000..add3ff5 --- /dev/null +++ b/counter_resource/mediacounters.md @@ -0,0 +1,20 @@ +# resource counters: media + +## by action + + +### D2 Deny +* C00154: Ask media not to report false information (needs media) +* C00204: Strengthen local media (needs media) + +### D3 Disrupt +* C00188: Newsroom/Journalist training to counter SEO influence (needs media,educators) +* C00193: promotion of a “higher standard of journalism” (needs media,educators) +* C00017: Media campaign promoting in-group to out-group in person communication / activities (needs media) +* C00124: Don't feed the trolls (needs public,media) + +### D4 Degrade +* C00054: Media literacy training. (needs educators,libraries,schools,DHS,NGO,platform_outreach,media,community_groups,religious_organisations) +* C00158: Use training to build the resilience of at-risk populations. (needs educators,media) +* C00020: Deligitimise the 24 hour news cycle (needs media) +* C00111: Present sympathetic views of opposite side (needs media,content_creators) diff --git a/counter_resource/militarycounters.md b/counter_resource/militarycounters.md new file mode 100644 index 0000000..a1c595f --- /dev/null +++ b/counter_resource/militarycounters.md @@ -0,0 +1,7 @@ +# resource counters: military + +## by action + + +### D3 Disrupt +* C00156: Better tell the U.S., NATO, and EU story. (needs government,military) diff --git a/counter_resource/moneycounters.md b/counter_resource/moneycounters.md new file mode 100644 index 0000000..c15a51e --- /dev/null +++ b/counter_resource/moneycounters.md @@ -0,0 +1,8 @@ +# resource counters: money + +## by action + + +### D3 Disrupt +* C00043: Detect hijacked accounts and reallocate them (needs platform_admin,activists,civil_society,money) +* C00105: Buy more advertising than the adversary to shift influence and algorithms (needs money,adtech) diff --git a/counter_resource/platform_admin:adtechcounters.md b/counter_resource/platform_admin:adtechcounters.md new file mode 100644 index 0000000..f6fcc4f --- /dev/null +++ b/counter_resource/platform_admin:adtechcounters.md @@ -0,0 +1,7 @@ +# resource counters: platform_admin:adtech + +## by action + + +### D2 Deny +* C00216: Use advertiser controls to stem flow of funds to bad actors (needs platform_admin:adtech) diff --git a/counter_resource/platform_admin:fundingsitescounters.md b/counter_resource/platform_admin:fundingsitescounters.md new file mode 100644 index 0000000..cb6ccda --- /dev/null +++ b/counter_resource/platform_admin:fundingsitescounters.md @@ -0,0 +1,7 @@ +# resource counters: platform_admin:fundingsites + +## by action + + +### D2 Deny +* C00155: Ban incident actors from funding sites (needs platform_admin:fundingsites) diff --git a/counter_resource/platform_admin:socialmediacounters.md b/counter_resource/platform_admin:socialmediacounters.md new file mode 100644 index 0000000..efbfdf0 --- /dev/null +++ b/counter_resource/platform_admin:socialmediacounters.md @@ -0,0 +1,13 @@ +# resource counters: platform_admin:socialmedia + +## by action + + +### D2 Deny +* C00074: Identify identical content and mass deplatform (needs platform_admin,platform_admin:socialmedia) +* C00006: Charge for social media (needs platform_admin:socialmedia) +* C00171: social media content take-downs (needs platform_admin:socialmedia) +* C00172: social media page removal (needs platform_admin:socialmedia) + +### D4 Degrade +* C00053: Delete old accounts / Remove unused social media accounts (needs platform_admin,platform_admin:socialmedia,public:account_owners) diff --git a/counter_resource/platform_admincounters.md b/counter_resource/platform_admincounters.md new file mode 100644 index 0000000..a8083c0 --- /dev/null +++ b/counter_resource/platform_admincounters.md @@ -0,0 +1,21 @@ +# resource counters: platform_admin + +## by action + + +### D2 Deny +* C00074: Identify identical content and mass deplatform (needs platform_admin,platform_admin:socialmedia) +* C00098: Revocation of "verified" (needs platform_admin) +* C00055: Empower existing regulators to govern social media (needs government:policymakers,government,platform_admin) +* C00122: Content moderation. Censorship? (needs platform_admin) +* C00217: Registries alert when large batches of newsy URLs get registered together (needs platform_admin) +* C00218: Censorship (needs platform_admin) + +### D3 Disrupt +* C00043: Detect hijacked accounts and reallocate them (needs platform_admin,activists,civil_society,money) +* C00133: Deplatform Account* (needs platform_admin) +* C00135: Deplatform message groups and/or message boards (needs platform_admin) + +### D4 Degrade +* C00053: Delete old accounts / Remove unused social media accounts (needs platform_admin,platform_admin:socialmedia,public:account_owners) +* C00102: Make repeat voting harder (needs platform_admin) diff --git a/counter_resource/platform_algorithmscounters.md b/counter_resource/platform_algorithmscounters.md new file mode 100644 index 0000000..4db0446 --- /dev/null +++ b/counter_resource/platform_algorithmscounters.md @@ -0,0 +1,18 @@ +# resource counters: platform_algorithms + +## by action + + +### D2 Deny +* C00097: Require use of verified identities to contribute to poll or comment (needs platform_algorithms) +* C00099: Strengthen verification methods (needs platform_algorithms) + +### D3 Disrupt +* C00044: Keep people from posting to social media immediately (needs platform_algorithms) +* C00147: Make amplification of social media ports expire (e.g. can't like/ retweet after n days) (needs platform_algorithms) + +### D4 Degrade +* C00148: Add random links to network graphs (needs platform_algorithms) +* C00101: Create participant friction (needs platform_algorithms) +* C00141: "Hey this story is old" popup when messaging with old URL (needs platform_algorithms) +* C00142: "This has been disproved - do you want to forward it" (needs platform_algorithms) diff --git a/counter_resource/platform_outreachcounters.md b/counter_resource/platform_outreachcounters.md new file mode 100644 index 0000000..ea8406b --- /dev/null +++ b/counter_resource/platform_outreachcounters.md @@ -0,0 +1,7 @@ +# resource counters: platform_outreach + +## by action + + +### D4 Degrade +* C00054: Media literacy training. (needs educators,libraries,schools,DHS,NGO,platform_outreach,media,community_groups,religious_organisations) diff --git a/counter_resource/platformscounters.md b/counter_resource/platformscounters.md new file mode 100644 index 0000000..4dc4bea --- /dev/null +++ b/counter_resource/platformscounters.md @@ -0,0 +1,7 @@ +# resource counters: platforms + +## by action + + +### D7 Deter +* C00207: tit-for-tat campaign (needs government,platforms) diff --git a/counter_resource/public:account_ownerscounters.md b/counter_resource/public:account_ownerscounters.md new file mode 100644 index 0000000..d29e75a --- /dev/null +++ b/counter_resource/public:account_ownerscounters.md @@ -0,0 +1,7 @@ +# resource counters: public:account_owners + +## by action + + +### D4 Degrade +* C00053: Delete old accounts / Remove unused social media accounts (needs platform_admin,platform_admin:socialmedia,public:account_owners) diff --git a/counter_resource/public:anyone with datasets or data summariescounters.md b/counter_resource/public:anyone with datasets or data summariescounters.md new file mode 100644 index 0000000..33d8e8e --- /dev/null +++ b/counter_resource/public:anyone with datasets or data summariescounters.md @@ -0,0 +1,7 @@ +# resource counters: public:anyone with datasets or data summaries + +## by action + + +### D1 detect +* C00213: Warn social media companies about an ongoing campaign (e.g. antivax sites). (needs public:anyone with datasets or data summaries) diff --git a/counter_resource/publiccounters.md b/counter_resource/publiccounters.md new file mode 100644 index 0000000..c8e30c8 --- /dev/null +++ b/counter_resource/publiccounters.md @@ -0,0 +1,14 @@ +# resource counters: public + +## by action + + +### D2 Deny +* C00114: Don't engage with payloads (needs public) + +### D3 Disrupt +* C00190: open engagement with civil society (needs public) +* C00124: Don't feed the trolls (needs public,media) + +### D4 Degrade +* C00143: (botnet) DMCA takedown requests to waste group time (needs public,elves) diff --git a/counter_resource/religious_organisationscounters.md b/counter_resource/religious_organisationscounters.md new file mode 100644 index 0000000..a1b0152 --- /dev/null +++ b/counter_resource/religious_organisationscounters.md @@ -0,0 +1,7 @@ +# resource counters: religious_organisations + +## by action + + +### D4 Degrade +* C00054: Media literacy training. (needs educators,libraries,schools,DHS,NGO,platform_outreach,media,community_groups,religious_organisations) diff --git a/counter_resource/schoolscounters.md b/counter_resource/schoolscounters.md new file mode 100644 index 0000000..c7123e8 --- /dev/null +++ b/counter_resource/schoolscounters.md @@ -0,0 +1,7 @@ +# resource counters: schools + +## by action + + +### D4 Degrade +* C00054: Media literacy training. (needs educators,libraries,schools,DHS,NGO,platform_outreach,media,community_groups,religious_organisations) diff --git a/counter_resource/server_admincounters.md b/counter_resource/server_admincounters.md new file mode 100644 index 0000000..0556ad0 --- /dev/null +++ b/counter_resource/server_admincounters.md @@ -0,0 +1,7 @@ +# resource counters: server_admin + +## by action + + +### D2 Deny +* C00131: Seize and analyse botnet servers (needs server_admin) diff --git a/counter_resource_counts.md b/counter_resource_counts.md new file mode 100644 index 0000000..cc0b662 --- /dev/null +++ b/counter_resource_counts.md @@ -0,0 +1,385 @@ +# AMITT resource courses of action + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +
ALLD2 DenyD3 DisruptD4 DegradeD5 DeceiveD6 DestroyD7 DeterTOTALS
DHS 1.0
NGO 1.0
activists 1.01.0
adtech 1.0
civil_society 1.0
community_groups 1.0
companies 1.0
content_creators 1.0
data_scientist 2.0
datastreams 1.0
developers 1.0 1.0
educators 6.03.02.0
elves 1.0
factcheckers 2.0
funding 1.0
gamesdesigners 1.0
government 1.05.0 1.0
government:policymakers 4.04.0
influencers 2.01.0
influencers:trusted_authority 1.0
infosec 1.01.0
libraries 1.0
media 2.04.04.0
military 1.0
money 2.0
platform_admin 6.03.02.0
platform_admin:adtech 1.0
platform_admin:fundingsites 1.0
platform_admin:socialmedia 4.0 1.0
platform_algorithms 2.02.04.0
platform_outreach 1.0
platforms 1.0
public 1.02.01.0
public:account_owners 1.0
religious_organisations 1.0
schools 1.0
server_admin 1.0
diff --git a/counter_tactic_counts.md b/counter_tactic_counts.md new file mode 100644 index 0000000..40ba239 --- /dev/null +++ b/counter_tactic_counts.md @@ -0,0 +1,147 @@ +# AMITT Courses of Action matrix: + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +
ALLTA01 Strategic PlanningTA02 Objective PlanningTA03 Develop PeopleTA04 Develop NetworksTA05 MicrotargetingTA06 Develop ContentTA07 Channel SelectionTA08 Pump PrimingTA09 ExposureTA10 Go PhysicalTA11 PersistenceTA12 Measure Effectiveness
ALL4000000000000
D2 Deny01101011213773110
D3 Disrupt06573587314061
D4 Degrade0701305322062
D5 Deceive0001002100000
D6 Destroy0001100000000
D7 Deter0401005030100
TOTALS428521187331815192133
diff --git a/counter_tactics/ALcounters.md b/counter_tactics/ALcounters.md new file mode 100644 index 0000000..dccf816 --- /dev/null +++ b/counter_tactics/ALcounters.md @@ -0,0 +1,15 @@ +# Tactic ALL counters + +## by action + + +### ALL +* C00001: Better models of info spread up the layers (needs nan) +* C00003: How can we safeguard against extremists using the tools that we will produce? (needs nan) +* C00004: Managing like a chronic disease (needs nan) +* C00005: Policy: makers, terminology, elements: a) broad, b) specific (needs nan) + +## by technique + + +### AL diff --git a/counter_tactics/TA01counters.md b/counter_tactics/TA01counters.md new file mode 100644 index 0000000..19769e6 --- /dev/null +++ b/counter_tactics/TA01counters.md @@ -0,0 +1,72 @@ +# Tactic TA01 Strategic Planning counters + +## by action + + +### D2 Deny +* C00006: Charge for social media (needs platform_admin:socialmedia) +* C00012: Platform regulation (needs government:policymakers) +* C00009: Educate high profile influencers on best practices (needs influencers,educators) +* C00011: Media literacy. Games to identify fake news (needs educators,gamesdesigners,developers) +* C00007: Create framework for BetterBusinessBureau (BBB) for news media (needs nan) +* C00008: Create shared fact-checking database (needs factcheckers) +* C00013: Rating framework for news - full transcripts, link source, add items, BBB for news (needs nan) +* C00014: Real-time updates to fact-checking database (needs factcheckers) +* C00015: Reputation scores for social media users (needs data_scientist,datastreams) +* C00010: Enhanced privacy regulation for social media (needs government:policymakers) +* C00016: Social media as a privilege not right (needs nan) + +### D3 Disrupt +* C00018: Promote constructive communication by shaming division-enablers (needs nan) +* C00019: Promote playbooks to call out division-enablers (needs nan) +* C00017: Media campaign promoting in-group to out-group in person communication / activities (needs media) +* C00153: Use offensive cyber action (needs infosec) +* C00159: Campaign mindset and associated toolbox (needs nan) +* C00205: strong dialogue between the federal government and private sector to encourage better reporting (needs companies,government) + +### D4 Degrade +* C00026: Shore up democracy based messages (peace, freedom) - make it sexy (needs nan) +* C00022: Innoculate. Positive campaign to promote feeling of safety - to counter ability and fear based attacks (needs nan) +* C00023: Promote civility as an identity that people will defend (needs nan) +* C00024: Promote constructive narratives i.e. not polarising. Pro-life, pro-choice, or pro-USA? (needs nan) +* C00020: Deligitimise the 24 hour news cycle (needs media) +* C00021: Encourage in-person communication (needs nan) +* C00025: Promote identity neutral narratives (needs nan) + +### D7 Deter +* C00027: Create culture of civility (needs nan) +* C00161: Coalition Building and Third-Party Inducements: (needs nan) +* C00176: Improve Coordination with and feedback from the U.S. private sector (needs nan) +* C00207: tit-for-tat campaign (needs government,platforms) + +## by technique + + +### TA01 +* C00023: Promote civility as an identity that people will defend (needs nan) +* C00024: Promote constructive narratives i.e. not polarising. Pro-life, pro-choice, or pro-USA? (needs nan) +* C00073: Educate on how to handle info pollution. Push out targeted education on why it's pollution (needs educators) +* C00008: Create shared fact-checking database (needs factcheckers) +* C00014: Real-time updates to fact-checking database (needs factcheckers) +* C00015: Reputation scores for social media users (needs data_scientist,datastreams) +* C00025: Promote identity neutral narratives (needs nan) + +### 39 T0001 - 5Ds (dismiss, distort, distract, disma... +Name: key, dtype: object +* C00020: Deligitimise the 24 hour news cycle (needs media) + +### 40 T0002 - Facilitate State Propaganda +Name: key, dtype: object +* C00026: Shore up democracy based messages (peace, freedom) - make it sexy (needs nan) +* C00031: Dilute the core narrative - create multiple permutations, target / amplify (needs nan) +* C00088: Poison pill recasting of message (needs nan) +* C00055: Empower existing regulators to govern social media (needs government:policymakers,government,platform_admin) +* C00022: Innoculate. Positive campaign to promote feeling of safety - to counter ability and fear based attacks (needs nan) + +### 41 T0003 - Leverage Existing Narratives +Name: key, dtype: object +* C00031: Dilute the core narrative - create multiple permutations, target / amplify (needs nan) + +### 42 T0004 - Competing Narratives +Name: key, dtype: object +* C00042: Address truth contained in narratives (needs nan) diff --git a/counter_tactics/TA02counters.md b/counter_tactics/TA02counters.md new file mode 100644 index 0000000..9aa6229 --- /dev/null +++ b/counter_tactics/TA02counters.md @@ -0,0 +1,32 @@ +# Tactic TA02 Objective Planning counters + +## by action + + +### D3 Disrupt +* C00031: Dilute the core narrative - create multiple permutations, target / amplify (needs nan) +* C00029: Create fake website to issue counter narrative and counter narrative through physical merchandise (needs nan) +* C00030: Develop a compelling counter narrative (truth based) (needs nan) +* C00032: Hijack content and link to truth- based info (platform) (needs nan) +* C00028: Blockchain audit log and validation with collaborative decryption to post comments (needs nan) + +## by technique + + +### TA02 +* C00070: Block access to platform. DDOS an attacker. (needs nan) + +### 43 T0005 - Center of Gravity Analysis +Name: key, dtype: object +* C00136: Microtarget most likely targets then send them countermessages (needs nan) +* C00036: Infiltrate the in-group to discredit leaders (divide) (needs nan) + +### 44 T0006 - Create Master Narratives +Name: key, dtype: object +* C00031: Dilute the core narrative - create multiple permutations, target / amplify (needs nan) +* C00088: Poison pill recasting of message (needs nan) +* C00023: Promote civility as an identity that people will defend (needs nan) +* C00024: Promote constructive narratives i.e. not polarising. Pro-life, pro-choice, or pro-USA? (needs nan) +* C00008: Create shared fact-checking database (needs factcheckers) +* C00014: Real-time updates to fact-checking database (needs factcheckers) +* C00025: Promote identity neutral narratives (needs nan) diff --git a/counter_tactics/TA03counters.md b/counter_tactics/TA03counters.md new file mode 100644 index 0000000..51b229d --- /dev/null +++ b/counter_tactics/TA03counters.md @@ -0,0 +1,67 @@ +# Tactic TA03 Develop People counters + +## by action + + +### D2 Deny +* C00150: “calling them out” (needs nan) +* C00034: Create more friction at account creation (needs nan) +* C00035: Friction (needs nan) +* C00039: Standard reporting for false profiles (needs nan) +* C00155: Ban incident actors from funding sites (needs platform_admin:fundingsites) +* C00197: remove suspicious facebook accounts (needs nan) +* C00033: Build cultural resistance to false content (needs nan) +* C00040: third party verification for people (needs nan) +* C00036: Infiltrate the in-group to discredit leaders (divide) (needs nan) +* C00160: find and train influencers (needs data_scientist,influencers) + +### D3 Disrupt +* C00043: Detect hijacked accounts and reallocate them (needs platform_admin,activists,civil_society,money) +* C00044: Keep people from posting to social media immediately (needs platform_algorithms) +* C00170: elevate information as a critical domain of statecraft (needs nan) +* C00042: Address truth contained in narratives (needs nan) +* C00045: S4d detection and re-allocation approaches (needs nan) +* C00164: compatriot policy (needs nan) +* C00179: Identify, monitor, and, if necessary, target Russia-based nonattributed social media accounts (needs nan) + +### D4 Degrade +* C00046: Marginalise and discredit extremist (needs nan) + +### D5 Deceive +* C00047: Coordinated inauthentics (needs nan) + +### D6 Destroy +* C00189: Ongoing analysis/monitoring of "flagged" profiles (needs nan) + +### D7 Deter +* C00048: Name and Shame (needs nan) + +## by technique + + +### TA03 +* C00011: Media literacy. Games to identify fake news (needs educators,gamesdesigners,developers) +* C00085: Demuting content (needs nan) + +### 45 T0007 - Create fake Social Media Profiles / Pa... +Name: key, dtype: object +* C00012: Platform regulation (needs government:policymakers) +* C00055: Empower existing regulators to govern social media (needs government:policymakers,government,platform_admin) +* C00039: Standard reporting for false profiles (needs nan) +* C00133: Deplatform Account* (needs platform_admin) +* C00135: Deplatform message groups and/or message boards (needs platform_admin) +* C00036: Infiltrate the in-group to discredit leaders (divide) (needs nan) + +### 46 T0008 - Create fake or imposter news sites +Name: key, dtype: object +* C00053: Delete old accounts / Remove unused social media accounts (needs platform_admin,platform_admin:socialmedia,public:account_owners) +* C00070: Block access to platform. DDOS an attacker. (needs nan) +* C00008: Create shared fact-checking database (needs factcheckers) +* C00014: Real-time updates to fact-checking database (needs factcheckers) + +### 47 T0009 - Create fake experts +Name: key, dtype: object +* C00133: Deplatform Account* (needs platform_admin) +* C00008: Create shared fact-checking database (needs factcheckers) +* C00014: Real-time updates to fact-checking database (needs factcheckers) +* C00040: third party verification for people (needs nan) diff --git a/counter_tactics/TA04counters.md b/counter_tactics/TA04counters.md new file mode 100644 index 0000000..96ba447 --- /dev/null +++ b/counter_tactics/TA04counters.md @@ -0,0 +1,79 @@ +# Tactic TA04 Develop Networks counters + +## by action + + +### D2 Deny +* C00152: “name and shame” (needs nan) +* C00056: Get off social media (needs nan) +* C00055: Empower existing regulators to govern social media (needs government:policymakers,government,platform_admin) +* C00174: Free and Fair Press (needs nan) +* C00049: Influence literacy training (needs educators) +* C00050: Anti-elicitation training (needs educators) +* C00051: Phishing prevention education etc (needs educators) +* C00057: Privacy standards (needs nan) +* C00059: Verification of project before posting (counters funding campaigns) (needs nan) +* C00058: Report crowdfunder as violator (needs nan) +* C00157: Build alternative news sources (needs nan) + +### D3 Disrupt +* C00061: Innoculating at language (needs nan) +* C00060: Enhanced legal enforcement against for-profit follower/engagement factories (needs government:policymakers) +* C00162: collect data/map constellations of Russian“civil society”. Unravel/target the Potemkin villages (needs nan) + +### D4 Degrade +* C00053: Delete old accounts / Remove unused social media accounts (needs platform_admin,platform_admin:socialmedia,public:account_owners) +* C00054: Media literacy training. (needs educators,libraries,schools,DHS,NGO,platform_outreach,media,community_groups,religious_organisations) +* C00052: Infiltrate platforms (needs activists) + +### D6 Destroy +* C00062: Free open library sources worldwide (needs nan) + +## by technique + + +### TA04 +* C00011: Media literacy. Games to identify fake news (needs educators,gamesdesigners,developers) +* C00085: Demuting content (needs nan) + +### 48 T0010 - Cultivate ignorant agents +Name: key, dtype: object +* C00136: Microtarget most likely targets then send them countermessages (needs nan) +* C00009: Educate high profile influencers on best practices (needs influencers,educators) +* C00093: Establish tailored code of conduct for individuals with many followers (needs nan) + +### 49 T0011 - Hijack legitimate account +Name: key, dtype: object +* C00043: Detect hijacked accounts and reallocate them (needs platform_admin,activists,civil_society,money) +* C00053: Delete old accounts / Remove unused social media accounts (needs platform_admin,platform_admin:socialmedia,public:account_owners) +* C00133: Deplatform Account* (needs platform_admin) +* C00135: Deplatform message groups and/or message boards (needs platform_admin) +* C00045: S4d detection and re-allocation approaches (needs nan) + +### 50 T0012 - Use concealment +Name: key, dtype: object +* C00049: Influence literacy training (needs educators) +* C00050: Anti-elicitation training (needs educators) +* C00051: Phishing prevention education etc (needs educators) +* C00052: Infiltrate platforms (needs activists) + +### 51 T0013 - Create fake websites +Name: key, dtype: object +* C00008: Create shared fact-checking database (needs factcheckers) +* C00014: Real-time updates to fact-checking database (needs factcheckers) + +### 52 T0014 - Create funding campaigns +Name: key, dtype: object +* C00012: Platform regulation (needs government:policymakers) +* C00070: Block access to platform. DDOS an attacker. (needs nan) +* C00133: Deplatform Account* (needs platform_admin) +* C00008: Create shared fact-checking database (needs factcheckers) +* C00014: Real-time updates to fact-checking database (needs factcheckers) + +### 53 T0015 - Create hashtag +Name: key, dtype: object +* C00145: Pollute the data voids with wholesome content (Kittens! Babyshark!) (needs nan) +* C00066: Co-opt a hashtag and drown it out (hijack it back) (needs nan) +* C00088: Poison pill recasting of message (needs nan) +* C00055: Empower existing regulators to govern social media (needs government:policymakers,government,platform_admin) +* C00070: Block access to platform. DDOS an attacker. (needs nan) diff --git a/counter_tactics/TA05counters.md b/counter_tactics/TA05counters.md new file mode 100644 index 0000000..48f3c31 --- /dev/null +++ b/counter_tactics/TA05counters.md @@ -0,0 +1,46 @@ +# Tactic TA05 Microtargeting counters + +## by action + + +### D2 Deny +* C00216: Use advertiser controls to stem flow of funds to bad actors (needs platform_admin:adtech) +* C00063: Ban political microtargeting (needs government:policymakers) + +### D3 Disrupt +* C00068: Expose online funding as fake (needs nan) +* C00069: Mark clickbait visually (needs nan) +* C00066: Co-opt a hashtag and drown it out (hijack it back) (needs nan) +* C00065: Ban political ads (needs government:policymakers) +* C00067: Denigrate the recipient/ project (of online funding) (needs nan) + +## by technique + + +### TA05 +* C00140: "Bomb" link shorteners with lots of calls (needs nan) +* C00141: "Hey this story is old" popup when messaging with old URL (needs platform_algorithms) +* C00142: "This has been disproved - do you want to forward it" (needs platform_algorithms) +* C00011: Media literacy. Games to identify fake news (needs educators,gamesdesigners,developers) +* C00085: Demuting content (needs nan) + +### 54 T0016 - Clickbait +Name: key, dtype: object +* C00069: Mark clickbait visually (needs nan) + +### 55 T0017 - Promote online funding +Name: key, dtype: object +* C00068: Expose online funding as fake (needs nan) +* C00088: Poison pill recasting of message (needs nan) +* C00070: Block access to platform. DDOS an attacker. (needs nan) +* C00133: Deplatform Account* (needs platform_admin) +* C00135: Deplatform message groups and/or message boards (needs platform_admin) +* C00036: Infiltrate the in-group to discredit leaders (divide) (needs nan) +* C00067: Denigrate the recipient/ project (of online funding) (needs nan) +* C00093: Establish tailored code of conduct for individuals with many followers (needs nan) + +### 56 T0018 - Paid targeted ads +Name: key, dtype: object +* C00133: Deplatform Account* (needs platform_admin) +* C00063: Ban political microtargeting (needs government:policymakers) +* C00065: Ban political ads (needs government:policymakers) diff --git a/counter_tactics/TA06counters.md b/counter_tactics/TA06counters.md new file mode 100644 index 0000000..68a6eff --- /dev/null +++ b/counter_tactics/TA06counters.md @@ -0,0 +1,124 @@ +# Tactic TA06 Develop Content counters + +## by action + + +### D2 Deny +* C00074: Identify identical content and mass deplatform (needs platform_admin,platform_admin:socialmedia) +* C00070: Block access to platform. DDOS an attacker. (needs nan) +* C00071: Block source of pollution (needs nan) +* C00072: Content censorship in non-relevant domains e.g. Pinterest antivax (needs nan) +* C00171: social media content take-downs (needs platform_admin:socialmedia) +* C00172: social media page removal (needs platform_admin:socialmedia) +* C00073: Educate on how to handle info pollution. Push out targeted education on why it's pollution (needs educators) +* C00075: normalise language (needs nan) +* C00076: Prohibit images in political discourse channels (needs nan) +* C00165: Limit access to alterable documents (needs nan) +* C00167: Deploy Information and Narrative-Building in Service of Statecraft (needs nan) +* C00202: Set data 'honeytraps' (needs nan) +* C00210: Use encrypted apps for confidential communication (needs nan) + +### D3 Disrupt +* C00082: Ground truthing as automated response to pollution (needs nan) +* C00081: Discredit by pointing out the "noise" and informing public that "flooding" is a technique of disinformation campaigns; point out intended objective of "noise" (needs nan) +* C00078: Change Search Algorithms for Disinformation Content. More specifically, change image search algorithms for hate groups and extremists (needs nan) +* C00079: Change search algorithms for hate and extremist queries to show content sympathetic to opposite side (needs nan) +* C00080: Create competing narrative (needs nan) +* C00084: Steal their truths (needs nan) +* C00077: Active defence: replay "develop people" (needs nan) +* C00219: Add metadata to content - out of the control of the adversary (needs nan) + +### D4 Degrade +* C00087: Make more noise (needs nan) +* C00088: Poison pill recasting of message (needs nan) +* C00089: Throttle number of forwards (needs nan) +* C00085: Demuting content (needs nan) +* C00086: Distract from noise with addictive content (needs nan) + +### D5 Deceive +* C00090: Fake engagement system (needs nan) +* C00091: Honeypot social community (needs nan) + +### D7 Deter +* C00094: Force full disclosure on corporate sponsor of research (needs nan) +* C00092: Establish a truth teller reputation score for individuals with many followers (needs nan) +* C00095: Keep score (needs nan) +* C00096: Strengthen institutions that are always truth tellers (needs nan) +* C00093: Establish tailored code of conduct for individuals with many followers (needs nan) + +## by technique + + +### TA06 +* C00053: Delete old accounts / Remove unused social media accounts (needs platform_admin,platform_admin:socialmedia,public:account_owners) +* C00008: Create shared fact-checking database (needs factcheckers) +* C00014: Real-time updates to fact-checking database (needs factcheckers) +* C00085: Demuting content (needs nan) + +### 57 T0019 - Generate information pollution +Name: key, dtype: object +* C00091: Honeypot social community (needs nan) +* C00071: Block source of pollution (needs nan) +* C00073: Educate on how to handle info pollution. Push out targeted education on why it's pollution (needs educators) +* C00042: Address truth contained in narratives (needs nan) + +### 58 T0020 - Trial content +Name: key, dtype: object +* C00137: Pollute the AB-testing data feeds (needs nan) +* C00149: Poison the monitoring & evaluation data (needs nan) +* C00090: Fake engagement system (needs nan) + +### 59 T0021 - Memes +Name: key, dtype: object +* C00079: Change search algorithms for hate and extremist queries to show content sympathetic to opposite side (needs nan) +* C00089: Throttle number of forwards (needs nan) +* C00076: Prohibit images in political discourse channels (needs nan) + +### 60 T0022 - Conspiracy narratives +Name: key, dtype: object +* C00074: Identify identical content and mass deplatform (needs platform_admin,platform_admin:socialmedia) +* C00072: Content censorship in non-relevant domains e.g. Pinterest antivax (needs nan) +* C00023: Promote civility as an identity that people will defend (needs nan) +* C00024: Promote constructive narratives i.e. not polarising. Pro-life, pro-choice, or pro-USA? (needs nan) +* C00096: Strengthen institutions that are always truth tellers (needs nan) +* C00025: Promote identity neutral narratives (needs nan) +* C00042: Address truth contained in narratives (needs nan) + +### 61 T0023 - Distort facts +Name: key, dtype: object +* C00023: Promote civility as an identity that people will defend (needs nan) +* C00024: Promote constructive narratives i.e. not polarising. Pro-life, pro-choice, or pro-USA? (needs nan) +* C00092: Establish a truth teller reputation score for individuals with many followers (needs nan) +* C00095: Keep score (needs nan) +* C00025: Promote identity neutral narratives (needs nan) + +### 62 T0024 - Create fake videos and images +Name: key, dtype: object +* C00092: Establish a truth teller reputation score for individuals with many followers (needs nan) +* C00076: Prohibit images in political discourse channels (needs nan) + +### 63 T0025 - Leak altered documents +Name: key, dtype: object +* C00074: Identify identical content and mass deplatform (needs platform_admin,platform_admin:socialmedia) +* C00012: Platform regulation (needs government:policymakers) +* C00092: Establish a truth teller reputation score for individuals with many followers (needs nan) +* C00036: Infiltrate the in-group to discredit leaders (divide) (needs nan) +* C00202: Set data 'honeytraps' (needs nan) +* C00210: Use encrypted apps for confidential communication (needs nan) + +### 64 T0026 - Create fake research +Name: key, dtype: object +* C00074: Identify identical content and mass deplatform (needs platform_admin,platform_admin:socialmedia) +* C00094: Force full disclosure on corporate sponsor of research (needs nan) +* C00092: Establish a truth teller reputation score for individuals with many followers (needs nan) + +### 65 T0027 - Adapt existing narratives +Name: key, dtype: object +* C00023: Promote civility as an identity that people will defend (needs nan) +* C00024: Promote constructive narratives i.e. not polarising. Pro-life, pro-choice, or pro-USA? (needs nan) +* C00025: Promote identity neutral narratives (needs nan) +* C00042: Address truth contained in narratives (needs nan) + +### 66 T0028 - Create competing narratives +Name: key, dtype: object +* C00042: Address truth contained in narratives (needs nan) diff --git a/counter_tactics/TA07counters.md b/counter_tactics/TA07counters.md new file mode 100644 index 0000000..1e54180 --- /dev/null +++ b/counter_tactics/TA07counters.md @@ -0,0 +1,87 @@ +# Tactic TA07 Channel Selection counters + +## by action + + +### D2 Deny +* C00195: Redirect Method (needs nan) +* C00097: Require use of verified identities to contribute to poll or comment (needs platform_algorithms) +* C00098: Revocation of "verified" (needs platform_admin) +* C00099: Strengthen verification methods (needs platform_algorithms) +* C00107: Content moderation (needs nan) +* C00110: Monetize centrist SEO by subsidizing the difference in greater clicks towards extremist content (needs funding) +* C00217: Registries alert when large batches of newsy URLs get registered together (needs platform_admin) + +### D3 Disrupt +* C00105: Buy more advertising than the adversary to shift influence and algorithms (needs money,adtech) +* C00100: Hashtag jacking (needs nan) +* C00106: Click-bait centrist content (needs nan) +* C00109: De-escalation (needs nan) +* C00196: Include the role of social media in the regulatory framework for media (needs government) +* C00214: Create policy that makes social media police disinformation (needs government:policymakers) +* C00215: Use fraud legislation to clean up social media (needs government:policymakers) + +### D4 Degrade +* C00101: Create participant friction (needs platform_algorithms) +* C00102: Make repeat voting harder (needs platform_admin) +* C00111: Present sympathetic views of opposite side (needs media,content_creators) + +### D5 Deceive +* C00103: Create a bot that engages / distract trolls (needs developers) + +## by technique + + +### TA07 +* C00078: Change Search Algorithms for Disinformation Content. More specifically, change image search algorithms for hate groups and extremists (needs nan) +* C00044: Keep people from posting to social media immediately (needs platform_algorithms) +* C00012: Platform regulation (needs government:policymakers) +* C00055: Empower existing regulators to govern social media (needs government:policymakers,government,platform_admin) +* C00133: Deplatform Account* (needs platform_admin) +* C00135: Deplatform message groups and/or message boards (needs platform_admin) +* C00092: Establish a truth teller reputation score for individuals with many followers (needs nan) +* C00028: Blockchain audit log and validation with collaborative decryption to post comments (needs nan) +* C00016: Social media as a privilege not right (needs nan) +* C00060: Enhanced legal enforcement against for-profit follower/engagement factories (needs government:policymakers) +* C00085: Demuting content (needs nan) +* C00093: Establish tailored code of conduct for individuals with many followers (needs nan) + +### 67 T0029 - Manipulate online polls +Name: key, dtype: object +* C00136: Microtarget most likely targets then send them countermessages (needs nan) +* C00103: Create a bot that engages / distract trolls (needs developers) +* C00097: Require use of verified identities to contribute to poll or comment (needs platform_algorithms) +* C00101: Create participant friction (needs platform_algorithms) +* C00102: Make repeat voting harder (needs platform_admin) +* C00009: Educate high profile influencers on best practices (needs influencers,educators) + +### 68 T0030 - Backstop personas +Name: key, dtype: object +* C00099: Strengthen verification methods (needs platform_algorithms) + +### 69 T0031 - YouTube +Name: key, dtype: object + +### 70 T0032 - Reddit +Name: key, dtype: object +* C00107: Content moderation (needs nan) + +### 71 T0033 - Instagram +Name: key, dtype: object + +### 72 T0034 - LinkedIn +Name: key, dtype: object + +### 73 T0035 - Pinterest +Name: key, dtype: object +* C00107: Content moderation (needs nan) + +### 74 T0036 - WhatsApp +Name: key, dtype: object + +### 75 T0037 - Facebook +Name: key, dtype: object + +### 76 T0038 - Twitter +Name: key, dtype: object +* C00098: Revocation of "verified" (needs platform_admin) diff --git a/counter_tactics/TA08counters.md b/counter_tactics/TA08counters.md new file mode 100644 index 0000000..f177b5a --- /dev/null +++ b/counter_tactics/TA08counters.md @@ -0,0 +1,91 @@ +# Tactic TA08 Pump Priming counters + +## by action + + +### D2 Deny +* C00113: Debunk and defuse a fake expert / credentials. Attack audience quality of fake expert (needs nan) +* C00115: Expose actor and intentions (needs nan) +* C00116: Provide proof of involvement (needs nan) +* C00154: Ask media not to report false information (needs media) +* C00204: Strengthen local media (needs media) +* C00112: "Prove they are not an op!" (needs nan) +* C00114: Don't engage with payloads (needs public) + +### D3 Disrupt +* C00188: Newsroom/Journalist training to counter SEO influence (needs media,educators) +* C00193: promotion of a “higher standard of journalism” (needs media,educators) +* C00203: Stop offering press credentials to propaganda outlets (needs government) + +### D4 Degrade +* C00117: Downgrade de-amplify label promote counter to disinformation (needs nan) +* C00118: Repurpose images with new text (needs nan) + +### D7 Deter +* C00120: Open dialogue about design of platforms to produce different outcomes (needs nan) +* C00119: Engage payload and debunk. Provide link to facts. (needs nan) +* C00121: Tool transparency and literacy for channels people follow. (needs nan) + +## by technique + + +### TA08 +* C00136: Microtarget most likely targets then send them countermessages (needs nan) +* C00018: Promote constructive communication by shaming division-enablers (needs nan) +* C00019: Promote playbooks to call out division-enablers (needs nan) +* C00048: Name and Shame (needs nan) +* C00009: Educate high profile influencers on best practices (needs influencers,educators) +* C00011: Media literacy. Games to identify fake news (needs educators,gamesdesigners,developers) +* C00008: Create shared fact-checking database (needs factcheckers) +* C00014: Real-time updates to fact-checking database (needs factcheckers) +* C00092: Establish a truth teller reputation score for individuals with many followers (needs nan) +* C00028: Blockchain audit log and validation with collaborative decryption to post comments (needs nan) +* C00027: Create culture of civility (needs nan) +* C00085: Demuting content (needs nan) +* C00124: Don't feed the trolls (needs public,media) + +### 77 T0039 - Bait legitimate influencers +Name: key, dtype: object +* C00093: Establish tailored code of conduct for individuals with many followers (needs nan) +* C00114: Don't engage with payloads (needs public) + +### 78 T0040 - Demand unsurmountable proof +Name: key, dtype: object +* C00112: "Prove they are not an op!" (needs nan) + +### 79 T0041 - Deny involvement +Name: key, dtype: object +* C00116: Provide proof of involvement (needs nan) + +### 80 T0042 - Kernel of Truth +Name: key, dtype: object +* C00042: Address truth contained in narratives (needs nan) +* C00112: "Prove they are not an op!" (needs nan) + +### 81 T0043 - Use SMS/ WhatsApp/ Chat apps +Name: key, dtype: object +* C00012: Platform regulation (needs government:policymakers) +* C00016: Social media as a privilege not right (needs nan) +* C00121: Tool transparency and literacy for channels people follow. (needs nan) + +### 82 T0044 - Seed distortions +Name: key, dtype: object +* C00042: Address truth contained in narratives (needs nan) +* C00118: Repurpose images with new text (needs nan) +* C00119: Engage payload and debunk. Provide link to facts. (needs nan) + +### 83 T0045 - Use fake experts +Name: key, dtype: object +* C00113: Debunk and defuse a fake expert / credentials. Attack audience quality of fake expert (needs nan) +* C00133: Deplatform Account* (needs platform_admin) +* C00135: Deplatform message groups and/or message boards (needs platform_admin) +* C00092: Establish a truth teller reputation score for individuals with many followers (needs nan) + +### 84 T0046 - Search Engine Optimization +Name: key, dtype: object +* C00145: Pollute the data voids with wholesome content (Kittens! Babyshark!) (needs nan) +* C00115: Expose actor and intentions (needs nan) +* C00078: Change Search Algorithms for Disinformation Content. More specifically, change image search algorithms for hate groups and extremists (needs nan) +* C00012: Platform regulation (needs government:policymakers) +* C00070: Block access to platform. DDOS an attacker. (needs nan) +* C00117: Downgrade de-amplify label promote counter to disinformation (needs nan) diff --git a/counter_tactics/TA09counters.md b/counter_tactics/TA09counters.md new file mode 100644 index 0000000..509eafa --- /dev/null +++ b/counter_tactics/TA09counters.md @@ -0,0 +1,128 @@ +# Tactic TA09 Exposure counters + +## by action + + +### D2 Deny +* C00122: Content moderation. Censorship? (needs platform_admin) +* C00182: malware detection/quarantine/deletion (needs infosec) +* C00218: Censorship (needs platform_admin) + +### D3 Disrupt +* C00169: develop a creative content hub (needs nan) +* C00211: Use humorous counter-narratives (needs nan) +* C00126: Social media amber alert (needs nan) +* C00151: “fight in the light” (needs nan) +* C00128: Create friction by marking content with ridicule or other "decelerants" (needs influencers:trusted_authority) +* C00178: Fill information voids with non-disinformation content (needs nan) +* C00194: Provide an alternative to Russian information by expanding and improving local content. (needs nan) +* C00125: Prepare the population with pre-announcements (needs nan) +* C00190: open engagement with civil society (needs public) +* C00212: build public resilence by making civil society more vibrant (needs educators,government) +* C00123: Bot control (needs nan) +* C00124: Don't feed the trolls (needs public,media) +* C00156: Better tell the U.S., NATO, and EU story. (needs government,military) +* C00200: Respected figure (influencer) disavows misinfo (needs influencers) + +### D4 Degrade +* C00184: Media exposure (needs nan) +* C00158: Use training to build the resilience of at-risk populations. (needs educators,media) + +## by technique + + +### TA09 +* C00136: Microtarget most likely targets then send them countermessages (needs nan) +* C00140: "Bomb" link shorteners with lots of calls (needs nan) +* C00018: Promote constructive communication by shaming division-enablers (needs nan) +* C00019: Promote playbooks to call out division-enablers (needs nan) +* C00141: "Hey this story is old" popup when messaging with old URL (needs platform_algorithms) +* C00142: "This has been disproved - do you want to forward it" (needs platform_algorithms) +* C00012: Platform regulation (needs government:policymakers) +* C00133: Deplatform Account* (needs platform_admin) +* C00135: Deplatform message groups and/or message boards (needs platform_admin) +* C00011: Media literacy. Games to identify fake news (needs educators,gamesdesigners,developers) +* C00028: Blockchain audit log and validation with collaborative decryption to post comments (needs nan) +* C00085: Demuting content (needs nan) +* C00086: Distract from noise with addictive content (needs nan) +* C00124: Don't feed the trolls (needs public,media) + +### 85 T0047 - Muzzle social media as a political force +Name: key, dtype: object +* C00055: Empower existing regulators to govern social media (needs government:policymakers,government,platform_admin) +* C00120: Open dialogue about design of platforms to produce different outcomes (needs nan) +* C00092: Establish a truth teller reputation score for individuals with many followers (needs nan) +* C00027: Create culture of civility (needs nan) +* C00060: Enhanced legal enforcement against for-profit follower/engagement factories (needs government:policymakers) +* C00093: Establish tailored code of conduct for individuals with many followers (needs nan) + +### 86 T0048 - Cow online opinion leaders +Name: key, dtype: object +* C00048: Name and Shame (needs nan) +* C00115: Expose actor and intentions (needs nan) +* C00055: Empower existing regulators to govern social media (needs government:policymakers,government,platform_admin) +* C00027: Create culture of civility (needs nan) +* C00093: Establish tailored code of conduct for individuals with many followers (needs nan) + +### 87 T0049 - Flooding +Name: key, dtype: object +* C00044: Keep people from posting to social media immediately (needs platform_algorithms) +* C00131: Seize and analyse botnet servers (needs server_admin) +* C00123: Bot control (needs nan) + +### 88 T0050 - Cheerleading domestic social media ops +Name: key, dtype: object + +### 89 T0051 - Fabricate social media comment +Name: key, dtype: object +* C00055: Empower existing regulators to govern social media (needs government:policymakers,government,platform_admin) +* C00123: Bot control (needs nan) + +### 90 T0052 - Tertiary sites amplify news +Name: key, dtype: object +* C00115: Expose actor and intentions (needs nan) +* C00126: Social media amber alert (needs nan) +* C00120: Open dialogue about design of platforms to produce different outcomes (needs nan) +* C00070: Block access to platform. DDOS an attacker. (needs nan) +* C00123: Bot control (needs nan) + +### 91 T0053 - Twitter trolls amplify and manipulate +Name: key, dtype: object +* C00115: Expose actor and intentions (needs nan) +* C00126: Social media amber alert (needs nan) +* C00120: Open dialogue about design of platforms to produce different outcomes (needs nan) +* C00144: Buy out troll farm employees / offer them jobs (needs nan) +* C00092: Establish a truth teller reputation score for individuals with many followers (needs nan) +* C00027: Create culture of civility (needs nan) +* C00093: Establish tailored code of conduct for individuals with many followers (needs nan) +* C00123: Bot control (needs nan) + +### 92 T0054 - Twitter bots amplify +Name: key, dtype: object +* C00115: Expose actor and intentions (needs nan) +* C00126: Social media amber alert (needs nan) +* C00044: Keep people from posting to social media immediately (needs platform_algorithms) +* C00120: Open dialogue about design of platforms to produce different outcomes (needs nan) +* C00131: Seize and analyse botnet servers (needs server_admin) +* C00123: Bot control (needs nan) + +### 93 T0055 - Use hashtag +Name: key, dtype: object +* C00115: Expose actor and intentions (needs nan) +* C00126: Social media amber alert (needs nan) +* C00066: Co-opt a hashtag and drown it out (hijack it back) (needs nan) +* C00055: Empower existing regulators to govern social media (needs government:policymakers,government,platform_admin) +* C00120: Open dialogue about design of platforms to produce different outcomes (needs nan) +* C00070: Block access to platform. DDOS an attacker. (needs nan) +* C00123: Bot control (needs nan) + +### 94 T0056 - Dedicated channels disseminate informa... +Name: key, dtype: object +* C00115: Expose actor and intentions (needs nan) +* C00126: Social media amber alert (needs nan) +* C00120: Open dialogue about design of platforms to produce different outcomes (needs nan) +* C00071: Block source of pollution (needs nan) +* C00073: Educate on how to handle info pollution. Push out targeted education on why it's pollution (needs educators) +* C00036: Infiltrate the in-group to discredit leaders (divide) (needs nan) +* C00042: Address truth contained in narratives (needs nan) +* C00123: Bot control (needs nan) diff --git a/counter_tactics/TA0counters.md b/counter_tactics/TA0counters.md new file mode 100644 index 0000000..ab35240 --- /dev/null +++ b/counter_tactics/TA0counters.md @@ -0,0 +1,12 @@ +# Tactic TA07 counters + +## by action + + +### D2 deny +* C00217: Registries alert when large batches of newsy URLs get registered together (needs platform_admin) + +## by technique + + +### TA0 diff --git a/counter_tactics/TA10counters.md b/counter_tactics/TA10counters.md new file mode 100644 index 0000000..f5d9156 --- /dev/null +++ b/counter_tactics/TA10counters.md @@ -0,0 +1,42 @@ +# Tactic TA10 Go Physical counters + +## by action + + +### D2 Deny +* C00129: Use banking to cut off access (needs nan) + +### D7 Deter +* C00130: Mentorship: elders, youth, credit. Learn vicariously. (needs nan) + +## by technique + + +### TA10 +* C00136: Microtarget most likely targets then send them countermessages (needs nan) +* C00140: "Bomb" link shorteners with lots of calls (needs nan) +* C00018: Promote constructive communication by shaming division-enablers (needs nan) +* C00019: Promote playbooks to call out division-enablers (needs nan) +* C00141: "Hey this story is old" popup when messaging with old URL (needs platform_algorithms) +* C00142: "This has been disproved - do you want to forward it" (needs platform_algorithms) +* C00012: Platform regulation (needs government:policymakers) +* C00133: Deplatform Account* (needs platform_admin) +* C00135: Deplatform message groups and/or message boards (needs platform_admin) +* C00028: Blockchain audit log and validation with collaborative decryption to post comments (needs nan) +* C00085: Demuting content (needs nan) + +### 95 T0057 - Organise remote rallies and events +Name: key, dtype: object +* C00048: Name and Shame (needs nan) +* C00088: Poison pill recasting of message (needs nan) +* C00129: Use banking to cut off access (needs nan) +* C00070: Block access to platform. DDOS an attacker. (needs nan) +* C00036: Infiltrate the in-group to discredit leaders (divide) (needs nan) + +### 99 T0061 - Sell merchandising +Name: key, dtype: object +* C00048: Name and Shame (needs nan) +* C00068: Expose online funding as fake (needs nan) +* C00129: Use banking to cut off access (needs nan) +* C00070: Block access to platform. DDOS an attacker. (needs nan) +* C00067: Denigrate the recipient/ project (of online funding) (needs nan) diff --git a/counter_tactics/TA11counters.md b/counter_tactics/TA11counters.md new file mode 100644 index 0000000..a650ebd --- /dev/null +++ b/counter_tactics/TA11counters.md @@ -0,0 +1,42 @@ +# Tactic TA11 Persistence counters + +## by action + + +### D2 Deny +* C00131: Seize and analyse botnet servers (needs server_admin) + +### D3 Disrupt +* C00136: Microtarget most likely targets then send them countermessages (needs nan) +* C00137: Pollute the AB-testing data feeds (needs nan) +* C00138: Spam domestic actors with lawsuits (needs nan) +* C00133: Deplatform Account* (needs platform_admin) +* C00135: Deplatform message groups and/or message boards (needs platform_admin) +* C00139: Weaponise youtube content matrices (needs nan) + +### D4 Degrade +* C00140: "Bomb" link shorteners with lots of calls (needs nan) +* C00145: Pollute the data voids with wholesome content (Kittens! Babyshark!) (needs nan) +* C00141: "Hey this story is old" popup when messaging with old URL (needs platform_algorithms) +* C00142: "This has been disproved - do you want to forward it" (needs platform_algorithms) +* C00144: Buy out troll farm employees / offer them jobs (needs nan) +* C00143: (botnet) DMCA takedown requests to waste group time (needs public,elves) + +## by technique + + +### TA11 +* C00085: Demuting content (needs nan) + +### 96 T0058 - Legacy web content +Name: key, dtype: object + +### 97 T0059 - Play the long game +Name: key, dtype: object +* C00088: Poison pill recasting of message (needs nan) +* C00011: Media literacy. Games to identify fake news (needs educators,gamesdesigners,developers) +* C00042: Address truth contained in narratives (needs nan) + +### 98 T0060 - Continue to amplify +Name: key, dtype: object +* C00147: Make amplification of social media ports expire (e.g. can't like/ retweet after n days) (needs platform_algorithms) diff --git a/counter_tactics/TA12counters.md b/counter_tactics/TA12counters.md new file mode 100644 index 0000000..10b6d1f --- /dev/null +++ b/counter_tactics/TA12counters.md @@ -0,0 +1,17 @@ +# Tactic TA12 Measure Effectiveness counters + +## by action + + +### D3 Disrupt +* C00147: Make amplification of social media ports expire (e.g. can't like/ retweet after n days) (needs platform_algorithms) + +### D4 Degrade +* C00148: Add random links to network graphs (needs platform_algorithms) +* C00149: Poison the monitoring & evaluation data (needs nan) + +## by technique + + +### TA12 +* C00149: Poison the monitoring & evaluation data (needs nan) diff --git a/incidents.md b/incidents.md new file mode 100644 index 0000000..385a1ad --- /dev/null +++ b/incidents.md @@ -0,0 +1,580 @@ +# AMITT Incidents: + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +
idnametypeYear StartedFrom countryTo countryFound via
I00001Blacktivists facebook groupincident2016.0RussiaUSAnan
I00002#VaccinateUScampaign2014.0RussiaWorldnan
I00003Beyonce protest ralliesincident2016.0RussiaUSAnan
I00004#Macrongateincident2017.0RussiaFrancenan
I00005Brexit votecampaign2016.0RussiaUKnan
I00006Columbian Chemicalsincident2014.0RussiaUSAnan
I00007Incirlik terroristsincident2016.0RussiaUSAnan
I00008Bujicincident2017.0RussiaSerbianan
I00009PhilippinesExpertincident2017.0RussiaPhilippinesnan
I00010ParklandTeensincident2018.0??USAnan
I00011CovingtonTeenincident2019.0??USAnan
I00012ChinaSmogincident2011.0ChinaChinanan
I00013FranceBlacktivistsincident2014.0RussiaFrancenan
I00014GiletsJaunePileonincident2018.0RussiaFrancenan
I00015ConcordDiscoveryincident2019.0RussiaUSAnan
I00016LithuanianElvescampaign2014.0RussiaLithuanianan
I00017US presidential electionscampaign2016.0RussiaUSAOII
I00018DNC email leak incidenttactic2016.0RussiaUSAOII
I00019MacronTiphaineincident2017.0unknownFranceOII
I000203000 tanksincident2017.0RussiaWorldOII
I00021Armenia electionscampaign2017.0RussiaArmeniaOII
I00022#Macronleaksincident2017.0RussiaFranceOII
I00023#dislikemacronincident2017.0RussiaFranceOII
I00024#syriahoaxincident2017.0SyriaUSAOII
I00025EU Armyincident2018.0RussiaEUOII
I00026Netherlands referendum on Ukraineincident2016.0RussiaNetherlandsOII
I00027crucifiedboyincident2014.0RussiaUkraineOII
I00028mh17 downedincident2014.0RussiaUkraineOII
I00029MH17 investigationcampaign2016.0RussiaUkraineOII
I00030LastJediincident2018.0RussiaWorldOII
I00031antivaxapt2018.0RussiaWorldOII
I00032Kavanaughincident2018.0RussiaUSAOII
I00033China 50cent Armyapt2014.0ChinaChinaOII
I00034DibaFacebookExpeditionincident2016.0ChinaTaiwanOII
I00035Brazilelectionscampaign2014.0BrazilBrazilOII
I00036BrazilPresDebateincident2014.0BrazilBrazilOII
I00037Rioelectionsincident2016.0BrazilBrazilOII
I00038Brazilimpeachmentincident2016.0BrazilBrazilOII
I00039MerkelFacebookincident2017.0unknownGermanyOII
I00040modamaniSelfieincident2015.0unknownGermanyOII
I00041Refugee crime mapincident2017.0unknownGermanyOII
I00042Saudi/Qatar bot disputeincident2017.0SaudiArabiaQatarMIS
I00043FCC commentsincident2017.0unknownUSAMIS
I00044JadeHelm exerciseincident2015.0nanUSAMIS
I00045Skripalincident2018.0RussiaUKnan
I00046North Macedoniaincident2018.0RussiaMacedonianan
I00047Sea of Azovincident2018.0RussiaWorldnan
I00048White Helmetscampaign2015.0RussiaWorldnan
I00049White Helmets: Chemical Weaponsincident2017.0RussiaWorldnan
I00050#HandsOffVenezuelaincident2019.0RussiaWorldnan
I00051Integrity Initiativeincident2018.0RussiaWorldnan
I00052China overiewcampaign2015.0ChinaWorldnan
I00053China Huawei CFO Arrestincident2018.0ChinaWorldnan
I00054China Muslimsincident2018.0ChinaWorldnan
I0005550 Cent Armycampaign2008.0ChinaWorldnan
I00056Iran Influence Operationscampaign2012.0IranWorldnan
I00057Mexico Electionincident2018.0Russia/domesticMexiconan
I00058Chemnitzincident2018.0RussiaGermanynan
I00059Myanmar - Rohingya campaign2014.0MyanmarMyanmarnan
I00060White Genocidecampaign2018.0RussiaWorldnan
I00061Military veterans Targettingcampaign2017.0RussiaUSnan
I00062Brexit/UK ongoingcampaign2015.0Russia/domesticUKnan
I00063Olympic Doping Scandalcampaign2016.0RussiaWorldnan
diff --git a/incidents/I00001.md b/incidents/I00001.md new file mode 100644 index 0000000..1997c0b --- /dev/null +++ b/incidents/I00001.md @@ -0,0 +1,67 @@ +# Blacktivists facebook group + +* Type: incident + +* Name: Blacktivists facebook group + +* Id: I00001 + +* Summary: IRA created fake @blacktivists facebook group and twitter account. + +* Year started: 2016.0 + +* From country / To country: Russia / USA + +* Found via: nan + +* Date added: 2019-02-24 + +* Techniques used: + +| Technique | Description given for this incident | +| --------- | ------------------------- | + +DO NOT EDIT ABOVE THIS LINE - PLEASE ADD NOTES BELOW + +Actor: + +Timeframe: + +Date: + +Presumed goals: “Russian-linked social media accounts saw racial tensions as something to be exploited in order to achieve the broader Russian goal of dividing Americans and creating chaos in U.S. politics during a campaign in which race repeatedly became an issue.” + +Method: +Possibly linked: black lives matter facebook ads, targetted at Baltimore, Ferguson, Missouri https://money.cnn.com/2017/09/27/media/facebook-black-lives-matter-targeting/index.html?iid=EL + +Counters: + +Related incidents: + +* Txrebels facebook group +* MuslimAmerica facebook group +* Patriotus facebook group +* SecuredBorders facebook group +* Lgbtun facebook group +* Black Matters facebook group + +References: +* https://money.cnn.com/2017/09/28/media/blacktivist-russia-facebook-twitter/index.html +* https://news.docnow.io/blacktivists-in-the-archive-71c807aa247e +* https://www.thedailybeast.com/exclusive-secret-documents-from-russias-election-trolls-leak + + + +Datasets + +* https://docs.google.com/spreadsheets/d/1OZcRCZuz83bMpxVjpUYEALiS4OtKU-pTVtTveG_Ljs0/edit#gid=0 - from https://news.docnow.io/blacktivists-in-the-archive-71c807aa247e are the @blacktivists tweets that used the #blacklivesmatter hashtag +* Jonathan Albright got the facebook text: https://data.world/d1gi/missing-fb-posts-w-share-stats/workspace/file?filename=Blacktivist+Facebook+Page+%28Text%29.pdf https://data.world/d1gi/missing-fb-posts-w-share-stats/workspace/file?filename=Blacktivist+Facebook+Page+%28Text%29-2.docx + +Notes + +First i read the cnn article, then did a twitter search to see if there are traces of the accounts left online. Only discussion about the IRA operation seem to be on Twitter. Also searched twitter for some of the text found later (in datasets) - nothing matches. +Reading the docnow.io post showed some interesting behavours. Also that there was no central data repo for the blacktivists posts. Classic was the tweets being sent only in 8am-6pm Moscow time. Also interesting: the followers grew over time, but they grew and dropped friends (people they followed) in batches periodically - was this to avoid hitting limits? +Reading the dailybeast.com article (on an IRA leak), it seems specific individuals were targetted. Thinking about the places we need to search: if it’s Russia, seems like we need to check twitter, facebook, youtube, reddit, tumblr, instagram, 9gag. +Names some of the people contacted, e.g. Craig Carson, a Rochester, New York, attorney and civil rights activist; maybe Shanall LaRay Logan—who lives in Sacramento, California; + + diff --git a/incidents/I00002.md b/incidents/I00002.md new file mode 100644 index 0000000..0b28ac6 --- /dev/null +++ b/incidents/I00002.md @@ -0,0 +1,83 @@ +# #VaccinateUS + +* Type: campaign + +* Name: #VaccinateUS + +* Id: I00002 + +* Summary: use both pro- and anti- topic messaging to create an artificial argument online. + +* Year started: 2014.0 + +* From country / To country: Russia / World + +* Found via: nan + +* Date added: 2019-02-24 + +* Techniques used: + +| Technique | Description given for this incident | +| --------- | ------------------------- | +| [T0017 Promote online funding](../techniques/T0017.md) | I00002T002 Promote "funding" campaign | +| [T0018 Paid targeted ads](../techniques/T0018.md) | I00002T001 buy FB targeted ads | +| [T0019 Generate information pollution](../techniques/T0019.md) | I00002T003 create web-site - information pollution | +| [T0046 Search Engine Optimization](../techniques/T0046.md) | I00002T004 SEO optimisation/manipulation ("key words") | +| [T0056 Dedicated channels disseminate information pollution](../techniques/T0056.md) | I00002T003 create web-site - information pollution | +| [T0058 Legacy web content](../techniques/T0058.md) | I00002T005 legacy web content | +| [T0058 Legacy web content](../techniques/T0058.md) | I00002T006 hard to remove content and/or campaign/exploit TOS | + +DO NOT EDIT ABOVE THIS LINE - PLEASE ADD NOTES BELOW + +Actor: IRA, individuals (e.g. Larry Cook). + +Timeframe: + +Date: + +Presumed goals: +Physical damage to country? + +Method: + +* Targetted facebook ads (Larry Cook, targetting Washington State mothers, $1,776 to boost posts over 9 months). +* Gofundme campaigns to pay for ads (Larry Cook) + +Effects: + +* “The U.S. anti-vax movement has been blamed for two outbreaks of measles that have infected some 300 people—mostly children—in New York and the Pacific Northwest.” + +Counters: + +* American Medical Association “warned social-media giants, including Amazon, Facebook, Google, Pinterest, Twitter, and YouTube, that they were helping to amplify the propaganda and confuse parents.” +* Gofundme banned antivaxxers: “Campaigns raising money to promote misinformation about vaccines violate GoFundMe’s terms of service and will be removed from the platform”. Less than 10 campaigns reported as removed. + +Related incidents: + +Artefacts: + +Search terms vaccination, anti-vaccination, “vaccine choice”. + +Notes: + +Started by looking for vaccine-related content in my misinformation datasets +Then did google search for “antivax misinformation” to get references etc. +Larry Cook runs “Stop Mandatory Vaccination”: “donations go “directly” to his bank account and funds “may be used to pay [his] personal bills.” + + +References; + +* https://www.thedailybeast.com/brooklyn-hasidic-community-is-in-the-midst-of-a-dire-measles-outbreak +* https://www.thedailybeast.com/amazon-wont-take-a-stand-in-war-over-forrest-maready-book-the-autism-vaccine +* https://www.bmj.com/content/362/bmj.k3739 +* https://hub.jhu.edu/2018/08/24/russian-trolls-bots-spread-vaccine-misinformation/ +* https://ajph.aphapublications.org/doi/full/10.2105/AJPH.2018.304567 +* Arciga, [GoFundMe Bans Anti-Vaxxers Who Raise Money to Spread Misinformation](https://www.thedailybeast.com/gofundme-bans-anti-vaxxers-who-raise-money-to-spread-misinformation), Daily Beast 2019-03-22 +* Arciga, [Anti-Vaxxer Larry Cook Has Weaponized Facebook Ads in War Against Science](https://www.thedailybeast.com/anti-vaxxer-larry-cook-has-weaponized-facebook-ads-in-war-against-science), Daily Beast 2019-02-15 +* Gofundmes (removed, but check archives) https://www.gofundme.com/help-save-vaccine-exemptions-in-washington-state https://www.gofundme.com/parents-wake-up-vaccines-kill +* Markay, [Anti-Vaccine Facebook Ads Target Women in Measles-Stricken States](https://www.thedailybeast.com/anti-vaccine-facebook-ads-target-women-in-measles-stricken-states/), Daily Beast 2019-02-14 + +Data + + diff --git a/incidents/I00003.md b/incidents/I00003.md new file mode 100644 index 0000000..4df2e6e --- /dev/null +++ b/incidents/I00003.md @@ -0,0 +1,45 @@ +# Beyonce protest rallies + +* Type: incident + +* Name: Beyonce protest rallies + +* Id: I00003 + +* Summary: use both pro- and anti- topic messaging to create an artificial argument in real life. + +* Year started: 2016.0 + +* From country / To country: Russia / USA + +* Found via: nan + +* Date added: 2019-02-24 + +* Techniques used: + +| Technique | Description given for this incident | +| --------- | ------------------------- | + +DO NOT EDIT ABOVE THIS LINE - PLEASE ADD NOTES BELOW + +Actor: IRA + +Timeframe: + +Date: + +Presumed goals: + +Method: + +Counters: + +Related incidents: + + +References: + +* https://twitter.com/JuliaDavisNews/status/994704834577215495 +* https://twitter.com/donie/status/957246815056908288 +* https://www.theguardian.com/us-news/2018/may/10/russia-facebook-ads-us-elections-congress diff --git a/incidents/I00004.md b/incidents/I00004.md new file mode 100644 index 0000000..9cb69d0 --- /dev/null +++ b/incidents/I00004.md @@ -0,0 +1,54 @@ +# #Macrongate + +* Type: incident + +* Name: #Macrongate + +* Id: I00004 + +* Summary: amplified document dump failed because France was prepared for it. + +* Year started: 2017.0 + +* From country / To country: Russia / France + +* Found via: nan + +* Date added: 2019-02-24 + +* Techniques used: + +| Technique | Description given for this incident | +| --------- | ------------------------- | + +DO NOT EDIT ABOVE THIS LINE - PLEASE ADD NOTES BELOW + +Actor: IRA + +Timeframe: 1 day (plus preparation) + +Date: May 2017 + +Presumed goals: reduce Emmanuel Macron’s chance of winning French presidential election + +Method: + +* fake documents posted on 4chan about Macron’s alleged offshore account, +* amplified by pro-Trump Twitter accounts using #MacronGate and #MacronCacheCash + +Counters: + +* preparation (resilience, account removals), +* honeytraps, +* counter-response with humour. + +Related incidents: + +* DNC document release, US presidential elections, 2016 + + +References: + +* Source: https://www.patreon.com/posts/macrongate-tied-11940855 +* http://www.niemanlab.org/2018/09/how-france-beat-back-information-manipulation-and-how-other-democracies-might-do-the-same/ +* https://www.theguardian.com/world/2017/may/08/macron-hackers-linked-to-russian-affiliated-group-behind-us-attack diff --git a/incidents/I00005.md b/incidents/I00005.md new file mode 100644 index 0000000..aa654f2 --- /dev/null +++ b/incidents/I00005.md @@ -0,0 +1,112 @@ +# Brexit vote + +* Type: campaign + +* Name: Brexit vote + +* Id: I00005 + +* Summary: In early 2014, then UK PM David Cameron outlined the changes he aimed to bring about in the EU and in the UK's relationship with it. These were: additional immigration controls, especially for citizens of new EU member states; tougher immigration rules for present EU citizens; new powers for national parliaments collectively to veto proposed EU laws; new free-trade agreements and a reduction in bureaucracy for businesses; a lessening of the influence of the European Court of Human Rights on British police and courts; more power for individual member states, and less for the central EU; and abandonment of the EU notion of "ever closer union".He intended to bring these about during a series of negotiations with other EU leaders and then, if re-elected, to announce a referendum. +European Union Referendum Act was passed by the Parliament of the United Kingdom. It extended to include and take legislative effect in Gibraltar,and received royal assent on 17 December 2015. + +Conservative-led Department for Culture, Media and Sport select committee concluded (2018) Russia engaged in ‘unconventional warfare’ during the Brexit campaign. This included ‘156,252 Russian accounts tweeting about #Brexit’ and posting ‘over 45,000 Brexit messages in the last 48 hours of the campaign.’ As it said, Kremlin-controlled media, ‘RT and Sputnik had more reach on Twitter for anti-EU content than either Vote Leave or Leave.EU, during the referendum campaign’. + +The report by Democrats on the Senate foreign relations committee, titled Putin’s asymmetric assault on democracy in Russia and Europe: implications for US national security, pinpoints the way in which UK campaign finance laws do not require disclosure of political donations if they are from “the beneficial owners of non-British companies that are incorporated in the EU and carry out business in the UK”. + +The senators point out that Ukip and its then-leader, Nigel Farage, did not just fan anti-EU sentiment but also “criticised European sanctions on Russia, and provided flattering assessments of Russian President Putin”. + +The report adds that although officially the Russian government asserted its neutrality on Brexit, its English-language media outlets RT and Sputnik covered the referendum campaign extensively and offered ‘’systematically one-sided coverage’’. + +* Year started: 2016.0 + +* From country / To country: Russia / UK + +* Found via: nan + +* Date added: 2019-02-24 + +* Techniques used: + +| Technique | Description given for this incident | +| --------- | ------------------------- | +| [T0007 Create fake Social Media Profiles / Pages / Groups](../techniques/T0007.md) | I00005T004 Fake FB groups + dark content | +| [T0010 Cultivate ignorant agents](../techniques/T0010.md) | I00005T008 cultivate, manipulate, exploit useful idiots | +| [T0018 Paid targeted ads](../techniques/T0018.md) | I00005T003 Targeted FB paid ads | +| [T0019 Generate information pollution](../techniques/T0019.md) | I00005T007 RT & Sputnik generate information pollution | +| [T0021 Memes](../techniques/T0021.md) | I00005T011 Memes... anti-immigration; euroskepticism; fear, outrage, conspiracy narratives | +| [T0029 Manipulate online polls](../techniques/T0029.md) | I00005T006 manipulate social media "online polls"? | +| [T0030 Backstop personas](../techniques/T0030.md) | I00005T012 Backstop personas | +| [T0031 YouTube](../techniques/T0031.md) | I00005T009 YouTube; Reddit; LinkedIn; Pinterest; WhatsApp? | +| [T0032 Reddit](../techniques/T0032.md) | I00005T009 YouTube; Reddit; LinkedIn; Pinterest; WhatsApp? | +| [T0034 LinkedIn](../techniques/T0034.md) | I00005T009 YouTube; Reddit; LinkedIn; Pinterest; WhatsApp? | +| [T0035 Pinterest](../techniques/T0035.md) | I00005T009 YouTube; Reddit; LinkedIn; Pinterest; WhatsApp? | +| [T0036 WhatsApp](../techniques/T0036.md) | I00005T009 YouTube; Reddit; LinkedIn; Pinterest; WhatsApp? | +| [T0046 Search Engine Optimization](../techniques/T0046.md) | I00005T010 SEO optimisation/manipulation ("key words") | +| [T0053 Twitter trolls amplify and manipulate](../techniques/T0053.md) | I00005T002 Twitter trolls amplify & manipulate | +| [T0054 Twitter bots amplify](../techniques/T0054.md) | I00005T001 Twitter bots amplify & manipulate | +| [T0056 Dedicated channels disseminate information pollution](../techniques/T0056.md) | I00005T007 RT & Sputnik generate information pollution | +| [T0057 Organise remote rallies and events](../techniques/T0057.md) | I00005T005 Digital to physical "organize+promote" rallies & events? | + +DO NOT EDIT ABOVE THIS LINE - PLEASE ADD NOTES BELOW + +Actor: Russia/ Internet Research Agency (IRA) + +Timeframe: December 2015 - ongoing + +Date: June 23, 2016 + +Presumed goals: Change Brexit vote to ‘leave’; continue to divide/undermine EU; drive Eurosceptic narrative/agenda + +Method: +* (From The European Values Think-Tank) +* Before Brexit, Russia Today and Sputnik released more anti-EU articles than the official Vote Leave website and Leave.EU website. The British version of Sputnik has an annual budget of £ 1.8 million from the Russian government. Kremlin-owned channels potentially influenced 134 million impressions during the Brexit campaign +* Method: The data that was used by 89up was derived from the Twitter Search API, Buzzsumo, the Facebook API and other scraping methods. In the timeframe from January 2016 to the day of the British referendum, analysts identified and analysed 261 of the most shared and popular articles that were clearly anti-European. The two main media outlets were RT and Sputnik. Costs: The total value of Kremlin media for the Leave campaign in the six months before the EU referendum was £1,353,000. The PR value for the Leave campaign, based on the 261 heavily pro-Leave articles published by RT and Sputnik, is estimated at nearly £1,500,000based on figures from a leading media monitoring tool. This excludes the significant social media value of these news articles. Estimated value of Russian media Facebook impressions is around $102,000 and the estimated value of Russian media’s potential impressions on Twitter is between $47,000 - $100,000. +* Content: The analysis also shows that the overwhelming majority of articles published by RT and Sputnik (131 of the 200 most shared) were clearly for Leave; 59 articles were Neutral and only 10 were set to Remain. When the neutral articles are filtered out, numbers show that the negative articles of RT/Sputnik, together, elicited nearly the same number of engagements as the official Vote Leave website. +* Social reach: The report shows the social reach of these anti-EU articles published by the Kremlin-owned channels was 134 million potential impressions, in comparison with a total social reach of just 33 million and 11 million potential impressions for all content shared from the Vote Leave website and Leave.EU website respectively. +* (Jane Mayer, staff writer at The New Yorker, via NPR) Role of - Cambridge Analytica, which is a big data company that worked for the Trump campaign in the end - and it was owned principally by one of Trump's largest backers, Robert Mercer - was also involved in helping the early stages of the Brexit campaign in England. +And the man who spanned both countries and pushed for both, really, was Steve Bannon, it seems there was actually a lot of Russian money offered to Arron Banks, who was one of the major political figures leading the Brexit campaign. The Russian money was offered to him in the form of business opportunities and gold mines and diamond mines by the Russian ambassador to England. So there seems to be financial incentives that were dangled. +* There are bots and trolls and posts that are coming from the same Russian Internet agency in St. Petersburg. So in both countries, we see pushing Brexit and pushing Trump at the same time by the same trolls and bots. research conducted by a joint team of experts from the University of California at Berkeley and Swansea University reportedly identified 150,000 Twitter accounts with various Russian ties that disseminated messages about Brexit. +* A cache of posts from 2016, seen by WIRED, shows how a coordinated network of Russian-based Twitter accounts spread racial hatred in an attempt to disrupt politics in the UK and Europe. +A network of accounts posted pro and anti-Brexit, anti-immigration and racist tweets around the EU referendum vote while also targeting posts in response to terrorist attacks across the continent. +* More broadly, a Russian espionage operation funneling money into a political campaign aimed at unwinding European integration would be entirely consistent with the Kremlin’s perceived political interests and tactics of hybrid warfare. Covert financial infiltration is part of a toolkit Moscow uses to interfere in European and American politics. Another tool deployed ahead of the 2016 referendum was pro-Brexit messaging pumped out by RT, Sputnik, and the Internet Research Agency. +* From 1 to 8 February 2016, Sputnik ran 14 stories on the “Brexit” issue. Eight of them had negative headlines, either featuring criticism of the deal or focusing on the difficulties Cameron faces; five headlines were broadly factual; one reported a positive comment that the Bank of England had “not yet seen” an impact on investor sentiment, but gave it a negative slant by headlining, “Bank of England on Brexit: No need to panic, yet.” (The word “panic” did not appear in the story.) Not one headline reported reactions supporting the deal. Both Sputnik and RT quoted a disproportionate number of reactions from “Out” campaigners. RT, for example, quoted five “Out” partisans: MP Liam Fox; the founder of Leave.EU; London Mayor Boris Johnson; MEP Nigel Farage, the leader of the UK Independence Party; and UKIP member Paul Nuttall. +* anti-immigrant adverts were targeted at Facebook users in the UK and the US. One – headlined “You’re not the only one to despise immigration”, which cost 4,884 roubles (£58) and received 4,055 views – was placed in January 2016. Another, which accused immigrants of stealing jobs, cost 5,514 roubles and received 14,396 impressions +* A study of social media during the Brexit campaign by 89Up, a consultancy, found that Russian bots delivered 10m potential Twitter impressions—about a third of the number generated by the Vote Leave campaign’s Twitter account. Such echoing amplifies the effect of RT and Sputnik stories, which are in general not much watched. + +Counters: FB & Twitter content take-downs + +Related incidents: + +* 2016 US Election… pick ‘em + +References: + +* https://publications.parliament.uk/pa/cm201719/cmselect/cmcumeds/363/36308.htm#_idTextAnchor033 +* https://www.foreign.senate.gov/imo/media/doc/FinalRR.pdf +* https://www.theguardian.com/world/2017/nov/15/russian-troll-factories-researchers-damn-twitters-refusal-to-share-data +* https://www.atlanticcouncil.org/blogs/new-atlanticist/congress-should-explain-how-dark-russian-money-infiltrates-western-democracies +* http://sputniknews.com/search/?query=Brexit +* http://sputniknews.com/europe/20160202/1034093305/cameron-tusk-brexit-deal.html +* http://sputniknews.com/europe/20160203/1034124763/tusk-eu-reform.html +* http://sputniknews.com/europe/20160204/1034209396/cameron-eu-brexit-talks.html +* http://sputniknews.com/europe/20160205/1034290031/business-investments-brexit-europe.html +* https://www.rt.com/uk/331734-cameron-calais-jungle-brexit/ +* https://www.rt.com/uk/331161-eu-referendum-date-brexit/ +* https://www.rt.com/uk/330977-tusk-eu-deal-brexit/ +* https://twitter.com/brexit_sham/status/994982969705189377 + +* https://www.nytimes.com/2017/11/15/world/europe/russia-brexit-twitter-facebook.html +* https://www.forbes.com/sites/emmawoollacott/2018/11/01/russian-trolls-used-islamophobia-to-whip-up-support-for-brexit/#11ee8dd465f2 +* https://www.theguardian.com/world/2018/jan/10/russian-influence-brexit-vote-detailed-us-senate-report +* https://www.npr.org/2019/01/19/686830510/senate-finds-russian-bots-bucks-helped-push-brexit-vote-through +* https://www.europeanvalues.net/wp-content/uploads/2019/02/Influence-of-Russian-Disinformation-Operations-Specific-examples-in-data-and-numbers.pdf +* https://blogs.lse.ac.uk/brexit/2018/11/14/the-extent-of-russian-backed-fraud-means-the-referendum-is-invalid/ +* https://www.wired.co.uk/article/brexit-russia-influence-twitter-bots-internet-research-agency +* https://www.buzzfeed.com/jamesball/a-suspected-network-of-13000-twitter-bots-pumped-out-pro?utm_term=.ipWGa5zK#.oeeKD58v +* https://www.atlanticcouncil.org/blogs/new-atlanticist/use-brexit-delay-to-investigate-russian-money +* http://www.interpretermag.com/putins-media-are-pushing-britain-for-the-brexit/ +* https://www.theguardian.com/technology/2018/may/12/facebook-brexit-russia-unresolved-40-questions +* https://www.economist.com/briefing/2018/02/22/russian-disinformation-distorts-american-and-european-democracy + + + diff --git a/incidents/I00006.md b/incidents/I00006.md new file mode 100644 index 0000000..0dc0bea --- /dev/null +++ b/incidents/I00006.md @@ -0,0 +1,70 @@ +# Columbian Chemicals + +* Type: incident + +* Name: Columbian Chemicals + +* Id: I00006 + +* Summary: Early Russian (IRA) “fake news” stories. Completely fabricated; very short lifespan. + +* Year started: 2014.0 + +* From country / To country: Russia / USA + +* Found via: nan + +* Date added: 2019-02-24 + +* Techniques used: + +| Technique | Description given for this incident | +| --------- | ------------------------- | +| [T0007 Create fake Social Media Profiles / Pages / Groups](../techniques/T0007.md) | I00006T004 Fake twitter profiles to amplify | +| [T0015 Create hashtag](../techniques/T0015.md) | I00006T003 Create and use hashtag | +| [T0024 Create fake videos and images](../techniques/T0024.md) | I00006T002 Fake video/images | +| [T0039 Bait legitimate influencers](../techniques/T0039.md) | I00006T005 bait journalists/media/politicians | +| [T0043 Use SMS/ WhatsApp/ Chat apps](../techniques/T0043.md) | I00006T001 Use SMS/text messages | +| [T0055 Use hashtag](../techniques/T0055.md) | I00006T003 Create and use hashtag | + +DO NOT EDIT ABOVE THIS LINE - PLEASE ADD NOTES BELOW + +Actor: probably IRA (source: recordedfuture) + +Timeframe: 1 day + +Date: Sept 11 2014 + +Presumed goals: test deployment + +Method: +* Artefacts: text messages, images, video +* Create messages. e.g. “A powerful explosion heard from miles away happened at a chemical plant in Centerville, Louisiana #ColumbianChemicals” +* Post messages from fake twitter accounts; include handles of local and global influencers (journalists, media, politicians, e.g. @senjeffmerkley) +* Amplify, by repeating messages on twitter via fake twitter accounts +* Not seen: interaction, refutation etc. +* TL;DR: early attempts to create fake incidents had limited traction. + +Counters: + +* None seen. Fake stories were debunked very quickly. + +Related incidents: + +* BP oil spill tsunami +* #PhosphorusDisaster - fake story about water contamination scare +* #EbolaInAtlanta - fake story about Ebola outbreak in Atlanta +* #shockingmurderinatlanta - fake story about unarmed black woman killed by police in Atlanta + +These were all well-produced fake news stories, promoted on Twitter to influencers through a single dominant hashtag (the single hashtag might have been something learned from crisismapping practice of forcing a single hashtag for each disaster because it was easier to track) + +References: + +* [RecordedFuture trace of attack]() + +* https://en.wikipedia.org/wiki/Columbian_Chemicals_Plant_explosion_hoax +* https://www.recordedfuture.com/columbianchemicals-hoax-analysis/ +* https://www.nytimes.com/2015/06/07/magazine/the-agency.html?_r=0 +* https://twitter.com/hashtag/PhosphorusDisaster?src=hash + + diff --git a/incidents/I00007.md b/incidents/I00007.md new file mode 100644 index 0000000..cc3a829 --- /dev/null +++ b/incidents/I00007.md @@ -0,0 +1,66 @@ +# Incirlik terrorists + +* Type: incident + +* Name: Incirlik terrorists + +* Id: I00007 + +* Summary: Fake story transmitted from Russian media to Trump campaign + +* Year started: 2016.0 + +* From country / To country: Russia / USA + +* Found via: nan + +* Date added: 2019-02-24 + +* Techniques used: + +| Technique | Description given for this incident | +| --------- | ------------------------- | +| [T0010 Cultivate ignorant agents](../techniques/T0010.md) | I00007T002 cultivate, manipulate, exploit useful idiots (in the case Paul Manafort) | +| [T0019 Generate information pollution](../techniques/T0019.md) | I00007T001 RT & Sputnik generate information pollution (report an unreported false story/event) | +| [T0053 Twitter trolls amplify and manipulate](../techniques/T0053.md) | I00007T004 Twitter trolls amplify & manipulate | +| [T0054 Twitter bots amplify](../techniques/T0054.md) | I00007T003 Twitter bots amplify & manipulate | +| [T0056 Dedicated channels disseminate information pollution](../techniques/T0056.md) | I00007T001 RT & Sputnik generate information pollution (report an unreported false story/event) | + +DO NOT EDIT ABOVE THIS LINE - PLEASE ADD NOTES BELOW + +Actor: RT/Sputnik + +Timeframe: 2 weeks + +Date: July-August 2016 + +Presumed goals: + +Method: + +Counters: + +Related incidents: + +* Jade Helm exercise +* Black Lives Matter protests +* Bundy Ranch standoff + +Notes: + +Story was that the Incirlik NATO base in Turkey was under attack by terrorists. +2016-08-14 Paul Manafort cited that the Incirlik NATO base in Turkey was under attack by terrorists, as an example of an unreported true story. +“The weekend of July 30, RT.com and Sputnik reported 7,000 armed police with heavy vehicles had surrounded Incirlik air base in Adana, Turkey, where 2,500 U.S. troops are stationed and some 50 U.S. nuclear weapons are stored. The two Kremlin-funded outlets suggested that the lockdown was in response to another coup attempt after a faction of the Turkish military failed to overthrow Turkish President Recep Tayyip Erdoğan.” +“On the evening of 30 July 2016, my colleagues and I watched as RT and Sputnik news simultaneously launched false stories about the U.S. air base in Incirlik, Turkey being overrun by terrorists,” he told the committee. Within minutes pro-Russian social media aggregators and automated bots amplified this false news story,” Watts said. “There were more than 4,000 tweets in the first 75 to 78 minutes after launching this false story. Perhaps the most stunning development for Watt and his companions was that the rapid proliferation of that story was linked back to the active measures accounts (Russian bots) they had tracked for the preceding two years. These previously identified accounts almost simultaneously appearing from different geographic locations and communities amplified the big news story in unison,” Watts said. The hashtags promoted by the bots, according to Watts, were “nuclear, media, Trump and Benghazi. The most common words, he said found in English speaking Twitter user profiles were “God, military Trump, family, country, conservative, Christian, America and constitution. The objective of the messages, Watts said, “clearly sought to convince Americans that U.S. military bases being overrun in a terrorist attack.” + +Data + +* Looked at Twitter for these dates: https://twitter.com/search?l=&q=incirlik%20until%3A2014-08-14&src=typd +https://twitter.com/ElectionLawCtr/status/492850603039522816 + + +References: +* https://www.rt.com/news/354042-turkish-police-incirlik-nato-coup/ +* https://sputniknews.com/middleeast/20160731/1043797161/incirlik-turkey-erdogan-nato-nukes.html +* https://www.politifact.com/truth-o-meter/statements/2016/aug/16/paul-manafort/trump-campaign-chair-misquotes-russian-media-makes/ +* https://wtop.com/j-j-green-national/2017/09/anatomy-russian-attack-first-signs/slide/1/ diff --git a/incidents/I00008.md b/incidents/I00008.md new file mode 100644 index 0000000..81290fb --- /dev/null +++ b/incidents/I00008.md @@ -0,0 +1,45 @@ +# Bujic + +* Type: incident + +* Name: Bujic + +* Id: I00008 + +* Summary: nan + +* Year started: 2017.0 + +* From country / To country: Russia / Serbia + +* Found via: nan + +* Date added: 2019-02-24 + +* Techniques used: + +| Technique | Description given for this incident | +| --------- | ------------------------- | + +DO NOT EDIT ABOVE THIS LINE - PLEASE ADD NOTES BELOW + +Actor: + +Timeframe: + +Date: + +Presumed goals: + +Method: + +Counters: + +Related incidents: + +References: + +* https://www.ceas-serbia.org/images/2018/201803_CEAS_Report.pdf +* https://www.stopfake.org/en/vencislav-the-virgin-hostile-operation-by-vencislav-bujic-seas-foundation-and-its-network-of-collaborators/ +* https://seas.foundation/en/2018/03/15/155 + diff --git a/incidents/I00009.md b/incidents/I00009.md new file mode 100644 index 0000000..5d347a9 --- /dev/null +++ b/incidents/I00009.md @@ -0,0 +1,76 @@ +# PhilippinesExpert + +* Type: incident + +* Name: PhilippinesExpert + +* Id: I00009 + +* Summary: President of the Philippine visited Moscow and forged ties on information strategy in 2017, and afterwards a series of disinformation campaign was noted in Philippine social media and mainstream media, mostly in favor of Philippine president and promoting Russian propaganda. Among this is the appearance of an unknown-before expert on global affairs who was cited frequently in Russian IRA-connected outlets. + +* Year started: 2017.0 + +* From country / To country: Russia / Philippines + +* Found via: nan + +* Date added: 2019-02-24 + +* Techniques used: + +| Technique | Description given for this incident | +| --------- | ------------------------- | +| [T0007 Create fake Social Media Profiles / Pages / Groups](../techniques/T0007.md) | I00009T003 FB pages | +| [T0019 Generate information pollution](../techniques/T0019.md) | I00009T002 RT & Sputnik generate information pollution | +| [T0045 Use fake experts](../techniques/T0045.md) | I00009T001 Using "expert" | +| [T0052 Tertiary sites amplify news](../techniques/T0052.md) | I00009T004 News circulated/amplifed by tertiary sites (Russia Insider, The Duran, Geopolitica.ru, Mint Press News, Oriental Review, globalresearch.ca) | +| [T0056 Dedicated channels disseminate information pollution](../techniques/T0056.md) | I00009T002 RT & Sputnik generate information pollution | + +DO NOT EDIT ABOVE THIS LINE - PLEASE ADD NOTES BELOW + +Suspected actors: + +* Attacker: IRA or more broadly Russian state-sponsored disinformation campaign. +* Amplifiers: through the persona of “Adam Garrie” (who first appeared on RT (Russian Today) and pro-Russia sites, with no background in Asia and Philippine affairs but suddenly rose to become a global affairs expert). +* Garrie was then promoted by pro-Duterte officials, social media pages and news outlets. + +Timeframe: After Putin and Philippine’s president Duterte met in Russia in May 2017 and forged a partnership in information dissemination. Duterte and Putin signed a number of national security agreements, including a deal on intelligence sharing, an “MOU on Cooperation in Mass Communications.” + +Date: 2017- ongoing + +Presumed goals: + +* To spread pro-Duterte and Russian propaganda through collaborative effort of both Philippine and Russian disinformation actors. + +Method: + +* Footprint of Garrie on the Philippine media scene started from his connection with Russian IRA websites and pages (GI Analytics Facebook page, Russia Insider, The Duran, Geopolitica.ru, Mint Press News, Oriental Review, globalresearch.ca.) + +* RT, one of media outlets that interviewed Garrie, was identified by the US Office of the Director of National Intelligence in January 2017 as the primary source of propaganda that the Russians used to further their interests in the 2016 US elections. + +* Also has appearance on Iran’s IRIB (Islamic Republic of Iran Broadcasting), which was identified by the US Department of the Treasury in 2013 as a network that broadcasts false reports and forced confessions of political detainees and has ties with “politically motivated phishing” accounts on Google. + +* The Daily Sentry, a Philippine news site emerged at the start of 2018 (no ownership information), started citing Adam Garrie as a global expert after Philippine-Russian ties grew stronger. Between Feb 2018 and Jan 2019, The Daily Sentry cited Garrie in 41% of posts on Facebook that mentioned experts. + +* By March 2018, Garrie started to come to the mainstream: The Manila Times – a supporter outlet of the Philippine president, cited by pro-Duterte social media pages. + +* Philippine online groups and pages began to spread Russian propaganda. Some sites link to Duterte officials and supporters including Duterte’s former assistant secretary. For example, Duterte’s former assistant secretary shared content from Trending News Portal site. + +Counters: + +* Facebook took down 220 pages and 73 Philippine accounts for spam, including pages of The Daily Sentry and its affiliates, TNP page and related pages. + +Related incidents: + +References: + +* http://www.interaksyon.com/breaking-news/2017/05/30/75431/ph-russia-communication-offices-to-partner-in-info-dissemination/ +* https://www.rappler.com/nation/188378-ph-russia-sign-bilateral-agreements +* https://www.dni.gov/files/documents/ICA_2017_01.pdf +* +* https://codastory.com/disinformation/how-a-little-known-pro-kremlin-analyst-became-a-philippine-expert-overnight/ +* https://www.rappler.com/technology/social-media/220741-facebook-remove-trending-news-portal-twinmark-media-enterprises +* https://www.rappler.com/thought-leaders/221422-facebook-maria-ressa-rappler-philippines +* https://www.rappler.com/nation/194814-maria-ressa-pcoo-training-china-russia +* http://www.interaksyon.com/breaking-news/2017/05/30/75431/ph-russia-communication-offices-to-partner-in-info-dissemination/ + diff --git a/incidents/I00010.md b/incidents/I00010.md new file mode 100644 index 0000000..2477754 --- /dev/null +++ b/incidents/I00010.md @@ -0,0 +1,80 @@ +# ParklandTeens + +* Type: incident + +* Name: ParklandTeens + +* Id: I00010 + +* Summary: IRA trolls amplified the far right messaging around the attack. Most notably they amplified social media speculation that many of the teens involved were “crisis actors” nefariously injected into the conversation by outside actors with an anti-gun poltical agenda. Other amplifications included ongoing harassment of survivors and claims that the event is a hoax from the right; and fatalist cynicism about gun reform from the left. + +* Year started: 2018.0 + +* From country / To country: ?? / USA + +* Found via: nan + +* Date added: 2019-02-01 + +* Techniques used: + +| Technique | Description given for this incident | +| --------- | ------------------------- | +| [T0007 Create fake Social Media Profiles / Pages / Groups](../techniques/T0007.md) | I00010T005 FB pages/groups/profiles | +| [T0010 Cultivate ignorant agents](../techniques/T0010.md) | I00010T004 cultivate, manipulate, exploit useful idiots (Alex Jones... drives conspiracy theories; false flags, crisis actors) | +| [T0020 Trial content](../techniques/T0020.md) | I00010T007 4Chan/8Chan - trial content | +| [T0031 YouTube](../techniques/T0031.md) | I00010T006 YouTube; Reddit | +| [T0032 Reddit](../techniques/T0032.md) | I00010T006 YouTube; Reddit | +| [T0039 Bait legitimate influencers](../techniques/T0039.md) | I00010T008 journalist/media baiting | +| [T0046 Search Engine Optimization](../techniques/T0046.md) | I00010T003 SEO optimisation/manipulation ("key words") | +| [T0053 Twitter trolls amplify and manipulate](../techniques/T0053.md) | I00010T002 Twitter trolls amplify & manipulate | +| [T0054 Twitter bots amplify](../techniques/T0054.md) | I00010T001 Twitter bots amplify & manipulate | + +DO NOT EDIT ABOVE THIS LINE - PLEASE ADD NOTES BELOW + +Actors: IRA, Alex Jones, far right and far left trolls + +Timeframe: Ongoing + +Date: February 2018 + +Presumed goals: Divide the American public on the issues of guns, race, generational politics and activism + +Method: Amplification via sockpuppet and cyborg accounts + +Counters: None / Media exposure + +Related incidents: + +* Sandy Hook hoaxers / Sandy Hook fatalists + +References + +* [How Russian trolls exploited Parkland mass shooting on social media](https://www.politifact.com/truth-o-meter/article/2018/feb/22/how-russian-trolls-exploited-parkland-mass-shootin/) +* [PRO-GUN RUSSIAN BOTS FLOOD TWITTER AFTER PARKLAND SHOOTING](https://www.wired.com/story/pro-gun-russian-bots-flood-twitter-after-parkland-shooting/) +* [Russian trolls flood Twitter after Parkland shooting](https://www.nbcnews.com/tech/social-media/russian-trolls-flood-twitter-after-parkland-shooting-n848471) +* [Russian Trolls Are Tweeting Propaganda After Stoneman Shooting](http://nymag.com/intelligencer/2018/02/russian-trolls-tweet-propaganda-after-florida-shooting.html) + +Details + +Following the Feb. 14 shooting at Marjory Stoneman Douglas High School that left 17 dead, an army of human-controlled and automated accounts spread related content across Twitter. + +Hamilton 68, a website created by Alliance for Securing Democracy, tracks Twitter activity from accounts it has identified as linked to Russian influence campaigns. As of morning, shooting-related terms dominated the site’s trending hashtags and topics, including Parkland, guncontrolnow, Florida, guncontrol, and Nikolas Cruz, the name of the alleged shooter. Popular trending topics among the bot network include shooter, NRA, shooting, Nikolas, Florida, and teacher. + +According to the German Marshall Fund, which tracks Russian-linked Twitter activity, the following are some of the more popular narratives, themes and articles. +The 'crisis actor' conspiracy +'False flag' and other conspiracy hashtags +Meanwhile, some accounts with large bot followings are already spreading misinformation about the shooter's ties to far-left group Antifa, even though the Associated Press reported that he was a member of a local white nationalist group. +One theory associated with these hashtags is that Marjory Stoneman Douglas High School was targeted because the school’s namesake was opposed to "draining the swamp" of the Florida Everglades. Under this theory, the Parkland shooting was a cryptic message to Trump, who vowed during his campaign to "drain the swamp" in Washington by hollowing out its infrastructure of career politicians, insiders and influence peddlers. +Sowing discord +Experts say the goal of Russian troll propagandists isn't to sway people's opinions in one way or another. Instead, the accounts seek to exploit divisions in order to break down society into smaller, warring groups. Trolls drum up persona accounts on every side of the ideological spectrum and take advantage of high-impact events to spread confusion and disarray. In particular, they're able to take advantage of how Twitter doesn't require users to verify their identity. +Russian accounts boosted erroneous content concerning the motives of the alleged shooter Nikolas Cruz. +According to the German Marshall Fund, one of the top links shared by Russia-linked accounts in the aftermath of the shooting was our 2014 article that largely debunked a statistic cited by pro-gun control group Everytown for Gun Safety. +A survey of tweets using the top hashtags flagged by the Hamilton 68 dashboard showed tweets adamantly in favor of gun control and saying the NRA had taken "blood money." Other tweets attacked liberals, the media and lawmakers. +Another top link shared by the network covers the “deranged” Instagram account of the shooter, showing images of him holding guns and knives, wearing army hats, and a screenshot of a Google search of the phrase “Allahu Akbar.” Characterizing shooters as deranged lone wolves with potential terrorist connections is a popular strategy of pro-gun groups because of the implication that new gun laws could not have prevented their actions. +The use of pro-gun control hashtags like #guncontrolnow, along with the spread of anti-gun control links like the Politifact article, appear at first to show the Russian strategy of promoting discord on both sides of a debate. +In other cases, the bots jump on existing hashtags to take control of the conversation and amplify a message. That’s likely what is happening with the Parkland shooting and the hashtag guncontrolnow. +Public awareness that antagonistic bots flood the Twitter debate hasn’t stopped them from achieving their goals of ratcheting up the vitriol—even amid a live tragedy like the Parkland shooting. The goal, after all, isn't to help one side or the other of the gun control debate win. It's to amplify the loudest voices in that fight, deepening the divisions between us. + +Examples + diff --git a/incidents/I00011.md b/incidents/I00011.md new file mode 100644 index 0000000..04eb35b --- /dev/null +++ b/incidents/I00011.md @@ -0,0 +1,24 @@ +# CovingtonTeen + +* Type: incident + +* Name: CovingtonTeen + +* Id: I00011 + +* Summary: nan + +* Year started: 2019.0 + +* From country / To country: ?? / USA + +* Found via: nan + +* Date added: 2019-02-01 + +* Techniques used: + +| Technique | Description given for this incident | +| --------- | ------------------------- | + +DO NOT EDIT ABOVE THIS LINE - PLEASE ADD NOTES BELOW \ No newline at end of file diff --git a/incidents/I00012.md b/incidents/I00012.md new file mode 100644 index 0000000..bc9beb2 --- /dev/null +++ b/incidents/I00012.md @@ -0,0 +1,24 @@ +# ChinaSmog + +* Type: incident + +* Name: ChinaSmog + +* Id: I00012 + +* Summary: nan + +* Year started: 2011.0 + +* From country / To country: China / China + +* Found via: nan + +* Date added: 2019-02-24 + +* Techniques used: + +| Technique | Description given for this incident | +| --------- | ------------------------- | + +DO NOT EDIT ABOVE THIS LINE - PLEASE ADD NOTES BELOW \ No newline at end of file diff --git a/incidents/I00013.md b/incidents/I00013.md new file mode 100644 index 0000000..f797caf --- /dev/null +++ b/incidents/I00013.md @@ -0,0 +1,24 @@ +# FranceBlacktivists + +* Type: incident + +* Name: FranceBlacktivists + +* Id: I00013 + +* Summary: nan + +* Year started: 2014.0 + +* From country / To country: Russia / France + +* Found via: nan + +* Date added: 2019-02-24 + +* Techniques used: + +| Technique | Description given for this incident | +| --------- | ------------------------- | + +DO NOT EDIT ABOVE THIS LINE - PLEASE ADD NOTES BELOW \ No newline at end of file diff --git a/incidents/I00014.md b/incidents/I00014.md new file mode 100644 index 0000000..dcd7dd7 --- /dev/null +++ b/incidents/I00014.md @@ -0,0 +1,24 @@ +# GiletsJaunePileon + +* Type: incident + +* Name: GiletsJaunePileon + +* Id: I00014 + +* Summary: nan + +* Year started: 2018.0 + +* From country / To country: Russia / France + +* Found via: nan + +* Date added: 2019-02-24 + +* Techniques used: + +| Technique | Description given for this incident | +| --------- | ------------------------- | + +DO NOT EDIT ABOVE THIS LINE - PLEASE ADD NOTES BELOW \ No newline at end of file diff --git a/incidents/I00015.md b/incidents/I00015.md new file mode 100644 index 0000000..10e8f7d --- /dev/null +++ b/incidents/I00015.md @@ -0,0 +1,97 @@ +# ConcordDiscovery + +* Type: incident + +* Name: ConcordDiscovery + +* Id: I00015 + +* Summary: The Office of Special Counsel accused Concord Management (an IRA funder/handler) and its counsel of abusing the discovery process by leaking discovery materials under false pretences: the documents were altered; the documents were portrayed as material obtained by hacking, rather than legal process; the released documents are selected to maximize exposure targets and methods. + +* Year started: 2019.0 + +* From country / To country: Russia / USA + +* Found via: nan + +* Date added: 2019-02-01 + +* Techniques used: + +| Technique | Description given for this incident | +| --------- | ------------------------- | +| [T0025 Leak altered documents](../techniques/T0025.md) | I00015T001 Forge ('release' altered hacked documents) | +| [T0025 Leak altered documents](../techniques/T0025.md) | I00015T002 hack/leak/manipulate/distort | +| [T0039 Bait legitimate influencers](../techniques/T0039.md) | I00015T004 journalist/media baiting | +| [T0044 Seed distortions](../techniques/T0044.md) | I00015T003 Circulate to media via DM, then release publicly | + +DO NOT EDIT ABOVE THIS LINE - PLEASE ADD NOTES BELOW + +Actors: Russian state actors, Concord Management + +Timeframe: Fall 2018 - Winter 2019 + +Date: October 2018 + +Presumed goals: + +* Discredit Mueller findings; +* sow doubt about Russian active measures; +* expose investigatory sources, priorities and methods; + +Method: + +* Release non-public documents with favorable amendments; +* Disguise document provenance as hacking (i.e. revelation); +* Circulate to media via DM, then release publicly + +Counters: + +* Media exposure; +* motions to limit future discovery + +Related incidents: + +* 2016 US election + +References + +* [Document: Concord Management Used Discovery for Disinformation Campaign, Mueller Says](https://www.lawfareblog.com/document-concord-management-used-discovery-disinformation-campaign-mueller-says) +* [Mueller says some private case files were used in 'disinformation campaign' to discredit Russia probe](https://thehill.com/policy/national-security/427723-mueller-says-some-of-his-private-case-files-were-used-in) +* [Mueller says Russians are using his discovery materials in disinformation effort](https://www.nbcnews.com/politics/justice-department/mueller-says-russians-using-his-discovery-materials-disinformation-effort-n964811) +* [Mueller says discovery materials in case against Russian firm were used in a cyber-disinformation campaign](https://www.washingtonpost.com/local/legal-issues/mueller-says-discovery-materials-in-case-against-russian-firm-were-used-in-a-cyber-disinformation-campaign/2019/01/30/9fd60218-24c9-11e9-81fd-b7b05d5bed90_story.html?utm_term=.4b814db9f811) +* [Mueller's Team Questions How Files in Russia Case Ended Up Online](https://www.law.com/nationallawjournal/2019/01/30/muellers-team-questions-how-files-in-russia-case-ended-up-online/?slreturn=20190231112904) +* https://www.documentcloud.org/documents/5700929-Concord-Discovery-Opposition.html + +Details + +The special counsel's office has filed a memorandum in U.S. v. Concord Management and Consulting, LLC in opposition to Concord's motion to disclose documents identified as "sensitive" by the Special Counsel to certain Concord officers and employees. The memo alleges that subsequent investigations into Concord have "revealed that certain non-sensitive discovery materials in the defense’s possession appear to have been altered and disseminated as part of a disinformation campaign" apparently aimed at discrediting the special counsel's investigation into Russian interference in the 2016 U.S. election. + +That discovery — evidence and documents traded between both sides of a lawsuit — appears to have been altered and disseminated as part of a disinformation campaign apparently aimed at discrediting the ongoing investigations in Russian interference in the U.S. political system, according to the documents. + +Prosecutors said sensitive evidence also could reveal government investigative techniques and identify cooperating individuals and companies. + +Concord is among 13 Russian individuals and entities charged last February in connection with Mueller’s probe. Concord is alleged to have funded the operation of the Internet Research Agency, a Russian troll farm that spread divisive content to U.S. audiences on social media as part of broader effort to meddle in the 2016 vote. + +Prosecutors said that some nonpublic files supplied to Concord’s defense attorneys were apparently altered and disseminated using the Twitter account @HackingRedstone, which has since been suspended on the platform. + +On Thursday, Mueller's team updated their filing with precise dates for the actions taken on Twitter, noting that the account @HackingRedstone started sending direct messages to members of the media on October 22, before making a public tweet on October 30 in regards to the supposed discovery documents. + +The filing cites an Oct. 22, 2018, tweet in which the account claimed, “We’ve got access to the Special Counsel Mueller’s probe database as we hacked Russian server with info from the Russian troll case Concord LLC v. Mueller. You can view all the files Mueller had about the IRA and Russia collusion. Enjoy the reading!” + +The tweet linked to a webpage with folders containing scores of files that mimicked names and folder structures of materials produced by the special counsel’s office in discovery, the filing states. + +The prosecutors’ filing said the matching files included images of political memes from Facebook and other social media accounts used online by the Internet Research Agency, many of which are presumably still available elsewhere on the Internet, but not with the unique identifiers used in materials turned over by prosecutors. + +Prosecutors said in their filing that an FBI review found no evidence of a hack of the special counsel’s office. The filing also said that defense lawyers told the Mueller team that the vendor it was using reported no unauthorized access to the nonsensitive files. Under a court protective order, sensitive evidence in the case must be reviewed by a U.S. government “firewall” counsel, and then a judge must give permission before the evidence can be given to any non-U.S. national. + +The facts “establish that the person(s) who created the Web page had access to at least some of the nonsensitive discovery produced by the government in this case,” wrote Justice Department national security division attorney Heather N. Alpino for a team including prosecutors with Mueller’s office and the U.S. attorney’s office of the District. + + +Mueller’s team firmly pushed back on the request in the filing Wednesday, asserting releasing the files to the firm’s employees in Russia – including Prigozhin – would risk U.S. national security. + +“Concord’s request to send the discovery to the Russian Federation unreasonably risks the national security interests of the United States,” the filing states. “The government’s concerns are only heightened by the apparent release and manipulation of information produced to Concord as ‘non-sensitive’ discovery in this case.” + +The filing also notes that the discovery files labeled "sensitive" identify "uncharged individuals" who government investigators believe are "continuing to engage in operations to interfere with lawful U.S. government functions like those activities charged in the indictment.” + +Mueller’s prosecutors did not oppose allowing Concord employees to view the files at their defense attorney’s offices under security protections, noting that “appearance in the United States would allow them to stand trial.” diff --git a/incidents/I00016.md b/incidents/I00016.md new file mode 100644 index 0000000..9d40a7f --- /dev/null +++ b/incidents/I00016.md @@ -0,0 +1,24 @@ +# LithuanianElves + +* Type: campaign + +* Name: LithuanianElves + +* Id: I00016 + +* Summary: nan + +* Year started: 2014.0 + +* From country / To country: Russia / Lithuania + +* Found via: nan + +* Date added: 2019-02-01 + +* Techniques used: + +| Technique | Description given for this incident | +| --------- | ------------------------- | + +DO NOT EDIT ABOVE THIS LINE - PLEASE ADD NOTES BELOW \ No newline at end of file diff --git a/incidents/I00017.md b/incidents/I00017.md new file mode 100644 index 0000000..86aaf32 --- /dev/null +++ b/incidents/I00017.md @@ -0,0 +1,66 @@ +# US presidential elections + +* Type: campaign + +* Name: US presidential elections + +* Id: I00017 + +* Summary: Make Clinton look bad or unpopular, and Trump look good over a long period, to change individuals’ voting intentions. + +* Year started: 2016.0 + +* From country / To country: Russia / USA + +* Found via: OII + +* Date added: 2019-02-24 + +* Techniques used: + +| Technique | Description given for this incident | +| --------- | ------------------------- | +| [T0007 Create fake Social Media Profiles / Pages / Groups](../techniques/T0007.md) | I00017T005 Fake FB groups + dark content | +| [T0010 Cultivate ignorant agents](../techniques/T0010.md) | I00017T009 cultivate, manipulate, exploit useful idiots | +| [T0016 Clickbait](../techniques/T0016.md) | I00017T014 Click-bait (economic actors) fake news sites (ie: Denver Guardian; Macedonian teens) | +| [T0018 Paid targeted ads](../techniques/T0018.md) | I00017T004 Targeted FB paid ads | +| [T0019 Generate information pollution](../techniques/T0019.md) | I00017T008 RT & Sputnik generate information pollution | +| [T0020 Trial content](../techniques/T0020.md) | I00017T011 4Chan/8Chan - trial content | +| [T0021 Memes](../techniques/T0021.md) | I00017T013 Memes... anti-immigration; euroskepticism; fear, outrage, conspiracy narratives | +| [T0025 Leak altered documents](../techniques/T0025.md) | I00017T001 hack/leak/manipulate/distort | +| [T0029 Manipulate online polls](../techniques/T0029.md) | I00017T007 manipulate social media "online polls"? | +| [T0030 Backstop personas](../techniques/T0030.md) | I00017T015 Backstop personas | +| [T0031 YouTube](../techniques/T0031.md) | I00017T010 YouTube; Reddit; (Instagram, LinkedIn; Pinterest; WhatsApp?) | +| [T0032 Reddit](../techniques/T0032.md) | I00017T010 YouTube; Reddit; (Instagram, LinkedIn; Pinterest; WhatsApp?) | +| [T0033 Instagram](../techniques/T0033.md) | I00017T010 YouTube; Reddit; (Instagram, LinkedIn; Pinterest; WhatsApp?) | +| [T0034 LinkedIn](../techniques/T0034.md) | I00017T010 YouTube; Reddit; (Instagram, LinkedIn; Pinterest; WhatsApp?) | +| [T0035 Pinterest](../techniques/T0035.md) | I00017T010 YouTube; Reddit; (Instagram, LinkedIn; Pinterest; WhatsApp?) | +| [T0036 WhatsApp](../techniques/T0036.md) | I00017T010 YouTube; Reddit; (Instagram, LinkedIn; Pinterest; WhatsApp?) | +| [T0046 Search Engine Optimization](../techniques/T0046.md) | I00017T012 SEO optimisation/manipulation ("key words") | +| [T0053 Twitter trolls amplify and manipulate](../techniques/T0053.md) | I00017T003 Twitter trolls amplify & manipulate | +| [T0054 Twitter bots amplify](../techniques/T0054.md) | I00017T002 Twitter bots amplify & manipulate | +| [T0056 Dedicated channels disseminate information pollution](../techniques/T0056.md) | I00017T008 RT & Sputnik generate information pollution | +| [T0057 Organise remote rallies and events](../techniques/T0057.md) | I00017T006 Digital to physical "organize+promote" rallies & events | + +DO NOT EDIT ABOVE THIS LINE - PLEASE ADD NOTES BELOW + +Actor: IRA + +Timeframe: 2 years + +Date: December 2015 - 2017 + +Presumed goals: “Russia’s goals were to undermine public faith in the US democratic process, denigrate Secretary Clinton, and harm her electability and potential presidency” - James Clapper + +Method: + +* Facebook ads promoting minor candidates (Jill Stein) + +References: +* https://medium.com/dfrlab/electionwatch-beyond-russian-impact-2f5777677cc0 +* https://www.thedailybeast.com/exclusive-secret-documents-from-russias-election-trolls-leak + +Notes: + +DailyBeast article gives sizings and method - 80 people on this. If they were working 8-6, that gives us a sizing on how much trolling they could do. + diff --git a/incidents/I00018.md b/incidents/I00018.md new file mode 100644 index 0000000..4b8c0a2 --- /dev/null +++ b/incidents/I00018.md @@ -0,0 +1,24 @@ +# DNC email leak incident + +* Type: tactic + +* Name: DNC email leak incident + +* Id: I00018 + +* Summary: nan + +* Year started: 2016.0 + +* From country / To country: Russia / USA + +* Found via: OII + +* Date added: 2019-02-24 + +* Techniques used: + +| Technique | Description given for this incident | +| --------- | ------------------------- | + +DO NOT EDIT ABOVE THIS LINE - PLEASE ADD NOTES BELOW \ No newline at end of file diff --git a/incidents/I00019.md b/incidents/I00019.md new file mode 100644 index 0000000..d75ce87 --- /dev/null +++ b/incidents/I00019.md @@ -0,0 +1,47 @@ +# MacronTiphaine + +* Type: incident + +* Name: MacronTiphaine + +* Id: I00019 + +* Summary: Far-right trolls on 4chan and Twitter spreading misinformation about French candidate Macron and spur support for rival candidate Le Pen. + +* Year started: 2017.0 + +* From country / To country: unknown / France + +* Found via: OII + +* Date added: 2019-02-24 + +* Techniques used: + +| Technique | Description given for this incident | +| --------- | ------------------------- | + +DO NOT EDIT ABOVE THIS LINE - PLEASE ADD NOTES BELOW + +Actor: + +* individual accounts on 4chan (IP addresses indicate locations of Sweden, US, France), +* accounts on Twitter (both identifiable and anonymous). + +Timeframe: a few days + +Date: few hours after Macron and Le Pen were declared winners of the first round of France’s presidential election (April 23, 2017). + +Presumed goals: creating and spreading hoaxes and misinformation related to Macron’s personal life, marriage, sexuality, position on terrorism, etc. to spur support for Le Pen in the second round of voting. + +Method: posts and memes started on 4chan and later shared in Twitter + +Counters: no actions noted. + +Related incidents: + +* #MacronGate and #MacronCacheCash: fake documents on 4chan about Macron’s alleged offshore account. + +References: +* https://www.buzzfeednews.com/article/ryanhatesthis/heres-how-far-right-trolls-are-spreading-hoaxes-about +* https://www.niemanlab.org/2018/09/how-france-beat-back-information-manipulation-and-how-other-democracies-might-do-the-same/ diff --git a/incidents/I00020.md b/incidents/I00020.md new file mode 100644 index 0000000..2985d80 --- /dev/null +++ b/incidents/I00020.md @@ -0,0 +1,24 @@ +# 3000 tanks + +* Type: incident + +* Name: 3000 tanks + +* Id: I00020 + +* Summary: nan + +* Year started: 2017.0 + +* From country / To country: Russia / World + +* Found via: OII + +* Date added: 2019-02-24 + +* Techniques used: + +| Technique | Description given for this incident | +| --------- | ------------------------- | + +DO NOT EDIT ABOVE THIS LINE - PLEASE ADD NOTES BELOW \ No newline at end of file diff --git a/incidents/I00021.md b/incidents/I00021.md new file mode 100644 index 0000000..e75b0eb --- /dev/null +++ b/incidents/I00021.md @@ -0,0 +1,24 @@ +# Armenia elections + +* Type: campaign + +* Name: Armenia elections + +* Id: I00021 + +* Summary: nan + +* Year started: 2017.0 + +* From country / To country: Russia / Armenia + +* Found via: OII + +* Date added: 2019-02-24 + +* Techniques used: + +| Technique | Description given for this incident | +| --------- | ------------------------- | + +DO NOT EDIT ABOVE THIS LINE - PLEASE ADD NOTES BELOW \ No newline at end of file diff --git a/incidents/I00022.md b/incidents/I00022.md new file mode 100644 index 0000000..bc60077 --- /dev/null +++ b/incidents/I00022.md @@ -0,0 +1,63 @@ +# #Macronleaks + +* Type: incident + +* Name: #Macronleaks + +* Id: I00022 + +* Summary: Countering the spreading of an alleged 9GB of “leaked”, fake documents of Macron campaign + +* Year started: 2017.0 + +* From country / To country: Russia / France + +* Found via: OII + +* Date added: 2019-02-24 + +* Techniques used: + +| Technique | Description given for this incident | +| --------- | ------------------------- | +| [T0007 Create fake Social Media Profiles / Pages / Groups](../techniques/T0007.md) | I00022T004 Fake FB groups/pages/profiles + dark content | +| [T0025 Leak altered documents](../techniques/T0025.md) | I00022T001 hack/leak/manipulate/distort | +| [T0053 Twitter trolls amplify and manipulate](../techniques/T0053.md) | I00022T003 Twitter trolls amplify & manipulate | +| [T0054 Twitter bots amplify](../techniques/T0054.md) | I00022T002 Twitter bots amplify & manipulate | + +DO NOT EDIT ABOVE THIS LINE - PLEASE ADD NOTES BELOW + +Actor: + +* 4chan user with Latvian IP address, +* pro-Trump Twitter accounts + +Timeframe: a few days + +Date: Two days before the second round of French 2017 election (May 5, 2017) + +Presumed goals: sabotaging Macron campaign in the last stage of the election. + +Method: + +* Hashtag campaign: #MacronLeaks with use of bots. +* Hashtags initially launched in the US, then got publicized by alt-right influencer, Le Pen’s supporters, Wikileaks. + +Counters: + +* French agencies that monitor cybersecurity, electoral integrity. +* Technical precautions: ending e-voting. +* Facebook removed 70,000 suspicious accounts in France 10 days before the vote. +* Campaign staff responding to social media posts and comments. +* Technically, placing traps along the way, using fake passwords, email addresses, documents to trap hackers. +* Stop offering press credentials to propaganda outlets. +* Use encrypted apps for confidential communication. +* Requesting the media not to report false information. + +Related incidents: + +References: + +* https://www.niemanlab.org/2018/09/how-france-beat-back-information-manipulation-and-how-other-democracies-might-do-the-same/ +* https://www.buzzfeednews.com/article/ryanhatesthis/heres-how-far-right-trolls-are-spreading-hoaxes-about +* https://medium.com/dfrlab/hashtag-campaign-macronleaks-4a3fb870c4e8 diff --git a/incidents/I00023.md b/incidents/I00023.md new file mode 100644 index 0000000..2fd74a5 --- /dev/null +++ b/incidents/I00023.md @@ -0,0 +1,24 @@ +# #dislikemacron + +* Type: incident + +* Name: #dislikemacron + +* Id: I00023 + +* Summary: nan + +* Year started: 2017.0 + +* From country / To country: Russia / France + +* Found via: OII + +* Date added: 2019-02-24 + +* Techniques used: + +| Technique | Description given for this incident | +| --------- | ------------------------- | + +DO NOT EDIT ABOVE THIS LINE - PLEASE ADD NOTES BELOW \ No newline at end of file diff --git a/incidents/I00024.md b/incidents/I00024.md new file mode 100644 index 0000000..f98263b --- /dev/null +++ b/incidents/I00024.md @@ -0,0 +1,24 @@ +# #syriahoax + +* Type: incident + +* Name: #syriahoax + +* Id: I00024 + +* Summary: nan + +* Year started: 2017.0 + +* From country / To country: Syria / USA + +* Found via: OII + +* Date added: 2019-02-24 + +* Techniques used: + +| Technique | Description given for this incident | +| --------- | ------------------------- | + +DO NOT EDIT ABOVE THIS LINE - PLEASE ADD NOTES BELOW \ No newline at end of file diff --git a/incidents/I00025.md b/incidents/I00025.md new file mode 100644 index 0000000..b363d7e --- /dev/null +++ b/incidents/I00025.md @@ -0,0 +1,67 @@ +# EU Army + +* Type: incident + +* Name: EU Army + +* Id: I00025 + +* Summary: Traces back to 2016: Guardian “Is there a secret plan to create an EU army?” French President Emmanuel Macron has warned that Europeans cannot be protected without a "true, European army", as he marks the centenary of the World War One Armistice. On a visit to the former Western Front in Verdun, he said Russia had shown it could be a threat and Europe had to be able "to defend itself better alone". German Chancellor Angela Merkel backed the idea of an intervention force in June, but said it would have to be part of "the structure of defence co-operation". + +Verdict: “An EU army marching out to war under Brussels’ command is a fantasy shared by Eurosceptics and a small number of federalists. Europe will continue down the road of defence cooperation in a halting way, but an EU army is only for armchair generals.” + +* Year started: 2018.0 + +* From country / To country: Russia / EU + +* Found via: OII + +* Date added: 2019-02-24 + +* Techniques used: + +| Technique | Description given for this incident | +| --------- | ------------------------- | + +DO NOT EDIT ABOVE THIS LINE - PLEASE ADD NOTES BELOW + +Actor: Russia + +Timeframe: November 6, 2018 - end of November 2018 + +Date: November 6, 2018 + +Presumed goals: + +* Include - Leave campaigners have claimed that the UK would be forced into an ‘EU army’ under the rules allowing for these activities. https://fullfact.org/europe/hunt-eu-army/ +* Baltic states are frightened by the single European army. The new European security system will be anti-American. To the leadership of the Baltic states, based on Russophobia, this doesn’t look good. + +Method: + +* “Limited” engagement & channels. In this case Reddit was key forum. +* Could not find examples of engagement from “usual suspects” ie: Russian embassy; military or broad mentions via RT & Sputnik + +Counters: + +Related incidents: + +References: + +* https://www.theguardian.com/politics/2016/may/27/is-there-a-secret-plan-to-create-an-eu-army +* https://medium.com/dfrlab/spread-it-on-reddit-3170a463e787 +* https://www.atlanticcouncil.org/blogs/new-atlanticist/a-european-army-eminently-defensible-but-not-probable-for-a-long-time-to-come +* https://www.bbc.com/news/world-europe-46108633 +* https://www.politico.eu/article/angela-merkel-emmanuel-macron-eu-army-to-complement-nato/ +* https://euvsdisinfo.eu/report/baltic-states-frightened-by-the-single-european-army/ +* https://www.theguardian.com/commentisfree/2019/jan/25/brexiters-european-army-myths-franco-german +* https://fullfact.org/europe/hunt-eu-army/ +* https://www.theguardian.com/politics/2016/may/27/is-there-a-secret-plan-to-create-an-eu-army + + +Datasets: + +Notes: +Worth noting the Breitbart commentary (see visual assets); compared to campaigns against NATO for instance, this incident didn’t seemingly have much traction/momentum, and seemed more of a potential wedge for the pro-Brexit audience. + +Visual Assets + diff --git a/incidents/I00026.md b/incidents/I00026.md new file mode 100644 index 0000000..5c5f4c2 --- /dev/null +++ b/incidents/I00026.md @@ -0,0 +1,24 @@ +# Netherlands referendum on Ukraine + +* Type: incident + +* Name: Netherlands referendum on Ukraine + +* Id: I00026 + +* Summary: nan + +* Year started: 2016.0 + +* From country / To country: Russia / Netherlands + +* Found via: OII + +* Date added: 2019-02-24 + +* Techniques used: + +| Technique | Description given for this incident | +| --------- | ------------------------- | + +DO NOT EDIT ABOVE THIS LINE - PLEASE ADD NOTES BELOW \ No newline at end of file diff --git a/incidents/I00027.md b/incidents/I00027.md new file mode 100644 index 0000000..0ac8543 --- /dev/null +++ b/incidents/I00027.md @@ -0,0 +1,24 @@ +# crucifiedboy + +* Type: incident + +* Name: crucifiedboy + +* Id: I00027 + +* Summary: nan + +* Year started: 2014.0 + +* From country / To country: Russia / Ukraine + +* Found via: OII + +* Date added: 2019-02-24 + +* Techniques used: + +| Technique | Description given for this incident | +| --------- | ------------------------- | + +DO NOT EDIT ABOVE THIS LINE - PLEASE ADD NOTES BELOW \ No newline at end of file diff --git a/incidents/I00028.md b/incidents/I00028.md new file mode 100644 index 0000000..5d5cef8 --- /dev/null +++ b/incidents/I00028.md @@ -0,0 +1,24 @@ +# mh17 downed + +* Type: incident + +* Name: mh17 downed + +* Id: I00028 + +* Summary: nan + +* Year started: 2014.0 + +* From country / To country: Russia / Ukraine + +* Found via: OII + +* Date added: 2019-02-24 + +* Techniques used: + +| Technique | Description given for this incident | +| --------- | ------------------------- | + +DO NOT EDIT ABOVE THIS LINE - PLEASE ADD NOTES BELOW \ No newline at end of file diff --git a/incidents/I00029.md b/incidents/I00029.md new file mode 100644 index 0000000..ae3885a --- /dev/null +++ b/incidents/I00029.md @@ -0,0 +1,121 @@ +# MH17 investigation + +* Type: campaign + +* Name: MH17 investigation + +* Id: I00029 + +* Summary: Since the shooting down of Malaysia Airlines Flight 17 (MH17) a scheduled passenger flight from Amsterdam to Kuala Lumpur on 17 July 2014 while flying over eastern Ukraine, killing all 283 passengers and 15 crew on board… wreckage of the aircraft fell near Hrabove in Donetsk Oblast, Ukraine, 40 km (25 mi) from the border.The shoot-down occurred in the War in Donbass, during the Battle of Shakhtarsk, in an area controlled by pro-Russian rebels. This has proven to be an ongoing example of Russia and their proxies ability to wage a disinformation campaign, and exemplify the use of the 4 D’s (dismiss, distort, distract, and dismay) + +* Year started: 2016.0 + +* From country / To country: Russia / Ukraine + +* Found via: OII + +* Date added: 2019-02-24 + +* Techniques used: + +| Technique | Description given for this incident | +| --------- | ------------------------- | +| [T0001 5Ds (dismiss, distort, distract, dismay, divide)](../techniques/T0001.md) | I00029T003 4 D's (dismiss, distort, distract, dismay...Official channels ie: Embassies & Defence Ministry; TASS | +| [T0010 Cultivate ignorant agents](../techniques/T0010.md) | I00029T005 cultivate, manipulate, exploit useful idiots | +| [T0019 Generate information pollution](../techniques/T0019.md) | I00029T004 RT & Sputnik generate information pollution (synthetic media) | +| [T0031 YouTube](../techniques/T0031.md) | I00029T008 YouTube; Reddit; | +| [T0032 Reddit](../techniques/T0032.md) | I00029T008 YouTube; Reddit; | +| [T0040 Demand unsurmountable proof](../techniques/T0040.md) | I00029T009 Demand insurmountable proof | +| [T0046 Search Engine Optimization](../techniques/T0046.md) | I00029T006 SEO optimisation/manipulation ("key words") | +| [T0052 Tertiary sites amplify news](../techniques/T0052.md) | I00029T007 News circulated/amplifed by tertiary sites (Russia Insider, The Duran, Geopolitica.ru, Mint Press News, Oriental Review, globalresearch.ca) | +| [T0053 Twitter trolls amplify and manipulate](../techniques/T0053.md) | I00029T002 Twitter trolls amplify & manipulate | +| [T0054 Twitter bots amplify](../techniques/T0054.md) | I00029T001 Twitter bots amplify & manipulate | +| [T0056 Dedicated channels disseminate information pollution](../techniques/T0056.md) | I00029T004 RT & Sputnik generate information pollution (synthetic media) | + +DO NOT EDIT ABOVE THIS LINE - PLEASE ADD NOTES BELOW + +Actor: Russia + +Timeframe: July 2014 - still active + +Date: July 17, 2014 + +Presumed goals: + +* Ongoing campaign to discredit/undermine Ukraine & NATO & Democracy + +Method: + +* Multi-pronged media & source driven campaign… ie: +* Russian state sources military, embassy, media (RT, Sputnik, TASS); +* Kremlin’s “witting idiots” ie: 21Wire, Global research; trolls & bots. +* “All” media platforms… ie: Youtube; Twitter; Reddit +* See collection of visual assets + +Counters: + +* Bellingcat; Dutch gov’t, DFRLab + +Related incidents: + +* Anything related to Ukraine +* Donetsk +* Crimea +* Sea of Azov +* Ukrainian election (2019) + +References: + +* [Bellingcat (collection of related investigations)](https://www.bellingcat.com/?s=MH17) +Ie: [“The Kremlin’s Shifting, Self-Contradicting Narratives on MH17”](https://www.bellingcat.com/news/uk-and-europe/2018/01/05/kremlins-shifting-self-contradicting-narratives-mh17/) + +* [DFRLab MH17 4D's "playbook"](https://medium.com/dfrlab/putinatwar-dismissing-mh17-8268d2968b9) +* [In social networks on the fingers showed how the Kremlin bots work](https://news.online.ua/754036/v-sotssetyah-na-paltsah-pokazali-kak-rabotayut-boty-kremlya-opublikovany-foto/): +“Censoring” the news (Facebook page “takedown”) [Facebook blocked Sergey Parkhomenko for commenting on the report of the downed "Boeing"](https://www.novayagazeta.ru/news/2015/05/07/112052-facebook-zablokiroval-sergeya-parhomenko-za-kommentariy-doklada-o-sbitom-171-boinge-187%20) +* [The most comprehensive guide ever to MH17 conspiracies](http://euromaidanpress.com/2015/10/14/confuse-and-obfuscate-the-most-comprehensive-guide-ever-to-mh17-conspiracies/) + +* http://tass.com/world/1050324 +* https://www.mirror.co.uk/news/world-news/ukraine-involved-mh17-downing-claims-14184413 +* https://www.bellingcat.com/resources/case-studies/2014/07/17/geolocating-the-missile-launcher-linked-to-the-downing-of-mh17/ +* https://globalnews.ca/news/4993120/russia-rising-part-5-maskirovka/ +* http://euromaidanpress.com/2018/12/06/ukraine-related-narratives-dominate-russian-propaganda/ + +Datasets: none searched for + +Notes: + +Russia still accusing Ukraine (03.25.2019)... TASS and UK Daily Mirror + +First Bellingcat report: Efforts to Geolocate the Launcher 07/17/14 +Countless example of Elliot Higgins & team getting trolled since, popular hashtag is #bellingcrap + +This is a good summary: +“But not only did Russia fiercely deny those accusations, a number of Russian leaders, officials and broadcasters responded by offering dozens of different alternative explanations, “including quite outlandish theories,” says Nilsson. + +“For instance, that an airplane would’ve been loaded with already dead people and that Ukrainian airplanes would then have shot it down to make it look like Russia was shooting down passenger airplanes,” he explains. + +“There were tons of these stories going around, quite a few of them coming from official Russian sources. And they were not meant to be taken seriously. They were simply supposed to occupy the attention span of the world for a while, to the extent that everyone would lose track of the original explanation, which turned out to be quite the right one.” https://globalnews.ca/news/4993120/russia-rising-part-5-maskirovka/ + +Topics of Ukraine-related narratives +http://euromaidanpress.com/2018/12/06/ukraine-related-narratives-dominate-russian-propaganda/ +Back in 2016, StopFake co-founder Yevhen Fedchenko identified 18 major Ukraine-related fake narrative topics spread by Russian propaganda by analyzing 500 debunked disinformation items. +The Euromaidan Revolution as a “coup d’état“ +Ukraine as a “fascist state“ +Ukraine as a “failed state“ +“Russia is not a part of the occupation/war in Ukraine“ +Discrediting the Ukrainian Armed Forces (UAF) +Discrediting the volunteer battalions (which officially became a part of UAF in 2015) +Donbas and Crimean internally displaced persons (IDPs) and refugees +Territorial disintegration of Ukraine +“Territorial claims” for parts of Ukraine from neighboring Poland, Hungary, Romania, and Slovakia +Fake “international legitimization” of annexation and occupation of Crimea +The war in Ukraine “conducted by the US, NATO or Western private contractors” +The West’s “Ukraine fatigue“ +Manipulating international organizations +Fakes about EU-Ukraine relations +“Decay” of the US and West in general, and the “disintegration of the EU” +Flight MH17 crash fakes +The West “uses biological weapons” in Ukraine +Mix-ups of the fake narratives about Ukraine, Syria, ISIS terrorists (e.g., Crimean Tatars being depicted as jihadists or Ukraine as a training ground for terrorists) +For post-Maidan Ukraine, Russian propaganda’s most used narratives were the Euromaidan as “coup d’etat” which brought a “Western-backed junta” (mostly “US-backed”) to power, and “fascism” as the main ideology of the post-Maidan government, Fedchenko notes. + diff --git a/incidents/I00030.md b/incidents/I00030.md new file mode 100644 index 0000000..ad3a491 --- /dev/null +++ b/incidents/I00030.md @@ -0,0 +1,24 @@ +# LastJedi + +* Type: incident + +* Name: LastJedi + +* Id: I00030 + +* Summary: nan + +* Year started: 2018.0 + +* From country / To country: Russia / World + +* Found via: OII + +* Date added: 2019-02-24 + +* Techniques used: + +| Technique | Description given for this incident | +| --------- | ------------------------- | + +DO NOT EDIT ABOVE THIS LINE - PLEASE ADD NOTES BELOW \ No newline at end of file diff --git a/incidents/I00031.md b/incidents/I00031.md new file mode 100644 index 0000000..cb9a960 --- /dev/null +++ b/incidents/I00031.md @@ -0,0 +1,24 @@ +# antivax + +* Type: apt + +* Name: antivax + +* Id: I00031 + +* Summary: nan + +* Year started: 2018.0 + +* From country / To country: Russia / World + +* Found via: OII + +* Date added: 2019-02-24 + +* Techniques used: + +| Technique | Description given for this incident | +| --------- | ------------------------- | + +DO NOT EDIT ABOVE THIS LINE - PLEASE ADD NOTES BELOW \ No newline at end of file diff --git a/incidents/I00032.md b/incidents/I00032.md new file mode 100644 index 0000000..4ee6250 --- /dev/null +++ b/incidents/I00032.md @@ -0,0 +1,139 @@ +# Kavanaugh + +* Type: incident + +* Name: Kavanaugh + +* Id: I00032 + +* Summary: Before the Senate SCOTUS confirmation hearings of Brett Kavanaugh, professor Christine Blasey Ford--first anonymously, then publicly--accused Kavanaugh of inappropriate or criminal sexual behavior. Amplified by Russian trolls Right wing operatives first tried to doxx Ford, then to discredit her. Many observers suggest that the Kavanaugh hearings were the largest anti-US Russian online operation for months. + +* Year started: 2018.0 + +* From country / To country: Russia / USA + +* Found via: OII + +* Date added: 2019-02-24 + +* Techniques used: + +| Technique | Description given for this incident | +| --------- | ------------------------- | +| [T0007 Create fake Social Media Profiles / Pages / Groups](../techniques/T0007.md) | I00032T003 Fake FB groups/pages/profiles | +| [T0010 Cultivate ignorant agents](../techniques/T0010.md) | I00032T009 cultivate, manipulate, exploit useful idiots (Alex Jones... drives conspiracy theories) | +| [T0019 Generate information pollution](../techniques/T0019.md) | I00032T005 RT & Sputnik generate information pollution | +| [T0020 Trial content](../techniques/T0020.md) | I00032T007 4Chan/8Chan - trial content | +| [T0031 YouTube](../techniques/T0031.md) | I00032T006 YouTube; Reddit; (Instagram, LinkedIn; Pinterest; WhatsApp?) | +| [T0032 Reddit](../techniques/T0032.md) | I00032T006 YouTube; Reddit; (Instagram, LinkedIn; Pinterest; WhatsApp?) | +| [T0033 Instagram](../techniques/T0033.md) | I00032T006 YouTube; Reddit; (Instagram, LinkedIn; Pinterest; WhatsApp?) | +| [T0034 LinkedIn](../techniques/T0034.md) | I00032T006 YouTube; Reddit; (Instagram, LinkedIn; Pinterest; WhatsApp?) | +| [T0035 Pinterest](../techniques/T0035.md) | I00032T006 YouTube; Reddit; (Instagram, LinkedIn; Pinterest; WhatsApp?) | +| [T0036 WhatsApp](../techniques/T0036.md) | I00032T006 YouTube; Reddit; (Instagram, LinkedIn; Pinterest; WhatsApp?) | +| [T0046 Search Engine Optimization](../techniques/T0046.md) | I00032T008 SEO optimisation/manipulation ("key words") | +| [T0053 Twitter trolls amplify and manipulate](../techniques/T0053.md) | I00032T002 Twitter trolls amplify & manipulate | +| [T0054 Twitter bots amplify](../techniques/T0054.md) | I00032T001 Twitter bots amplify & manipulate | +| [T0056 Dedicated channels disseminate information pollution](../techniques/T0056.md) | I00032T005 RT & Sputnik generate information pollution | +| [T0057 Organise remote rallies and events](../techniques/T0057.md) | I00032T004 Digital to physical "organize+promote" rallies & events? | + +DO NOT EDIT ABOVE THIS LINE - PLEASE ADD NOTES BELOW + +Summary: + +Actors: + +* IRA; other Russian state actors; +* Roger Stone, Alex Jones, gamergaters + +Timeframe: Fall 2018 + +Date: September-October 2018 + +Presumed goals: + +* Divide the American public on gender and party lines; Harass and intimidate anti-Trump voices; +* Promote epistemic confusion; +* Seed the narrative terrain for future operations; +* Promote “both sides” relativism; + +Method: + +* Amplify extreme and hyper-partisan rhetoric; +* Promote divisive conspiracy theories; +* Re-up debunked theories in new contexts (e.g. hashtags); +* Re-center debates on emotional, rather than rational, content; +* Alter “ground-truth” resources, such as Wikipedia + +Counters: None / Media exposure + +Related incidents: + +* gamergate; +* 2016 election + +References + +* [Russian trolls and bots are flooding Twitter with Ford-Kavanaugh disinformation](https://qz.com/1409102/russian-trolls-and-bots-are-flooding-twitter-with-ford-kavanaugh-disinformation/) +* [Brett Kavanaugh and the information terrorists trying to reshape America](https://www.wired.com/story/information-terrorists-trying-to-reshape-america/) +* [How the Kavanaugh information war mirrors real warzones](https://www.wired.com/story/how-the-kavanaugh-information-war-mirrors-real-warzones/) +* [How Facebook polarized us during the Kavanaugh hearings](https://www.theverge.com/2018/10/6/17943680/facebook-polarization-kavanaugh-partisan-news-groups) +* [Brett Kavanaugh has huge opposition in the U.S. - but Russian state propaganda loves Donald Trump's nominee](https://www.newsweek.com/brett-kavanaugh-has-huge-opposition-us-russian-state-propaganda-loves-donald-1155046) + +Details + +Last month, the attorney of Christine Blasey Ford, the California professor who has accused Supreme Court nominee Brett Kavanaugh of sexual assault at a long-ago high school party, revealed that Blasey Ford and her family were in hiding and had hired private security after Blasey Ford received death threats over email and social media. Among those cheering on the hate-trollers were many familiar faces from the sewers of the modern far-right disinformation metropolis: dandified Republican rogue (and likely Mueller investigee) Roger Stone, his alt-media protégés Mike Cernovich and Jack Posobiec, anarchist turned Kremlin propaganda employee turned Bernie backer turned Trump backer Cassandra Fairbanks, and breathless Infowars conspiracist-in-chief Alex Jones. And not surprisingly, alt-right super-troll Chuck Johnson had his own connection to players in the scandal. + +This is an operational unit of information terrorists helping to transform the way Americans consume news in the age of Trump—some of the central nodes that give order to the information deluge and around which bot armies and human amplification networks can be organized, wiped out, reconstituted, and armed for attack. + +The attacks on Blasey Ford aimed to discredit and silence her using the same tactics that have been deployed to discredit and silence others over the past few years. As others have come forward to accuse Kavanaugh of wrongdoing—including Deborah Ramirez and Julie Swetnick—they have been similarly harassed and smeared by the same machinery and themes. + +Online Twitter accounts tied to Russia are heavily involved in discussing the Supreme Court nominee and allegations against him online. Hamilton68, a project run by the German Marshall Fund think tank that tracks tweets “tied to Russia-linked influence networks,” listed Kavanaugh, Trump, the FBI, and Ford as the top four topics mentioned by Russia-linked accounts on the evening of Oct.1. + +The Russia-linked accounts are largely lending their support to Kavanaugh, says Jonathon Morgan, CEO of New Knowledge, the company that built the software behind Hamilton68. Morgan, who is currently tracking a set of around 1,000 accounts he believes are tied to Russia, says the Kavanaugh hearings have unleashed more US domestic-focused propaganda from foreign-linked networks than his firm has seen in months. + +Posts about Ford and Kavanaugh are “really cluttered and confused,” with various pieces of clear fabrication from both sides, says Decker. + +The effort to introduce a doppelganger aligned with another key method used in LikeWars around the world: muddying the debate by throwing out alternative theories. Russia has long been the master of this disinformation tactic. After its 2014 shootdown of the MH-17 airliner over Ukraine, for instance, Russia spread over a dozen different theories of what had really happened. Many were contradictory and debunked previous claims. But the goal wasn’t to find the truth—it was to obscure it behind a smokescreen of lies. + +Similarly, the Kavanaugh debate has given rise to false claims and ridiculous photoshopped images, often spread under fake identities. There have been debunked rumors that Kavanaugh had ruled against Ford’s parents in a house foreclosure and that Ford’s brother was part of the Russia investigation. There was even a flurry of unsubstantiated sexual assault charges leveled against Kavanaugh in the hours before the hearing. His supporters were outraged; those opposed to Kavanaugh's nomination speculated that they were placed so that his defenders could point to the media’s unreliability and cast doubt on Ford's credibility. + +The state-funded outlet RT, which was recently obligated to register its U.S. branch under the Foreign Agents Registration Act, trumpeted the news that the White House had found no proof of sexual misconduct by Kavanaugh after reviewing the findings of a time-limited FBI investigation into the allegations. + +The same outlet also called attention to the arrest of several high-profile celebrities, actress and comedian Amy Schumer and model Emily Ratajkowski, who were protesting Kavanaugh’s potential appointment in front of the Supreme Court on Thursday. “Obstruction of Justice?” the outlet asked. + +Pro-Kavanaugh accounts have pushed out false smears aimed at discrediting Ford. One notable anti-Kavanaugh post picked up more than 11,000 retweets while purporting to to cite a Wall Street Journal article that in fact didn’t exist. + +Other accounts are using popular interest in the Ford-Kavanaugh dispute to push unrelated disinformation. A common tactic is to re-up a conspiracy theory or previously debunked story and add tags related to Kavanaugh so the tweet gains more traction. + +Examples include re-circulating debunked sexual assault allegations against Democrats like representative Keith Ellison, senator Cory Booker, and former vice president Joe Biden; or against Republicans like senator Lindsey Graham. “Both sides are coopting matters that may have been killed off and never gained traction, and using the Kavanaugh incident to rehash these different claims,” Decker said. + +Morgan says the Russian bots he’s tracking are largely using this latter method, seemingly with the broad aim of making Kavanaugh seem no worse than Democrats. The approach differs from Russian activity during the 2016 election, where influence campaigns aimed to sow discontent among both liberals and conservatives by pushing propaganda that appealed to both sides. + +This has all taken on a new heady energy as pushback to #MeToo—and riding the coattails of the conspiracy bandwagon. But the intent is the same: to demonize the opponent, define identity, activate the base around emotional rather than rational concepts, and build a narrative that can be used to normalize marginal and radical political views. It is, after all, very convenient to have a narrative positing that all your political opponents are part of a secret cabal of sexual predators, which thus exonerates your side by default. + +Daily Wire’s top story about Kavanaugh confirmation was published Oct. 1 with the headline “Prosecutor Who Questioned Ford Shreds Her Case In Five-Page Memo.” It’s generated more than 205,000 engagements. The site also received just under 180,000 engagements for the story, “Bill Clinton Rape Accuser Juanita Broaddrick Crashes Kavanaugh Hearing, Slams Dems For ‘Biggest Double Standard.’” + +Occupy Democrats’ top story about Kavanaugh-Ford is headlined “Matt Damon just DESTROYED Kavanaugh and Senate Republicans in hilarious SNL cold open.” It had just under 70,000 engagements. Another story about the Kavanaugh confirmation, “Bernie Sanders just demanded the FBI investigate five lies Kavanaugh told at his hearing,” generated over 44,000 engagements. + +This is the ideological landscape that has been so swiftly leveraged in the defense of Brett Kavanaugh. + +The cadre and their followers knew exactly what to do when the allegations made against Kavanaugh by Christine Blasey Ford became public. They did not disappoint. Rapid efforts by far-right blogs and personalities to dox and troll Blasey Ford resulted in the targeting of the wrong Christine Blasey Ford; Posobiec was one of those reportedly amping this misguided doxxing. Cernovich said Blasey Ford was a "far left wing activist" who had been "scrubbing" her social media profile, so her accusations were "activism." Alex Jones made a joke of the whole thing, with Infowars saying Blasey Ford is a "leftist" whose accusations were a "political ploy." Fairbanks: "She can't prove it… Her clothes were on… Fuck that lady." That's a particularly strong comment from a one-time anti-rape activist. Stone: "This is a woman looking for her Anita Hill moment." + +This is the information that flowed through the architecture the Stone cadre popularized and mainstreamed over the past few years, moving it from the fringe to a central pillar of the conservative agenda, cartoonifying legitimate issues of conservative concern and recruiting new supporters as they went. The narrative was set long ago—allegations are false, men (especially white men) are oppressed, the people who stand against you are corrupt perverts worthy of demonization, and everything that is the America you know will fall apart if you don't fight for some notion of the way things were and should be again. And the best way to achieve this, since the system will fight back, is viciousness. + +This architecture is established, and permanently in transmit mode. + +Consider the now-infamous and disavowed (but archived here) Ed Whelan twitter thread, an odd diversionary narrative hyped as an alternate theory of the night Blasey Ford describes. Its gist: mistaken identity of the perpetrator. Potential defamation issues aside, it seemed to build on the groundwork being laid by Senate Republicans and the White House to carefully insinuate that Blasey Ford wasn't lying, merely mistaken about who attacked her. But Whelan transformed it into a bonkers Twitterverse conspiracy theory about the bedroom at the top of the stairs. + +An analysis of the accounts that retweeted Whelan's teaser for his conspiracy most frequently post content from right and far-right media, several of which are anchors in the far-right disinformation ecosphere (and Russian disinformation, to boot). + +Posted for less than 24 hours, Whelan's mistaken-identity theory sparked a wave of blog posts and discussions on far-right sites that live on even after Whelan backed off. This post, for example, repeats Whelan's claims and suggests they all but vindicate Kavanaugh. It was a top-trending piece on disinformation trackers and was still being circulated on Twitter days after the source was deleted. And so was this one, this one, and this one. Some 1.5 million "Fox and Friends" viewers heard all about the mistaken-identity theory live on TV. Once it's out there, you can't pull it back. + +The narratives to defend Kavanaugh were mostly about discrediting Blasey Ford: that she was part of a secret CIA mind-control project (the CIA connection was also alluded to by Kremlin disinformation purveyors); that George Soros was behind her allegations; that her lawyer was linked to Hillary Clinton; that she was motivated by profit; that she did this as revenge for a foreclosure case where Kavanaugh's mother, also a judge, ruled against Blasey Ford's parents (only, she didn't—she ruled in their favor); that she had also made false allegations against Neil Gorsuch; and many more. + +In the course of his angry self-defense, Kavanaugh stamped a lot of bingo squares: attempted rape allegations as a political tool, false allegations, Clinton, secret conspiracies. By going out and taking the big swing, he elicited a powerful emotional response in his defense—an activated response from a hardened base. #ConfirmKavanaugh was trending—with support of far-right and Russian-linked accounts—after the hearing. + +Not even history itself is safe—at least the online version of it, which we increasingly depend on. When Kavanaugh testified that Devil's Triangle, as mentioned on his high school yearbook page, was a drinking game, there was no online evidence to back up his claim. (Other sources asserted it was a known sexual term.) So an anonymous person immediately updated Wikipedia to support Kavanaugh's definition. It was a near perfect parallel to how Russian operatives repeatedly edited the Wikipedia entry for “MH17” in the hours after the airliner was shot down to try to provide an alternative history. + +Examples + diff --git a/incidents/I00033.md b/incidents/I00033.md new file mode 100644 index 0000000..a70dbe2 --- /dev/null +++ b/incidents/I00033.md @@ -0,0 +1,121 @@ +# China 50cent Army + +* Type: apt + +* Name: China 50cent Army + +* Id: I00033 + +* Summary: 50cent Army is a CCP “tool” - “massive secret operation” in China pumping out an estimated 488 million fabricated social media posts per year, part of an effort to “regularly distract the public and change the subject” from any policy-related issues that threaten to anger citizens enough to turn them out onto the streets. But the research finds no evidence these 50-centers are, in fact, paid 50 cents, nor does it find they engage in direct and angry argument with their opponents. Instead, they are mostly bureaucrats already on the public payroll, responding to government directives at a time of heightened tension to flood social media with pro-government cheerleading. + +* Year started: 2014.0 + +* From country / To country: China / China + +* Found via: OII + +* Date added: 2019-02-24 + +* Techniques used: + +| Technique | Description given for this incident | +| --------- | ------------------------- | +| [T0002 Facilitate State Propaganda](../techniques/T0002.md) | I00033T005 facilitate state propaganda and defuse crises | +| [T0047 Muzzle social media as a political force](../techniques/T0047.md) | I00033T004 cow online opinion leaders into submission, muzzling social media as a political force | +| [T0048 Cow online opinion leaders](../techniques/T0048.md) | I00033T004 cow online opinion leaders into submission, muzzling social media as a political force | +| [T0049 Flooding](../techniques/T0049.md) | I00033T001 2,000,000 people (est.) part of state run/sponsored astroturfing | +| [T0050 Cheerleading domestic social media ops](../techniques/T0050.md) | I00033T003 domestic social media influence operations focus primarily on “cheerleading” or presenting or furthering a positive narrative about the Chinese state | +| [T0051 Fabricate social media comment](../techniques/T0051.md) | I00033T002 fabricated social media comment | + +DO NOT EDIT ABOVE THIS LINE - PLEASE ADD NOTES BELOW + +Actor: China + +Timeframe: 2011 + +Date: + +Presumed goals: + +* Commentators’ duty to guide public opinion in a “constructive” way and engage the internet as “an important battlefield of ideology.” The vice minister of public security said that the police should use microblogs as a communication platform to “release correct information and dispel misunderstandings.” +* Accounts describing the operations of progovernment commentators that have emerged in recent years indicate that they are also involved in identifying and recommending content for deletion. Other testimonies highlight the fact that the posts do not only praise or support the CCP and government policy, but also target government critics with negative remarks. Other forms of misdirection involve deliberate attempts to muddy the facts of a particular incident—for example, a false eyewitness can contradict the account of a netizen reporting a case of police abuse. +* The Chinese government has long been suspected of hiring as many as 2,000,000 people to surreptitiously insert huge numbers of pseudonymous and other deceptive writings into the stream of real social media posts, as if they were the genuine opinions of ordinary people. Many academics, and most journalists and activists, claim that these so-called “50c party” posts vociferously argue for the government’s side in political and policy debates. + +Method: + +* Astroturfing: “surreptitiously post large numbers of fabricated social media comments, as if they were the genuine opinions of ordinary Chinese people" +* Cow online opinion leaders into submission +* Bombard Taiwan social media (Facebook, twitter, chat groups) with ani-DPP, anti-Tsai content. + +Counters: + +Related incidents: + +Notes: + +(Recorded Future) The term “Great Firewall” was coined in a June 1997 Wired magazine article in which an anonymous Communist Party official stated that the firewall was “designed to keep Chinese cyberspace free of pollutants of all sorts, by the simple means of requiring ISPs [internet service providers] to block access to ‘problem’ sites abroad.” + +Our research focused on the English-language social media activity of six major state-run propaganda organizations from October 1, 2018 through January 21, 2019, which included over 40,000 posts. We selected these six organizations — Xinhua, People’s Daily, China Global Television (CGTN), China Central Television (CCTV), China Plus News, and the Global Times — because they: Are highly digitized; Possess accounts on multiple English language social media platforms; Are associated with Chinese intelligence agencies and/or English language propaganda systems + +Because our intent was to map out Chinese state-run influence campaigns targeting the American public, we evaluated only English language posts and comments, as the posts in Chinese were unlikely to affect most Americans. Further, our research focused on answering two fundamental questions about Chinese influence operations: Does China employ the same influence tactics in the English-language social media space as it does domestically? How do Chinese state-run influence operations differ from Russian ones? In what ways are they similar and different, and why? + +The information-control regime in China has evolved to include a dizzying array of techniques, technologies, and resources: Blocking traffic via IP address and domain; Mobile application bans; Protocol blocking, specifically Virtual Private Network protocols and applications; Filtering and blocking keywords in domains (URL filtering); Resetting TCP connections; Packet filtering; Distributed denial-of-service (DDoS) attacks (the so-called Great Cannon); Man-in-the-middle (MiTM) attacks; Search engine keyword filtering; Government-paid social media commenters and astroturfers; Social media account blocking, topic filtering, content censorship; State-run media monopoly and censorship; Social Credit System; Mandatory real-name account registration; + +This tool set, combined with the now-ubiquitous mass physical surveillance systems, place China at the forefront of integrating information technology, influence operations, surveillance, and censorship in a model referred to by two scholars from MERICS as “IT-based authoritarianism.” + +In addition to the constraints imposed by the Great Firewall and content censorship, the Chinese state also employs a series of active disinformation and distortion measures to influence domestic social media users. One of the most widely studied has been the so-called “50 Cent Party.” The 50 Cent Party is a group of people hired by the Chinese government to “surreptitiously post large numbers of fabricated social media comments, as if they were the genuine opinions of ordinary Chinese people.” The name is derivative of a rumor that these fake commentators were paid 50 Chinese cents per comment (this has been largely disproven). This fabrication of social media comments and sentiment is largely known by the term “astroturfing.” Among scholars of the Chinese domestic social media environment, there is much disagreement regarding what the goals or objectives of government-paid astroturfers are. One study by professors at Harvard, Stanford, and UC San Diego, published in April 2017, determined that one in every 178 social media posts are fabricated by the government and that comments and campaigns are focused and directed against specific topics or issues. Additionally, these scholars have assessed that domestic social media influence operations focus primarily on “cheerleading” or presenting or furthering a positive narrative about the Chinese state. Conversely, a separate set of scholars at the University of Michigan, who also examined posts from the 50 Cent Party astroturfers, determined that at least one in every six posts on Chinese domestic social media was fabricated by the government. Further, these scholars argued that less than 40 percent of astroturfed comments could be classified as “cheerleading” and that the rest were a combination of vitriol, racism, insults, and rage against events or individuals. They additionally argue that censors and state-sponsored influence campaigns focus much of their resources on “opinion leaders” and users with large numbers of followers as opposed to simply intervening based on content. + + Chinese government has used a combination of muscle and guile to cow online opinion leaders into submission, muzzling social media as a political force, and leaching public dialogue of much of its independence. But beneath the peppy, pablum-filled surface that has resulted, Chinese social media remains a contested space. + +(Taiwan election) Tsai futilely urged Taiwanese citizens to see Beijing’s effort for what it was — a Russian-style influence campaign. The island’s 23 million citizens were bombarded with anti-Tsai and anti-DPP content through Facebook, Twitter and online chat groups, promoted by China’s “50-cent army” of paid social media trolls. There are also dozens of investigations into allegations that Chinese money went to fund Taiwanese candidates opposing Tsai and the DPP. +After the elections, Chinese state media pointed to Tsai’s losses as evidence that her tough stance vis-à-vis China was unpopular and wrongheaded. Beijing’s overall goal is to replace her with a more malleable leader in Taipei as part of its broad effort to exert control over Taiwan and weaken Taipei’s relationships with the international community. +The Chinese government is bribing or coercing foreign governments to break diplomatic relations with Taiwan, pressuring them to evict Taiwan from international organizations. Beijing is also threatening foreign companies unless they literally erase Taiwan from their websites. Their ultimate goal is to dissolve the U.S.-Taiwan partnership and subjugate the island to the People’s Republic of China (PRC). + +There are numerous agencies sponsoring internet commentators, including local propaganda offices, ministries and even schools and state-owned enterprises. For instance, China’s largest oil and gasoline producer, Sinopec, was found to be running an astroturfing campaign justifying rising gasoline prices in 2011 (Wang 2011). +The following excerpt from a recruiting flyer from the Propaganda Department of the Zhengding Party Committee, Hebei, provides an example of what online commentators are expected to do (Zhonggong Zhengding Xianwei Xuanchuanbu 2009): +compose original postings and carry out positive publicity online to promote the priorities and major deployments of the party committee and the government; +release authoritative information on major incidents to hinder the spread of rumours and ensure correct direction of online opinion; +answer questions and clarify confusion for netizens on hotbutton incidents, interpret the policies of and measures taken by the party and the government and divert netizens’ emotions; +strengthen information management on the internet and tightly integrate the analysis of online opinion, disposing of harmful information and guiding online opinion. + +These instructions show that besides monitoring public opinion, the primary mission for online commentators is to facilitate state propaganda and defuse crises. In online propaganda campaigns, commentators work to attract public attention and fabricate an audience, if necessary. + + “American Cent Party” (美分党) who express western democratic values and criticize the Chinese communist regime online, and the “internet water army” (网络水军), which refers to for-hire astroturfers working for and advancing the interests of companies and other actors willing to pay their fees. +Prominent dissident Ai Weiwei said “If you oppose the US and Japan [online], you are a member of the 50 cents army” (Strafella and Berg, 2015). 50c party members “combat hostile energy,” defined as posts that “go against socialist core values,” or “are not amenable to the unity of the people.” Such information should be “resolutely resisted, proactively refuted, and eagerly reported to Internet authorities.” 4 (Haley, 2010). Through active engagement of opposition views, they try to “sway public opinion” (Editors, 2016; Jason Ng, 2011), “influence public opinion. . . pretending to be ordinary citizens and defending or promoting the government’s point of view” (O. Lam, 2013), or “steer conversations in the right direction” (Editors, 2013). Estimates by journalists of the size of the 50c party is between 500,000 to 2 million (Philipp, 2015). + +References: + +* https://www.wired.com/1997/06/china-3/ +* https://en.greatfire.org/analyzer +* https://www.nytimes.com/2017/01/04/business/media/new-york-times-apps-apple-china.html +* https://techcrunch.com/2017/07/29/apple-removes-vpn-apps-from-the-app-store-in-china/ +* https://pdfs.semanticscholar.org/9fc1/d1815a678583c1e73233bb93aaaab7d0fd4f.pdf +* https://www.cl.cam.ac.uk/~rnc1/ignoring.pdf +* https://citizenlab.ca/2015/04/chinas-great-cannon/ +* https://drive.google.com/file/d/1xjHWI0Ih3abONxL0WoXj2swlcBuiRCXO/view +* https://papers.ssrn.com/sol3/Papers.cfm?abstract_id=2738325 +* http://www.spiegel.de/international/world/china-s-xinjiang-province-a-surveillance-state-unlike-any-the-world-has-ever-seen-a-1220174.html +* https://www.merics.org/sites/default/files/2018-07/MPOC_ChinasCoreExecutive_web.pdf +* https://www.freedomhouse.org/template.cfm?page=691&cmb=34#Vice +* http://cmp.hku.hk/2011/05/09/12125 +* http://chinadigitaltimes.net/2008/05/chinese-bloggers-on-the-history-and-influence-of-the-fifty-cent-party/ +* http://gking.harvard.edu/files/gking/files/50c.pdf?m=1463587807 +* http://blakeapm.com/ +* https://www.washingtonpost.com/news/monkey-cage/wp/2017/02/21/can-the-chinese-government-really-control-the-internet-we-found-cracks-in-the-great-firewall/ +* https://drive.google.com/file/d/1xjHWI0Ih3abONxL0WoXj2swlcBuiRCXO/view +* https://foreignpolicy.com/2014/01/30/whisper-together/ +* https://www.nytimes.com/2018/11/22/world/asia/taiwan-elections-meddling.html +* http://www.taipeitimes.com/News/front/archives/2018/10/23/2003702864 +* https://www.aljazeera.com/news/2018/11/news-rattles-taiwan-elections-181123005140173.html +* https://www.reuters.com/article/us-taiwan-politics/china-heaps-pressure-on-taiwan-president-after-poll-defeat-idUSKCN1NV02X +* https://www.washingtonpost.com/opinions/global-opinions/trump-is-failing-to-counter-chinas-diplomatic-assault-on-taiwan/2018/09/06/e744f97c-b20c-11e8-9a6a-565d92a3585d_story.html +* https://www.washingtonpost.com/news/josh-rogin/wp/2018/05/05/white-house-calls-chinas-threats-to-airlines-orwellian-nonsense/ +* https://gking.harvard.edu/files/gking/files/how_the_chinese_government_fabricates_social_media_posts_for_strategic_distraction_not_engaged_argument.pdf +* https://www.voanews.com/a/who-is-that-chinese-troll/3540663.html +* https://journals.sub.uni-hamburg.de/giga/jcca/article/viewFile/850/851 +* https://www.scmp.com/culture/books/article/2144692/how-china-censors-its-internet-and-controls-information-great-firewall +* https://freedomhouse.org/blog/china%E2%80%99s-growing-army-paid-internet-commentators +* https://www.recordedfuture.com/china-social-media-operations/ +* https://foreignpolicy.com/2016/05/19/meet-the-chinese-internet-trolls-pumping-488-million-posts-harvard-stanford-ucsd-research/ +* https://www.washingtonpost.com/opinions/2018/12/18/chinas-interference-elections-succeeded-taiwan/ + diff --git a/incidents/I00034.md b/incidents/I00034.md new file mode 100644 index 0000000..cb7bc7c --- /dev/null +++ b/incidents/I00034.md @@ -0,0 +1,78 @@ +# DibaFacebookExpedition + +* Type: incident + +* Name: DibaFacebookExpedition + +* Id: I00034 + +* Summary: In the Expedition, Diba engaged in a highly organized cyber-attack of a Taiwanese political leader. On January 20, 2016 (the day of President Tsai Ing-wen’s inauguration) featuring the posting of an overwhelming number of social media comments in support of a PRC-sanctioned message. Netizens from one of the largest discussion forums in China, known as Diba, coordinated to overcome China’s Great Firewall to flood the Facebook pages of Taiwanese politicians and news agencies with a pro-PRC message, a cyberattack referred to as the “Diba Expedition to Facebook.” + +Unique for taking place outside of the Chinese Internet system, both transgressing technical and political norms while exposing their actions to an international audience. In spite of the transgressive nature of the action, “Diba Expedition” was highly praised by Chinese official media, in contrast to comparable activities in the past that lacked its explicit pro-government ideology. Yet—reflecting the complexity of Diba’s relationship with the PRC government—the Expedition was shut down after a few days. + +* Year started: 2016.0 + +* From country / To country: China / Taiwan + +* Found via: OII + +* Date added: 2019-02-24 + +* Techniques used: + +| Technique | Description given for this incident | +| --------- | ------------------------- | +| [T0002 Facilitate State Propaganda](../techniques/T0002.md) | I00034T001 Netizens from one of the largest discussion forums in China, known as Diba, coordinated to overcome China’s Great Firewall | +| [T0049 Flooding](../techniques/T0049.md) | I00034T002 flood the Facebook pages of Taiwanese politicians and news agencies with a pro-PRC message | +| [T0049 Flooding](../techniques/T0049.md) | I00034T003 Democratic Progressive Party (DPP), attracted nearly 40,000 Facebook comments in just eight hours. | + +DO NOT EDIT ABOVE THIS LINE - PLEASE ADD NOTES BELOW + +Actor: China + +Timeframe: 72 hours? + +Date: January 20th, 2016 + +Presumed goals: + +* The trolls planned their attack for 7pm, China time, on January 20. Members of Di Ba—one of the largest message boards on the internet—would organize into groups, leap over the Great Firewall to reach Facebook, and flood it with the message that Taiwan is part of China. The anti-independence and pro-China posts started to take over the Facebook page of Tsai Ing-wen, Taiwan’s newly elected president + +Method: + +* Tsai’s latest Facebook post, about a meeting she had with leaders from her Democratic Progressive Party (DPP), attracted nearly 40,000 Facebook comments in just eight hours. +* News of the attack spread far and wide, with a number of posts making their way around social network WeChat. * For most of the day “Di Ba’s Facebook battle” has been at the top of the list of searched terms on Weibo, a Chinese microblog site similar to Twitter. News outlets in Taiwan covered the story (link in Chinese). +* Information also spread suggesting that Di Ba’s battle was organized and well-prepared. Screenshots showed that attackers were separated into six “columns,” in the military sense: information gathering; posting; writing opinions and creating images; translation; miscellaneous Facebook tasks such as liking posts; and a vanguard to head things up. +* The majority of the 26K comments consisted of lines copied and pasted from the officially designated messages +* more than 42,000 people had made comments on a single post of Ms Tsai's Facebook page, demanding her self-ruled island be brought under Chinese control. +* Beginning at 7 pm on January 20, 2016 CST (China Standard Time), tens of thousands of +comments against Taiwan independence appeared in posts of Taiwan President-elect Ms. Tsai Ing-Wen’s Facebook page as well as news media’s such as Sanli News and Apple Daily. While the organizers claim to taking further steps on issues against Taiwan independence, the event lasted for less than two days due to Chinese government’s intervention, leaving tens of thousands of comments either deleted or unattended. +* Within this most active group, every username posted 6 comments at least and 12 comments +on average. The most productive one posted 192 comments during this period. Two interesting +findings come from the discrepant mapping result of Facebook usernames and IDs, which imply +participants’ strategy. First, users might share account. We found five IDs, each of which is +associated with different usernames. According to one internal document downloaded from the +QQ group, some participants would register Facebook accounts in advance, and then give them to those responsible for attack. Since Facebook allows users to change their usernames anytime, we speculate whether this may be due to the sharing of accounts but changing the name to differentiate the identity. +* Second, users shared some usernames to maintain the consistency of their identities. The total +number of IDs is more than the number of unique usernames. Many usernames are shared by +different IDs, which account for 2.82% of all 16,891 IDs. One possible reason for this practice is +that during the attack, reporting and blocking accounts is a prevalent tactic used by both sides as defense. Once the account is “dead”, the user has to register for a new account to keep fighting. One commenter said that he/she was blocked over 3 times, but kept registering new accounts to fight. It is thus not surprising to see a small percentage of users who have more than one ID while maintaining the same username. +* More notable is the case where one username is shared by more than 10 IDs. One possible +explanation is that someone dedicates himself/herself to this event and intends to increase their +visibility. However, for those usernames associated with over 30 IDs, we argue that it might be a +unique strategy for attacking or trolling, because it is difficult to log into multiple accounts and +post comments by a single user. + +Counters: + +Related incidents: + +References: + +* https://www.ideals.illinois.edu/handle/2142/96746 +* https://qz.com/598812/an-army-of-chinese-trolls-has-jumped-the-great-firewall-to-attack-taiwanese-independence-on-facebook/ +* https://www.abc.net.au/news/2016-01-21/chinese-facebook-users-flooding-taiwan-president-elect-account/7105228 +* https://www.businessinsider.com/chinese-people-are-flooding-the-internet-with-a-campaign-against-taiwan-2016-1 + + + diff --git a/incidents/I00035.md b/incidents/I00035.md new file mode 100644 index 0000000..ba10f64 --- /dev/null +++ b/incidents/I00035.md @@ -0,0 +1,51 @@ +# Brazilelections + +* Type: campaign + +* Name: Brazilelections + +* Id: I00035 + +* Summary: Bot activity in Brazil elections + +* Year started: 2014.0 + +* From country / To country: Brazil / Brazil + +* Found via: OII + +* Date added: 2019-02-24 + +* Techniques used: + +| Technique | Description given for this incident | +| --------- | ------------------------- | + +DO NOT EDIT ABOVE THIS LINE - PLEASE ADD NOTES BELOW + +Summary: + +Actor: + +Timeframe: + +Date: + +Presumed goals: + +Method: + +* Bot activity that inflates the visibility of and perceived support for certain candidates and ideologies in 2014 elections. +* Campaigns use bots or spread content favorable to their respective candidates in 2014. Neves’ operation used bots on a much larger scale than the Rousseff’s campaign (on FB, Twitter and WhatsApp). + +Counters: + +* Facebook removed 200 pages run by individuals connected to the right-wing activist organization Movimento Brasil Livre related to the Brazil elections. + +Related incidents: + +References: +* https://blogs.oii.ox.ac.uk/politicalbots/wp-content/uploads/sites/89/2017/06/Comprop-Brazil-1.pdf +* https://www.wilsoncenter.org/blog-post/bots-brazil-the-activity-social-media-bots-brazilian-elections + + diff --git a/incidents/I00036.md b/incidents/I00036.md new file mode 100644 index 0000000..2d4d23b --- /dev/null +++ b/incidents/I00036.md @@ -0,0 +1,24 @@ +# BrazilPresDebate + +* Type: incident + +* Name: BrazilPresDebate + +* Id: I00036 + +* Summary: nan + +* Year started: 2014.0 + +* From country / To country: Brazil / Brazil + +* Found via: OII + +* Date added: 2019-02-24 + +* Techniques used: + +| Technique | Description given for this incident | +| --------- | ------------------------- | + +DO NOT EDIT ABOVE THIS LINE - PLEASE ADD NOTES BELOW \ No newline at end of file diff --git a/incidents/I00037.md b/incidents/I00037.md new file mode 100644 index 0000000..7025198 --- /dev/null +++ b/incidents/I00037.md @@ -0,0 +1,24 @@ +# Rioelections + +* Type: incident + +* Name: Rioelections + +* Id: I00037 + +* Summary: nan + +* Year started: 2016.0 + +* From country / To country: Brazil / Brazil + +* Found via: OII + +* Date added: 2019-02-24 + +* Techniques used: + +| Technique | Description given for this incident | +| --------- | ------------------------- | + +DO NOT EDIT ABOVE THIS LINE - PLEASE ADD NOTES BELOW \ No newline at end of file diff --git a/incidents/I00038.md b/incidents/I00038.md new file mode 100644 index 0000000..6a4eec2 --- /dev/null +++ b/incidents/I00038.md @@ -0,0 +1,24 @@ +# Brazilimpeachment + +* Type: incident + +* Name: Brazilimpeachment + +* Id: I00038 + +* Summary: nan + +* Year started: 2016.0 + +* From country / To country: Brazil / Brazil + +* Found via: OII + +* Date added: 2019-02-24 + +* Techniques used: + +| Technique | Description given for this incident | +| --------- | ------------------------- | + +DO NOT EDIT ABOVE THIS LINE - PLEASE ADD NOTES BELOW \ No newline at end of file diff --git a/incidents/I00039.md b/incidents/I00039.md new file mode 100644 index 0000000..97a4180 --- /dev/null +++ b/incidents/I00039.md @@ -0,0 +1,57 @@ +# MerkelFacebook + +* Type: incident + +* Name: MerkelFacebook + +* Id: I00039 + +* Summary: Top stories about Merkel in both German and English were negative and misleading, most published from fake news sites. + +* Year started: 2017.0 + +* From country / To country: unknown / Germany + +* Found via: OII + +* Date added: 2019-02-24 + +* Techniques used: + +| Technique | Description given for this incident | +| --------- | ------------------------- | + +DO NOT EDIT ABOVE THIS LINE - PLEASE ADD NOTES BELOW + +Actor: + +* Right-wing FB pages +* Fake news sites e.g. yesimright.com; shoebat.com; endingthefed.com; truthfeed.com; yournewswire.com. +* British tabloids: Express, MailOnline. + +Timeframe: Data was collected and analyzed in 2016. + +Date: 2016. + +Presumed goals: +* To attack Merkel’s liberal position on the refugee crisis. + +Method: +* Fake news sites mix legitimate partisan political content with false and conspiratorial information. +* Large right-wing FB pages in the US also share anti-Merkel content. +* Most popular Merkel articles on Facebook also come from legitimate, but negative and right-wing news sources. +* German links that generated most engagement in 2016 spread conspiratorial claims about Merkel’s mental health. + +Counters: +* No counter actions were taken. + +Related incidents: + +* Defamation of Modamani – a Syrian refugee - who took a selfie with Merkel and was accused on social media as having links to terrorism. + +References: + +* Source: Buzzfeed analysis +* https://www.buzzfeed.com/albertonardelli/hyperpartisan-sites-and-facebook-pages-are-publishing-false +* https://www.nytimes.com/2017/02/06/business/syria-refugee-anas-modamani-germany-facebook.html + \ No newline at end of file diff --git a/incidents/I00040.md b/incidents/I00040.md new file mode 100644 index 0000000..c9bec3e --- /dev/null +++ b/incidents/I00040.md @@ -0,0 +1,24 @@ +# modamaniSelfie + +* Type: incident + +* Name: modamaniSelfie + +* Id: I00040 + +* Summary: nan + +* Year started: 2015.0 + +* From country / To country: unknown / Germany + +* Found via: OII + +* Date added: 2019-02-24 + +* Techniques used: + +| Technique | Description given for this incident | +| --------- | ------------------------- | + +DO NOT EDIT ABOVE THIS LINE - PLEASE ADD NOTES BELOW \ No newline at end of file diff --git a/incidents/I00041.md b/incidents/I00041.md new file mode 100644 index 0000000..a4fd8a5 --- /dev/null +++ b/incidents/I00041.md @@ -0,0 +1,24 @@ +# Refugee crime map + +* Type: incident + +* Name: Refugee crime map + +* Id: I00041 + +* Summary: nan + +* Year started: 2017.0 + +* From country / To country: unknown / Germany + +* Found via: OII + +* Date added: 2019-02-24 + +* Techniques used: + +| Technique | Description given for this incident | +| --------- | ------------------------- | + +DO NOT EDIT ABOVE THIS LINE - PLEASE ADD NOTES BELOW \ No newline at end of file diff --git a/incidents/I00042.md b/incidents/I00042.md new file mode 100644 index 0000000..722d68f --- /dev/null +++ b/incidents/I00042.md @@ -0,0 +1,88 @@ +# Saudi/Qatar bot dispute + +* Type: incident + +* Name: Saudi/Qatar bot dispute + +* Id: I00042 + +* Summary: In the summer of 2017, Twitter bots—automated accounts—were deployed to boost messaging on both sides of the diplomatic dispute between Saudi Arabia and Qatar.” Calling this a “diplomatic dispute” understates the complexity of regional dynamics, at the center is an alleged report that Qatar’s emir, Sheikh Tamim bin Hamad al-Thani, had made an astonishing speech, and alleged “hack” of Qatar’s official news agency, and further woven into concerns Saudi Arabia has about the influence of public perception, the role of Al Jazeera. + +* Year started: 2017.0 + +* From country / To country: SaudiArabia / Qatar + +* Found via: MIS + +* Date added: 2019-02-24 + +* Techniques used: + +| Technique | Description given for this incident | +| --------- | ------------------------- | +| [T0011 Hijack legitimate account](../techniques/T0011.md) | I00042T001 “hack” of Qatar’s official news agency | +| [T0021 Memes](../techniques/T0021.md) | I00042T004 memes | +| [T0024 Create fake videos and images](../techniques/T0024.md) | I00042T003 photoshopped/fake images | +| [T0054 Twitter bots amplify](../techniques/T0054.md) | I00042T002 Twitter bots amplify & manipulate | + +DO NOT EDIT ABOVE THIS LINE - PLEASE ADD NOTES BELOW + +Actor: + +* Saudi Arabia / Qatar /Turkey. +* While the dispute is between these two Kingdoms, it’s with certainty that one can suggest Iran (both projection and the containment of its power/influence in the region) is at the center of it. + +Timeframe: May - September 2017 + +Date: May, 2017 + +Presumed goals: + +* The programmatic/synthetic amplification of respective “positions and/or plights.” +* The respective hashtags can not be categorized as organic in nature, but launched in conjunction with the botnet deployments. As well, none of the identified bot related activity points to an effort to drown out/flood the opponents. + +Method: + +* Twitter campaign; bots/botnets seriously distorted the conversation on Twitter. +* Commercial botnets (these are created en masse and rented out to any user who is willing to pay for retweets, likes, and follow—either for their own account or for somebody else’s. They are thus the easiest and quickest way to obtain artificial amplification) +* On 24 May 2017, for example, pro-Qatar users launched the hashtag or “Qatar is not alone.” +* Supporters of Saudi Arabia also turned to apparently commercial bots to promote their messages. On 21 July, supporters of Qatar launched another hashtag, or “Tamim the Glorious,” in honor of the Emir. In response, supporters ,#تميم_المج ُد of Saudi Arabia used a botnet to attack the hashtag. The attack began when an account called @al_muhairiuae posted a photoshopped image of the Emir designed to make him look foolish. +* Combined with the Korean imagery, this suggests they were a commercial botnet that an unknown user rented to amplify the anti-Qatar tweet and to subvert the pro-Qatar hashtag, which had only just started to trend. +* At least one botnet seemed based in Turkey, joining the fray in mid-September in a bid to support Qatar.” + +Counters: + +* Essentially the was a tit-for-tat campaign with a brief “incursion”/support/spike of activity most likely (but not officially verified) from Turkey in support of Qatar + +* Global Research (Pro-Kremlin publication/organization located in Montreal, QC) contributed anti-Saudi spin via their blog. Global Research (anti-Saudi… campaign); Global Research (more) + +Related incidents: + +* Jamal Khashoggi incident will bear hallmarks of the incident, but moves beyond a regional information operation into one of global significance. In 2018 the NY Times investigates Saudi Arabia’s Troll Army + +References: + +* https://www.globalresearch.ca/saudi-arabias-march-towards-civil-war/5616699 +* https://www.globalresearch.ca/the-machiavellian-plot-to-provoke-saudi-arabia-and-qatar-into-a-blood-border-war/5593870 +* https://www.nytimes.com/2018/10/20/us/politics/saudi-image-campaign-twitter.html +* https://jia.sipa.columbia.edu/robot-wars-how-bots-joined-battle-gulf +* https://www.washingtonpost.com/news/monkey-cage/wp/2017/06/07/hacking-bots-and-information-wars-in-the-qatar-spat/ +* https://www.independent.co.uk/news/world/middle-east/russian-hackers-qatar-fake-news-gulf-diplomatic-row-fbi-doha-saudi-arabia-bahrain-uae-egypt-a7776446.html +* https://qz.com/1107023/the-inside-story-of-the-hack-that-nearly-started-another-middle-east-war/ +* https://theconversation.com/the-world-cup-in-digital-and-social-the-viewers-the-tweets-and-the-trolls-99625 + +* https://www.bbc.com/news/blogs-trending-44294826 +* https://jia.sipa.columbia.edu/robot-wars-how-bots-joined-battle-gulf + +Datasets: Mining and analyzing Twitter data is unlikely to “prove” or offer much more insight than Ben Nimmo’s work. + +Notes: + +Given the apparent use of commercial botnets, it’s difficult to attribute much of the activity to state actors, however it is fair to suggest some of this behavior would undoubtedly needed tacit state support… private “patriots” of the state? + +This article https://jia.sipa.columbia.edu/robot-wars-how-bots-joined-battle-gulf highlights the mechanics and dynamics of the bot operations/amplification in some cases to short life span of the activity and assets (quickly deleted from the platform), but doesn’t communicate the underlying political issues that drove these incidents. + +The focus of these Arabic-language hashtags was clearly local and regional rather than international; this was a question of messaging to the domestic population and to Arabic-language rivals, rather than the non-Arabic-speaking world. +Claims of Russian involvement/hack are reported by both the Washington Post and the Independent UK (cites CNN as source). Quartz as well cites the Russian connection, further citing documentation shared with them via Qatar (flimsy at best) and further point blame for the affair at President Trump. + +Post incident - Given Qatar is hosting the 2022 World Cup of Soccer, the World Cup 2018, was a “test” ground for this ongoing online “war” while subtle was evident (Mentionmapp Analytics… John’s research) \ No newline at end of file diff --git a/incidents/I00043.md b/incidents/I00043.md new file mode 100644 index 0000000..7214348 --- /dev/null +++ b/incidents/I00043.md @@ -0,0 +1,24 @@ +# FCC comments + +* Type: incident + +* Name: FCC comments + +* Id: I00043 + +* Summary: nan + +* Year started: 2017.0 + +* From country / To country: unknown / USA + +* Found via: MIS + +* Date added: 2019-02-24 + +* Techniques used: + +| Technique | Description given for this incident | +| --------- | ------------------------- | + +DO NOT EDIT ABOVE THIS LINE - PLEASE ADD NOTES BELOW \ No newline at end of file diff --git a/incidents/I00044.md b/incidents/I00044.md new file mode 100644 index 0000000..bd855d7 --- /dev/null +++ b/incidents/I00044.md @@ -0,0 +1,122 @@ +# JadeHelm exercise + +* Type: incident + +* Name: JadeHelm exercise + +* Id: I00044 + +* Summary: In the summer of 2015, thousands of troops from the US Army Special Operations command conducted and multi-state, weeks-long training operation across the southwest. Russian trolls amplified conspiracy theories promoted by far right media operatives such as Alex Jones, specifically: the Jade Helm 15 exercise was a precursor to domestic invasion and subsequent martial law by the Obama Administration in coordination with China. Some versions have deus ex machina such as an asteroid strike. Ultimately the Governor of Texas, Greg Abbot, was forced to speak out on the conspiracy theory, but he hedged on Obama’s motives. + +* Year started: 2015.0 + +* From country / To country: nan / USA + +* Found via: MIS + +* Date added: 2019-02-25 + +* Techniques used: + +| Technique | Description given for this incident | +| --------- | ------------------------- | +| [T0009 Create fake experts](../techniques/T0009.md) | I00044T008 Promote fake “experts” with impressive (and scary) titles | +| [T0010 Cultivate ignorant agents](../techniques/T0010.md) | I00044T007 cultivate, manipulate, exploit useful idiots (Alex Jones... drives conspiracy theories) | +| [T0019 Generate information pollution](../techniques/T0019.md) | I00044T003 RT & Sputnik generate information pollution | +| [T0020 Trial content](../techniques/T0020.md) | I00044T005 4Chan/8Chan - trial content | +| [T0031 YouTube](../techniques/T0031.md) | I00044T004 YouTube; Reddit | +| [T0032 Reddit](../techniques/T0032.md) | I00044T004 YouTube; Reddit | +| [T0046 Search Engine Optimization](../techniques/T0046.md) | I00044T006 SEO optimisation/manipulation ("key words") | +| [T0053 Twitter trolls amplify and manipulate](../techniques/T0053.md) | I00044T002 Twitter trolls amplify & manipulate | +| [T0054 Twitter bots amplify](../techniques/T0054.md) | I00044T001 Twitter bots amplify & manipulate | +| [T0056 Dedicated channels disseminate information pollution](../techniques/T0056.md) | I00044T003 RT & Sputnik generate information pollution | + +DO NOT EDIT ABOVE THIS LINE - PLEASE ADD NOTES BELOW + +Actors: + +* SVR and IRA; +* Alex Jones; +* Global Research; +* anti-gov trolls; rapture trolls; alt-right trolls; + +Timeframe: Most of 2015 + +Date: May - Oct 2015 + +Presumed goals: + +* US operational dry run; +* Test 2016 themes; +* Promote paranoia in right wing US populations; +* Establish and prime anti-government narratives for future use. + +Method: + +* Amplification via sockpuppet and cyborg accounts; +* Social media groups and meetups; +* Promote fake “experts” with impressive (and scary) titles; +* Amplify US media derision of message “carriers” in Russian state media; + +Counters: + +* Media exposure; +* Texas Governor disavows + +Related incidents: + +* 2016 US election; +* QAnon; +* Texas secession + +References + +* [That 'Jade Helm' Conspiracy Freakout Was Spurred By Russian Bots, Ex-Intel Chief Says](https://taskandpurpose.com/jade-helm-conspiracy-russian-bots) +* [Russians Sowed Divisions in Texas Politics, Says U.S. Senate Report](https://www.texasmonthly.com/news/russians-sowed-divisions-texas-politics-says-u-s-senate-report/) +* [Case Analysis: Jade Helm 15 and Russian Active Measures](https://toinformistoinfluence.com/2015/11/16/case-analysis-jade-helm-15-and-russian-active-measures/) +* [Trolling for Trump: how Russia is trying to destroy our democracy](https://warontherocks.com/2016/11/trolling-for-trump-how-russia-is-trying-to-destroy-our-democracy/) +* [Anatomy of a Russian attack: First signs of the Kremlin’s attempt to influence the 2016 election](https://wtop.com/j-j-green-national/2017/09/anatomy-russian-attack-first-signs/slide/1/) + +Details + +Even before the 2016 presidential election, the Russians had been testing disinformation in Texas by stirring up the controversy surrounding the Jade Helm military maneuver in the summer of 2015. Conspiracy theorists had created the idea that a joint military training exercise in Texas was cover for President Obama to declare martial law and seize Texas. The conspiracy theory gained traction when Abbott ordered the Texas State Guard to monitor the U.S. military. Earlier this year, a former head of the National Security Agency and the CIA—Air Force General Michael Hayden—said the Jade Helm disinformation campaign was pivotal to the Russians’ decision to try to influence the U.S. presidential campaign. “At that point, I’m figuring the Russians are saying, ‘We can go big-time.’ And at that point, I think they made the decision, ‘We’re going to play in the electoral process,’” Hayden said. + +When thousands of troops from Army Special Operations Command descended on the American southwest for the totally normal eight-week training exercise Jade Helm 15, Texas Gov. Greg Abbott — goaded on by anti-government ideologues, rapture-predicting ministries and alt-right internet famewhores — ordered the state's volunteer guard to "monitor" the U.S. service members on their land to make sure they didn't start kidnapping undesirables and grabbing people's guns. + +It was a precursor to martial law, they said. It was "way worse than you realize: police, military working together toward population control," they said. It was "secretly using recently closed Wal-Marts to stockpile supplies for Chinese troops who will be arriving to disarm Americans," they said. It was preparation for Obama's takeover after an impending asteroid impact that would begin the global apocalypse, they said. It mobilized right-wing activists to prepare to fight their government — their uniformed soldiers! — to the death. + +Russian intelligence, state media, and trolls under President Vladimir Putin sought to bum steer U.S. domestic reactions to Jade Helm 15, the multi-state U.S.-based military training exercise concludedSeptember 15th. Russia has invested tens to hundreds of millions to infiltrate U.S. media markets with English language news, opinion, conspiracy, and troll content, often interlocking with the most popular U.S. conspiracy theory websites on the net. + +On July 2015, at a community meeting in Bastrop, some Texans were up in arms about hosting part of a multi-state U.S. military training exercise named Jade Helm 15. While most locals were unswayed by the conspiracy theories of Jade Helm 15 ushering in martial law, the video of the crowd at the link records aspects of U.S. social and cognitive vulnerability to Russian “active measures.” + +It's an age-old problem; during the Cold War, Soviet agencies worked to whip up leftist anger at the U.S. government, highlighting America's race and inequality problems. But today, they've found that the most effective, salient mode of fuckery in U.S. affairs is to push right-wing conspiracy theories — "deep state," Hillary emails, Pizzagate, Seth Rich, Soros, Islamists sneaking over the Mexico-U.S. border, Benghazi — that reinforce the idea that anyone to the left of, say, President Donald Trump, is a robotic foreign-paid human-trafficking overlord doing the bidding of the Rothschilds or Trilaterals or Freemasons or Kellers some other inane shit. + +The Russian SVR (Sluzhba vneshney razvedki) has chief responsibility for conducting active measures outside of Russia. The SVR’s active measures surrounding Jade Helm 15 generated fear to ignite a range of behaviors serving Russian foreign policy objectives, from feeding cynicism about the U.S. governing system and its people, to inciting violence and sabotage in the U.S. + +One example of how this messaging worked in ramping up fear of Jade Helm 15 was found at “Global Research,” a media outlet for a Canadian non-profit called Centre for Research on Globalization. Entitled, Towards a Militarized Police State in America? Explosive New Revelations over “Jade Helm 15 Exercise” and Potential False Flags, the online article was posted May 27, 2015, roughly 48 days before the Jade Helm 15 training exercise was to begin. Such a lead would give the piece time to disseminate to conspiracist sites and gullible readers ample time to organize a response. + +The idea is to get Americans thinking other Americans are the real enemies of humanity and progress. And it works, because a lot of Americans are already disposed to that way of thinking. + +On the other hand, it’s an easy cop-out to blame the Russians for every insecure dumbass idea that excitable Americans run with. + +Considering their interlocking content and links, Global Research and Alex Jones’s InfoWars.com (one of the most popular conspiracy websites on the internet) have a de facto alliance. Both sites published conspiracy pieces about Jade Helm 15 in advance of the exercise, as did many other conspiracist websites that link with one or both. + +The blizzard of conspiracy has had an effect. By May 2015, a Rasmussen poll on Jade Helm 15 found that “45% of voters are concerned that the government will use U.S. military training operations to impose greater control over some states,” with 19% “Very Concerned.” Rasmussen also reported that “21% believe the government’s decision to conduct military training exercises in some states is an infringement on the rights of the citizens in those states.” + +Some debate the effectiveness of Russian active measures, propaganda, and trolling. Russia Today (RT) is a more sophisticated Kremlin media outlet, with slick television, internet, and periodical output. RT’s portrayal of Jade Helm 15was to depict Americans as prone to conspiracy theory, and to amplify left-leaning U.S. media derision of Texas demographics disturbed by Jade Helm 15, while casting doubt on the government operation with headlines and sub-headlines. Russia Today’s approach had accentuated personal caricatures and distrust driving partisan anger in the U.S. + +On social media however, Kremlin-linked and other conspiracists sometimes represent themselves as insiders or experts whose content can be frightening and inciting. + +For example, on LinkedIn.com, many Pulse posts have focused on Jade Helm 15. Below I profile two examples of Pulse writers who hit Jade Helm 15 theme especially hard, one of them naming himself a “Military Intelligence Analyst / Russian Regional CME” and the other a “Geopolitical Strategist, Journalist & Author” + +Are apocalyptic conspiracies harmless despite their over-the-top claims? + +Apparently not. One ominous event may have turned Jade Helm 15 Active measures into a high-yield victory for Vladimir Putin’s Kremlin. Three North Carolina men amassed arms, munitions, and weapons and had been actively preparing to ambush Jade Helm 15 troops in training. Fortunately, the FBI received a tip from a gun and surplus store owner and arrested the would-be domestic-terrorists who feared that Jade Helm 15 was a prelude to martial law in the U.S. + +The Russian SVR and Putin’s media have aimed at Texas before. Did Putin foresee that Texas politicians might respond to popular conspiracist fears ramped up by the Kremlin itself and so cause strife in the partisan divide? That happened when Governor Greg Abbot tried to reassure Texans about Jade Helm 15, and opposition media lampooned him. + +Yet according to the San Antonio Express News, Governor Abbot, who is also a former Texas Supreme Court Justice not of the conspiracist mold, had initially a milder approach. Yet the opposing partisan media did more than just embarrass Gov. Abbot over his response, it called some of his constituents who had been moved by conspiracy propaganda “dumb,” which further tends to divide U.S. demographics along stereotypical lines. Mr. Putin must have been pleased. + +Examples + + diff --git a/incidents/I00045.md b/incidents/I00045.md new file mode 100644 index 0000000..a3c296e --- /dev/null +++ b/incidents/I00045.md @@ -0,0 +1,97 @@ +# Skripal + +* Type: incident + +* Name: Skripal + +* Id: I00045 + +* Summary: On 4 March 2018, Sergei Skripal, a former Russian military officer and double agent for the UK's intelligence services, and his daughter Yulia Skripal were poisoned in Salisbury, England, with a Novichok nerve agent known as A-234, according to official UK sources and the Organisation for the Prohibition of Chemical Weapons (OPCW) + +* Year started: 2018.0 + +* From country / To country: Russia / UK + +* Found via: nan + +* Date added: 2019-03-20 + +* Techniques used: + +| Technique | Description given for this incident | +| --------- | ------------------------- | + +DO NOT EDIT ABOVE THIS LINE - PLEASE ADD NOTES BELOW + +Actor: Russia + +Timeframe: March 4, 2018 - ongoing + +Date: March 4, 2018 + +Presumed goals: + +* Russian officials have sought to exploit holes in the complicated narrative of the poisoning to suggest an anti-Russian conspiracy. Mark Galeotti, an expert on the Russian intelligence services, wrote in an op-ed in The Moscow Times… “The Kremlin is enjoying the reputation of being a swashbuckling maverick, ruthless, dangerous and decisive,” he wrote. “This has a certain value, not least in deterring the fainthearted.” +* Reuters: Commentary: For Putin’s Russia, a poisoned spy sends a political message “the poisoning as a sign of just how committed Vladimir Putin’s Kremlin has become to eradicating its enemies – and reminding others it can do so.” + +Method: + +* Multi-source/channel/media response +* highlighting conspiracies: It was a British “false flag” operation; It could be the CIA; Because of Donald Trump; There’s always Ukraine +* The conspiracy theories did not stop here. Multiple special-interest groups have attempted to lay the blame for the Skripals’ poisoning at the door of their chosen enemies. A UKIP branch in High Wycombe, in the English Home Counties, tweeted to accuse “a third party such as the EU” of “trying to interfere in UK Russian relations.” Sputnik even misquoted former Kremlin advisor Alexander Nekrassov as accusing “rouge agents” [sic] of carrying out the attack, “for some sort agenda [sic] such as slander or tarnish Russia [sic] or cause friction between Britain and Russia.” Matteo Salvini, Italian politician and member of the Italian senate, shared an article on his Facebook page, titled “The Skripal Case is a hoax, the war of the West against Russia is terribly true”. His post was liked 3,800 times and generated over 800 shares. +* Here are 20 different narratives offered by Russian media and officials for the poisoning: The United Kingdom did it to fuel anti-Russian sentiment (source: Russia 1 TV channel); Ukraine did it to frame Russia (Russia 1); The United States did it to destabilize the world (Russia 1); Theresa May helped orchestrate the attack because she is a friend of CIA director Gina Haspel (Zvezda); It was an attempted suicide (Russia 1) +It was an accidental overdose (RIA Novosti); It was due to accidental exposure from Britain’s Porton Down research facility (Russia 24 TV channel); The Porton Down lab carried out illicit human testing and is lying about not producing Novichok (RT); Skripal’s future mother-in-law did it (Moskovsky Komsomolets: mk.ru) +Terrorists did it (Russian ministry of foreign affairs spokesperson); American-British financier Bill Browder — blacklisted in Russia for denouncing corruption — did it (Russia 1); A drone did it (Zvezda and Russian defense ministry); Skripal was a chemical weapons smuggler (Pravda); The West is using the case to deflect attention from Russia’s successes in Syria (Russian ministry of foreign affairs spokesperson); Britain is using the case to deflect attention from Brexit (Russian Foreign Minister Sergei Lavrov, Russian UN ambassador, Russian OSCE ambassador); The attack was an attempt by a rival faction to undermine Vladimir Putin (state TV); Russia has destroyed all its stockpiles of Novichok (Sputnik); Russia never developed Novichok (Interfax); Only the Czech Republic, Slovakia, and Sweden have Novichok (Russian ministry of foreign affairs spokesperson). All three countries have denied the claim.; There is no evidence that the nerve agent used against the Skripals was Novichok, Porton Down lab is struggling to identify the substance (RT) + +Counters: + +* Bellingcat; +* DFRLab; + +Related incidents: + +* ties to ongoing campaigns/narrative - Ukraine; NATO; EU; Brexit + +References: + +* https://www.themoscowtimes.com/2019/03/03/a-year-after-the-skripal-poisoning-how-much-has-really-changed-a64677 +* https://www.reuters.com/article/us-apps-poisoning-commentary/commentary-for-putins-russia-a-poisoned-spy-sends-a-political-message-idUSKCN1GK309 +* https://twitter.com/UKIPHighWycombe/status/971773863230164992 +* https://sputniknews.com/analysis/201803141062498438-uk-novichok-nerve-agent-skripal/ +* https://www.facebook.com/salviniofficial/posts/10155663618083155 +* http://www.linkiesta.it/it/article/2018/03/28/il-caso-skripal-e-una-bufala-la-guerra-delloccidente-alla-russia-e-ter/37595/ +* https://www.rt.com/news/452946-skripal-anniversary-truth-novichok/ +* https://disinfoportal.org/sputnik-abkhazias-disinformation-about-porton-down-allegedly-denying-russian-trace-in-skripal-poisoning/ +* https://www.nytimes.com/2019/03/04/world/europe/russia-skripal-poisoning-britain.html + + +* https://www.bellingcat.com/tag/skripal/ +* https://medium.com/dfrlab/skripal-poisoning-if-not-russia-then-1d49f086e3e0 +* https://medium.com/dfrlab/uk-poisoning-russia-recycles-responses-77e1d357b777 +* https://medium.com/dfrlab/putinatwar-social-media-surge-on-skripal-b5132db6f439 +* https://euvsdisinfo.eu/conspiracy-mania-marks-one-year-anniversary-of-the-skripal-poisoning/ +* https://www.nytimes.com/2019/03/04/world/europe/russia-skripal-poisoning-britain.html +* https://www.reuters.com/article/us-britain-russia-skripal/third-suspect-in-skripal-poisoning-is-russian-gru-agent-bellingcat-idUSKCN1Q32BZ +* http://euromaidanpress.com/2018/04/11/five-ways-russia-is-generating-a-conspiracy-smokescreen-around-the-skripal-poisoning/ +* http://euromaidanpress.com/2018/03/30/russian-media-have-published-20-different-narratives-on-skripal-poisoning/ +* https://en.wikipedia.org/wiki/Poisoning_of_Sergei_and_Yulia_Skripal + +Visual assets (Google Drive) + +Datasets: + +Notes: + +On 6 March 2018 Andrey Lugovoy, deputy of Russia's State Duma (the Liberal Democratic Party of Russia) and alleged killer of Alexander Litvinenko, in his interview with the Echo of Moscow said: "Something constantly happens to Russian citizens who either run away from Russian justice, or for some reason choose for themselves a way of life they call a change of their Motherland. So the more Britain accepts on its territory every good-for-nothing, every scum from all over the world, the more problems they will have." +Russian Foreign Minister Sergey Lavrov on 9 March rejected Britain's claim of Russia's involvement in Skripal's poisoning and accused the United Kingdom of spreading "propaganda". Lavrov said that Russia was "ready to cooperate" and demanded access to the samples of the nerve-agent which was used to poison Skripal. The request was rejected by the British government. + +Ongoing… one year later +https://disinfoportal.org/sputnik-abkhazias-disinformation-about-porton-down-allegedly-denying-russian-trace-in-skripal-poisoning/ +On February 7, 2019, Sputnik-Abkhazia released an article headlined “Scotland Yard about the third suspect in the Skripal case: the investigation continues.” According to Sputnik-Abkhazia, the Russian Foreign Ministry caught British Prime Minister Theresa May in a lie, because the Porton Down Laboratory denied that a nerve agent that poisoned Russian ex-spy, Sergei Skripal and his daughter, Yulia had been produced in Russia + +https://www.nytimes.com/2019/03/04/world/europe/russia-skripal-poisoning-britain.html +Rather than ignoring the anniversary, however, Russia punctuated the occasion on Monday with an hourlong news conference at the United Nations and a 52-page report rehashing the episode in detail, amplified by extensive coverage on its English-language government channel, RT. + +Russian officials also have tried to turn the tables, accusing Britain of violating international law by refusing to provide Russian consular officials access to the Skripals, who survived and whose whereabouts has not been made public. + + diff --git a/incidents/I00046.md b/incidents/I00046.md new file mode 100644 index 0000000..1a20433 --- /dev/null +++ b/incidents/I00046.md @@ -0,0 +1,24 @@ +# North Macedonia + +* Type: incident + +* Name: North Macedonia + +* Id: I00046 + +* Summary: nan + +* Year started: 2018.0 + +* From country / To country: Russia / Macedonia + +* Found via: nan + +* Date added: 2019-03-20 + +* Techniques used: + +| Technique | Description given for this incident | +| --------- | ------------------------- | + +DO NOT EDIT ABOVE THIS LINE - PLEASE ADD NOTES BELOW \ No newline at end of file diff --git a/incidents/I00047.md b/incidents/I00047.md new file mode 100644 index 0000000..72cfa61 --- /dev/null +++ b/incidents/I00047.md @@ -0,0 +1,98 @@ +# Sea of Azov + +* Type: incident + +* Name: Sea of Azov + +* Id: I00047 + +* Summary: An international incident occurred on 25 November 2018 when the Russian Federal Security Service (FSB) coast guard fired upon and captured three Ukrainian Navy vessels attempting to pass from the Black Sea into the Sea of Azov through the Kerch Strait on their way to the port of Mariupol. In 2014, Russia had annexed the nearby Crimean Peninsula, which is dominantly internationally recognised as Ukrainian territory. It later constructed the Crimean Bridge across the strait. Under a 2003 treaty, the strait and the Azov Sea are intended to be the shared territorial waters of both countries, and freely accessible. +The Russian Federal Security Service (FSB), which is also responsible for border protection, claims that the ships illegally entered Russian waters. The FSB alleges that crews did not comply with demands to stop. In the scuffle, a Russian border patrol ship rammed and damaged a Ukrainian Navy tugboat. Russian forces later seized all three Ukrainian ships, confiscating them for violating Russia's border. Six Ukrainian navy soldiers were injured, the Ukrainian navy reported. + +* Year started: 2018.0 + +* From country / To country: Russia / World + +* Found via: nan + +* Date added: 2019-03-20 + +* Techniques used: + +| Technique | Description given for this incident | +| --------- | ------------------------- | +| [T0001 5Ds (dismiss, distort, distract, dismay, divide)](../techniques/T0001.md) | I00047T001 4 D's (dismiss, distort, distract, dismay...Official channels ie: Embassies & Defence Ministry; TASS | +| [T0001 5Ds (dismiss, distort, distract, dismay, divide)](../techniques/T0001.md) | I00047T002 Russian FSB security service blamed Ukraine for sparking the clashes, saying their "irrefutable" evidence would "soon be made public | +| [T0023 Distort facts](../techniques/T0023.md) | I00047T003 (Distort) Kremlin-controlled RT cited Russian Minister of Foreign Affairs Sergei Lavrov suggesting that Ukraine deliberately provoked Russia in hopes of gaining additional support from the United States and Europe. | +| [T0040 Demand unsurmountable proof](../techniques/T0040.md) | I00047T006 Demand insurmountable proof | +| [T0053 Twitter trolls amplify and manipulate](../techniques/T0053.md) | I00047T005 Twitter trolls amplify & manipulate | +| [T0054 Twitter bots amplify](../techniques/T0054.md) | I00047T004 Twitter bots amplify & manipulate | + +DO NOT EDIT ABOVE THIS LINE - PLEASE ADD NOTES BELOW + +Actor: Russia + +Timeframe: November 25, 2018 - ongoing + +Date: November 25, 2018 + +Presumed goals: + +* Russian media,quoted authorities who accused Kyiv of seeking to “create a conflict situation.” +“The same Moscow spokespeople who assured us in 2014 that the little green men who seized Crimea were not Russian soldiers—until Vladimir Putin himself spilled the beans weeks later—are now telling the world that volatile maneuvers of Ukrainian ships led to the collision November 25. +* Russian FSB security service blamed Ukraine for sparking the clashes, saying their "irrefutable" evidence would "soon be made public". Foreign Minister Sergey Lavrov said on the next day that Ukraine had violated international legal norms by failing to obtain authorisation for its vessels. Deputy Chairman of the State Duma Pyotr Tolstoy warned of the danger of a war. +* The goal of this campaign is to create confusion, to portray Ukraine as the culprit for both the Kerch Strait incident and the deteriorating security situation in the region, and to exonerate Russia of any responsibility. + +Method: + +* (Distort) Kremlin-controlled RT cited Russian Minister of Foreign Affairs Sergei Lavrov suggesting that Ukraine deliberately provoked Russia in hopes of gaining additional support from the United States and Europe. +distracting the audience from the main issue – Russia shooting at Ukrainian boats and capturing the vessels and crews. Instead they target the president of Ukraine, Petro Poroshenko: “Washington incited Poroshenko to launch this “sea provocation” against Russia in order to “thwart the Putin -Trump meeting”” and “President of Ukraine Petro Poroshenko uses the Kerch provocation for a coup d’état“. But in reality, the Ukrainian Parliament adopted a resolution scheduling the presidential elections for 31 March 2019. +Dismissing the critic has also found its place under the sun of Kremlin info-war. Claims were spread that the Russian ships have moved so far ahead “in their technological development” that they “do not use ramming as a tactic“. + +* Attempts to pollute the German Twitter: Russian disinformation does not only rely on its own resources to spread its narratives about Ukraine. Twitter has been used so heavily that Russia Today and Sputnik are scoring more engagement than some of the German quality media combined. Between Sunday and Tuesday, more than 10,000 German-language Tweets from 3,000 unique accounts mentioned Ukraine, almost all of them relating to the confrontation in the Sea of Azov. Despite the large overall number of tweeters, a small group of 30 accounts has been driving a significant share of the debate so far. + +* Dmitry Peskov described Ukrainian navy’s actions as “an invasion of foreign military ships into Russia’s territorial waters.” Belittling Ukraine’s navy; Ridiculing and dehumanising Ukrainians - This ridiculing of Ukraine’s navy echoes other cases when disinformation has been used to show Ukraine as weak and dependent. + +Counters: + +Related incidents: + +* This is not the first time the Kremlin has used the four-D tactics. +* @DFRLab has documented the Kremlin’s use of the 4Ds of disinformation to deny its involvement in the downing of the Malaysian Airlines flight MH17 over Ukraine, the Skripal poisoning, and the interference in the U.S. Presidential elections in 2016. + +References: + +* https://euvsdisinfo.eu/report/washington-incited-poroshenko-to-launch-a-sea-provocation-to-thwart-the-putin-trump-meeting/ +* https://euvsdisinfo.eu/report/kerch-confrontation-part-of-poroshenkos-plan-to-postpone-the-ukrainian-elections/ +* https://euvsdisinfo.eu/report/russia-does-not-shirk-international-law/ +* https://meduza.io/en/feature/2018/11/26/how-russia-captured-three-ukrainian-ships-in-the-black-sea +* https://medium.com/dfrlab/uk-poisoning-russia-recycles-responses-77e1d357b777 +* https://medium.com/dfrlab/propaganda-pushed-around-indictment-f63b85ac0587 +* https://www.dw.com/en/the-scars-of-ukraines-war-in-mariupol/a-19430738 +* https://www.dw.com/en/crimea-applies-for-annexation-by-moscow-after-secession-referendum-wins-968-approval/a-17500659 + +* https://euvsdisinfo.eu/wave-of-disinformation-from-the-azov-sea/ +* https://medium.com/dfrlab/minskmonitor-disinformation-tactics-extend-to-kerch-c32351c7c293 +* https://www.bellingcat.com/news/uk-and-europe/2018/11/30/investigating-the-kerch-strait-incident/ +* https://www.justsecurity.org/61835/rogue-kremlin-push-international-law/ +* https://www.stopfake.org/en/denigrating-ukraine-with-disinformation/ + +* https://www.dw.com/en/what-you-need-to-know-about-the-conflict-in-the-sea-of-azov/a-46461361 +* https://www.atlanticcouncil.org/blogs/new-atlanticist/russia-ukraine-feud-heats-up-the-sea-of-azov +* https://en.wikipedia.org/wiki/Kerch_Strait_incident + + +Datasets: + +Notes: + +Given anything related to the ukraine is a key testing ground/flashpoint for Russia narrative manipultion & anti-democracy disinformation, the incident and geographic chokepoint will be an ongoing issue. + +The Kerch Strait is the only connection between the Black Sea and the Sea of Azov, and the only way to reach two important Ukrainian ports, Mariupol and Berdiansk. The route is vital for Mariupol's two large metallurgical plants. Russia has controlled the strait since annexing Crimea in 2014, which has made traffic significantly more difficult for Ukrainian ships. The consequences of Russian control have become particularly noticeable since the completion of the Crimean Bridge in May 2018. The bridge connects the Russian mainland with the occupied peninsula. The FSB inspects all ships bound for Ukraine, sometimes taking days, which has aggravated the situation. The volume of freight has steadily declined since then. The war in Ukraine's Donbass region is also problematic for Ukraine's ports. + +this most recent escalation in the Kerch Strait is aggravating the already existing conflict between Ukraine and Russia that began after the annexation of Crimea in 2014. + +On the evening of 28 November, Ukrainian Infrastructure Minister Volodymyr Omelyan said that vessels bound for the ports of Berdyansk and Mariupol awaited entrance to the Sea of Azov and vessels were also waiting to go southbound. He characterised this as a virtual blockade. No vessels were identified as Ukrainian. On 4 December Omelyan stated that Russia did let ships reach Berdyansk and Mariupol again. The same day the Ukrainian Ministry of Temporarily Occupied Territories and IDPs claimed that the accumulation of ships waiting to go to the Ukrainian ports had led to several accidents. Russia denied it ever blocked vessels from sailing to Ukrainian ports and asserted that any possible disruptions were due to bad weather +On 19 January 2019, USS Donald Cook entered the Black Sea, being the second American vessel to arrive in the Black Sea after the Kerch Strait incident after USS Fort McHenry entered in 10 January 2019 +In March 2019, Canada, the United States and the EU imposed sanctions on Russian citizens and companies for their participation in the incident and activities in Crimea and separatist-controlled eastern Ukraine + diff --git a/incidents/I00048.md b/incidents/I00048.md new file mode 100644 index 0000000..78cf06d --- /dev/null +++ b/incidents/I00048.md @@ -0,0 +1,24 @@ +# White Helmets + +* Type: campaign + +* Name: White Helmets + +* Id: I00048 + +* Summary: nan + +* Year started: 2015.0 + +* From country / To country: Russia / World + +* Found via: nan + +* Date added: 2019-03-20 + +* Techniques used: + +| Technique | Description given for this incident | +| --------- | ------------------------- | + +DO NOT EDIT ABOVE THIS LINE - PLEASE ADD NOTES BELOW \ No newline at end of file diff --git a/incidents/I00049.md b/incidents/I00049.md new file mode 100644 index 0000000..02fb254 --- /dev/null +++ b/incidents/I00049.md @@ -0,0 +1,92 @@ +# White Helmets: Chemical Weapons + +* Type: incident + +* Name: White Helmets: Chemical Weapons + +* Id: I00049 + +* Summary: On 7 April 2018, a high number of civilians were killed in the besieged Syrian city of Douma, with evidence pointing towards another chemical attack by the regime, according to the EU. Subsequent to this event, a series of images "prove" that the White Helmets "staged" the chemical attack in Syria. + +* Year started: 2017.0 + +* From country / To country: Russia / World + +* Found via: nan + +* Date added: 2019-03-20 + +* Techniques used: + +| Technique | Description given for this incident | +| --------- | ------------------------- | +| [T0001 5Ds (dismiss, distort, distract, dismay, divide)](../techniques/T0001.md) | I00049T003 4 D's (dismiss, distort, distract, dismay...Official channels ie: Embassies & Defence Ministry; TASS | +| [T0010 Cultivate ignorant agents](../techniques/T0010.md) | I00049T005 cultivate, manipulate, exploit useful idiots (Roger Waters; Venessa Beeley...) | +| [T0019 Generate information pollution](../techniques/T0019.md) | I00049T004 RT & Sputnik generate information pollution (synthetic media) | +| [T0031 YouTube](../techniques/T0031.md) | I00049T008 YouTube; Reddit; | +| [T0032 Reddit](../techniques/T0032.md) | I00049T008 YouTube; Reddit; | +| [T0046 Search Engine Optimization](../techniques/T0046.md) | I00049T006 SEO optimisation/manipulation ("key words") | +| [T0052 Tertiary sites amplify news](../techniques/T0052.md) | I00049T007 News circulated/amplifed by tertiary sites (Russia Insider, The Duran, Geopolitica.ru, Mint Press News, Oriental Review, globalresearch.ca) | +| [T0053 Twitter trolls amplify and manipulate](../techniques/T0053.md) | I00049T002 Twitter trolls amplify & manipulate | +| [T0054 Twitter bots amplify](../techniques/T0054.md) | I00049T001 Twitter bots amplify & manipulate | +| [T0056 Dedicated channels disseminate information pollution](../techniques/T0056.md) | I00049T004 RT & Sputnik generate information pollution (synthetic media) | + +DO NOT EDIT ABOVE THIS LINE - PLEASE ADD NOTES BELOW + +Actor: Russia, Syrian Government and Iran + +Timeframe: April-June + +Date: April 8, 2018 + +Presumed goals: + +* can’t trust anyone who is reporting about it & fit into the “false flag,” commonly used conspiracy trope positing that mass casualty incidents are engineered internally to provide pretext for either government repression or military action + +Method: + +* One novel attack on the White Helmets in the wake of the Douma attacks featured the claim that the group had run a film studio in the besieged city, and used it to stage propaganda videos. This was initially reported by Lebanon-based Al-Aahed News[81] and Iran’s Fars News,[82] each of which attributed it to the other. It was then picked up by Russian state outlets in both Russian[83] and English.[84] As Bellingcat was quick to point out, the images of the studio were actually taken from the Facebook page of a film called Revolution Man.[85] The way in which this demonstrably false claim was amplified on pro-Assad channels reinforces the conclusion that its purpose was to discredit the White Helmets because their reporting was accurate—not because it was false. +* A separate line of argument focused on the Western response to the Douma attack, and the conclusion that the chemical attack had indeed been launched by Assad’s forces. This argument claimed, in essence, that the West’s response was hasty, ill-judged, and went beyond the evidence.[86] +* A third line of attack focused on accusing the West of condoning or staging chemical attacks, including the Douma one, and thus delegitimizing Western outrage. On April 13, the Russian Ministry of Defense said that it had “evidence proving the United Kingdom’s direct involvement in the organization of this provocation in eastern Ghouta,”[91] +* A fourth tactic featured apocalyptic warnings that any Western strike into Syria that harmed Russians could trigger World War III. On April 8, for example, the Russian Foreign Ministry warned of “very grave consequences” of an American strike.[93] + +Counters: + +* Fact checking (Snopes & Bellingcat) + +Related incidents: + +* foundation to Russia ramping up chemical weapon disinformation leading-op to Idlib offensive + +References: + +* https://eeas.europa.eu/headquarters/headquarters-homepage/42657/syria-eu-calls-accountability-after-yet-another-chemical-attack_en +* This is the most detailed article/resource helps lay the background, details, players, tactics http://www.publications.atlanticcouncil.org/breakingghouta/disinformation-2/ +* https://www.washingtonpost.com/news/monkey-cage/wp/2018/09/17/russia-is-gearing-up-to-misinform-the-u-s-public-about-syria-heres-our-cheat-sheet-to-identify-twitter-trolls/?utm_term=.7d3c56b0b03a +* https://euvsdisinfo.eu/report/bbc-admits-that-reason-for-bombing-syria-was-fake/ +* https://www.bellingcat.com/news/mena/2018/12/18/chemical-weapons-and-absurdity-the-disinformation-campaign-against-the-white-helmets/ +* https://www.bellingcat.com/news/mena/2018/08/30/russian-chem-disinfo-idlib/ +* https://www.bellingcat.com/tag/chlorine/ +* https://www.nybooks.com/daily/2018/10/16/why-assad-and-russia-target-the-white-helmets/ +* https://www.snopes.com/news/2018/04/12/disinformation-conspiracy-trolling-syrian-chemical-attack/ +* https://www.snopes.com/fact-check/is-this-proof-white-helmets-staged-chemical-attack/ +* https://www.dw.com/en/russias-syria-chemical-weapons-attack-warning-dubious-experts-say/a-45250441 +* https://euvsdisinfo.eu/report/new-chemical-attack-to-be-staged-by-the-white-helmets-in-idlib/ +* https://www.nytimes.com/2018/04/08/world/middleeast/syria-chemical-attack-ghouta.html + +Datasets: + +Notes: + +For the Syrian opposition, the use of these weapons in high-casualty attacks now brought the possibility of US military intervention. For the Syrian government and Russia, that same possibility brought an urgent need to sow doubt around the veracity of any claims of chemical weapons use—including by claiming that the reports of chemical weapons use were a conspiracy launched by foreign enemies to trigger more strikes. +In parallel, perhaps in an attempt to deflect potential consequences, Russian government sources began claiming that rebel groups and the White Helmets rescue organization, backed by Western powers, were planning “false flag” chemical attacks, designed to kill civilians and point the blame at the Syrian government. Against the background of the 2017 US strikes that followed the Khan Sheikhoun attack, such claims introduced the idea of American complicity in any future attacks, suggesting that such attacks would be a false flag to cover an already-decided US engagement, rather than a consequence of the regime or Russia’s decision to use chemical weapons. This seeded a narrative that could later be passed on to anti-interventionist media outlets and campaigners in the West. +The claim that a given incident was a false flag attack, designed to discredit the Russian government, has regularly been deployed by Kremlin supporters—for example, over the downing of Malaysia Airlines flight MH17 over Ukraine and the poisoning of former Russian spy Sergei Skripal in England, as well as in Syria. Such claims have been repeated and disseminated through a complex ecosystem of blogs and social media posts, largely written in English by self-styled “investigative journalists” with ties to Kremlin-operated media outlets.[18] These provided vital validation to the Syrian/Russian narrative, and played an important role in its dissemination. +The disinformation campaign waged by the Syrian and Russian regimes was large scale, persistent, and supported by a range of Western commentators. In the immediate aftermath of the attack, its impact was limited, and the bulk of mainstream reporting focused on establishing the series of events. According to an online scan of Twitter mentions of the word “Douma” conducted with the Sysomos online service, none of the ten most-retweeted tweets posted on April 7-9 contained pro-Assad content, indicating that the conversation was dominated by other voices.[110] In all, the scan collected some 435,000 tweets. Progressively, however, the mainstream media shifted their focus to other issues, while the supporters of the Syrian and Russian regimes kept their focus on Douma; thus, the overall volume of traffic declined, and the share of the conversation dominated by pro-Assad voices increased. In a similar scan of the period from April 10-16, six of the ten most-retweeted posts came from Assad supporters, out of a total of 487,000 posts.[111] +This analysis also reveals the integration of government-funded media (RT, SputnikNews) and geopolitical think tanks (GlobalResearch) as source content for anti-WH [anti-White Helmet] narratives.”[120] +Pro-Assad and pro-Russian disinformation was further amplified by a group of ostensibly independent news websites that have since been demonstrated to have Iranian links,[121] and which systematically promoted pro-Iranian regime messaging.[122] These sites included IUVMPress.com, an apparent news site that reproduced content from Iranian regime and pro-regime sources, stripped it of its attribution, and passed it onto other sites; institutomanquehue.org, ostensibly a think tank focused on Latin America; and britishleft.com, apparently a site dedicated to left-wing British politics +Commentators such as Beeley, Bartlett, and 21st Century Wire colleague Patrick Henningsen bridged the gap between the “alt-right” movement in the United States and the Russian state communications network, being cited both on sites such as RT, and alt-right hubs such as Infowars. Beeley and Bartlett contribute to both 21st Century Wire[129] and RT;[130] Henningsen formerly wrote for Infowars,[131] writes for 21st Century Wire, and is featured as a contributor on RT’s site.[132] Their contributions helped to spread pro-Assad and pro-Kremlin messaging into US audiences, very much in the manner described by Simonyan, when she spoke of the need for “English-speaking talking heads” to validate the Kremlin’s view. + +On at least one occasion, their messaging broke into the mainstream. On April 13, 2018, rock guitarist Roger Waters told a concert in Barcelona that he thought the White Helmets were a “fake organization that is creating propaganda for jihadists and terrorists”—a very similar misrepresentation to that publicized by the Kremlin disinformation networks.[134 +A video clip of his comments was repeatedly uploaded to YouTube by Kremlin and pro-Kremlin users, including RT UK,[136]Beeley,[137] Hands Off Syria,[138] and Clarity of Signal.[139] Together, these totalled more than 140,000 views by September 19, 2018 + +When incidents such as the Waters amplification are taken into account, the reason that Russia’s General Dvornikov spoke so highly of information operations becomes clear. The combination of state-funded outlets, covert outlets such as IUVMPress, official statements, and supporting bloggers and trolls allowed the pro-Assad narrative to dominate the online conversation for extended periods, especially during times when the credible media outlets were focusing on other issues. diff --git a/incidents/I00050.md b/incidents/I00050.md new file mode 100644 index 0000000..7fa377d --- /dev/null +++ b/incidents/I00050.md @@ -0,0 +1,135 @@ +# #HandsOffVenezuela + +* Type: incident + +* Name: #HandsOffVenezuela + +* Id: I00050 + +* Summary: Venezuela has been thrown into turmoil after Guaidó declared himself interim president Jan. 23. The 35-year-old president of the National Assembly says Venezuela's constitution grants him power to take control of the government because Maduro was re-elected last year by fraud. Guaidó has called for Maduro to leave office and call new elections. + +More than 50 nations, including the United States and most of Latin America, concluded that Maduro's re-election last year was a fraud. They have recognized Juan Guaidó, president of the opposition-led National Assembly, as Venezuela's legitimate head of state, endorsing his mission to establish a transitional government and hold fresh elections. +Maduro has remained defiant in the face of domestic and international pressure, securing the support of the governments of Iran and Russia, as well as the loyalty of the Venezuelan military. + +* Year started: 2019.0 + +* From country / To country: Russia / World + +* Found via: nan + +* Date added: 2019-03-20 + +* Techniques used: + +| Technique | Description given for this incident | +| --------- | ------------------------- | +| [T0010 Cultivate ignorant agents](../techniques/T0010.md) | I00050T004 cultivate, manipulate, exploit useful idiots (Roger Waters) | +| [T0019 Generate information pollution](../techniques/T0019.md) | I00050T003 RT & Sputnik generate information pollution (synthetic media) | +| [T0031 YouTube](../techniques/T0031.md) | I00050T007 YouTube; Reddit; | +| [T0032 Reddit](../techniques/T0032.md) | I00050T007 YouTube; Reddit; | +| [T0046 Search Engine Optimization](../techniques/T0046.md) | I00050T005 SEO optimisation/manipulation ("key words") | +| [T0052 Tertiary sites amplify news](../techniques/T0052.md) | I00050T006 News circulated/amplifed by tertiary sites (Mint Press News, globalresearch.ca) | +| [T0053 Twitter trolls amplify and manipulate](../techniques/T0053.md) | I00050T002 Twitter trolls amplify & manipulate | +| [T0054 Twitter bots amplify](../techniques/T0054.md) | I00050T001 Twitter bots amplify & manipulate | +| [T0056 Dedicated channels disseminate information pollution](../techniques/T0056.md) | I00050T003 RT & Sputnik generate information pollution (synthetic media) | + +DO NOT EDIT ABOVE THIS LINE - PLEASE ADD NOTES BELOW + +Actor: Russia, Cuba, China, Iran + +Timeframe: January 23, 2019 + +Date: January 29, 2019 - ongoing + +Presumed goals: + +* Given the history (going back to the Monroe Doctrine) the US is easily characterized with “imperialist” aspirations. Of course there’s the connected issue of oil and Venezuela’s indebtedness to Russia and China. The relationship between Cuba and Venezuela can not be underscored going back to Castro & Chavez’s relationship. + +* Search (google) #handsofvenezuela the results are largely linking to articles denouncing the US and those countries opposed to the Maduro regime. “There's been a lot of misinformation in the international media about whether what is happening in Venezuela is a brazen US-led power grab or a constitutional …” Jan 13, 2019 - An attempt at an imperialist coup d'état is underway in Venezuela. It must ... Most likely this is another attempt by Washington to spread misinformation and ... socialist and anti-imperialist, is to reject this scandalous imperialist … + +* Activists to Trump: 'Hands Off Venezuela' - Truthdig +https://www.truthdig.com/articles/activists-to-trump-hands-off-venezuela/ +Mar 17, 2019 - medeabenjamin “We are absolutely opposed to economic sanctions in Venezuela” at the #HandsOffVenezuela rally. pic.twitter.com/ ... Packed London meeting says: “US-UK, hands off Venezuela!" +https://www.marxist.com/packed-london-meeting-says-us-uk-hands-off-venezuela.htm +Jan 31, 2019 - Nearly 100 people packed the #HandsOffVenezuela meeting in London on 30 January, and heard Venezuelan ambassador Rocío Manero, ... + +Method: + +* From efforts via blogs, “news” sites and media supporting the left/socialism/stateism positioning anti-Maduro efforts as “imperialisitic” it’s noteworthy to documented the efforts in February to deliver aid to the country. For instance this case study - analysis demonstrates that the depiction of Russia’s role as “peacekeeper” and “defender” has had a big impact on the networks. We filtered all mentions to include only those containing the words “Russia”, “Moscow” or “Putin” in reference to Venezuela. This resulted in a total number of 60,315 tweets for the period. A few peaks can be noticed at times when Russian sources, mainly RT and Sputnik, forward Venezuela-related news. +A: Russia expresses an adamant position that Maduro is the legitimate president of Venezuela +B: Russia will defend the Venezuelan Constitution +C: The US is massing troops at the Venezuelan border +E: Russia is sending humanitarian aid to Venezuela +* The Trojan Horse. The most striking success of the Russian disinformation campaign is the impact of the Trojan Horse Narrative. The first case of describing US and EU humanitarian aid to Venezuela as a Trojan horse, in Spanish Caballo de Troya, appeared in Spanish language networks on 24 January: +From February 23, 2019 - Billionaire businessman Richard Branson says he hopes his Live Aid-inspired concert to raise funds for Venezuelans will persuade members of the country's military to defy President Nicolas Maduro and allow humanitarian aid to cross the border. +Branson, who will host "Venezuela Aid Live" on Friday in the Colombian border town of Cucuta, said he is aiming to raise about $100 million to buy food and medicine, essential supplies for the country, which is gripped by a political and humanitarian crisis. +In reaction to - Maduro’s government announced that it would accept contributions from China and Cuba, but called Guaidó-organized aid, which includes contributions from the United States, a “handout.” In an interview with the Associated Press this week, Maduro blamed U.S. sanctions for Venezuela’s economic woes, saying “the infected hand of Donald Trump is hurting Venezuela.” +* Like the White Helmets (Musician) Roger Waters (willing idiot) weighs in - In a two-minute video posted on Twitter, the musician says Mr Branson's "Live-Aid-ish" concert has "nothing to do with humanitarian aid at all". "It has to do with Richard Branson, and I'm not surprised by this, having bought the US saying: 'We have decided to take over Venezuela, for whatever our reasons may be,'" Mr Waters says. "But it has nothing to do with the needs of the Venezuelan people, it has nothing to do with democracy, it has nothing to do with freedom, and it has nothing to do with aid." He adds that he has "friends that are in Caracas" who claim there is "no civil war, no mayhem, no murder, no apparent dictatorship, no suppression of the press" +Maduro government holds their own concert to counter Branson’s efforts +https://www.cnbc.com/2019/02/19/richard-branson-maduro-concert-on-venezuela-border.html +https://www.theguardian.com/world/2019/feb/19/maduro-government-richard-branson-rival-venezuela-concerts +Just 300 metres away, the first of some 150 artists began performing at Maduro's Hands off Venezuela festival. +https://www.aljazeera.com/news/2019/02/rival-concerts-backdrop-venezuela-power-struggle-190222142807321.html + +* The Russian official line - (talking points for trolls & willing/unwitting idiots) +On Tuesday, Russian Foreign Minister Sergey Lavrov criticized the U.S. sanctions, which meant that proceeds from the sale of Venezuelan oil would be withheld from Maduro’s government. +In a press conference, Lavrov dubbed the U.S. sanctions “illegitimate” and “cynical,” adding that Russia “along with other responsible members of the global community will do everything to support the legal government of the president,” RIA Novosti reported. +There is concern in Moscow about the level of debt Caracas owes Russia. Russian Deputy Finance Minister Sergei Storchak said the sanctions may mean Venezuela will have problems servicing sovereign debt to Russia. +Venezuela has two months to pay Russian $100 million and there is uncertainty as to whether PDVSA can service its debt to Russia’s state energy giant Rosneft, Radio Free Europe reported +The evolution/spread of talking points +But while the Canadian government, which accused Maduro of seizing power through fraudulent elections, has expressed full support for Guaido, some Canadian protesters are calling it out for what they say is an attack on Venezuela’s sovereignty. +“What is brewing, what is being organized is an actual military intervention of Venezuela,” said Margaret Villamizar, who attended a protest in Windsor, Ont. “If it doesn’t turn out to be full-scale military, what’s being called diplomacy is really an attack on Venezuela’s sovereignty.” + +* Also - In an interview with Foreign Policy, Adm. Craig Faller, the four-star military officer who heads U.S. Southern Command, pointed to a Chinese disinformation campaign designed to blame the United States for the blackouts that devastated Venezuela in recent weeks. https://foreignpolicy.com/2019/04/08/us-military-wary-of-chinas-foothold-in-venezuela-maduro-faller-guaido-trump-pentagon/ +A Chinese plane loaded with 65 tons of medical supplies landed in Venezuela's capital of Caracas on Friday amid a power struggle between President Nicolas Maduro and opposition leader Juan Guaido. +Maduro welcomed the arrival of the humanitarian aid on Twitter, saying "Venezuela is breaking the imperialist siege and advancing with a victory." +He shared photos showing the arrival of the aid as well as a photo of him taken with his Chinese counterpart Xi Jinping during his visit to China last year. +China's move came after Russia sent humanitarian aid to Caracas last week. +Venezuela has been rocked by protests since Jan. 10, when Maduro was sworn in for a second term following a vote boycotted by the opposition. +https://www.aa.com.tr/en/americas/venezuela-welcomes-arrival-of-chinese-medical-aid/1435166 + +Counters: + +* Every report suggesting that Venezuela is mired in a humanitarian crisis. +April 10, 2019 The UN reports “There is a very real humanitarian problem in Venezuela,” said Mark Lowcock, the UN humanitarian chief. “We estimate that 7 million people in Venezuela need humanitarian assistance. That is some 25 per cent of the population,” +April 10, 2019 NY Times ‘You Shouldn’t Be Here’: U.S. Pushes U.N. to Pull Venezuela Envoy’s Credentials +Go back to October 2018 Washington Post: A humanitarian crisis in Venezuela? Nothing to see here, government says. Human Rights Watch Report + +Related incidents: + +* Speculation but research worthy… right/left regional binary pitting new right wing governments in Brazil & Columbia and hosility/percieved hosility to regimes like Venezuela & Ecuador + +References: + +* https://www.truthdig.com/articles/activists-to-trump-hands-off-venezuela/ +* https://www.marxist.com/packed-london-meeting-says-us-uk-hands-off-venezuela.htm +* https://euvsdisinfo.eu/twitter-as-an-information-battlefield-venezuela-a-case-study/ +* https://www.washingtonpost.com/world/the_americas/in-venezuela-humanitarian-aid-has-become-a-political-weapon/2019/02/14/5eab781a-3089-11e9-8781-763619f12cb4_story.html +* https://www.apnews.com/21b641f6def1400894125e3a8117f66c +* https://www.cnbc.com/2019/02/19/richard-branson-maduro-concert-on-venezuela-border.html +* https://www.theguardian.com/world/2019/feb/19/maduro-government-richard-branson-rival-venezuela-concerts +* https://www.aljazeera.com/news/2019/02/rival-concerts-backdrop-venezuela-power-struggle-190222142807321.html +* https://foreignpolicy.com/2019/04/08/us-military-wary-of-chinas-foothold-in-venezuela-maduro-faller-guaido-trump-pentagon/ +* https://www.aa.com.tr/en/americas/venezuela-welcomes-arrival-of-chinese-medical-aid/1435166 +* https://news.un.org/en/story/2019/04/1036441 +* https://www.nytimes.com/2019/04/10/world/americas/pence-venezuela-un-envoy.html +* https://www.washingtonpost.com/world/the_americas/a-humanitarian-crisis-in-venezuela-nothing-to-see-here-government-says/2018/10/12/6ebd1aa6-c2ac-11e8-9451-e878f96be19b_story.html +* https://www.hrw.org/world-report/2019/country-chapters/venezuela +* https://euvsdisinfo.eu/twitter-as-an-information-battlefield-venezuela-a-case-study/ +* https://www.npr.org/2019/03/25/706635580/venezuelas-maduro-faces-pressure-from-much-of-the-world-yet-he-persists +* https://cronkitenews.azpbs.org/2019/02/26/venezuela-protests-in-tucson/ +* https://www.newsweek.com/donald-trump-told-hands-venezuela-countrys-president-who-has-full-backing-1309188 +* https://www.dw.com/cda/en/venezuela-juan-guaido-urges-army-to-let-aid-through/a-47651164 +* https://www.npr.org/2019/04/02/709306132/maduro-allies-move-against-rival-juan-guaid-in-venezuela +* https://www.washingtonpost.com/world/2019/04/02/trump-has-russia-problem-venezuela/?utm_term=.9233de48de14 +* https://www.atlanticcouncil.org/blogs/new-atlanticist/russia-s-venezuela-challenge +* https://www.theglobeandmail.com/world/article-venezuelas-maduro-seeks-to-restore-power-stem-looting-as-china/ +* https://www.npr.org/tags/587365601/venezuela-crisis +* https://www.washingtonpost.com/world/2019/02/16/richard-bransons-goal-million-venezuela-could-face-an-obstacle-maduro/?utm_term=.8a5ad46a730a +* https://www.bbc.com/news/world-latin-america-47271182 + +Notes: + + + + diff --git a/incidents/I00051.md b/incidents/I00051.md new file mode 100644 index 0000000..67e73fb --- /dev/null +++ b/incidents/I00051.md @@ -0,0 +1,78 @@ +# Integrity Initiative + +* Type: incident + +* Name: Integrity Initiative + +* Id: I00051 + +* Summary: The UK Foreign Office has accused Russian state media of trying to discredit a government-funded body that works to counter Kremlin disinformation. A spokesperson said the Institute for Statecraft was hacked several weeks ago and documents were "published and amplified by Kremlin news channels". +The FCO comments on the IfS were issued after a news report said the group had retweeted stories critical of Labour. Western officials believe the group involved in the hack is linked to the Russian state. Since then internal documents have been leaked to the Russian media about the organisation's activities, including lists of journalists it had contacted. The Foreign Office has provided £2.2m in funding to the institute over the last two years supported its work to counter disinformation overseas and not in the UK + +* Year started: 2018.0 + +* From country / To country: Russia / World + +* Found via: nan + +* Date added: 2019-03-20 + +* Techniques used: + +| Technique | Description given for this incident | +| --------- | ------------------------- | +| [T0010 Cultivate ignorant agents](../techniques/T0010.md) | I00051T005 cultivate, manipulate, exploit useful idiots | +| [T0019 Generate information pollution](../techniques/T0019.md) | I00051T004 RT & Sputnik generate information pollution | +| [T0025 Leak altered documents](../techniques/T0025.md) | I00051T001 hack/leak/manipulate/distort | +| [T0031 YouTube](../techniques/T0031.md) | I00051T006 YouTube; Reddit | +| [T0032 Reddit](../techniques/T0032.md) | I00051T006 YouTube; Reddit | +| [T0046 Search Engine Optimization](../techniques/T0046.md) | I00051T007 SEO optimisation/manipulation ("key words") | +| [T0053 Twitter trolls amplify and manipulate](../techniques/T0053.md) | I00051T003 Twitter trolls amplify & manipulate | +| [T0054 Twitter bots amplify](../techniques/T0054.md) | I00051T002 Twitter bots amplify & manipulate | +| [T0056 Dedicated channels disseminate information pollution](../techniques/T0056.md) | I00051T004 RT & Sputnik generate information pollution | + +DO NOT EDIT ABOVE THIS LINE - PLEASE ADD NOTES BELOW + +Actor: Russia + +Timeframe: December 2018 - (ongoing) + +Date: December 10, 2018 + +Presumed goals: + +* Russian disinformation intended to confuse audiences and discredit an organisation (Integrity Inititative)which is working independently to tackle the threat of disinformation. Russia’s state-owned media outlets have seized on the posted materials, with the government’s RT and Sputnik news sites writing dozens of stories claiming that the materials prove that the British government, rather than Russia, is trying to poison internet discourse with propaganda. + +Method: + +* Hack (email), leak, amplify, smear MSM + +Counters: none identified + +Related incidents: + +* The campaign also threads other organization into the “conspiracy” such as Britsh Military, NATO and the CIA. +* With it, efforts to further discredit MH17 for instance; tie-in Soro’s (dog-whistle for the far-right); +* yet at the same defend the far-left alleging Integrity Initiative was running a smear campaign again UK Labour/Jeremy Corbyn + +References: +* https://eaworldview.com/2019/01/counter-russia-disinformation-integrity-initiative/ +* https://www.stopfake.org/en/kremlin-watch-briefing-the-eu-has-to-start-taking-pro-kremlin-disinformation-seriously/ +* https://www.buzzfeednews.com/article/kevincollier/russian-hackers-british-institute +* https://www.bbc.com/news/uk-46509956 +* https://www.thetimes.co.uk/article/anti-propaganda-website-forced-offline-by-hacking-b0ds2bkbp +* https://eaworldview.com/2019/01/counter-russia-disinformation-integrity-initiative/ +* https://news.sky.com/story/highly-likely-moscow-hacked-uk-agency-countering-russian-disinformation-11656539 +* http://euromaidanpress.com/2019/01/17/russian-attack-on-the-integrity-initiative-what-makes-the-mafia-different-from-the-police/ + +Datasets: + +Notes: + +RT and Sputnik claim that the Integrity Initiative hack was the work of freelancers aligned with the online Anonymous collective and who were not affiliated with the Russian government. The primary evidence for that, according to RT and Sputnik, is that the stolen Integrity Initiative material was posted to the website of a hacktivist collective called CyberGuerrilla, alongside manifestos claiming “We are Anonymous” and posts saying “We have warned the UK government that it must conduct an honest and transparent investigation into the activity of the Integrity Initiative and the Institute for Statecraft.” + +The Integrity Initiative has pulled down its website, replacing it with a reiteration of its mission, a description of the hack, and a call for tips. +“This international public programme was set up in 2015 to counter disinformation and other forms of malign influence being conducted by states and sub-state actors seeking to interfere in democratic processes and to undermine public confidence in national political institutions,” a spokesperson said in a statement. + + + diff --git a/incidents/I00052.md b/incidents/I00052.md new file mode 100644 index 0000000..513678f --- /dev/null +++ b/incidents/I00052.md @@ -0,0 +1,24 @@ +# China overiew + +* Type: campaign + +* Name: China overiew + +* Id: I00052 + +* Summary: nan + +* Year started: 2015.0 + +* From country / To country: China / World + +* Found via: nan + +* Date added: 2019-03-20 + +* Techniques used: + +| Technique | Description given for this incident | +| --------- | ------------------------- | + +DO NOT EDIT ABOVE THIS LINE - PLEASE ADD NOTES BELOW \ No newline at end of file diff --git a/incidents/I00053.md b/incidents/I00053.md new file mode 100644 index 0000000..fc1b5f6 --- /dev/null +++ b/incidents/I00053.md @@ -0,0 +1,125 @@ +# China Huawei CFO Arrest + +* Type: incident + +* Name: China Huawei CFO Arrest + +* Id: I00053 + +* Summary: Dec. 1: Canadian authorities arrest Huawei's chief financial officer Meng Wanzhou at Vancouver’s airport while she is en route from Hong Kong to Mexico, after an extradition request from the Americans. The news becomes public on Dec. 5. Dec. 7: In Vancouver, Meng appears in court, where allegations of fraud are laid out. The U.S. alleges Meng misled American banks in a bid to get around American sanctions on Iran. +Geopolitically complex issue combines US/China trade; Security concerns/issues related to Huawei’s 5G wireless equipment; diplomacy between Canada & China as Chinese subsequently arrest Canadian citizens. + +* Year started: 2018.0 + +* From country / To country: China / World + +* Found via: nan + +* Date added: 2019-03-20 + +* Techniques used: + +| Technique | Description given for this incident | +| --------- | ------------------------- | +| [T0001 5Ds (dismiss, distort, distract, dismay, divide)](../techniques/T0001.md) | I00053T005 China also plays victim, innocence, plays by rules, misunderstood narrative | +| [T0001 5Ds (dismiss, distort, distract, dismay, divide)](../techniques/T0001.md) | I00053T006 Chinese ambassador Lu Shaye accused Canada of applying a double standard, and has decried what he sees as “Western egotism and white supremacy” in the treatment of detained Huawei executive Meng Wanzhou.” | +| [T0023 Distort facts](../techniques/T0023.md) | I00053T002 Distorted, saccharine “news” about the Chinese State and Party | +| [T0050 Cheerleading domestic social media ops](../techniques/T0050.md) | I00053T004 Extend digital the physical space… gatherings ie: support for Meng outside courthouse | +| [T0056 Dedicated channels disseminate information pollution](../techniques/T0056.md) | I00053T001 State-run media seeds foreign influence environment | +| [T0057 Organise remote rallies and events](../techniques/T0057.md) | I00053T003 Events coordinated and promoted across media platforms | +| [T0057 Organise remote rallies and events](../techniques/T0057.md) | I00053T004 Extend digital the physical space… gatherings ie: support for Meng outside courthouse | + +DO NOT EDIT ABOVE THIS LINE - PLEASE ADD NOTES BELOW + +Actor: China + +Timeframe: December 5, 2018 - still active on 04/03/2019 + +Date: December 5, 2018 + +Presumed goals: + +* Unlike Russia, Chinese state has employed a plethora of state-run media to exploit the openness of American democratic society in an effort to insert an intentionally distorted and biased narrative portraying a utopian view of the Chinese government and party. + +Method: + +* China’s state-run social media operations are largely positive and coordinated because those techniques support Chinese strategic goals. State-run media seeds foreign influence environment +* Distorted, saccharine “news” about the Chinese State and Party +* Events coordinated and promoted across media platforms +* Extend from digital into physical space with gatherings, ie: support for Meng outside courthouse + +* In the case of Chinese state-run information manipulation campaigns — to distinguish the political intent and national strategies underlying these campaigns as different from simply another perspective on the news. China also play’s victim, innocence, plays by rules, misunderstood narrative… they too have their version of the 4D’s. Examples: “Chinese ambassador Lu Shaye has accused Canada of applying a double standard, and has decried what he sees as “Western egotism and white supremacy” in the treatment of detained Huawei executive Meng Wanzhou.” - Op-Ed in Globe & Mail. The Chinese embassy in Canada says the Vancouver arrest of a top Huawei executive amounts to a “political conspiracy” to undermine the telecom giant and it dismisses Prime Minister Justin Trudeau’s assertion that he had no role in the high-profile case. Canada's arrest of a senior Huawei executive was the "backstabbing" of a friend, Chinese ambassador Lu Shaye said Thursday, and he warned of repercussions if the federal government bars her telecom company from building a Canadian 5G network. + +Counters: none identified/researched + +Related incidents: + +* See Poland (arrest of Huawei employee); Czech republic; +* Five Eyes to ban or not ban Huawei 5G network equipment + + +References: + +* https://www.theglobeandmail.com/politics/article-chinas-envoy-says-white-supremacy-played-part-in-canadas-arrest-of/ +* https://twitter.com/globaltimesnews +* https://twitter.com/UserExperienceU +* https://www.universityworldnews.com/post.php?story=20190125061623487 +* https://www.theglobeandmail.com/business/article-canadian-universities-continuing-rd-funding-partnerships-with/ +* http://fortune.com/2019/01/18/oxford-university-huawei-research-funding/ +* https://www.reuters.com/article/us-usa-china-security-universities-insig/u-s-universities-unplug-from-chinas-huawei-under-pressure-from-trump-idUSKCN1PI0GV + + +* Beyond Hybrid War: How China Exploits Social Media to Sway American Opinion +https://www.theglobeandmail.com/politics/article-china-says-arrest-of-huawei-cfo-part-of-political-conspiracy-by/ +* https://www.theatlantic.com/international/archive/2019/03/czech-zeman-babis-huawei-xi-trump/584158 +* https://www.defenseone.com/technology/2019/04/installing-chinese-5g-gear-dangerous-and-probably-inevitable-nato-report/156007/?oref=defenseone_today_nl +* https://www.ctvnews.ca/politics/canada-s-arrest-of-huawei-exec-an-act-of-backstabbing-chinese-ambassador-says-1.4258201 +* https://www.cnn.com/2019/01/09/asia/china-canada-meng-huawei-intl/index.html +* https://www.theglobeandmail.com/opinion/article-on-china-has-canada-lost-its-sense-of-justice/ +* https://portswigger.net/daily-swig/proper-news-or-propaganda-chinas-social-media-manipulations-exposed +* https://globalnews.ca/news/4758109/china-bully-canada-release-huawei-cfo/ +* https://www.ctvnews.ca/canada/canada-will-pay-chinese-state-media-threaten-repercussions-over-huawei-arrest-1.4216293 +* https://business.financialpost.com/telecom/inside-huaweis-rather-awkward-charm-offensive-to-convince-the-world-its-ok +* https://www.scmp.com/comment/letters/article/3001272/despite-us-allegations-huawei-has-done-nothing-wrong-why-should-it + +Datasets: none identified (mining more Twitter data, Reddit, and comment forums could be valuable research) + +Notes: + +While a hypothesis and not related to Meng’s arrest, research done by John Gray (using Mentionmapp data from January 13, 2019) also suggests the need to look at adjecent/tangential flow of social data. In this case (could be coincidence) simutatneaous flow of tweets via State Media @globaltimesnews (reporting on Poland arrest) and of “influencer” (using bots to amplify content) @UserExperienceU tweeting favorable about Huawei technology. Need to consider the amplifiers/influencers operate to support/put the happy face on Huawei. More work needs to be done researching social behavior outside the “Great Firewall” using trolls, bots, cyborgs, and “willing/unwitting” idiots. Just like Russia, we also need to give more consideration to how bots/automation (low-volume in particular) is operating to amplify State Media in order to gain higher fidelity in search engines. + +We should also recognize another form of Huawei/China manipulation in the form of research programs in Universities across North America and Europe +https://www.universityworldnews.com/post.php?story=20190125061623487 +https://www.theglobeandmail.com/business/article-canadian-universities-continuing-rd-funding-partnerships-with/ +fortune.com/2019/01/18/oxford-university-huawei-research-funding/ +https://www.reuters.com/article/us-usa-china-security-universities-insig/u-s-universities-unplug-from-chinas-huawei-under-pressure-from-trump-idUSKCN1PI0GV + +Timeline of events + +Dec. 6: China demands Canada release Meng and “immediately correct the mistake” officials made in arresting her. The Chinese also say they were not briefed on the reasons for Meng’s arrest. +In Ottawa, Prime Minister Justin Trudeau says Meng’s case is part of an independent legal process with no outside political influence. +Dec. 7: In Vancouver, Meng appears in court, where allegations of fraud are laid out. The U.S. alleges Meng misled American banks in a bid to get around American sanctions on Iran. +Dec. 8: Canada’s ambassador to China, John McCallum, is summoned to a meeting with China’s assistant foreign minister so the country can register complaints about Meng’s arrest. “China strongly urges the Canadian side to immediately release the detained Huawei executive … or face grave consequences that the Canadian side should be held accountable for,” the assistant minister, Le Yucheng, says in a statement. + +Dec. 12: China’s foreign ministry says it has no information about Kovrig, but says the organization he worked with – the International Crisis Group – was not registered in China, making its activities in the country illegal. + +Dec. 13: China’s foreign ministry says Kovrig and Spavor have been detained on suspicion of “endangering national security.” + +Dec. 20: Indictments unsealed in the United States allege two Chinese citizens targeted companies in Canada and around the world as part of a years-long hacking campaign to steal data. + +Dec. 24: China’s foreign ministry calls out the U.S., Britain and EU, saying the trio should be condemning Canada for Meng’s arrest. Spokeswoman Hua Chunying says Canada should “correct its mistakes” and stop acting at the behest of the United States. She says Kovrig and Spavor’s rights are being respected in custody. + +Jan. 9: China’s envoy in Ottawa suggests Canada and its Western allies are white supremacists for calling for the release of two Canadians imprisoned last month by his country’s communist government. Ambassador Lu Shaye makes the accusation in an op-ed in the Hill Times. + +Jan. 15: China expresses its “strong dissatisfaction” with Trudeau over his criticism of Schellenberg’s sentence. Trudeau should “respect the rule of law, respect China’s judicial sovereignty, correct mistakes and stop making irresponsible remarks,” foreign ministry spokeswoman Hua Chunying says. + +Jan. 17: Ambassador Shaye says Canada’s arrest of Meng was an act of “backstabbing” by a friend. Lu warns of “repercussions” if Canada bars the firm from its new 5G network for security reasons, as have three of its intelligence-sharing allies. + +Jan. 22: China demands the U.S. drop a request that Canada extradite Meng. Foreign Ministry spokeswoman Hua Chunying said Meng’s case was out of the ordinary and Canada’s extradition treaty with the U.S. infringed on the “safety and legitimate rights and interests of Chinese citizens.” +Jan. 28: The U.S. Department of Justice formally levels criminal charges against Huawei, two subsidiaries and Meng. The charges, contained in two newly unsealed indictments, allege that Huawei misrepresented its ownership of a Hong Kong-based subsidiary to circumvent American sanctions against Iran. Furthermore, they say Huawei stole telecommunications technology, trade secrets and equipment from U.S. cellphone provider T-Mobile USA. Meng is charged with bank fraud, wire fraud and two counts of conspiracy to commit both. In a statement, Huawei denied committing any of the violations cited in the indictment. + +Jan. 29:China calls on the U.S. to “stop the unreasonable crackdown” on Huawei, saying it will “firmly defend” its companies. + +March 6: A lawyer for Meng tells a judge the United States’ bid for extradition raises serious concerns about the political motivations behind the case as the matter is scheduled to return to court on May 8 to set hearing dates. + + diff --git a/incidents/I00054.md b/incidents/I00054.md new file mode 100644 index 0000000..aa9336a --- /dev/null +++ b/incidents/I00054.md @@ -0,0 +1,24 @@ +# China Muslims + +* Type: incident + +* Name: China Muslims + +* Id: I00054 + +* Summary: nan + +* Year started: 2018.0 + +* From country / To country: China / World + +* Found via: nan + +* Date added: 2019-03-20 + +* Techniques used: + +| Technique | Description given for this incident | +| --------- | ------------------------- | + +DO NOT EDIT ABOVE THIS LINE - PLEASE ADD NOTES BELOW \ No newline at end of file diff --git a/incidents/I00055.md b/incidents/I00055.md new file mode 100644 index 0000000..5261cf3 --- /dev/null +++ b/incidents/I00055.md @@ -0,0 +1,24 @@ +# 50 Cent Army + +* Type: campaign + +* Name: 50 Cent Army + +* Id: I00055 + +* Summary: nan + +* Year started: 2008.0 + +* From country / To country: China / World + +* Found via: nan + +* Date added: 2019-03-20 + +* Techniques used: + +| Technique | Description given for this incident | +| --------- | ------------------------- | + +DO NOT EDIT ABOVE THIS LINE - PLEASE ADD NOTES BELOW \ No newline at end of file diff --git a/incidents/I00056.md b/incidents/I00056.md new file mode 100644 index 0000000..3859c58 --- /dev/null +++ b/incidents/I00056.md @@ -0,0 +1,97 @@ +# Iran Influence Operations + +* Type: campaign + +* Name: Iran Influence Operations + +* Id: I00056 + +* Summary: Iranian interference in the politics of Arab countries has become more self-evident since the Arab Spring of 2011. Iran has been trying to widen its influence in the region in a political confrontation with Saudi Arabia. Factor long-held hostility to US (Iran as a member of the “Axis of Evil”) & Isreal; it’s funding of proxies (Hezbolla) and Shia militia’s in Iraq; and most recently having the Revolutionary Guard being designated a terror organization; the seeming collapse of the Joint Comprehensive Plan of Action (nuclear programme) and expanding economic sanctions all add up to an increased likihood of Iran expanding their information operations. +While there is history to Iran’s information/influence operations, starting with FireEye’s report about Iranian “fake news” websites, and subsequent reports by DFRLab (Jan 31, 2019 and March 26, 2019) we have strong document proof and assets that highlight Iran’s activities. + +* Year started: 2012.0 + +* From country / To country: Iran / World + +* Found via: nan + +* Date added: 2019-03-20 + +* Techniques used: + +| Technique | Description given for this incident | +| --------- | ------------------------- | +| [T0007 Create fake Social Media Profiles / Pages / Groups](../techniques/T0007.md) | I00056T003 Fake FB groups/pages/profiles + dark content (non-paid advertising) | +| [T0008 Create fake or imposter news sites](../techniques/T0008.md) | I00056T006 Fake news/synthetic web-sites | +| [T0021 Memes](../techniques/T0021.md) | I00056T005 Memes... anti-Isreal/USA/West, conspiracy narratives | +| [T0022 Conspiracy narratives](../techniques/T0022.md) | I00056T005 Memes... anti-Isreal/USA/West, conspiracy narratives | +| [T0046 Search Engine Optimization](../techniques/T0046.md) | I00056T004 SEO optimisation/manipulation ("key words") | +| [T0053 Twitter trolls amplify and manipulate](../techniques/T0053.md) | I00056T002 Twitter trolls amplify & manipulate | +| [T0054 Twitter bots amplify](../techniques/T0054.md) | I00056T001 Twitter bots amplify & manipulate | +| [T0058 Legacy web content](../techniques/T0058.md) | I00056T007 legacy web content | + +DO NOT EDIT ABOVE THIS LINE - PLEASE ADD NOTES BELOW + +Actor: Iran + +Timeframe: 2012 - ongoing + +Date: Aug 21, 20198 + +Presumed goals: + +* Iran’s meddling in the politics of the Arab states has become more conspicuous since the Arab Spring of 2011. Iran has been trying to widen its influence in the region in its political jousting against Saudi Arabia which is sometimes referred to as “the Arab Cold War”. Although the two regional rivals have never declared war, the two players have been involved in proxy wars in the region including Syria and Yemen. +* Pages promoted or amplified views in line with Iranian government’s international stances. The pages posted content with strong bias for the government in Tehran and against the “West” and regional neighbors, such as Saudi Arabia and Israel.The operation was noteworthy, however, that more than 30 percent of the removed assets were active for five or more years, indicating that Iranian entities have been engaged in social media influence campaigns since as early as 2010 (DFRLab) + + +Method: + +* In August 2018, Facebook removed 652 pages, groups, and accounts on Facebook and Instagram originating from Iran for engaging in a “coordinated inauthentic behaviour”. 15 These operations targeted people in the Middle East, Latin America, the UK, and the US. In October 2018, Facebook announced the removal of another 82 pages, groups, and accounts on Facebook and Instagram. This time the company announced that these accounts and pages targeted people in the US and the UK.16 Some of these accounts masqueraded as American citizens pushing anti-Saudi and anti-Israel narratives. +* In October 2018, Twitter published two data sets comprising 3,841 accounts affiliated with the Internet Research Agency (IRA), and 770 accounts that could be traced back to Iran. These accounts were suspended by Twitter in August 2018 for engaging in coordinated manipulation on the platform. Twitter believes that the information operations linked to Iran are potentially backed by the state +* 70 websites found by Reuters which push Iranian propaganda to 15 countries, in an operation that cybersecurity experts, social media firms and journalists are only starting to uncover. The sites found by Reuters are visited by more than half a million people a month, and have been promoted by social media accounts with more than a million followers… the sites in the campaign have been active at different times since 2012. They look like normal news and media outlets,but only a couple disclose any Iranian ties. +* The social media companies have closed hundreds of accounts that promoted the sites or pushed Iranian messaging. Facebook said last month it had taken down 82 pages, groups and accounts linked to the Iranian campaign; these had gathered more than one million followers in the United States and Britain. But the sites uncovered by Reuters have a much wider scope. They have published in 16 different languages, from Azerbaijani to Urdu, targeting Internet users in less-developed countries. That they reached readers in tightly controlled societies such as Egypt, which has blocked hundreds of news websites since 2017, highlights the campaign’s reach. +* Ten outlets targeting readers in Yemen, where Iran and U.S. ally Saudi Arabia have been fighting a proxy conflict since civil war broke out in 2015; A media outlet offering daily news and satirical cartoons in Sudan. Reuters could not reach any of its staff; A website called Realnie Novosti, or “Real News,” for Russian readers. It offers a downloadable mobile phone app but its operator could not be traced. +* One of IUVM’s most popular users is a site called Sudan Today, which SimilarWeb data shows receives almost 150,000 unique visitors each month. On Facebook, it tells its 57,000 followers that it operates without political bias. Its 18,000 followers on Twitter have included the Italian Embassy in Sudan, and its work has been cited in a report by the Egyptian Electricity Ministry. +The office address registered for Sudan Today in 2016 covers a whole city district in north Khartoum, according to archived website registration details provided by WhoisAPI Inc and DomainTools LLC. The phone number listed in those records does not work. +* We have observed inauthentic social media personas, masquerading as American liberals supportive of U.S. Senator Bernie Sanders, heavily promoting Quds Day, a holiday established by Iran in 1979 to express support for Palestinians and opposition to Israel. (FireEye) +* Broadly speaking, the intent behind this activity appears to be to promote Iranian political interests, including anti-Saudi, anti-Israeli, and pro-Palestinian themes, as well as to promote support for specific U.S. policies favorable to Iran, such as the U.S.-Iran nuclear deal (JCPOA). In the context of the U.S.-focused activity, this also includes significant anti-Trump messaging and the alignment of social media personas with an American liberal identity. However, it is important to note that the activity does not appear to have been specifically designed to influence the 2018 U.S. midterm elections, as it extends well beyond U.S. audiences and U.S. politics. (FireEye) +* All 17 of the pages containing information about manager location had managers from Iran. Canada, Saudi Arabia, and Syria were other common locations of page managers. (DFRLab) +Promoting Shi’a Political and Militant Views +* One of the removed pages — @alalsadrr1 — promoted Moqtada al-Sadr, an influential Shi’a cleric and militia leader from Iraq and leader of the Mahdi Army. According to the Wilson Center, in the mid-2000’s, the Mahdi Army received weapons and training from the Islamic Revolutionary Guard Corps and Lebanese Hezbollah agents. In May 2018, The Atlantic reported that the “controversial” leader and his followers had committed brutal atrocities in Iraq, fought the U.S. military in Sadr City and Basra, and were known for corruption. (DfRLab) +* In January, Facebook took down 783 accounts and pages, which it assessed as “directed from Iran, in some cases repurposing Iranian state media content.” (DFRLab - March 26, 2019) +The operation strongly resembled the earlier IUVM operation. Facebook did not attribute it to IUVM directly, but the latest network used the same techniques and pointed to some of the same websites, making attribution to the same network likely, although not confirmed. +In particular, pages across the network reproduced IUVM content, as well as content from other websites which have featured in earlier exposés and takedowns. +The network functioned by steering users towards ostensibly independent news websites, which amplified Iranian regime propaganda, often copied verbatim from regime assets. The social media content therefore served as a secondary amplifier, rather than a direct audience-engagement tool. +Despite the heterogeneous nature of the assets — they were spread across many countries, languages, and cultures — their messaging was largely homogeneous. It dealt with issues of importance to the Iranian government, supporting Palestinians and Shia Muslims on one hand, and attacking Israel, the United States, Saudi Arabia, and the conduct of the military campaign in Yemen on the other. +The focus on South Asia was noteworthy. Indonesia and India had the most pages targeted at them; African countries also featured prominently. This expands the known area of Iranian influence operations, which have thus far been primarily exposed in the Middle East and in the West. + + +Counters: + +* Facebook and Twitter content take-downs + +Related incidents: + +* See Venezuela: +https://www.bloomberg.com/news/articles/2019-02-01/iran-slams-u-s-over-venezuela-secretly-some-may-be-relieved +https://www.rand.org/blog/2019/02/hezbollah-is-in-venezuela-to-stay.html + + +References: + +* http://www.state.gov/e/eb/tfs/spi/iran/jcpoa/ +* http://www.arabnews.com/node/1329971/middle-east +* https://www.wilsoncenter.org/article/part-2-pro-iran-militias-iraq +* https://www.theatlantic.com/international/archive/2018/05/iraq-moqtada-sadr/559499/ +* https://www.amnesty.org/en/latest/news/2014/10/iraq-evidence-war-crimes-government-backed-shi-militias/ +* http://www.washingtonpost.com/wp-dyn/content/article/2008/04/18/AR2008041803429.html +* https://www.telegraph.co.uk/news/worldnews/middleeast/iraq/1498970/UK-troops-left-isolated-as-Mahdi-Army-weaves-a-web-of-official-corruption.html +* https://medium.com/dfrlab/trolltracker-outward-influence-operation-from-iran-cc4539684c8d +* https://newsroom.fb.com/news/2019/01/removing-cib-iran/ +* https://www.reuters.com/article/us-cyber-iran-specialreport/special-report-how-iran-spreads-disinformation-around-the-world-idUSKCN1NZ1FT +* https://www.rand.org/blog/2018/08/irans-disinformation-campaigns.html +* https://medium.com/dfrlab/takedown-details-of-the-iranian-propaganda-network-d1fad32fdf30 +* https://medium.com/dfrlab/trolltracker-outward-influence-operation-from-iran-cc4539684c8d +* https://comprop.oii.ox.ac.uk/wp-content/uploads/sites/93/2019/04/Iran-Memo.pdf +* https://www.fireeye.com/blog/threat-research/2018/08/suspected-iranian-influence-operation.html + diff --git a/incidents/I00057.md b/incidents/I00057.md new file mode 100644 index 0000000..01b9ae2 --- /dev/null +++ b/incidents/I00057.md @@ -0,0 +1,24 @@ +# Mexico Election + +* Type: incident + +* Name: Mexico Election + +* Id: I00057 + +* Summary: nan + +* Year started: 2018.0 + +* From country / To country: Russia/domestic / Mexico + +* Found via: nan + +* Date added: 2019-03-20 + +* Techniques used: + +| Technique | Description given for this incident | +| --------- | ------------------------- | + +DO NOT EDIT ABOVE THIS LINE - PLEASE ADD NOTES BELOW \ No newline at end of file diff --git a/incidents/I00058.md b/incidents/I00058.md new file mode 100644 index 0000000..653689c --- /dev/null +++ b/incidents/I00058.md @@ -0,0 +1,24 @@ +# Chemnitz + +* Type: incident + +* Name: Chemnitz + +* Id: I00058 + +* Summary: nan + +* Year started: 2018.0 + +* From country / To country: Russia / Germany + +* Found via: nan + +* Date added: 2019-03-20 + +* Techniques used: + +| Technique | Description given for this incident | +| --------- | ------------------------- | + +DO NOT EDIT ABOVE THIS LINE - PLEASE ADD NOTES BELOW \ No newline at end of file diff --git a/incidents/I00059.md b/incidents/I00059.md new file mode 100644 index 0000000..956cfe1 --- /dev/null +++ b/incidents/I00059.md @@ -0,0 +1,24 @@ +# Myanmar - Rohingya + +* Type: campaign + +* Name: Myanmar - Rohingya + +* Id: I00059 + +* Summary: nan + +* Year started: 2014.0 + +* From country / To country: Myanmar / Myanmar + +* Found via: nan + +* Date added: 2019-03-20 + +* Techniques used: + +| Technique | Description given for this incident | +| --------- | ------------------------- | + +DO NOT EDIT ABOVE THIS LINE - PLEASE ADD NOTES BELOW \ No newline at end of file diff --git a/incidents/I00060.md b/incidents/I00060.md new file mode 100644 index 0000000..28d654a --- /dev/null +++ b/incidents/I00060.md @@ -0,0 +1,43 @@ +# White Genocide + +* Type: campaign + +* Name: White Genocide + +* Id: I00060 + +* Summary: nan + +* Year started: 2018.0 + +* From country / To country: Russia / World + +* Found via: nan + +* Date added: 2019-03-20 + +* Techniques used: + +| Technique | Description given for this incident | +| --------- | ------------------------- | + +DO NOT EDIT ABOVE THIS LINE - PLEASE ADD NOTES BELOW + +Actors: + +Timeframe: + +Date: + +Presumed goals: + +Method: + +Counters: + +Related incidents: + +References: +* (Trump’s White-Nationalist Pipeline)[https://www.theatlantic.com/politics/archive/2018/08/trump-white-nationalism/568393/] +* (Parallels between social media misinformation campaigns in the USA and South Africa)[https://www.iafrikan.com/2018/11/20/social-media-usa-south-africa-fake-news-disinformation/] +* (The high price of 'white genocide' politics for Australia)[https://www.smh.com.au/world/oceania/the-high-price-of-white-genocide-politics-for-australia-20180724-p4zt9k.html] diff --git a/incidents/I00061.md b/incidents/I00061.md new file mode 100644 index 0000000..abea84c --- /dev/null +++ b/incidents/I00061.md @@ -0,0 +1,24 @@ +# Military veterans Targetting + +* Type: campaign + +* Name: Military veterans Targetting + +* Id: I00061 + +* Summary: nan + +* Year started: 2017.0 + +* From country / To country: Russia / US + +* Found via: nan + +* Date added: 2019-03-20 + +* Techniques used: + +| Technique | Description given for this incident | +| --------- | ------------------------- | + +DO NOT EDIT ABOVE THIS LINE - PLEASE ADD NOTES BELOW \ No newline at end of file diff --git a/incidents/I00062.md b/incidents/I00062.md new file mode 100644 index 0000000..54e4d94 --- /dev/null +++ b/incidents/I00062.md @@ -0,0 +1,26 @@ +# Brexit/UK ongoing + +* Type: campaign + +* Name: Brexit/UK ongoing + +* Id: I00062 + +* Summary: nan + +* Year started: 2015.0 + +* From country / To country: Russia/domestic / UK + +* Found via: nan + +* Date added: 2019-03-20 + +* Techniques used: + +| Technique | Description given for this incident | +| --------- | ------------------------- | + +DO NOT EDIT ABOVE THIS LINE - PLEASE ADD NOTES BELOW + +See also I00005. \ No newline at end of file diff --git a/incidents/I00063.md b/incidents/I00063.md new file mode 100644 index 0000000..c070f3b --- /dev/null +++ b/incidents/I00063.md @@ -0,0 +1,77 @@ +# Olympic Doping Scandal + +* Type: campaign + +* Name: Olympic Doping Scandal + +* Id: I00063 + +* Summary: On 18 July 2016, Richard McLaren, a Canadian attorney retained by WADA to investigate Grigor Rodchenkov (the former head of Russia's national anti-doping laboratory, the Anti-Doping Center, which was suspended by the World Anti-Doping Agency (WADA) in November 2015 for facilitating Russia's elaborate state-sponsored doping program. Rodchenkov helped develop and distribute banned performance-enhancing substances for thousands of Russian Olympians from 2005 to 2015. He made headlines in 2016 as a whistleblower, helping expose the complex and extensive nature of Russia's doping program. His revelations lead to Russia's partial ban from the 2016 Summer Olympics and total ban from the 2018 Winter Olympics.). These allegations led to a 97-page report covering significant state-sponsored doping in Russia. + +The investigation found corroborating evidence after conducting witness interviews, reviewing thousands of documents, analysis of hard drives, forensic analysis of urine sample collection bottles, and laboratory analysis of individual athlete samples, with "more evidence becoming available by the day." The report concluded that it was shown "beyond a reasonable doubt" that Russia's Ministry of Sport, the Centre of Sports Preparation of the National Teams of Russia, the Federal Security Service (FSB), and the WADA-accredited laboratory in Moscow had "operated for the protection of doped Russian athletes" within a "state-directed failsafe system" using "the disappearing positive [test] methodology" (DPM) after the country's poor medal count during the 2010 Winter Olympic Games in Vancouver. McLaren stated that urine samples were opened in Sochi in order to swap them "without any evidence to the untrained eye". The official producer of BEREG-KIT security bottles used for anti-doping tests, Berlinger Group, stated, "We have no knowledge of the specifications, the methods or the procedures involved in the tests and experiments conducted by the McLaren Commission." + +* Year started: 2016.0 + +* From country / To country: Russia / World + +* Found via: nan + +* Date added: 2019-04-06 + +* Techniques used: + +| Technique | Description given for this incident | +| --------- | ------------------------- | +| [T0001 5Ds (dismiss, distort, distract, dismay, divide)](../techniques/T0001.md) | I00063T003 4 D's (dismiss, distort, distract, dismay...Official channels ie: Putin himself; Embassies & Sports Ministry; TASS | +| [T0010 Cultivate ignorant agents](../techniques/T0010.md) | I00063T005 cultivate, manipulate, exploit useful idiots | +| [T0019 Generate information pollution](../techniques/T0019.md) | I00063T004 RT & Sputnik generate information pollution (synthetic media) | +| [T0031 YouTube](../techniques/T0031.md) | I00063T008 YouTube; Reddit; | +| [T0032 Reddit](../techniques/T0032.md) | I00063T008 YouTube; Reddit; | +| [T0046 Search Engine Optimization](../techniques/T0046.md) | I00063T006 SEO optimisation/manipulation ("key words") | +| [T0052 Tertiary sites amplify news](../techniques/T0052.md) | I00063T007 News circulated/amplifed by tertiary sites (Russia Insider, The Duran, Geopolitica.ru, Mint Press News, Oriental Review, globalresearch.ca) | +| [T0053 Twitter trolls amplify and manipulate](../techniques/T0053.md) | I00063T002 Twitter trolls amplify & manipulate | +| [T0054 Twitter bots amplify](../techniques/T0054.md) | I00063T001 Twitter bots amplify & manipulate | +| [T0056 Dedicated channels disseminate information pollution](../techniques/T0056.md) | I00063T004 RT & Sputnik generate information pollution (synthetic media) | + +DO NOT EDIT ABOVE THIS LINE - PLEASE ADD NOTES BELOW + +Actor: Russia + +Timeframe: July 18, 2016 - ongoing + +Date: July 18, 2016 + +Presumed goals: + +* Sports ie the Olympics is another platform to project power, and bans on Russian athletes, the stripping of medals is serious business. Deflect from negative West perspective as state-run cheats/crooks; World/West plot against us; Proclaim Russian innocence & image to domestic audience; + +Method: + +* Some Russians described the allegations as an anti-Russian plot while others stated that Russia was "just doing what the rest of the world does" Just like MH17 and Skripal, Russia gets caught and goes into 4-D mode… ie: the above comment - dismiss/”what-aboutism” +* Deny - Russian President Vladimir Putin said that Russia had "never supported any violations in sport, we have never supported it at the state level, and we will never support this" and that the allegations were part of an "anti-Russia policy" by the West. +* Dismiss - Russian Minister of Foreign Affairs, Sergey Lavrov, commented that the United States "fears honest competition", affirming Vladimir Putin's position that the United States used its influence within the IOC to "orchestrate the doping scandal" +* Many Russians believed that the IOC was retaliating against Russia for their discriminatory anti-gay law which provoked considerable controversy with the IOC during the 2014 Winter Olympics. Russian MP Dmitry Svishchev, who is also the head of Russia's Curling Federation, was quoted by Ria Novosti news agency as saying: "This is what we expected. There's nothing new, only empty allegations against all of us. If you are Russian, you'll get accused of every single sin." Aleksei Pushkov, chairman of Russia's parliamentary foreign affairs committee, said that the IAAF's decision to uphold its ban was "an act of political revenge against Russia for its independent foreign policy." A member of Russia's parliament, Vadim Dengin, stated, "The entire doping scandal is a pure falsification, invented to discredit and humiliate Russia +Talking points as above are futher amplifed/spun via Russian media, and public apologists; while this happened prior to 2016 US Elections, suggesting the IRA along with trolls & bots operating in the social space (Twitter, FB, YouTube, Reddit) could be deemed naive. + +Counters: + +Related incidents: + +* Prelude to 2016 +* the end of the 2014 Sochi Olympics where Russian athletes dominate (in combination with Euromaiden “crisis”) “emboldens” Putin/Russia to make move on Ukraine invasion. +* Russians allegedly tried to hack the World Anti-Doping Agency (WADA)... The Justice Department filed criminal charges against seven members of the GRU, Russia's main military intelligence unit, accusing them of hacking into the U.S. Anti-Doping Agency in Colorado Springs, Colorado, as well as four international sports governing bodies. A grand jury indictment said the operation was in retaliation for the exposure of Russia's state-sponsored athlete doping program that resulted in a ban from the 2016 summer Olympics in Brazil. + +References: + +* https://www.nbcnews.com/news/world/international-olympic-committee-bars-russia-2018-winter-games-over-doping-n826671 + +* https://www.nytimes.com/2016/05/13/sports/russia-doping-sochi-olympics-2014.html?module=inline +* https://www.bbc.com/sport/38261608 +* https://en.wikipedia.org/wiki/Doping_in_Russia +* https://www.theguardian.com/technology/2016/aug/22/russian-hackers-world-anti-doping-agency-dnc-hack-fancy-bear +* https://www.dw.com/en/two-russians-probed-for-hacking-anti-doping-agency-wada/a-45502397 +* https://www.nytimes.com/2018/01/10/sports/olympics/russian-hackers-emails-doping.html +* https://qz.com/1413474/all-of-the-victims-named-in-the-latest-russian-hacking-scandal/ +* https://www.nbcnews.com/news/us-news/7-russians-indicted-hacking-related-olympic-doping-scandal-nerve-agent-n916656 + + diff --git a/matrices/.DS_Store b/matrices/.DS_Store new file mode 100644 index 0000000..5008ddf Binary files /dev/null and b/matrices/.DS_Store differ diff --git a/matrices/matrix_arr.csv b/matrices/matrix_arr.csv new file mode 100644 index 0000000..a212e52 --- /dev/null +++ b/matrices/matrix_arr.csv @@ -0,0 +1,12 @@ +P01,P01,P02,P02,P02,P02,P02,P03,P03,P03,P03,P04 +TA01,TA02,TA03,TA04,TA05,TA06,TA07,TA08,TA09,TA10,TA11,TA12 +T0001,T0005,T0007,T0010,T0016,T0019,T0029,T0039,T0047,T0057,T0058, +T0002,T0006,T0008,T0011,T0017,T0020,T0030,T0040,T0048,T0061,T0059, +T0003,,T0009,T0012,T0018,T0021,T0031,T0041,T0049,,T0060, +T0004,,,T0013,,T0022,T0032,T0042,T0050,,, +,,,T0014,,T0023,T0033,T0043,T0051,,, +,,,T0015,,T0024,T0034,T0044,T0052,,, +,,,,,T0025,T0035,T0045,T0053,,, +,,,,,T0026,T0036,T0046,T0054,,, +,,,,,T0027,T0037,,T0055,,, +,,,,,T0028,T0038,,T0056,,, diff --git a/matrix.md b/matrix.md new file mode 100644 index 0000000..fef7beb --- /dev/null +++ b/matrix.md @@ -0,0 +1,174 @@ +# AMITT Latest Framework: + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +
P01 PlanningP01 PlanningP02 PreparationP02 PreparationP02 PreparationP02 PreparationP02 PreparationP03 ExecutionP03 ExecutionP03 ExecutionP03 ExecutionP04 Evaluation
TA01 Strategic PlanningTA02 Objective PlanningTA03 Develop PeopleTA04 Develop NetworksTA05 MicrotargetingTA06 Develop ContentTA07 Channel SelectionTA08 Pump PrimingTA09 ExposureTA10 Go PhysicalTA11 PersistenceTA12 Measure Effectiveness
T0001 5Ds (dismiss, distort, distract, dismay, divide)T0005 Center of Gravity AnalysisT0007 Create fake Social Media Profiles / Pages / GroupsT0010 Cultivate ignorant agentsT0016 ClickbaitT0019 Generate information pollutionT0029 Manipulate online pollsT0039 Bait legitimate influencersT0047 Muzzle social media as a political forceT0057 Organise remote rallies and eventsT0058 Legacy web content
T0002 Facilitate State PropagandaT0006 Create Master NarrativesT0008 Create fake or imposter news sitesT0011 Hijack legitimate accountT0017 Promote online fundingT0020 Trial contentT0030 Backstop personasT0040 Demand unsurmountable proofT0048 Cow online opinion leadersT0061 Sell merchandisingT0059 Play the long game
T0003 Leverage Existing Narratives T0009 Create fake expertsT0012 Use concealmentT0018 Paid targeted adsT0021 MemesT0031 YouTubeT0041 Deny involvementT0049 Flooding T0060 Continue to amplify
T0004 Competing Narratives T0013 Create fake websites T0022 Conspiracy narrativesT0032 RedditT0042 Kernel of TruthT0050 Cheerleading domestic social media ops
T0014 Create funding campaigns T0023 Distort factsT0033 InstagramT0043 Use SMS/ WhatsApp/ Chat appsT0051 Fabricate social media comment
T0015 Create hashtag T0024 Create fake videos and imagesT0034 LinkedInT0044 Seed distortionsT0052 Tertiary sites amplify news
T0025 Leak altered documentsT0035 PinterestT0045 Use fake expertsT0053 Twitter trolls amplify and manipulate
T0026 Create fake researchT0036 WhatsAppT0046 Search Engine OptimizationT0054 Twitter bots amplify
T0027 Adapt existing narrativesT0037 Facebook T0055 Use hashtag
T0028 Create competing narrativesT0038 Twitter T0056 Dedicated channels disseminate information pollution
diff --git a/matrix_to_message.html b/matrix_to_message.html new file mode 100644 index 0000000..e498656 --- /dev/null +++ b/matrix_to_message.html @@ -0,0 +1,263 @@ + + + + AMITT + + + + + +

AMITT

+ + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +
P01 PlanningP01 PlanningP02 PreparationP02 PreparationP02 PreparationP02 PreparationP02 PreparationP03 ExecutionP03 ExecutionP03 ExecutionP03 ExecutionP04 Evaluation
TA01 Strategic PlanningTA02 Objective PlanningTA03 Develop PeopleTA04 Develop NetworksTA05 MicrotargetingTA06 Develop ContentTA07 Channel SelectionTA08 Pump PrimingTA09 ExposureTA10 Go PhysicalTA11 PersistenceTA12 Measure Effectiveness
T0001 5Ds (dismiss, distort, distract, dismay, divide)T0005 Center of Gravity AnalysisT0007 Create fake Social Media Profiles / Pages / GroupsT0010 Cultivate ignorant agentsT0016 ClickbaitT0019 Generate information pollutionT0029 Manipulate online pollsT0039 Bait legitimate influencersT0047 Muzzle social media as a political forceT0057 Organise remote rallies and eventsT0058 Legacy web content
T0002 Facilitate State PropagandaT0006 Create Master NarrativesT0008 Create fake or imposter news sitesT0011 Hijack legitimate accountT0017 Promote online fundingT0020 Trial contentT0030 Backstop personasT0040 Demand unsurmountable proofT0048 Cow online opinion leadersT0061 Sell merchandisingT0059 Play the long game
T0003 Leverage Existing Narratives T0009 Create fake expertsT0012 Use concealmentT0018 Paid targeted adsT0021 MemesT0031 YouTubeT0041 Deny involvementT0049 Flooding T0060 Continue to amplify
T0004 Competing Narratives T0013 Create fake websites T0022 Conspiracy narrativesT0032 RedditT0042 Kernel of TruthT0050 Cheerleading domestic social media ops
T0014 Create funding campaigns T0023 Distort factsT0033 InstagramT0043 Use SMS/ WhatsApp/ Chat appsT0051 Fabricate social media comment
T0015 Create hashtag T0024 Create fake videos and imagesT0034 LinkedInT0044 Seed distortionsT0052 Tertiary sites amplify news
T0025 Leak altered documentsT0035 PinterestT0045 Use fake expertsT0053 Twitter trolls amplify and manipulate
T0026 Create fake researchT0036 WhatsAppT0046 Search Engine OptimizationT0054 Twitter bots amplify
T0027 Adapt existing narrativesT0037 Facebook T0055 Use hashtag
T0028 Create competing narrativesT0038 Twitter T0056 Dedicated channels disseminate information pollution
+
+
    + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +
+ + + diff --git a/phases/P01.md b/phases/P01.md new file mode 100644 index 0000000..2e85c5a --- /dev/null +++ b/phases/P01.md @@ -0,0 +1,11 @@ +# Planning + +* Type: Phase + +* Name: Planning + +* Id: P01 + +* Summary: Planning is the means by which desired outcome is envisioned, effective ways of achieving it are laid out, and the vision, intent, and decisions are communicated, focusing on the results expected to be achieved. + +DO NOT EDIT ABOVE THIS LINE - PLEASE ADD NOTES BELOW \ No newline at end of file diff --git a/phases/P02.md b/phases/P02.md new file mode 100644 index 0000000..461bc10 --- /dev/null +++ b/phases/P02.md @@ -0,0 +1,11 @@ +# Preparation + +* Type: Phase + +* Name: Preparation + +* Id: P02 + +* Summary: Preparation contains the activities conducted before execution to improve the ability to conduct the action. Examples include: development of the ecosystem needed to support the action: people, network, channels, content etc. + +DO NOT EDIT ABOVE THIS LINE - PLEASE ADD NOTES BELOW diff --git a/phases/P03.md b/phases/P03.md new file mode 100644 index 0000000..14247f0 --- /dev/null +++ b/phases/P03.md @@ -0,0 +1,11 @@ +# Execution + +* Type: Phase + +* Name: Execution + +* Id: P03 + +* Summary: Run the action, from initial exposure to wrap-up and/or maintaining presence etc. + +DO NOT EDIT ABOVE THIS LINE - PLEASE ADD NOTES BELOW \ No newline at end of file diff --git a/phases/P04.md b/phases/P04.md new file mode 100644 index 0000000..ac4e068 --- /dev/null +++ b/phases/P04.md @@ -0,0 +1,11 @@ +# Evaluation + +* Type: Phase + +* Name: Evaluation + +* Id: P04 + +* Summary: Evaluate effectiveness of action, for use in future plans + +DO NOT EDIT ABOVE THIS LINE - PLEASE ADD NOTES BELOW \ No newline at end of file diff --git a/tactics/.DS_Store b/tactics/.DS_Store new file mode 100644 index 0000000..5008ddf Binary files /dev/null and b/tactics/.DS_Store differ diff --git a/tactics/TA01.md b/tactics/TA01.md new file mode 100644 index 0000000..2da8ede --- /dev/null +++ b/tactics/TA01.md @@ -0,0 +1,31 @@ +# Strategic Planning + +* Type: Tactic + +* Name: Strategic Planning + +* Id: TA01 + +* Summary: Defining the desired end state that is the set of required conditions that defines achievement of all objectives. + +* Phase: P01 + +* Tasks: + +| Task | +| ---- | +| [TK0001 Goal setting](../tasks/TK0001.md) | +| [TK0002 Population research / audience analysis (centre of gravity)](../tasks/TK0002.md) | +| [TK0003 Campaign design (objective design)](../tasks/TK0003.md) | + + +* Techniques: + +| Technique | +| --------- | +| [T0001 5Ds (dismiss, distort, distract, dismay, divide)](../techniques/T0001.md) | +| [T0002 Facilitate State Propaganda](../techniques/T0002.md) | +| [T0003 Leverage Existing Narratives](../techniques/T0003.md) | +| [T0004 Competing Narratives](../techniques/T0004.md) | + +DO NOT EDIT ABOVE THIS LINE - PLEASE ADD NOTES BELOW \ No newline at end of file diff --git a/tactics/TA02.md b/tactics/TA02.md new file mode 100644 index 0000000..674bbd7 --- /dev/null +++ b/tactics/TA02.md @@ -0,0 +1,36 @@ +# Objective Planning + +* Type: Tactic + +* Name: Objective Planning + +* Id: TA02 + +* Summary: Objectives should be clearly defined, measurable, and achievable. Achieving objectives ties execution of tactical tasks to reaching the desired end state. There are four primary considerations: +- Each desired effect should link directly to one or more objectives +- The effect should be measurable +- The objective statement should not specify the way and means of accomplishment +- The effect should be distinguishable from the objective it supports as a condition for success, not as another objective or task. + +* Phase: P01 + +* Tasks: + +| Task | +| ---- | +| [TK0004 Identify target subgroups](../tasks/TK0004.md) | +| [TK0005 Analyse subgroups](../tasks/TK0005.md) | +| [TK0006 create master narratives](../tasks/TK0006.md) | +| [TK0007 Decide on techniques (4Ds etc)](../tasks/TK0007.md) | +| [TK0008 Create subnarratives](../tasks/TK0008.md) | +| [TK0009 4chan/8chan coordinating content](../tasks/TK0009.md) | + + +* Techniques: + +| Technique | +| --------- | +| [T0005 Center of Gravity Analysis](../techniques/T0005.md) | +| [T0006 Create Master Narratives](../techniques/T0006.md) | + +DO NOT EDIT ABOVE THIS LINE - PLEASE ADD NOTES BELOW \ No newline at end of file diff --git a/tactics/TA03.md b/tactics/TA03.md new file mode 100644 index 0000000..69a6992 --- /dev/null +++ b/tactics/TA03.md @@ -0,0 +1,31 @@ +# Develop People + +* Type: Tactic + +* Name: Develop People + +* Id: TA03 + +* Summary: Develop online and offline users and agents, including automated personas + +* Phase: P02 + +* Tasks: + +| Task | +| ---- | +| [TK0010 Create personas](../tasks/TK0010.md) | +| [TK0011 Recruit contractors](../tasks/TK0011.md) | +| [TK0012 Recruit partisans](../tasks/TK0012.md) | +| [TK0013 find influencers](../tasks/TK0013.md) | + + +* Techniques: + +| Technique | +| --------- | +| [T0007 Create fake Social Media Profiles / Pages / Groups](../techniques/T0007.md) | +| [T0008 Create fake or imposter news sites](../techniques/T0008.md) | +| [T0009 Create fake experts](../techniques/T0009.md) | + +DO NOT EDIT ABOVE THIS LINE - PLEASE ADD NOTES BELOW \ No newline at end of file diff --git a/tactics/TA04.md b/tactics/TA04.md new file mode 100644 index 0000000..3b1d9eb --- /dev/null +++ b/tactics/TA04.md @@ -0,0 +1,33 @@ +# Develop Networks + +* Type: Tactic + +* Name: Develop Networks + +* Id: TA04 + +* Summary: Develop online and offline communities and transmission methods and cultivate assets and unwitting agents + +* Phase: P02 + +* Tasks: + +| Task | +| ---- | +| [TK0014 Network building](../tasks/TK0014.md) | +| [TK0015 Network infiltration](../tasks/TK0015.md) | +| [TK0016 identify targets - susceptible audience members in networks](../tasks/TK0016.md) | + + +* Techniques: + +| Technique | +| --------- | +| [T0010 Cultivate ignorant agents](../techniques/T0010.md) | +| [T0011 Hijack legitimate account](../techniques/T0011.md) | +| [T0012 Use concealment](../techniques/T0012.md) | +| [T0013 Create fake websites](../techniques/T0013.md) | +| [T0014 Create funding campaigns](../techniques/T0014.md) | +| [T0015 Create hashtag](../techniques/T0015.md) | + +DO NOT EDIT ABOVE THIS LINE - PLEASE ADD NOTES BELOW \ No newline at end of file diff --git a/tactics/TA05.md b/tactics/TA05.md new file mode 100644 index 0000000..02f91d6 --- /dev/null +++ b/tactics/TA05.md @@ -0,0 +1,27 @@ +# Microtargeting + +* Type: Tactic + +* Name: Microtargeting + +* Id: TA05 + +* Summary: Target very specific populations of people + +* Phase: P02 + +* Tasks: + +| Task | +| ---- | + + +* Techniques: + +| Technique | +| --------- | +| [T0016 Clickbait](../techniques/T0016.md) | +| [T0017 Promote online funding](../techniques/T0017.md) | +| [T0018 Paid targeted ads](../techniques/T0018.md) | + +DO NOT EDIT ABOVE THIS LINE - PLEASE ADD NOTES BELOW \ No newline at end of file diff --git a/tactics/TA06.md b/tactics/TA06.md new file mode 100644 index 0000000..5ebf3d1 --- /dev/null +++ b/tactics/TA06.md @@ -0,0 +1,36 @@ +# Develop Content + +* Type: Tactic + +* Name: Develop Content + +* Id: TA06 + +* Summary: Create and acquire content used in incident + +* Phase: P02 + +* Tasks: + +| Task | +| ---- | +| [TK0017 content creation](../tasks/TK0017.md) | +| [TK0018 content appropriation](../tasks/TK0018.md) | + + +* Techniques: + +| Technique | +| --------- | +| [T0019 Generate information pollution](../techniques/T0019.md) | +| [T0020 Trial content](../techniques/T0020.md) | +| [T0021 Memes](../techniques/T0021.md) | +| [T0022 Conspiracy narratives](../techniques/T0022.md) | +| [T0023 Distort facts](../techniques/T0023.md) | +| [T0024 Create fake videos and images](../techniques/T0024.md) | +| [T0025 Leak altered documents](../techniques/T0025.md) | +| [T0026 Create fake research](../techniques/T0026.md) | +| [T0027 Adapt existing narratives](../techniques/T0027.md) | +| [T0028 Create competing narratives](../techniques/T0028.md) | + +DO NOT EDIT ABOVE THIS LINE - PLEASE ADD NOTES BELOW \ No newline at end of file diff --git a/tactics/TA07.md b/tactics/TA07.md new file mode 100644 index 0000000..e45eff8 --- /dev/null +++ b/tactics/TA07.md @@ -0,0 +1,34 @@ +# Channel Selection + +* Type: Tactic + +* Name: Channel Selection + +* Id: TA07 + +* Summary: Set up specific delivery, amplification and manipulation channels for incident, including channels to attack. Each channel serves as an atomic surface (test bed) location/site for adversary to hide/conceal the work/content that goes into setting up for this channel and/or other specific platforms. Contributes to building out a connected ecosystem where this channel can operate as part of a whole campaign/incident + +* Phase: P02 + +* Tasks: + +| Task | +| ---- | + + +* Techniques: + +| Technique | +| --------- | +| [T0029 Manipulate online polls](../techniques/T0029.md) | +| [T0030 Backstop personas](../techniques/T0030.md) | +| [T0031 YouTube](../techniques/T0031.md) | +| [T0032 Reddit](../techniques/T0032.md) | +| [T0033 Instagram](../techniques/T0033.md) | +| [T0034 LinkedIn](../techniques/T0034.md) | +| [T0035 Pinterest](../techniques/T0035.md) | +| [T0036 WhatsApp](../techniques/T0036.md) | +| [T0037 Facebook](../techniques/T0037.md) | +| [T0038 Twitter](../techniques/T0038.md) | + +DO NOT EDIT ABOVE THIS LINE - PLEASE ADD NOTES BELOW \ No newline at end of file diff --git a/tactics/TA08.md b/tactics/TA08.md new file mode 100644 index 0000000..0d8edbb --- /dev/null +++ b/tactics/TA08.md @@ -0,0 +1,34 @@ +# Pump Priming + +* Type: Tactic + +* Name: Pump Priming + +* Id: TA08 + +* Summary: Release content on a targetted small scale, prior to general release, including releasing seed narratives + +* Phase: P03 + +* Tasks: + +| Task | +| ---- | +| [TK0019 anchor trust / credibility](../tasks/TK0019.md) | +| [TK0020 insert themes](../tasks/TK0020.md) | + + +* Techniques: + +| Technique | +| --------- | +| [T0039 Bait legitimate influencers](../techniques/T0039.md) | +| [T0040 Demand unsurmountable proof](../techniques/T0040.md) | +| [T0041 Deny involvement](../techniques/T0041.md) | +| [T0042 Kernel of Truth](../techniques/T0042.md) | +| [T0043 Use SMS/ WhatsApp/ Chat apps](../techniques/T0043.md) | +| [T0044 Seed distortions](../techniques/T0044.md) | +| [T0045 Use fake experts](../techniques/T0045.md) | +| [T0046 Search Engine Optimization](../techniques/T0046.md) | + +DO NOT EDIT ABOVE THIS LINE - PLEASE ADD NOTES BELOW \ No newline at end of file diff --git a/tactics/TA09.md b/tactics/TA09.md new file mode 100644 index 0000000..3198379 --- /dev/null +++ b/tactics/TA09.md @@ -0,0 +1,36 @@ +# Exposure + +* Type: Tactic + +* Name: Exposure + +* Id: TA09 + +* Summary: Release content to general public or push to larger population + +* Phase: P03 + +* Tasks: + +| Task | +| ---- | +| [TK0021 deamplification (suppression, censoring)](../tasks/TK0021.md) | +| [TK0022 amplification](../tasks/TK0022.md) | + + +* Techniques: + +| Technique | +| --------- | +| [T0047 Muzzle social media as a political force](../techniques/T0047.md) | +| [T0048 Cow online opinion leaders](../techniques/T0048.md) | +| [T0049 Flooding](../techniques/T0049.md) | +| [T0050 Cheerleading domestic social media ops](../techniques/T0050.md) | +| [T0051 Fabricate social media comment](../techniques/T0051.md) | +| [T0052 Tertiary sites amplify news](../techniques/T0052.md) | +| [T0053 Twitter trolls amplify and manipulate](../techniques/T0053.md) | +| [T0054 Twitter bots amplify](../techniques/T0054.md) | +| [T0055 Use hashtag](../techniques/T0055.md) | +| [T0056 Dedicated channels disseminate information pollution](../techniques/T0056.md) | + +DO NOT EDIT ABOVE THIS LINE - PLEASE ADD NOTES BELOW \ No newline at end of file diff --git a/tactics/TA10.md b/tactics/TA10.md new file mode 100644 index 0000000..6ba5056 --- /dev/null +++ b/tactics/TA10.md @@ -0,0 +1,26 @@ +# Go Physical + +* Type: Tactic + +* Name: Go Physical + +* Id: TA10 + +* Summary: Move incident into offline world + +* Phase: P03 + +* Tasks: + +| Task | +| ---- | + + +* Techniques: + +| Technique | +| --------- | +| [T0057 Organise remote rallies and events](../techniques/T0057.md) | +| [T0061 Sell merchandising](../techniques/T0061.md) | + +DO NOT EDIT ABOVE THIS LINE - PLEASE ADD NOTES BELOW \ No newline at end of file diff --git a/tactics/TA11.md b/tactics/TA11.md new file mode 100644 index 0000000..2f4190d --- /dev/null +++ b/tactics/TA11.md @@ -0,0 +1,32 @@ +# Persistence + +* Type: Tactic + +* Name: Persistence + +* Id: TA11 + +* Summary: Keep incident 'alive', beyond the incident creators' efforts + +* Phase: P03 + +* Tasks: + +| Task | +| ---- | +| [TK0023 retention](../tasks/TK0023.md) | +| [TK0024 customer relationship](../tasks/TK0024.md) | +| [TK0025 advocacy/ zealotry](../tasks/TK0025.md) | +| [TK0026 conversion](../tasks/TK0026.md) | +| [TK0027 keep recruiting/prospecting](../tasks/TK0027.md) | + + +* Techniques: + +| Technique | +| --------- | +| [T0058 Legacy web content](../techniques/T0058.md) | +| [T0059 Play the long game](../techniques/T0059.md) | +| [T0060 Continue to amplify](../techniques/T0060.md) | + +DO NOT EDIT ABOVE THIS LINE - PLEASE ADD NOTES BELOW \ No newline at end of file diff --git a/tactics/TA12.md b/tactics/TA12.md new file mode 100644 index 0000000..9c4d796 --- /dev/null +++ b/tactics/TA12.md @@ -0,0 +1,27 @@ +# Measure Effectiveness + +* Type: Tactic + +* Name: Measure Effectiveness + +* Id: TA12 + +* Summary: Measure effectiveness of incident, for use in planning future events + +* Phase: P04 + +* Tasks: + +| Task | +| ---- | +| [TK0028 evaluation](../tasks/TK0028.md) | +| [TK0029 post-mortem](../tasks/TK0029.md) | +| [TK0030 after-action analysis](../tasks/TK0030.md) | + + +* Techniques: + +| Technique | +| --------- | + +DO NOT EDIT ABOVE THIS LINE - PLEASE ADD NOTES BELOW \ No newline at end of file diff --git a/tasks/TK0001.md b/tasks/TK0001.md new file mode 100644 index 0000000..11203c8 --- /dev/null +++ b/tasks/TK0001.md @@ -0,0 +1,12 @@ +# Goal setting + +* Type: Task + +* Name: Goal setting + +* Id: TK0001 + +* Summary: nan + +* Tactic: TA01 +DO NOT EDIT ABOVE THIS LINE - PLEASE ADD NOTES BELOW \ No newline at end of file diff --git a/tasks/TK0002.md b/tasks/TK0002.md new file mode 100644 index 0000000..67aa211 --- /dev/null +++ b/tasks/TK0002.md @@ -0,0 +1,12 @@ +# Population research / audience analysis (centre of gravity) + +* Type: Task + +* Name: Population research / audience analysis (centre of gravity) + +* Id: TK0002 + +* Summary: nan + +* Tactic: TA01 +DO NOT EDIT ABOVE THIS LINE - PLEASE ADD NOTES BELOW \ No newline at end of file diff --git a/tasks/TK0003.md b/tasks/TK0003.md new file mode 100644 index 0000000..3a62b5d --- /dev/null +++ b/tasks/TK0003.md @@ -0,0 +1,12 @@ +# Campaign design (objective design) + +* Type: Task + +* Name: Campaign design (objective design) + +* Id: TK0003 + +* Summary: nan + +* Tactic: TA01 +DO NOT EDIT ABOVE THIS LINE - PLEASE ADD NOTES BELOW \ No newline at end of file diff --git a/tasks/TK0004.md b/tasks/TK0004.md new file mode 100644 index 0000000..1bbd6aa --- /dev/null +++ b/tasks/TK0004.md @@ -0,0 +1,12 @@ +# Identify target subgroups + +* Type: Task + +* Name: Identify target subgroups + +* Id: TK0004 + +* Summary: nan + +* Tactic: TA02 +DO NOT EDIT ABOVE THIS LINE - PLEASE ADD NOTES BELOW \ No newline at end of file diff --git a/tasks/TK0005.md b/tasks/TK0005.md new file mode 100644 index 0000000..eaf6499 --- /dev/null +++ b/tasks/TK0005.md @@ -0,0 +1,12 @@ +# Analyse subgroups + +* Type: Task + +* Name: Analyse subgroups + +* Id: TK0005 + +* Summary: nan + +* Tactic: TA02 +DO NOT EDIT ABOVE THIS LINE - PLEASE ADD NOTES BELOW \ No newline at end of file diff --git a/tasks/TK0006.md b/tasks/TK0006.md new file mode 100644 index 0000000..634ebb4 --- /dev/null +++ b/tasks/TK0006.md @@ -0,0 +1,12 @@ +# create master narratives + +* Type: Task + +* Name: create master narratives + +* Id: TK0006 + +* Summary: nan + +* Tactic: TA02 +DO NOT EDIT ABOVE THIS LINE - PLEASE ADD NOTES BELOW \ No newline at end of file diff --git a/tasks/TK0007.md b/tasks/TK0007.md new file mode 100644 index 0000000..48fd855 --- /dev/null +++ b/tasks/TK0007.md @@ -0,0 +1,12 @@ +# Decide on techniques (4Ds etc) + +* Type: Task + +* Name: Decide on techniques (4Ds etc) + +* Id: TK0007 + +* Summary: nan + +* Tactic: TA02 +DO NOT EDIT ABOVE THIS LINE - PLEASE ADD NOTES BELOW \ No newline at end of file diff --git a/tasks/TK0008.md b/tasks/TK0008.md new file mode 100644 index 0000000..0b691a7 --- /dev/null +++ b/tasks/TK0008.md @@ -0,0 +1,12 @@ +# Create subnarratives + +* Type: Task + +* Name: Create subnarratives + +* Id: TK0008 + +* Summary: nan + +* Tactic: TA02 +DO NOT EDIT ABOVE THIS LINE - PLEASE ADD NOTES BELOW \ No newline at end of file diff --git a/tasks/TK0009.md b/tasks/TK0009.md new file mode 100644 index 0000000..d8aeef4 --- /dev/null +++ b/tasks/TK0009.md @@ -0,0 +1,12 @@ +# 4chan/8chan coordinating content + +* Type: Task + +* Name: 4chan/8chan coordinating content + +* Id: TK0009 + +* Summary: nan + +* Tactic: TA02 +DO NOT EDIT ABOVE THIS LINE - PLEASE ADD NOTES BELOW \ No newline at end of file diff --git a/tasks/TK0010.md b/tasks/TK0010.md new file mode 100644 index 0000000..20d903a --- /dev/null +++ b/tasks/TK0010.md @@ -0,0 +1,12 @@ +# Create personas + +* Type: Task + +* Name: Create personas + +* Id: TK0010 + +* Summary: nan + +* Tactic: TA03 +DO NOT EDIT ABOVE THIS LINE - PLEASE ADD NOTES BELOW \ No newline at end of file diff --git a/tasks/TK0011.md b/tasks/TK0011.md new file mode 100644 index 0000000..90ae7c7 --- /dev/null +++ b/tasks/TK0011.md @@ -0,0 +1,12 @@ +# Recruit contractors + +* Type: Task + +* Name: Recruit contractors + +* Id: TK0011 + +* Summary: nan + +* Tactic: TA03 +DO NOT EDIT ABOVE THIS LINE - PLEASE ADD NOTES BELOW \ No newline at end of file diff --git a/tasks/TK0012.md b/tasks/TK0012.md new file mode 100644 index 0000000..ea47037 --- /dev/null +++ b/tasks/TK0012.md @@ -0,0 +1,12 @@ +# Recruit partisans + +* Type: Task + +* Name: Recruit partisans + +* Id: TK0012 + +* Summary: nan + +* Tactic: TA03 +DO NOT EDIT ABOVE THIS LINE - PLEASE ADD NOTES BELOW \ No newline at end of file diff --git a/tasks/TK0013.md b/tasks/TK0013.md new file mode 100644 index 0000000..ed61465 --- /dev/null +++ b/tasks/TK0013.md @@ -0,0 +1,12 @@ +# find influencers + +* Type: Task + +* Name: find influencers + +* Id: TK0013 + +* Summary: nan + +* Tactic: TA03 +DO NOT EDIT ABOVE THIS LINE - PLEASE ADD NOTES BELOW \ No newline at end of file diff --git a/tasks/TK0014.md b/tasks/TK0014.md new file mode 100644 index 0000000..bf9e499 --- /dev/null +++ b/tasks/TK0014.md @@ -0,0 +1,12 @@ +# Network building + +* Type: Task + +* Name: Network building + +* Id: TK0014 + +* Summary: nan + +* Tactic: TA04 +DO NOT EDIT ABOVE THIS LINE - PLEASE ADD NOTES BELOW \ No newline at end of file diff --git a/tasks/TK0015.md b/tasks/TK0015.md new file mode 100644 index 0000000..3812a94 --- /dev/null +++ b/tasks/TK0015.md @@ -0,0 +1,12 @@ +# Network infiltration + +* Type: Task + +* Name: Network infiltration + +* Id: TK0015 + +* Summary: nan + +* Tactic: TA04 +DO NOT EDIT ABOVE THIS LINE - PLEASE ADD NOTES BELOW \ No newline at end of file diff --git a/tasks/TK0016.md b/tasks/TK0016.md new file mode 100644 index 0000000..0d0a4a6 --- /dev/null +++ b/tasks/TK0016.md @@ -0,0 +1,12 @@ +# identify targets - susceptible audience members in networks + +* Type: Task + +* Name: identify targets - susceptible audience members in networks + +* Id: TK0016 + +* Summary: nan + +* Tactic: TA04 +DO NOT EDIT ABOVE THIS LINE - PLEASE ADD NOTES BELOW \ No newline at end of file diff --git a/tasks/TK0017.md b/tasks/TK0017.md new file mode 100644 index 0000000..e18449d --- /dev/null +++ b/tasks/TK0017.md @@ -0,0 +1,12 @@ +# content creation + +* Type: Task + +* Name: content creation + +* Id: TK0017 + +* Summary: nan + +* Tactic: TA06 +DO NOT EDIT ABOVE THIS LINE - PLEASE ADD NOTES BELOW \ No newline at end of file diff --git a/tasks/TK0018.md b/tasks/TK0018.md new file mode 100644 index 0000000..98587a1 --- /dev/null +++ b/tasks/TK0018.md @@ -0,0 +1,12 @@ +# content appropriation + +* Type: Task + +* Name: content appropriation + +* Id: TK0018 + +* Summary: nan + +* Tactic: TA06 +DO NOT EDIT ABOVE THIS LINE - PLEASE ADD NOTES BELOW \ No newline at end of file diff --git a/tasks/TK0019.md b/tasks/TK0019.md new file mode 100644 index 0000000..e3e1811 --- /dev/null +++ b/tasks/TK0019.md @@ -0,0 +1,12 @@ +# anchor trust / credibility + +* Type: Task + +* Name: anchor trust / credibility + +* Id: TK0019 + +* Summary: nan + +* Tactic: TA08 +DO NOT EDIT ABOVE THIS LINE - PLEASE ADD NOTES BELOW \ No newline at end of file diff --git a/tasks/TK0020.md b/tasks/TK0020.md new file mode 100644 index 0000000..0e53726 --- /dev/null +++ b/tasks/TK0020.md @@ -0,0 +1,12 @@ +# insert themes + +* Type: Task + +* Name: insert themes + +* Id: TK0020 + +* Summary: nan + +* Tactic: TA08 +DO NOT EDIT ABOVE THIS LINE - PLEASE ADD NOTES BELOW \ No newline at end of file diff --git a/tasks/TK0021.md b/tasks/TK0021.md new file mode 100644 index 0000000..1de3eb6 --- /dev/null +++ b/tasks/TK0021.md @@ -0,0 +1,12 @@ +# deamplification (suppression, censoring) + +* Type: Task + +* Name: deamplification (suppression, censoring) + +* Id: TK0021 + +* Summary: nan + +* Tactic: TA09 +DO NOT EDIT ABOVE THIS LINE - PLEASE ADD NOTES BELOW \ No newline at end of file diff --git a/tasks/TK0022.md b/tasks/TK0022.md new file mode 100644 index 0000000..4540bc2 --- /dev/null +++ b/tasks/TK0022.md @@ -0,0 +1,12 @@ +# amplification + +* Type: Task + +* Name: amplification + +* Id: TK0022 + +* Summary: nan + +* Tactic: TA09 +DO NOT EDIT ABOVE THIS LINE - PLEASE ADD NOTES BELOW \ No newline at end of file diff --git a/tasks/TK0023.md b/tasks/TK0023.md new file mode 100644 index 0000000..c0af9e7 --- /dev/null +++ b/tasks/TK0023.md @@ -0,0 +1,12 @@ +# retention + +* Type: Task + +* Name: retention + +* Id: TK0023 + +* Summary: nan + +* Tactic: TA11 +DO NOT EDIT ABOVE THIS LINE - PLEASE ADD NOTES BELOW \ No newline at end of file diff --git a/tasks/TK0024.md b/tasks/TK0024.md new file mode 100644 index 0000000..caaecc1 --- /dev/null +++ b/tasks/TK0024.md @@ -0,0 +1,12 @@ +# customer relationship + +* Type: Task + +* Name: customer relationship + +* Id: TK0024 + +* Summary: nan + +* Tactic: TA11 +DO NOT EDIT ABOVE THIS LINE - PLEASE ADD NOTES BELOW \ No newline at end of file diff --git a/tasks/TK0025.md b/tasks/TK0025.md new file mode 100644 index 0000000..dd3f5e1 --- /dev/null +++ b/tasks/TK0025.md @@ -0,0 +1,12 @@ +# advocacy/ zealotry + +* Type: Task + +* Name: advocacy/ zealotry + +* Id: TK0025 + +* Summary: nan + +* Tactic: TA11 +DO NOT EDIT ABOVE THIS LINE - PLEASE ADD NOTES BELOW \ No newline at end of file diff --git a/tasks/TK0026.md b/tasks/TK0026.md new file mode 100644 index 0000000..b948d90 --- /dev/null +++ b/tasks/TK0026.md @@ -0,0 +1,12 @@ +# conversion + +* Type: Task + +* Name: conversion + +* Id: TK0026 + +* Summary: nan + +* Tactic: TA11 +DO NOT EDIT ABOVE THIS LINE - PLEASE ADD NOTES BELOW \ No newline at end of file diff --git a/tasks/TK0027.md b/tasks/TK0027.md new file mode 100644 index 0000000..8dfac47 --- /dev/null +++ b/tasks/TK0027.md @@ -0,0 +1,12 @@ +# keep recruiting/prospecting + +* Type: Task + +* Name: keep recruiting/prospecting + +* Id: TK0027 + +* Summary: nan + +* Tactic: TA11 +DO NOT EDIT ABOVE THIS LINE - PLEASE ADD NOTES BELOW \ No newline at end of file diff --git a/tasks/TK0028.md b/tasks/TK0028.md new file mode 100644 index 0000000..e5c3ab0 --- /dev/null +++ b/tasks/TK0028.md @@ -0,0 +1,12 @@ +# evaluation + +* Type: Task + +* Name: evaluation + +* Id: TK0028 + +* Summary: nan + +* Tactic: TA12 +DO NOT EDIT ABOVE THIS LINE - PLEASE ADD NOTES BELOW \ No newline at end of file diff --git a/tasks/TK0029.md b/tasks/TK0029.md new file mode 100644 index 0000000..a964244 --- /dev/null +++ b/tasks/TK0029.md @@ -0,0 +1,12 @@ +# post-mortem + +* Type: Task + +* Name: post-mortem + +* Id: TK0029 + +* Summary: nan + +* Tactic: TA12 +DO NOT EDIT ABOVE THIS LINE - PLEASE ADD NOTES BELOW \ No newline at end of file diff --git a/tasks/TK0030.md b/tasks/TK0030.md new file mode 100644 index 0000000..74e75ce --- /dev/null +++ b/tasks/TK0030.md @@ -0,0 +1,12 @@ +# after-action analysis + +* Type: Task + +* Name: after-action analysis + +* Id: TK0030 + +* Summary: nan + +* Tactic: TA12 +DO NOT EDIT ABOVE THIS LINE - PLEASE ADD NOTES BELOW \ No newline at end of file diff --git a/techniques/.DS_Store b/techniques/.DS_Store new file mode 100644 index 0000000..5008ddf Binary files /dev/null and b/techniques/.DS_Store differ diff --git a/techniques/T0001.md b/techniques/T0001.md new file mode 100644 index 0000000..be5add6 --- /dev/null +++ b/techniques/T0001.md @@ -0,0 +1,23 @@ +# 5Ds (dismiss, distort, distract, dismay, divide) + +* Type: Technique + +* Name: 5Ds (dismiss, distort, distract, dismay, divide) + +* Id: T0001 + +* Summary: Nimmo's "4Ds of propaganda": dismiss, distort, distract, dismay (MisinfosecWG added divide in 2019). Misinformation promotes an agenda by advancing narratives supportive of that agenda. This is most effective when the advanced narrative pre-dates the revelation of the specific misinformation content. But this is often not possible. + +* Tactic: TA01 + +* Incidents: + +| Incident | Descriptions given for this incident | +| -------- | -------------------- | +| [I00029 MH17 investigation](../incidents/I00029.md) | 4 D's (dismiss, distort, distract, dismay...Official channels ie: Embassies & Defence Ministry; TASS | +| [I00047 Sea of Azov](../incidents/I00047.md) | 4 D's (dismiss, distort, distract, dismay...Official channels ie: Embassies & Defence Ministry; TASS, Russian FSB security service blamed Ukraine for sparking the clashes, saying their "irrefutable" evidence would "soon be made public | +| [I00049 White Helmets: Chemical Weapons](../incidents/I00049.md) | 4 D's (dismiss, distort, distract, dismay...Official channels ie: Embassies & Defence Ministry; TASS | +| [I00053 China Huawei CFO Arrest](../incidents/I00053.md) | China also plays victim, innocence, plays by rules, misunderstood narrative, Chinese ambassador Lu Shaye accused Canada of applying a double standard, and has decried what he sees as “Western egotism and white supremacy” in the treatment of detained Huawei executive Meng Wanzhou.” | +| [I00063 Olympic Doping Scandal](../incidents/I00063.md) | 4 D's (dismiss, distort, distract, dismay...Official channels ie: Putin himself; Embassies & Sports Ministry; TASS | + +DO NOT EDIT ABOVE THIS LINE - PLEASE ADD NOTES BELOW \ No newline at end of file diff --git a/techniques/T0002.md b/techniques/T0002.md new file mode 100644 index 0000000..20f1b9e --- /dev/null +++ b/techniques/T0002.md @@ -0,0 +1,20 @@ +# Facilitate State Propaganda + +* Type: Technique + +* Name: Facilitate State Propaganda + +* Id: T0002 + +* Summary: Organize citizens around pro-state messaging. Paid or volunteer groups coordinated to push state propaganda (examples include 2016 Diba Facebook Expedition, coordinated to overcome China’s Great Firewall to flood the Facebook pages of Taiwanese politicians and news agencies with a pro-PRC message). + +* Tactic: TA01 + +* Incidents: + +| Incident | Descriptions given for this incident | +| -------- | -------------------- | +| [I00033 China 50cent Army](../incidents/I00033.md) | facilitate state propaganda and defuse crises | +| [I00034 DibaFacebookExpedition](../incidents/I00034.md) | Netizens from one of the largest discussion forums in China, known as Diba, coordinated to overcome China’s Great Firewall | + +DO NOT EDIT ABOVE THIS LINE - PLEASE ADD NOTES BELOW \ No newline at end of file diff --git a/techniques/T0003.md b/techniques/T0003.md new file mode 100644 index 0000000..6b73ea8 --- /dev/null +++ b/techniques/T0003.md @@ -0,0 +1,18 @@ +# Leverage Existing Narratives + +* Type: Technique + +* Name: Leverage Existing Narratives + +* Id: T0003 + +* Summary: Use or adapt existing narrative themes, where narratives are the baseline stories of a target audience. Narratives form the bedrock of our worldviews. New information is understood through a process firmly grounded in this bedrock. If new information is not consitent with the prevailing narratives of an audience, it will be ignored. Effective campaigns will frame their misinformation in the context of these narratives. Highly effective campaigns will make extensive use of audience-appropriate archetypes and meta-narratives throughout their content creation and amplifiction practices. Examples include midwesterners are generous, Russia is under attack from outside. + +* Tactic: TA01 + +* Incidents: + +| Incident | Descriptions given for this incident | +| -------- | -------------------- | + +DO NOT EDIT ABOVE THIS LINE - PLEASE ADD NOTES BELOW \ No newline at end of file diff --git a/techniques/T0004.md b/techniques/T0004.md new file mode 100644 index 0000000..df46cb4 --- /dev/null +++ b/techniques/T0004.md @@ -0,0 +1,22 @@ +# Competing Narratives + +* Type: Technique + +* Name: Competing Narratives + +* Id: T0004 + +* Summary: Advance competing narratives connected to same issue ie: on one hand deny incident while at same time expresses dismiss. MH17 (example) "Russian Foreign Ministry again claimed that “absolutely groundless accusations are put forward against the Russian side, which are aimed at discrediting Russia in the eyes of the international community" (deny); "The Dutch MH17 investigation is biased, anti-Russian and factually inaccurate" (dismiss). + +Suppressing or discouraging narratives already spreading requires an alternative. The most simple set of narrative techniques in response would be the construction and promotion of contradictory alternatives centered on denial, deflection, dismissal, counter-charges, excessive standards of proof, bias in prohibition or enforcement, and so on. + +These competing narratives allow loyalists cover, but are less compelling to opponents and fence-sitters than campaigns built around existing narratives or highly explanatory master narratives. Competing narratives, as such, are especially useful in the "firehose of misinformation" approach. + +* Tactic: TA01 + +* Incidents: + +| Incident | Descriptions given for this incident | +| -------- | -------------------- | + +DO NOT EDIT ABOVE THIS LINE - PLEASE ADD NOTES BELOW \ No newline at end of file diff --git a/techniques/T0005.md b/techniques/T0005.md new file mode 100644 index 0000000..cd44faf --- /dev/null +++ b/techniques/T0005.md @@ -0,0 +1,18 @@ +# Center of Gravity Analysis + +* Type: Technique + +* Name: Center of Gravity Analysis + +* Id: T0005 + +* Summary: Recon/research to identify "the source of power that provides moral or physical strength, freedom of action, or will to act." Thus, the center of gravity is usually seen as the "source of strength". Includes demographic and network analysis of communities + +* Tactic: TA02 + +* Incidents: + +| Incident | Descriptions given for this incident | +| -------- | -------------------- | + +DO NOT EDIT ABOVE THIS LINE - PLEASE ADD NOTES BELOW \ No newline at end of file diff --git a/techniques/T0006.md b/techniques/T0006.md new file mode 100644 index 0000000..1fc4422 --- /dev/null +++ b/techniques/T0006.md @@ -0,0 +1,25 @@ +# Create Master Narratives + +* Type: Technique + +* Name: Create Master Narratives + +* Id: T0006 + +* Summary: The promotion of beneficial master narratives is perhaps the most effective method for achieving long-term strategic narrative dominance. From a "whole of society" perpective the promotion of the society's core master narratives should occupy a central strategic role. From a misinformation campaign / cognitive security perpectve the tactics around master narratives center more precisely on the day-to-day promotion and reinforcement of this messaging. In other words, beneficial, high-coverage master narratives are a central strategic goal and their promotion consitutes an ongoing tactical struggle carried out at a whole-of-society level. + +By way of example, major powers are promoting master narratives such as: +* "Huawei is detetmined to build trustworthy networks" +* "Russia is the victim of bullying by NATO powers" +* "USA is guided by its founding principles of liberty and egalitarianism" + +Tactically, their promotion covers a broad spectrum of activities both on- and offline. + +* Tactic: TA02 + +* Incidents: + +| Incident | Descriptions given for this incident | +| -------- | -------------------- | + +DO NOT EDIT ABOVE THIS LINE - PLEASE ADD NOTES BELOW \ No newline at end of file diff --git a/techniques/T0007.md b/techniques/T0007.md new file mode 100644 index 0000000..78baa53 --- /dev/null +++ b/techniques/T0007.md @@ -0,0 +1,30 @@ +# Create fake Social Media Profiles / Pages / Groups + +* Type: Technique + +* Name: Create fake Social Media Profiles / Pages / Groups + +* Id: T0007 + +* Summary: Create key social engineering assets needed to amplify content, manipulate algorithms, fool public and/or specific incident/campaign targets. + +Computational propaganda depends substantially on false perceptions of credibility and acceptance. By creating fake users and groups with a variety of interests and commitments, attackers can ensure that their messages both come from trusted sources and appear more widely adopted than they actually are. + +Examples: Ukraine elections (2019) circumvent Facebook’s new safeguards by paying Ukrainian citizens to give a Russian agent access to their personal pages. EU Elections (2019) Avaaz reported more than 500 suspicious pages and groups to Facebook related to the three-month investigation of Facebook disinformation networks in Europe. Mueller report (2016) The IRA was able to reach up to 126 million Americans on Facebook via a mixture of fraudulent accounts, groups, and advertisements, the report says. Twitter accounts it created were portrayed as real American voices by major news outlets. It was even able to hold real-life rallies, mobilizing hundreds of people at a time in major cities like Philadelphia and Miami. + +* Tactic: TA03 + +* Incidents: + +| Incident | Descriptions given for this incident | +| -------- | -------------------- | +| [I00005 Brexit vote](../incidents/I00005.md) | Fake FB groups + dark content | +| [I00006 Columbian Chemicals](../incidents/I00006.md) | Fake twitter profiles to amplify | +| [I00009 PhilippinesExpert](../incidents/I00009.md) | FB pages | +| [I00010 ParklandTeens](../incidents/I00010.md) | FB pages/groups/profiles | +| [I00017 US presidential elections](../incidents/I00017.md) | Fake FB groups + dark content | +| [I00022 #Macronleaks](../incidents/I00022.md) | Fake FB groups/pages/profiles + dark content | +| [I00032 Kavanaugh](../incidents/I00032.md) | Fake FB groups/pages/profiles | +| [I00056 Iran Influence Operations](../incidents/I00056.md) | Fake FB groups/pages/profiles + dark content (non-paid advertising) | + +DO NOT EDIT ABOVE THIS LINE - PLEASE ADD NOTES BELOW \ No newline at end of file diff --git a/techniques/T0008.md b/techniques/T0008.md new file mode 100644 index 0000000..0a142cb --- /dev/null +++ b/techniques/T0008.md @@ -0,0 +1,19 @@ +# Create fake or imposter news sites + +* Type: Technique + +* Name: Create fake or imposter news sites + +* Id: T0008 + +* Summary: Modern computational propaganda makes use of a cadre of imposter news sites spreading globally. These sites, sometimes motivated by concerns other than propaganda--for instance, click-based revenue--often have some superficial markers of authenticity, such as naming and site-design. But many can be quickly exposed with reference to their owenership, reporting history and adverstising details. A prominent case from the 2016 era was the _Denver Guardian_, which purported to be a local newspaper in Colorado and specialized in negative stories about Hillary Clinton. + +* Tactic: TA03 + +* Incidents: + +| Incident | Descriptions given for this incident | +| -------- | -------------------- | +| [I00056 Iran Influence Operations](../incidents/I00056.md) | Fake news/synthetic web-sites | + +DO NOT EDIT ABOVE THIS LINE - PLEASE ADD NOTES BELOW \ No newline at end of file diff --git a/techniques/T0009.md b/techniques/T0009.md new file mode 100644 index 0000000..86b9af8 --- /dev/null +++ b/techniques/T0009.md @@ -0,0 +1,19 @@ +# Create fake experts + +* Type: Technique + +* Name: Create fake experts + +* Id: T0009 + +* Summary: Stories planted or promoted in computational propaganda operations often make use of experts fabricated from whole cloth, sometimes specifically for the story itself. For example, in the Jade Helm conspiracy theory promoted by SVR in 2015, a pair of experts--one of them naming himself a “Military Intelligence Analyst / Russian Regional CME” and the other a “Geopolitical Strategist, Journalist & Author”--pushed the story heavily on LinkedIn. + +* Tactic: TA03 + +* Incidents: + +| Incident | Descriptions given for this incident | +| -------- | -------------------- | +| [I00044 JadeHelm exercise](../incidents/I00044.md) | Promote fake “experts” with impressive (and scary) titles | + +DO NOT EDIT ABOVE THIS LINE - PLEASE ADD NOTES BELOW \ No newline at end of file diff --git a/techniques/T0010.md b/techniques/T0010.md new file mode 100644 index 0000000..758ea59 --- /dev/null +++ b/techniques/T0010.md @@ -0,0 +1,29 @@ +# Cultivate ignorant agents + +* Type: Technique + +* Name: Cultivate ignorant agents + +* Id: T0010 + +* Summary: Cultivate propagandists for a cause, the goals of which are not fully comprehended, and who are used cynically by the leaders of the cause. Independent actors use social media and specialised web sites to strategically reinforce and spread messages compatible with their own. Their networks are infiltrated and used by state media disinformation organisations to amplify the state’s own disinformation strategies against target populations. Many are traffickers in conspiracy theories or hoaxes, unified by a suspicion of Western governments and mainstream media. Their narratives, which appeal to leftists hostile to globalism and military intervention and nationalists against immigration, are frequently infiltrated and shaped by state-controlled trolls and altered news items from agencies such as RT and Sputnik. Also know as "useful idiots" or "unwitting agents". + +* Tactic: TA04 + +* Incidents: + +| Incident | Descriptions given for this incident | +| -------- | -------------------- | +| [I00005 Brexit vote](../incidents/I00005.md) | cultivate, manipulate, exploit useful idiots | +| [I00007 Incirlik terrorists](../incidents/I00007.md) | cultivate, manipulate, exploit useful idiots (in the case Paul Manafort) | +| [I00010 ParklandTeens](../incidents/I00010.md) | cultivate, manipulate, exploit useful idiots (Alex Jones... drives conspiracy theories; false flags, crisis actors) | +| [I00017 US presidential elections](../incidents/I00017.md) | cultivate, manipulate, exploit useful idiots | +| [I00029 MH17 investigation](../incidents/I00029.md) | cultivate, manipulate, exploit useful idiots | +| [I00032 Kavanaugh](../incidents/I00032.md) | cultivate, manipulate, exploit useful idiots (Alex Jones... drives conspiracy theories) | +| [I00044 JadeHelm exercise](../incidents/I00044.md) | cultivate, manipulate, exploit useful idiots (Alex Jones... drives conspiracy theories) | +| [I00049 White Helmets: Chemical Weapons](../incidents/I00049.md) | cultivate, manipulate, exploit useful idiots (Roger Waters; Venessa Beeley...) | +| [I00050 #HandsOffVenezuela](../incidents/I00050.md) | cultivate, manipulate, exploit useful idiots (Roger Waters) | +| [I00051 Integrity Initiative](../incidents/I00051.md) | cultivate, manipulate, exploit useful idiots | +| [I00063 Olympic Doping Scandal](../incidents/I00063.md) | cultivate, manipulate, exploit useful idiots | + +DO NOT EDIT ABOVE THIS LINE - PLEASE ADD NOTES BELOW \ No newline at end of file diff --git a/techniques/T0011.md b/techniques/T0011.md new file mode 100644 index 0000000..22bf858 --- /dev/null +++ b/techniques/T0011.md @@ -0,0 +1,19 @@ +# Hijack legitimate account + +* Type: Technique + +* Name: Hijack legitimate account + +* Id: T0011 + +* Summary: Hack or take over legimate accounts to distribute misinformation or damaging content. Examples include Syrian Electronic Army (2013) series of false tweets from a hijacked Associated Press Twitter account claiming that President Barack Obama had been injured in a series of explosions near the White House. The false report caused a temporary plunge of 143 points on the Dow Jones Industrial Average. + +* Tactic: TA04 + +* Incidents: + +| Incident | Descriptions given for this incident | +| -------- | -------------------- | +| [I00042 Saudi/Qatar bot dispute](../incidents/I00042.md) | “hack” of Qatar’s official news agency | + +DO NOT EDIT ABOVE THIS LINE - PLEASE ADD NOTES BELOW \ No newline at end of file diff --git a/techniques/T0012.md b/techniques/T0012.md new file mode 100644 index 0000000..b95ec2b --- /dev/null +++ b/techniques/T0012.md @@ -0,0 +1,20 @@ +# Use concealment + +* Type: Technique + +* Name: Use concealment + +* Id: T0012 + +* Summary: Use anonymous social media profiles. Examples include page or group administrators, masked "whois" website directory data, no bylines connected to news article, no masthead connect to news websites. + +Example is 2016 @TEN_GOP profile where the actual Tennessee Republican Party tried unsuccessfully for months to get Twitter to shut it down, and 2019 Endless Mayfly is an Iran-aligned network of inauthentic personas and social media accounts that spreads falsehoods and amplifies narratives critical of Saudi Arabia, the United States, and Israel. + +* Tactic: TA04 + +* Incidents: + +| Incident | Descriptions given for this incident | +| -------- | -------------------- | + +DO NOT EDIT ABOVE THIS LINE - PLEASE ADD NOTES BELOW \ No newline at end of file diff --git a/techniques/T0013.md b/techniques/T0013.md new file mode 100644 index 0000000..2ca43f9 --- /dev/null +++ b/techniques/T0013.md @@ -0,0 +1,18 @@ +# Create fake websites + +* Type: Technique + +* Name: Create fake websites + +* Id: T0013 + +* Summary: Create media assets to support fake organizations (e.g. think tank), people (e.g. experts) and/or serve as sites to distribute malware/launch phishing operations. + +* Tactic: TA04 + +* Incidents: + +| Incident | Descriptions given for this incident | +| -------- | -------------------- | + +DO NOT EDIT ABOVE THIS LINE - PLEASE ADD NOTES BELOW \ No newline at end of file diff --git a/techniques/T0014.md b/techniques/T0014.md new file mode 100644 index 0000000..f2cdca5 --- /dev/null +++ b/techniques/T0014.md @@ -0,0 +1,18 @@ +# Create funding campaigns + +* Type: Technique + +* Name: Create funding campaigns + +* Id: T0014 + +* Summary: Generate revenue through online funding campaigns. e.g. Gather data, advance credible persona via Gofundme; Patreon; or via fake website connecting via PayPal or Stripe. (Example 2016) #VaccinateUS Gofundme campaigns to pay for Targetted facebook ads (Larry Cook, targetting Washington State mothers, $1,776 to boost posts over 9 months). + +* Tactic: TA04 + +* Incidents: + +| Incident | Descriptions given for this incident | +| -------- | -------------------- | + +DO NOT EDIT ABOVE THIS LINE - PLEASE ADD NOTES BELOW \ No newline at end of file diff --git a/techniques/T0015.md b/techniques/T0015.md new file mode 100644 index 0000000..fbe5c4e --- /dev/null +++ b/techniques/T0015.md @@ -0,0 +1,25 @@ +# Create hashtag + +* Type: Technique + +* Name: Create hashtag + +* Id: T0015 + +* Summary: Many incident-based campaigns will create a hashtag to promote their fabricated event (e.g. #ColumbianChemicals to promote a fake story about a chemical spill in Louisiana). + +Creating a hashtag for an incident can have two important effects: +1. Create a perception of reality around an event. Certainly only "real" events would be discussed in a hashtag. After all, the event has a name! +2. Publicize the story more widely through trending lists and search behavior + +Asset needed to direct/control/manage "conversation" connected to launching new incident/campaign with new hashtag for applicable social media sites ie: Twitter, LinkedIn) + +* Tactic: TA04 + +* Incidents: + +| Incident | Descriptions given for this incident | +| -------- | -------------------- | +| [I00006 Columbian Chemicals](../incidents/I00006.md) | Create and use hashtag | + +DO NOT EDIT ABOVE THIS LINE - PLEASE ADD NOTES BELOW \ No newline at end of file diff --git a/techniques/T0016.md b/techniques/T0016.md new file mode 100644 index 0000000..009ff34 --- /dev/null +++ b/techniques/T0016.md @@ -0,0 +1,19 @@ +# Clickbait + +* Type: Technique + +* Name: Clickbait + +* Id: T0016 + +* Summary: Create attention grabbing headlines (outrage, doubt, humor) required to drive traffic & engagement. (example 2016) “Pope Francis shocks world, endorses Donald Trump for president.” (example 2016) "FBI director received millions from Clinton Foundation, his brother’s law firm does Clinton’s taxes”. This is a key asset + +* Tactic: TA05 + +* Incidents: + +| Incident | Descriptions given for this incident | +| -------- | -------------------- | +| [I00017 US presidential elections](../incidents/I00017.md) | Click-bait (economic actors) fake news sites (ie: Denver Guardian; Macedonian teens) | + +DO NOT EDIT ABOVE THIS LINE - PLEASE ADD NOTES BELOW \ No newline at end of file diff --git a/techniques/T0017.md b/techniques/T0017.md new file mode 100644 index 0000000..bccb5bd --- /dev/null +++ b/techniques/T0017.md @@ -0,0 +1,19 @@ +# Promote online funding + +* Type: Technique + +* Name: Promote online funding + +* Id: T0017 + +* Summary: Drive traffic/engagement to funding campaign sites; helps provide measurable metrics to assess conversion rates + +* Tactic: TA05 + +* Incidents: + +| Incident | Descriptions given for this incident | +| -------- | -------------------- | +| [I00002 #VaccinateUS](../incidents/I00002.md) | Promote "funding" campaign | + +DO NOT EDIT ABOVE THIS LINE - PLEASE ADD NOTES BELOW \ No newline at end of file diff --git a/techniques/T0018.md b/techniques/T0018.md new file mode 100644 index 0000000..0f140be --- /dev/null +++ b/techniques/T0018.md @@ -0,0 +1,21 @@ +# Paid targeted ads + +* Type: Technique + +* Name: Paid targeted ads + +* Id: T0018 + +* Summary: Create or fund advertisements targeted at specific populations + +* Tactic: TA05 + +* Incidents: + +| Incident | Descriptions given for this incident | +| -------- | -------------------- | +| [I00002 #VaccinateUS](../incidents/I00002.md) | buy FB targeted ads | +| [I00005 Brexit vote](../incidents/I00005.md) | Targeted FB paid ads | +| [I00017 US presidential elections](../incidents/I00017.md) | Targeted FB paid ads | + +DO NOT EDIT ABOVE THIS LINE - PLEASE ADD NOTES BELOW \ No newline at end of file diff --git a/techniques/T0019.md b/techniques/T0019.md new file mode 100644 index 0000000..eab2e3c --- /dev/null +++ b/techniques/T0019.md @@ -0,0 +1,30 @@ +# Generate information pollution + +* Type: Technique + +* Name: Generate information pollution + +* Id: T0019 + +* Summary: Flood social channels; drive traffic/engagement to all assets; create aura/sense/perception of pervasiveness/consensus (for or against or both simultaneously) of an issue or topic. "Nothing is true, but everything is possible." Akin to astroturfing campaign. + +* Tactic: TA06 + +* Incidents: + +| Incident | Descriptions given for this incident | +| -------- | -------------------- | +| [I00002 #VaccinateUS](../incidents/I00002.md) | create web-site - information pollution | +| [I00005 Brexit vote](../incidents/I00005.md) | RT & Sputnik generate information pollution | +| [I00007 Incirlik terrorists](../incidents/I00007.md) | RT & Sputnik generate information pollution (report an unreported false story/event) | +| [I00009 PhilippinesExpert](../incidents/I00009.md) | RT & Sputnik generate information pollution | +| [I00017 US presidential elections](../incidents/I00017.md) | RT & Sputnik generate information pollution | +| [I00029 MH17 investigation](../incidents/I00029.md) | RT & Sputnik generate information pollution (synthetic media) | +| [I00032 Kavanaugh](../incidents/I00032.md) | RT & Sputnik generate information pollution | +| [I00044 JadeHelm exercise](../incidents/I00044.md) | RT & Sputnik generate information pollution | +| [I00049 White Helmets: Chemical Weapons](../incidents/I00049.md) | RT & Sputnik generate information pollution (synthetic media) | +| [I00050 #HandsOffVenezuela](../incidents/I00050.md) | RT & Sputnik generate information pollution (synthetic media) | +| [I00051 Integrity Initiative](../incidents/I00051.md) | RT & Sputnik generate information pollution | +| [I00063 Olympic Doping Scandal](../incidents/I00063.md) | RT & Sputnik generate information pollution (synthetic media) | + +DO NOT EDIT ABOVE THIS LINE - PLEASE ADD NOTES BELOW \ No newline at end of file diff --git a/techniques/T0020.md b/techniques/T0020.md new file mode 100644 index 0000000..4b0d37c --- /dev/null +++ b/techniques/T0020.md @@ -0,0 +1,22 @@ +# Trial content + +* Type: Technique + +* Name: Trial content + +* Id: T0020 + +* Summary: Iteratively test incident performance (messages, content etc), e.g. A/B test headline/content enagagement metrics; website and/or funding campaign conversion rates + +* Tactic: TA06 + +* Incidents: + +| Incident | Descriptions given for this incident | +| -------- | -------------------- | +| [I00010 ParklandTeens](../incidents/I00010.md) | 4Chan/8Chan - trial content | +| [I00017 US presidential elections](../incidents/I00017.md) | 4Chan/8Chan - trial content | +| [I00032 Kavanaugh](../incidents/I00032.md) | 4Chan/8Chan - trial content | +| [I00044 JadeHelm exercise](../incidents/I00044.md) | 4Chan/8Chan - trial content | + +DO NOT EDIT ABOVE THIS LINE - PLEASE ADD NOTES BELOW \ No newline at end of file diff --git a/techniques/T0021.md b/techniques/T0021.md new file mode 100644 index 0000000..99ab030 --- /dev/null +++ b/techniques/T0021.md @@ -0,0 +1,22 @@ +# Memes + +* Type: Technique + +* Name: Memes + +* Id: T0021 + +* Summary: Memes are one of the most important single artefact types in all of computational propaganda. Memes in this framework denotes the narrow image-based definition. But that naming is no accident, as these items have most of the important properties of Dawkins' original conception as a self-replicating unit of culture. Memes pull together reference and commentary; image and narrative; emotion and message. Memes are a powerful tool and the heart of modern influence campaigns. + +* Tactic: TA06 + +* Incidents: + +| Incident | Descriptions given for this incident | +| -------- | -------------------- | +| [I00005 Brexit vote](../incidents/I00005.md) | Memes... anti-immigration; euroskepticism; fear, outrage, conspiracy narratives | +| [I00017 US presidential elections](../incidents/I00017.md) | Memes... anti-immigration; euroskepticism; fear, outrage, conspiracy narratives | +| [I00042 Saudi/Qatar bot dispute](../incidents/I00042.md) | memes | +| [I00056 Iran Influence Operations](../incidents/I00056.md) | Memes... anti-Isreal/USA/West, conspiracy narratives | + +DO NOT EDIT ABOVE THIS LINE - PLEASE ADD NOTES BELOW \ No newline at end of file diff --git a/techniques/T0022.md b/techniques/T0022.md new file mode 100644 index 0000000..d3ecc6c --- /dev/null +++ b/techniques/T0022.md @@ -0,0 +1,21 @@ +# Conspiracy narratives + +* Type: Technique + +* Name: Conspiracy narratives + +* Id: T0022 + +* Summary: "Conspiracy narratives appeal to the human desire for explanatory order, by invoking the participation of poweful (often sinister) actors in pursuit of their own political goals. These narratives are especially appealing when an audience is low-information, marginalized or otherwise inclined to reject the prevailing explanation. Conspiracy narratives are an important component of the ""firehose of falsehoods"" model. + +Example: QAnon: conspiracy theory is an explanation of an event or situation that invokes a conspiracy by sinister and powerful actors, often political in motivation, when other explanations are more probable " + +* Tactic: TA06 + +* Incidents: + +| Incident | Descriptions given for this incident | +| -------- | -------------------- | +| [I00056 Iran Influence Operations](../incidents/I00056.md) | Memes... anti-Isreal/USA/West, conspiracy narratives | + +DO NOT EDIT ABOVE THIS LINE - PLEASE ADD NOTES BELOW \ No newline at end of file diff --git a/techniques/T0023.md b/techniques/T0023.md new file mode 100644 index 0000000..90874eb --- /dev/null +++ b/techniques/T0023.md @@ -0,0 +1,20 @@ +# Distort facts + +* Type: Technique + +* Name: Distort facts + +* Id: T0023 + +* Summary: Change, twist, or exaggerate existing facts to construct a narrative that differs from reality. Examples: images and ideas can be distorted by being placed in an improper content + +* Tactic: TA06 + +* Incidents: + +| Incident | Descriptions given for this incident | +| -------- | -------------------- | +| [I00047 Sea of Azov](../incidents/I00047.md) | (Distort) Kremlin-controlled RT cited Russian Minister of Foreign Affairs Sergei Lavrov suggesting that Ukraine deliberately provoked Russia in hopes of gaining additional support from the United States and Europe. | +| [I00053 China Huawei CFO Arrest](../incidents/I00053.md) | Distorted, saccharine “news” about the Chinese State and Party | + +DO NOT EDIT ABOVE THIS LINE - PLEASE ADD NOTES BELOW \ No newline at end of file diff --git a/techniques/T0024.md b/techniques/T0024.md new file mode 100644 index 0000000..148a07c --- /dev/null +++ b/techniques/T0024.md @@ -0,0 +1,20 @@ +# Create fake videos and images + +* Type: Technique + +* Name: Create fake videos and images + +* Id: T0024 + +* Summary: Create fake videos and/or images by manipulating existing content or generating new content (e.g. deepfakes). Examples include Pelosi video (making her appear drunk) and photoshoped shark on flooded streets of Houston TX. + +* Tactic: TA06 + +* Incidents: + +| Incident | Descriptions given for this incident | +| -------- | -------------------- | +| [I00006 Columbian Chemicals](../incidents/I00006.md) | Fake video/images | +| [I00042 Saudi/Qatar bot dispute](../incidents/I00042.md) | photoshopped/fake images | + +DO NOT EDIT ABOVE THIS LINE - PLEASE ADD NOTES BELOW \ No newline at end of file diff --git a/techniques/T0025.md b/techniques/T0025.md new file mode 100644 index 0000000..0dae748 --- /dev/null +++ b/techniques/T0025.md @@ -0,0 +1,24 @@ +# Leak altered documents + +* Type: Technique + +* Name: Leak altered documents + +* Id: T0025 + +* Summary: Obtain documents (eg by theft or leak), then alter and release, possibly among factual documents/sources. + +Example (2019) DFRLab report "Secondary Infektion” highlights incident with key asset being a forged “letter” created by the operation to provide ammunition for far-right forces in Europe ahead of the election. + +* Tactic: TA06 + +* Incidents: + +| Incident | Descriptions given for this incident | +| -------- | -------------------- | +| [I00015 ConcordDiscovery](../incidents/I00015.md) | Forge ('release' altered hacked documents), hack/leak/manipulate/distort | +| [I00017 US presidential elections](../incidents/I00017.md) | hack/leak/manipulate/distort | +| [I00022 #Macronleaks](../incidents/I00022.md) | hack/leak/manipulate/distort | +| [I00051 Integrity Initiative](../incidents/I00051.md) | hack/leak/manipulate/distort | + +DO NOT EDIT ABOVE THIS LINE - PLEASE ADD NOTES BELOW \ No newline at end of file diff --git a/techniques/T0026.md b/techniques/T0026.md new file mode 100644 index 0000000..8eceda0 --- /dev/null +++ b/techniques/T0026.md @@ -0,0 +1,18 @@ +# Create fake research + +* Type: Technique + +* Name: Create fake research + +* Id: T0026 + +* Summary: Create fake academic research. Example: fake social science research is often aimed at hot-button social issues such as gender, race and sexuality. Fake science research can target Climate Science debate or pseudoscience like anti-vaxx + +* Tactic: TA06 + +* Incidents: + +| Incident | Descriptions given for this incident | +| -------- | -------------------- | + +DO NOT EDIT ABOVE THIS LINE - PLEASE ADD NOTES BELOW \ No newline at end of file diff --git a/techniques/T0027.md b/techniques/T0027.md new file mode 100644 index 0000000..9f05a28 --- /dev/null +++ b/techniques/T0027.md @@ -0,0 +1,18 @@ +# Adapt existing narratives + +* Type: Technique + +* Name: Adapt existing narratives + +* Id: T0027 + +* Summary: Adapting existing narratives to current operational goals is the tactical sweet-spot for an effective misinformation campaign. Leveraging existing narratives is not only more effective, it requires substantially less resourcing, as the promotion of new master narratives operates on a much larger scale, both time and scope. Fluid, dynamic & often interchangeable key master narratives can be ("The morally corrupt West") adapted to divisive (LGBT propaganda) or to distort (individuals working as CIA operatives). For Western audiences, different but equally powerful framings are available, such as "USA has a fraught history in race relations, especially in criminal justice areas." + +* Tactic: TA06 + +* Incidents: + +| Incident | Descriptions given for this incident | +| -------- | -------------------- | + +DO NOT EDIT ABOVE THIS LINE - PLEASE ADD NOTES BELOW \ No newline at end of file diff --git a/techniques/T0028.md b/techniques/T0028.md new file mode 100644 index 0000000..cdff210 --- /dev/null +++ b/techniques/T0028.md @@ -0,0 +1,22 @@ +# Create competing narratives + +* Type: Technique + +* Name: Create competing narratives + +* Id: T0028 + +* Summary: Misinformation promotes an agenda by advancing narratives supportive of that agenda. This is most effective when the advanced narrative pre-dates the revelation of the specific misinformation content. But this is often not possible. + +Suppressing or discouraging narratives already spreading requires an alternative. The most simple set of narrative techniques in response would be the construction and promotion of contradictory alternatives centered on denial, deflection, dismissal, counter-charges, excessive standards of proof, bias in prohibition or enforcement, and so on. + +These competing narratives allow loyalists cover, but are less compelling to opponents and fence-sitters than campaigns built around existing narratives or highly explanatory master narratives. Competing narratives, as such, are especially useful in the *firehose of misinformation* approach. + +* Tactic: TA06 + +* Incidents: + +| Incident | Descriptions given for this incident | +| -------- | -------------------- | + +DO NOT EDIT ABOVE THIS LINE - PLEASE ADD NOTES BELOW \ No newline at end of file diff --git a/techniques/T0029.md b/techniques/T0029.md new file mode 100644 index 0000000..e2a5bd1 --- /dev/null +++ b/techniques/T0029.md @@ -0,0 +1,20 @@ +# Manipulate online polls + +* Type: Technique + +* Name: Manipulate online polls + +* Id: T0029 + +* Summary: Create fake online polls, or manipulate existing online polls. Examples: flooding FCC with comments; creating fake engagement metrics of Twitter/Facebook polls to manipulate perception of given issue. Data gathering tactic to target those who engage, and potentially their networks of friends/followers as well + +* Tactic: TA07 + +* Incidents: + +| Incident | Descriptions given for this incident | +| -------- | -------------------- | +| [I00005 Brexit vote](../incidents/I00005.md) | manipulate social media "online polls"? | +| [I00017 US presidential elections](../incidents/I00017.md) | manipulate social media "online polls"? | + +DO NOT EDIT ABOVE THIS LINE - PLEASE ADD NOTES BELOW \ No newline at end of file diff --git a/techniques/T0030.md b/techniques/T0030.md new file mode 100644 index 0000000..1853b57 --- /dev/null +++ b/techniques/T0030.md @@ -0,0 +1,20 @@ +# Backstop personas + +* Type: Technique + +* Name: Backstop personas + +* Id: T0030 + +* Summary: Create other assets/dossier/cover/fake relationships and/or connections or documents, sites, bylines, attributions, to establish/augment/inflate crediblity/believability + +* Tactic: TA07 + +* Incidents: + +| Incident | Descriptions given for this incident | +| -------- | -------------------- | +| [I00005 Brexit vote](../incidents/I00005.md) | Backstop personas | +| [I00017 US presidential elections](../incidents/I00017.md) | Backstop personas | + +DO NOT EDIT ABOVE THIS LINE - PLEASE ADD NOTES BELOW \ No newline at end of file diff --git a/techniques/T0031.md b/techniques/T0031.md new file mode 100644 index 0000000..e4174ae --- /dev/null +++ b/techniques/T0031.md @@ -0,0 +1,28 @@ +# YouTube + +* Type: Technique + +* Name: YouTube + +* Id: T0031 + +* Summary: Use YouTube as a narrative dissemination channel + +* Tactic: TA07 + +* Incidents: + +| Incident | Descriptions given for this incident | +| -------- | -------------------- | +| [I00005 Brexit vote](../incidents/I00005.md) | YouTube; Reddit; LinkedIn; Pinterest; WhatsApp? | +| [I00010 ParklandTeens](../incidents/I00010.md) | YouTube; Reddit | +| [I00017 US presidential elections](../incidents/I00017.md) | YouTube; Reddit; (Instagram, LinkedIn; Pinterest; WhatsApp?) | +| [I00029 MH17 investigation](../incidents/I00029.md) | YouTube; Reddit; | +| [I00032 Kavanaugh](../incidents/I00032.md) | YouTube; Reddit; (Instagram, LinkedIn; Pinterest; WhatsApp?) | +| [I00044 JadeHelm exercise](../incidents/I00044.md) | YouTube; Reddit | +| [I00049 White Helmets: Chemical Weapons](../incidents/I00049.md) | YouTube; Reddit; | +| [I00050 #HandsOffVenezuela](../incidents/I00050.md) | YouTube; Reddit; | +| [I00051 Integrity Initiative](../incidents/I00051.md) | YouTube; Reddit | +| [I00063 Olympic Doping Scandal](../incidents/I00063.md) | YouTube; Reddit; | + +DO NOT EDIT ABOVE THIS LINE - PLEASE ADD NOTES BELOW \ No newline at end of file diff --git a/techniques/T0032.md b/techniques/T0032.md new file mode 100644 index 0000000..75ecc42 --- /dev/null +++ b/techniques/T0032.md @@ -0,0 +1,28 @@ +# Reddit + +* Type: Technique + +* Name: Reddit + +* Id: T0032 + +* Summary: Use Reddit as a narrative dissemination channel + +* Tactic: TA07 + +* Incidents: + +| Incident | Descriptions given for this incident | +| -------- | -------------------- | +| [I00005 Brexit vote](../incidents/I00005.md) | YouTube; Reddit; LinkedIn; Pinterest; WhatsApp? | +| [I00010 ParklandTeens](../incidents/I00010.md) | YouTube; Reddit | +| [I00017 US presidential elections](../incidents/I00017.md) | YouTube; Reddit; (Instagram, LinkedIn; Pinterest; WhatsApp?) | +| [I00029 MH17 investigation](../incidents/I00029.md) | YouTube; Reddit; | +| [I00032 Kavanaugh](../incidents/I00032.md) | YouTube; Reddit; (Instagram, LinkedIn; Pinterest; WhatsApp?) | +| [I00044 JadeHelm exercise](../incidents/I00044.md) | YouTube; Reddit | +| [I00049 White Helmets: Chemical Weapons](../incidents/I00049.md) | YouTube; Reddit; | +| [I00050 #HandsOffVenezuela](../incidents/I00050.md) | YouTube; Reddit; | +| [I00051 Integrity Initiative](../incidents/I00051.md) | YouTube; Reddit | +| [I00063 Olympic Doping Scandal](../incidents/I00063.md) | YouTube; Reddit; | + +DO NOT EDIT ABOVE THIS LINE - PLEASE ADD NOTES BELOW \ No newline at end of file diff --git a/techniques/T0033.md b/techniques/T0033.md new file mode 100644 index 0000000..0ea6073 --- /dev/null +++ b/techniques/T0033.md @@ -0,0 +1,20 @@ +# Instagram + +* Type: Technique + +* Name: Instagram + +* Id: T0033 + +* Summary: Use Instagram as a narrative dissemination channel + +* Tactic: TA07 + +* Incidents: + +| Incident | Descriptions given for this incident | +| -------- | -------------------- | +| [I00017 US presidential elections](../incidents/I00017.md) | YouTube; Reddit; (Instagram, LinkedIn; Pinterest; WhatsApp?) | +| [I00032 Kavanaugh](../incidents/I00032.md) | YouTube; Reddit; (Instagram, LinkedIn; Pinterest; WhatsApp?) | + +DO NOT EDIT ABOVE THIS LINE - PLEASE ADD NOTES BELOW \ No newline at end of file diff --git a/techniques/T0034.md b/techniques/T0034.md new file mode 100644 index 0000000..5df9b56 --- /dev/null +++ b/techniques/T0034.md @@ -0,0 +1,21 @@ +# LinkedIn + +* Type: Technique + +* Name: LinkedIn + +* Id: T0034 + +* Summary: Use LinkedIn as a narrative dissemination channel + +* Tactic: TA07 + +* Incidents: + +| Incident | Descriptions given for this incident | +| -------- | -------------------- | +| [I00005 Brexit vote](../incidents/I00005.md) | YouTube; Reddit; LinkedIn; Pinterest; WhatsApp? | +| [I00017 US presidential elections](../incidents/I00017.md) | YouTube; Reddit; (Instagram, LinkedIn; Pinterest; WhatsApp?) | +| [I00032 Kavanaugh](../incidents/I00032.md) | YouTube; Reddit; (Instagram, LinkedIn; Pinterest; WhatsApp?) | + +DO NOT EDIT ABOVE THIS LINE - PLEASE ADD NOTES BELOW \ No newline at end of file diff --git a/techniques/T0035.md b/techniques/T0035.md new file mode 100644 index 0000000..bafdd42 --- /dev/null +++ b/techniques/T0035.md @@ -0,0 +1,21 @@ +# Pinterest + +* Type: Technique + +* Name: Pinterest + +* Id: T0035 + +* Summary: Use Pinterest as a narrative dissemination channel + +* Tactic: TA07 + +* Incidents: + +| Incident | Descriptions given for this incident | +| -------- | -------------------- | +| [I00005 Brexit vote](../incidents/I00005.md) | YouTube; Reddit; LinkedIn; Pinterest; WhatsApp? | +| [I00017 US presidential elections](../incidents/I00017.md) | YouTube; Reddit; (Instagram, LinkedIn; Pinterest; WhatsApp?) | +| [I00032 Kavanaugh](../incidents/I00032.md) | YouTube; Reddit; (Instagram, LinkedIn; Pinterest; WhatsApp?) | + +DO NOT EDIT ABOVE THIS LINE - PLEASE ADD NOTES BELOW \ No newline at end of file diff --git a/techniques/T0036.md b/techniques/T0036.md new file mode 100644 index 0000000..b76c631 --- /dev/null +++ b/techniques/T0036.md @@ -0,0 +1,21 @@ +# WhatsApp + +* Type: Technique + +* Name: WhatsApp + +* Id: T0036 + +* Summary: Use WhatsApp as a narrative dissemination channel + +* Tactic: TA07 + +* Incidents: + +| Incident | Descriptions given for this incident | +| -------- | -------------------- | +| [I00005 Brexit vote](../incidents/I00005.md) | YouTube; Reddit; LinkedIn; Pinterest; WhatsApp? | +| [I00017 US presidential elections](../incidents/I00017.md) | YouTube; Reddit; (Instagram, LinkedIn; Pinterest; WhatsApp?) | +| [I00032 Kavanaugh](../incidents/I00032.md) | YouTube; Reddit; (Instagram, LinkedIn; Pinterest; WhatsApp?) | + +DO NOT EDIT ABOVE THIS LINE - PLEASE ADD NOTES BELOW \ No newline at end of file diff --git a/techniques/T0037.md b/techniques/T0037.md new file mode 100644 index 0000000..d7410de --- /dev/null +++ b/techniques/T0037.md @@ -0,0 +1,18 @@ +# Facebook + +* Type: Technique + +* Name: Facebook + +* Id: T0037 + +* Summary: Use Facebook as a narrative dissemination channel + +* Tactic: TA07 + +* Incidents: + +| Incident | Descriptions given for this incident | +| -------- | -------------------- | + +DO NOT EDIT ABOVE THIS LINE - PLEASE ADD NOTES BELOW \ No newline at end of file diff --git a/techniques/T0038.md b/techniques/T0038.md new file mode 100644 index 0000000..8b889b2 --- /dev/null +++ b/techniques/T0038.md @@ -0,0 +1,18 @@ +# Twitter + +* Type: Technique + +* Name: Twitter + +* Id: T0038 + +* Summary: Use Twitter as a narrative dissemination channel + +* Tactic: TA07 + +* Incidents: + +| Incident | Descriptions given for this incident | +| -------- | -------------------- | + +DO NOT EDIT ABOVE THIS LINE - PLEASE ADD NOTES BELOW \ No newline at end of file diff --git a/techniques/T0039.md b/techniques/T0039.md new file mode 100644 index 0000000..cc11f58 --- /dev/null +++ b/techniques/T0039.md @@ -0,0 +1,23 @@ +# Bait legitimate influencers + +* Type: Technique + +* Name: Bait legitimate influencers + +* Id: T0039 + +* Summary: Credibility in a social media environment is often a function of the size of a user's network. "Influencers" are so-called because of their reach, typically understood as: 1) the size of their network (i.e. the number of followers, perhaps weighted by their own influence); and 2) The rate at which their comments are re-circulated (these two metrics are related). Add traditional media players at all levels of credibility and professionalism to this, and the number of potential influencial carriers available for unwitting amplification becomes substantial. + +By targeting high-influence people and organizations in all types of media with narratives and content engineered to appeal their emotional or ideological drivers, influence campaigns are able to add perceived credibility to their messaging via saturation and adoption by trusted agents such as celebrities, journalists and local leaders. + +* Tactic: TA08 + +* Incidents: + +| Incident | Descriptions given for this incident | +| -------- | -------------------- | +| [I00006 Columbian Chemicals](../incidents/I00006.md) | bait journalists/media/politicians | +| [I00010 ParklandTeens](../incidents/I00010.md) | journalist/media baiting | +| [I00015 ConcordDiscovery](../incidents/I00015.md) | journalist/media baiting | + +DO NOT EDIT ABOVE THIS LINE - PLEASE ADD NOTES BELOW \ No newline at end of file diff --git a/techniques/T0040.md b/techniques/T0040.md new file mode 100644 index 0000000..4535b8f --- /dev/null +++ b/techniques/T0040.md @@ -0,0 +1,20 @@ +# Demand unsurmountable proof + +* Type: Technique + +* Name: Demand unsurmountable proof + +* Id: T0040 + +* Summary: Campaigns often leverage tactical and informational asymmetries on the threat surface, as seen in the Distort and Deny strategies, and the "firehose of misinformation". Specifically, conspiracy theorists can be repeatedly wrong, but advocates of the truth need to be perfect. By constantly escalating demands for proof, propagandists can effectively leverage this asymmetry while also priming its future use, often with an even greater asymmetric advantage. The conspiracist is offered freer rein for a broader range of "questions" while the truth teller is burdened with higher and higher standards of proof. + +* Tactic: TA08 + +* Incidents: + +| Incident | Descriptions given for this incident | +| -------- | -------------------- | +| [I00029 MH17 investigation](../incidents/I00029.md) | Demand insurmountable proof | +| [I00047 Sea of Azov](../incidents/I00047.md) | Demand insurmountable proof | + +DO NOT EDIT ABOVE THIS LINE - PLEASE ADD NOTES BELOW \ No newline at end of file diff --git a/techniques/T0041.md b/techniques/T0041.md new file mode 100644 index 0000000..23afca1 --- /dev/null +++ b/techniques/T0041.md @@ -0,0 +1,18 @@ +# Deny involvement + +* Type: Technique + +* Name: Deny involvement + +* Id: T0041 + +* Summary: Without "smoking gun" proof (and even with proof), incident creator can or will deny involvement. This technique also leverages the attacker advantages outlined in T0040 "Demand unsurmountable proof", specifically the asymmetric disadvantage for truth-tellers in a "firehose of misinformation" environment. + +* Tactic: TA08 + +* Incidents: + +| Incident | Descriptions given for this incident | +| -------- | -------------------- | + +DO NOT EDIT ABOVE THIS LINE - PLEASE ADD NOTES BELOW \ No newline at end of file diff --git a/techniques/T0042.md b/techniques/T0042.md new file mode 100644 index 0000000..6ce54a9 --- /dev/null +++ b/techniques/T0042.md @@ -0,0 +1,22 @@ +# Kernel of Truth + +* Type: Technique + +* Name: Kernel of Truth + +* Id: T0042 + +* Summary: Wrap lies or altered context/facts around truths. + +Influence campaigns pursue a variety of objectives with respect to target audiences, prominent among them: 1. undermine a narrative commonly referenced in the target audience; or 2. promote a narrative less common in the target audience, but preferred by the attacker. In both cases, the attacker is presented with a heavy lift. They must change the relative importance of various narratives in the interpretation of events, despite contrary tendencies. + +When messaging makes use of factual reporting to promote these adjustments in the narrative space, they are less likely to be dismissed out of hand; when messaging can juxtapose a (factual) truth about current affairs with the (abstract) truth explicated in these narratives, propagandists can undermine or promote them selectively. Context matters. + +* Tactic: TA08 + +* Incidents: + +| Incident | Descriptions given for this incident | +| -------- | -------------------- | + +DO NOT EDIT ABOVE THIS LINE - PLEASE ADD NOTES BELOW \ No newline at end of file diff --git a/techniques/T0043.md b/techniques/T0043.md new file mode 100644 index 0000000..8b11a9e --- /dev/null +++ b/techniques/T0043.md @@ -0,0 +1,19 @@ +# Use SMS/ WhatsApp/ Chat apps + +* Type: Technique + +* Name: Use SMS/ WhatsApp/ Chat apps + +* Id: T0043 + +* Summary: Direct messaging via encypted app is an increasing method of delivery. These messages are often automated and new delivery and storage methods make them anonymous, viral, and ephemeral. This is a diffucult space to monitor, but also a difficult space to build acclaim or notoriety. + +* Tactic: TA08 + +* Incidents: + +| Incident | Descriptions given for this incident | +| -------- | -------------------- | +| [I00006 Columbian Chemicals](../incidents/I00006.md) | Use SMS/text messages | + +DO NOT EDIT ABOVE THIS LINE - PLEASE ADD NOTES BELOW \ No newline at end of file diff --git a/techniques/T0044.md b/techniques/T0044.md new file mode 100644 index 0000000..cacf4c6 --- /dev/null +++ b/techniques/T0044.md @@ -0,0 +1,21 @@ +# Seed distortions + +* Type: Technique + +* Name: Seed distortions + +* Id: T0044 + +* Summary: Incident creators often try a wide variety of messages in the early hours surrounding an incident or event in order to give a misleading account or impression. + +Examples: (2019) China formally arrests Canadians Spavor and Kovrig, accuses them of spying (in retaliation to detention of Hauwei CFO). (2018) The Russian ministry of defence put out a press release, claiming that they had intelligence Syrian rebel forces were about to gas their own people in Idlib province as part of a “false flag” operation to frame the Syrian government. + +* Tactic: TA08 + +* Incidents: + +| Incident | Descriptions given for this incident | +| -------- | -------------------- | +| [I00015 ConcordDiscovery](../incidents/I00015.md) | Circulate to media via DM, then release publicly | + +DO NOT EDIT ABOVE THIS LINE - PLEASE ADD NOTES BELOW \ No newline at end of file diff --git a/techniques/T0045.md b/techniques/T0045.md new file mode 100644 index 0000000..d8b9365 --- /dev/null +++ b/techniques/T0045.md @@ -0,0 +1,19 @@ +# Use fake experts + +* Type: Technique + +* Name: Use fake experts + +* Id: T0045 + +* Summary: Use the fake experts that were set up in T0009. Pseudo-experts are disposable assets that often appear once and then disappear. Give "credility" to misinformation. Take advantage of credential bias + +* Tactic: TA08 + +* Incidents: + +| Incident | Descriptions given for this incident | +| -------- | -------------------- | +| [I00009 PhilippinesExpert](../incidents/I00009.md) | Using "expert" | + +DO NOT EDIT ABOVE THIS LINE - PLEASE ADD NOTES BELOW \ No newline at end of file diff --git a/techniques/T0046.md b/techniques/T0046.md new file mode 100644 index 0000000..e292fb3 --- /dev/null +++ b/techniques/T0046.md @@ -0,0 +1,30 @@ +# Search Engine Optimization + +* Type: Technique + +* Name: Search Engine Optimization + +* Id: T0046 + +* Summary: Manipulate content engagement metrics (ie: Reddit & Twitter) to influence/impact news search results (e.g. Google), also elevates RT & Sputnik headline into Google news alert emails. aka "Black-hat SEO" + +* Tactic: TA08 + +* Incidents: + +| Incident | Descriptions given for this incident | +| -------- | -------------------- | +| [I00002 #VaccinateUS](../incidents/I00002.md) | SEO optimisation/manipulation ("key words") | +| [I00005 Brexit vote](../incidents/I00005.md) | SEO optimisation/manipulation ("key words") | +| [I00010 ParklandTeens](../incidents/I00010.md) | SEO optimisation/manipulation ("key words") | +| [I00017 US presidential elections](../incidents/I00017.md) | SEO optimisation/manipulation ("key words") | +| [I00029 MH17 investigation](../incidents/I00029.md) | SEO optimisation/manipulation ("key words") | +| [I00032 Kavanaugh](../incidents/I00032.md) | SEO optimisation/manipulation ("key words") | +| [I00044 JadeHelm exercise](../incidents/I00044.md) | SEO optimisation/manipulation ("key words") | +| [I00049 White Helmets: Chemical Weapons](../incidents/I00049.md) | SEO optimisation/manipulation ("key words") | +| [I00050 #HandsOffVenezuela](../incidents/I00050.md) | SEO optimisation/manipulation ("key words") | +| [I00051 Integrity Initiative](../incidents/I00051.md) | SEO optimisation/manipulation ("key words") | +| [I00056 Iran Influence Operations](../incidents/I00056.md) | SEO optimisation/manipulation ("key words") | +| [I00063 Olympic Doping Scandal](../incidents/I00063.md) | SEO optimisation/manipulation ("key words") | + +DO NOT EDIT ABOVE THIS LINE - PLEASE ADD NOTES BELOW diff --git a/techniques/T0047.md b/techniques/T0047.md new file mode 100644 index 0000000..a2bd0d4 --- /dev/null +++ b/techniques/T0047.md @@ -0,0 +1,19 @@ +# Muzzle social media as a political force + +* Type: Technique + +* Name: Muzzle social media as a political force + +* Id: T0047 + +* Summary: Use political influence or the power of state to stop critical social media comments. Government requested/driven content take downs (see Google Transperancy reports. (Example 20190 Singapore Protection from Online Falsehoods and Manipulation Bill would make it illegal to spread "false statements of fact" in Singapore, where that information is "prejudicial" to Singapore's security or "public tranquility." Or India/New Delhi has cut off services to Facebook and Twitter in Kashmir 28 times in the past five years, and in 2016, access was blocked for five months -- on the grounds that these platforms were being used for anti-social and "anti-national" purposes. + +* Tactic: TA09 + +* Incidents: + +| Incident | Descriptions given for this incident | +| -------- | -------------------- | +| [I00033 China 50cent Army](../incidents/I00033.md) | cow online opinion leaders into submission, muzzling social media as a political force | + +DO NOT EDIT ABOVE THIS LINE - PLEASE ADD NOTES BELOW \ No newline at end of file diff --git a/techniques/T0048.md b/techniques/T0048.md new file mode 100644 index 0000000..a536e5a --- /dev/null +++ b/techniques/T0048.md @@ -0,0 +1,19 @@ +# Cow online opinion leaders + +* Type: Technique + +* Name: Cow online opinion leaders + +* Id: T0048 + +* Summary: Intimidate, coerce, threaten critics/dissidents/journalists via trolling, doxing. Examples: Philippines, Maria Ressa and Rappler journalists targeted Duterte regime, lawsuits, trollings, banned from the presidential palace where press briefings take place; 2017 bot attack on five ProPublica Journalists. + +* Tactic: TA09 + +* Incidents: + +| Incident | Descriptions given for this incident | +| -------- | -------------------- | +| [I00033 China 50cent Army](../incidents/I00033.md) | cow online opinion leaders into submission, muzzling social media as a political force | + +DO NOT EDIT ABOVE THIS LINE - PLEASE ADD NOTES BELOW \ No newline at end of file diff --git a/techniques/T0049.md b/techniques/T0049.md new file mode 100644 index 0000000..237c4f7 --- /dev/null +++ b/techniques/T0049.md @@ -0,0 +1,22 @@ +# Flooding + +* Type: Technique + +* Name: Flooding + +* Id: T0049 + +* Summary: Flooding and/or mobbing social media channels feeds and/or hashtag with excessive volume of content to control/shape online conversations and/or drown out opposing points of view. Bots and/or patriotic trolls are effective tools to acheive this effect. + +Example (2018): bots flood social media promoting messages which support Saudi Arabia with intent to cast doubt on allegations that the kingdom was involved in Khashoggi’s death. + +* Tactic: TA09 + +* Incidents: + +| Incident | Descriptions given for this incident | +| -------- | -------------------- | +| [I00033 China 50cent Army](../incidents/I00033.md) | 2,000,000 people (est.) part of state run/sponsored astroturfing | +| [I00034 DibaFacebookExpedition](../incidents/I00034.md) | flood the Facebook pages of Taiwanese politicians and news agencies with a pro-PRC message, Democratic Progressive Party (DPP), attracted nearly 40,000 Facebook comments in just eight hours. | + +DO NOT EDIT ABOVE THIS LINE - PLEASE ADD NOTES BELOW \ No newline at end of file diff --git a/techniques/T0050.md b/techniques/T0050.md new file mode 100644 index 0000000..6f83caa --- /dev/null +++ b/techniques/T0050.md @@ -0,0 +1,20 @@ +# Cheerleading domestic social media ops + +* Type: Technique + +* Name: Cheerleading domestic social media ops + +* Id: T0050 + +* Summary: Deploy state-coordinated social media commenters and astroturfers. Both internal/domestic and external social media influence operations, popularized by China (50cent Army manage message inside the "Great Firewall") but also technique used by Chinese English-language social media influence operations are seeded by state-run media, which overwhelmingly present a positive, benign, and cooperative image of China. + +* Tactic: TA09 + +* Incidents: + +| Incident | Descriptions given for this incident | +| -------- | -------------------- | +| [I00033 China 50cent Army](../incidents/I00033.md) | domestic social media influence operations focus primarily on “cheerleading” or presenting or furthering a positive narrative about the Chinese state | +| [I00053 China Huawei CFO Arrest](../incidents/I00053.md) | Extend digital the physical space… gatherings ie: support for Meng outside courthouse | + +DO NOT EDIT ABOVE THIS LINE - PLEASE ADD NOTES BELOW \ No newline at end of file diff --git a/techniques/T0051.md b/techniques/T0051.md new file mode 100644 index 0000000..90d555d --- /dev/null +++ b/techniques/T0051.md @@ -0,0 +1,19 @@ +# Fabricate social media comment + +* Type: Technique + +* Name: Fabricate social media comment + +* Id: T0051 + +* Summary: Use government-paid social media commenters, astroturfers, chat bots (programmed to reply to specific key words/hashtags) influence online conversations, product reviews, web-site comment forums. (2017 example) the FCC was inundated with nearly 22 million public comments on net neutrality (many from fake accounts) + +* Tactic: TA09 + +* Incidents: + +| Incident | Descriptions given for this incident | +| -------- | -------------------- | +| [I00033 China 50cent Army](../incidents/I00033.md) | fabricated social media comment | + +DO NOT EDIT ABOVE THIS LINE - PLEASE ADD NOTES BELOW \ No newline at end of file diff --git a/techniques/T0052.md b/techniques/T0052.md new file mode 100644 index 0000000..ab6feee --- /dev/null +++ b/techniques/T0052.md @@ -0,0 +1,25 @@ +# Tertiary sites amplify news + +* Type: Technique + +* Name: Tertiary sites amplify news + +* Id: T0052 + +* Summary: Create content/news/opinion web-sites to cross-post stories. Tertiary sites circulate and amplify narratives. Often these sites have no masthead, bylines or attribution. + +Examples of tertiary sites include Russia Insider, The Duran, geopolitica.ru, Mint Press News, Oriental Review, globalresearch.ca. Examples: (2019, Domestic news): Snopes reveals Star News Digital Media, Inc. may look like a media company that produces local news, but operates via undisclosed connections to political activism. (2018) FireEye reports on Iranian campaign that created between April 2018 and March 2019 sites used to spread inauthentic content from websites such as Liberty Front Press (LFP), US Journal, and Real Progressive Front during the 2018 US mid-terms. + +* Tactic: TA09 + +* Incidents: + +| Incident | Descriptions given for this incident | +| -------- | -------------------- | +| [I00009 PhilippinesExpert](../incidents/I00009.md) | News circulated/amplifed by tertiary sites (Russia Insider, The Duran, Geopolitica.ru, Mint Press News, Oriental Review, globalresearch.ca) | +| [I00029 MH17 investigation](../incidents/I00029.md) | News circulated/amplifed by tertiary sites (Russia Insider, The Duran, Geopolitica.ru, Mint Press News, Oriental Review, globalresearch.ca) | +| [I00049 White Helmets: Chemical Weapons](../incidents/I00049.md) | News circulated/amplifed by tertiary sites (Russia Insider, The Duran, Geopolitica.ru, Mint Press News, Oriental Review, globalresearch.ca) | +| [I00050 #HandsOffVenezuela](../incidents/I00050.md) | News circulated/amplifed by tertiary sites (Mint Press News, globalresearch.ca) | +| [I00063 Olympic Doping Scandal](../incidents/I00063.md) | News circulated/amplifed by tertiary sites (Russia Insider, The Duran, Geopolitica.ru, Mint Press News, Oriental Review, globalresearch.ca) | + +DO NOT EDIT ABOVE THIS LINE - PLEASE ADD NOTES BELOW \ No newline at end of file diff --git a/techniques/T0053.md b/techniques/T0053.md new file mode 100644 index 0000000..d3fe581 --- /dev/null +++ b/techniques/T0053.md @@ -0,0 +1,32 @@ +# Twitter trolls amplify and manipulate + +* Type: Technique + +* Name: Twitter trolls amplify and manipulate + +* Id: T0053 + +* Summary: Use trolls to amplify narratives and/or manipulate narratives. Fake profiles/sockpuppets operating to support individuals/narratives from the entire political spectrum (left/right binary). Operating with increased emphasis on promoting local content and promoting real Twitter users generating their own, often divisive political content, as it's easier to amplify existing content than create new/original content. Trolls operate where ever there's a socially divisive issue (issues that can/are be politicized) e.g. BlackLivesMatter or MeToo + +* Tactic: TA09 + +* Incidents: + +| Incident | Descriptions given for this incident | +| -------- | -------------------- | +| [I00005 Brexit vote](../incidents/I00005.md) | Twitter trolls amplify & manipulate | +| [I00007 Incirlik terrorists](../incidents/I00007.md) | Twitter trolls amplify & manipulate | +| [I00010 ParklandTeens](../incidents/I00010.md) | Twitter trolls amplify & manipulate | +| [I00017 US presidential elections](../incidents/I00017.md) | Twitter trolls amplify & manipulate | +| [I00022 #Macronleaks](../incidents/I00022.md) | Twitter trolls amplify & manipulate | +| [I00029 MH17 investigation](../incidents/I00029.md) | Twitter trolls amplify & manipulate | +| [I00032 Kavanaugh](../incidents/I00032.md) | Twitter trolls amplify & manipulate | +| [I00044 JadeHelm exercise](../incidents/I00044.md) | Twitter trolls amplify & manipulate | +| [I00047 Sea of Azov](../incidents/I00047.md) | Twitter trolls amplify & manipulate | +| [I00049 White Helmets: Chemical Weapons](../incidents/I00049.md) | Twitter trolls amplify & manipulate | +| [I00050 #HandsOffVenezuela](../incidents/I00050.md) | Twitter trolls amplify & manipulate | +| [I00051 Integrity Initiative](../incidents/I00051.md) | Twitter trolls amplify & manipulate | +| [I00056 Iran Influence Operations](../incidents/I00056.md) | Twitter trolls amplify & manipulate | +| [I00063 Olympic Doping Scandal](../incidents/I00063.md) | Twitter trolls amplify & manipulate | + +DO NOT EDIT ABOVE THIS LINE - PLEASE ADD NOTES BELOW \ No newline at end of file diff --git a/techniques/T0054.md b/techniques/T0054.md new file mode 100644 index 0000000..f23f105 --- /dev/null +++ b/techniques/T0054.md @@ -0,0 +1,33 @@ +# Twitter bots amplify + +* Type: Technique + +* Name: Twitter bots amplify + +* Id: T0054 + +* Summary: Use bots to amplify narratives above algorithm thresholds. Bots are automated/programmed profiles designed to amplify content (ie: automatically retweet or like) and give appearance it's more "popular" than it is. They can operate as a network, to function in a coordinated/orchestrated manner. In some cases (more so now) they are an inexpensive/disposable assets used for minimal deployment as bot detection tools improve and platforms are more responsive.(example 2019) #TrudeauMustGo + +* Tactic: TA09 + +* Incidents: + +| Incident | Descriptions given for this incident | +| -------- | -------------------- | +| [I00005 Brexit vote](../incidents/I00005.md) | Twitter bots amplify & manipulate | +| [I00007 Incirlik terrorists](../incidents/I00007.md) | Twitter bots amplify & manipulate | +| [I00010 ParklandTeens](../incidents/I00010.md) | Twitter bots amplify & manipulate | +| [I00017 US presidential elections](../incidents/I00017.md) | Twitter bots amplify & manipulate | +| [I00022 #Macronleaks](../incidents/I00022.md) | Twitter bots amplify & manipulate | +| [I00029 MH17 investigation](../incidents/I00029.md) | Twitter bots amplify & manipulate | +| [I00032 Kavanaugh](../incidents/I00032.md) | Twitter bots amplify & manipulate | +| [I00042 Saudi/Qatar bot dispute](../incidents/I00042.md) | Twitter bots amplify & manipulate | +| [I00044 JadeHelm exercise](../incidents/I00044.md) | Twitter bots amplify & manipulate | +| [I00047 Sea of Azov](../incidents/I00047.md) | Twitter bots amplify & manipulate | +| [I00049 White Helmets: Chemical Weapons](../incidents/I00049.md) | Twitter bots amplify & manipulate | +| [I00050 #HandsOffVenezuela](../incidents/I00050.md) | Twitter bots amplify & manipulate | +| [I00051 Integrity Initiative](../incidents/I00051.md) | Twitter bots amplify & manipulate | +| [I00056 Iran Influence Operations](../incidents/I00056.md) | Twitter bots amplify & manipulate | +| [I00063 Olympic Doping Scandal](../incidents/I00063.md) | Twitter bots amplify & manipulate | + +DO NOT EDIT ABOVE THIS LINE - PLEASE ADD NOTES BELOW \ No newline at end of file diff --git a/techniques/T0055.md b/techniques/T0055.md new file mode 100644 index 0000000..9fd0042 --- /dev/null +++ b/techniques/T0055.md @@ -0,0 +1,19 @@ +# Use hashtag + +* Type: Technique + +* Name: Use hashtag + +* Id: T0055 + +* Summary: Use a dedicated hashtag for the incident (e.g. #PhosphorusDisaster) - either create a campaign/incident specific hashtag, or take over an existing hashtag. + +* Tactic: TA09 + +* Incidents: + +| Incident | Descriptions given for this incident | +| -------- | -------------------- | +| [I00006 Columbian Chemicals](../incidents/I00006.md) | Create and use hashtag | + +DO NOT EDIT ABOVE THIS LINE - PLEASE ADD NOTES BELOW \ No newline at end of file diff --git a/techniques/T0056.md b/techniques/T0056.md new file mode 100644 index 0000000..0fb35b8 --- /dev/null +++ b/techniques/T0056.md @@ -0,0 +1,31 @@ +# Dedicated channels disseminate information pollution + +* Type: Technique + +* Name: Dedicated channels disseminate information pollution + +* Id: T0056 + +* Summary: Output information pollution (e.g. articles on an unreported false story/event) through channels controlled by or related to the incident creator. Examples include RT/Sputnik or antivax websites seeding stories. + +* Tactic: TA09 + +* Incidents: + +| Incident | Descriptions given for this incident | +| -------- | -------------------- | +| [I00002 #VaccinateUS](../incidents/I00002.md) | create web-site - information pollution | +| [I00005 Brexit vote](../incidents/I00005.md) | RT & Sputnik generate information pollution | +| [I00007 Incirlik terrorists](../incidents/I00007.md) | RT & Sputnik generate information pollution (report an unreported false story/event) | +| [I00009 PhilippinesExpert](../incidents/I00009.md) | RT & Sputnik generate information pollution | +| [I00017 US presidential elections](../incidents/I00017.md) | RT & Sputnik generate information pollution | +| [I00029 MH17 investigation](../incidents/I00029.md) | RT & Sputnik generate information pollution (synthetic media) | +| [I00032 Kavanaugh](../incidents/I00032.md) | RT & Sputnik generate information pollution | +| [I00044 JadeHelm exercise](../incidents/I00044.md) | RT & Sputnik generate information pollution | +| [I00049 White Helmets: Chemical Weapons](../incidents/I00049.md) | RT & Sputnik generate information pollution (synthetic media) | +| [I00050 #HandsOffVenezuela](../incidents/I00050.md) | RT & Sputnik generate information pollution (synthetic media) | +| [I00051 Integrity Initiative](../incidents/I00051.md) | RT & Sputnik generate information pollution | +| [I00053 China Huawei CFO Arrest](../incidents/I00053.md) | State-run media seeds foreign influence environment | +| [I00063 Olympic Doping Scandal](../incidents/I00063.md) | RT & Sputnik generate information pollution (synthetic media) | + +DO NOT EDIT ABOVE THIS LINE - PLEASE ADD NOTES BELOW \ No newline at end of file diff --git a/techniques/T0057.md b/techniques/T0057.md new file mode 100644 index 0000000..d45eb41 --- /dev/null +++ b/techniques/T0057.md @@ -0,0 +1,22 @@ +# Organise remote rallies and events + +* Type: Technique + +* Name: Organise remote rallies and events + +* Id: T0057 + +* Summary: Coordinate and promote real-world events across media platforms, e.g. rallies, protests, gatherings in support of incident narratives. Example: Facebook groups/pages coordinate/more divisive/polarizing groups and actvities into the public space. (Example) Mueller's report, highlights, the IRA organized political rallies in the U.S. using social media starting in 2015 and continued to coordinate rallies after the 2016 election + +* Tactic: TA10 + +* Incidents: + +| Incident | Descriptions given for this incident | +| -------- | -------------------- | +| [I00005 Brexit vote](../incidents/I00005.md) | Digital to physical "organize+promote" rallies & events? | +| [I00017 US presidential elections](../incidents/I00017.md) | Digital to physical "organize+promote" rallies & events | +| [I00032 Kavanaugh](../incidents/I00032.md) | Digital to physical "organize+promote" rallies & events? | +| [I00053 China Huawei CFO Arrest](../incidents/I00053.md) | Events coordinated and promoted across media platforms, Extend digital the physical space… gatherings ie: support for Meng outside courthouse | + +DO NOT EDIT ABOVE THIS LINE - PLEASE ADD NOTES BELOW \ No newline at end of file diff --git a/techniques/T0058.md b/techniques/T0058.md new file mode 100644 index 0000000..4af1708 --- /dev/null +++ b/techniques/T0058.md @@ -0,0 +1,20 @@ +# Legacy web content + +* Type: Technique + +* Name: Legacy web content + +* Id: T0058 + +* Summary: Make incident content visible for a long time, e.g. by exploiting platform terms of service, or placing it where it's hard to remove or unlikely to be removed. + +* Tactic: TA11 + +* Incidents: + +| Incident | Descriptions given for this incident | +| -------- | -------------------- | +| [I00002 #VaccinateUS](../incidents/I00002.md) | legacy web content, hard to remove content and/or campaign/exploit TOS | +| [I00056 Iran Influence Operations](../incidents/I00056.md) | legacy web content | + +DO NOT EDIT ABOVE THIS LINE - PLEASE ADD NOTES BELOW \ No newline at end of file diff --git a/techniques/T0059.md b/techniques/T0059.md new file mode 100644 index 0000000..4045576 --- /dev/null +++ b/techniques/T0059.md @@ -0,0 +1,20 @@ +# Play the long game + +* Type: Technique + +* Name: Play the long game + +* Id: T0059 + +* Summary: Play the long game can mean a couple of things: +1. To plan messaging and allow it to grow organically without conducting your own amplification. This is methodical and slow and requires years for the message to take hold (e.g. China and its constant messaging that Taiwan and Hong Kong are part of one China). +2. To develop a series of seemingly disconnected messaging narratives that eventually combine into a new narrative. + +* Tactic: TA11 + +* Incidents: + +| Incident | Descriptions given for this incident | +| -------- | -------------------- | + +DO NOT EDIT ABOVE THIS LINE - PLEASE ADD NOTES BELOW \ No newline at end of file diff --git a/techniques/T0060.md b/techniques/T0060.md new file mode 100644 index 0000000..38be261 --- /dev/null +++ b/techniques/T0060.md @@ -0,0 +1,18 @@ +# Continue to amplify + +* Type: Technique + +* Name: Continue to amplify + +* Id: T0060 + +* Summary: continue narrative or message amplification after the main incident work has finished + +* Tactic: TA11 + +* Incidents: + +| Incident | Descriptions given for this incident | +| -------- | -------------------- | + +DO NOT EDIT ABOVE THIS LINE - PLEASE ADD NOTES BELOW \ No newline at end of file diff --git a/techniques/T0061.md b/techniques/T0061.md new file mode 100644 index 0000000..0c97e45 --- /dev/null +++ b/techniques/T0061.md @@ -0,0 +1,18 @@ +# Sell merchandising + +* Type: Technique + +* Name: Sell merchandising + +* Id: T0061 + +* Summary: Sell hats, t-shirts, flags and other branded content that's designed to be seen in the real world + +* Tactic: TA10 + +* Incidents: + +| Incident | Descriptions given for this incident | +| -------- | -------------------- | + +DO NOT EDIT ABOVE THIS LINE - PLEASE ADD NOTES BELOW \ No newline at end of file