diff --git a/AMITT_MASTER_DATA/AMITT_COMMENTS.csv b/AMITT_MASTER_DATA/AMITT_COMMENTS.csv new file mode 100644 index 0000000..045fb69 --- /dev/null +++ b/AMITT_MASTER_DATA/AMITT_COMMENTS.csv @@ -0,0 +1,1755 @@ +0,1,2 +"counter","C00066"," + +New content. + +If a group has the ability - e.g. enough dedicated person-hours - it can hijack the artifacts and narratives of a disinformation incident, by flooding them with counter-content. This has been seen in the past as accidental hashtag flooding - e.g. a new disinformation hashtag was unknowingly chosen that was the same as a children's swim team, which became active during a swim meet. In 2020, kPop stans flooded disinformation-carrying hashtags including #whitelivesmatter, and gay men flooded the #proudboys hashtag. + +This is an example of a countertechnique that mirrors an existing disinformation technique - in this case T0049. +" +"incident","I00002"," + +Actor: IRA, individuals (e.g. Larry Cook). + +Timeframe: + +Date: + +Presumed goals: +Physical damage to country? + +Method: + +* Targetted facebook ads (Larry Cook, targetting Washington State mothers, $1,776 to boost posts over 9 months). +* Gofundme campaigns to pay for ads (Larry Cook) + +Effects: + +* “The U.S. anti-vax movement has been blamed for two outbreaks of measles that have infected some 300 people—mostly children—in New York and the Pacific Northwest.” + +Counters: + +* American Medical Association “warned social-media giants, including Amazon, Facebook, Google, Pinterest, Twitter, and YouTube, that they were helping to amplify the propaganda and confuse parents.” +* Gofundme banned antivaxxers: “Campaigns raising money to promote misinformation about vaccines violate GoFundMe’s terms of service and will be removed from the platform”. Less than 10 campaigns reported as removed. + +Related incidents: + +Artefacts: + +Search terms vaccination, anti-vaccination, “vaccine choice”. + +Notes: + +Started by looking for vaccine-related content in my misinformation datasets +Then did google search for “antivax misinformation” to get references etc. +Larry Cook runs “Stop Mandatory Vaccination”: “donations go “directly” to his bank account and funds “may be used to pay [his] personal bills.” + + +References; + +* https://www.thedailybeast.com/brooklyn-hasidic-community-is-in-the-midst-of-a-dire-measles-outbreak +* https://www.thedailybeast.com/amazon-wont-take-a-stand-in-war-over-forrest-maready-book-the-autism-vaccine +* https://www.bmj.com/content/362/bmj.k3739 +* https://hub.jhu.edu/2018/08/24/russian-trolls-bots-spread-vaccine-misinformation/ +* https://ajph.aphapublications.org/doi/full/10.2105/AJPH.2018.304567 +* Arciga, [GoFundMe Bans Anti-Vaxxers Who Raise Money to Spread Misinformation](https://www.thedailybeast.com/gofundme-bans-anti-vaxxers-who-raise-money-to-spread-misinformation), Daily Beast 2019-03-22 +* Arciga, [Anti-Vaxxer Larry Cook Has Weaponized Facebook Ads in War Against Science](https://www.thedailybeast.com/anti-vaxxer-larry-cook-has-weaponized-facebook-ads-in-war-against-science), Daily Beast 2019-02-15 +* Gofundmes (removed, but check archives) https://www.gofundme.com/help-save-vaccine-exemptions-in-washington-state https://www.gofundme.com/parents-wake-up-vaccines-kill +* Markay, [Anti-Vaccine Facebook Ads Target Women in Measles-Stricken States](https://www.thedailybeast.com/anti-vaccine-facebook-ads-target-women-in-measles-stricken-states/), Daily Beast 2019-02-14 + +Data + + +" +"incident","I00053"," + +Actor: China + +Timeframe: December 5, 2018 - still active on 04/03/2019 + +Date: December 5, 2018 + +Presumed goals: + +* Unlike Russia, Chinese state has employed a plethora of state-run media to exploit the openness of American democratic society in an effort to insert an intentionally distorted and biased narrative portraying a utopian view of the Chinese government and party. + +Method: + +* China’s state-run social media operations are largely positive and coordinated because those techniques support Chinese strategic goals. State-run media seeds foreign influence environment +* Distorted, saccharine “news” about the Chinese State and Party +* Events coordinated and promoted across media platforms +* Extend from digital into physical space with gatherings, ie: support for Meng outside courthouse + +* In the case of Chinese state-run information manipulation campaigns — to distinguish the political intent and national strategies underlying these campaigns as different from simply another perspective on the news. China also play’s victim, innocence, plays by rules, misunderstood narrative… they too have their version of the 4D’s. Examples: “Chinese ambassador Lu Shaye has accused Canada of applying a double standard, and has decried what he sees as “Western egotism and white supremacy” in the treatment of detained Huawei executive Meng Wanzhou.” - Op-Ed in Globe & Mail. The Chinese embassy in Canada says the Vancouver arrest of a top Huawei executive amounts to a “political conspiracy” to undermine the telecom giant and it dismisses Prime Minister Justin Trudeau’s assertion that he had no role in the high-profile case. Canada's arrest of a senior Huawei executive was the ""backstabbing"" of a friend, Chinese ambassador Lu Shaye said Thursday, and he warned of repercussions if the federal government bars her telecom company from building a Canadian 5G network. + +Counters: none identified/researched + +Related incidents: + +* See Poland (arrest of Huawei employee); Czech republic; +* Five Eyes to ban or not ban Huawei 5G network equipment + + +References: + +* https://www.theglobeandmail.com/politics/article-chinas-envoy-says-white-supremacy-played-part-in-canadas-arrest-of/ +* https://twitter.com/globaltimesnews +* https://twitter.com/UserExperienceU +* https://www.universityworldnews.com/post.php?story=20190125061623487 +* https://www.theglobeandmail.com/business/article-canadian-universities-continuing-rd-funding-partnerships-with/ +* http://fortune.com/2019/01/18/oxford-university-huawei-research-funding/ +* https://www.reuters.com/article/us-usa-china-security-universities-insig/u-s-universities-unplug-from-chinas-huawei-under-pressure-from-trump-idUSKCN1PI0GV + + +* Beyond Hybrid War: How China Exploits Social Media to Sway American Opinion +https://www.theglobeandmail.com/politics/article-china-says-arrest-of-huawei-cfo-part-of-political-conspiracy-by/ +* https://www.theatlantic.com/international/archive/2019/03/czech-zeman-babis-huawei-xi-trump/584158 +* https://www.defenseone.com/technology/2019/04/installing-chinese-5g-gear-dangerous-and-probably-inevitable-nato-report/156007/?oref=defenseone_today_nl +* https://www.ctvnews.ca/politics/canada-s-arrest-of-huawei-exec-an-act-of-backstabbing-chinese-ambassador-says-1.4258201 +* https://www.cnn.com/2019/01/09/asia/china-canada-meng-huawei-intl/index.html +* https://www.theglobeandmail.com/opinion/article-on-china-has-canada-lost-its-sense-of-justice/ +* https://portswigger.net/daily-swig/proper-news-or-propaganda-chinas-social-media-manipulations-exposed +* https://globalnews.ca/news/4758109/china-bully-canada-release-huawei-cfo/ +* https://www.ctvnews.ca/canada/canada-will-pay-chinese-state-media-threaten-repercussions-over-huawei-arrest-1.4216293 +* https://business.financialpost.com/telecom/inside-huaweis-rather-awkward-charm-offensive-to-convince-the-world-its-ok +* https://www.scmp.com/comment/letters/article/3001272/despite-us-allegations-huawei-has-done-nothing-wrong-why-should-it + +Datasets: none identified (mining more Twitter data, Reddit, and comment forums could be valuable research) + +Notes: + +While a hypothesis and not related to Meng’s arrest, research done by John Gray (using Mentionmapp data from January 13, 2019) also suggests the need to look at adjecent/tangential flow of social data. In this case (could be coincidence) simutatneaous flow of tweets via State Media @globaltimesnews (reporting on Poland arrest) and of “influencer” (using bots to amplify content) @UserExperienceU tweeting favorable about Huawei technology. Need to consider the amplifiers/influencers operate to support/put the happy face on Huawei. More work needs to be done researching social behavior outside the “Great Firewall” using trolls, bots, cyborgs, and “willing/unwitting” idiots. Just like Russia, we also need to give more consideration to how bots/automation (low-volume in particular) is operating to amplify State Media in order to gain higher fidelity in search engines. + +We should also recognize another form of Huawei/China manipulation in the form of research programs in Universities across North America and Europe +https://www.universityworldnews.com/post.php?story=20190125061623487 +https://www.theglobeandmail.com/business/article-canadian-universities-continuing-rd-funding-partnerships-with/ +fortune.com/2019/01/18/oxford-university-huawei-research-funding/ +https://www.reuters.com/article/us-usa-china-security-universities-insig/u-s-universities-unplug-from-chinas-huawei-under-pressure-from-trump-idUSKCN1PI0GV + +Timeline of events + +Dec. 6: China demands Canada release Meng and “immediately correct the mistake” officials made in arresting her. The Chinese also say they were not briefed on the reasons for Meng’s arrest. +In Ottawa, Prime Minister Justin Trudeau says Meng’s case is part of an independent legal process with no outside political influence. +Dec. 7: In Vancouver, Meng appears in court, where allegations of fraud are laid out. The U.S. alleges Meng misled American banks in a bid to get around American sanctions on Iran. +Dec. 8: Canada’s ambassador to China, John McCallum, is summoned to a meeting with China’s assistant foreign minister so the country can register complaints about Meng’s arrest. “China strongly urges the Canadian side to immediately release the detained Huawei executive … or face grave consequences that the Canadian side should be held accountable for,” the assistant minister, Le Yucheng, says in a statement. + +Dec. 12: China’s foreign ministry says it has no information about Kovrig, but says the organization he worked with – the International Crisis Group – was not registered in China, making its activities in the country illegal. + +Dec. 13: China’s foreign ministry says Kovrig and Spavor have been detained on suspicion of “endangering national security.” + +Dec. 20: Indictments unsealed in the United States allege two Chinese citizens targeted companies in Canada and around the world as part of a years-long hacking campaign to steal data. + +Dec. 24: China’s foreign ministry calls out the U.S., Britain and EU, saying the trio should be condemning Canada for Meng’s arrest. Spokeswoman Hua Chunying says Canada should “correct its mistakes” and stop acting at the behest of the United States. She says Kovrig and Spavor’s rights are being respected in custody. + +Jan. 9: China’s envoy in Ottawa suggests Canada and its Western allies are white supremacists for calling for the release of two Canadians imprisoned last month by his country’s communist government. Ambassador Lu Shaye makes the accusation in an op-ed in the Hill Times. + +Jan. 15: China expresses its “strong dissatisfaction” with Trudeau over his criticism of Schellenberg’s sentence. Trudeau should “respect the rule of law, respect China’s judicial sovereignty, correct mistakes and stop making irresponsible remarks,” foreign ministry spokeswoman Hua Chunying says. + +Jan. 17: Ambassador Shaye says Canada’s arrest of Meng was an act of “backstabbing” by a friend. Lu warns of “repercussions” if Canada bars the firm from its new 5G network for security reasons, as have three of its intelligence-sharing allies. + +Jan. 22: China demands the U.S. drop a request that Canada extradite Meng. Foreign Ministry spokeswoman Hua Chunying said Meng’s case was out of the ordinary and Canada’s extradition treaty with the U.S. infringed on the “safety and legitimate rights and interests of Chinese citizens.” +Jan. 28: The U.S. Department of Justice formally levels criminal charges against Huawei, two subsidiaries and Meng. The charges, contained in two newly unsealed indictments, allege that Huawei misrepresented its ownership of a Hong Kong-based subsidiary to circumvent American sanctions against Iran. Furthermore, they say Huawei stole telecommunications technology, trade secrets and equipment from U.S. cellphone provider T-Mobile USA. Meng is charged with bank fraud, wire fraud and two counts of conspiracy to commit both. In a statement, Huawei denied committing any of the violations cited in the indictment. + +Jan. 29:China calls on the U.S. to “stop the unreasonable crackdown” on Huawei, saying it will “firmly defend” its companies. + +March 6: A lawyer for Meng tells a judge the United States’ bid for extradition raises serious concerns about the political motivations behind the case as the matter is scheduled to return to court on May 8 to set hearing dates. + + +" +"incident","I00032"," + +Summary: + +Actors: + +* IRA; other Russian state actors; +* Roger Stone, Alex Jones, gamergaters + +Timeframe: Fall 2018 + +Date: September-October 2018 + +Presumed goals: + +* Divide the American public on gender and party lines; Harass and intimidate anti-Trump voices; +* Promote epistemic confusion; +* Seed the narrative terrain for future operations; +* Promote “both sides” relativism; + +Method: + +* Amplify extreme and hyper-partisan rhetoric; +* Promote divisive conspiracy theories; +* Re-up debunked theories in new contexts (e.g. hashtags); +* Re-center debates on emotional, rather than rational, content; +* Alter “ground-truth” resources, such as Wikipedia + +Counters: None / Media exposure + +Related incidents: + +* gamergate; +* 2016 election + +References + +* [Russian trolls and bots are flooding Twitter with Ford-Kavanaugh disinformation](https://qz.com/1409102/russian-trolls-and-bots-are-flooding-twitter-with-ford-kavanaugh-disinformation/) +* [Brett Kavanaugh and the information terrorists trying to reshape America](https://www.wired.com/story/information-terrorists-trying-to-reshape-america/) +* [How the Kavanaugh information war mirrors real warzones](https://www.wired.com/story/how-the-kavanaugh-information-war-mirrors-real-warzones/) +* [How Facebook polarized us during the Kavanaugh hearings](https://www.theverge.com/2018/10/6/17943680/facebook-polarization-kavanaugh-partisan-news-groups) +* [Brett Kavanaugh has huge opposition in the U.S. - but Russian state propaganda loves Donald Trump's nominee](https://www.newsweek.com/brett-kavanaugh-has-huge-opposition-us-russian-state-propaganda-loves-donald-1155046) + +Details + +Last month, the attorney of Christine Blasey Ford, the California professor who has accused Supreme Court nominee Brett Kavanaugh of sexual assault at a long-ago high school party, revealed that Blasey Ford and her family were in hiding and had hired private security after Blasey Ford received death threats over email and social media. Among those cheering on the hate-trollers were many familiar faces from the sewers of the modern far-right disinformation metropolis: dandified Republican rogue (and likely Mueller investigee) Roger Stone, his alt-media protégés Mike Cernovich and Jack Posobiec, anarchist turned Kremlin propaganda employee turned Bernie backer turned Trump backer Cassandra Fairbanks, and breathless Infowars conspiracist-in-chief Alex Jones. And not surprisingly, alt-right super-troll Chuck Johnson had his own connection to players in the scandal. + +This is an operational unit of information terrorists helping to transform the way Americans consume news in the age of Trump—some of the central nodes that give order to the information deluge and around which bot armies and human amplification networks can be organized, wiped out, reconstituted, and armed for attack. + +The attacks on Blasey Ford aimed to discredit and silence her using the same tactics that have been deployed to discredit and silence others over the past few years. As others have come forward to accuse Kavanaugh of wrongdoing—including Deborah Ramirez and Julie Swetnick—they have been similarly harassed and smeared by the same machinery and themes. + +Online Twitter accounts tied to Russia are heavily involved in discussing the Supreme Court nominee and allegations against him online. Hamilton68, a project run by the German Marshall Fund think tank that tracks tweets “tied to Russia-linked influence networks,” listed Kavanaugh, Trump, the FBI, and Ford as the top four topics mentioned by Russia-linked accounts on the evening of Oct.1. + +The Russia-linked accounts are largely lending their support to Kavanaugh, says Jonathon Morgan, CEO of New Knowledge, the company that built the software behind Hamilton68. Morgan, who is currently tracking a set of around 1,000 accounts he believes are tied to Russia, says the Kavanaugh hearings have unleashed more US domestic-focused propaganda from foreign-linked networks than his firm has seen in months. + +Posts about Ford and Kavanaugh are “really cluttered and confused,” with various pieces of clear fabrication from both sides, says Decker. + +The effort to introduce a doppelganger aligned with another key method used in LikeWars around the world: muddying the debate by throwing out alternative theories. Russia has long been the master of this disinformation tactic. After its 2014 shootdown of the MH-17 airliner over Ukraine, for instance, Russia spread over a dozen different theories of what had really happened. Many were contradictory and debunked previous claims. But the goal wasn’t to find the truth—it was to obscure it behind a smokescreen of lies. + +Similarly, the Kavanaugh debate has given rise to false claims and ridiculous photoshopped images, often spread under fake identities. There have been debunked rumors that Kavanaugh had ruled against Ford’s parents in a house foreclosure and that Ford’s brother was part of the Russia investigation. There was even a flurry of unsubstantiated sexual assault charges leveled against Kavanaugh in the hours before the hearing. His supporters were outraged; those opposed to Kavanaugh's nomination speculated that they were placed so that his defenders could point to the media’s unreliability and cast doubt on Ford's credibility. + +The state-funded outlet RT, which was recently obligated to register its U.S. branch under the Foreign Agents Registration Act, trumpeted the news that the White House had found no proof of sexual misconduct by Kavanaugh after reviewing the findings of a time-limited FBI investigation into the allegations. + +The same outlet also called attention to the arrest of several high-profile celebrities, actress and comedian Amy Schumer and model Emily Ratajkowski, who were protesting Kavanaugh’s potential appointment in front of the Supreme Court on Thursday. “Obstruction of Justice?” the outlet asked. + +Pro-Kavanaugh accounts have pushed out false smears aimed at discrediting Ford. One notable anti-Kavanaugh post picked up more than 11,000 retweets while purporting to to cite a Wall Street Journal article that in fact didn’t exist. + +Other accounts are using popular interest in the Ford-Kavanaugh dispute to push unrelated disinformation. A common tactic is to re-up a conspiracy theory or previously debunked story and add tags related to Kavanaugh so the tweet gains more traction. + +Examples include re-circulating debunked sexual assault allegations against Democrats like representative Keith Ellison, senator Cory Booker, and former vice president Joe Biden; or against Republicans like senator Lindsey Graham. “Both sides are coopting matters that may have been killed off and never gained traction, and using the Kavanaugh incident to rehash these different claims,” Decker said. + +Morgan says the Russian bots he’s tracking are largely using this latter method, seemingly with the broad aim of making Kavanaugh seem no worse than Democrats. The approach differs from Russian activity during the 2016 election, where influence campaigns aimed to sow discontent among both liberals and conservatives by pushing propaganda that appealed to both sides. + +This has all taken on a new heady energy as pushback to #MeToo—and riding the coattails of the conspiracy bandwagon. But the intent is the same: to demonize the opponent, define identity, activate the base around emotional rather than rational concepts, and build a narrative that can be used to normalize marginal and radical political views. It is, after all, very convenient to have a narrative positing that all your political opponents are part of a secret cabal of sexual predators, which thus exonerates your side by default. + +Daily Wire’s top story about Kavanaugh confirmation was published Oct. 1 with the headline “Prosecutor Who Questioned Ford Shreds Her Case In Five-Page Memo.” It’s generated more than 205,000 engagements. The site also received just under 180,000 engagements for the story, “Bill Clinton Rape Accuser Juanita Broaddrick Crashes Kavanaugh Hearing, Slams Dems For ‘Biggest Double Standard.’” + +Occupy Democrats’ top story about Kavanaugh-Ford is headlined “Matt Damon just DESTROYED Kavanaugh and Senate Republicans in hilarious SNL cold open.” It had just under 70,000 engagements. Another story about the Kavanaugh confirmation, “Bernie Sanders just demanded the FBI investigate five lies Kavanaugh told at his hearing,” generated over 44,000 engagements. + +This is the ideological landscape that has been so swiftly leveraged in the defense of Brett Kavanaugh. + +The cadre and their followers knew exactly what to do when the allegations made against Kavanaugh by Christine Blasey Ford became public. They did not disappoint. Rapid efforts by far-right blogs and personalities to dox and troll Blasey Ford resulted in the targeting of the wrong Christine Blasey Ford; Posobiec was one of those reportedly amping this misguided doxxing. Cernovich said Blasey Ford was a ""far left wing activist"" who had been ""scrubbing"" her social media profile, so her accusations were ""activism."" Alex Jones made a joke of the whole thing, with Infowars saying Blasey Ford is a ""leftist"" whose accusations were a ""political ploy."" Fairbanks: ""She can't prove it… Her clothes were on… Fuck that lady."" That's a particularly strong comment from a one-time anti-rape activist. Stone: ""This is a woman looking for her Anita Hill moment."" + +This is the information that flowed through the architecture the Stone cadre popularized and mainstreamed over the past few years, moving it from the fringe to a central pillar of the conservative agenda, cartoonifying legitimate issues of conservative concern and recruiting new supporters as they went. The narrative was set long ago—allegations are false, men (especially white men) are oppressed, the people who stand against you are corrupt perverts worthy of demonization, and everything that is the America you know will fall apart if you don't fight for some notion of the way things were and should be again. And the best way to achieve this, since the system will fight back, is viciousness. + +This architecture is established, and permanently in transmit mode. + +Consider the now-infamous and disavowed (but archived here) Ed Whelan twitter thread, an odd diversionary narrative hyped as an alternate theory of the night Blasey Ford describes. Its gist: mistaken identity of the perpetrator. Potential defamation issues aside, it seemed to build on the groundwork being laid by Senate Republicans and the White House to carefully insinuate that Blasey Ford wasn't lying, merely mistaken about who attacked her. But Whelan transformed it into a bonkers Twitterverse conspiracy theory about the bedroom at the top of the stairs. + +An analysis of the accounts that retweeted Whelan's teaser for his conspiracy most frequently post content from right and far-right media, several of which are anchors in the far-right disinformation ecosphere (and Russian disinformation, to boot). + +Posted for less than 24 hours, Whelan's mistaken-identity theory sparked a wave of blog posts and discussions on far-right sites that live on even after Whelan backed off. This post, for example, repeats Whelan's claims and suggests they all but vindicate Kavanaugh. It was a top-trending piece on disinformation trackers and was still being circulated on Twitter days after the source was deleted. And so was this one, this one, and this one. Some 1.5 million ""Fox and Friends"" viewers heard all about the mistaken-identity theory live on TV. Once it's out there, you can't pull it back. + +The narratives to defend Kavanaugh were mostly about discrediting Blasey Ford: that she was part of a secret CIA mind-control project (the CIA connection was also alluded to by Kremlin disinformation purveyors); that George Soros was behind her allegations; that her lawyer was linked to Hillary Clinton; that she was motivated by profit; that she did this as revenge for a foreclosure case where Kavanaugh's mother, also a judge, ruled against Blasey Ford's parents (only, she didn't—she ruled in their favor); that she had also made false allegations against Neil Gorsuch; and many more. + +In the course of his angry self-defense, Kavanaugh stamped a lot of bingo squares: attempted rape allegations as a political tool, false allegations, Clinton, secret conspiracies. By going out and taking the big swing, he elicited a powerful emotional response in his defense—an activated response from a hardened base. #ConfirmKavanaugh was trending—with support of far-right and Russian-linked accounts—after the hearing. + +Not even history itself is safe—at least the online version of it, which we increasingly depend on. When Kavanaugh testified that Devil's Triangle, as mentioned on his high school yearbook page, was a drinking game, there was no online evidence to back up his claim. (Other sources asserted it was a known sexual term.) So an anonymous person immediately updated Wikipedia to support Kavanaugh's definition. It was a near perfect parallel to how Russian operatives repeatedly edited the Wikipedia entry for “MH17” in the hours after the airliner was shot down to try to provide an alternative history. + +Examples + +" +"incident","I00063"," + +Actor: Russia + +Timeframe: July 18, 2016 - ongoing + +Date: July 18, 2016 + +Presumed goals: + +* Sports ie the Olympics is another platform to project power, and bans on Russian athletes, the stripping of medals is serious business. Deflect from negative West perspective as state-run cheats/crooks; World/West plot against us; Proclaim Russian innocence & image to domestic audience; + +Method: + +* Some Russians described the allegations as an anti-Russian plot while others stated that Russia was ""just doing what the rest of the world does"" Just like MH17 and Skripal, Russia gets caught and goes into 4-D mode… ie: the above comment - dismiss/”what-aboutism” +* Deny - Russian President Vladimir Putin said that Russia had ""never supported any violations in sport, we have never supported it at the state level, and we will never support this"" and that the allegations were part of an ""anti-Russia policy"" by the West. +* Dismiss - Russian Minister of Foreign Affairs, Sergey Lavrov, commented that the United States ""fears honest competition"", affirming Vladimir Putin's position that the United States used its influence within the IOC to ""orchestrate the doping scandal"" +* Many Russians believed that the IOC was retaliating against Russia for their discriminatory anti-gay law which provoked considerable controversy with the IOC during the 2014 Winter Olympics. Russian MP Dmitry Svishchev, who is also the head of Russia's Curling Federation, was quoted by Ria Novosti news agency as saying: ""This is what we expected. There's nothing new, only empty allegations against all of us. If you are Russian, you'll get accused of every single sin."" Aleksei Pushkov, chairman of Russia's parliamentary foreign affairs committee, said that the IAAF's decision to uphold its ban was ""an act of political revenge against Russia for its independent foreign policy."" A member of Russia's parliament, Vadim Dengin, stated, ""The entire doping scandal is a pure falsification, invented to discredit and humiliate Russia +Talking points as above are futher amplifed/spun via Russian media, and public apologists; while this happened prior to 2016 US Elections, suggesting the IRA along with trolls & bots operating in the social space (Twitter, FB, YouTube, Reddit) could be deemed naive. + +Counters: + +Related incidents: + +* Prelude to 2016 +* the end of the 2014 Sochi Olympics where Russian athletes dominate (in combination with Euromaiden “crisis”) “emboldens” Putin/Russia to make move on Ukraine invasion. +* Russians allegedly tried to hack the World Anti-Doping Agency (WADA)... The Justice Department filed criminal charges against seven members of the GRU, Russia's main military intelligence unit, accusing them of hacking into the U.S. Anti-Doping Agency in Colorado Springs, Colorado, as well as four international sports governing bodies. A grand jury indictment said the operation was in retaliation for the exposure of Russia's state-sponsored athlete doping program that resulted in a ban from the 2016 summer Olympics in Brazil. + +References: + +* https://www.nbcnews.com/news/world/international-olympic-committee-bars-russia-2018-winter-games-over-doping-n826671 + +* https://www.nytimes.com/2016/05/13/sports/russia-doping-sochi-olympics-2014.html?module=inline +* https://www.bbc.com/sport/38261608 +* https://en.wikipedia.org/wiki/Doping_in_Russia +* https://www.theguardian.com/technology/2016/aug/22/russian-hackers-world-anti-doping-agency-dnc-hack-fancy-bear +* https://www.dw.com/en/two-russians-probed-for-hacking-anti-doping-agency-wada/a-45502397 +* https://www.nytimes.com/2018/01/10/sports/olympics/russian-hackers-emails-doping.html +* https://qz.com/1413474/all-of-the-victims-named-in-the-latest-russian-hacking-scandal/ +* https://www.nbcnews.com/news/us-news/7-russians-indicted-hacking-related-olympic-doping-scandal-nerve-agent-n916656 + + +" +"incident","I00006"," + +Actor: probably IRA (source: recordedfuture) + +Timeframe: 1 day + +Date: Sept 11 2014 + +Presumed goals: test deployment + +Method: +* Artefacts: text messages, images, video +* Create messages. e.g. “A powerful explosion heard from miles away happened at a chemical plant in Centerville, Louisiana #ColumbianChemicals” +* Post messages from fake twitter accounts; include handles of local and global influencers (journalists, media, politicians, e.g. @senjeffmerkley) +* Amplify, by repeating messages on twitter via fake twitter accounts +* Not seen: interaction, refutation etc. +* TL;DR: early attempts to create fake incidents had limited traction. + +Counters: + +* None seen. Fake stories were debunked very quickly. + +Related incidents: + +* BP oil spill tsunami +* #PhosphorusDisaster - fake story about water contamination scare +* #EbolaInAtlanta - fake story about Ebola outbreak in Atlanta +* #shockingmurderinatlanta - fake story about unarmed black woman killed by police in Atlanta + +These were all well-produced fake news stories, promoted on Twitter to influencers through a single dominant hashtag (the single hashtag might have been something learned from crisismapping practice of forcing a single hashtag for each disaster because it was easier to track) + +References: + +* [RecordedFuture trace of attack]() + +* https://en.wikipedia.org/wiki/Columbian_Chemicals_Plant_explosion_hoax +* https://www.recordedfuture.com/columbianchemicals-hoax-analysis/ +* https://www.nytimes.com/2015/06/07/magazine/the-agency.html?_r=0 +* https://twitter.com/hashtag/PhosphorusDisaster?src=hash + + +" +"incident","I00047"," + +Actor: Russia + +Timeframe: November 25, 2018 - ongoing + +Date: November 25, 2018 + +Presumed goals: + +* Russian media,quoted authorities who accused Kyiv of seeking to “create a conflict situation.” +“The same Moscow spokespeople who assured us in 2014 that the little green men who seized Crimea were not Russian soldiers—until Vladimir Putin himself spilled the beans weeks later—are now telling the world that volatile maneuvers of Ukrainian ships led to the collision November 25. +* Russian FSB security service blamed Ukraine for sparking the clashes, saying their ""irrefutable"" evidence would ""soon be made public"". Foreign Minister Sergey Lavrov said on the next day that Ukraine had violated international legal norms by failing to obtain authorisation for its vessels. Deputy Chairman of the State Duma Pyotr Tolstoy warned of the danger of a war. +* The goal of this campaign is to create confusion, to portray Ukraine as the culprit for both the Kerch Strait incident and the deteriorating security situation in the region, and to exonerate Russia of any responsibility. + +Method: + +* (Distort) Kremlin-controlled RT cited Russian Minister of Foreign Affairs Sergei Lavrov suggesting that Ukraine deliberately provoked Russia in hopes of gaining additional support from the United States and Europe. +distracting the audience from the main issue – Russia shooting at Ukrainian boats and capturing the vessels and crews. Instead they target the president of Ukraine, Petro Poroshenko: “Washington incited Poroshenko to launch this “sea provocation” against Russia in order to “thwart the Putin -Trump meeting”” and “President of Ukraine Petro Poroshenko uses the Kerch provocation for a coup d’état“. But in reality, the Ukrainian Parliament adopted a resolution scheduling the presidential elections for 31 March 2019. +Dismissing the critic has also found its place under the sun of Kremlin info-war. Claims were spread that the Russian ships have moved so far ahead “in their technological development” that they “do not use ramming as a tactic“. + +* Attempts to pollute the German Twitter: Russian disinformation does not only rely on its own resources to spread its narratives about Ukraine. Twitter has been used so heavily that Russia Today and Sputnik are scoring more engagement than some of the German quality media combined. Between Sunday and Tuesday, more than 10,000 German-language Tweets from 3,000 unique accounts mentioned Ukraine, almost all of them relating to the confrontation in the Sea of Azov. Despite the large overall number of tweeters, a small group of 30 accounts has been driving a significant share of the debate so far. + +* Dmitry Peskov described Ukrainian navy’s actions as “an invasion of foreign military ships into Russia’s territorial waters.” Belittling Ukraine’s navy; Ridiculing and dehumanising Ukrainians - This ridiculing of Ukraine’s navy echoes other cases when disinformation has been used to show Ukraine as weak and dependent. + +Counters: + +Related incidents: + +* This is not the first time the Kremlin has used the four-D tactics. +* @DFRLab has documented the Kremlin’s use of the 4Ds of disinformation to deny its involvement in the downing of the Malaysian Airlines flight MH17 over Ukraine, the Skripal poisoning, and the interference in the U.S. Presidential elections in 2016. + +References: + +* https://euvsdisinfo.eu/report/washington-incited-poroshenko-to-launch-a-sea-provocation-to-thwart-the-putin-trump-meeting/ +* https://euvsdisinfo.eu/report/kerch-confrontation-part-of-poroshenkos-plan-to-postpone-the-ukrainian-elections/ +* https://euvsdisinfo.eu/report/russia-does-not-shirk-international-law/ +* https://meduza.io/en/feature/2018/11/26/how-russia-captured-three-ukrainian-ships-in-the-black-sea +* https://medium.com/dfrlab/uk-poisoning-russia-recycles-responses-77e1d357b777 +* https://medium.com/dfrlab/propaganda-pushed-around-indictment-f63b85ac0587 +* https://www.dw.com/en/the-scars-of-ukraines-war-in-mariupol/a-19430738 +* https://www.dw.com/en/crimea-applies-for-annexation-by-moscow-after-secession-referendum-wins-968-approval/a-17500659 + +* https://euvsdisinfo.eu/wave-of-disinformation-from-the-azov-sea/ +* https://medium.com/dfrlab/minskmonitor-disinformation-tactics-extend-to-kerch-c32351c7c293 +* https://www.bellingcat.com/news/uk-and-europe/2018/11/30/investigating-the-kerch-strait-incident/ +* https://www.justsecurity.org/61835/rogue-kremlin-push-international-law/ +* https://www.stopfake.org/en/denigrating-ukraine-with-disinformation/ + +* https://www.dw.com/en/what-you-need-to-know-about-the-conflict-in-the-sea-of-azov/a-46461361 +* https://www.atlanticcouncil.org/blogs/new-atlanticist/russia-ukraine-feud-heats-up-the-sea-of-azov +* https://en.wikipedia.org/wiki/Kerch_Strait_incident + + +Datasets: + +Notes: + +Given anything related to the ukraine is a key testing ground/flashpoint for Russia narrative manipultion & anti-democracy disinformation, the incident and geographic chokepoint will be an ongoing issue. + +The Kerch Strait is the only connection between the Black Sea and the Sea of Azov, and the only way to reach two important Ukrainian ports, Mariupol and Berdiansk. The route is vital for Mariupol's two large metallurgical plants. Russia has controlled the strait since annexing Crimea in 2014, which has made traffic significantly more difficult for Ukrainian ships. The consequences of Russian control have become particularly noticeable since the completion of the Crimean Bridge in May 2018. The bridge connects the Russian mainland with the occupied peninsula. The FSB inspects all ships bound for Ukraine, sometimes taking days, which has aggravated the situation. The volume of freight has steadily declined since then. The war in Ukraine's Donbass region is also problematic for Ukraine's ports. + +this most recent escalation in the Kerch Strait is aggravating the already existing conflict between Ukraine and Russia that began after the annexation of Crimea in 2014. + +On the evening of 28 November, Ukrainian Infrastructure Minister Volodymyr Omelyan said that vessels bound for the ports of Berdyansk and Mariupol awaited entrance to the Sea of Azov and vessels were also waiting to go southbound. He characterised this as a virtual blockade. No vessels were identified as Ukrainian. On 4 December Omelyan stated that Russia did let ships reach Berdyansk and Mariupol again. The same day the Ukrainian Ministry of Temporarily Occupied Territories and IDPs claimed that the accumulation of ships waiting to go to the Ukrainian ports had led to several accidents. Russia denied it ever blocked vessels from sailing to Ukrainian ports and asserted that any possible disruptions were due to bad weather +On 19 January 2019, USS Donald Cook entered the Black Sea, being the second American vessel to arrive in the Black Sea after the Kerch Strait incident after USS Fort McHenry entered in 10 January 2019 +In March 2019, Canada, the United States and the EU imposed sanctions on Russian citizens and companies for their participation in the incident and activities in Crimea and separatist-controlled eastern Ukraine + +" +"incident","I00022"," + +Actor: + +* 4chan user with Latvian IP address, +* pro-Trump Twitter accounts + +Timeframe: a few days + +Date: Two days before the second round of French 2017 election (May 5, 2017) + +Presumed goals: sabotaging Macron campaign in the last stage of the election. + +Method: + +* Hashtag campaign: #MacronLeaks with use of bots. +* Hashtags initially launched in the US, then got publicized by alt-right influencer, Le Pen’s supporters, Wikileaks. + +Counters: + +* French agencies that monitor cybersecurity, electoral integrity. +* Technical precautions: ending e-voting. +* Facebook removed 70,000 suspicious accounts in France 10 days before the vote. +* Campaign staff responding to social media posts and comments. +* Technically, placing traps along the way, using fake passwords, email addresses, documents to trap hackers. +* Stop offering press credentials to propaganda outlets. +* Use encrypted apps for confidential communication. +* Requesting the media not to report false information. + +Related incidents: + +References: + +* https://www.niemanlab.org/2018/09/how-france-beat-back-information-manipulation-and-how-other-democracies-might-do-the-same/ +* https://www.buzzfeednews.com/article/ryanhatesthis/heres-how-far-right-trolls-are-spreading-hoaxes-about +* https://medium.com/dfrlab/hashtag-campaign-macronleaks-4a3fb870c4e8 +" +"incident","I00033"," + +Actor: China + +Timeframe: 2011 + +Date: + +Presumed goals: + +* Commentators’ duty to guide public opinion in a “constructive” way and engage the internet as “an important battlefield of ideology.” The vice minister of public security said that the police should use microblogs as a communication platform to “release correct information and dispel misunderstandings.” +* Accounts describing the operations of progovernment commentators that have emerged in recent years indicate that they are also involved in identifying and recommending content for deletion. Other testimonies highlight the fact that the posts do not only praise or support the CCP and government policy, but also target government critics with negative remarks. Other forms of misdirection involve deliberate attempts to muddy the facts of a particular incident—for example, a false eyewitness can contradict the account of a netizen reporting a case of police abuse. +* The Chinese government has long been suspected of hiring as many as 2,000,000 people to surreptitiously insert huge numbers of pseudonymous and other deceptive writings into the stream of real social media posts, as if they were the genuine opinions of ordinary people. Many academics, and most journalists and activists, claim that these so-called “50c party” posts vociferously argue for the government’s side in political and policy debates. + +Method: + +* Astroturfing: “surreptitiously post large numbers of fabricated social media comments, as if they were the genuine opinions of ordinary Chinese people"" +* Cow online opinion leaders into submission +* Bombard Taiwan social media (Facebook, twitter, chat groups) with ani-DPP, anti-Tsai content. + +Counters: + +Related incidents: + +Notes: + +(Recorded Future) The term “Great Firewall” was coined in a June 1997 Wired magazine article in which an anonymous Communist Party official stated that the firewall was “designed to keep Chinese cyberspace free of pollutants of all sorts, by the simple means of requiring ISPs [internet service providers] to block access to ‘problem’ sites abroad.” + +Our research focused on the English-language social media activity of six major state-run propaganda organizations from October 1, 2018 through January 21, 2019, which included over 40,000 posts. We selected these six organizations — Xinhua, People’s Daily, China Global Television (CGTN), China Central Television (CCTV), China Plus News, and the Global Times — because they: Are highly digitized; Possess accounts on multiple English language social media platforms; Are associated with Chinese intelligence agencies and/or English language propaganda systems + +Because our intent was to map out Chinese state-run influence campaigns targeting the American public, we evaluated only English language posts and comments, as the posts in Chinese were unlikely to affect most Americans. Further, our research focused on answering two fundamental questions about Chinese influence operations: Does China employ the same influence tactics in the English-language social media space as it does domestically? How do Chinese state-run influence operations differ from Russian ones? In what ways are they similar and different, and why? + +The information-control regime in China has evolved to include a dizzying array of techniques, technologies, and resources: Blocking traffic via IP address and domain; Mobile application bans; Protocol blocking, specifically Virtual Private Network protocols and applications; Filtering and blocking keywords in domains (URL filtering); Resetting TCP connections; Packet filtering; Distributed denial-of-service (DDoS) attacks (the so-called Great Cannon); Man-in-the-middle (MiTM) attacks; Search engine keyword filtering; Government-paid social media commenters and astroturfers; Social media account blocking, topic filtering, content censorship; State-run media monopoly and censorship; Social Credit System; Mandatory real-name account registration; + +This tool set, combined with the now-ubiquitous mass physical surveillance systems, place China at the forefront of integrating information technology, influence operations, surveillance, and censorship in a model referred to by two scholars from MERICS as “IT-based authoritarianism.” + +In addition to the constraints imposed by the Great Firewall and content censorship, the Chinese state also employs a series of active disinformation and distortion measures to influence domestic social media users. One of the most widely studied has been the so-called “50 Cent Party.” The 50 Cent Party is a group of people hired by the Chinese government to “surreptitiously post large numbers of fabricated social media comments, as if they were the genuine opinions of ordinary Chinese people.” The name is derivative of a rumor that these fake commentators were paid 50 Chinese cents per comment (this has been largely disproven). This fabrication of social media comments and sentiment is largely known by the term “astroturfing.” Among scholars of the Chinese domestic social media environment, there is much disagreement regarding what the goals or objectives of government-paid astroturfers are. One study by professors at Harvard, Stanford, and UC San Diego, published in April 2017, determined that one in every 178 social media posts are fabricated by the government and that comments and campaigns are focused and directed against specific topics or issues. Additionally, these scholars have assessed that domestic social media influence operations focus primarily on “cheerleading” or presenting or furthering a positive narrative about the Chinese state. Conversely, a separate set of scholars at the University of Michigan, who also examined posts from the 50 Cent Party astroturfers, determined that at least one in every six posts on Chinese domestic social media was fabricated by the government. Further, these scholars argued that less than 40 percent of astroturfed comments could be classified as “cheerleading” and that the rest were a combination of vitriol, racism, insults, and rage against events or individuals. They additionally argue that censors and state-sponsored influence campaigns focus much of their resources on “opinion leaders” and users with large numbers of followers as opposed to simply intervening based on content. + + Chinese government has used a combination of muscle and guile to cow online opinion leaders into submission, muzzling social media as a political force, and leaching public dialogue of much of its independence. But beneath the peppy, pablum-filled surface that has resulted, Chinese social media remains a contested space. + +(Taiwan election) Tsai futilely urged Taiwanese citizens to see Beijing’s effort for what it was — a Russian-style influence campaign. The island’s 23 million citizens were bombarded with anti-Tsai and anti-DPP content through Facebook, Twitter and online chat groups, promoted by China’s “50-cent army” of paid social media trolls. There are also dozens of investigations into allegations that Chinese money went to fund Taiwanese candidates opposing Tsai and the DPP. +After the elections, Chinese state media pointed to Tsai’s losses as evidence that her tough stance vis-à-vis China was unpopular and wrongheaded. Beijing’s overall goal is to replace her with a more malleable leader in Taipei as part of its broad effort to exert control over Taiwan and weaken Taipei’s relationships with the international community. +The Chinese government is bribing or coercing foreign governments to break diplomatic relations with Taiwan, pressuring them to evict Taiwan from international organizations. Beijing is also threatening foreign companies unless they literally erase Taiwan from their websites. Their ultimate goal is to dissolve the U.S.-Taiwan partnership and subjugate the island to the People’s Republic of China (PRC). + +There are numerous agencies sponsoring internet commentators, including local propaganda offices, ministries and even schools and state-owned enterprises. For instance, China’s largest oil and gasoline producer, Sinopec, was found to be running an astroturfing campaign justifying rising gasoline prices in 2011 (Wang 2011). +The following excerpt from a recruiting flyer from the Propaganda Department of the Zhengding Party Committee, Hebei, provides an example of what online commentators are expected to do (Zhonggong Zhengding Xianwei Xuanchuanbu 2009): +compose original postings and carry out positive publicity online to promote the priorities and major deployments of the party committee and the government; +release authoritative information on major incidents to hinder the spread of rumours and ensure correct direction of online opinion; +answer questions and clarify confusion for netizens on hotbutton incidents, interpret the policies of and measures taken by the party and the government and divert netizens’ emotions; +strengthen information management on the internet and tightly integrate the analysis of online opinion, disposing of harmful information and guiding online opinion. + +These instructions show that besides monitoring public opinion, the primary mission for online commentators is to facilitate state propaganda and defuse crises. In online propaganda campaigns, commentators work to attract public attention and fabricate an audience, if necessary. + + “American Cent Party” (美分党) who express western democratic values and criticize the Chinese communist regime online, and the “internet water army” (网络水军), which refers to for-hire astroturfers working for and advancing the interests of companies and other actors willing to pay their fees. +Prominent dissident Ai Weiwei said “If you oppose the US and Japan [online], you are a member of the 50 cents army” (Strafella and Berg, 2015). 50c party members “combat hostile energy,” defined as posts that “go against socialist core values,” or “are not amenable to the unity of the people.” Such information should be “resolutely resisted, proactively refuted, and eagerly reported to Internet authorities.” 4 (Haley, 2010). Through active engagement of opposition views, they try to “sway public opinion” (Editors, 2016; Jason Ng, 2011), “influence public opinion. . . pretending to be ordinary citizens and defending or promoting the government’s point of view” (O. Lam, 2013), or “steer conversations in the right direction” (Editors, 2013). Estimates by journalists of the size of the 50c party is between 500,000 to 2 million (Philipp, 2015). + +References: + +* https://www.wired.com/1997/06/china-3/ +* https://en.greatfire.org/analyzer +* https://www.nytimes.com/2017/01/04/business/media/new-york-times-apps-apple-china.html +* https://techcrunch.com/2017/07/29/apple-removes-vpn-apps-from-the-app-store-in-china/ +* https://pdfs.semanticscholar.org/9fc1/d1815a678583c1e73233bb93aaaab7d0fd4f.pdf +* https://www.cl.cam.ac.uk/~rnc1/ignoring.pdf +* https://citizenlab.ca/2015/04/chinas-great-cannon/ +* https://drive.google.com/file/d/1xjHWI0Ih3abONxL0WoXj2swlcBuiRCXO/view +* https://papers.ssrn.com/sol3/Papers.cfm?abstract_id=2738325 +* http://www.spiegel.de/international/world/china-s-xinjiang-province-a-surveillance-state-unlike-any-the-world-has-ever-seen-a-1220174.html +* https://www.merics.org/sites/default/files/2018-07/MPOC_ChinasCoreExecutive_web.pdf +* https://www.freedomhouse.org/template.cfm?page=691&cmb=34#Vice +* http://cmp.hku.hk/2011/05/09/12125 +* http://chinadigitaltimes.net/2008/05/chinese-bloggers-on-the-history-and-influence-of-the-fifty-cent-party/ +* http://gking.harvard.edu/files/gking/files/50c.pdf?m=1463587807 +* http://blakeapm.com/ +* https://www.washingtonpost.com/news/monkey-cage/wp/2017/02/21/can-the-chinese-government-really-control-the-internet-we-found-cracks-in-the-great-firewall/ +* https://drive.google.com/file/d/1xjHWI0Ih3abONxL0WoXj2swlcBuiRCXO/view +* https://foreignpolicy.com/2014/01/30/whisper-together/ +* https://www.nytimes.com/2018/11/22/world/asia/taiwan-elections-meddling.html +* http://www.taipeitimes.com/News/front/archives/2018/10/23/2003702864 +* https://www.aljazeera.com/news/2018/11/news-rattles-taiwan-elections-181123005140173.html +* https://www.reuters.com/article/us-taiwan-politics/china-heaps-pressure-on-taiwan-president-after-poll-defeat-idUSKCN1NV02X +* https://www.washingtonpost.com/opinions/global-opinions/trump-is-failing-to-counter-chinas-diplomatic-assault-on-taiwan/2018/09/06/e744f97c-b20c-11e8-9a6a-565d92a3585d_story.html +* https://www.washingtonpost.com/news/josh-rogin/wp/2018/05/05/white-house-calls-chinas-threats-to-airlines-orwellian-nonsense/ +* https://gking.harvard.edu/files/gking/files/how_the_chinese_government_fabricates_social_media_posts_for_strategic_distraction_not_engaged_argument.pdf +* https://www.voanews.com/a/who-is-that-chinese-troll/3540663.html +* https://journals.sub.uni-hamburg.de/giga/jcca/article/viewFile/850/851 +* https://www.scmp.com/culture/books/article/2144692/how-china-censors-its-internet-and-controls-information-great-firewall +* https://freedomhouse.org/blog/china%E2%80%99s-growing-army-paid-internet-commentators +* https://www.recordedfuture.com/china-social-media-operations/ +* https://foreignpolicy.com/2016/05/19/meet-the-chinese-internet-trolls-pumping-488-million-posts-harvard-stanford-ucsd-research/ +* https://www.washingtonpost.com/opinions/2018/12/18/chinas-interference-elections-succeeded-taiwan/ + +" +"incident","I00062"," + +See also I00005." +"incident","I00056"," + +Actor: Iran + +Timeframe: 2012 - ongoing + +Date: Aug 21, 20198 + +Presumed goals: + +* Iran’s meddling in the politics of the Arab states has become more conspicuous since the Arab Spring of 2011. Iran has been trying to widen its influence in the region in its political jousting against Saudi Arabia which is sometimes referred to as “the Arab Cold War”. Although the two regional rivals have never declared war, the two players have been involved in proxy wars in the region including Syria and Yemen. +* Pages promoted or amplified views in line with Iranian government’s international stances. The pages posted content with strong bias for the government in Tehran and against the “West” and regional neighbors, such as Saudi Arabia and Israel.The operation was noteworthy, however, that more than 30 percent of the removed assets were active for five or more years, indicating that Iranian entities have been engaged in social media influence campaigns since as early as 2010 (DFRLab) + + +Method: + +* In August 2018, Facebook removed 652 pages, groups, and accounts on Facebook and Instagram originating from Iran for engaging in a “coordinated inauthentic behaviour”. 15 These operations targeted people in the Middle East, Latin America, the UK, and the US. In October 2018, Facebook announced the removal of another 82 pages, groups, and accounts on Facebook and Instagram. This time the company announced that these accounts and pages targeted people in the US and the UK.16 Some of these accounts masqueraded as American citizens pushing anti-Saudi and anti-Israel narratives. +* In October 2018, Twitter published two data sets comprising 3,841 accounts affiliated with the Internet Research Agency (IRA), and 770 accounts that could be traced back to Iran. These accounts were suspended by Twitter in August 2018 for engaging in coordinated manipulation on the platform. Twitter believes that the information operations linked to Iran are potentially backed by the state +* 70 websites found by Reuters which push Iranian propaganda to 15 countries, in an operation that cybersecurity experts, social media firms and journalists are only starting to uncover. The sites found by Reuters are visited by more than half a million people a month, and have been promoted by social media accounts with more than a million followers… the sites in the campaign have been active at different times since 2012. They look like normal news and media outlets,but only a couple disclose any Iranian ties. +* The social media companies have closed hundreds of accounts that promoted the sites or pushed Iranian messaging. Facebook said last month it had taken down 82 pages, groups and accounts linked to the Iranian campaign; these had gathered more than one million followers in the United States and Britain. But the sites uncovered by Reuters have a much wider scope. They have published in 16 different languages, from Azerbaijani to Urdu, targeting Internet users in less-developed countries. That they reached readers in tightly controlled societies such as Egypt, which has blocked hundreds of news websites since 2017, highlights the campaign’s reach. +* Ten outlets targeting readers in Yemen, where Iran and U.S. ally Saudi Arabia have been fighting a proxy conflict since civil war broke out in 2015; A media outlet offering daily news and satirical cartoons in Sudan. Reuters could not reach any of its staff; A website called Realnie Novosti, or “Real News,” for Russian readers. It offers a downloadable mobile phone app but its operator could not be traced. +* One of IUVM’s most popular users is a site called Sudan Today, which SimilarWeb data shows receives almost 150,000 unique visitors each month. On Facebook, it tells its 57,000 followers that it operates without political bias. Its 18,000 followers on Twitter have included the Italian Embassy in Sudan, and its work has been cited in a report by the Egyptian Electricity Ministry. +The office address registered for Sudan Today in 2016 covers a whole city district in north Khartoum, according to archived website registration details provided by WhoisAPI Inc and DomainTools LLC. The phone number listed in those records does not work. +* We have observed inauthentic social media personas, masquerading as American liberals supportive of U.S. Senator Bernie Sanders, heavily promoting Quds Day, a holiday established by Iran in 1979 to express support for Palestinians and opposition to Israel. (FireEye) +* Broadly speaking, the intent behind this activity appears to be to promote Iranian political interests, including anti-Saudi, anti-Israeli, and pro-Palestinian themes, as well as to promote support for specific U.S. policies favorable to Iran, such as the U.S.-Iran nuclear deal (JCPOA). In the context of the U.S.-focused activity, this also includes significant anti-Trump messaging and the alignment of social media personas with an American liberal identity. However, it is important to note that the activity does not appear to have been specifically designed to influence the 2018 U.S. midterm elections, as it extends well beyond U.S. audiences and U.S. politics. (FireEye) +* All 17 of the pages containing information about manager location had managers from Iran. Canada, Saudi Arabia, and Syria were other common locations of page managers. (DFRLab) +Promoting Shi’a Political and Militant Views +* One of the removed pages — @alalsadrr1 — promoted Moqtada al-Sadr, an influential Shi’a cleric and militia leader from Iraq and leader of the Mahdi Army. According to the Wilson Center, in the mid-2000’s, the Mahdi Army received weapons and training from the Islamic Revolutionary Guard Corps and Lebanese Hezbollah agents. In May 2018, The Atlantic reported that the “controversial” leader and his followers had committed brutal atrocities in Iraq, fought the U.S. military in Sadr City and Basra, and were known for corruption. (DfRLab) +* In January, Facebook took down 783 accounts and pages, which it assessed as “directed from Iran, in some cases repurposing Iranian state media content.” (DFRLab - March 26, 2019) +The operation strongly resembled the earlier IUVM operation. Facebook did not attribute it to IUVM directly, but the latest network used the same techniques and pointed to some of the same websites, making attribution to the same network likely, although not confirmed. +In particular, pages across the network reproduced IUVM content, as well as content from other websites which have featured in earlier exposés and takedowns. +The network functioned by steering users towards ostensibly independent news websites, which amplified Iranian regime propaganda, often copied verbatim from regime assets. The social media content therefore served as a secondary amplifier, rather than a direct audience-engagement tool. +Despite the heterogeneous nature of the assets — they were spread across many countries, languages, and cultures — their messaging was largely homogeneous. It dealt with issues of importance to the Iranian government, supporting Palestinians and Shia Muslims on one hand, and attacking Israel, the United States, Saudi Arabia, and the conduct of the military campaign in Yemen on the other. +The focus on South Asia was noteworthy. Indonesia and India had the most pages targeted at them; African countries also featured prominently. This expands the known area of Iranian influence operations, which have thus far been primarily exposed in the Middle East and in the West. + + +Counters: + +* Facebook and Twitter content take-downs + +Related incidents: + +* See Venezuela: +https://www.bloomberg.com/news/articles/2019-02-01/iran-slams-u-s-over-venezuela-secretly-some-may-be-relieved +https://www.rand.org/blog/2019/02/hezbollah-is-in-venezuela-to-stay.html + + +References: + +* http://www.state.gov/e/eb/tfs/spi/iran/jcpoa/ +* http://www.arabnews.com/node/1329971/middle-east +* https://www.wilsoncenter.org/article/part-2-pro-iran-militias-iraq +* https://www.theatlantic.com/international/archive/2018/05/iraq-moqtada-sadr/559499/ +* https://www.amnesty.org/en/latest/news/2014/10/iraq-evidence-war-crimes-government-backed-shi-militias/ +* http://www.washingtonpost.com/wp-dyn/content/article/2008/04/18/AR2008041803429.html +* https://www.telegraph.co.uk/news/worldnews/middleeast/iraq/1498970/UK-troops-left-isolated-as-Mahdi-Army-weaves-a-web-of-official-corruption.html +* https://medium.com/dfrlab/trolltracker-outward-influence-operation-from-iran-cc4539684c8d +* https://newsroom.fb.com/news/2019/01/removing-cib-iran/ +* https://www.reuters.com/article/us-cyber-iran-specialreport/special-report-how-iran-spreads-disinformation-around-the-world-idUSKCN1NZ1FT +* https://www.rand.org/blog/2018/08/irans-disinformation-campaigns.html +* https://medium.com/dfrlab/takedown-details-of-the-iranian-propaganda-network-d1fad32fdf30 +* https://medium.com/dfrlab/trolltracker-outward-influence-operation-from-iran-cc4539684c8d +* https://comprop.oii.ox.ac.uk/wp-content/uploads/sites/93/2019/04/Iran-Memo.pdf +* https://www.fireeye.com/blog/threat-research/2018/08/suspected-iranian-influence-operation.html + +" +"incident","I00007"," + +Actor: RT/Sputnik + +Timeframe: 2 weeks + +Date: July-August 2016 + +Presumed goals: + +Method: + +Counters: + +Related incidents: + +* Jade Helm exercise +* Black Lives Matter protests +* Bundy Ranch standoff + +Notes: + +Story was that the Incirlik NATO base in Turkey was under attack by terrorists. +2016-08-14 Paul Manafort cited that the Incirlik NATO base in Turkey was under attack by terrorists, as an example of an unreported true story. +“The weekend of July 30, RT.com and Sputnik reported 7,000 armed police with heavy vehicles had surrounded Incirlik air base in Adana, Turkey, where 2,500 U.S. troops are stationed and some 50 U.S. nuclear weapons are stored. The two Kremlin-funded outlets suggested that the lockdown was in response to another coup attempt after a faction of the Turkish military failed to overthrow Turkish President Recep Tayyip Erdoğan.” +“On the evening of 30 July 2016, my colleagues and I watched as RT and Sputnik news simultaneously launched false stories about the U.S. air base in Incirlik, Turkey being overrun by terrorists,” he told the committee. Within minutes pro-Russian social media aggregators and automated bots amplified this false news story,” Watts said. “There were more than 4,000 tweets in the first 75 to 78 minutes after launching this false story. Perhaps the most stunning development for Watt and his companions was that the rapid proliferation of that story was linked back to the active measures accounts (Russian bots) they had tracked for the preceding two years. These previously identified accounts almost simultaneously appearing from different geographic locations and communities amplified the big news story in unison,” Watts said. The hashtags promoted by the bots, according to Watts, were “nuclear, media, Trump and Benghazi. The most common words, he said found in English speaking Twitter user profiles were “God, military Trump, family, country, conservative, Christian, America and constitution. The objective of the messages, Watts said, “clearly sought to convince Americans that U.S. military bases being overrun in a terrorist attack.” + +Data + +* Looked at Twitter for these dates: https://twitter.com/search?l=&q=incirlik%20until%3A2014-08-14&src=typd +https://twitter.com/ElectionLawCtr/status/492850603039522816 + + +References: +* https://www.rt.com/news/354042-turkish-police-incirlik-nato-coup/ +* https://sputniknews.com/middleeast/20160731/1043797161/incirlik-turkey-erdogan-nato-nukes.html +* https://www.politifact.com/truth-o-meter/statements/2016/aug/16/paul-manafort/trump-campaign-chair-misquotes-russian-media-makes/ +* https://wtop.com/j-j-green-national/2017/09/anatomy-russian-attack-first-signs/slide/1/ +" +"incident","I00017"," + +Actor: IRA + +Timeframe: 2 years + +Date: December 2015 - 2017 + +Presumed goals: “Russia’s goals were to undermine public faith in the US democratic process, denigrate Secretary Clinton, and harm her electability and potential presidency” - James Clapper + +Method: + +* Facebook ads promoting minor candidates (Jill Stein) + +References: +* https://medium.com/dfrlab/electionwatch-beyond-russian-impact-2f5777677cc0 +* https://www.thedailybeast.com/exclusive-secret-documents-from-russias-election-trolls-leak + +Notes: + +DailyBeast article gives sizings and method - 80 people on this. If they were working 8-6, that gives us a sizing on how much trolling they could do. + +" +"incident","I00003"," + +Actor: IRA + +Timeframe: + +Date: + +Presumed goals: + +Method: + +Counters: + +Related incidents: + + +References: + +* https://twitter.com/JuliaDavisNews/status/994704834577215495 +* https://twitter.com/donie/status/957246815056908288 +* https://www.theguardian.com/us-news/2018/may/10/russia-facebook-ads-us-elections-congress +" +"incident","I00042"," + +Actor: + +* Saudi Arabia / Qatar /Turkey. +* While the dispute is between these two Kingdoms, it’s with certainty that one can suggest Iran (both projection and the containment of its power/influence in the region) is at the center of it. + +Timeframe: May - September 2017 + +Date: May, 2017 + +Presumed goals: + +* The programmatic/synthetic amplification of respective “positions and/or plights.” +* The respective hashtags can not be categorized as organic in nature, but launched in conjunction with the botnet deployments. As well, none of the identified bot related activity points to an effort to drown out/flood the opponents. + +Method: + +* Twitter campaign; bots/botnets seriously distorted the conversation on Twitter. +* Commercial botnets (these are created en masse and rented out to any user who is willing to pay for retweets, likes, and follow—either for their own account or for somebody else’s. They are thus the easiest and quickest way to obtain artificial amplification) +* On 24 May 2017, for example, pro-Qatar users launched the hashtag or “Qatar is not alone.” +* Supporters of Saudi Arabia also turned to apparently commercial bots to promote their messages. On 21 July, supporters of Qatar launched another hashtag, or “Tamim the Glorious,” in honor of the Emir. In response, supporters ,#تميم_المج ُد of Saudi Arabia used a botnet to attack the hashtag. The attack began when an account called @al_muhairiuae posted a photoshopped image of the Emir designed to make him look foolish. +* Combined with the Korean imagery, this suggests they were a commercial botnet that an unknown user rented to amplify the anti-Qatar tweet and to subvert the pro-Qatar hashtag, which had only just started to trend. +* At least one botnet seemed based in Turkey, joining the fray in mid-September in a bid to support Qatar.” + +Counters: + +* Essentially the was a tit-for-tat campaign with a brief “incursion”/support/spike of activity most likely (but not officially verified) from Turkey in support of Qatar + +* Global Research (Pro-Kremlin publication/organization located in Montreal, QC) contributed anti-Saudi spin via their blog. Global Research (anti-Saudi… campaign); Global Research (more) + +Related incidents: + +* Jamal Khashoggi incident will bear hallmarks of the incident, but moves beyond a regional information operation into one of global significance. In 2018 the NY Times investigates Saudi Arabia’s Troll Army + +References: + +* https://www.globalresearch.ca/saudi-arabias-march-towards-civil-war/5616699 +* https://www.globalresearch.ca/the-machiavellian-plot-to-provoke-saudi-arabia-and-qatar-into-a-blood-border-war/5593870 +* https://www.nytimes.com/2018/10/20/us/politics/saudi-image-campaign-twitter.html +* https://jia.sipa.columbia.edu/robot-wars-how-bots-joined-battle-gulf +* https://www.washingtonpost.com/news/monkey-cage/wp/2017/06/07/hacking-bots-and-information-wars-in-the-qatar-spat/ +* https://www.independent.co.uk/news/world/middle-east/russian-hackers-qatar-fake-news-gulf-diplomatic-row-fbi-doha-saudi-arabia-bahrain-uae-egypt-a7776446.html +* https://qz.com/1107023/the-inside-story-of-the-hack-that-nearly-started-another-middle-east-war/ +* https://theconversation.com/the-world-cup-in-digital-and-social-the-viewers-the-tweets-and-the-trolls-99625 + +* https://www.bbc.com/news/blogs-trending-44294826 +* https://jia.sipa.columbia.edu/robot-wars-how-bots-joined-battle-gulf + +Datasets: Mining and analyzing Twitter data is unlikely to “prove” or offer much more insight than Ben Nimmo’s work. + +Notes: + +Given the apparent use of commercial botnets, it’s difficult to attribute much of the activity to state actors, however it is fair to suggest some of this behavior would undoubtedly needed tacit state support… private “patriots” of the state? + +This article https://jia.sipa.columbia.edu/robot-wars-how-bots-joined-battle-gulf highlights the mechanics and dynamics of the bot operations/amplification in some cases to short life span of the activity and assets (quickly deleted from the platform), but doesn’t communicate the underlying political issues that drove these incidents. + +The focus of these Arabic-language hashtags was clearly local and regional rather than international; this was a question of messaging to the domestic population and to Arabic-language rivals, rather than the non-Arabic-speaking world. +Claims of Russian involvement/hack are reported by both the Washington Post and the Independent UK (cites CNN as source). Quartz as well cites the Russian connection, further citing documentation shared with them via Qatar (flimsy at best) and further point blame for the affair at President Trump. + +Post incident - Given Qatar is hosting the 2022 World Cup of Soccer, the World Cup 2018, was a “test” ground for this ongoing online “war” while subtle was evident (Mentionmapp Analytics… John’s research) " +"incident","I00008"," + +Actor: + +Timeframe: + +Date: + +Presumed goals: + +Method: + +Counters: + +Related incidents: + +References: + +* https://www.ceas-serbia.org/images/2018/201803_CEAS_Report.pdf +* https://www.stopfake.org/en/vencislav-the-virgin-hostile-operation-by-vencislav-bujic-seas-foundation-and-its-network-of-collaborators/ +* https://seas.foundation/en/2018/03/15/155 + +" +"incident","I00049"," + +Actor: Russia, Syrian Government and Iran + +Timeframe: April-June + +Date: April 8, 2018 + +Presumed goals: + +* can’t trust anyone who is reporting about it & fit into the “false flag,” commonly used conspiracy trope positing that mass casualty incidents are engineered internally to provide pretext for either government repression or military action + +Method: + +* One novel attack on the White Helmets in the wake of the Douma attacks featured the claim that the group had run a film studio in the besieged city, and used it to stage propaganda videos. This was initially reported by Lebanon-based Al-Aahed News[81] and Iran’s Fars News,[82] each of which attributed it to the other. It was then picked up by Russian state outlets in both Russian[83] and English.[84] As Bellingcat was quick to point out, the images of the studio were actually taken from the Facebook page of a film called Revolution Man.[85] The way in which this demonstrably false claim was amplified on pro-Assad channels reinforces the conclusion that its purpose was to discredit the White Helmets because their reporting was accurate—not because it was false. +* A separate line of argument focused on the Western response to the Douma attack, and the conclusion that the chemical attack had indeed been launched by Assad’s forces. This argument claimed, in essence, that the West’s response was hasty, ill-judged, and went beyond the evidence.[86] +* A third line of attack focused on accusing the West of condoning or staging chemical attacks, including the Douma one, and thus delegitimizing Western outrage. On April 13, the Russian Ministry of Defense said that it had “evidence proving the United Kingdom’s direct involvement in the organization of this provocation in eastern Ghouta,”[91] +* A fourth tactic featured apocalyptic warnings that any Western strike into Syria that harmed Russians could trigger World War III. On April 8, for example, the Russian Foreign Ministry warned of “very grave consequences” of an American strike.[93] + +Counters: + +* Fact checking (Snopes & Bellingcat) + +Related incidents: + +* foundation to Russia ramping up chemical weapon disinformation leading-op to Idlib offensive + +References: + +* https://eeas.europa.eu/headquarters/headquarters-homepage/42657/syria-eu-calls-accountability-after-yet-another-chemical-attack_en +* This is the most detailed article/resource helps lay the background, details, players, tactics http://www.publications.atlanticcouncil.org/breakingghouta/disinformation-2/ +* https://www.washingtonpost.com/news/monkey-cage/wp/2018/09/17/russia-is-gearing-up-to-misinform-the-u-s-public-about-syria-heres-our-cheat-sheet-to-identify-twitter-trolls/?utm_term=.7d3c56b0b03a +* https://euvsdisinfo.eu/report/bbc-admits-that-reason-for-bombing-syria-was-fake/ +* https://www.bellingcat.com/news/mena/2018/12/18/chemical-weapons-and-absurdity-the-disinformation-campaign-against-the-white-helmets/ +* https://www.bellingcat.com/news/mena/2018/08/30/russian-chem-disinfo-idlib/ +* https://www.bellingcat.com/tag/chlorine/ +* https://www.nybooks.com/daily/2018/10/16/why-assad-and-russia-target-the-white-helmets/ +* https://www.snopes.com/news/2018/04/12/disinformation-conspiracy-trolling-syrian-chemical-attack/ +* https://www.snopes.com/fact-check/is-this-proof-white-helmets-staged-chemical-attack/ +* https://www.dw.com/en/russias-syria-chemical-weapons-attack-warning-dubious-experts-say/a-45250441 +* https://euvsdisinfo.eu/report/new-chemical-attack-to-be-staged-by-the-white-helmets-in-idlib/ +* https://www.nytimes.com/2018/04/08/world/middleeast/syria-chemical-attack-ghouta.html + +Datasets: + +Notes: + +For the Syrian opposition, the use of these weapons in high-casualty attacks now brought the possibility of US military intervention. For the Syrian government and Russia, that same possibility brought an urgent need to sow doubt around the veracity of any claims of chemical weapons use—including by claiming that the reports of chemical weapons use were a conspiracy launched by foreign enemies to trigger more strikes. +In parallel, perhaps in an attempt to deflect potential consequences, Russian government sources began claiming that rebel groups and the White Helmets rescue organization, backed by Western powers, were planning “false flag” chemical attacks, designed to kill civilians and point the blame at the Syrian government. Against the background of the 2017 US strikes that followed the Khan Sheikhoun attack, such claims introduced the idea of American complicity in any future attacks, suggesting that such attacks would be a false flag to cover an already-decided US engagement, rather than a consequence of the regime or Russia’s decision to use chemical weapons. This seeded a narrative that could later be passed on to anti-interventionist media outlets and campaigners in the West. +The claim that a given incident was a false flag attack, designed to discredit the Russian government, has regularly been deployed by Kremlin supporters—for example, over the downing of Malaysia Airlines flight MH17 over Ukraine and the poisoning of former Russian spy Sergei Skripal in England, as well as in Syria. Such claims have been repeated and disseminated through a complex ecosystem of blogs and social media posts, largely written in English by self-styled “investigative journalists” with ties to Kremlin-operated media outlets.[18] These provided vital validation to the Syrian/Russian narrative, and played an important role in its dissemination. +The disinformation campaign waged by the Syrian and Russian regimes was large scale, persistent, and supported by a range of Western commentators. In the immediate aftermath of the attack, its impact was limited, and the bulk of mainstream reporting focused on establishing the series of events. According to an online scan of Twitter mentions of the word “Douma” conducted with the Sysomos online service, none of the ten most-retweeted tweets posted on April 7-9 contained pro-Assad content, indicating that the conversation was dominated by other voices.[110] In all, the scan collected some 435,000 tweets. Progressively, however, the mainstream media shifted their focus to other issues, while the supporters of the Syrian and Russian regimes kept their focus on Douma; thus, the overall volume of traffic declined, and the share of the conversation dominated by pro-Assad voices increased. In a similar scan of the period from April 10-16, six of the ten most-retweeted posts came from Assad supporters, out of a total of 487,000 posts.[111] +This analysis also reveals the integration of government-funded media (RT, SputnikNews) and geopolitical think tanks (GlobalResearch) as source content for anti-WH [anti-White Helmet] narratives.”[120] +Pro-Assad and pro-Russian disinformation was further amplified by a group of ostensibly independent news websites that have since been demonstrated to have Iranian links,[121] and which systematically promoted pro-Iranian regime messaging.[122] These sites included IUVMPress.com, an apparent news site that reproduced content from Iranian regime and pro-regime sources, stripped it of its attribution, and passed it onto other sites; institutomanquehue.org, ostensibly a think tank focused on Latin America; and britishleft.com, apparently a site dedicated to left-wing British politics +Commentators such as Beeley, Bartlett, and 21st Century Wire colleague Patrick Henningsen bridged the gap between the “alt-right” movement in the United States and the Russian state communications network, being cited both on sites such as RT, and alt-right hubs such as Infowars. Beeley and Bartlett contribute to both 21st Century Wire[129] and RT;[130] Henningsen formerly wrote for Infowars,[131] writes for 21st Century Wire, and is featured as a contributor on RT’s site.[132] Their contributions helped to spread pro-Assad and pro-Kremlin messaging into US audiences, very much in the manner described by Simonyan, when she spoke of the need for “English-speaking talking heads” to validate the Kremlin’s view. + +On at least one occasion, their messaging broke into the mainstream. On April 13, 2018, rock guitarist Roger Waters told a concert in Barcelona that he thought the White Helmets were a “fake organization that is creating propaganda for jihadists and terrorists”—a very similar misrepresentation to that publicized by the Kremlin disinformation networks.[134 +A video clip of his comments was repeatedly uploaded to YouTube by Kremlin and pro-Kremlin users, including RT UK,[136]Beeley,[137] Hands Off Syria,[138] and Clarity of Signal.[139] Together, these totalled more than 140,000 views by September 19, 2018 + +When incidents such as the Waters amplification are taken into account, the reason that Russia’s General Dvornikov spoke so highly of information operations becomes clear. The combination of state-funded outlets, covert outlets such as IUVMPress, official statements, and supporting bloggers and trolls allowed the pro-Assad narrative to dominate the online conversation for extended periods, especially during times when the credible media outlets were focusing on other issues. +" +"incident","I00039"," + +Actor: + +* Right-wing FB pages +* Fake news sites e.g. yesimright.com; shoebat.com; endingthefed.com; truthfeed.com; yournewswire.com. +* British tabloids: Express, MailOnline. + +Timeframe: Data was collected and analyzed in 2016. + +Date: 2016. + +Presumed goals: +* To attack Merkel’s liberal position on the refugee crisis. + +Method: +* Fake news sites mix legitimate partisan political content with false and conspiratorial information. +* Large right-wing FB pages in the US also share anti-Merkel content. +* Most popular Merkel articles on Facebook also come from legitimate, but negative and right-wing news sources. +* German links that generated most engagement in 2016 spread conspiratorial claims about Merkel’s mental health. + +Counters: +* No counter actions were taken. + +Related incidents: + +* Defamation of Modamani – a Syrian refugee - who took a selfie with Merkel and was accused on social media as having links to terrorism. + +References: + +* Source: Buzzfeed analysis +* https://www.buzzfeed.com/albertonardelli/hyperpartisan-sites-and-facebook-pages-are-publishing-false +* https://www.nytimes.com/2017/02/06/business/syria-refugee-anas-modamani-germany-facebook.html + " +"incident","I00029"," + +Actor: Russia + +Timeframe: July 2014 - still active + +Date: July 17, 2014 + +Presumed goals: + +* Ongoing campaign to discredit/undermine Ukraine & NATO & Democracy + +Method: + +* Multi-pronged media & source driven campaign… ie: +* Russian state sources military, embassy, media (RT, Sputnik, TASS); +* Kremlin’s “witting idiots” ie: 21Wire, Global research; trolls & bots. +* “All” media platforms… ie: Youtube; Twitter; Reddit +* See collection of visual assets + +Counters: + +* Bellingcat; Dutch gov’t, DFRLab + +Related incidents: + +* Anything related to Ukraine +* Donetsk +* Crimea +* Sea of Azov +* Ukrainian election (2019) + +References: + +* [Bellingcat (collection of related investigations)](https://www.bellingcat.com/?s=MH17) +Ie: [“The Kremlin’s Shifting, Self-Contradicting Narratives on MH17”](https://www.bellingcat.com/news/uk-and-europe/2018/01/05/kremlins-shifting-self-contradicting-narratives-mh17/) + +* [DFRLab MH17 4D's ""playbook""](https://medium.com/dfrlab/putinatwar-dismissing-mh17-8268d2968b9) +* [In social networks on the fingers showed how the Kremlin bots work](https://news.online.ua/754036/v-sotssetyah-na-paltsah-pokazali-kak-rabotayut-boty-kremlya-opublikovany-foto/): +“Censoring” the news (Facebook page “takedown”) [Facebook blocked Sergey Parkhomenko for commenting on the report of the downed ""Boeing""](https://www.novayagazeta.ru/news/2015/05/07/112052-facebook-zablokiroval-sergeya-parhomenko-za-kommentariy-doklada-o-sbitom-171-boinge-187%20) +* [The most comprehensive guide ever to MH17 conspiracies](http://euromaidanpress.com/2015/10/14/confuse-and-obfuscate-the-most-comprehensive-guide-ever-to-mh17-conspiracies/) + +* http://tass.com/world/1050324 +* https://www.mirror.co.uk/news/world-news/ukraine-involved-mh17-downing-claims-14184413 +* https://www.bellingcat.com/resources/case-studies/2014/07/17/geolocating-the-missile-launcher-linked-to-the-downing-of-mh17/ +* https://globalnews.ca/news/4993120/russia-rising-part-5-maskirovka/ +* http://euromaidanpress.com/2018/12/06/ukraine-related-narratives-dominate-russian-propaganda/ + +Datasets: none searched for + +Notes: + +Russia still accusing Ukraine (03.25.2019)... TASS and UK Daily Mirror + +First Bellingcat report: Efforts to Geolocate the Launcher 07/17/14 +Countless example of Elliot Higgins & team getting trolled since, popular hashtag is #bellingcrap + +This is a good summary: +“But not only did Russia fiercely deny those accusations, a number of Russian leaders, officials and broadcasters responded by offering dozens of different alternative explanations, “including quite outlandish theories,” says Nilsson. + +“For instance, that an airplane would’ve been loaded with already dead people and that Ukrainian airplanes would then have shot it down to make it look like Russia was shooting down passenger airplanes,” he explains. + +“There were tons of these stories going around, quite a few of them coming from official Russian sources. And they were not meant to be taken seriously. They were simply supposed to occupy the attention span of the world for a while, to the extent that everyone would lose track of the original explanation, which turned out to be quite the right one.” https://globalnews.ca/news/4993120/russia-rising-part-5-maskirovka/ + +Topics of Ukraine-related narratives +http://euromaidanpress.com/2018/12/06/ukraine-related-narratives-dominate-russian-propaganda/ +Back in 2016, StopFake co-founder Yevhen Fedchenko identified 18 major Ukraine-related fake narrative topics spread by Russian propaganda by analyzing 500 debunked disinformation items. +The Euromaidan Revolution as a “coup d’état“ +Ukraine as a “fascist state“ +Ukraine as a “failed state“ +“Russia is not a part of the occupation/war in Ukraine“ +Discrediting the Ukrainian Armed Forces (UAF) +Discrediting the volunteer battalions (which officially became a part of UAF in 2015) +Donbas and Crimean internally displaced persons (IDPs) and refugees +Territorial disintegration of Ukraine +“Territorial claims” for parts of Ukraine from neighboring Poland, Hungary, Romania, and Slovakia +Fake “international legitimization” of annexation and occupation of Crimea +The war in Ukraine “conducted by the US, NATO or Western private contractors” +The West’s “Ukraine fatigue“ +Manipulating international organizations +Fakes about EU-Ukraine relations +“Decay” of the US and West in general, and the “disintegration of the EU” +Flight MH17 crash fakes +The West “uses biological weapons” in Ukraine +Mix-ups of the fake narratives about Ukraine, Syria, ISIS terrorists (e.g., Crimean Tatars being depicted as jihadists or Ukraine as a training ground for terrorists) +For post-Maidan Ukraine, Russian propaganda’s most used narratives were the Euromaidan as “coup d’etat” which brought a “Western-backed junta” (mostly “US-backed”) to power, and “fascism” as the main ideology of the post-Maidan government, Fedchenko notes. + +" +"incident","I00009"," + +Suspected actors: + +* Attacker: IRA or more broadly Russian state-sponsored disinformation campaign. +* Amplifiers: through the persona of “Adam Garrie” (who first appeared on RT (Russian Today) and pro-Russia sites, with no background in Asia and Philippine affairs but suddenly rose to become a global affairs expert). +* Garrie was then promoted by pro-Duterte officials, social media pages and news outlets. + +Timeframe: After Putin and Philippine’s president Duterte met in Russia in May 2017 and forged a partnership in information dissemination. Duterte and Putin signed a number of national security agreements, including a deal on intelligence sharing, an “MOU on Cooperation in Mass Communications.” + +Date: 2017- ongoing + +Presumed goals: + +* To spread pro-Duterte and Russian propaganda through collaborative effort of both Philippine and Russian disinformation actors. + +Method: + +* Footprint of Garrie on the Philippine media scene started from his connection with Russian IRA websites and pages (GI Analytics Facebook page, Russia Insider, The Duran, Geopolitica.ru, Mint Press News, Oriental Review, globalresearch.ca.) + +* RT, one of media outlets that interviewed Garrie, was identified by the US Office of the Director of National Intelligence in January 2017 as the primary source of propaganda that the Russians used to further their interests in the 2016 US elections. + +* Also has appearance on Iran’s IRIB (Islamic Republic of Iran Broadcasting), which was identified by the US Department of the Treasury in 2013 as a network that broadcasts false reports and forced confessions of political detainees and has ties with “politically motivated phishing” accounts on Google. + +* The Daily Sentry, a Philippine news site emerged at the start of 2018 (no ownership information), started citing Adam Garrie as a global expert after Philippine-Russian ties grew stronger. Between Feb 2018 and Jan 2019, The Daily Sentry cited Garrie in 41% of posts on Facebook that mentioned experts. + +* By March 2018, Garrie started to come to the mainstream: The Manila Times – a supporter outlet of the Philippine president, cited by pro-Duterte social media pages. + +* Philippine online groups and pages began to spread Russian propaganda. Some sites link to Duterte officials and supporters including Duterte’s former assistant secretary. For example, Duterte’s former assistant secretary shared content from Trending News Portal site. + +Counters: + +* Facebook took down 220 pages and 73 Philippine accounts for spam, including pages of The Daily Sentry and its affiliates, TNP page and related pages. + +Related incidents: + +References: + +* http://www.interaksyon.com/breaking-news/2017/05/30/75431/ph-russia-communication-offices-to-partner-in-info-dissemination/ +* https://www.rappler.com/nation/188378-ph-russia-sign-bilateral-agreements +* https://www.dni.gov/files/documents/ICA_2017_01.pdf +* +* https://codastory.com/disinformation/how-a-little-known-pro-kremlin-analyst-became-a-philippine-expert-overnight/ +* https://www.rappler.com/technology/social-media/220741-facebook-remove-trending-news-portal-twinmark-media-enterprises +* https://www.rappler.com/thought-leaders/221422-facebook-maria-ressa-rappler-philippines +* https://www.rappler.com/nation/194814-maria-ressa-pcoo-training-china-russia +* http://www.interaksyon.com/breaking-news/2017/05/30/75431/ph-russia-communication-offices-to-partner-in-info-dissemination/ + +" +"incident","I00019"," + +Actor: + +* individual accounts on 4chan (IP addresses indicate locations of Sweden, US, France), +* accounts on Twitter (both identifiable and anonymous). + +Timeframe: a few days + +Date: few hours after Macron and Le Pen were declared winners of the first round of France’s presidential election (April 23, 2017). + +Presumed goals: creating and spreading hoaxes and misinformation related to Macron’s personal life, marriage, sexuality, position on terrorism, etc. to spur support for Le Pen in the second round of voting. + +Method: posts and memes started on 4chan and later shared in Twitter + +Counters: no actions noted. + +Related incidents: + +* #MacronGate and #MacronCacheCash: fake documents on 4chan about Macron’s alleged offshore account. + +References: +* https://www.buzzfeednews.com/article/ryanhatesthis/heres-how-far-right-trolls-are-spreading-hoaxes-about +* https://www.niemanlab.org/2018/09/how-france-beat-back-information-manipulation-and-how-other-democracies-might-do-the-same/ +" +"incident","I00004"," + +Actor: IRA + +Timeframe: 1 day (plus preparation) + +Date: May 2017 + +Presumed goals: reduce Emmanuel Macron’s chance of winning French presidential election + +Method: + +* fake documents posted on 4chan about Macron’s alleged offshore account, +* amplified by pro-Trump Twitter accounts using #MacronGate and #MacronCacheCash + +Counters: + +* preparation (resilience, account removals), +* honeytraps, +* counter-response with humour. + +Related incidents: + +* DNC document release, US presidential elections, 2016 + + +References: + +* Source: https://www.patreon.com/posts/macrongate-tied-11940855 +* http://www.niemanlab.org/2018/09/how-france-beat-back-information-manipulation-and-how-other-democracies-might-do-the-same/ +* https://www.theguardian.com/world/2017/may/08/macron-hackers-linked-to-russian-affiliated-group-behind-us-attack +" +"incident","I00045"," + +Actor: Russia + +Timeframe: March 4, 2018 - ongoing + +Date: March 4, 2018 + +Presumed goals: + +* Russian officials have sought to exploit holes in the complicated narrative of the poisoning to suggest an anti-Russian conspiracy. Mark Galeotti, an expert on the Russian intelligence services, wrote in an op-ed in The Moscow Times… “The Kremlin is enjoying the reputation of being a swashbuckling maverick, ruthless, dangerous and decisive,” he wrote. “This has a certain value, not least in deterring the fainthearted.” +* Reuters: Commentary: For Putin’s Russia, a poisoned spy sends a political message “the poisoning as a sign of just how committed Vladimir Putin’s Kremlin has become to eradicating its enemies – and reminding others it can do so.” + +Method: + +* Multi-source/channel/media response +* highlighting conspiracies: It was a British “false flag” operation; It could be the CIA; Because of Donald Trump; There’s always Ukraine +* The conspiracy theories did not stop here. Multiple special-interest groups have attempted to lay the blame for the Skripals’ poisoning at the door of their chosen enemies. A UKIP branch in High Wycombe, in the English Home Counties, tweeted to accuse “a third party such as the EU” of “trying to interfere in UK Russian relations.” Sputnik even misquoted former Kremlin advisor Alexander Nekrassov as accusing “rouge agents” [sic] of carrying out the attack, “for some sort agenda [sic] such as slander or tarnish Russia [sic] or cause friction between Britain and Russia.” Matteo Salvini, Italian politician and member of the Italian senate, shared an article on his Facebook page, titled “The Skripal Case is a hoax, the war of the West against Russia is terribly true”. His post was liked 3,800 times and generated over 800 shares. +* Here are 20 different narratives offered by Russian media and officials for the poisoning: The United Kingdom did it to fuel anti-Russian sentiment (source: Russia 1 TV channel); Ukraine did it to frame Russia (Russia 1); The United States did it to destabilize the world (Russia 1); Theresa May helped orchestrate the attack because she is a friend of CIA director Gina Haspel (Zvezda); It was an attempted suicide (Russia 1) +It was an accidental overdose (RIA Novosti); It was due to accidental exposure from Britain’s Porton Down research facility (Russia 24 TV channel); The Porton Down lab carried out illicit human testing and is lying about not producing Novichok (RT); Skripal’s future mother-in-law did it (Moskovsky Komsomolets: mk.ru) +Terrorists did it (Russian ministry of foreign affairs spokesperson); American-British financier Bill Browder — blacklisted in Russia for denouncing corruption — did it (Russia 1); A drone did it (Zvezda and Russian defense ministry); Skripal was a chemical weapons smuggler (Pravda); The West is using the case to deflect attention from Russia’s successes in Syria (Russian ministry of foreign affairs spokesperson); Britain is using the case to deflect attention from Brexit (Russian Foreign Minister Sergei Lavrov, Russian UN ambassador, Russian OSCE ambassador); The attack was an attempt by a rival faction to undermine Vladimir Putin (state TV); Russia has destroyed all its stockpiles of Novichok (Sputnik); Russia never developed Novichok (Interfax); Only the Czech Republic, Slovakia, and Sweden have Novichok (Russian ministry of foreign affairs spokesperson). All three countries have denied the claim.; There is no evidence that the nerve agent used against the Skripals was Novichok, Porton Down lab is struggling to identify the substance (RT) + +Counters: + +* Bellingcat; +* DFRLab; + +Related incidents: + +* ties to ongoing campaigns/narrative - Ukraine; NATO; EU; Brexit + +References: + +* https://www.themoscowtimes.com/2019/03/03/a-year-after-the-skripal-poisoning-how-much-has-really-changed-a64677 +* https://www.reuters.com/article/us-apps-poisoning-commentary/commentary-for-putins-russia-a-poisoned-spy-sends-a-political-message-idUSKCN1GK309 +* https://twitter.com/UKIPHighWycombe/status/971773863230164992 +* https://sputniknews.com/analysis/201803141062498438-uk-novichok-nerve-agent-skripal/ +* https://www.facebook.com/salviniofficial/posts/10155663618083155 +* http://www.linkiesta.it/it/article/2018/03/28/il-caso-skripal-e-una-bufala-la-guerra-delloccidente-alla-russia-e-ter/37595/ +* https://www.rt.com/news/452946-skripal-anniversary-truth-novichok/ +* https://disinfoportal.org/sputnik-abkhazias-disinformation-about-porton-down-allegedly-denying-russian-trace-in-skripal-poisoning/ +* https://www.nytimes.com/2019/03/04/world/europe/russia-skripal-poisoning-britain.html + + +* https://www.bellingcat.com/tag/skripal/ +* https://medium.com/dfrlab/skripal-poisoning-if-not-russia-then-1d49f086e3e0 +* https://medium.com/dfrlab/uk-poisoning-russia-recycles-responses-77e1d357b777 +* https://medium.com/dfrlab/putinatwar-social-media-surge-on-skripal-b5132db6f439 +* https://euvsdisinfo.eu/conspiracy-mania-marks-one-year-anniversary-of-the-skripal-poisoning/ +* https://www.nytimes.com/2019/03/04/world/europe/russia-skripal-poisoning-britain.html +* https://www.reuters.com/article/us-britain-russia-skripal/third-suspect-in-skripal-poisoning-is-russian-gru-agent-bellingcat-idUSKCN1Q32BZ +* http://euromaidanpress.com/2018/04/11/five-ways-russia-is-generating-a-conspiracy-smokescreen-around-the-skripal-poisoning/ +* http://euromaidanpress.com/2018/03/30/russian-media-have-published-20-different-narratives-on-skripal-poisoning/ +* https://en.wikipedia.org/wiki/Poisoning_of_Sergei_and_Yulia_Skripal + +Visual assets (Google Drive) + +Datasets: + +Notes: + +On 6 March 2018 Andrey Lugovoy, deputy of Russia's State Duma (the Liberal Democratic Party of Russia) and alleged killer of Alexander Litvinenko, in his interview with the Echo of Moscow said: ""Something constantly happens to Russian citizens who either run away from Russian justice, or for some reason choose for themselves a way of life they call a change of their Motherland. So the more Britain accepts on its territory every good-for-nothing, every scum from all over the world, the more problems they will have."" +Russian Foreign Minister Sergey Lavrov on 9 March rejected Britain's claim of Russia's involvement in Skripal's poisoning and accused the United Kingdom of spreading ""propaganda"". Lavrov said that Russia was ""ready to cooperate"" and demanded access to the samples of the nerve-agent which was used to poison Skripal. The request was rejected by the British government. + +Ongoing… one year later +https://disinfoportal.org/sputnik-abkhazias-disinformation-about-porton-down-allegedly-denying-russian-trace-in-skripal-poisoning/ +On February 7, 2019, Sputnik-Abkhazia released an article headlined “Scotland Yard about the third suspect in the Skripal case: the investigation continues.” According to Sputnik-Abkhazia, the Russian Foreign Ministry caught British Prime Minister Theresa May in a lie, because the Porton Down Laboratory denied that a nerve agent that poisoned Russian ex-spy, Sergei Skripal and his daughter, Yulia had been produced in Russia + +https://www.nytimes.com/2019/03/04/world/europe/russia-skripal-poisoning-britain.html +Rather than ignoring the anniversary, however, Russia punctuated the occasion on Monday with an hourlong news conference at the United Nations and a 52-page report rehashing the episode in detail, amplified by extensive coverage on its English-language government channel, RT. + +Russian officials also have tried to turn the tables, accusing Britain of violating international law by refusing to provide Russian consular officials access to the Skripals, who survived and whose whereabouts has not been made public. + + +" +"incident","I00051"," + +Actor: Russia + +Timeframe: December 2018 - (ongoing) + +Date: December 10, 2018 + +Presumed goals: + +* Russian disinformation intended to confuse audiences and discredit an organisation (Integrity Inititative)which is working independently to tackle the threat of disinformation. Russia’s state-owned media outlets have seized on the posted materials, with the government’s RT and Sputnik news sites writing dozens of stories claiming that the materials prove that the British government, rather than Russia, is trying to poison internet discourse with propaganda. + +Method: + +* Hack (email), leak, amplify, smear MSM + +Counters: none identified + +Related incidents: + +* The campaign also threads other organization into the “conspiracy” such as Britsh Military, NATO and the CIA. +* With it, efforts to further discredit MH17 for instance; tie-in Soro’s (dog-whistle for the far-right); +* yet at the same defend the far-left alleging Integrity Initiative was running a smear campaign again UK Labour/Jeremy Corbyn + +References: +* https://eaworldview.com/2019/01/counter-russia-disinformation-integrity-initiative/ +* https://www.stopfake.org/en/kremlin-watch-briefing-the-eu-has-to-start-taking-pro-kremlin-disinformation-seriously/ +* https://www.buzzfeednews.com/article/kevincollier/russian-hackers-british-institute +* https://www.bbc.com/news/uk-46509956 +* https://www.thetimes.co.uk/article/anti-propaganda-website-forced-offline-by-hacking-b0ds2bkbp +* https://eaworldview.com/2019/01/counter-russia-disinformation-integrity-initiative/ +* https://news.sky.com/story/highly-likely-moscow-hacked-uk-agency-countering-russian-disinformation-11656539 +* http://euromaidanpress.com/2019/01/17/russian-attack-on-the-integrity-initiative-what-makes-the-mafia-different-from-the-police/ + +Datasets: + +Notes: + +RT and Sputnik claim that the Integrity Initiative hack was the work of freelancers aligned with the online Anonymous collective and who were not affiliated with the Russian government. The primary evidence for that, according to RT and Sputnik, is that the stolen Integrity Initiative material was posted to the website of a hacktivist collective called CyberGuerrilla, alongside manifestos claiming “We are Anonymous” and posts saying “We have warned the UK government that it must conduct an honest and transparent investigation into the activity of the Integrity Initiative and the Institute for Statecraft.” + +The Integrity Initiative has pulled down its website, replacing it with a reiteration of its mission, a description of the hack, and a call for tips. +“This international public programme was set up in 2015 to counter disinformation and other forms of malign influence being conducted by states and sub-state actors seeking to interfere in democratic processes and to undermine public confidence in national political institutions,” a spokesperson said in a statement. + + + +" +"incident","I00034"," + +Actor: China + +Timeframe: 72 hours? + +Date: January 20th, 2016 + +Presumed goals: + +* The trolls planned their attack for 7pm, China time, on January 20. Members of Di Ba—one of the largest message boards on the internet—would organize into groups, leap over the Great Firewall to reach Facebook, and flood it with the message that Taiwan is part of China. The anti-independence and pro-China posts started to take over the Facebook page of Tsai Ing-wen, Taiwan’s newly elected president + +Method: + +* Tsai’s latest Facebook post, about a meeting she had with leaders from her Democratic Progressive Party (DPP), attracted nearly 40,000 Facebook comments in just eight hours. +* News of the attack spread far and wide, with a number of posts making their way around social network WeChat. * For most of the day “Di Ba’s Facebook battle” has been at the top of the list of searched terms on Weibo, a Chinese microblog site similar to Twitter. News outlets in Taiwan covered the story (link in Chinese). +* Information also spread suggesting that Di Ba’s battle was organized and well-prepared. Screenshots showed that attackers were separated into six “columns,” in the military sense: information gathering; posting; writing opinions and creating images; translation; miscellaneous Facebook tasks such as liking posts; and a vanguard to head things up. +* The majority of the 26K comments consisted of lines copied and pasted from the officially designated messages +* more than 42,000 people had made comments on a single post of Ms Tsai's Facebook page, demanding her self-ruled island be brought under Chinese control. +* Beginning at 7 pm on January 20, 2016 CST (China Standard Time), tens of thousands of +comments against Taiwan independence appeared in posts of Taiwan President-elect Ms. Tsai Ing-Wen’s Facebook page as well as news media’s such as Sanli News and Apple Daily. While the organizers claim to taking further steps on issues against Taiwan independence, the event lasted for less than two days due to Chinese government’s intervention, leaving tens of thousands of comments either deleted or unattended. +* Within this most active group, every username posted 6 comments at least and 12 comments +on average. The most productive one posted 192 comments during this period. Two interesting +findings come from the discrepant mapping result of Facebook usernames and IDs, which imply +participants’ strategy. First, users might share account. We found five IDs, each of which is +associated with different usernames. According to one internal document downloaded from the +QQ group, some participants would register Facebook accounts in advance, and then give them to those responsible for attack. Since Facebook allows users to change their usernames anytime, we speculate whether this may be due to the sharing of accounts but changing the name to differentiate the identity. +* Second, users shared some usernames to maintain the consistency of their identities. The total +number of IDs is more than the number of unique usernames. Many usernames are shared by +different IDs, which account for 2.82% of all 16,891 IDs. One possible reason for this practice is +that during the attack, reporting and blocking accounts is a prevalent tactic used by both sides as defense. Once the account is “dead”, the user has to register for a new account to keep fighting. One commenter said that he/she was blocked over 3 times, but kept registering new accounts to fight. It is thus not surprising to see a small percentage of users who have more than one ID while maintaining the same username. +* More notable is the case where one username is shared by more than 10 IDs. One possible +explanation is that someone dedicates himself/herself to this event and intends to increase their +visibility. However, for those usernames associated with over 30 IDs, we argue that it might be a +unique strategy for attacking or trolling, because it is difficult to log into multiple accounts and +post comments by a single user. + +Counters: + +Related incidents: + +References: + +* https://www.ideals.illinois.edu/handle/2142/96746 +* https://qz.com/598812/an-army-of-chinese-trolls-has-jumped-the-great-firewall-to-attack-taiwanese-independence-on-facebook/ +* https://www.abc.net.au/news/2016-01-21/chinese-facebook-users-flooding-taiwan-president-elect-account/7105228 +* https://www.businessinsider.com/chinese-people-are-flooding-the-internet-with-a-campaign-against-taiwan-2016-1 + + + +" +"incident","I00010"," + +Actors: IRA, Alex Jones, far right and far left trolls + +Timeframe: Ongoing + +Date: February 2018 + +Presumed goals: Divide the American public on the issues of guns, race, generational politics and activism + +Method: Amplification via sockpuppet and cyborg accounts + +Counters: None / Media exposure + +Related incidents: + +* Sandy Hook hoaxers / Sandy Hook fatalists + +References + +* [How Russian trolls exploited Parkland mass shooting on social media](https://www.politifact.com/truth-o-meter/article/2018/feb/22/how-russian-trolls-exploited-parkland-mass-shootin/) +* [PRO-GUN RUSSIAN BOTS FLOOD TWITTER AFTER PARKLAND SHOOTING](https://www.wired.com/story/pro-gun-russian-bots-flood-twitter-after-parkland-shooting/) +* [Russian trolls flood Twitter after Parkland shooting](https://www.nbcnews.com/tech/social-media/russian-trolls-flood-twitter-after-parkland-shooting-n848471) +* [Russian Trolls Are Tweeting Propaganda After Stoneman Shooting](http://nymag.com/intelligencer/2018/02/russian-trolls-tweet-propaganda-after-florida-shooting.html) + +Details + +Following the Feb. 14 shooting at Marjory Stoneman Douglas High School that left 17 dead, an army of human-controlled and automated accounts spread related content across Twitter. + +Hamilton 68, a website created by Alliance for Securing Democracy, tracks Twitter activity from accounts it has identified as linked to Russian influence campaigns. As of morning, shooting-related terms dominated the site’s trending hashtags and topics, including Parkland, guncontrolnow, Florida, guncontrol, and Nikolas Cruz, the name of the alleged shooter. Popular trending topics among the bot network include shooter, NRA, shooting, Nikolas, Florida, and teacher. + +According to the German Marshall Fund, which tracks Russian-linked Twitter activity, the following are some of the more popular narratives, themes and articles. +The 'crisis actor' conspiracy +'False flag' and other conspiracy hashtags +Meanwhile, some accounts with large bot followings are already spreading misinformation about the shooter's ties to far-left group Antifa, even though the Associated Press reported that he was a member of a local white nationalist group. +One theory associated with these hashtags is that Marjory Stoneman Douglas High School was targeted because the school’s namesake was opposed to ""draining the swamp"" of the Florida Everglades. Under this theory, the Parkland shooting was a cryptic message to Trump, who vowed during his campaign to ""drain the swamp"" in Washington by hollowing out its infrastructure of career politicians, insiders and influence peddlers. +Sowing discord +Experts say the goal of Russian troll propagandists isn't to sway people's opinions in one way or another. Instead, the accounts seek to exploit divisions in order to break down society into smaller, warring groups. Trolls drum up persona accounts on every side of the ideological spectrum and take advantage of high-impact events to spread confusion and disarray. In particular, they're able to take advantage of how Twitter doesn't require users to verify their identity. +Russian accounts boosted erroneous content concerning the motives of the alleged shooter Nikolas Cruz. +According to the German Marshall Fund, one of the top links shared by Russia-linked accounts in the aftermath of the shooting was our 2014 article that largely debunked a statistic cited by pro-gun control group Everytown for Gun Safety. +A survey of tweets using the top hashtags flagged by the Hamilton 68 dashboard showed tweets adamantly in favor of gun control and saying the NRA had taken ""blood money."" Other tweets attacked liberals, the media and lawmakers. +Another top link shared by the network covers the “deranged” Instagram account of the shooter, showing images of him holding guns and knives, wearing army hats, and a screenshot of a Google search of the phrase “Allahu Akbar.” Characterizing shooters as deranged lone wolves with potential terrorist connections is a popular strategy of pro-gun groups because of the implication that new gun laws could not have prevented their actions. +The use of pro-gun control hashtags like #guncontrolnow, along with the spread of anti-gun control links like the Politifact article, appear at first to show the Russian strategy of promoting discord on both sides of a debate. +In other cases, the bots jump on existing hashtags to take control of the conversation and amplify a message. That’s likely what is happening with the Parkland shooting and the hashtag guncontrolnow. +Public awareness that antagonistic bots flood the Twitter debate hasn’t stopped them from achieving their goals of ratcheting up the vitriol—even amid a live tragedy like the Parkland shooting. The goal, after all, isn't to help one side or the other of the gun control debate win. It's to amplify the loudest voices in that fight, deepening the divisions between us. + +Examples + +" +"incident","I00050"," + +Actor: Russia, Cuba, China, Iran + +Timeframe: January 23, 2019 + +Date: January 29, 2019 - ongoing + +Presumed goals: + +* Given the history (going back to the Monroe Doctrine) the US is easily characterized with “imperialist” aspirations. Of course there’s the connected issue of oil and Venezuela’s indebtedness to Russia and China. The relationship between Cuba and Venezuela can not be underscored going back to Castro & Chavez’s relationship. + +* Search (google) #handsofvenezuela the results are largely linking to articles denouncing the US and those countries opposed to the Maduro regime. “There's been a lot of misinformation in the international media about whether what is happening in Venezuela is a brazen US-led power grab or a constitutional …” Jan 13, 2019 - An attempt at an imperialist coup d'état is underway in Venezuela. It must ... Most likely this is another attempt by Washington to spread misinformation and ... socialist and anti-imperialist, is to reject this scandalous imperialist … + +* Activists to Trump: 'Hands Off Venezuela' - Truthdig +https://www.truthdig.com/articles/activists-to-trump-hands-off-venezuela/ +Mar 17, 2019 - medeabenjamin “We are absolutely opposed to economic sanctions in Venezuela” at the #HandsOffVenezuela rally. pic.twitter.com/ ... Packed London meeting says: “US-UK, hands off Venezuela!"" +https://www.marxist.com/packed-london-meeting-says-us-uk-hands-off-venezuela.htm +Jan 31, 2019 - Nearly 100 people packed the #HandsOffVenezuela meeting in London on 30 January, and heard Venezuelan ambassador Rocío Manero, ... + +Method: + +* From efforts via blogs, “news” sites and media supporting the left/socialism/stateism positioning anti-Maduro efforts as “imperialisitic” it’s noteworthy to documented the efforts in February to deliver aid to the country. For instance this case study - analysis demonstrates that the depiction of Russia’s role as “peacekeeper” and “defender” has had a big impact on the networks. We filtered all mentions to include only those containing the words “Russia”, “Moscow” or “Putin” in reference to Venezuela. This resulted in a total number of 60,315 tweets for the period. A few peaks can be noticed at times when Russian sources, mainly RT and Sputnik, forward Venezuela-related news. +A: Russia expresses an adamant position that Maduro is the legitimate president of Venezuela +B: Russia will defend the Venezuelan Constitution +C: The US is massing troops at the Venezuelan border +E: Russia is sending humanitarian aid to Venezuela +* The Trojan Horse. The most striking success of the Russian disinformation campaign is the impact of the Trojan Horse Narrative. The first case of describing US and EU humanitarian aid to Venezuela as a Trojan horse, in Spanish Caballo de Troya, appeared in Spanish language networks on 24 January: +From February 23, 2019 - Billionaire businessman Richard Branson says he hopes his Live Aid-inspired concert to raise funds for Venezuelans will persuade members of the country's military to defy President Nicolas Maduro and allow humanitarian aid to cross the border. +Branson, who will host ""Venezuela Aid Live"" on Friday in the Colombian border town of Cucuta, said he is aiming to raise about $100 million to buy food and medicine, essential supplies for the country, which is gripped by a political and humanitarian crisis. +In reaction to - Maduro’s government announced that it would accept contributions from China and Cuba, but called Guaidó-organized aid, which includes contributions from the United States, a “handout.” In an interview with the Associated Press this week, Maduro blamed U.S. sanctions for Venezuela’s economic woes, saying “the infected hand of Donald Trump is hurting Venezuela.” +* Like the White Helmets (Musician) Roger Waters (willing idiot) weighs in - In a two-minute video posted on Twitter, the musician says Mr Branson's ""Live-Aid-ish"" concert has ""nothing to do with humanitarian aid at all"". ""It has to do with Richard Branson, and I'm not surprised by this, having bought the US saying: 'We have decided to take over Venezuela, for whatever our reasons may be,'"" Mr Waters says. ""But it has nothing to do with the needs of the Venezuelan people, it has nothing to do with democracy, it has nothing to do with freedom, and it has nothing to do with aid."" He adds that he has ""friends that are in Caracas"" who claim there is ""no civil war, no mayhem, no murder, no apparent dictatorship, no suppression of the press"" +Maduro government holds their own concert to counter Branson’s efforts +https://www.cnbc.com/2019/02/19/richard-branson-maduro-concert-on-venezuela-border.html +https://www.theguardian.com/world/2019/feb/19/maduro-government-richard-branson-rival-venezuela-concerts +Just 300 metres away, the first of some 150 artists began performing at Maduro's Hands off Venezuela festival. +https://www.aljazeera.com/news/2019/02/rival-concerts-backdrop-venezuela-power-struggle-190222142807321.html + +* The Russian official line - (talking points for trolls & willing/unwitting idiots) +On Tuesday, Russian Foreign Minister Sergey Lavrov criticized the U.S. sanctions, which meant that proceeds from the sale of Venezuelan oil would be withheld from Maduro’s government. +In a press conference, Lavrov dubbed the U.S. sanctions “illegitimate” and “cynical,” adding that Russia “along with other responsible members of the global community will do everything to support the legal government of the president,” RIA Novosti reported. +There is concern in Moscow about the level of debt Caracas owes Russia. Russian Deputy Finance Minister Sergei Storchak said the sanctions may mean Venezuela will have problems servicing sovereign debt to Russia. +Venezuela has two months to pay Russian $100 million and there is uncertainty as to whether PDVSA can service its debt to Russia’s state energy giant Rosneft, Radio Free Europe reported +The evolution/spread of talking points +But while the Canadian government, which accused Maduro of seizing power through fraudulent elections, has expressed full support for Guaido, some Canadian protesters are calling it out for what they say is an attack on Venezuela’s sovereignty. +“What is brewing, what is being organized is an actual military intervention of Venezuela,” said Margaret Villamizar, who attended a protest in Windsor, Ont. “If it doesn’t turn out to be full-scale military, what’s being called diplomacy is really an attack on Venezuela’s sovereignty.” + +* Also - In an interview with Foreign Policy, Adm. Craig Faller, the four-star military officer who heads U.S. Southern Command, pointed to a Chinese disinformation campaign designed to blame the United States for the blackouts that devastated Venezuela in recent weeks. https://foreignpolicy.com/2019/04/08/us-military-wary-of-chinas-foothold-in-venezuela-maduro-faller-guaido-trump-pentagon/ +A Chinese plane loaded with 65 tons of medical supplies landed in Venezuela's capital of Caracas on Friday amid a power struggle between President Nicolas Maduro and opposition leader Juan Guaido. +Maduro welcomed the arrival of the humanitarian aid on Twitter, saying ""Venezuela is breaking the imperialist siege and advancing with a victory."" +He shared photos showing the arrival of the aid as well as a photo of him taken with his Chinese counterpart Xi Jinping during his visit to China last year. +China's move came after Russia sent humanitarian aid to Caracas last week. +Venezuela has been rocked by protests since Jan. 10, when Maduro was sworn in for a second term following a vote boycotted by the opposition. +https://www.aa.com.tr/en/americas/venezuela-welcomes-arrival-of-chinese-medical-aid/1435166 + +Counters: + +* Every report suggesting that Venezuela is mired in a humanitarian crisis. +April 10, 2019 The UN reports “There is a very real humanitarian problem in Venezuela,” said Mark Lowcock, the UN humanitarian chief. “We estimate that 7 million people in Venezuela need humanitarian assistance. That is some 25 per cent of the population,” +April 10, 2019 NY Times ‘You Shouldn’t Be Here’: U.S. Pushes U.N. to Pull Venezuela Envoy’s Credentials +Go back to October 2018 Washington Post: A humanitarian crisis in Venezuela? Nothing to see here, government says. Human Rights Watch Report + +Related incidents: + +* Speculation but research worthy… right/left regional binary pitting new right wing governments in Brazil & Columbia and hosility/percieved hosility to regimes like Venezuela & Ecuador + +References: + +* https://www.truthdig.com/articles/activists-to-trump-hands-off-venezuela/ +* https://www.marxist.com/packed-london-meeting-says-us-uk-hands-off-venezuela.htm +* https://euvsdisinfo.eu/twitter-as-an-information-battlefield-venezuela-a-case-study/ +* https://www.washingtonpost.com/world/the_americas/in-venezuela-humanitarian-aid-has-become-a-political-weapon/2019/02/14/5eab781a-3089-11e9-8781-763619f12cb4_story.html +* https://www.apnews.com/21b641f6def1400894125e3a8117f66c +* https://www.cnbc.com/2019/02/19/richard-branson-maduro-concert-on-venezuela-border.html +* https://www.theguardian.com/world/2019/feb/19/maduro-government-richard-branson-rival-venezuela-concerts +* https://www.aljazeera.com/news/2019/02/rival-concerts-backdrop-venezuela-power-struggle-190222142807321.html +* https://foreignpolicy.com/2019/04/08/us-military-wary-of-chinas-foothold-in-venezuela-maduro-faller-guaido-trump-pentagon/ +* https://www.aa.com.tr/en/americas/venezuela-welcomes-arrival-of-chinese-medical-aid/1435166 +* https://news.un.org/en/story/2019/04/1036441 +* https://www.nytimes.com/2019/04/10/world/americas/pence-venezuela-un-envoy.html +* https://www.washingtonpost.com/world/the_americas/a-humanitarian-crisis-in-venezuela-nothing-to-see-here-government-says/2018/10/12/6ebd1aa6-c2ac-11e8-9451-e878f96be19b_story.html +* https://www.hrw.org/world-report/2019/country-chapters/venezuela +* https://euvsdisinfo.eu/twitter-as-an-information-battlefield-venezuela-a-case-study/ +* https://www.npr.org/2019/03/25/706635580/venezuelas-maduro-faces-pressure-from-much-of-the-world-yet-he-persists +* https://cronkitenews.azpbs.org/2019/02/26/venezuela-protests-in-tucson/ +* https://www.newsweek.com/donald-trump-told-hands-venezuela-countrys-president-who-has-full-backing-1309188 +* https://www.dw.com/cda/en/venezuela-juan-guaido-urges-army-to-let-aid-through/a-47651164 +* https://www.npr.org/2019/04/02/709306132/maduro-allies-move-against-rival-juan-guaid-in-venezuela +* https://www.washingtonpost.com/world/2019/04/02/trump-has-russia-problem-venezuela/?utm_term=.9233de48de14 +* https://www.atlanticcouncil.org/blogs/new-atlanticist/russia-s-venezuela-challenge +* https://www.theglobeandmail.com/world/article-venezuelas-maduro-seeks-to-restore-power-stem-looting-as-china/ +* https://www.npr.org/tags/587365601/venezuela-crisis +* https://www.washingtonpost.com/world/2019/02/16/richard-bransons-goal-million-venezuela-could-face-an-obstacle-maduro/?utm_term=.8a5ad46a730a +* https://www.bbc.com/news/world-latin-america-47271182 + +Notes: + + + + +" +"incident","I00001"," + +Actor: + +Timeframe: + +Date: + +Presumed goals: “Russian-linked social media accounts saw racial tensions as something to be exploited in order to achieve the broader Russian goal of dividing Americans and creating chaos in U.S. politics during a campaign in which race repeatedly became an issue.” + +Method: +Possibly linked: black lives matter facebook ads, targetted at Baltimore, Ferguson, Missouri https://money.cnn.com/2017/09/27/media/facebook-black-lives-matter-targeting/index.html?iid=EL + +Counters: + +Related incidents: + +* Txrebels facebook group +* MuslimAmerica facebook group +* Patriotus facebook group +* SecuredBorders facebook group +* Lgbtun facebook group +* Black Matters facebook group + +References: +* https://money.cnn.com/2017/09/28/media/blacktivist-russia-facebook-twitter/index.html +* https://news.docnow.io/blacktivists-in-the-archive-71c807aa247e +* https://www.thedailybeast.com/exclusive-secret-documents-from-russias-election-trolls-leak + + + +Datasets + +* https://docs.google.com/spreadsheets/d/1OZcRCZuz83bMpxVjpUYEALiS4OtKU-pTVtTveG_Ljs0/edit#gid=0 - from https://news.docnow.io/blacktivists-in-the-archive-71c807aa247e are the @blacktivists tweets that used the #blacklivesmatter hashtag +* Jonathan Albright got the facebook text: https://data.world/d1gi/missing-fb-posts-w-share-stats/workspace/file?filename=Blacktivist+Facebook+Page+%28Text%29.pdf https://data.world/d1gi/missing-fb-posts-w-share-stats/workspace/file?filename=Blacktivist+Facebook+Page+%28Text%29-2.docx + +Notes + +First i read the cnn article, then did a twitter search to see if there are traces of the accounts left online. Only discussion about the IRA operation seem to be on Twitter. Also searched twitter for some of the text found later (in datasets) - nothing matches. +Reading the docnow.io post showed some interesting behavours. Also that there was no central data repo for the blacktivists posts. Classic was the tweets being sent only in 8am-6pm Moscow time. Also interesting: the followers grew over time, but they grew and dropped friends (people they followed) in batches periodically - was this to avoid hitting limits? +Reading the dailybeast.com article (on an IRA leak), it seems specific individuals were targetted. Thinking about the places we need to search: if it’s Russia, seems like we need to check twitter, facebook, youtube, reddit, tumblr, instagram, 9gag. +Names some of the people contacted, e.g. Craig Carson, a Rochester, New York, attorney and civil rights activist; maybe Shanall LaRay Logan—who lives in Sacramento, California; + + +" +"incident","I00035"," + +Summary: + +Actor: + +Timeframe: + +Date: + +Presumed goals: + +Method: + +* Bot activity that inflates the visibility of and perceived support for certain candidates and ideologies in 2014 elections. +* Campaigns use bots or spread content favorable to their respective candidates in 2014. Neves’ operation used bots on a much larger scale than the Rousseff’s campaign (on FB, Twitter and WhatsApp). + +Counters: + +* Facebook removed 200 pages run by individuals connected to the right-wing activist organization Movimento Brasil Livre related to the Brazil elections. + +Related incidents: + +References: +* https://blogs.oii.ox.ac.uk/politicalbots/wp-content/uploads/sites/89/2017/06/Comprop-Brazil-1.pdf +* https://www.wilsoncenter.org/blog-post/bots-brazil-the-activity-social-media-bots-brazilian-elections + + +" +"incident","I00025"," + +Actor: Russia + +Timeframe: November 6, 2018 - end of November 2018 + +Date: November 6, 2018 + +Presumed goals: + +* Include - Leave campaigners have claimed that the UK would be forced into an ‘EU army’ under the rules allowing for these activities. https://fullfact.org/europe/hunt-eu-army/ +* Baltic states are frightened by the single European army. The new European security system will be anti-American. To the leadership of the Baltic states, based on Russophobia, this doesn’t look good. + +Method: + +* “Limited” engagement & channels. In this case Reddit was key forum. +* Could not find examples of engagement from “usual suspects” ie: Russian embassy; military or broad mentions via RT & Sputnik + +Counters: + +Related incidents: + +References: + +* https://www.theguardian.com/politics/2016/may/27/is-there-a-secret-plan-to-create-an-eu-army +* https://medium.com/dfrlab/spread-it-on-reddit-3170a463e787 +* https://www.atlanticcouncil.org/blogs/new-atlanticist/a-european-army-eminently-defensible-but-not-probable-for-a-long-time-to-come +* https://www.bbc.com/news/world-europe-46108633 +* https://www.politico.eu/article/angela-merkel-emmanuel-macron-eu-army-to-complement-nato/ +* https://euvsdisinfo.eu/report/baltic-states-frightened-by-the-single-european-army/ +* https://www.theguardian.com/commentisfree/2019/jan/25/brexiters-european-army-myths-franco-german +* https://fullfact.org/europe/hunt-eu-army/ +* https://www.theguardian.com/politics/2016/may/27/is-there-a-secret-plan-to-create-an-eu-army + + +Datasets: + +Notes: +Worth noting the Breitbart commentary (see visual assets); compared to campaigns against NATO for instance, this incident didn’t seemingly have much traction/momentum, and seemed more of a potential wedge for the pro-Brexit audience. + +Visual Assets + +" +"incident","I00060"," + +Actors: + +Timeframe: + +Date: + +Presumed goals: + +Method: + +Counters: + +Related incidents: + +References: +* (Trump’s White-Nationalist Pipeline)[https://www.theatlantic.com/politics/archive/2018/08/trump-white-nationalism/568393/] +* (Parallels between social media misinformation campaigns in the USA and South Africa)[https://www.iafrikan.com/2018/11/20/social-media-usa-south-africa-fake-news-disinformation/] +* (The high price of 'white genocide' politics for Australia)[https://www.smh.com.au/world/oceania/the-high-price-of-white-genocide-politics-for-australia-20180724-p4zt9k.html] +" +"incident","I00005"," + +Actor: Russia/ Internet Research Agency (IRA) + +Timeframe: December 2015 - ongoing + +Date: June 23, 2016 + +Presumed goals: Change Brexit vote to ‘leave’; continue to divide/undermine EU; drive Eurosceptic narrative/agenda + +Method: +* (From The European Values Think-Tank) +* Before Brexit, Russia Today and Sputnik released more anti-EU articles than the official Vote Leave website and Leave.EU website. The British version of Sputnik has an annual budget of £ 1.8 million from the Russian government. Kremlin-owned channels potentially influenced 134 million impressions during the Brexit campaign +* Method: The data that was used by 89up was derived from the Twitter Search API, Buzzsumo, the Facebook API and other scraping methods. In the timeframe from January 2016 to the day of the British referendum, analysts identified and analysed 261 of the most shared and popular articles that were clearly anti-European. The two main media outlets were RT and Sputnik. Costs: The total value of Kremlin media for the Leave campaign in the six months before the EU referendum was £1,353,000. The PR value for the Leave campaign, based on the 261 heavily pro-Leave articles published by RT and Sputnik, is estimated at nearly £1,500,000based on figures from a leading media monitoring tool. This excludes the significant social media value of these news articles. Estimated value of Russian media Facebook impressions is around $102,000 and the estimated value of Russian media’s potential impressions on Twitter is between $47,000 - $100,000. +* Content: The analysis also shows that the overwhelming majority of articles published by RT and Sputnik (131 of the 200 most shared) were clearly for Leave; 59 articles were Neutral and only 10 were set to Remain. When the neutral articles are filtered out, numbers show that the negative articles of RT/Sputnik, together, elicited nearly the same number of engagements as the official Vote Leave website. +* Social reach: The report shows the social reach of these anti-EU articles published by the Kremlin-owned channels was 134 million potential impressions, in comparison with a total social reach of just 33 million and 11 million potential impressions for all content shared from the Vote Leave website and Leave.EU website respectively. +* (Jane Mayer, staff writer at The New Yorker, via NPR) Role of - Cambridge Analytica, which is a big data company that worked for the Trump campaign in the end - and it was owned principally by one of Trump's largest backers, Robert Mercer - was also involved in helping the early stages of the Brexit campaign in England. +And the man who spanned both countries and pushed for both, really, was Steve Bannon, it seems there was actually a lot of Russian money offered to Arron Banks, who was one of the major political figures leading the Brexit campaign. The Russian money was offered to him in the form of business opportunities and gold mines and diamond mines by the Russian ambassador to England. So there seems to be financial incentives that were dangled. +* There are bots and trolls and posts that are coming from the same Russian Internet agency in St. Petersburg. So in both countries, we see pushing Brexit and pushing Trump at the same time by the same trolls and bots. research conducted by a joint team of experts from the University of California at Berkeley and Swansea University reportedly identified 150,000 Twitter accounts with various Russian ties that disseminated messages about Brexit. +* A cache of posts from 2016, seen by WIRED, shows how a coordinated network of Russian-based Twitter accounts spread racial hatred in an attempt to disrupt politics in the UK and Europe. +A network of accounts posted pro and anti-Brexit, anti-immigration and racist tweets around the EU referendum vote while also targeting posts in response to terrorist attacks across the continent. +* More broadly, a Russian espionage operation funneling money into a political campaign aimed at unwinding European integration would be entirely consistent with the Kremlin’s perceived political interests and tactics of hybrid warfare. Covert financial infiltration is part of a toolkit Moscow uses to interfere in European and American politics. Another tool deployed ahead of the 2016 referendum was pro-Brexit messaging pumped out by RT, Sputnik, and the Internet Research Agency. +* From 1 to 8 February 2016, Sputnik ran 14 stories on the “Brexit” issue. Eight of them had negative headlines, either featuring criticism of the deal or focusing on the difficulties Cameron faces; five headlines were broadly factual; one reported a positive comment that the Bank of England had “not yet seen” an impact on investor sentiment, but gave it a negative slant by headlining, “Bank of England on Brexit: No need to panic, yet.” (The word “panic” did not appear in the story.) Not one headline reported reactions supporting the deal. Both Sputnik and RT quoted a disproportionate number of reactions from “Out” campaigners. RT, for example, quoted five “Out” partisans: MP Liam Fox; the founder of Leave.EU; London Mayor Boris Johnson; MEP Nigel Farage, the leader of the UK Independence Party; and UKIP member Paul Nuttall. +* anti-immigrant adverts were targeted at Facebook users in the UK and the US. One – headlined “You’re not the only one to despise immigration”, which cost 4,884 roubles (£58) and received 4,055 views – was placed in January 2016. Another, which accused immigrants of stealing jobs, cost 5,514 roubles and received 14,396 impressions +* A study of social media during the Brexit campaign by 89Up, a consultancy, found that Russian bots delivered 10m potential Twitter impressions—about a third of the number generated by the Vote Leave campaign’s Twitter account. Such echoing amplifies the effect of RT and Sputnik stories, which are in general not much watched. + +Counters: FB & Twitter content take-downs + +Related incidents: + +* 2016 US Election… pick ‘em + +References: + +* https://publications.parliament.uk/pa/cm201719/cmselect/cmcumeds/363/36308.htm#_idTextAnchor033 +* https://www.foreign.senate.gov/imo/media/doc/FinalRR.pdf +* https://www.theguardian.com/world/2017/nov/15/russian-troll-factories-researchers-damn-twitters-refusal-to-share-data +* https://www.atlanticcouncil.org/blogs/new-atlanticist/congress-should-explain-how-dark-russian-money-infiltrates-western-democracies +* http://sputniknews.com/search/?query=Brexit +* http://sputniknews.com/europe/20160202/1034093305/cameron-tusk-brexit-deal.html +* http://sputniknews.com/europe/20160203/1034124763/tusk-eu-reform.html +* http://sputniknews.com/europe/20160204/1034209396/cameron-eu-brexit-talks.html +* http://sputniknews.com/europe/20160205/1034290031/business-investments-brexit-europe.html +* https://www.rt.com/uk/331734-cameron-calais-jungle-brexit/ +* https://www.rt.com/uk/331161-eu-referendum-date-brexit/ +* https://www.rt.com/uk/330977-tusk-eu-deal-brexit/ +* https://twitter.com/brexit_sham/status/994982969705189377 + +* https://www.nytimes.com/2017/11/15/world/europe/russia-brexit-twitter-facebook.html +* https://www.forbes.com/sites/emmawoollacott/2018/11/01/russian-trolls-used-islamophobia-to-whip-up-support-for-brexit/#11ee8dd465f2 +* https://www.theguardian.com/world/2018/jan/10/russian-influence-brexit-vote-detailed-us-senate-report +* https://www.npr.org/2019/01/19/686830510/senate-finds-russian-bots-bucks-helped-push-brexit-vote-through +* https://www.europeanvalues.net/wp-content/uploads/2019/02/Influence-of-Russian-Disinformation-Operations-Specific-examples-in-data-and-numbers.pdf +* https://blogs.lse.ac.uk/brexit/2018/11/14/the-extent-of-russian-backed-fraud-means-the-referendum-is-invalid/ +* https://www.wired.co.uk/article/brexit-russia-influence-twitter-bots-internet-research-agency +* https://www.buzzfeed.com/jamesball/a-suspected-network-of-13000-twitter-bots-pumped-out-pro?utm_term=.ipWGa5zK#.oeeKD58v +* https://www.atlanticcouncil.org/blogs/new-atlanticist/use-brexit-delay-to-investigate-russian-money +* http://www.interpretermag.com/putins-media-are-pushing-britain-for-the-brexit/ +* https://www.theguardian.com/technology/2018/may/12/facebook-brexit-russia-unresolved-40-questions +* https://www.economist.com/briefing/2018/02/22/russian-disinformation-distorts-american-and-european-democracy + + + +" +"incident","I00044"," + +Actors: + +* SVR and IRA; +* Alex Jones; +* Global Research; +* anti-gov trolls; rapture trolls; alt-right trolls; + +Timeframe: Most of 2015 + +Date: May - Oct 2015 + +Presumed goals: + +* US operational dry run; +* Test 2016 themes; +* Promote paranoia in right wing US populations; +* Establish and prime anti-government narratives for future use. + +Method: + +* Amplification via sockpuppet and cyborg accounts; +* Social media groups and meetups; +* Promote fake “experts” with impressive (and scary) titles; +* Amplify US media derision of message “carriers” in Russian state media; + +Counters: + +* Media exposure; +* Texas Governor disavows + +Related incidents: + +* 2016 US election; +* QAnon; +* Texas secession + +References + +* [That 'Jade Helm' Conspiracy Freakout Was Spurred By Russian Bots, Ex-Intel Chief Says](https://taskandpurpose.com/jade-helm-conspiracy-russian-bots) +* [Russians Sowed Divisions in Texas Politics, Says U.S. Senate Report](https://www.texasmonthly.com/news/russians-sowed-divisions-texas-politics-says-u-s-senate-report/) +* [Case Analysis: Jade Helm 15 and Russian Active Measures](https://toinformistoinfluence.com/2015/11/16/case-analysis-jade-helm-15-and-russian-active-measures/) +* [Trolling for Trump: how Russia is trying to destroy our democracy](https://warontherocks.com/2016/11/trolling-for-trump-how-russia-is-trying-to-destroy-our-democracy/) +* [Anatomy of a Russian attack: First signs of the Kremlin’s attempt to influence the 2016 election](https://wtop.com/j-j-green-national/2017/09/anatomy-russian-attack-first-signs/slide/1/) + +Details + +Even before the 2016 presidential election, the Russians had been testing disinformation in Texas by stirring up the controversy surrounding the Jade Helm military maneuver in the summer of 2015. Conspiracy theorists had created the idea that a joint military training exercise in Texas was cover for President Obama to declare martial law and seize Texas. The conspiracy theory gained traction when Abbott ordered the Texas State Guard to monitor the U.S. military. Earlier this year, a former head of the National Security Agency and the CIA—Air Force General Michael Hayden—said the Jade Helm disinformation campaign was pivotal to the Russians’ decision to try to influence the U.S. presidential campaign. “At that point, I’m figuring the Russians are saying, ‘We can go big-time.’ And at that point, I think they made the decision, ‘We’re going to play in the electoral process,’” Hayden said. + +When thousands of troops from Army Special Operations Command descended on the American southwest for the totally normal eight-week training exercise Jade Helm 15, Texas Gov. Greg Abbott — goaded on by anti-government ideologues, rapture-predicting ministries and alt-right internet famewhores — ordered the state's volunteer guard to ""monitor"" the U.S. service members on their land to make sure they didn't start kidnapping undesirables and grabbing people's guns. + +It was a precursor to martial law, they said. It was ""way worse than you realize: police, military working together toward population control,"" they said. It was ""secretly using recently closed Wal-Marts to stockpile supplies for Chinese troops who will be arriving to disarm Americans,"" they said. It was preparation for Obama's takeover after an impending asteroid impact that would begin the global apocalypse, they said. It mobilized right-wing activists to prepare to fight their government — their uniformed soldiers! — to the death. + +Russian intelligence, state media, and trolls under President Vladimir Putin sought to bum steer U.S. domestic reactions to Jade Helm 15, the multi-state U.S.-based military training exercise concludedSeptember 15th. Russia has invested tens to hundreds of millions to infiltrate U.S. media markets with English language news, opinion, conspiracy, and troll content, often interlocking with the most popular U.S. conspiracy theory websites on the net. + +On July 2015, at a community meeting in Bastrop, some Texans were up in arms about hosting part of a multi-state U.S. military training exercise named Jade Helm 15. While most locals were unswayed by the conspiracy theories of Jade Helm 15 ushering in martial law, the video of the crowd at the link records aspects of U.S. social and cognitive vulnerability to Russian “active measures.” + +It's an age-old problem; during the Cold War, Soviet agencies worked to whip up leftist anger at the U.S. government, highlighting America's race and inequality problems. But today, they've found that the most effective, salient mode of fuckery in U.S. affairs is to push right-wing conspiracy theories — ""deep state,"" Hillary emails, Pizzagate, Seth Rich, Soros, Islamists sneaking over the Mexico-U.S. border, Benghazi — that reinforce the idea that anyone to the left of, say, President Donald Trump, is a robotic foreign-paid human-trafficking overlord doing the bidding of the Rothschilds or Trilaterals or Freemasons or Kellers some other inane shit. + +The Russian SVR (Sluzhba vneshney razvedki) has chief responsibility for conducting active measures outside of Russia. The SVR’s active measures surrounding Jade Helm 15 generated fear to ignite a range of behaviors serving Russian foreign policy objectives, from feeding cynicism about the U.S. governing system and its people, to inciting violence and sabotage in the U.S. + +One example of how this messaging worked in ramping up fear of Jade Helm 15 was found at “Global Research,” a media outlet for a Canadian non-profit called Centre for Research on Globalization. Entitled, Towards a Militarized Police State in America? Explosive New Revelations over “Jade Helm 15 Exercise” and Potential False Flags, the online article was posted May 27, 2015, roughly 48 days before the Jade Helm 15 training exercise was to begin. Such a lead would give the piece time to disseminate to conspiracist sites and gullible readers ample time to organize a response. + +The idea is to get Americans thinking other Americans are the real enemies of humanity and progress. And it works, because a lot of Americans are already disposed to that way of thinking. + +On the other hand, it’s an easy cop-out to blame the Russians for every insecure dumbass idea that excitable Americans run with. + +Considering their interlocking content and links, Global Research and Alex Jones’s InfoWars.com (one of the most popular conspiracy websites on the internet) have a de facto alliance. Both sites published conspiracy pieces about Jade Helm 15 in advance of the exercise, as did many other conspiracist websites that link with one or both. + +The blizzard of conspiracy has had an effect. By May 2015, a Rasmussen poll on Jade Helm 15 found that “45% of voters are concerned that the government will use U.S. military training operations to impose greater control over some states,” with 19% “Very Concerned.” Rasmussen also reported that “21% believe the government’s decision to conduct military training exercises in some states is an infringement on the rights of the citizens in those states.” + +Some debate the effectiveness of Russian active measures, propaganda, and trolling. Russia Today (RT) is a more sophisticated Kremlin media outlet, with slick television, internet, and periodical output. RT’s portrayal of Jade Helm 15was to depict Americans as prone to conspiracy theory, and to amplify left-leaning U.S. media derision of Texas demographics disturbed by Jade Helm 15, while casting doubt on the government operation with headlines and sub-headlines. Russia Today’s approach had accentuated personal caricatures and distrust driving partisan anger in the U.S. + +On social media however, Kremlin-linked and other conspiracists sometimes represent themselves as insiders or experts whose content can be frightening and inciting. + +For example, on LinkedIn.com, many Pulse posts have focused on Jade Helm 15. Below I profile two examples of Pulse writers who hit Jade Helm 15 theme especially hard, one of them naming himself a “Military Intelligence Analyst / Russian Regional CME” and the other a “Geopolitical Strategist, Journalist & Author” + +Are apocalyptic conspiracies harmless despite their over-the-top claims? + +Apparently not. One ominous event may have turned Jade Helm 15 Active measures into a high-yield victory for Vladimir Putin’s Kremlin. Three North Carolina men amassed arms, munitions, and weapons and had been actively preparing to ambush Jade Helm 15 troops in training. Fortunately, the FBI received a tip from a gun and surplus store owner and arrested the would-be domestic-terrorists who feared that Jade Helm 15 was a prelude to martial law in the U.S. + +The Russian SVR and Putin’s media have aimed at Texas before. Did Putin foresee that Texas politicians might respond to popular conspiracist fears ramped up by the Kremlin itself and so cause strife in the partisan divide? That happened when Governor Greg Abbot tried to reassure Texans about Jade Helm 15, and opposition media lampooned him. + +Yet according to the San Antonio Express News, Governor Abbot, who is also a former Texas Supreme Court Justice not of the conspiracist mold, had initially a milder approach. Yet the opposing partisan media did more than just embarrass Gov. Abbot over his response, it called some of his constituents who had been moved by conspiracy propaganda “dumb,” which further tends to divide U.S. demographics along stereotypical lines. Mr. Putin must have been pleased. + +Examples + + +" +"incident","I00015"," + +Actors: Russian state actors, Concord Management + +Timeframe: Fall 2018 - Winter 2019 + +Date: October 2018 + +Presumed goals: + +* Discredit Mueller findings; +* sow doubt about Russian active measures; +* expose investigatory sources, priorities and methods; + +Method: + +* Release non-public documents with favorable amendments; +* Disguise document provenance as hacking (i.e. revelation); +* Circulate to media via DM, then release publicly + +Counters: + +* Media exposure; +* motions to limit future discovery + +Related incidents: + +* 2016 US election + +References + +* [Document: Concord Management Used Discovery for Disinformation Campaign, Mueller Says](https://www.lawfareblog.com/document-concord-management-used-discovery-disinformation-campaign-mueller-says) +* [Mueller says some private case files were used in 'disinformation campaign' to discredit Russia probe](https://thehill.com/policy/national-security/427723-mueller-says-some-of-his-private-case-files-were-used-in) +* [Mueller says Russians are using his discovery materials in disinformation effort](https://www.nbcnews.com/politics/justice-department/mueller-says-russians-using-his-discovery-materials-disinformation-effort-n964811) +* [Mueller says discovery materials in case against Russian firm were used in a cyber-disinformation campaign](https://www.washingtonpost.com/local/legal-issues/mueller-says-discovery-materials-in-case-against-russian-firm-were-used-in-a-cyber-disinformation-campaign/2019/01/30/9fd60218-24c9-11e9-81fd-b7b05d5bed90_story.html?utm_term=.4b814db9f811) +* [Mueller's Team Questions How Files in Russia Case Ended Up Online](https://www.law.com/nationallawjournal/2019/01/30/muellers-team-questions-how-files-in-russia-case-ended-up-online/?slreturn=20190231112904) +* https://www.documentcloud.org/documents/5700929-Concord-Discovery-Opposition.html + +Details + +The special counsel's office has filed a memorandum in U.S. v. Concord Management and Consulting, LLC in opposition to Concord's motion to disclose documents identified as ""sensitive"" by the Special Counsel to certain Concord officers and employees. The memo alleges that subsequent investigations into Concord have ""revealed that certain non-sensitive discovery materials in the defense’s possession appear to have been altered and disseminated as part of a disinformation campaign"" apparently aimed at discrediting the special counsel's investigation into Russian interference in the 2016 U.S. election. + +That discovery — evidence and documents traded between both sides of a lawsuit — appears to have been altered and disseminated as part of a disinformation campaign apparently aimed at discrediting the ongoing investigations in Russian interference in the U.S. political system, according to the documents. + +Prosecutors said sensitive evidence also could reveal government investigative techniques and identify cooperating individuals and companies. + +Concord is among 13 Russian individuals and entities charged last February in connection with Mueller’s probe. Concord is alleged to have funded the operation of the Internet Research Agency, a Russian troll farm that spread divisive content to U.S. audiences on social media as part of broader effort to meddle in the 2016 vote. + +Prosecutors said that some nonpublic files supplied to Concord’s defense attorneys were apparently altered and disseminated using the Twitter account @HackingRedstone, which has since been suspended on the platform. + +On Thursday, Mueller's team updated their filing with precise dates for the actions taken on Twitter, noting that the account @HackingRedstone started sending direct messages to members of the media on October 22, before making a public tweet on October 30 in regards to the supposed discovery documents. + +The filing cites an Oct. 22, 2018, tweet in which the account claimed, “We’ve got access to the Special Counsel Mueller’s probe database as we hacked Russian server with info from the Russian troll case Concord LLC v. Mueller. You can view all the files Mueller had about the IRA and Russia collusion. Enjoy the reading!” + +The tweet linked to a webpage with folders containing scores of files that mimicked names and folder structures of materials produced by the special counsel’s office in discovery, the filing states. + +The prosecutors’ filing said the matching files included images of political memes from Facebook and other social media accounts used online by the Internet Research Agency, many of which are presumably still available elsewhere on the Internet, but not with the unique identifiers used in materials turned over by prosecutors. + +Prosecutors said in their filing that an FBI review found no evidence of a hack of the special counsel’s office. The filing also said that defense lawyers told the Mueller team that the vendor it was using reported no unauthorized access to the nonsensitive files. Under a court protective order, sensitive evidence in the case must be reviewed by a U.S. government “firewall” counsel, and then a judge must give permission before the evidence can be given to any non-U.S. national. + +The facts “establish that the person(s) who created the Web page had access to at least some of the nonsensitive discovery produced by the government in this case,” wrote Justice Department national security division attorney Heather N. Alpino for a team including prosecutors with Mueller’s office and the U.S. attorney’s office of the District. + + +Mueller’s team firmly pushed back on the request in the filing Wednesday, asserting releasing the files to the firm’s employees in Russia – including Prigozhin – would risk U.S. national security. + +“Concord’s request to send the discovery to the Russian Federation unreasonably risks the national security interests of the United States,” the filing states. “The government’s concerns are only heightened by the apparent release and manipulation of information produced to Concord as ‘non-sensitive’ discovery in this case.” + +The filing also notes that the discovery files labeled ""sensitive"" identify ""uncharged individuals"" who government investigators believe are ""continuing to engage in operations to interfere with lawful U.S. government functions like those activities charged in the indictment.” + +Mueller’s prosecutors did not oppose allowing Concord employees to view the files at their defense attorney’s offices under security protections, noting that “appearance in the United States would allow them to stand trial.” +" diff --git a/AMITT_MASTER_DATA/AMITT_DATA_MASTER.xlsx b/AMITT_MASTER_DATA/AMITT_DATA_MASTER.xlsx index 8900f0c..9fc673d 100644 Binary files a/AMITT_MASTER_DATA/AMITT_DATA_MASTER.xlsx and b/AMITT_MASTER_DATA/AMITT_DATA_MASTER.xlsx differ diff --git a/AMITT_MASTER_DATA/AMITT_FRAMEWORKS_MASTER.xlsx b/AMITT_MASTER_DATA/AMITT_FRAMEWORKS_MASTER.xlsx index 68c6fd8..1d2af98 100644 Binary files a/AMITT_MASTER_DATA/AMITT_FRAMEWORKS_MASTER.xlsx and b/AMITT_MASTER_DATA/AMITT_FRAMEWORKS_MASTER.xlsx differ diff --git a/HTML_GENERATING_CODE/.ipynb_checkpoints/AMITT_generate_github_files-checkpoint.ipynb b/HTML_GENERATING_CODE/.ipynb_checkpoints/AMITT_generate_github_files-checkpoint.ipynb index 5dc1e17..44d2ab9 100644 --- a/HTML_GENERATING_CODE/.ipynb_checkpoints/AMITT_generate_github_files-checkpoint.ipynb +++ b/HTML_GENERATING_CODE/.ipynb_checkpoints/AMITT_generate_github_files-checkpoint.ipynb @@ -11,7 +11,7 @@ }, { "cell_type": "code", - "execution_count": 2, + "execution_count": 1, "metadata": { "scrolled": true }, @@ -24,14 +24,55 @@ "updated ../amitt_red_framework_clickable.html\n", "updated ../amitt_blue_framework.md\n", "updated ../amitt_blue_framework_clickable.html\n", + "Temp: objecttype phase\n", "updated ../phases_index.md\n", + "Temp: objecttype tactic\n", "updated ../tactics_index.md\n", + "Temp: objecttype technique\n", "updated ../techniques_index.md\n", + "Temp: objecttype task\n", "updated ../tasks_index.md\n", + "Temp: objecttype incident\n", "updated ../incidents_index.md\n", + "Temp: objecttype counter\n", "updated ../counters_index.md\n", + "Temp: objecttype metatechnique\n", "updated ../metatechniques_index.md\n", + "Temp: objecttype actortype\n", "updated ../actortypes_index.md\n", + "Updating ../actortypes/A001.md\n", + "Updating ../actortypes/A002.md\n", + "Updating ../actortypes/A003.md\n", + "Updating ../actortypes/A004.md\n", + "Updating ../actortypes/A005.md\n", + "Updating ../actortypes/A006.md\n", + "Updating ../actortypes/A007.md\n", + "Updating ../actortypes/A008.md\n", + "Updating ../actortypes/A009.md\n", + "Updating ../actortypes/A010.md\n", + "Updating ../actortypes/A011.md\n", + "Updating ../actortypes/A012.md\n", + "Updating ../actortypes/A013.md\n", + "Updating ../actortypes/A014.md\n", + "Updating ../actortypes/A015.md\n", + "Updating ../actortypes/A016.md\n", + "Updating ../actortypes/A017.md\n", + "Updating ../actortypes/A018.md\n", + "Updating ../actortypes/A019.md\n", + "Updating ../actortypes/A020.md\n", + "Updating ../actortypes/A021.md\n", + "Updating ../actortypes/A022.md\n", + "Updating ../actortypes/A023.md\n", + "Updating ../actortypes/A024.md\n", + "Updating ../actortypes/A025.md\n", + "Updating ../actortypes/A026.md\n", + "Updating ../actortypes/A027.md\n", + "Updating ../actortypes/A028.md\n", + "Updating ../actortypes/A029.md\n", + "Updating ../actortypes/A030.md\n", + "Updating ../actortypes/A031.md\n", + "Updating ../actortypes/A032.md\n", + "Updating ../actortypes/A033.md\n", "updated ../responsetype_index.md\n", "updated ../detections_index.md\n", "updated ../tactics_by_responsetype_table.md\n", @@ -48,7 +89,7 @@ }, { "cell_type": "code", - "execution_count": 3, + "execution_count": 2, "metadata": { "scrolled": true }, @@ -76,376 +117,463 @@ " \n", " amitt_id\n", " name\n", - " metatechnique\n", " summary\n", - " actortypes\n", - " resources_needed\n", - " how_found\n", - " references\n", - " incident_ids\n", - " tactic\n", - " responsetype\n", - " notes\n", - " techniques\n", + " sector_ids\n", + " framework_ids\n", " longname\n", - " tactic_id\n", - " tactic_name\n", - " metatechnique_id\n", - " metatechnique_name\n", " \n", " \n", " \n", " \n", " 0\n", - " C00006\n", - " Charge for social media\n", - " M004 - friction\n", - " Include a paid-for privacy option, e.g. pay Fa...\n", - " A033 - social media platform owner\n", - " \n", - " 2019-11-workshop\n", - " \n", - " \n", - " TA01 Strategic Planning\n", - " D2 Deny\n", - " \n", - " T0007 - Create fake Social Media Profiles / Pa...\n", - " C00006 - Charge for social media\n", - " TA01\n", - " Strategic Planning\n", - " M004\n", - " - friction\n", + " A001\n", + " data scientist\n", + " Person who can wrangle data, implement machine...\n", + " S001, S002, S003, S004, S005, S006, S007, S008...\n", + " FW01, FW02\n", + " A001 - data scientist\n", " \n", " \n", " 1\n", - " C00008\n", - " Create shared fact-checking database\n", - " M006 - scoring\n", - " Share fact-checking resources - tips, response...\n", - " A007 - factchecker\n", - " \n", - " 2019-11-workshop\\n2019-11-search\n", - " \n", - " I00049,I00050\n", - " TA01 Strategic Planning\n", - " D4 Degrade\n", - " \n", - " T0001 - 5Ds (dismiss, distort, distract, disma...\n", - " C00008 - Create shared fact-checking database\n", - " TA01\n", - " Strategic Planning\n", - " M006\n", - " - scoring\n", + " A002\n", + " target\n", + " Person being targeted by disinformation campaign\n", + " S001, S002, S003, S004, S005, S006, S007, S008...\n", + " FW02\n", + " A002 - target\n", " \n", " \n", " 2\n", - " C00009\n", - " Educate high profile influencers on best pract...\n", - " M001 - resilience\n", - " Find online influencers. Provide training in t...\n", - " A016 - influencer,A006 - educator\n", - " \n", - " 2019-11-workshop\n", - " \n", - " \n", - " TA02 Objective Planning\n", - " D2 Deny\n", - " \n", - " T0010 - Cultivate ignorant agents\\nT0039 - Bai...\n", - " C00009 - Educate high profile influencers on b...\n", - " TA02\n", - " Objective Planning\n", - " M001\n", - " - resilience\n", + " A003\n", + " trusted authority\n", + " Influencer\n", + " S001, S002, S003, S004, S005, S006, S007, S008...\n", + " FW01, FW02\n", + " A003 - trusted authority\n", " \n", " \n", " 3\n", - " C00010\n", - " Enhanced privacy regulation for social media\n", - " M004 - friction\n", - " Implement stronger privacy standards, to reduc...\n", - " A020 - policy maker\n", + " A004\n", + " activist\n", " \n", - " 2019-11-workshop\n", - " \n", - " \n", - " TA01 Strategic Planning\n", - " D2 Deny\n", - " \n", - " T0005 - Center of gravity analysis\\nT0018 - Pa...\n", - " C00010 - Enhanced privacy regulation for socia...\n", - " TA01\n", - " Strategic Planning\n", - " M004\n", - " - friction\n", + " S002\n", + " FW02\n", + " A004 - activist\n", " \n", " \n", " 4\n", - " C00011\n", - " Media literacy. Games to identify fake news\n", - " M001 - resilience\n", - " Create and use games to show people the mechan...\n", - " A006 - educator,A026 - games designer,A024 - d...\n", + " A005\n", + " community group\n", " \n", - " 2019-11-workshop\n", - " \n", - " \n", - " TA02 Objective Planning\n", - " D2 Deny\n", - " \n", - " T0001 - 5Ds (dismiss, distort, distract, disma...\n", - " C00011 - Media literacy. Games to identify fak...\n", - " TA02\n", - " Objective Planning\n", - " M001\n", - " - resilience\n", + " S002\n", + " FW02\n", + " A005 - community group\n", " \n", " \n", - " ...\n", - " ...\n", - " ...\n", - " ...\n", - " ...\n", - " ...\n", - " ...\n", - " ...\n", - " ...\n", - " ...\n", - " ...\n", - " ...\n", - " ...\n", - " ...\n", - " ...\n", - " ...\n", - " ...\n", - " ...\n", - " ...\n", + " 5\n", + " A006\n", + " educator\n", + " \n", + " S002\n", + " FW02\n", + " A006 - educator\n", " \n", " \n", - " 135\n", - " C00219\n", - " Add metadata to content that’s out of the cont...\n", - " M003 - daylight\n", - " Steganography. Adding date, signatures etc to ...\n", - " \n", - " \n", - " grugq\n", - " \n", - " \n", - " TA06 Develop Content\n", - " D4 Degrade\n", - " \n", - " T0024 - Create fake videos and images\\nT0026 -...\n", - " C00219 - Add metadata to content that’s out of...\n", - " TA06\n", - " Develop Content\n", - " M003\n", - " - daylight\n", + " 6\n", + " A007\n", + " factchecker\n", + " Someone with the skills to verify whether info...\n", + " S002\n", + " FW02\n", + " A007 - factchecker\n", " \n", " \n", - " 136\n", - " C00220\n", - " Develop a monitoring and intelligence plan\n", - " M007 - metatechnique\n", - " Create a plan for misinformation and disinform...\n", + " 7\n", + " A008\n", + " library\n", " \n", - " \n", - " Counters cleanup\n", - " \n", - " \n", - " TA01 Strategic Planning\n", - " D3 Disrupt\n", - " \n", - " \n", - " C00220 - Develop a monitoring and intelligence...\n", - " TA01\n", - " Strategic Planning\n", - " M007\n", - " - metatechnique\n", + " S002\n", + " FW02\n", + " A008 - library\n", " \n", " \n", - " 137\n", - " C00221\n", - " Run a disinformation red team, and design miti...\n", - " M007 - metatechnique\n", - " Include PACE plans - Primary, Alternate, Conti...\n", + " 8\n", + " A009\n", + " NGO\n", " \n", - " \n", - " Counters cleanup\n", - " \n", - " \n", - " TA01 Strategic Planning\n", - " D3 Disrupt\n", - " \n", - " \n", - " C00221 - Run a disinformation red team, and de...\n", - " TA01\n", - " Strategic Planning\n", - " M007\n", - " - metatechnique\n", + " S002\n", + " FW02\n", + " A009 - NGO\n", " \n", " \n", - " 138\n", - " C00222\n", - " Tabletop simulations\n", - " M007 - metatechnique\n", - " Simulate misinformation and disinformation cam...\n", + " 9\n", + " A010\n", + " religious organisation\n", " \n", - " \n", - " \n", - " \n", - " \n", - " TA02 Objective Planning\n", - " D3 Disrupt\n", - " \n", - " \n", - " C00222 - Tabletop simulations\n", - " TA02\n", - " Objective Planning\n", - " M007\n", - " - metatechnique\n", + " S002\n", + " FW02\n", + " A010 - religious organisation\n", " \n", " \n", - " 139\n", - " C00223\n", - " Strengthen Trust in social media platforms\n", - " M001 - resilience\n", - " Improve trust in the misinformation responses ...\n", + " 10\n", + " A011\n", + " school\n", " \n", + " S002\n", + " FW02\n", + " A011 - school\n", + " \n", + " \n", + " 11\n", + " A012\n", + " account owner\n", + " Anyone who owns an account online\n", + " S006\n", + " FW01\\nFW02\n", + " A012 - account owner\n", + " \n", + " \n", + " 12\n", + " A013\n", + " content creator\n", " \n", + " S006\n", + " FW01\\nFW02\n", + " A013 - content creator\n", + " \n", + " \n", + " 13\n", + " A014\n", + " elves\n", " \n", + " S006\n", + " FW02\n", + " A014 - elves\n", + " \n", + " \n", + " 14\n", + " A015\n", + " general public\n", " \n", + " S006\n", + " FW02\n", + " A015 - general public\n", + " \n", + " \n", + " 15\n", + " A016\n", + " influencer\n", " \n", - " TA01 Strategic Planning\n", - " D3 Disrupt\n", + " S006\n", + " FW01\\nFW02\n", + " A016 - influencer\n", + " \n", + " \n", + " 16\n", + " A017\n", + " coordinating body\n", + " For example the DHS\n", + " S003\n", + " FW02\n", + " A017 - coordinating body\n", + " \n", + " \n", + " 17\n", + " A018\n", + " government\n", + " Government agencies\n", + " S003\n", + " FW01\\nFW02\n", + " A018 - government\n", + " \n", + " \n", + " 18\n", + " A019\n", + " military\n", " \n", + " S003\n", + " FW02\n", + " A019 - military\n", + " \n", + " \n", + " 19\n", + " A020\n", + " policy maker\n", " \n", - " C00223 - Strengthen Trust in social media plat...\n", - " TA01\n", - " Strategic Planning\n", - " M001\n", - " - resilience\n", + " S003\n", + " FW02\n", + " A020 - policy maker\n", + " \n", + " \n", + " 20\n", + " A021\n", + " media organisation\n", + " \n", + " S010\n", + " FW01\\nFW02\n", + " A021 - media organisation\n", + " \n", + " \n", + " 21\n", + " A022\n", + " company\n", + " \n", + " S009\n", + " FW02\n", + " A022 - company\n", + " \n", + " \n", + " 22\n", + " A023\n", + " adtech provider\n", + " \n", + " S008\n", + " FW02\n", + " A023 - adtech provider\n", + " \n", + " \n", + " 23\n", + " A024\n", + " developer\n", + " \n", + " S008\n", + " FW02\n", + " A024 - developer\n", + " \n", + " \n", + " 24\n", + " A025\n", + " funding_site_admin\n", + " Funding site admin\n", + " S008\n", + " FW02\n", + " A025 - funding_site_admin\n", + " \n", + " \n", + " 25\n", + " A026\n", + " games designer\n", + " \n", + " S008\n", + " FW01, FW02\n", + " A026 - games designer\n", + " \n", + " \n", + " 26\n", + " A027\n", + " information security\n", + " \n", + " S008\n", + " FW02\n", + " A027 - information security\n", + " \n", + " \n", + " 27\n", + " A028\n", + " platform administrator\n", + " \n", + " S008\n", + " FW02\n", + " A028 - platform administrator\n", + " \n", + " \n", + " 28\n", + " A029\n", + " server admininistrator\n", + " \n", + " S008\n", + " FW02\n", + " A029 - server admininistrator\n", + " \n", + " \n", + " 29\n", + " A030\n", + " platforms\n", + " \n", + " S007\n", + " FW02\n", + " A030 - platforms\n", + " \n", + " \n", + " 30\n", + " A031\n", + " social media platform adminstrator\n", + " Person with the authority to make changes to a...\n", + " S007\n", + " FW02\n", + " A031 - social media platform adminstrator\n", + " \n", + " \n", + " 31\n", + " A032\n", + " social media platform outreach\n", + " \n", + " S007\n", + " FW02\n", + " A032 - social media platform outreach\n", + " \n", + " \n", + " 32\n", + " A033\n", + " social media platform owner\n", + " Person with authority to make changes to a soc...\n", + " S007\n", + " FW02\n", + " A033 - social media platform owner\n", " \n", " \n", "\n", - "

140 rows × 18 columns

\n", "" ], "text/plain": [ - " amitt_id name \\\n", - "0 C00006 Charge for social media \n", - "1 C00008 Create shared fact-checking database \n", - "2 C00009 Educate high profile influencers on best pract... \n", - "3 C00010 Enhanced privacy regulation for social media \n", - "4 C00011 Media literacy. Games to identify fake news \n", - ".. ... ... \n", - "135 C00219 Add metadata to content that’s out of the cont... \n", - "136 C00220 Develop a monitoring and intelligence plan \n", - "137 C00221 Run a disinformation red team, and design miti... \n", - "138 C00222 Tabletop simulations \n", - "139 C00223 Strengthen Trust in social media platforms \n", + " amitt_id name \\\n", + "0 A001 data scientist \n", + "1 A002 target \n", + "2 A003 trusted authority \n", + "3 A004 activist \n", + "4 A005 community group \n", + "5 A006 educator \n", + "6 A007 factchecker \n", + "7 A008 library \n", + "8 A009 NGO \n", + "9 A010 religious organisation \n", + "10 A011 school \n", + "11 A012 account owner \n", + "12 A013 content creator \n", + "13 A014 elves \n", + "14 A015 general public \n", + "15 A016 influencer \n", + "16 A017 coordinating body \n", + "17 A018 government \n", + "18 A019 military \n", + "19 A020 policy maker \n", + "20 A021 media organisation \n", + "21 A022 company \n", + "22 A023 adtech provider \n", + "23 A024 developer \n", + "24 A025 funding_site_admin \n", + "25 A026 games designer \n", + "26 A027 information security \n", + "27 A028 platform administrator \n", + "28 A029 server admininistrator \n", + "29 A030 platforms \n", + "30 A031 social media platform adminstrator \n", + "31 A032 social media platform outreach \n", + "32 A033 social media platform owner \n", "\n", - " metatechnique summary \\\n", - "0 M004 - friction Include a paid-for privacy option, e.g. pay Fa... \n", - "1 M006 - scoring Share fact-checking resources - tips, response... \n", - "2 M001 - resilience Find online influencers. Provide training in t... \n", - "3 M004 - friction Implement stronger privacy standards, to reduc... \n", - "4 M001 - resilience Create and use games to show people the mechan... \n", - ".. ... ... \n", - "135 M003 - daylight Steganography. Adding date, signatures etc to ... \n", - "136 M007 - metatechnique Create a plan for misinformation and disinform... \n", - "137 M007 - metatechnique Include PACE plans - Primary, Alternate, Conti... \n", - "138 M007 - metatechnique Simulate misinformation and disinformation cam... \n", - "139 M001 - resilience Improve trust in the misinformation responses ... \n", + " summary \\\n", + "0 Person who can wrangle data, implement machine... \n", + "1 Person being targeted by disinformation campaign \n", + "2 Influencer \n", + "3 \n", + "4 \n", + "5 \n", + "6 Someone with the skills to verify whether info... \n", + "7 \n", + "8 \n", + "9 \n", + "10 \n", + "11 Anyone who owns an account online \n", + "12 \n", + "13 \n", + "14 \n", + "15 \n", + "16 For example the DHS \n", + "17 Government agencies \n", + "18 \n", + "19 \n", + "20 \n", + "21 \n", + "22 \n", + "23 \n", + "24 Funding site admin \n", + "25 \n", + "26 \n", + "27 \n", + "28 \n", + "29 \n", + "30 Person with the authority to make changes to a... \n", + "31 \n", + "32 Person with authority to make changes to a soc... \n", "\n", - " actortypes resources_needed \\\n", - "0 A033 - social media platform owner \n", - "1 A007 - factchecker \n", - "2 A016 - influencer,A006 - educator \n", - "3 A020 - policy maker \n", - "4 A006 - educator,A026 - games designer,A024 - d... \n", - ".. ... ... \n", - "135 \n", - "136 \n", - "137 \n", - "138 \n", - "139 \n", + " sector_ids framework_ids \\\n", + "0 S001, S002, S003, S004, S005, S006, S007, S008... FW01, FW02 \n", + "1 S001, S002, S003, S004, S005, S006, S007, S008... FW02 \n", + "2 S001, S002, S003, S004, S005, S006, S007, S008... FW01, FW02 \n", + "3 S002 FW02 \n", + "4 S002 FW02 \n", + "5 S002 FW02 \n", + "6 S002 FW02 \n", + "7 S002 FW02 \n", + "8 S002 FW02 \n", + "9 S002 FW02 \n", + "10 S002 FW02 \n", + "11 S006 FW01\\nFW02 \n", + "12 S006 FW01\\nFW02 \n", + "13 S006 FW02 \n", + "14 S006 FW02 \n", + "15 S006 FW01\\nFW02 \n", + "16 S003 FW02 \n", + "17 S003 FW01\\nFW02 \n", + "18 S003 FW02 \n", + "19 S003 FW02 \n", + "20 S010 FW01\\nFW02 \n", + "21 S009 FW02 \n", + "22 S008 FW02 \n", + "23 S008 FW02 \n", + "24 S008 FW02 \n", + "25 S008 FW01, FW02 \n", + "26 S008 FW02 \n", + "27 S008 FW02 \n", + "28 S008 FW02 \n", + "29 S007 FW02 \n", + "30 S007 FW02 \n", + "31 S007 FW02 \n", + "32 S007 FW02 \n", "\n", - " how_found references incident_ids \\\n", - "0 2019-11-workshop \n", - "1 2019-11-workshop\\n2019-11-search I00049,I00050 \n", - "2 2019-11-workshop \n", - "3 2019-11-workshop \n", - "4 2019-11-workshop \n", - ".. ... ... ... \n", - "135 grugq \n", - "136 Counters cleanup \n", - "137 Counters cleanup \n", - "138 \n", - "139 \n", - "\n", - " tactic responsetype notes \\\n", - "0 TA01 Strategic Planning D2 Deny \n", - "1 TA01 Strategic Planning D4 Degrade \n", - "2 TA02 Objective Planning D2 Deny \n", - "3 TA01 Strategic Planning D2 Deny \n", - "4 TA02 Objective Planning D2 Deny \n", - ".. ... ... ... \n", - "135 TA06 Develop Content D4 Degrade \n", - "136 TA01 Strategic Planning D3 Disrupt \n", - "137 TA01 Strategic Planning D3 Disrupt \n", - "138 TA02 Objective Planning D3 Disrupt \n", - "139 TA01 Strategic Planning D3 Disrupt \n", - "\n", - " techniques \\\n", - "0 T0007 - Create fake Social Media Profiles / Pa... \n", - "1 T0001 - 5Ds (dismiss, distort, distract, disma... \n", - "2 T0010 - Cultivate ignorant agents\\nT0039 - Bai... \n", - "3 T0005 - Center of gravity analysis\\nT0018 - Pa... \n", - "4 T0001 - 5Ds (dismiss, distort, distract, disma... \n", - ".. ... \n", - "135 T0024 - Create fake videos and images\\nT0026 -... \n", - "136 \n", - "137 \n", - "138 \n", - "139 \n", - "\n", - " longname tactic_id \\\n", - "0 C00006 - Charge for social media TA01 \n", - "1 C00008 - Create shared fact-checking database TA01 \n", - "2 C00009 - Educate high profile influencers on b... TA02 \n", - "3 C00010 - Enhanced privacy regulation for socia... TA01 \n", - "4 C00011 - Media literacy. Games to identify fak... TA02 \n", - ".. ... ... \n", - "135 C00219 - Add metadata to content that’s out of... TA06 \n", - "136 C00220 - Develop a monitoring and intelligence... TA01 \n", - "137 C00221 - Run a disinformation red team, and de... TA01 \n", - "138 C00222 - Tabletop simulations TA02 \n", - "139 C00223 - Strengthen Trust in social media plat... TA01 \n", - "\n", - " tactic_name metatechnique_id metatechnique_name \n", - "0 Strategic Planning M004 - friction \n", - "1 Strategic Planning M006 - scoring \n", - "2 Objective Planning M001 - resilience \n", - "3 Strategic Planning M004 - friction \n", - "4 Objective Planning M001 - resilience \n", - ".. ... ... ... \n", - "135 Develop Content M003 - daylight \n", - "136 Strategic Planning M007 - metatechnique \n", - "137 Strategic Planning M007 - metatechnique \n", - "138 Objective Planning M007 - metatechnique \n", - "139 Strategic Planning M001 - resilience \n", - "\n", - "[140 rows x 18 columns]" + " longname \n", + "0 A001 - data scientist \n", + "1 A002 - target \n", + "2 A003 - trusted authority \n", + "3 A004 - activist \n", + "4 A005 - community group \n", + "5 A006 - educator \n", + "6 A007 - factchecker \n", + "7 A008 - library \n", + "8 A009 - NGO \n", + "9 A010 - religious organisation \n", + "10 A011 - school \n", + "11 A012 - account owner \n", + "12 A013 - content creator \n", + "13 A014 - elves \n", + "14 A015 - general public \n", + "15 A016 - influencer \n", + "16 A017 - coordinating body \n", + "17 A018 - government \n", + "18 A019 - military \n", + "19 A020 - policy maker \n", + "20 A021 - media organisation \n", + "21 A022 - company \n", + "22 A023 - adtech provider \n", + "23 A024 - developer \n", + "24 A025 - funding_site_admin \n", + "25 A026 - games designer \n", + "26 A027 - information security \n", + "27 A028 - platform administrator \n", + "28 A029 - server admininistrator \n", + "29 A030 - platforms \n", + "30 A031 - social media platform adminstrator \n", + "31 A032 - social media platform outreach \n", + "32 A033 - social media platform owner " ] }, - "execution_count": 3, + "execution_count": 2, "metadata": {}, "output_type": "execute_result" } ], "source": [ - "amitt.df_counters" + "amitt.df_actortypes" ] }, { diff --git a/HTML_GENERATING_CODE/.ipynb_checkpoints/Find_warning_text-checkpoint.ipynb b/HTML_GENERATING_CODE/.ipynb_checkpoints/Find_warning_text-checkpoint.ipynb new file mode 100644 index 0000000..1027598 --- /dev/null +++ b/HTML_GENERATING_CODE/.ipynb_checkpoints/Find_warning_text-checkpoint.ipynb @@ -0,0 +1,522 @@ +{ + "cells": [ + { + "cell_type": "markdown", + "metadata": {}, + "source": [ + "# Find warning text in AMITT generated files" + ] + }, + { + "cell_type": "code", + "execution_count": 21, + "metadata": { + "scrolled": true + }, + "outputs": [ + { + "name": "stdout", + "output_type": "stream", + "text": [ + "warning text in counter C00066\n", + "warning text in incident I00002\n", + "warning text in incident I00053\n", + "warning text in incident I00032\n", + "warning text in incident I00063\n", + "warning text in incident I00006\n", + "warning text in incident I00047\n", + "warning text in incident I00022\n", + "warning text in incident I00033\n", + "warning text in incident I00062\n", + "warning text in incident I00056\n", + "warning text in incident I00007\n", + "warning text in incident I00017\n", + "warning text in incident I00003\n", + "warning text in incident I00042\n", + "warning text in incident I00008\n", + "warning text in incident I00049\n", + "warning text in incident I00039\n", + "warning text in incident I00029\n", + "warning text in incident I00009\n", + "warning text in incident I00019\n", + "warning text in incident I00004\n", + "warning text in incident I00045\n", + "warning text in incident I00051\n", + "warning text in incident I00034\n", + "warning text in incident I00010\n", + "warning text in incident I00050\n", + "warning text in incident I00001\n", + "warning text in incident I00035\n", + "warning text in incident I00025\n", + "warning text in incident I00060\n", + "warning text in incident I00005\n", + "warning text in incident I00044\n", + "warning text in incident I00015\n" + ] + }, + { + "data": { + "text/plain": [ + "[['counter',\n", + " 'C00066',\n", + " \"\\n\\nNew content. \\n\\nIf a group has the ability - e.g. enough dedicated person-hours - it can hijack the artifacts and narratives of a disinformation incident, by flooding them with counter-content. This has been seen in the past as accidental hashtag flooding - e.g. a new disinformation hashtag was unknowingly chosen that was the same as a children's swim team, which became active during a swim meet. In 2020, kPop stans flooded disinformation-carrying hashtags including #whitelivesmatter, and gay men flooded the #proudboys hashtag. \\n\\nThis is an example of a countertechnique that mirrors an existing disinformation technique - in this case T0049. \\n\"],\n", + " ['incident',\n", + " 'I00002',\n", + " '\\n\\nActor: IRA, individuals (e.g. Larry Cook).\\n\\nTimeframe: \\n\\nDate: \\n\\nPresumed goals:\\nPhysical damage to country? \\n\\nMethod: \\n\\n* Targetted facebook ads (Larry Cook, targetting Washington State mothers, $1,776 to boost posts over 9 months). \\n* Gofundme campaigns to pay for ads (Larry Cook)\\n\\nEffects:\\n\\n* “The U.S. anti-vax movement has been blamed for two outbreaks of measles that have infected some 300 people—mostly children—in New York and the Pacific Northwest.”\\n\\nCounters:\\n\\n* American Medical Association “warned social-media giants, including Amazon, Facebook, Google, Pinterest, Twitter, and YouTube, that they were helping to amplify the propaganda and confuse parents.”\\n* Gofundme banned antivaxxers: “Campaigns raising money to promote misinformation about vaccines violate GoFundMe’s terms of service and will be removed from the platform”. Less than 10 campaigns reported as removed.\\n\\nRelated incidents:\\n\\nArtefacts:\\n\\nSearch terms vaccination, anti-vaccination, “vaccine choice”. \\n\\nNotes:\\n\\nStarted by looking for vaccine-related content in my misinformation datasets\\nThen did google search for “antivax misinformation” to get references etc. \\nLarry Cook runs “Stop Mandatory Vaccination”: “donations go “directly” to his bank account and funds “may be used to pay [his] personal bills.”\\n\\n\\nReferences;\\n\\n* https://www.thedailybeast.com/brooklyn-hasidic-community-is-in-the-midst-of-a-dire-measles-outbreak\\n* https://www.thedailybeast.com/amazon-wont-take-a-stand-in-war-over-forrest-maready-book-the-autism-vaccine\\n* https://www.bmj.com/content/362/bmj.k3739\\n* https://hub.jhu.edu/2018/08/24/russian-trolls-bots-spread-vaccine-misinformation/\\n* https://ajph.aphapublications.org/doi/full/10.2105/AJPH.2018.304567 \\n* Arciga, [GoFundMe Bans Anti-Vaxxers Who Raise Money to Spread Misinformation](https://www.thedailybeast.com/gofundme-bans-anti-vaxxers-who-raise-money-to-spread-misinformation), Daily Beast 2019-03-22\\n* Arciga, [Anti-Vaxxer Larry Cook Has Weaponized Facebook Ads in War Against Science](https://www.thedailybeast.com/anti-vaxxer-larry-cook-has-weaponized-facebook-ads-in-war-against-science), Daily Beast 2019-02-15\\n* Gofundmes (removed, but check archives) https://www.gofundme.com/help-save-vaccine-exemptions-in-washington-state https://www.gofundme.com/parents-wake-up-vaccines-kill \\n* Markay, [Anti-Vaccine Facebook Ads Target Women in Measles-Stricken States](https://www.thedailybeast.com/anti-vaccine-facebook-ads-target-women-in-measles-stricken-states/), Daily Beast 2019-02-14\\n\\nData\\n\\n\\n'],\n", + " ['incident',\n", + " 'I00053',\n", + " '\\n\\nActor: China\\n\\nTimeframe: December 5, 2018 - still active on 04/03/2019\\n\\nDate: December 5, 2018\\n\\nPresumed goals: \\n\\n* Unlike Russia, Chinese state has employed a plethora of state-run media to exploit the openness of American democratic society in an effort to insert an intentionally distorted and biased narrative portraying a utopian view of the Chinese government and party. \\n\\nMethod: \\n\\n* China’s state-run social media operations are largely positive and coordinated because those techniques support Chinese strategic goals. State-run media seeds foreign influence environment\\n* Distorted, saccharine “news” about the Chinese State and Party\\n* Events coordinated and promoted across media platforms\\n* Extend from digital into physical space with gatherings, ie: support for Meng outside courthouse\\n\\n* In the case of Chinese state-run information manipulation campaigns — to distinguish the political intent and national strategies underlying these campaigns as different from simply another perspective on the news. China also play’s victim, innocence, plays by rules, misunderstood narrative… they too have their version of the 4D’s. Examples: “Chinese ambassador Lu Shaye has accused Canada of applying a double standard, and has decried what he sees as “Western egotism and white supremacy” in the treatment of detained Huawei executive Meng Wanzhou.” - Op-Ed in Globe & Mail. The Chinese embassy in Canada says the Vancouver arrest of a top Huawei executive amounts to a “political conspiracy” to undermine the telecom giant and it dismisses Prime Minister Justin Trudeau’s assertion that he had no role in the high-profile case. Canada\\'s arrest of a senior Huawei executive was the \"backstabbing\" of a friend, Chinese ambassador Lu Shaye said Thursday, and he warned of repercussions if the federal government bars her telecom company from building a Canadian 5G network.\\n\\nCounters: none identified/researched\\n\\nRelated incidents: \\n\\n* See Poland (arrest of Huawei employee); Czech republic; \\n* Five Eyes to ban or not ban Huawei 5G network equipment \\n\\n\\nReferences: \\n\\n* https://www.theglobeandmail.com/politics/article-chinas-envoy-says-white-supremacy-played-part-in-canadas-arrest-of/\\n* https://twitter.com/globaltimesnews\\n* https://twitter.com/UserExperienceU\\n* https://www.universityworldnews.com/post.php?story=20190125061623487\\n* https://www.theglobeandmail.com/business/article-canadian-universities-continuing-rd-funding-partnerships-with/\\n* http://fortune.com/2019/01/18/oxford-university-huawei-research-funding/\\n* https://www.reuters.com/article/us-usa-china-security-universities-insig/u-s-universities-unplug-from-chinas-huawei-under-pressure-from-trump-idUSKCN1PI0GV\\n\\n\\n* Beyond Hybrid War: How China Exploits Social Media to Sway American Opinion\\nhttps://www.theglobeandmail.com/politics/article-china-says-arrest-of-huawei-cfo-part-of-political-conspiracy-by/\\n* https://www.theatlantic.com/international/archive/2019/03/czech-zeman-babis-huawei-xi-trump/584158\\n* https://www.defenseone.com/technology/2019/04/installing-chinese-5g-gear-dangerous-and-probably-inevitable-nato-report/156007/?oref=defenseone_today_nl\\n* https://www.ctvnews.ca/politics/canada-s-arrest-of-huawei-exec-an-act-of-backstabbing-chinese-ambassador-says-1.4258201\\n* https://www.cnn.com/2019/01/09/asia/china-canada-meng-huawei-intl/index.html\\n* https://www.theglobeandmail.com/opinion/article-on-china-has-canada-lost-its-sense-of-justice/\\n* https://portswigger.net/daily-swig/proper-news-or-propaganda-chinas-social-media-manipulations-exposed\\n* https://globalnews.ca/news/4758109/china-bully-canada-release-huawei-cfo/\\n* https://www.ctvnews.ca/canada/canada-will-pay-chinese-state-media-threaten-repercussions-over-huawei-arrest-1.4216293\\n* https://business.financialpost.com/telecom/inside-huaweis-rather-awkward-charm-offensive-to-convince-the-world-its-ok\\n* https://www.scmp.com/comment/letters/article/3001272/despite-us-allegations-huawei-has-done-nothing-wrong-why-should-it\\n\\nDatasets: none identified (mining more Twitter data, Reddit, and comment forums could be valuable research)\\n\\nNotes: \\n\\nWhile a hypothesis and not related to Meng’s arrest, research done by John Gray (using Mentionmapp data from January 13, 2019) also suggests the need to look at adjecent/tangential flow of social data. In this case (could be coincidence) simutatneaous flow of tweets via State Media @globaltimesnews (reporting on Poland arrest) and of “influencer” (using bots to amplify content) @UserExperienceU tweeting favorable about Huawei technology. Need to consider the amplifiers/influencers operate to support/put the happy face on Huawei. More work needs to be done researching social behavior outside the “Great Firewall” using trolls, bots, cyborgs, and “willing/unwitting” idiots. Just like Russia, we also need to give more consideration to how bots/automation (low-volume in particular) is operating to amplify State Media in order to gain higher fidelity in search engines. \\n\\nWe should also recognize another form of Huawei/China manipulation in the form of research programs in Universities across North America and Europe\\nhttps://www.universityworldnews.com/post.php?story=20190125061623487\\nhttps://www.theglobeandmail.com/business/article-canadian-universities-continuing-rd-funding-partnerships-with/\\nfortune.com/2019/01/18/oxford-university-huawei-research-funding/\\nhttps://www.reuters.com/article/us-usa-china-security-universities-insig/u-s-universities-unplug-from-chinas-huawei-under-pressure-from-trump-idUSKCN1PI0GV\\n\\nTimeline of events\\n\\nDec. 6: China demands Canada release Meng and “immediately correct the mistake” officials made in arresting her. The Chinese also say they were not briefed on the reasons for Meng’s arrest.\\nIn Ottawa, Prime Minister Justin Trudeau says Meng’s case is part of an independent legal process with no outside political influence.\\nDec. 7: In Vancouver, Meng appears in court, where allegations of fraud are laid out. The U.S. alleges Meng misled American banks in a bid to get around American sanctions on Iran.\\nDec. 8: Canada’s ambassador to China, John McCallum, is summoned to a meeting with China’s assistant foreign minister so the country can register complaints about Meng’s arrest. “China strongly urges the Canadian side to immediately release the detained Huawei executive … or face grave consequences that the Canadian side should be held accountable for,” the assistant minister, Le Yucheng, says in a statement.\\n\\nDec. 12: China’s foreign ministry says it has no information about Kovrig, but says the organization he worked with – the International Crisis Group – was not registered in China, making its activities in the country illegal.\\n\\nDec. 13: China’s foreign ministry says Kovrig and Spavor have been detained on suspicion of “endangering national security.”\\n\\nDec. 20: Indictments unsealed in the United States allege two Chinese citizens targeted companies in Canada and around the world as part of a years-long hacking campaign to steal data.\\n\\nDec. 24: China’s foreign ministry calls out the U.S., Britain and EU, saying the trio should be condemning Canada for Meng’s arrest. Spokeswoman Hua Chunying says Canada should “correct its mistakes” and stop acting at the behest of the United States. She says Kovrig and Spavor’s rights are being respected in custody.\\n\\nJan. 9: China’s envoy in Ottawa suggests Canada and its Western allies are white supremacists for calling for the release of two Canadians imprisoned last month by his country’s communist government. Ambassador Lu Shaye makes the accusation in an op-ed in the Hill Times.\\n\\nJan. 15: China expresses its “strong dissatisfaction” with Trudeau over his criticism of Schellenberg’s sentence. Trudeau should “respect the rule of law, respect China’s judicial sovereignty, correct mistakes and stop making irresponsible remarks,” foreign ministry spokeswoman Hua Chunying says.\\n\\nJan. 17: Ambassador Shaye says Canada’s arrest of Meng was an act of “backstabbing” by a friend. Lu warns of “repercussions” if Canada bars the firm from its new 5G network for security reasons, as have three of its intelligence-sharing allies.\\n\\nJan. 22: China demands the U.S. drop a request that Canada extradite Meng. Foreign Ministry spokeswoman Hua Chunying said Meng’s case was out of the ordinary and Canada’s extradition treaty with the U.S. infringed on the “safety and legitimate rights and interests of Chinese citizens.”\\nJan. 28: The U.S. Department of Justice formally levels criminal charges against Huawei, two subsidiaries and Meng. The charges, contained in two newly unsealed indictments, allege that Huawei misrepresented its ownership of a Hong Kong-based subsidiary to circumvent American sanctions against Iran. Furthermore, they say Huawei stole telecommunications technology, trade secrets and equipment from U.S. cellphone provider T-Mobile USA. Meng is charged with bank fraud, wire fraud and two counts of conspiracy to commit both. In a statement, Huawei denied committing any of the violations cited in the indictment.\\n\\nJan. 29:China calls on the U.S. to “stop the unreasonable crackdown” on Huawei, saying it will “firmly defend” its companies.\\n\\nMarch 6: A lawyer for Meng tells a judge the United States’ bid for extradition raises serious concerns about the political motivations behind the case as the matter is scheduled to return to court on May 8 to set hearing dates.\\n\\n\\n'],\n", + " ['incident',\n", + " 'I00032',\n", + " '\\n\\nSummary: \\n\\nActors: \\n\\n* IRA; other Russian state actors; \\n* Roger Stone, Alex Jones, gamergaters\\n\\nTimeframe: Fall 2018\\n\\nDate: September-October 2018\\n\\nPresumed goals: \\n\\n* Divide the American public on gender and party lines; Harass and intimidate anti-Trump voices; \\n* Promote epistemic confusion; \\n* Seed the narrative terrain for future operations; \\n* Promote “both sides” relativism; \\n\\nMethod: \\n\\n* Amplify extreme and hyper-partisan rhetoric; \\n* Promote divisive conspiracy theories; \\n* Re-up debunked theories in new contexts (e.g. hashtags); \\n* Re-center debates on emotional, rather than rational, content; \\n* Alter “ground-truth” resources, such as Wikipedia\\n\\nCounters: None / Media exposure\\n\\nRelated incidents: \\n\\n* gamergate; \\n* 2016 election\\n\\nReferences\\n\\n* [Russian trolls and bots are flooding Twitter with Ford-Kavanaugh disinformation](https://qz.com/1409102/russian-trolls-and-bots-are-flooding-twitter-with-ford-kavanaugh-disinformation/)\\n* [Brett Kavanaugh and the information terrorists trying to reshape America](https://www.wired.com/story/information-terrorists-trying-to-reshape-america/)\\n* [How the Kavanaugh information war mirrors real warzones](https://www.wired.com/story/how-the-kavanaugh-information-war-mirrors-real-warzones/)\\n* [How Facebook polarized us during the Kavanaugh hearings](https://www.theverge.com/2018/10/6/17943680/facebook-polarization-kavanaugh-partisan-news-groups)\\n* [Brett Kavanaugh has huge opposition in the U.S. - but Russian state propaganda loves Donald Trump\\'s nominee](https://www.newsweek.com/brett-kavanaugh-has-huge-opposition-us-russian-state-propaganda-loves-donald-1155046)\\n\\nDetails\\n\\nLast month, the attorney of Christine Blasey Ford, the California professor who has accused Supreme Court nominee Brett Kavanaugh of sexual assault at a long-ago high school party, revealed that Blasey Ford and her family were in hiding and had hired private security after Blasey Ford received death threats over email and social media. Among those cheering on the hate-trollers were many familiar faces from the sewers of the modern far-right disinformation metropolis: dandified Republican rogue (and likely Mueller investigee) Roger Stone, his alt-media protégés Mike Cernovich and Jack Posobiec, anarchist turned Kremlin propaganda employee turned Bernie backer turned Trump backer Cassandra Fairbanks, and breathless Infowars conspiracist-in-chief Alex Jones. And not surprisingly, alt-right super-troll Chuck Johnson had his own connection to players in the scandal.\\n\\nThis is an operational unit of information terrorists helping to transform the way Americans consume news in the age of Trump—some of the central nodes that give order to the information deluge and around which bot armies and human amplification networks can be organized, wiped out, reconstituted, and armed for attack.\\n\\nThe attacks on Blasey Ford aimed to discredit and silence her using the same tactics that have been deployed to discredit and silence others over the past few years. As others have come forward to accuse Kavanaugh of wrongdoing—including Deborah Ramirez and Julie Swetnick—they have been similarly harassed and smeared by the same machinery and themes.\\n\\nOnline Twitter accounts tied to Russia are heavily involved in discussing the Supreme Court nominee and allegations against him online. Hamilton68, a project run by the German Marshall Fund think tank that tracks tweets “tied to Russia-linked influence networks,” listed Kavanaugh, Trump, the FBI, and Ford as the top four topics mentioned by Russia-linked accounts on the evening of Oct.1.\\n\\nThe Russia-linked accounts are largely lending their support to Kavanaugh, says Jonathon Morgan, CEO of New Knowledge, the company that built the software behind Hamilton68. Morgan, who is currently tracking a set of around 1,000 accounts he believes are tied to Russia, says the Kavanaugh hearings have unleashed more US domestic-focused propaganda from foreign-linked networks than his firm has seen in months.\\n\\nPosts about Ford and Kavanaugh are “really cluttered and confused,” with various pieces of clear fabrication from both sides, says Decker.\\n\\nThe effort to introduce a doppelganger aligned with another key method used in LikeWars around the world: muddying the debate by throwing out alternative theories. Russia has long been the master of this disinformation tactic. After its 2014 shootdown of the MH-17 airliner over Ukraine, for instance, Russia spread over a dozen different theories of what had really happened. Many were contradictory and debunked previous claims. But the goal wasn’t to find the truth—it was to obscure it behind a smokescreen of lies.\\n\\nSimilarly, the Kavanaugh debate has given rise to false claims and ridiculous photoshopped images, often spread under fake identities. There have been debunked rumors that Kavanaugh had ruled against Ford’s parents in a house foreclosure and that Ford’s brother was part of the Russia investigation. There was even a flurry of unsubstantiated sexual assault charges leveled against Kavanaugh in the hours before the hearing. His supporters were outraged; those opposed to Kavanaugh\\'s nomination speculated that they were placed so that his defenders could point to the media’s unreliability and cast doubt on Ford\\'s credibility.\\n\\nThe state-funded outlet RT, which was recently obligated to register its U.S. branch under the Foreign Agents Registration Act, trumpeted the news that the White House had found no proof of sexual misconduct by Kavanaugh after reviewing the findings of a time-limited FBI investigation into the allegations.\\n\\nThe same outlet also called attention to the arrest of several high-profile celebrities, actress and comedian Amy Schumer and model Emily Ratajkowski, who were protesting Kavanaugh’s potential appointment in front of the Supreme Court on Thursday. “Obstruction of Justice?” the outlet asked.\\n\\nPro-Kavanaugh accounts have pushed out false smears aimed at discrediting Ford. One notable anti-Kavanaugh post picked up more than 11,000 retweets while purporting to to cite a Wall Street Journal article that in fact didn’t exist.\\n\\nOther accounts are using popular interest in the Ford-Kavanaugh dispute to push unrelated disinformation. A common tactic is to re-up a conspiracy theory or previously debunked story and add tags related to Kavanaugh so the tweet gains more traction.\\n\\nExamples include re-circulating debunked sexual assault allegations against Democrats like representative Keith Ellison, senator Cory Booker, and former vice president Joe Biden; or against Republicans like senator Lindsey Graham. “Both sides are coopting matters that may have been killed off and never gained traction, and using the Kavanaugh incident to rehash these different claims,” Decker said.\\n\\nMorgan says the Russian bots he’s tracking are largely using this latter method, seemingly with the broad aim of making Kavanaugh seem no worse than Democrats. The approach differs from Russian activity during the 2016 election, where influence campaigns aimed to sow discontent among both liberals and conservatives by pushing propaganda that appealed to both sides.\\n\\nThis has all taken on a new heady energy as pushback to #MeToo—and riding the coattails of the conspiracy bandwagon. But the intent is the same: to demonize the opponent, define identity, activate the base around emotional rather than rational concepts, and build a narrative that can be used to normalize marginal and radical political views. It is, after all, very convenient to have a narrative positing that all your political opponents are part of a secret cabal of sexual predators, which thus exonerates your side by default.\\n\\nDaily Wire’s top story about Kavanaugh confirmation was published Oct. 1 with the headline “Prosecutor Who Questioned Ford Shreds Her Case In Five-Page Memo.” It’s generated more than 205,000 engagements. The site also received just under 180,000 engagements for the story, “Bill Clinton Rape Accuser Juanita Broaddrick Crashes Kavanaugh Hearing, Slams Dems For ‘Biggest Double Standard.’”\\n\\nOccupy Democrats’ top story about Kavanaugh-Ford is headlined “Matt Damon just DESTROYED Kavanaugh and Senate Republicans in hilarious SNL cold open.” It had just under 70,000 engagements. Another story about the Kavanaugh confirmation, “Bernie Sanders just demanded the FBI investigate five lies Kavanaugh told at his hearing,” generated over 44,000 engagements.\\n\\nThis is the ideological landscape that has been so swiftly leveraged in the defense of Brett Kavanaugh.\\n\\nThe cadre and their followers knew exactly what to do when the allegations made against Kavanaugh by Christine Blasey Ford became public. They did not disappoint. Rapid efforts by far-right blogs and personalities to dox and troll Blasey Ford resulted in the targeting of the wrong Christine Blasey Ford; Posobiec was one of those reportedly amping this misguided doxxing. Cernovich said Blasey Ford was a \"far left wing activist\" who had been \"scrubbing\" her social media profile, so her accusations were \"activism.\" Alex Jones made a joke of the whole thing, with Infowars saying Blasey Ford is a \"leftist\" whose accusations were a \"political ploy.\" Fairbanks: \"She can\\'t prove it… Her clothes were on… Fuck that lady.\" That\\'s a particularly strong comment from a one-time anti-rape activist. Stone: \"This is a woman looking for her Anita Hill moment.\"\\n\\nThis is the information that flowed through the architecture the Stone cadre popularized and mainstreamed over the past few years, moving it from the fringe to a central pillar of the conservative agenda, cartoonifying legitimate issues of conservative concern and recruiting new supporters as they went. The narrative was set long ago—allegations are false, men (especially white men) are oppressed, the people who stand against you are corrupt perverts worthy of demonization, and everything that is the America you know will fall apart if you don\\'t fight for some notion of the way things were and should be again. And the best way to achieve this, since the system will fight back, is viciousness.\\n\\nThis architecture is established, and permanently in transmit mode.\\n\\nConsider the now-infamous and disavowed (but archived here) Ed Whelan twitter thread, an odd diversionary narrative hyped as an alternate theory of the night Blasey Ford describes. Its gist: mistaken identity of the perpetrator. Potential defamation issues aside, it seemed to build on the groundwork being laid by Senate Republicans and the White House to carefully insinuate that Blasey Ford wasn\\'t lying, merely mistaken about who attacked her. But Whelan transformed it into a bonkers Twitterverse conspiracy theory about the bedroom at the top of the stairs.\\n\\nAn analysis of the accounts that retweeted Whelan\\'s teaser for his conspiracy most frequently post content from right and far-right media, several of which are anchors in the far-right disinformation ecosphere (and Russian disinformation, to boot).\\n\\nPosted for less than 24 hours, Whelan\\'s mistaken-identity theory sparked a wave of blog posts and discussions on far-right sites that live on even after Whelan backed off. This post, for example, repeats Whelan\\'s claims and suggests they all but vindicate Kavanaugh. It was a top-trending piece on disinformation trackers and was still being circulated on Twitter days after the source was deleted. And so was this one, this one, and this one. Some 1.5 million \"Fox and Friends\" viewers heard all about the mistaken-identity theory live on TV. Once it\\'s out there, you can\\'t pull it back.\\n\\nThe narratives to defend Kavanaugh were mostly about discrediting Blasey Ford: that she was part of a secret CIA mind-control project (the CIA connection was also alluded to by Kremlin disinformation purveyors); that George Soros was behind her allegations; that her lawyer was linked to Hillary Clinton; that she was motivated by profit; that she did this as revenge for a foreclosure case where Kavanaugh\\'s mother, also a judge, ruled against Blasey Ford\\'s parents (only, she didn\\'t—she ruled in their favor); that she had also made false allegations against Neil Gorsuch; and many more.\\n\\nIn the course of his angry self-defense, Kavanaugh stamped a lot of bingo squares: attempted rape allegations as a political tool, false allegations, Clinton, secret conspiracies. By going out and taking the big swing, he elicited a powerful emotional response in his defense—an activated response from a hardened base. #ConfirmKavanaugh was trending—with support of far-right and Russian-linked accounts—after the hearing.\\n\\nNot even history itself is safe—at least the online version of it, which we increasingly depend on. When Kavanaugh testified that Devil\\'s Triangle, as mentioned on his high school yearbook page, was a drinking game, there was no online evidence to back up his claim. (Other sources asserted it was a known sexual term.) So an anonymous person immediately updated Wikipedia to support Kavanaugh\\'s definition. It was a near perfect parallel to how Russian operatives repeatedly edited the Wikipedia entry for “MH17” in the hours after the airliner was shot down to try to provide an alternative history.\\n\\nExamples\\n\\n'],\n", + " ['incident',\n", + " 'I00063',\n", + " '\\n\\nActor: Russia\\n\\nTimeframe: July 18, 2016 - ongoing\\n\\nDate: July 18, 2016\\n\\nPresumed goals: \\n\\n* Sports ie the Olympics is another platform to project power, and bans on Russian athletes, the stripping of medals is serious business. Deflect from negative West perspective as state-run cheats/crooks; World/West plot against us; Proclaim Russian innocence & image to domestic audience; \\n\\nMethod: \\n\\n* Some Russians described the allegations as an anti-Russian plot while others stated that Russia was \"just doing what the rest of the world does\" Just like MH17 and Skripal, Russia gets caught and goes into 4-D mode… ie: the above comment - dismiss/”what-aboutism”\\n* Deny - Russian President Vladimir Putin said that Russia had \"never supported any violations in sport, we have never supported it at the state level, and we will never support this\" and that the allegations were part of an \"anti-Russia policy\" by the West.\\n* Dismiss - Russian Minister of Foreign Affairs, Sergey Lavrov, commented that the United States \"fears honest competition\", affirming Vladimir Putin\\'s position that the United States used its influence within the IOC to \"orchestrate the doping scandal\"\\n* Many Russians believed that the IOC was retaliating against Russia for their discriminatory anti-gay law which provoked considerable controversy with the IOC during the 2014 Winter Olympics. Russian MP Dmitry Svishchev, who is also the head of Russia\\'s Curling Federation, was quoted by Ria Novosti news agency as saying: \"This is what we expected. There\\'s nothing new, only empty allegations against all of us. If you are Russian, you\\'ll get accused of every single sin.\" Aleksei Pushkov, chairman of Russia\\'s parliamentary foreign affairs committee, said that the IAAF\\'s decision to uphold its ban was \"an act of political revenge against Russia for its independent foreign policy.\" A member of Russia\\'s parliament, Vadim Dengin, stated, \"The entire doping scandal is a pure falsification, invented to discredit and humiliate Russia\\nTalking points as above are futher amplifed/spun via Russian media, and public apologists; while this happened prior to 2016 US Elections, suggesting the IRA along with trolls & bots operating in the social space (Twitter, FB, YouTube, Reddit) could be deemed naive. \\n\\nCounters: \\n\\nRelated incidents: \\n\\n* Prelude to 2016\\n* the end of the 2014 Sochi Olympics where Russian athletes dominate (in combination with Euromaiden “crisis”) “emboldens” Putin/Russia to make move on Ukraine invasion. \\n* Russians allegedly tried to hack the World Anti-Doping Agency (WADA)... The Justice Department filed criminal charges against seven members of the GRU, Russia\\'s main military intelligence unit, accusing them of hacking into the U.S. Anti-Doping Agency in Colorado Springs, Colorado, as well as four international sports governing bodies. A grand jury indictment said the operation was in retaliation for the exposure of Russia\\'s state-sponsored athlete doping program that resulted in a ban from the 2016 summer Olympics in Brazil.\\n\\nReferences: \\n\\n* https://www.nbcnews.com/news/world/international-olympic-committee-bars-russia-2018-winter-games-over-doping-n826671\\n\\n* https://www.nytimes.com/2016/05/13/sports/russia-doping-sochi-olympics-2014.html?module=inline\\n* https://www.bbc.com/sport/38261608\\n* https://en.wikipedia.org/wiki/Doping_in_Russia\\n* https://www.theguardian.com/technology/2016/aug/22/russian-hackers-world-anti-doping-agency-dnc-hack-fancy-bear\\n* https://www.dw.com/en/two-russians-probed-for-hacking-anti-doping-agency-wada/a-45502397\\n* https://www.nytimes.com/2018/01/10/sports/olympics/russian-hackers-emails-doping.html\\n* https://qz.com/1413474/all-of-the-victims-named-in-the-latest-russian-hacking-scandal/\\n* https://www.nbcnews.com/news/us-news/7-russians-indicted-hacking-related-olympic-doping-scandal-nerve-agent-n916656\\n\\n\\n'],\n", + " ['incident',\n", + " 'I00006',\n", + " '\\n\\nActor: probably IRA (source: recordedfuture)\\n\\nTimeframe: 1 day\\n\\nDate: Sept 11 2014\\n\\nPresumed goals: test deployment\\n\\nMethod: \\n* Artefacts: text messages, images, video\\n* Create messages. e.g. “A powerful explosion heard from miles away happened at a chemical plant in Centerville, Louisiana #ColumbianChemicals”\\n* Post messages from fake twitter accounts; include handles of local and global influencers (journalists, media, politicians, e.g. @senjeffmerkley)\\n* Amplify, by repeating messages on twitter via fake twitter accounts\\n* Not seen: interaction, refutation etc. \\n* TL;DR: early attempts to create fake incidents had limited traction. \\n\\nCounters:\\n\\n* None seen. Fake stories were debunked very quickly. \\n\\nRelated incidents: \\n\\n* BP oil spill tsunami\\n* #PhosphorusDisaster - fake story about water contamination scare\\n* #EbolaInAtlanta - fake story about Ebola outbreak in Atlanta\\n* #shockingmurderinatlanta - fake story about unarmed black woman killed by police in Atlanta\\n\\nThese were all well-produced fake news stories, promoted on Twitter to influencers through a single dominant hashtag (the single hashtag might have been something learned from crisismapping practice of forcing a single hashtag for each disaster because it was easier to track)\\n\\nReferences:\\n\\n* [RecordedFuture trace of attack]()\\n\\n* https://en.wikipedia.org/wiki/Columbian_Chemicals_Plant_explosion_hoax \\n* https://www.recordedfuture.com/columbianchemicals-hoax-analysis/\\n* https://www.nytimes.com/2015/06/07/magazine/the-agency.html?_r=0 \\n* https://twitter.com/hashtag/PhosphorusDisaster?src=hash\\n\\n\\n'],\n", + " ['incident',\n", + " 'I00047',\n", + " '\\n\\nActor: Russia\\n\\nTimeframe: November 25, 2018 - ongoing\\n\\nDate: November 25, 2018\\n\\nPresumed goals: \\n\\n* Russian media,quoted authorities who accused Kyiv of seeking to “create a conflict situation.” \\n“The same Moscow spokespeople who assured us in 2014 that the little green men who seized Crimea were not Russian soldiers—until Vladimir Putin himself spilled the beans weeks later—are now telling the world that volatile maneuvers of Ukrainian ships led to the collision November 25. \\n* Russian FSB security service blamed Ukraine for sparking the clashes, saying their \"irrefutable\" evidence would \"soon be made public\". Foreign Minister Sergey Lavrov said on the next day that Ukraine had violated international legal norms by failing to obtain authorisation for its vessels. Deputy Chairman of the State Duma Pyotr Tolstoy warned of the danger of a war.\\n* The goal of this campaign is to create confusion, to portray Ukraine as the culprit for both the Kerch Strait incident and the deteriorating security situation in the region, and to exonerate Russia of any responsibility.\\n\\nMethod: \\n\\n* (Distort) Kremlin-controlled RT cited Russian Minister of Foreign Affairs Sergei Lavrov suggesting that Ukraine deliberately provoked Russia in hopes of gaining additional support from the United States and Europe.\\ndistracting the audience from the main issue – Russia shooting at Ukrainian boats and capturing the vessels and crews. Instead they target the president of Ukraine, Petro Poroshenko: “Washington incited Poroshenko to launch this “sea provocation” against Russia in order to “thwart the Putin -Trump meeting”” and “President of Ukraine Petro Poroshenko uses the Kerch provocation for a coup d’état“. But in reality, the Ukrainian Parliament adopted a resolution scheduling the presidential elections for 31 March 2019.\\nDismissing the critic has also found its place under the sun of Kremlin info-war. Claims were spread that the Russian ships have moved so far ahead “in their technological development” that they “do not use ramming as a tactic“.\\n\\n* Attempts to pollute the German Twitter: Russian disinformation does not only rely on its own resources to spread its narratives about Ukraine. Twitter has been used so heavily that Russia Today and Sputnik are scoring more engagement than some of the German quality media combined. Between Sunday and Tuesday, more than 10,000 German-language Tweets from 3,000 unique accounts mentioned Ukraine, almost all of them relating to the confrontation in the Sea of Azov. Despite the large overall number of tweeters, a small group of 30 accounts has been driving a significant share of the debate so far.\\n \\n* Dmitry Peskov described Ukrainian navy’s actions as “an invasion of foreign military ships into Russia’s territorial waters.” Belittling Ukraine’s navy; Ridiculing and dehumanising Ukrainians - This ridiculing of Ukraine’s navy echoes other cases when disinformation has been used to show Ukraine as weak and dependent.\\n\\nCounters: \\n\\nRelated incidents: \\n\\n* This is not the first time the Kremlin has used the four-D tactics. \\n* @DFRLab has documented the Kremlin’s use of the 4Ds of disinformation to deny its involvement in the downing of the Malaysian Airlines flight MH17 over Ukraine, the Skripal poisoning, and the interference in the U.S. Presidential elections in 2016.\\n\\nReferences: \\n\\n* https://euvsdisinfo.eu/report/washington-incited-poroshenko-to-launch-a-sea-provocation-to-thwart-the-putin-trump-meeting/\\n* https://euvsdisinfo.eu/report/kerch-confrontation-part-of-poroshenkos-plan-to-postpone-the-ukrainian-elections/\\n* https://euvsdisinfo.eu/report/russia-does-not-shirk-international-law/\\n* https://meduza.io/en/feature/2018/11/26/how-russia-captured-three-ukrainian-ships-in-the-black-sea\\n* https://medium.com/dfrlab/uk-poisoning-russia-recycles-responses-77e1d357b777\\n* https://medium.com/dfrlab/propaganda-pushed-around-indictment-f63b85ac0587\\n* https://www.dw.com/en/the-scars-of-ukraines-war-in-mariupol/a-19430738\\n* https://www.dw.com/en/crimea-applies-for-annexation-by-moscow-after-secession-referendum-wins-968-approval/a-17500659\\n\\n* https://euvsdisinfo.eu/wave-of-disinformation-from-the-azov-sea/\\n* https://medium.com/dfrlab/minskmonitor-disinformation-tactics-extend-to-kerch-c32351c7c293\\n* https://www.bellingcat.com/news/uk-and-europe/2018/11/30/investigating-the-kerch-strait-incident/\\n* https://www.justsecurity.org/61835/rogue-kremlin-push-international-law/\\n* https://www.stopfake.org/en/denigrating-ukraine-with-disinformation/\\n\\n* https://www.dw.com/en/what-you-need-to-know-about-the-conflict-in-the-sea-of-azov/a-46461361\\n* https://www.atlanticcouncil.org/blogs/new-atlanticist/russia-ukraine-feud-heats-up-the-sea-of-azov\\n* https://en.wikipedia.org/wiki/Kerch_Strait_incident\\n\\n\\nDatasets: \\n\\nNotes: \\n\\nGiven anything related to the ukraine is a key testing ground/flashpoint for Russia narrative manipultion & anti-democracy disinformation, the incident and geographic chokepoint will be an ongoing issue. \\n\\nThe Kerch Strait is the only connection between the Black Sea and the Sea of Azov, and the only way to reach two important Ukrainian ports, Mariupol and Berdiansk. The route is vital for Mariupol\\'s two large metallurgical plants. Russia has controlled the strait since annexing Crimea in 2014, which has made traffic significantly more difficult for Ukrainian ships. The consequences of Russian control have become particularly noticeable since the completion of the Crimean Bridge in May 2018. The bridge connects the Russian mainland with the occupied peninsula. The FSB inspects all ships bound for Ukraine, sometimes taking days, which has aggravated the situation. The volume of freight has steadily declined since then. The war in Ukraine\\'s Donbass region is also problematic for Ukraine\\'s ports.\\n\\nthis most recent escalation in the Kerch Strait is aggravating the already existing conflict between Ukraine and Russia that began after the annexation of Crimea in 2014.\\n \\nOn the evening of 28 November, Ukrainian Infrastructure Minister Volodymyr Omelyan said that vessels bound for the ports of Berdyansk and Mariupol awaited entrance to the Sea of Azov and vessels were also waiting to go southbound. He characterised this as a virtual blockade. No vessels were identified as Ukrainian. On 4 December Omelyan stated that Russia did let ships reach Berdyansk and Mariupol again. The same day the Ukrainian Ministry of Temporarily Occupied Territories and IDPs claimed that the accumulation of ships waiting to go to the Ukrainian ports had led to several accidents. Russia denied it ever blocked vessels from sailing to Ukrainian ports and asserted that any possible disruptions were due to bad weather\\nOn 19 January 2019, USS Donald Cook entered the Black Sea, being the second American vessel to arrive in the Black Sea after the Kerch Strait incident after USS Fort McHenry entered in 10 January 2019\\nIn March 2019, Canada, the United States and the EU imposed sanctions on Russian citizens and companies for their participation in the incident and activities in Crimea and separatist-controlled eastern Ukraine\\n\\n'],\n", + " ['incident',\n", + " 'I00022',\n", + " '\\n\\nActor: \\n\\n* 4chan user with Latvian IP address, \\n* pro-Trump Twitter accounts\\n\\nTimeframe: a few days\\n\\nDate: Two days before the second round of French 2017 election (May 5, 2017)\\n\\nPresumed goals: sabotaging Macron campaign in the last stage of the election.\\n\\nMethod:\\n\\n* Hashtag campaign: #MacronLeaks with use of bots. \\n* Hashtags initially launched in the US, then got publicized by alt-right influencer, Le Pen’s supporters, Wikileaks.\\n\\nCounters:\\n\\n* French agencies that monitor cybersecurity, electoral integrity.\\n* Technical precautions: ending e-voting.\\n* Facebook removed 70,000 suspicious accounts in France 10 days before the vote.\\n* Campaign staff responding to social media posts and comments.\\n* Technically, placing traps along the way, using fake passwords, email addresses, documents to trap hackers.\\n* Stop offering press credentials to propaganda outlets.\\n* Use encrypted apps for confidential communication.\\n* Requesting the media not to report false information.\\n\\nRelated incidents:\\n\\nReferences:\\n\\n* https://www.niemanlab.org/2018/09/how-france-beat-back-information-manipulation-and-how-other-democracies-might-do-the-same/\\n* https://www.buzzfeednews.com/article/ryanhatesthis/heres-how-far-right-trolls-are-spreading-hoaxes-about\\n* https://medium.com/dfrlab/hashtag-campaign-macronleaks-4a3fb870c4e8\\n'],\n", + " ['incident',\n", + " 'I00033',\n", + " '\\n\\nActor: China\\n\\nTimeframe: 2011\\n\\nDate:\\n\\nPresumed goals: \\n\\n* Commentators’ duty to guide public opinion in a “constructive” way and engage the internet as “an important battlefield of ideology.” The vice minister of public security said that the police should use microblogs as a communication platform to “release correct information and dispel misunderstandings.”\\n* Accounts describing the operations of progovernment commentators that have emerged in recent years indicate that they are also involved in identifying and recommending content for deletion. Other testimonies highlight the fact that the posts do not only praise or support the CCP and government policy, but also target government critics with negative remarks. Other forms of misdirection involve deliberate attempts to muddy the facts of a particular incident—for example, a false eyewitness can contradict the account of a netizen reporting a case of police abuse.\\n* The Chinese government has long been suspected of hiring as many as 2,000,000 people to surreptitiously insert huge numbers of pseudonymous and other deceptive writings into the stream of real social media posts, as if they were the genuine opinions of ordinary people. Many academics, and most journalists and activists, claim that these so-called “50c party” posts vociferously argue for the government’s side in political and policy debates.\\n\\nMethod: \\n\\n* Astroturfing: “surreptitiously post large numbers of fabricated social media comments, as if they were the genuine opinions of ordinary Chinese people\"\\n* Cow online opinion leaders into submission\\n* Bombard Taiwan social media (Facebook, twitter, chat groups) with ani-DPP, anti-Tsai content.\\n\\nCounters: \\n\\nRelated incidents: \\n\\nNotes: \\n\\n(Recorded Future) The term “Great Firewall” was coined in a June 1997 Wired magazine article in which an anonymous Communist Party official stated that the firewall was “designed to keep Chinese cyberspace free of pollutants of all sorts, by the simple means of requiring ISPs [internet service providers] to block access to ‘problem’ sites abroad.”\\n\\nOur research focused on the English-language social media activity of six major state-run propaganda organizations from October 1, 2018 through January 21, 2019, which included over 40,000 posts. We selected these six organizations — Xinhua, People’s Daily, China Global Television (CGTN), China Central Television (CCTV), China Plus News, and the Global Times — because they: Are highly digitized; Possess accounts on multiple English language social media platforms; Are associated with Chinese intelligence agencies and/or English language propaganda systems\\n\\nBecause our intent was to map out Chinese state-run influence campaigns targeting the American public, we evaluated only English language posts and comments, as the posts in Chinese were unlikely to affect most Americans. Further, our research focused on answering two fundamental questions about Chinese influence operations: Does China employ the same influence tactics in the English-language social media space as it does domestically? How do Chinese state-run influence operations differ from Russian ones? In what ways are they similar and different, and why?\\n\\nThe information-control regime in China has evolved to include a dizzying array of techniques, technologies, and resources: Blocking traffic via IP address and domain; Mobile application bans; Protocol blocking, specifically Virtual Private Network protocols and applications; Filtering and blocking keywords in domains (URL filtering); Resetting TCP connections; Packet filtering; Distributed denial-of-service (DDoS) attacks (the so-called Great Cannon); Man-in-the-middle (MiTM) attacks; Search engine keyword filtering; Government-paid social media commenters and astroturfers; Social media account blocking, topic filtering, content censorship; State-run media monopoly and censorship; Social Credit System; Mandatory real-name account registration; \\n\\nThis tool set, combined with the now-ubiquitous mass physical surveillance systems, place China at the forefront of integrating information technology, influence operations, surveillance, and censorship in a model referred to by two scholars from MERICS as “IT-based authoritarianism.”\\n\\nIn addition to the constraints imposed by the Great Firewall and content censorship, the Chinese state also employs a series of active disinformation and distortion measures to influence domestic social media users. One of the most widely studied has been the so-called “50 Cent Party.” The 50 Cent Party is a group of people hired by the Chinese government to “surreptitiously post large numbers of fabricated social media comments, as if they were the genuine opinions of ordinary Chinese people.” The name is derivative of a rumor that these fake commentators were paid 50 Chinese cents per comment (this has been largely disproven). This fabrication of social media comments and sentiment is largely known by the term “astroturfing.” Among scholars of the Chinese domestic social media environment, there is much disagreement regarding what the goals or objectives of government-paid astroturfers are. One study by professors at Harvard, Stanford, and UC San Diego, published in April 2017, determined that one in every 178 social media posts are fabricated by the government and that comments and campaigns are focused and directed against specific topics or issues. Additionally, these scholars have assessed that domestic social media influence operations focus primarily on “cheerleading” or presenting or furthering a positive narrative about the Chinese state. Conversely, a separate set of scholars at the University of Michigan, who also examined posts from the 50 Cent Party astroturfers, determined that at least one in every six posts on Chinese domestic social media was fabricated by the government. Further, these scholars argued that less than 40 percent of astroturfed comments could be classified as “cheerleading” and that the rest were a combination of vitriol, racism, insults, and rage against events or individuals. They additionally argue that censors and state-sponsored influence campaigns focus much of their resources on “opinion leaders” and users with large numbers of followers as opposed to simply intervening based on content.\\n\\n Chinese government has used a combination of muscle and guile to cow online opinion leaders into submission, muzzling social media as a political force, and leaching public dialogue of much of its independence. But beneath the peppy, pablum-filled surface that has resulted, Chinese social media remains a contested space.\\n\\n(Taiwan election) Tsai futilely urged Taiwanese citizens to see Beijing’s effort for what it was — a Russian-style influence campaign. The island’s 23 million citizens were bombarded with anti-Tsai and anti-DPP content through Facebook, Twitter and online chat groups, promoted by China’s “50-cent army” of paid social media trolls. There are also dozens of investigations into allegations that Chinese money went to fund Taiwanese candidates opposing Tsai and the DPP.\\nAfter the elections, Chinese state media pointed to Tsai’s losses as evidence that her tough stance vis-à-vis China was unpopular and wrongheaded. Beijing’s overall goal is to replace her with a more malleable leader in Taipei as part of its broad effort to exert control over Taiwan and weaken Taipei’s relationships with the international community.\\nThe Chinese government is bribing or coercing foreign governments to break diplomatic relations with Taiwan, pressuring them to evict Taiwan from international organizations. Beijing is also threatening foreign companies unless they literally erase Taiwan from their websites. Their ultimate goal is to dissolve the U.S.-Taiwan partnership and subjugate the island to the People’s Republic of China (PRC).\\n\\nThere are numerous agencies sponsoring internet commentators, including local propaganda offices, ministries and even schools and state-owned enterprises. For instance, China’s largest oil and gasoline producer, Sinopec, was found to be running an astroturfing campaign justifying rising gasoline prices in 2011 (Wang 2011). \\nThe following excerpt from a recruiting flyer from the Propaganda Department of the Zhengding Party Committee, Hebei, provides an example of what online commentators are expected to do (Zhonggong Zhengding Xianwei Xuanchuanbu 2009): \\ncompose original postings and carry out positive publicity online to promote the priorities and major deployments of the party committee and the government; \\nrelease authoritative information on major incidents to hinder the spread of rumours and ensure correct direction of online opinion; \\nanswer questions and clarify confusion for netizens on hotbutton incidents, interpret the policies of and measures taken by the party and the government and divert netizens’ emotions; \\nstrengthen information management on the internet and tightly integrate the analysis of online opinion, disposing of harmful information and guiding online opinion. \\n\\nThese instructions show that besides monitoring public opinion, the primary mission for online commentators is to facilitate state propaganda and defuse crises. In online propaganda campaigns, commentators work to attract public attention and fabricate an audience, if necessary. \\n\\n “American Cent Party” (美分党) who express western democratic values and criticize the Chinese communist regime online, and the “internet water army” (网络水军), which refers to for-hire astroturfers working for and advancing the interests of companies and other actors willing to pay their fees.\\nProminent dissident Ai Weiwei said “If you oppose the US and Japan [online], you are a member of the 50 cents army” (Strafella and Berg, 2015). 50c party members “combat hostile energy,” defined as posts that “go against socialist core values,” or “are not amenable to the unity of the people.” Such information should be “resolutely resisted, proactively refuted, and eagerly reported to Internet authorities.” 4 (Haley, 2010). Through active engagement of opposition views, they try to “sway public opinion” (Editors, 2016; Jason Ng, 2011), “influence public opinion. . . pretending to be ordinary citizens and defending or promoting the government’s point of view” (O. Lam, 2013), or “steer conversations in the right direction” (Editors, 2013). Estimates by journalists of the size of the 50c party is between 500,000 to 2 million (Philipp, 2015).\\n\\nReferences:\\n\\n* https://www.wired.com/1997/06/china-3/\\n* https://en.greatfire.org/analyzer\\n* https://www.nytimes.com/2017/01/04/business/media/new-york-times-apps-apple-china.html\\n* https://techcrunch.com/2017/07/29/apple-removes-vpn-apps-from-the-app-store-in-china/\\n* https://pdfs.semanticscholar.org/9fc1/d1815a678583c1e73233bb93aaaab7d0fd4f.pdf\\n* https://www.cl.cam.ac.uk/~rnc1/ignoring.pdf\\n* https://citizenlab.ca/2015/04/chinas-great-cannon/\\n* https://drive.google.com/file/d/1xjHWI0Ih3abONxL0WoXj2swlcBuiRCXO/view\\n* https://papers.ssrn.com/sol3/Papers.cfm?abstract_id=2738325\\n* http://www.spiegel.de/international/world/china-s-xinjiang-province-a-surveillance-state-unlike-any-the-world-has-ever-seen-a-1220174.html\\n* https://www.merics.org/sites/default/files/2018-07/MPOC_ChinasCoreExecutive_web.pdf\\n* https://www.freedomhouse.org/template.cfm?page=691&cmb=34#Vice\\n* http://cmp.hku.hk/2011/05/09/12125\\n* http://chinadigitaltimes.net/2008/05/chinese-bloggers-on-the-history-and-influence-of-the-fifty-cent-party/\\n* http://gking.harvard.edu/files/gking/files/50c.pdf?m=1463587807\\n* http://blakeapm.com/\\n* https://www.washingtonpost.com/news/monkey-cage/wp/2017/02/21/can-the-chinese-government-really-control-the-internet-we-found-cracks-in-the-great-firewall/\\n* https://drive.google.com/file/d/1xjHWI0Ih3abONxL0WoXj2swlcBuiRCXO/view\\n* https://foreignpolicy.com/2014/01/30/whisper-together/\\n* https://www.nytimes.com/2018/11/22/world/asia/taiwan-elections-meddling.html\\n* http://www.taipeitimes.com/News/front/archives/2018/10/23/2003702864\\n* https://www.aljazeera.com/news/2018/11/news-rattles-taiwan-elections-181123005140173.html\\n* https://www.reuters.com/article/us-taiwan-politics/china-heaps-pressure-on-taiwan-president-after-poll-defeat-idUSKCN1NV02X\\n* https://www.washingtonpost.com/opinions/global-opinions/trump-is-failing-to-counter-chinas-diplomatic-assault-on-taiwan/2018/09/06/e744f97c-b20c-11e8-9a6a-565d92a3585d_story.html\\n* https://www.washingtonpost.com/news/josh-rogin/wp/2018/05/05/white-house-calls-chinas-threats-to-airlines-orwellian-nonsense/\\n* https://gking.harvard.edu/files/gking/files/how_the_chinese_government_fabricates_social_media_posts_for_strategic_distraction_not_engaged_argument.pdf \\n* https://www.voanews.com/a/who-is-that-chinese-troll/3540663.html\\n* https://journals.sub.uni-hamburg.de/giga/jcca/article/viewFile/850/851\\n* https://www.scmp.com/culture/books/article/2144692/how-china-censors-its-internet-and-controls-information-great-firewall\\n* https://freedomhouse.org/blog/china%E2%80%99s-growing-army-paid-internet-commentators\\n* https://www.recordedfuture.com/china-social-media-operations/\\n* https://foreignpolicy.com/2016/05/19/meet-the-chinese-internet-trolls-pumping-488-million-posts-harvard-stanford-ucsd-research/\\n* https://www.washingtonpost.com/opinions/2018/12/18/chinas-interference-elections-succeeded-taiwan/\\n\\n'],\n", + " ['incident', 'I00062', '\\n\\nSee also I00005.'],\n", + " ['incident',\n", + " 'I00056',\n", + " '\\n\\nActor: Iran\\n\\nTimeframe: 2012 - ongoing\\n\\nDate: Aug 21, 20198\\n\\nPresumed goals: \\n\\n* Iran’s meddling in the politics of the Arab states has become more conspicuous since the Arab Spring of 2011. Iran has been trying to widen its influence in the region in its political jousting against Saudi Arabia which is sometimes referred to as “the Arab Cold War”. Although the two regional rivals have never declared war, the two players have been involved in proxy wars in the region including Syria and Yemen.\\n* Pages promoted or amplified views in line with Iranian government’s international stances. The pages posted content with strong bias for the government in Tehran and against the “West” and regional neighbors, such as Saudi Arabia and Israel.The operation was noteworthy, however, that more than 30 percent of the removed assets were active for five or more years, indicating that Iranian entities have been engaged in social media influence campaigns since as early as 2010 (DFRLab)\\n\\n\\nMethod: \\n\\n* In August 2018, Facebook removed 652 pages, groups, and accounts on Facebook and Instagram originating from Iran for engaging in a “coordinated inauthentic behaviour”. 15 These operations targeted people in the Middle East, Latin America, the UK, and the US. In October 2018, Facebook announced the removal of another 82 pages, groups, and accounts on Facebook and Instagram. This time the company announced that these accounts and pages targeted people in the US and the UK.16 Some of these accounts masqueraded as American citizens pushing anti-Saudi and anti-Israel narratives.\\n* In October 2018, Twitter published two data sets comprising 3,841 accounts affiliated with the Internet Research Agency (IRA), and 770 accounts that could be traced back to Iran. These accounts were suspended by Twitter in August 2018 for engaging in coordinated manipulation on the platform. Twitter believes that the information operations linked to Iran are potentially backed by the state\\n* 70 websites found by Reuters which push Iranian propaganda to 15 countries, in an operation that cybersecurity experts, social media firms and journalists are only starting to uncover. The sites found by Reuters are visited by more than half a million people a month, and have been promoted by social media accounts with more than a million followers… the sites in the campaign have been active at different times since 2012. They look like normal news and media outlets,but only a couple disclose any Iranian ties.\\n* The social media companies have closed hundreds of accounts that promoted the sites or pushed Iranian messaging. Facebook said last month it had taken down 82 pages, groups and accounts linked to the Iranian campaign; these had gathered more than one million followers in the United States and Britain. But the sites uncovered by Reuters have a much wider scope. They have published in 16 different languages, from Azerbaijani to Urdu, targeting Internet users in less-developed countries. That they reached readers in tightly controlled societies such as Egypt, which has blocked hundreds of news websites since 2017, highlights the campaign’s reach.\\n* Ten outlets targeting readers in Yemen, where Iran and U.S. ally Saudi Arabia have been fighting a proxy conflict since civil war broke out in 2015; A media outlet offering daily news and satirical cartoons in Sudan. Reuters could not reach any of its staff; A website called Realnie Novosti, or “Real News,” for Russian readers. It offers a downloadable mobile phone app but its operator could not be traced.\\n* One of IUVM’s most popular users is a site called Sudan Today, which SimilarWeb data shows receives almost 150,000 unique visitors each month. On Facebook, it tells its 57,000 followers that it operates without political bias. Its 18,000 followers on Twitter have included the Italian Embassy in Sudan, and its work has been cited in a report by the Egyptian Electricity Ministry.\\nThe office address registered for Sudan Today in 2016 covers a whole city district in north Khartoum, according to archived website registration details provided by WhoisAPI Inc and DomainTools LLC. The phone number listed in those records does not work.\\n* We have observed inauthentic social media personas, masquerading as American liberals supportive of U.S. Senator Bernie Sanders, heavily promoting Quds Day, a holiday established by Iran in 1979 to express support for Palestinians and opposition to Israel. (FireEye)\\n* Broadly speaking, the intent behind this activity appears to be to promote Iranian political interests, including anti-Saudi, anti-Israeli, and pro-Palestinian themes, as well as to promote support for specific U.S. policies favorable to Iran, such as the U.S.-Iran nuclear deal (JCPOA). In the context of the U.S.-focused activity, this also includes significant anti-Trump messaging and the alignment of social media personas with an American liberal identity. However, it is important to note that the activity does not appear to have been specifically designed to influence the 2018 U.S. midterm elections, as it extends well beyond U.S. audiences and U.S. politics. (FireEye)\\n* All 17 of the pages containing information about manager location had managers from Iran. Canada, Saudi Arabia, and Syria were other common locations of page managers. (DFRLab)\\nPromoting Shi’a Political and Militant Views\\n* One of the removed pages\\u200a—\\u200a@alalsadrr1\\u200a—\\u200apromoted Moqtada al-Sadr, an influential Shi’a cleric and militia leader from Iraq and leader of the Mahdi Army. According to the Wilson Center, in the mid-2000’s, the Mahdi Army received weapons and training from the Islamic Revolutionary Guard Corps and Lebanese Hezbollah agents. In May 2018, The Atlantic reported that the “controversial” leader and his followers had committed brutal atrocities in Iraq, fought the U.S. military in Sadr City and Basra, and were known for corruption. (DfRLab)\\n* In January, Facebook took down 783 accounts and pages, which it assessed as “directed from Iran, in some cases repurposing Iranian state media content.” (DFRLab - March 26, 2019)\\nThe operation strongly resembled the earlier IUVM operation. Facebook did not attribute it to IUVM directly, but the latest network used the same techniques and pointed to some of the same websites, making attribution to the same network likely, although not confirmed.\\nIn particular, pages across the network reproduced IUVM content, as well as content from other websites which have featured in earlier exposés and takedowns.\\nThe network functioned by steering users towards ostensibly independent news websites, which amplified Iranian regime propaganda, often copied verbatim from regime assets. The social media content therefore served as a secondary amplifier, rather than a direct audience-engagement tool.\\nDespite the heterogeneous nature of the assets\\u200a—\\u200athey were spread across many countries, languages, and cultures\\u200a—\\u200atheir messaging was largely homogeneous. It dealt with issues of importance to the Iranian government, supporting Palestinians and Shia Muslims on one hand, and attacking Israel, the United States, Saudi Arabia, and the conduct of the military campaign in Yemen on the other.\\nThe focus on South Asia was noteworthy. Indonesia and India had the most pages targeted at them; African countries also featured prominently. This expands the known area of Iranian influence operations, which have thus far been primarily exposed in the Middle East and in the West.\\n\\n\\nCounters: \\n\\n* Facebook and Twitter content take-downs\\n\\nRelated incidents: \\n\\n* See Venezuela:\\nhttps://www.bloomberg.com/news/articles/2019-02-01/iran-slams-u-s-over-venezuela-secretly-some-may-be-relieved\\nhttps://www.rand.org/blog/2019/02/hezbollah-is-in-venezuela-to-stay.html\\n\\n\\nReferences: \\n\\n* http://www.state.gov/e/eb/tfs/spi/iran/jcpoa/\\n* http://www.arabnews.com/node/1329971/middle-east\\n* https://www.wilsoncenter.org/article/part-2-pro-iran-militias-iraq\\n* https://www.theatlantic.com/international/archive/2018/05/iraq-moqtada-sadr/559499/\\n* https://www.amnesty.org/en/latest/news/2014/10/iraq-evidence-war-crimes-government-backed-shi-militias/\\n* http://www.washingtonpost.com/wp-dyn/content/article/2008/04/18/AR2008041803429.html\\n* https://www.telegraph.co.uk/news/worldnews/middleeast/iraq/1498970/UK-troops-left-isolated-as-Mahdi-Army-weaves-a-web-of-official-corruption.html\\n* https://medium.com/dfrlab/trolltracker-outward-influence-operation-from-iran-cc4539684c8d\\n* https://newsroom.fb.com/news/2019/01/removing-cib-iran/\\n* https://www.reuters.com/article/us-cyber-iran-specialreport/special-report-how-iran-spreads-disinformation-around-the-world-idUSKCN1NZ1FT\\n* https://www.rand.org/blog/2018/08/irans-disinformation-campaigns.html\\n* https://medium.com/dfrlab/takedown-details-of-the-iranian-propaganda-network-d1fad32fdf30\\n* https://medium.com/dfrlab/trolltracker-outward-influence-operation-from-iran-cc4539684c8d\\n* https://comprop.oii.ox.ac.uk/wp-content/uploads/sites/93/2019/04/Iran-Memo.pdf\\n* https://www.fireeye.com/blog/threat-research/2018/08/suspected-iranian-influence-operation.html\\n\\n'],\n", + " ['incident',\n", + " 'I00007',\n", + " '\\n\\nActor: RT/Sputnik\\n\\nTimeframe: 2 weeks\\n\\nDate: July-August 2016\\n\\nPresumed goals: \\n\\nMethod: \\n\\nCounters: \\n\\nRelated incidents: \\n\\n* Jade Helm exercise\\n* Black Lives Matter protests\\n* Bundy Ranch standoff\\n\\nNotes:\\n\\nStory was that the Incirlik NATO base in Turkey was under attack by terrorists. \\n2016-08-14 Paul Manafort cited that the Incirlik NATO base in Turkey was under attack by terrorists, as an example of an unreported true story. \\n“The weekend of July 30, RT.com and Sputnik reported 7,000 armed police with heavy vehicles had surrounded Incirlik air base in Adana, Turkey, where 2,500 U.S. troops are stationed and some 50 U.S. nuclear weapons are stored. The two Kremlin-funded outlets suggested that the lockdown was in response to another coup attempt after a faction of the Turkish military failed to overthrow Turkish President Recep Tayyip Erdoğan.”\\n“On the evening of 30 July 2016, my colleagues and I watched as RT and Sputnik news simultaneously launched false stories about the U.S. air base in Incirlik, Turkey being overrun by terrorists,” he told the committee. Within minutes pro-Russian social media aggregators and automated bots amplified this false news story,” Watts said. “There were more than 4,000 tweets in the first 75 to 78 minutes after launching this false story. Perhaps the most stunning development for Watt and his companions was that the rapid proliferation of that story was linked back to the active measures accounts (Russian bots) they had tracked for the preceding two years. These previously identified accounts almost simultaneously appearing from different geographic locations and communities amplified the big news story in unison,” Watts said. The hashtags promoted by the bots, according to Watts, were “nuclear, media, Trump and Benghazi. The most common words, he said found in English speaking Twitter user profiles were “God, military Trump, family, country, conservative, Christian, America and constitution. The objective of the messages, Watts said, “clearly sought to convince Americans that U.S. military bases being overrun in a terrorist attack.”\\n\\nData\\n\\n* Looked at Twitter for these dates: https://twitter.com/search?l=&q=incirlik%20until%3A2014-08-14&src=typd\\nhttps://twitter.com/ElectionLawCtr/status/492850603039522816\\n\\n\\nReferences: \\n* https://www.rt.com/news/354042-turkish-police-incirlik-nato-coup/\\n* https://sputniknews.com/middleeast/20160731/1043797161/incirlik-turkey-erdogan-nato-nukes.html\\n* https://www.politifact.com/truth-o-meter/statements/2016/aug/16/paul-manafort/trump-campaign-chair-misquotes-russian-media-makes/\\n* https://wtop.com/j-j-green-national/2017/09/anatomy-russian-attack-first-signs/slide/1/ \\n'],\n", + " ['incident',\n", + " 'I00017',\n", + " '\\n\\nActor: IRA\\n\\nTimeframe: 2 years\\n\\nDate: December 2015 - 2017\\n\\nPresumed goals: “Russia’s goals were to undermine public faith in the US democratic process, denigrate Secretary Clinton, and harm her electability and potential presidency” - James Clapper\\n\\nMethod:\\n\\n* Facebook ads promoting minor candidates (Jill Stein)\\n\\nReferences:\\n* https://medium.com/dfrlab/electionwatch-beyond-russian-impact-2f5777677cc0\\n* https://www.thedailybeast.com/exclusive-secret-documents-from-russias-election-trolls-leak\\n\\nNotes:\\n\\nDailyBeast article gives sizings and method - 80 people on this. If they were working 8-6, that gives us a sizing on how much trolling they could do. \\n\\n'],\n", + " ['incident',\n", + " 'I00003',\n", + " '\\n\\nActor: IRA\\n\\nTimeframe: \\n\\nDate: \\n\\nPresumed goals:\\n\\nMethod: \\n\\nCounters:\\n\\nRelated incidents:\\n\\n\\nReferences:\\n\\n* https://twitter.com/JuliaDavisNews/status/994704834577215495 \\n* https://twitter.com/donie/status/957246815056908288 \\n* https://www.theguardian.com/us-news/2018/may/10/russia-facebook-ads-us-elections-congress\\n'],\n", + " ['incident',\n", + " 'I00042',\n", + " '\\n\\nActor: \\n\\n* Saudi Arabia / Qatar /Turkey. \\n* While the dispute is between these two Kingdoms, it’s with certainty that one can suggest Iran (both projection and the containment of its power/influence in the region) is at the center of it.\\n\\nTimeframe: May - September 2017 \\n\\nDate: May, 2017\\n\\nPresumed goals: \\n\\n* The programmatic/synthetic amplification of respective “positions and/or plights.” \\n* The respective hashtags can not be categorized as organic in nature, but launched in conjunction with the botnet deployments. As well, none of the identified bot related activity points to an effort to drown out/flood the opponents. \\n\\nMethod: \\n\\n* Twitter campaign; bots/botnets seriously distorted the conversation on Twitter.\\n* Commercial botnets (these are created en masse and rented out to any user who is willing to pay for retweets, likes, and follow—either for their own account or for somebody else’s. They are thus the easiest and quickest way to obtain artificial amplification)\\n* On 24 May 2017, for example, pro-Qatar users launched the hashtag or “Qatar is not alone.”\\n* Supporters of Saudi Arabia also turned to apparently commercial bots to promote their messages. On 21 July, supporters of Qatar launched another hashtag, or “Tamim the Glorious,” in honor of the Emir. In response, supporters ,#تميم_المج ُد of Saudi Arabia used a botnet to attack the hashtag. The attack began when an account called @al_muhairiuae posted a photoshopped image of the Emir designed to make him look foolish.\\n* Combined with the Korean imagery, this suggests they were a commercial botnet that an unknown user rented to amplify the anti-Qatar tweet and to subvert the pro-Qatar hashtag, which had only just started to trend.\\n* At least one botnet seemed based in Turkey, joining the fray in mid-September in a bid to support Qatar.”\\n\\nCounters: \\n\\n* Essentially the was a tit-for-tat campaign with a brief “incursion”/support/spike of activity most likely (but not officially verified) from Turkey in support of Qatar\\n\\n* Global Research (Pro-Kremlin publication/organization located in Montreal, QC) contributed anti-Saudi spin via their blog. Global Research (anti-Saudi… campaign); Global Research (more)\\n\\nRelated incidents: \\n\\n* Jamal Khashoggi incident will bear hallmarks of the incident, but moves beyond a regional information operation into one of global significance. In 2018 the NY Times investigates Saudi Arabia’s Troll Army\\n\\nReferences: \\n\\n* https://www.globalresearch.ca/saudi-arabias-march-towards-civil-war/5616699\\n* https://www.globalresearch.ca/the-machiavellian-plot-to-provoke-saudi-arabia-and-qatar-into-a-blood-border-war/5593870\\n* https://www.nytimes.com/2018/10/20/us/politics/saudi-image-campaign-twitter.html\\n* https://jia.sipa.columbia.edu/robot-wars-how-bots-joined-battle-gulf\\n* https://www.washingtonpost.com/news/monkey-cage/wp/2017/06/07/hacking-bots-and-information-wars-in-the-qatar-spat/\\n* https://www.independent.co.uk/news/world/middle-east/russian-hackers-qatar-fake-news-gulf-diplomatic-row-fbi-doha-saudi-arabia-bahrain-uae-egypt-a7776446.html\\n* https://qz.com/1107023/the-inside-story-of-the-hack-that-nearly-started-another-middle-east-war/\\n* https://theconversation.com/the-world-cup-in-digital-and-social-the-viewers-the-tweets-and-the-trolls-99625\\n\\n* https://www.bbc.com/news/blogs-trending-44294826\\n* https://jia.sipa.columbia.edu/robot-wars-how-bots-joined-battle-gulf\\n\\nDatasets: Mining and analyzing Twitter data is unlikely to “prove” or offer much more insight than Ben Nimmo’s work.\\n\\nNotes: \\n\\nGiven the apparent use of commercial botnets, it’s difficult to attribute much of the activity to state actors, however it is fair to suggest some of this behavior would undoubtedly needed tacit state support… private “patriots” of the state?\\n\\nThis article https://jia.sipa.columbia.edu/robot-wars-how-bots-joined-battle-gulf highlights the mechanics and dynamics of the bot operations/amplification in some cases to short life span of the activity and assets (quickly deleted from the platform), but doesn’t communicate the underlying political issues that drove these incidents.\\n \\nThe focus of these Arabic-language hashtags was clearly local and regional rather than international; this was a question of messaging to the domestic population and to Arabic-language rivals, rather than the non-Arabic-speaking world.\\nClaims of Russian involvement/hack are reported by both the Washington Post and the Independent UK (cites CNN as source). Quartz as well cites the Russian connection, further citing documentation shared with them via Qatar (flimsy at best) and further point blame for the affair at President Trump. \\n\\nPost incident - Given Qatar is hosting the 2022 World Cup of Soccer, the World Cup 2018, was a “test” ground for this ongoing online “war” while subtle was evident (Mentionmapp Analytics… John’s research) '],\n", + " ['incident',\n", + " 'I00008',\n", + " '\\n\\nActor: \\n\\nTimeframe: \\n\\nDate: \\n\\nPresumed goals:\\n\\nMethod: \\n\\nCounters:\\n\\nRelated incidents:\\n\\nReferences:\\n\\n* https://www.ceas-serbia.org/images/2018/201803_CEAS_Report.pdf\\n* https://www.stopfake.org/en/vencislav-the-virgin-hostile-operation-by-vencislav-bujic-seas-foundation-and-its-network-of-collaborators/\\n* https://seas.foundation/en/2018/03/15/155\\n\\n'],\n", + " ['incident',\n", + " 'I00049',\n", + " '\\n\\nActor: Russia, Syrian Government and Iran\\n\\nTimeframe: April-June\\n\\nDate: April 8, 2018\\n\\nPresumed goals: \\n\\n* can’t trust anyone who is reporting about it & fit into the “false flag,” commonly used conspiracy trope positing that mass casualty incidents are engineered internally to provide pretext for either government repression or military action \\n\\nMethod: \\n\\n* One novel attack on the White Helmets in the wake of the Douma attacks featured the claim that the group had run a film studio in the besieged city, and used it to stage propaganda videos. This was initially reported by Lebanon-based Al-Aahed News[81] and Iran’s Fars News,[82] each of which attributed it to the other. It was then picked up by Russian state outlets in both Russian[83] and English.[84] As Bellingcat was quick to point out, the images of the studio were actually taken from the Facebook page of a film called Revolution Man.[85] The way in which this demonstrably false claim was amplified on pro-Assad channels reinforces the conclusion that its purpose was to discredit the White Helmets because their reporting was accurate—not because it was false.\\n* A separate line of argument focused on the Western response to the Douma attack, and the conclusion that the chemical attack had indeed been launched by Assad’s forces. This argument claimed, in essence, that the West’s response was hasty, ill-judged, and went beyond the evidence.[86]\\n* A third line of attack focused on accusing the West of condoning or staging chemical attacks, including the Douma one, and thus delegitimizing Western outrage. On April 13, the Russian Ministry of Defense said that it had “evidence proving the United Kingdom’s direct involvement in the organization of this provocation in eastern Ghouta,”[91]\\n* A fourth tactic featured apocalyptic warnings that any Western strike into Syria that harmed Russians could trigger World War III. On April 8, for example, the Russian Foreign Ministry warned of “very grave consequences” of an American strike.[93]\\n\\nCounters: \\n\\n* Fact checking (Snopes & Bellingcat)\\n\\nRelated incidents: \\n\\n* foundation to Russia ramping up chemical weapon disinformation leading-op to Idlib offensive \\n\\nReferences: \\n\\n* https://eeas.europa.eu/headquarters/headquarters-homepage/42657/syria-eu-calls-accountability-after-yet-another-chemical-attack_en\\n* This is the most detailed article/resource helps lay the background, details, players, tactics http://www.publications.atlanticcouncil.org/breakingghouta/disinformation-2/\\n* https://www.washingtonpost.com/news/monkey-cage/wp/2018/09/17/russia-is-gearing-up-to-misinform-the-u-s-public-about-syria-heres-our-cheat-sheet-to-identify-twitter-trolls/?utm_term=.7d3c56b0b03a\\n* https://euvsdisinfo.eu/report/bbc-admits-that-reason-for-bombing-syria-was-fake/\\n* https://www.bellingcat.com/news/mena/2018/12/18/chemical-weapons-and-absurdity-the-disinformation-campaign-against-the-white-helmets/\\n* https://www.bellingcat.com/news/mena/2018/08/30/russian-chem-disinfo-idlib/\\n* https://www.bellingcat.com/tag/chlorine/\\n* https://www.nybooks.com/daily/2018/10/16/why-assad-and-russia-target-the-white-helmets/\\n* https://www.snopes.com/news/2018/04/12/disinformation-conspiracy-trolling-syrian-chemical-attack/\\n* https://www.snopes.com/fact-check/is-this-proof-white-helmets-staged-chemical-attack/\\n* https://www.dw.com/en/russias-syria-chemical-weapons-attack-warning-dubious-experts-say/a-45250441\\n* https://euvsdisinfo.eu/report/new-chemical-attack-to-be-staged-by-the-white-helmets-in-idlib/\\n* https://www.nytimes.com/2018/04/08/world/middleeast/syria-chemical-attack-ghouta.html\\n\\nDatasets: \\n\\nNotes: \\n\\nFor the Syrian opposition, the use of these weapons in high-casualty attacks now brought the possibility of US military intervention. For the Syrian government and Russia, that same possibility brought an urgent need to sow doubt around the veracity of any claims of chemical weapons use—including by claiming that the reports of chemical weapons use were a conspiracy launched by foreign enemies to trigger more strikes.\\nIn parallel, perhaps in an attempt to deflect potential consequences, Russian government sources began claiming that rebel groups and the White Helmets rescue organization, backed by Western powers, were planning “false flag” chemical attacks, designed to kill civilians and point the blame at the Syrian government. Against the background of the 2017 US strikes that followed the Khan Sheikhoun attack, such claims introduced the idea of American complicity in any future attacks, suggesting that such attacks would be a false flag to cover an already-decided US engagement, rather than a consequence of the regime or Russia’s decision to use chemical weapons. This seeded a narrative that could later be passed on to anti-interventionist media outlets and campaigners in the West.\\nThe claim that a given incident was a false flag attack, designed to discredit the Russian government, has regularly been deployed by Kremlin supporters—for example, over the downing of Malaysia Airlines flight MH17 over Ukraine and the poisoning of former Russian spy Sergei Skripal in England, as well as in Syria. Such claims have been repeated and disseminated through a complex ecosystem of blogs and social media posts, largely written in English by self-styled “investigative journalists” with ties to Kremlin-operated media outlets.[18] These provided vital validation to the Syrian/Russian narrative, and played an important role in its dissemination.\\nThe disinformation campaign waged by the Syrian and Russian regimes was large scale, persistent, and supported by a range of Western commentators. In the immediate aftermath of the attack, its impact was limited, and the bulk of mainstream reporting focused on establishing the series of events. According to an online scan of Twitter mentions of the word “Douma” conducted with the Sysomos online service, none of the ten most-retweeted tweets posted on April 7-9 contained pro-Assad content, indicating that the conversation was dominated by other voices.[110] In all, the scan collected some 435,000 tweets. Progressively, however, the mainstream media shifted their focus to other issues, while the supporters of the Syrian and Russian regimes kept their focus on Douma; thus, the overall volume of traffic declined, and the share of the conversation dominated by pro-Assad voices increased. In a similar scan of the period from April 10-16, six of the ten most-retweeted posts came from Assad supporters, out of a total of 487,000 posts.[111]\\nThis analysis also reveals the integration of government-funded media (RT, SputnikNews) and geopolitical think tanks (GlobalResearch) as source content for anti-WH [anti-White Helmet] narratives.”[120]\\nPro-Assad and pro-Russian disinformation was further amplified by a group of ostensibly independent news websites that have since been demonstrated to have Iranian links,[121] and which systematically promoted pro-Iranian regime messaging.[122] These sites included IUVMPress.com, an apparent news site that reproduced content from Iranian regime and pro-regime sources, stripped it of its attribution, and passed it onto other sites; institutomanquehue.org, ostensibly a think tank focused on Latin America; and britishleft.com, apparently a site dedicated to left-wing British politics\\nCommentators such as Beeley, Bartlett, and 21st Century Wire colleague Patrick Henningsen bridged the gap between the “alt-right” movement in the United States and the Russian state communications network, being cited both on sites such as RT, and alt-right hubs such as Infowars. Beeley and Bartlett contribute to both 21st Century Wire[129] and RT;[130] Henningsen formerly wrote for Infowars,[131] writes for 21st Century Wire, and is featured as a contributor on RT’s site.[132] Their contributions helped to spread pro-Assad and pro-Kremlin messaging into US audiences, very much in the manner described by Simonyan, when she spoke of the need for “English-speaking talking heads” to validate the Kremlin’s view.\\n\\nOn at least one occasion, their messaging broke into the mainstream. On April 13, 2018, rock guitarist Roger Waters told a concert in Barcelona that he thought the White Helmets were a “fake organization that is creating propaganda for jihadists and terrorists”—a very similar misrepresentation to that publicized by the Kremlin disinformation networks.[134\\nA video clip of his comments was repeatedly uploaded to YouTube by Kremlin and pro-Kremlin users, including RT UK,[136]Beeley,[137] Hands Off Syria,[138] and Clarity of Signal.[139] Together, these totalled more than 140,000 views by September 19, 2018\\n\\nWhen incidents such as the Waters amplification are taken into account, the reason that Russia’s General Dvornikov spoke so highly of information operations becomes clear. The combination of state-funded outlets, covert outlets such as IUVMPress, official statements, and supporting bloggers and trolls allowed the pro-Assad narrative to dominate the online conversation for extended periods, especially during times when the credible media outlets were focusing on other issues.\\n'],\n", + " ['incident',\n", + " 'I00039',\n", + " '\\n\\nActor:\\n\\n* Right-wing FB pages\\n* Fake news sites e.g. yesimright.com; shoebat.com; endingthefed.com; truthfeed.com; yournewswire.com.\\n* British tabloids: Express, MailOnline.\\n\\nTimeframe: Data was collected and analyzed in 2016.\\n\\nDate: 2016.\\n\\nPresumed goals:\\n* To attack Merkel’s liberal position on the refugee crisis.\\n\\nMethod:\\n* Fake news sites mix legitimate partisan political content with false and conspiratorial information.\\n* Large right-wing FB pages in the US also share anti-Merkel content.\\n* Most popular Merkel articles on Facebook also come from legitimate, but negative and right-wing news sources.\\n* German links that generated most engagement in 2016 spread conspiratorial claims about Merkel’s mental health.\\n\\nCounters:\\n* No counter actions were taken.\\n\\nRelated incidents: \\n\\n* Defamation of Modamani – a Syrian refugee - who took a selfie with Merkel and was accused on social media as having links to terrorism.\\n\\nReferences:\\n\\n* Source: Buzzfeed analysis\\n* https://www.buzzfeed.com/albertonardelli/hyperpartisan-sites-and-facebook-pages-are-publishing-false\\n* https://www.nytimes.com/2017/02/06/business/syria-refugee-anas-modamani-germany-facebook.html\\n '],\n", + " ['incident',\n", + " 'I00029',\n", + " '\\n\\nActor: Russia \\n\\nTimeframe: July 2014 - still active\\n\\nDate: July 17, 2014\\n\\nPresumed goals: \\n\\n* Ongoing campaign to discredit/undermine Ukraine & NATO & Democracy\\n\\nMethod: \\n\\n* Multi-pronged media & source driven campaign… ie: \\n* Russian state sources military, embassy, media (RT, Sputnik, TASS); \\n* Kremlin’s “witting idiots” ie: 21Wire, Global research; trolls & bots. \\n* “All” media platforms… ie: Youtube; Twitter; Reddit\\n* See collection of visual assets \\n\\nCounters: \\n\\n* Bellingcat; Dutch gov’t, DFRLab\\n\\nRelated incidents: \\n\\n* Anything related to Ukraine\\n* Donetsk\\n* Crimea\\n* Sea of Azov\\n* Ukrainian election (2019)\\n\\nReferences:\\n\\n* [Bellingcat (collection of related investigations)](https://www.bellingcat.com/?s=MH17) \\nIe: [“The Kremlin’s Shifting, Self-Contradicting Narratives on MH17”](https://www.bellingcat.com/news/uk-and-europe/2018/01/05/kremlins-shifting-self-contradicting-narratives-mh17/)\\n\\n* [DFRLab MH17 4D\\'s \"playbook\"](https://medium.com/dfrlab/putinatwar-dismissing-mh17-8268d2968b9) \\n* [In social networks on the fingers showed how the Kremlin bots work](https://news.online.ua/754036/v-sotssetyah-na-paltsah-pokazali-kak-rabotayut-boty-kremlya-opublikovany-foto/):\\n“Censoring” the news (Facebook page “takedown”) [Facebook blocked Sergey Parkhomenko for commenting on the report of the downed \"Boeing\"](https://www.novayagazeta.ru/news/2015/05/07/112052-facebook-zablokiroval-sergeya-parhomenko-za-kommentariy-doklada-o-sbitom-171-boinge-187%20)\\n* [The most comprehensive guide ever to MH17 conspiracies](http://euromaidanpress.com/2015/10/14/confuse-and-obfuscate-the-most-comprehensive-guide-ever-to-mh17-conspiracies/)\\n\\n* http://tass.com/world/1050324\\n* https://www.mirror.co.uk/news/world-news/ukraine-involved-mh17-downing-claims-14184413\\n* https://www.bellingcat.com/resources/case-studies/2014/07/17/geolocating-the-missile-launcher-linked-to-the-downing-of-mh17/\\n* https://globalnews.ca/news/4993120/russia-rising-part-5-maskirovka/\\n* http://euromaidanpress.com/2018/12/06/ukraine-related-narratives-dominate-russian-propaganda/\\n\\nDatasets: none searched for\\n\\nNotes:\\n\\nRussia still accusing Ukraine (03.25.2019)... TASS and UK Daily Mirror \\n\\nFirst Bellingcat report: Efforts to Geolocate the Launcher 07/17/14\\nCountless example of Elliot Higgins & team getting trolled since, popular hashtag is #bellingcrap\\n\\nThis is a good summary: \\n“But not only did Russia fiercely deny those accusations, a number of Russian leaders, officials and broadcasters responded by offering dozens of different alternative explanations, “including quite outlandish theories,” says Nilsson.\\n\\n“For instance, that an airplane would’ve been loaded with already dead people and that Ukrainian airplanes would then have shot it down to make it look like Russia was shooting down passenger airplanes,” he explains.\\n\\n“There were tons of these stories going around, quite a few of them coming from official Russian sources. And they were not meant to be taken seriously. They were simply supposed to occupy the attention span of the world for a while, to the extent that everyone would lose track of the original explanation, which turned out to be quite the right one.” https://globalnews.ca/news/4993120/russia-rising-part-5-maskirovka/\\n\\nTopics of Ukraine-related narratives\\nhttp://euromaidanpress.com/2018/12/06/ukraine-related-narratives-dominate-russian-propaganda/\\nBack in 2016, StopFake co-founder Yevhen Fedchenko identified 18 major Ukraine-related fake narrative topics spread by Russian propaganda by analyzing 500 debunked disinformation items.\\nThe Euromaidan Revolution as a “coup d’état“\\nUkraine as a “fascist state“\\nUkraine as a “failed state“\\n“Russia is not a part of the occupation/war in Ukraine“\\nDiscrediting the Ukrainian Armed Forces (UAF)\\nDiscrediting the volunteer battalions (which officially became a part of UAF in 2015)\\nDonbas and Crimean internally displaced persons (IDPs) and refugees\\nTerritorial disintegration of Ukraine\\n“Territorial claims” for parts of Ukraine from neighboring Poland, Hungary, Romania, and Slovakia\\nFake “international legitimization” of annexation and occupation of Crimea\\nThe war in Ukraine “conducted by the US, NATO or Western private contractors”\\nThe West’s “Ukraine fatigue“\\nManipulating international organizations\\nFakes about EU-Ukraine relations\\n“Decay” of the US and West in general, and the “disintegration of the EU”\\nFlight MH17 crash fakes\\nThe West “uses biological weapons” in Ukraine\\nMix-ups of the fake narratives about Ukraine, Syria, ISIS terrorists (e.g., Crimean Tatars being depicted as jihadists or Ukraine as a training ground for terrorists)\\nFor post-Maidan Ukraine, Russian propaganda’s most used narratives were the Euromaidan as “coup d’etat” which brought a “Western-backed junta” (mostly “US-backed”) to power, and “fascism” as the main ideology of the post-Maidan government, Fedchenko notes.\\n\\n'],\n", + " ['incident',\n", + " 'I00009',\n", + " ' \\n\\nSuspected actors:\\n\\n* Attacker: IRA or more broadly Russian state-sponsored disinformation campaign.\\n* Amplifiers: through the persona of “Adam Garrie” (who first appeared on RT (Russian Today) and pro-Russia sites, with no background in Asia and Philippine affairs but suddenly rose to become a global affairs expert).\\n* Garrie was then promoted by pro-Duterte officials, social media pages and news outlets.\\n \\nTimeframe: After Putin and Philippine’s president Duterte met in Russia in May 2017 and forged a partnership in information dissemination. Duterte and Putin signed a number of national security agreements, including a deal on intelligence sharing, an “MOU on Cooperation in Mass Communications.”\\n \\nDate: 2017- ongoing\\n\\nPresumed goals:\\n\\n* To spread pro-Duterte and Russian propaganda through collaborative effort of both Philippine and Russian disinformation actors.\\n\\nMethod:\\n \\n* Footprint of Garrie on the Philippine media scene started from his connection with Russian IRA websites and pages (GI Analytics Facebook page, Russia Insider, The Duran, Geopolitica.ru, Mint Press News, Oriental Review, globalresearch.ca.)\\n \\n* RT, one of media outlets that interviewed Garrie, was identified by the US Office of the Director of National Intelligence in January 2017 as the primary source of propaganda that the Russians used to further their interests in the 2016 US elections.\\n \\n* Also has appearance on Iran’s IRIB (Islamic Republic of Iran Broadcasting), which was identified by the US Department of the Treasury in 2013 as a network that broadcasts false reports and forced confessions of political detainees and has ties with “politically motivated phishing” accounts on Google.\\n \\n* The Daily Sentry, a Philippine news site emerged at the start of 2018 (no ownership information), started citing Adam Garrie as a global expert after Philippine-Russian ties grew stronger. Between Feb 2018 and Jan 2019, The Daily Sentry cited Garrie in 41% of posts on Facebook that mentioned experts.\\n \\n* By March 2018, Garrie started to come to the mainstream: The Manila Times – a supporter outlet of the Philippine president, cited by pro-Duterte social media pages.\\n \\n* Philippine online groups and pages began to spread Russian propaganda. Some sites link to Duterte officials and supporters including Duterte’s former assistant secretary. For example, Duterte’s former assistant secretary shared content from Trending News Portal site.\\n \\nCounters:\\n\\n* Facebook took down 220 pages and 73 Philippine accounts for spam, including pages of The Daily Sentry and its affiliates, TNP page and related pages.\\n \\nRelated incidents:\\n\\nReferences:\\n\\n* http://www.interaksyon.com/breaking-news/2017/05/30/75431/ph-russia-communication-offices-to-partner-in-info-dissemination/\\n* https://www.rappler.com/nation/188378-ph-russia-sign-bilateral-agreements\\n* https://www.dni.gov/files/documents/ICA_2017_01.pdf\\n* \\n* https://codastory.com/disinformation/how-a-little-known-pro-kremlin-analyst-became-a-philippine-expert-overnight/\\n* https://www.rappler.com/technology/social-media/220741-facebook-remove-trending-news-portal-twinmark-media-enterprises\\n* https://www.rappler.com/thought-leaders/221422-facebook-maria-ressa-rappler-philippines\\n* https://www.rappler.com/nation/194814-maria-ressa-pcoo-training-china-russia\\n* http://www.interaksyon.com/breaking-news/2017/05/30/75431/ph-russia-communication-offices-to-partner-in-info-dissemination/\\n\\n'],\n", + " ['incident',\n", + " 'I00019',\n", + " '\\n\\nActor: \\n\\n* individual accounts on 4chan (IP addresses indicate locations of Sweden, US, France), \\n* accounts on Twitter (both identifiable and anonymous).\\n\\nTimeframe: a few days\\n\\nDate: few hours after Macron and Le Pen were declared winners of the first round of France’s presidential election (April 23, 2017).\\n\\nPresumed goals: creating and spreading hoaxes and misinformation related to Macron’s personal life, marriage, sexuality, position on terrorism, etc. to spur support for Le Pen in the second round of voting.\\n\\nMethod: posts and memes started on 4chan and later shared in Twitter\\n\\nCounters: no actions noted.\\n\\nRelated incidents:\\n\\n* #MacronGate and #MacronCacheCash: fake documents on 4chan about Macron’s alleged offshore account.\\n\\nReferences:\\n* https://www.buzzfeednews.com/article/ryanhatesthis/heres-how-far-right-trolls-are-spreading-hoaxes-about\\n* https://www.niemanlab.org/2018/09/how-france-beat-back-information-manipulation-and-how-other-democracies-might-do-the-same/\\n'],\n", + " ['incident',\n", + " 'I00004',\n", + " '\\n\\nActor: IRA\\n\\nTimeframe: 1 day (plus preparation)\\n\\nDate: May 2017\\n\\nPresumed goals: reduce Emmanuel Macron’s chance of winning French presidential election\\n\\nMethod:\\n\\n* fake documents posted on 4chan about Macron’s alleged offshore account, \\n* amplified by pro-Trump Twitter accounts using #MacronGate and #MacronCacheCash\\n\\nCounters: \\n\\n* preparation (resilience, account removals), \\n* honeytraps, \\n* counter-response with humour.\\n\\nRelated incidents:\\n\\n* DNC document release, US presidential elections, 2016\\n\\n\\nReferences:\\n\\n* Source: https://www.patreon.com/posts/macrongate-tied-11940855 \\n* http://www.niemanlab.org/2018/09/how-france-beat-back-information-manipulation-and-how-other-democracies-might-do-the-same/\\n* https://www.theguardian.com/world/2017/may/08/macron-hackers-linked-to-russian-affiliated-group-behind-us-attack \\n'],\n", + " ['incident',\n", + " 'I00045',\n", + " '\\n\\nActor: Russia\\n\\nTimeframe: March 4, 2018 - ongoing\\n\\nDate: March 4, 2018\\n\\nPresumed goals: \\n\\n* Russian officials have sought to exploit holes in the complicated narrative of the poisoning to suggest an anti-Russian conspiracy. Mark Galeotti, an expert on the Russian intelligence services, wrote in an op-ed in The Moscow Times… “The Kremlin is enjoying the reputation of being a swashbuckling maverick, ruthless, dangerous and decisive,” he wrote. “This has a certain value, not least in deterring the fainthearted.”\\n* Reuters: Commentary: For Putin’s Russia, a poisoned spy sends a political message “the poisoning as a sign of just how committed Vladimir Putin’s Kremlin has become to eradicating its enemies – and reminding others it can do so.”\\n\\nMethod: \\n\\n* Multi-source/channel/media response \\n* highlighting conspiracies: It was a British “false flag” operation; It could be the CIA; Because of Donald Trump; There’s always Ukraine\\n* The conspiracy theories did not stop here. Multiple special-interest groups have attempted to lay the blame for the Skripals’ poisoning at the door of their chosen enemies. A UKIP branch in High Wycombe, in the English Home Counties, tweeted to accuse “a third party such as the EU” of “trying to interfere in UK Russian relations.” Sputnik even misquoted former Kremlin advisor Alexander Nekrassov as accusing “rouge agents” [sic] of carrying out the attack, “for some sort agenda [sic] such as slander or tarnish Russia [sic] or cause friction between Britain and Russia.” Matteo Salvini, Italian politician and member of the Italian senate, shared an article on his Facebook page, titled “The Skripal Case is a hoax, the war of the West against Russia is terribly true”. His post was liked 3,800 times and generated over 800 shares.\\n* Here are 20 different narratives offered by Russian media and officials for the poisoning: The United Kingdom did it to fuel anti-Russian sentiment (source: Russia 1 TV channel); Ukraine did it to frame Russia (Russia 1); The United States did it to destabilize the world (Russia 1); Theresa May helped orchestrate the attack because she is a friend of CIA director Gina Haspel (Zvezda); It was an attempted suicide (Russia 1)\\nIt was an accidental overdose (RIA Novosti); It was due to accidental exposure from Britain’s Porton Down research facility (Russia 24 TV channel); The Porton Down lab carried out illicit human testing and is lying about not producing Novichok (RT); Skripal’s future mother-in-law did it (Moskovsky Komsomolets: mk.ru)\\nTerrorists did it (Russian ministry of foreign affairs spokesperson); American-British financier Bill Browder — blacklisted in Russia for denouncing corruption — did it (Russia 1); A drone did it (Zvezda and Russian defense ministry); Skripal was a chemical weapons smuggler (Pravda); The West is using the case to deflect attention from Russia’s successes in Syria (Russian ministry of foreign affairs spokesperson); Britain is using the case to deflect attention from Brexit (Russian Foreign Minister Sergei Lavrov, Russian UN ambassador, Russian OSCE ambassador); The attack was an attempt by a rival faction to undermine Vladimir Putin (state TV); Russia has destroyed all its stockpiles of Novichok (Sputnik); Russia never developed Novichok (Interfax); Only the Czech Republic, Slovakia, and Sweden have Novichok (Russian ministry of foreign affairs spokesperson). All three countries have denied the claim.; There is no evidence that the nerve agent used against the Skripals was Novichok, Porton Down lab is struggling to identify the substance (RT)\\n\\nCounters: \\n\\n* Bellingcat; \\n* DFRLab; \\n\\nRelated incidents: \\n\\n* ties to ongoing campaigns/narrative - Ukraine; NATO; EU; Brexit\\n\\nReferences:\\n\\n* https://www.themoscowtimes.com/2019/03/03/a-year-after-the-skripal-poisoning-how-much-has-really-changed-a64677\\n* https://www.reuters.com/article/us-apps-poisoning-commentary/commentary-for-putins-russia-a-poisoned-spy-sends-a-political-message-idUSKCN1GK309\\n* https://twitter.com/UKIPHighWycombe/status/971773863230164992\\n* https://sputniknews.com/analysis/201803141062498438-uk-novichok-nerve-agent-skripal/\\n* https://www.facebook.com/salviniofficial/posts/10155663618083155\\n* http://www.linkiesta.it/it/article/2018/03/28/il-caso-skripal-e-una-bufala-la-guerra-delloccidente-alla-russia-e-ter/37595/\\n* https://www.rt.com/news/452946-skripal-anniversary-truth-novichok/\\n* https://disinfoportal.org/sputnik-abkhazias-disinformation-about-porton-down-allegedly-denying-russian-trace-in-skripal-poisoning/\\n* https://www.nytimes.com/2019/03/04/world/europe/russia-skripal-poisoning-britain.html\\n\\n\\n* https://www.bellingcat.com/tag/skripal/\\n* https://medium.com/dfrlab/skripal-poisoning-if-not-russia-then-1d49f086e3e0\\n* https://medium.com/dfrlab/uk-poisoning-russia-recycles-responses-77e1d357b777\\n* https://medium.com/dfrlab/putinatwar-social-media-surge-on-skripal-b5132db6f439\\n* https://euvsdisinfo.eu/conspiracy-mania-marks-one-year-anniversary-of-the-skripal-poisoning/\\n* https://www.nytimes.com/2019/03/04/world/europe/russia-skripal-poisoning-britain.html\\n* https://www.reuters.com/article/us-britain-russia-skripal/third-suspect-in-skripal-poisoning-is-russian-gru-agent-bellingcat-idUSKCN1Q32BZ\\n* http://euromaidanpress.com/2018/04/11/five-ways-russia-is-generating-a-conspiracy-smokescreen-around-the-skripal-poisoning/\\n* http://euromaidanpress.com/2018/03/30/russian-media-have-published-20-different-narratives-on-skripal-poisoning/\\n* https://en.wikipedia.org/wiki/Poisoning_of_Sergei_and_Yulia_Skripal\\n\\nVisual assets (Google Drive)\\n\\nDatasets: \\n\\nNotes: \\n\\nOn 6 March 2018 Andrey Lugovoy, deputy of Russia\\'s State Duma (the Liberal Democratic Party of Russia) and alleged killer of Alexander Litvinenko, in his interview with the Echo of Moscow said: \"Something constantly happens to Russian citizens who either run away from Russian justice, or for some reason choose for themselves a way of life they call a change of their Motherland. So the more Britain accepts on its territory every good-for-nothing, every scum from all over the world, the more problems they will have.\"\\nRussian Foreign Minister Sergey Lavrov on 9 March rejected Britain\\'s claim of Russia\\'s involvement in Skripal\\'s poisoning and accused the United Kingdom of spreading \"propaganda\". Lavrov said that Russia was \"ready to cooperate\" and demanded access to the samples of the nerve-agent which was used to poison Skripal. The request was rejected by the British government.\\n\\nOngoing… one year later\\nhttps://disinfoportal.org/sputnik-abkhazias-disinformation-about-porton-down-allegedly-denying-russian-trace-in-skripal-poisoning/\\nOn February 7, 2019, Sputnik-Abkhazia released an article headlined “Scotland Yard about the third suspect in the Skripal case: the investigation continues.” According to Sputnik-Abkhazia, the Russian Foreign Ministry caught British Prime Minister Theresa May in a lie, because the Porton Down Laboratory denied that a nerve agent that poisoned Russian ex-spy, Sergei Skripal and his daughter, Yulia had been produced in Russia\\n\\nhttps://www.nytimes.com/2019/03/04/world/europe/russia-skripal-poisoning-britain.html\\nRather than ignoring the anniversary, however, Russia punctuated the occasion on Monday with an hourlong news conference at the United Nations and a 52-page report rehashing the episode in detail, amplified by extensive coverage on its English-language government channel, RT.\\n \\nRussian officials also have tried to turn the tables, accusing Britain of violating international law by refusing to provide Russian consular officials access to the Skripals, who survived and whose whereabouts has not been made public. \\n\\n\\n'],\n", + " ['incident',\n", + " 'I00051',\n", + " '\\n\\nActor: Russia\\n\\nTimeframe: December 2018 - (ongoing)\\n\\nDate: December 10, 2018\\n\\nPresumed goals: \\n\\n* Russian disinformation intended to confuse audiences and discredit an organisation (Integrity Inititative)which is working independently to tackle the threat of disinformation. Russia’s state-owned media outlets have seized on the posted materials, with the government’s RT and Sputnik news sites writing dozens of stories claiming that the materials prove that the British government, rather than Russia, is trying to poison internet discourse with propaganda.\\n \\nMethod: \\n\\n* Hack (email), leak, amplify, smear MSM\\n\\nCounters: none identified\\n\\nRelated incidents: \\n\\n* The campaign also threads other organization into the “conspiracy” such as Britsh Military, NATO and the CIA.\\n* With it, efforts to further discredit MH17 for instance; tie-in Soro’s (dog-whistle for the far-right); \\n* yet at the same defend the far-left alleging Integrity Initiative was running a smear campaign again UK Labour/Jeremy Corbyn\\n\\nReferences: \\n* https://eaworldview.com/2019/01/counter-russia-disinformation-integrity-initiative/\\n* https://www.stopfake.org/en/kremlin-watch-briefing-the-eu-has-to-start-taking-pro-kremlin-disinformation-seriously/\\n* https://www.buzzfeednews.com/article/kevincollier/russian-hackers-british-institute\\n* https://www.bbc.com/news/uk-46509956\\n* https://www.thetimes.co.uk/article/anti-propaganda-website-forced-offline-by-hacking-b0ds2bkbp\\n* https://eaworldview.com/2019/01/counter-russia-disinformation-integrity-initiative/\\n* https://news.sky.com/story/highly-likely-moscow-hacked-uk-agency-countering-russian-disinformation-11656539\\n* http://euromaidanpress.com/2019/01/17/russian-attack-on-the-integrity-initiative-what-makes-the-mafia-different-from-the-police/\\n\\nDatasets: \\n\\nNotes: \\n\\nRT and Sputnik claim that the Integrity Initiative hack was the work of freelancers aligned with the online Anonymous collective and who were not affiliated with the Russian government. The primary evidence for that, according to RT and Sputnik, is that the stolen Integrity Initiative material was posted to the website of a hacktivist collective called CyberGuerrilla, alongside manifestos claiming “We are Anonymous” and posts saying “We have warned the UK government that it must conduct an honest and transparent investigation into the activity of the Integrity Initiative and the Institute for Statecraft.”\\n\\nThe Integrity Initiative has pulled down its website, replacing it with a reiteration of its mission, a description of the hack, and a call for tips.\\n“This international public programme was set up in 2015 to counter disinformation and other forms of malign influence being conducted by states and sub-state actors seeking to interfere in democratic processes and to undermine public confidence in national political institutions,” a spokesperson said in a statement.\\n\\n \\n\\n'],\n", + " ['incident',\n", + " 'I00034',\n", + " \"\\n\\nActor: China\\n\\nTimeframe: 72 hours?\\n\\nDate: January 20th, 2016\\n\\nPresumed goals: \\n\\n* The trolls planned their attack for 7pm, China time, on January 20. Members of Di Ba—one of the largest message boards on the internet—would organize into groups, leap over the Great Firewall to reach Facebook, and flood it with the message that Taiwan is part of China. The anti-independence and pro-China posts started to take over the Facebook page of Tsai Ing-wen, Taiwan’s newly elected president\\n\\nMethod: \\n\\n* Tsai’s latest Facebook post, about a meeting she had with leaders from her Democratic Progressive Party (DPP), attracted nearly 40,000 Facebook comments in just eight hours.\\n* News of the attack spread far and wide, with a number of posts making their way around social network WeChat. * For most of the day “Di Ba’s Facebook battle” has been at the top of the list of searched terms on Weibo, a Chinese microblog site similar to Twitter. News outlets in Taiwan covered the story (link in Chinese).\\n* Information also spread suggesting that Di Ba’s battle was organized and well-prepared. Screenshots showed that attackers were separated into six “columns,” in the military sense: information gathering; posting; writing opinions and creating images; translation; miscellaneous Facebook tasks such as liking posts; and a vanguard to head things up.\\n* The majority of the 26K comments consisted of lines copied and pasted from the officially designated messages\\n* more than 42,000 people had made comments on a single post of Ms Tsai's Facebook page, demanding her self-ruled island be brought under Chinese control.\\n* Beginning at 7 pm on January 20, 2016 CST (China Standard Time), tens of thousands of\\ncomments against Taiwan independence appeared in posts of Taiwan President-elect Ms. Tsai Ing-Wen’s Facebook page as well as news media’s such as Sanli News and Apple Daily. While the organizers claim to taking further steps on issues against Taiwan independence, the event lasted for less than two days due to Chinese government’s intervention, leaving tens of thousands of comments either deleted or unattended.\\n* Within this most active group, every username posted 6 comments at least and 12 comments\\non average. The most productive one posted 192 comments during this period. Two interesting\\nfindings come from the discrepant mapping result of Facebook usernames and IDs, which imply\\nparticipants’ strategy. First, users might share account. We found five IDs, each of which is\\nassociated with different usernames. According to one internal document downloaded from the\\nQQ group, some participants would register Facebook accounts in advance, and then give them to those responsible for attack. Since Facebook allows users to change their usernames anytime, we speculate whether this may be due to the sharing of accounts but changing the name to differentiate the identity.\\n* Second, users shared some usernames to maintain the consistency of their identities. The total\\nnumber of IDs is more than the number of unique usernames. Many usernames are shared by\\ndifferent IDs, which account for 2.82% of all 16,891 IDs. One possible reason for this practice is\\nthat during the attack, reporting and blocking accounts is a prevalent tactic used by both sides as defense. Once the account is “dead”, the user has to register for a new account to keep fighting. One commenter said that he/she was blocked over 3 times, but kept registering new accounts to fight. It is thus not surprising to see a small percentage of users who have more than one ID while maintaining the same username.\\n* More notable is the case where one username is shared by more than 10 IDs. One possible\\nexplanation is that someone dedicates himself/herself to this event and intends to increase their\\nvisibility. However, for those usernames associated with over 30 IDs, we argue that it might be a\\nunique strategy for attacking or trolling, because it is difficult to log into multiple accounts and\\npost comments by a single user.\\n\\nCounters: \\n\\nRelated incidents: \\n\\nReferences:\\n\\n* https://www.ideals.illinois.edu/handle/2142/96746\\n* https://qz.com/598812/an-army-of-chinese-trolls-has-jumped-the-great-firewall-to-attack-taiwanese-independence-on-facebook/\\n* https://www.abc.net.au/news/2016-01-21/chinese-facebook-users-flooding-taiwan-president-elect-account/7105228\\n* https://www.businessinsider.com/chinese-people-are-flooding-the-internet-with-a-campaign-against-taiwan-2016-1\\n\\n\\n\\n\"],\n", + " ['incident',\n", + " 'I00010',\n", + " '\\n\\nActors: IRA, Alex Jones, far right and far left trolls\\n\\nTimeframe: Ongoing\\n\\nDate: February 2018\\n\\nPresumed goals: Divide the American public on the issues of guns, race, generational politics and activism\\n\\nMethod: Amplification via sockpuppet and cyborg accounts\\n\\nCounters: None / Media exposure\\n\\nRelated incidents: \\n\\n* Sandy Hook hoaxers / Sandy Hook fatalists\\n\\nReferences\\n\\n* [How Russian trolls exploited Parkland mass shooting on social media](https://www.politifact.com/truth-o-meter/article/2018/feb/22/how-russian-trolls-exploited-parkland-mass-shootin/)\\n* [PRO-GUN RUSSIAN BOTS FLOOD TWITTER AFTER PARKLAND SHOOTING](https://www.wired.com/story/pro-gun-russian-bots-flood-twitter-after-parkland-shooting/)\\n* [Russian trolls flood Twitter after Parkland shooting](https://www.nbcnews.com/tech/social-media/russian-trolls-flood-twitter-after-parkland-shooting-n848471)\\n* [Russian Trolls Are Tweeting Propaganda After Stoneman Shooting](http://nymag.com/intelligencer/2018/02/russian-trolls-tweet-propaganda-after-florida-shooting.html)\\n\\nDetails\\n\\nFollowing the Feb. 14 shooting at Marjory Stoneman Douglas High School that left 17 dead, an army of human-controlled and automated accounts spread related content across Twitter. \\n\\nHamilton 68, a website created by Alliance for Securing Democracy, tracks Twitter activity from accounts it has identified as linked to Russian influence campaigns. As of morning, shooting-related terms dominated the site’s trending hashtags and topics, including Parkland, guncontrolnow, Florida, guncontrol, and Nikolas Cruz, the name of the alleged shooter. Popular trending topics among the bot network include shooter, NRA, shooting, Nikolas, Florida, and teacher.\\n\\nAccording to the German Marshall Fund, which tracks Russian-linked Twitter activity, the following are some of the more popular narratives, themes and articles.\\nThe \\'crisis actor\\' conspiracy\\n\\'False flag\\' and other conspiracy hashtags\\nMeanwhile, some accounts with large bot followings are already spreading misinformation about the shooter\\'s ties to far-left group Antifa, even though the Associated Press reported that he was a member of a local white nationalist group.\\nOne theory associated with these hashtags is that Marjory Stoneman Douglas High School was targeted because the school’s namesake was opposed to \"draining the swamp\" of the Florida Everglades. Under this theory, the Parkland shooting was a cryptic message to Trump, who vowed during his campaign to \"drain the swamp\" in Washington by hollowing out its infrastructure of career politicians, insiders and influence peddlers.\\nSowing discord\\nExperts say the goal of Russian troll propagandists isn\\'t to sway people\\'s opinions in one way or another. Instead, the accounts seek to exploit divisions in order to break down society into smaller, warring groups. Trolls drum up persona accounts on every side of the ideological spectrum and take advantage of high-impact events to spread confusion and disarray. In particular, they\\'re able to take advantage of how Twitter doesn\\'t require users to verify their identity.\\nRussian accounts boosted erroneous content concerning the motives of the alleged shooter Nikolas Cruz.\\nAccording to the German Marshall Fund, one of the top links shared by Russia-linked accounts in the aftermath of the shooting was our 2014 article that largely debunked a statistic cited by pro-gun control group Everytown for Gun Safety.\\nA survey of tweets using the top hashtags flagged by the Hamilton 68 dashboard showed tweets adamantly in favor of gun control and saying the NRA had taken \"blood money.\" Other tweets attacked liberals, the media and lawmakers.\\nAnother top link shared by the network covers the “deranged” Instagram account of the shooter, showing images of him holding guns and knives, wearing army hats, and a screenshot of a Google search of the phrase “Allahu Akbar.” Characterizing shooters as deranged lone wolves with potential terrorist connections is a popular strategy of pro-gun groups because of the implication that new gun laws could not have prevented their actions.\\nThe use of pro-gun control hashtags like #guncontrolnow, along with the spread of anti-gun control links like the Politifact article, appear at first to show the Russian strategy of promoting discord on both sides of a debate.\\nIn other cases, the bots jump on existing hashtags to take control of the conversation and amplify a message. That’s likely what is happening with the Parkland shooting and the hashtag guncontrolnow.\\nPublic awareness that antagonistic bots flood the Twitter debate hasn’t stopped them from achieving their goals of ratcheting up the vitriol—even amid a live tragedy like the Parkland shooting. The goal, after all, isn\\'t to help one side or the other of the gun control debate win. It\\'s to amplify the loudest voices in that fight, deepening the divisions between us.\\n\\nExamples\\n\\n'],\n", + " ['incident',\n", + " 'I00050',\n", + " '\\n\\nActor: Russia, Cuba, China, Iran\\n\\nTimeframe: January 23, 2019\\n\\nDate: January 29, 2019 - ongoing\\n\\nPresumed goals: \\n\\n* Given the history (going back to the Monroe Doctrine) the US is easily characterized with “imperialist” aspirations. Of course there’s the connected issue of oil and Venezuela’s indebtedness to Russia and China. The relationship between Cuba and Venezuela can not be underscored going back to Castro & Chavez’s relationship.\\n\\n* Search (google) #handsofvenezuela the results are largely linking to articles denouncing the US and those countries opposed to the Maduro regime. “There\\'s been a lot of misinformation in the international media about whether what is happening in Venezuela is a brazen US-led power grab or a constitutional …” Jan 13, 2019 - An attempt at an imperialist coup d\\'état is underway in Venezuela. It must ... Most likely this is another attempt by Washington to spread misinformation and ... socialist and anti-imperialist, is to reject this scandalous imperialist …\\n\\n* Activists to Trump: \\'Hands Off Venezuela\\' - Truthdig\\nhttps://www.truthdig.com/articles/activists-to-trump-hands-off-venezuela/\\nMar 17, 2019 - medeabenjamin “We are absolutely opposed to economic sanctions in Venezuela” at the #HandsOffVenezuela rally. pic.twitter.com/ ... Packed London meeting says: “US-UK, hands off Venezuela!\"\\nhttps://www.marxist.com/packed-london-meeting-says-us-uk-hands-off-venezuela.htm\\nJan 31, 2019 - Nearly 100 people packed the #HandsOffVenezuela meeting in London on 30 January, and heard Venezuelan ambassador Rocío Manero, ...\\n\\nMethod: \\n\\n* From efforts via blogs, “news” sites and media supporting the left/socialism/stateism positioning anti-Maduro efforts as “imperialisitic” it’s noteworthy to documented the efforts in February to deliver aid to the country. For instance this case study - analysis demonstrates that the depiction of Russia’s role as “peacekeeper” and “defender” has had a big impact on the networks. We filtered all mentions to include only those containing the words “Russia”, “Moscow” or “Putin” in reference to Venezuela. This resulted in a total number of 60,315 tweets for the period. A few peaks can be noticed at times when Russian sources, mainly RT and Sputnik, forward Venezuela-related news.\\nA: Russia expresses an adamant position that Maduro is the legitimate president of Venezuela\\nB: Russia will defend the Venezuelan Constitution\\nC: The US is massing troops at the Venezuelan border\\nE: Russia is sending humanitarian aid to Venezuela\\n* The Trojan Horse. The most striking success of the Russian disinformation campaign is the impact of the Trojan Horse Narrative. The first case of describing US and EU humanitarian aid to Venezuela as a Trojan horse, in Spanish Caballo de Troya, appeared in Spanish language networks on 24 January:\\nFrom February 23, 2019 - Billionaire businessman Richard Branson says he hopes his Live Aid-inspired concert to raise funds for Venezuelans will persuade members of the country\\'s military to defy President Nicolas Maduro and allow humanitarian aid to cross the border.\\nBranson, who will host \"Venezuela Aid Live\" on Friday in the Colombian border town of Cucuta, said he is aiming to raise about $100 million to buy food and medicine, essential supplies for the country, which is gripped by a political and humanitarian crisis.\\nIn reaction to - Maduro’s government announced that it would accept contributions from China and Cuba, but called Guaidó-organized aid, which includes contributions from the United States, a “handout.” In an interview with the Associated Press this week, Maduro blamed U.S. sanctions for Venezuela’s economic woes, saying “the infected hand of Donald Trump is hurting Venezuela.”\\n* Like the White Helmets (Musician) Roger Waters (willing idiot) weighs in - In a two-minute video posted on Twitter, the musician says Mr Branson\\'s \"Live-Aid-ish\" concert has \"nothing to do with humanitarian aid at all\". \"It has to do with Richard Branson, and I\\'m not surprised by this, having bought the US saying: \\'We have decided to take over Venezuela, for whatever our reasons may be,\\'\" Mr Waters says. \"But it has nothing to do with the needs of the Venezuelan people, it has nothing to do with democracy, it has nothing to do with freedom, and it has nothing to do with aid.\" He adds that he has \"friends that are in Caracas\" who claim there is \"no civil war, no mayhem, no murder, no apparent dictatorship, no suppression of the press\"\\nMaduro government holds their own concert to counter Branson’s efforts\\nhttps://www.cnbc.com/2019/02/19/richard-branson-maduro-concert-on-venezuela-border.html\\nhttps://www.theguardian.com/world/2019/feb/19/maduro-government-richard-branson-rival-venezuela-concerts\\nJust 300 metres away, the first of some 150 artists began performing at Maduro\\'s Hands off Venezuela festival. \\nhttps://www.aljazeera.com/news/2019/02/rival-concerts-backdrop-venezuela-power-struggle-190222142807321.html\\n\\n* The Russian official line - (talking points for trolls & willing/unwitting idiots)\\nOn Tuesday, Russian Foreign Minister Sergey Lavrov criticized the U.S. sanctions, which meant that proceeds from the sale of Venezuelan oil would be withheld from Maduro’s government.\\nIn a press conference, Lavrov dubbed the U.S. sanctions “illegitimate” and “cynical,” adding that Russia “along with other responsible members of the global community will do everything to support the legal government of the president,” RIA Novosti reported.\\nThere is concern in Moscow about the level of debt Caracas owes Russia. Russian Deputy Finance Minister Sergei Storchak said the sanctions may mean Venezuela will have problems servicing sovereign debt to Russia.\\nVenezuela has two months to pay Russian $100 million and there is uncertainty as to whether PDVSA can service its debt to Russia’s state energy giant Rosneft, Radio Free Europe reported\\nThe evolution/spread of talking points \\nBut while the Canadian government, which accused Maduro of seizing power through fraudulent elections, has expressed full support for Guaido, some Canadian protesters are calling it out for what they say is an attack on Venezuela’s sovereignty.\\n“What is brewing, what is being organized is an actual military intervention of Venezuela,” said Margaret Villamizar, who attended a protest in Windsor, Ont. “If it doesn’t turn out to be full-scale military, what’s being called diplomacy is really an attack on Venezuela’s sovereignty.”\\n \\n* Also - In an interview with Foreign Policy, Adm. Craig Faller, the four-star military officer who heads U.S. Southern Command, pointed to a Chinese disinformation campaign designed to blame the United States for the blackouts that devastated Venezuela in recent weeks. https://foreignpolicy.com/2019/04/08/us-military-wary-of-chinas-foothold-in-venezuela-maduro-faller-guaido-trump-pentagon/\\nA Chinese plane loaded with 65 tons of medical supplies landed in Venezuela\\'s capital of Caracas on Friday amid a power struggle between President Nicolas Maduro and opposition leader Juan Guaido.\\nMaduro welcomed the arrival of the humanitarian aid on Twitter, saying \"Venezuela is breaking the imperialist siege and advancing with a victory.\"\\nHe shared photos showing the arrival of the aid as well as a photo of him taken with his Chinese counterpart Xi Jinping during his visit to China last year.\\nChina\\'s move came after Russia sent humanitarian aid to Caracas last week.\\nVenezuela has been rocked by protests since Jan. 10, when Maduro was sworn in for a second term following a vote boycotted by the opposition.\\nhttps://www.aa.com.tr/en/americas/venezuela-welcomes-arrival-of-chinese-medical-aid/1435166\\n \\nCounters: \\n\\n* Every report suggesting that Venezuela is mired in a humanitarian crisis.\\nApril 10, 2019 The UN reports “There is a very real humanitarian problem in Venezuela,” said Mark Lowcock, the UN humanitarian chief. “We estimate that 7 million people in Venezuela need humanitarian assistance. That is some 25 per cent of the population,”\\nApril 10, 2019 NY Times ‘You Shouldn’t Be Here’: U.S. Pushes U.N. to Pull Venezuela Envoy’s Credentials\\nGo back to October 2018 Washington Post: A humanitarian crisis in Venezuela? Nothing to see here, government says. Human Rights Watch Report\\n\\nRelated incidents: \\n\\n* Speculation but research worthy… right/left regional binary pitting new right wing governments in Brazil & Columbia and hosility/percieved hosility to regimes like Venezuela & Ecuador\\n\\nReferences: \\n\\n* https://www.truthdig.com/articles/activists-to-trump-hands-off-venezuela/\\n* https://www.marxist.com/packed-london-meeting-says-us-uk-hands-off-venezuela.htm\\n* https://euvsdisinfo.eu/twitter-as-an-information-battlefield-venezuela-a-case-study/\\n* https://www.washingtonpost.com/world/the_americas/in-venezuela-humanitarian-aid-has-become-a-political-weapon/2019/02/14/5eab781a-3089-11e9-8781-763619f12cb4_story.html\\n* https://www.apnews.com/21b641f6def1400894125e3a8117f66c\\n* https://www.cnbc.com/2019/02/19/richard-branson-maduro-concert-on-venezuela-border.html\\n* https://www.theguardian.com/world/2019/feb/19/maduro-government-richard-branson-rival-venezuela-concerts\\n* https://www.aljazeera.com/news/2019/02/rival-concerts-backdrop-venezuela-power-struggle-190222142807321.html\\n* https://foreignpolicy.com/2019/04/08/us-military-wary-of-chinas-foothold-in-venezuela-maduro-faller-guaido-trump-pentagon/\\n* https://www.aa.com.tr/en/americas/venezuela-welcomes-arrival-of-chinese-medical-aid/1435166\\n* https://news.un.org/en/story/2019/04/1036441\\n* https://www.nytimes.com/2019/04/10/world/americas/pence-venezuela-un-envoy.html\\n* https://www.washingtonpost.com/world/the_americas/a-humanitarian-crisis-in-venezuela-nothing-to-see-here-government-says/2018/10/12/6ebd1aa6-c2ac-11e8-9451-e878f96be19b_story.html\\n* https://www.hrw.org/world-report/2019/country-chapters/venezuela\\n* https://euvsdisinfo.eu/twitter-as-an-information-battlefield-venezuela-a-case-study/\\n* https://www.npr.org/2019/03/25/706635580/venezuelas-maduro-faces-pressure-from-much-of-the-world-yet-he-persists\\n* https://cronkitenews.azpbs.org/2019/02/26/venezuela-protests-in-tucson/\\n* https://www.newsweek.com/donald-trump-told-hands-venezuela-countrys-president-who-has-full-backing-1309188\\n* https://www.dw.com/cda/en/venezuela-juan-guaido-urges-army-to-let-aid-through/a-47651164\\n* https://www.npr.org/2019/04/02/709306132/maduro-allies-move-against-rival-juan-guaid-in-venezuela\\n* https://www.washingtonpost.com/world/2019/04/02/trump-has-russia-problem-venezuela/?utm_term=.9233de48de14\\n* https://www.atlanticcouncil.org/blogs/new-atlanticist/russia-s-venezuela-challenge\\n* https://www.theglobeandmail.com/world/article-venezuelas-maduro-seeks-to-restore-power-stem-looting-as-china/\\n* https://www.npr.org/tags/587365601/venezuela-crisis\\n* https://www.washingtonpost.com/world/2019/02/16/richard-bransons-goal-million-venezuela-could-face-an-obstacle-maduro/?utm_term=.8a5ad46a730a\\n* https://www.bbc.com/news/world-latin-america-47271182\\n\\nNotes:\\n\\n\\n \\n\\n'],\n", + " ['incident',\n", + " 'I00001',\n", + " '\\n\\nActor: \\n\\nTimeframe: \\n\\nDate: \\n\\nPresumed goals: “Russian-linked social media accounts saw racial tensions as something to be exploited in order to achieve the broader Russian goal of dividing Americans and creating chaos in U.S. politics during a campaign in which race repeatedly became an issue.”\\n\\nMethod: \\nPossibly linked: black lives matter facebook ads, targetted at Baltimore, Ferguson, Missouri https://money.cnn.com/2017/09/27/media/facebook-black-lives-matter-targeting/index.html?iid=EL \\n\\nCounters:\\n\\nRelated incidents:\\n\\n* Txrebels facebook group\\n* MuslimAmerica facebook group\\n* Patriotus facebook group\\n* SecuredBorders facebook group\\n* Lgbtun facebook group\\n* Black Matters facebook group\\n\\nReferences:\\n* https://money.cnn.com/2017/09/28/media/blacktivist-russia-facebook-twitter/index.html\\n* https://news.docnow.io/blacktivists-in-the-archive-71c807aa247e\\n* https://www.thedailybeast.com/exclusive-secret-documents-from-russias-election-trolls-leak\\n\\n\\n\\nDatasets\\n\\n* https://docs.google.com/spreadsheets/d/1OZcRCZuz83bMpxVjpUYEALiS4OtKU-pTVtTveG_Ljs0/edit#gid=0 - from https://news.docnow.io/blacktivists-in-the-archive-71c807aa247e are the @blacktivists tweets that used the #blacklivesmatter hashtag\\n* Jonathan Albright got the facebook text: https://data.world/d1gi/missing-fb-posts-w-share-stats/workspace/file?filename=Blacktivist+Facebook+Page+%28Text%29.pdf https://data.world/d1gi/missing-fb-posts-w-share-stats/workspace/file?filename=Blacktivist+Facebook+Page+%28Text%29-2.docx \\n\\nNotes\\n\\nFirst i read the cnn article, then did a twitter search to see if there are traces of the accounts left online. Only discussion about the IRA operation seem to be on Twitter. Also searched twitter for some of the text found later (in datasets) - nothing matches. \\nReading the docnow.io post showed some interesting behavours. Also that there was no central data repo for the blacktivists posts. Classic was the tweets being sent only in 8am-6pm Moscow time. Also interesting: the followers grew over time, but they grew and dropped friends (people they followed) in batches periodically - was this to avoid hitting limits? \\nReading the dailybeast.com article (on an IRA leak), it seems specific individuals were targetted. Thinking about the places we need to search: if it’s Russia, seems like we need to check twitter, facebook, youtube, reddit, tumblr, instagram, 9gag. \\nNames some of the people contacted, e.g. Craig Carson, a Rochester, New York, attorney and civil rights activist; maybe Shanall LaRay Logan—who lives in Sacramento, California; \\n\\n\\n'],\n", + " ['incident',\n", + " 'I00035',\n", + " '\\n\\nSummary: \\n\\nActor: \\n\\nTimeframe: \\n\\nDate: \\n\\nPresumed goals: \\n\\nMethod:\\n\\n* Bot activity that inflates the visibility of and perceived support for certain candidates and ideologies in 2014 elections.\\n* Campaigns use bots or spread content favorable to their respective candidates in 2014. Neves’ operation used bots on a much larger scale than the Rousseff’s campaign (on FB, Twitter and WhatsApp).\\n\\nCounters:\\n\\n* Facebook removed 200 pages run by individuals connected to the right-wing activist organization Movimento Brasil Livre related to the Brazil elections.\\n\\nRelated incidents: \\n\\nReferences:\\n* https://blogs.oii.ox.ac.uk/politicalbots/wp-content/uploads/sites/89/2017/06/Comprop-Brazil-1.pdf\\n* https://www.wilsoncenter.org/blog-post/bots-brazil-the-activity-social-media-bots-brazilian-elections\\n \\n\\n'],\n", + " ['incident',\n", + " 'I00025',\n", + " '\\n\\nActor: Russia\\n\\nTimeframe: November 6, 2018 - end of November 2018\\n\\nDate: November 6, 2018\\n\\nPresumed goals:\\n\\n* Include - Leave campaigners have claimed that the UK would be forced into an ‘EU army’ under the rules allowing for these activities. https://fullfact.org/europe/hunt-eu-army/\\n* Baltic states are frightened by the single European army. The new European security system will be anti-American. To the leadership of the Baltic states, based on Russophobia, this doesn’t look good.\\n\\nMethod: \\n\\n* “Limited” engagement & channels. In this case Reddit was key forum. \\n* Could not find examples of engagement from “usual suspects” ie: Russian embassy; military or broad mentions via RT & Sputnik\\n\\nCounters: \\n\\nRelated incidents: \\n\\nReferences: \\n\\n* https://www.theguardian.com/politics/2016/may/27/is-there-a-secret-plan-to-create-an-eu-army\\n* https://medium.com/dfrlab/spread-it-on-reddit-3170a463e787\\n* https://www.atlanticcouncil.org/blogs/new-atlanticist/a-european-army-eminently-defensible-but-not-probable-for-a-long-time-to-come\\n* https://www.bbc.com/news/world-europe-46108633\\n* https://www.politico.eu/article/angela-merkel-emmanuel-macron-eu-army-to-complement-nato/\\n* https://euvsdisinfo.eu/report/baltic-states-frightened-by-the-single-european-army/\\n* https://www.theguardian.com/commentisfree/2019/jan/25/brexiters-european-army-myths-franco-german\\n* https://fullfact.org/europe/hunt-eu-army/\\n* https://www.theguardian.com/politics/2016/may/27/is-there-a-secret-plan-to-create-an-eu-army\\n\\n\\nDatasets: \\n\\nNotes:\\nWorth noting the Breitbart commentary (see visual assets); compared to campaigns against NATO for instance, this incident didn’t seemingly have much traction/momentum, and seemed more of a potential wedge for the pro-Brexit audience.\\n\\nVisual Assets\\n\\n'],\n", + " ['incident',\n", + " 'I00060',\n", + " \"\\n\\nActors: \\n\\nTimeframe:\\n\\nDate: \\n\\nPresumed goals: \\n\\nMethod: \\n\\nCounters:\\n\\nRelated incidents: \\n\\nReferences:\\n* (Trump’s White-Nationalist Pipeline)[https://www.theatlantic.com/politics/archive/2018/08/trump-white-nationalism/568393/] \\n* (Parallels between social media misinformation campaigns in the USA and South Africa)[https://www.iafrikan.com/2018/11/20/social-media-usa-south-africa-fake-news-disinformation/]\\n* (The high price of 'white genocide' politics for Australia)[https://www.smh.com.au/world/oceania/the-high-price-of-white-genocide-politics-for-australia-20180724-p4zt9k.html]\\n\"],\n", + " ['incident',\n", + " 'I00005',\n", + " \"\\n\\nActor: Russia/ Internet Research Agency (IRA)\\n\\nTimeframe: December 2015 - ongoing\\n\\nDate: June 23, 2016\\n\\nPresumed goals: Change Brexit vote to ‘leave’; continue to divide/undermine EU; drive Eurosceptic narrative/agenda\\n\\nMethod:\\n* (From The European Values Think-Tank)\\n* Before Brexit, Russia Today and Sputnik released more anti-EU articles than the official Vote Leave website and Leave.EU website. The British version of Sputnik has an annual budget of £ 1.8 million from the Russian government. Kremlin-owned channels potentially influenced 134 million impressions during the Brexit campaign\\n* Method: The data that was used by 89up was derived from the Twitter Search API, Buzzsumo, the Facebook API and other scraping methods. In the timeframe from January 2016 to the day of the British referendum, analysts identified and analysed 261 of the most shared and popular articles that were clearly anti-European. The two main media outlets were RT and Sputnik. Costs: The total value of Kremlin media for the Leave campaign in the six months before the EU referendum was £1,353,000. The PR value for the Leave campaign, based on the 261 heavily pro-Leave articles published by RT and Sputnik, is estimated at nearly £1,500,000based on figures from a leading media monitoring tool. This excludes the significant social media value of these news articles. Estimated value of Russian media Facebook impressions is around $102,000 and the estimated value of Russian media’s potential impressions on Twitter is between $47,000 - $100,000. \\n* Content: The analysis also shows that the overwhelming majority of articles published by RT and Sputnik (131 of the 200 most shared) were clearly for Leave; 59 articles were Neutral and only 10 were set to Remain. When the neutral articles are filtered out, numbers show that the negative articles of RT/Sputnik, together, elicited nearly the same number of engagements as the official Vote Leave website.\\n* Social reach: The report shows the social reach of these anti-EU articles published by the Kremlin-owned channels was 134 million potential impressions, in comparison with a total social reach of just 33 million and 11 million potential impressions for all content shared from the Vote Leave website and Leave.EU website respectively.\\n* (Jane Mayer, staff writer at The New Yorker, via NPR) Role of - Cambridge Analytica, which is a big data company that worked for the Trump campaign in the end - and it was owned principally by one of Trump's largest backers, Robert Mercer - was also involved in helping the early stages of the Brexit campaign in England.\\nAnd the man who spanned both countries and pushed for both, really, was Steve Bannon, it seems there was actually a lot of Russian money offered to Arron Banks, who was one of the major political figures leading the Brexit campaign. The Russian money was offered to him in the form of business opportunities and gold mines and diamond mines by the Russian ambassador to England. So there seems to be financial incentives that were dangled. \\n* There are bots and trolls and posts that are coming from the same Russian Internet agency in St. Petersburg. So in both countries, we see pushing Brexit and pushing Trump at the same time by the same trolls and bots. research conducted by a joint team of experts from the University of California at Berkeley and Swansea University reportedly identified 150,000 Twitter accounts with various Russian ties that disseminated messages about Brexit.\\n* A cache of posts from 2016, seen by WIRED, shows how a coordinated network of Russian-based Twitter accounts spread racial hatred in an attempt to disrupt politics in the UK and Europe.\\nA network of accounts posted pro and anti-Brexit, anti-immigration and racist tweets around the EU referendum vote while also targeting posts in response to terrorist attacks across the continent. \\n* More broadly, a Russian espionage operation funneling money into a political campaign aimed at unwinding European integration would be entirely consistent with the Kremlin’s perceived political interests and tactics of hybrid warfare. Covert financial infiltration is part of a toolkit Moscow uses to interfere in European and American politics. Another tool deployed ahead of the 2016 referendum was pro-Brexit messaging pumped out by RT, Sputnik, and the Internet Research Agency.\\n* From 1 to 8 February 2016, Sputnik ran 14 stories on the “Brexit” issue. Eight of them had negative headlines, either featuring criticism of the deal or focusing on the difficulties Cameron faces; five headlines were broadly factual; one reported a positive comment that the Bank of England had “not yet seen” an impact on investor sentiment, but gave it a negative slant by headlining, “Bank of England on Brexit: No need to panic, yet.” (The word “panic” did not appear in the story.) Not one headline reported reactions supporting the deal. Both Sputnik and RT quoted a disproportionate number of reactions from “Out” campaigners. RT, for example, quoted five “Out” partisans: MP Liam Fox; the founder of Leave.EU; London Mayor Boris Johnson; MEP Nigel Farage, the leader of the UK Independence Party; and UKIP member Paul Nuttall.\\n* anti-immigrant adverts were targeted at Facebook users in the UK and the US. One – headlined “You’re not the only one to despise immigration”, which cost 4,884 roubles (£58) and received 4,055 views – was placed in January 2016. Another, which accused immigrants of stealing jobs, cost 5,514 roubles and received 14,396 impressions\\n* A study of social media during the Brexit campaign by 89Up, a consultancy, found that Russian bots delivered 10m potential Twitter impressions—about a third of the number generated by the Vote Leave campaign’s Twitter account. Such echoing amplifies the effect of RT and Sputnik stories, which are in general not much watched.\\n\\nCounters: FB & Twitter content take-downs\\n\\nRelated incidents: \\n\\n* 2016 US Election… pick ‘em\\n\\nReferences:\\n\\n* https://publications.parliament.uk/pa/cm201719/cmselect/cmcumeds/363/36308.htm#_idTextAnchor033\\n* https://www.foreign.senate.gov/imo/media/doc/FinalRR.pdf\\n* https://www.theguardian.com/world/2017/nov/15/russian-troll-factories-researchers-damn-twitters-refusal-to-share-data\\n* https://www.atlanticcouncil.org/blogs/new-atlanticist/congress-should-explain-how-dark-russian-money-infiltrates-western-democracies\\n* http://sputniknews.com/search/?query=Brexit\\n* http://sputniknews.com/europe/20160202/1034093305/cameron-tusk-brexit-deal.html\\n* http://sputniknews.com/europe/20160203/1034124763/tusk-eu-reform.html\\n* http://sputniknews.com/europe/20160204/1034209396/cameron-eu-brexit-talks.html\\n* http://sputniknews.com/europe/20160205/1034290031/business-investments-brexit-europe.html\\n* https://www.rt.com/uk/331734-cameron-calais-jungle-brexit/\\n* https://www.rt.com/uk/331161-eu-referendum-date-brexit/\\n* https://www.rt.com/uk/330977-tusk-eu-deal-brexit/\\n* https://twitter.com/brexit_sham/status/994982969705189377\\n\\n* https://www.nytimes.com/2017/11/15/world/europe/russia-brexit-twitter-facebook.html \\n* https://www.forbes.com/sites/emmawoollacott/2018/11/01/russian-trolls-used-islamophobia-to-whip-up-support-for-brexit/#11ee8dd465f2\\n* https://www.theguardian.com/world/2018/jan/10/russian-influence-brexit-vote-detailed-us-senate-report\\n* https://www.npr.org/2019/01/19/686830510/senate-finds-russian-bots-bucks-helped-push-brexit-vote-through\\n* https://www.europeanvalues.net/wp-content/uploads/2019/02/Influence-of-Russian-Disinformation-Operations-Specific-examples-in-data-and-numbers.pdf\\n* https://blogs.lse.ac.uk/brexit/2018/11/14/the-extent-of-russian-backed-fraud-means-the-referendum-is-invalid/\\n* https://www.wired.co.uk/article/brexit-russia-influence-twitter-bots-internet-research-agency\\n* https://www.buzzfeed.com/jamesball/a-suspected-network-of-13000-twitter-bots-pumped-out-pro?utm_term=.ipWGa5zK#.oeeKD58v\\n* https://www.atlanticcouncil.org/blogs/new-atlanticist/use-brexit-delay-to-investigate-russian-money\\n* http://www.interpretermag.com/putins-media-are-pushing-britain-for-the-brexit/\\n* https://www.theguardian.com/technology/2018/may/12/facebook-brexit-russia-unresolved-40-questions\\n* https://www.economist.com/briefing/2018/02/22/russian-disinformation-distorts-american-and-european-democracy\\n\\n\\n\\n\"],\n", + " ['incident',\n", + " 'I00044',\n", + " '\\n\\nActors: \\n\\n* SVR and IRA; \\n* Alex Jones; \\n* Global Research; \\n* anti-gov trolls; rapture trolls; alt-right trolls;\\n\\nTimeframe: Most of 2015\\n\\nDate: May - Oct 2015\\n\\nPresumed goals: \\n\\n* US operational dry run; \\n* Test 2016 themes; \\n* Promote paranoia in right wing US populations; \\n* Establish and prime anti-government narratives for future use. \\n\\nMethod: \\n\\n* Amplification via sockpuppet and cyborg accounts; \\n* Social media groups and meetups; \\n* Promote fake “experts” with impressive (and scary) titles; \\n* Amplify US media derision of message “carriers” in Russian state media;\\n\\nCounters: \\n\\n* Media exposure; \\n* Texas Governor disavows \\n\\nRelated incidents: \\n\\n* 2016 US election; \\n* QAnon; \\n* Texas secession\\n\\nReferences\\n\\n* [That \\'Jade Helm\\' Conspiracy Freakout Was Spurred By Russian Bots, Ex-Intel Chief Says](https://taskandpurpose.com/jade-helm-conspiracy-russian-bots)\\n* [Russians Sowed Divisions in Texas Politics, Says U.S. Senate Report](https://www.texasmonthly.com/news/russians-sowed-divisions-texas-politics-says-u-s-senate-report/)\\n* [Case Analysis: Jade Helm 15 and Russian Active Measures](https://toinformistoinfluence.com/2015/11/16/case-analysis-jade-helm-15-and-russian-active-measures/)\\n* [Trolling for Trump: how Russia is trying to destroy our democracy](https://warontherocks.com/2016/11/trolling-for-trump-how-russia-is-trying-to-destroy-our-democracy/)\\n* [Anatomy of a Russian attack: First signs of the Kremlin’s attempt to influence the 2016 election](https://wtop.com/j-j-green-national/2017/09/anatomy-russian-attack-first-signs/slide/1/)\\n\\nDetails\\n\\nEven before the 2016 presidential election, the Russians had been testing disinformation in Texas by stirring up the controversy surrounding the Jade Helm military maneuver in the summer of 2015. Conspiracy theorists had created the idea that a joint military training exercise in Texas was cover for President Obama to declare martial law and seize Texas. The conspiracy theory gained traction when Abbott ordered the Texas State Guard to monitor the U.S. military. Earlier this year, a former head of the National Security Agency and the CIA—Air Force General Michael Hayden—said the Jade Helm disinformation campaign was pivotal to the Russians’ decision to try to influence the U.S. presidential campaign. “At that point, I’m figuring the Russians are saying, ‘We can go big-time.’ And at that point, I think they made the decision, ‘We’re going to play in the electoral process,’” Hayden said.\\n\\nWhen thousands of troops from Army Special Operations Command descended on the American southwest for the totally normal eight-week training exercise Jade Helm 15, Texas Gov. Greg Abbott — goaded on by anti-government ideologues, rapture-predicting ministries and alt-right internet famewhores — ordered the state\\'s volunteer guard to \"monitor\" the U.S. service members on their land to make sure they didn\\'t start kidnapping undesirables and grabbing people\\'s guns.\\n\\nIt was a precursor to martial law, they said. It was \"way worse than you realize: police, military working together toward population control,\" they said. It was \"secretly using recently closed Wal-Marts to stockpile supplies for Chinese troops who will be arriving to disarm Americans,\" they said. It was preparation for Obama\\'s takeover after an impending asteroid impact that would begin the global apocalypse, they said. It mobilized right-wing activists to prepare to fight their government — their uniformed soldiers! — to the death.\\n\\nRussian intelligence, state media, and trolls under President Vladimir Putin sought to bum steer U.S. domestic reactions to Jade Helm 15, the multi-state U.S.-based military training exercise concludedSeptember 15th. Russia has invested tens to hundreds of millions to infiltrate U.S. media markets with English language news, opinion, conspiracy, and troll content, often interlocking with the most popular U.S. conspiracy theory websites on the net.\\n\\nOn July 2015, at a community meeting in Bastrop, some Texans were up in arms about hosting part of a multi-state U.S. military training exercise named Jade Helm 15. While most locals were unswayed by the conspiracy theories of Jade Helm 15 ushering in martial law, the video of the crowd at the link records aspects of U.S. social and cognitive vulnerability to Russian “active measures.”\\n\\nIt\\'s an age-old problem; during the Cold War, Soviet agencies worked to whip up leftist anger at the U.S. government, highlighting America\\'s race and inequality problems. But today, they\\'ve found that the most effective, salient mode of fuckery in U.S. affairs is to push right-wing conspiracy theories — \"deep state,\" Hillary emails, Pizzagate, Seth Rich, Soros, Islamists sneaking over the Mexico-U.S. border, Benghazi — that reinforce the idea that anyone to the left of, say, President Donald Trump, is a robotic foreign-paid human-trafficking overlord doing the bidding of the Rothschilds or Trilaterals or Freemasons or Kellers some other inane shit.\\n\\nThe Russian SVR (Sluzhba vneshney razvedki) has chief responsibility for conducting active measures outside of Russia. The SVR’s active measures surrounding Jade Helm 15 generated fear to ignite a range of behaviors serving Russian foreign policy objectives, from feeding cynicism about the U.S. governing system and its people, to inciting violence and sabotage in the U.S.\\n\\nOne example of how this messaging worked in ramping up fear of Jade Helm 15 was found at “Global Research,” a media outlet for a Canadian non-profit called Centre for Research on Globalization. Entitled, Towards a Militarized Police State in America? Explosive New Revelations over “Jade Helm 15 Exercise” and Potential False Flags, the online article was posted May 27, 2015, roughly 48 days before the Jade Helm 15 training exercise was to begin. Such a lead would give the piece time to disseminate to conspiracist sites and gullible readers ample time to organize a response.\\n\\nThe idea is to get Americans thinking other Americans are the real enemies of humanity and progress. And it works, because a lot of Americans are already disposed to that way of thinking.\\n\\nOn the other hand, it’s an easy cop-out to blame the Russians for every insecure dumbass idea that excitable Americans run with.\\n\\nConsidering their interlocking content and links, Global Research and Alex Jones’s InfoWars.com (one of the most popular conspiracy websites on the internet) have a de facto alliance. Both sites published conspiracy pieces about Jade Helm 15 in advance of the exercise, as did many other conspiracist websites that link with one or both.\\n\\nThe blizzard of conspiracy has had an effect. By May 2015, a Rasmussen poll on Jade Helm 15 found that “45% of voters are concerned that the government will use U.S. military training operations to impose greater control over some states,” with 19% “Very Concerned.” Rasmussen also reported that “21% believe the government’s decision to conduct military training exercises in some states is an infringement on the rights of the citizens in those states.”\\n\\nSome debate the effectiveness of Russian active measures, propaganda, and trolling. Russia Today (RT) is a more sophisticated Kremlin media outlet, with slick television, internet, and periodical output. RT’s portrayal of Jade Helm 15was to depict Americans as prone to conspiracy theory, and to amplify left-leaning U.S. media derision of Texas demographics disturbed by Jade Helm 15, while casting doubt on the government operation with headlines and sub-headlines. Russia Today’s approach had accentuated personal caricatures and distrust driving partisan anger in the U.S.\\n\\nOn social media however, Kremlin-linked and other conspiracists sometimes represent themselves as insiders or experts whose content can be frightening and inciting.\\n\\nFor example, on LinkedIn.com, many Pulse posts have focused on Jade Helm 15. Below I profile two examples of Pulse writers who hit Jade Helm 15 theme especially hard, one of them naming himself a “Military Intelligence Analyst / Russian Regional CME” and the other a “Geopolitical Strategist, Journalist & Author”\\n\\nAre apocalyptic conspiracies harmless despite their over-the-top claims?\\n\\nApparently not. One ominous event may have turned Jade Helm 15 Active measures into a high-yield victory for Vladimir Putin’s Kremlin. Three North Carolina men amassed arms, munitions, and weapons and had been actively preparing to ambush Jade Helm 15 troops in training. Fortunately, the FBI received a tip from a gun and surplus store owner and arrested the would-be domestic-terrorists who feared that Jade Helm 15 was a prelude to martial law in the U.S.\\n\\nThe Russian SVR and Putin’s media have aimed at Texas before. Did Putin foresee that Texas politicians might respond to popular conspiracist fears ramped up by the Kremlin itself and so cause strife in the partisan divide? That happened when Governor Greg Abbot tried to reassure Texans about Jade Helm 15, and opposition media lampooned him.\\n\\nYet according to the San Antonio Express News, Governor Abbot, who is also a former Texas Supreme Court Justice not of the conspiracist mold, had initially a milder approach. Yet the opposing partisan media did more than just embarrass Gov. Abbot over his response, it called some of his constituents who had been moved by conspiracy propaganda “dumb,” which further tends to divide U.S. demographics along stereotypical lines. Mr. Putin must have been pleased.\\n\\nExamples\\n\\n\\n'],\n", + " ['incident',\n", + " 'I00015',\n", + " '\\n\\nActors: Russian state actors, Concord Management\\n\\nTimeframe: Fall 2018 - Winter 2019\\n\\nDate: October 2018\\n\\nPresumed goals: \\n\\n* Discredit Mueller findings; \\n* sow doubt about Russian active measures; \\n* expose investigatory sources, priorities and methods; \\n\\nMethod: \\n\\n* Release non-public documents with favorable amendments; \\n* Disguise document provenance as hacking (i.e. revelation); \\n* Circulate to media via DM, then release publicly \\n\\nCounters: \\n\\n* Media exposure; \\n* motions to limit future discovery\\n\\nRelated incidents: \\n\\n* 2016 US election\\n\\nReferences\\n\\n* [Document: Concord Management Used Discovery for Disinformation Campaign, Mueller Says](https://www.lawfareblog.com/document-concord-management-used-discovery-disinformation-campaign-mueller-says)\\n* [Mueller says some private case files were used in \\'disinformation campaign\\' to discredit Russia probe](https://thehill.com/policy/national-security/427723-mueller-says-some-of-his-private-case-files-were-used-in)\\n* [Mueller says Russians are using his discovery materials in disinformation effort](https://www.nbcnews.com/politics/justice-department/mueller-says-russians-using-his-discovery-materials-disinformation-effort-n964811)\\n* [Mueller says discovery materials in case against Russian firm were used in a cyber-disinformation campaign](https://www.washingtonpost.com/local/legal-issues/mueller-says-discovery-materials-in-case-against-russian-firm-were-used-in-a-cyber-disinformation-campaign/2019/01/30/9fd60218-24c9-11e9-81fd-b7b05d5bed90_story.html?utm_term=.4b814db9f811)\\n* [Mueller\\'s Team Questions How Files in Russia Case Ended Up Online](https://www.law.com/nationallawjournal/2019/01/30/muellers-team-questions-how-files-in-russia-case-ended-up-online/?slreturn=20190231112904)\\n* https://www.documentcloud.org/documents/5700929-Concord-Discovery-Opposition.html\\n\\nDetails\\n\\nThe special counsel\\'s office has filed a memorandum in U.S. v. Concord Management and Consulting, LLC in opposition to Concord\\'s motion to disclose documents identified as \"sensitive\" by the Special Counsel to certain Concord officers and employees. The memo alleges that subsequent investigations into Concord have \"revealed that certain non-sensitive discovery materials in the defense’s possession appear to have been altered and disseminated as part of a disinformation campaign\" apparently aimed at discrediting the special counsel\\'s investigation into Russian interference in the 2016 U.S. election.\\n\\nThat discovery — evidence and documents traded between both sides of a lawsuit — appears to have been altered and disseminated as part of a disinformation campaign apparently aimed at discrediting the ongoing investigations in Russian interference in the U.S. political system, according to the documents.\\n\\nProsecutors said sensitive evidence also could reveal government investigative techniques and identify cooperating individuals and companies.\\n\\nConcord is among 13 Russian individuals and entities charged last February in connection with Mueller’s probe. Concord is alleged to have funded the operation of the Internet Research Agency, a Russian troll farm that spread divisive content to U.S. audiences on social media as part of broader effort to meddle in the 2016 vote.\\n\\nProsecutors said that some nonpublic files supplied to Concord’s defense attorneys were apparently altered and disseminated using the Twitter account @HackingRedstone, which has since been suspended on the platform.\\n\\nOn Thursday, Mueller\\'s team updated their filing with precise dates for the actions taken on Twitter, noting that the account @HackingRedstone started sending direct messages to members of the media on October 22, before making a public tweet on October 30 in regards to the supposed discovery documents.\\n\\nThe filing cites an Oct. 22, 2018, tweet in which the account claimed, “We’ve got access to the Special Counsel Mueller’s probe database as we hacked Russian server with info from the Russian troll case Concord LLC v. Mueller. You can view all the files Mueller had about the IRA and Russia collusion. Enjoy the reading!” \\n\\nThe tweet linked to a webpage with folders containing scores of files that mimicked names and folder structures of materials produced by the special counsel’s office in discovery, the filing states.\\n\\nThe prosecutors’ filing said the matching files included images of political memes from Facebook and other social media accounts used online by the Internet Research Agency, many of which are presumably still available elsewhere on the Internet, but not with the unique identifiers used in materials turned over by prosecutors.\\n\\nProsecutors said in their filing that an FBI review found no evidence of a hack of the special counsel’s office. The filing also said that defense lawyers told the Mueller team that the vendor it was using reported no unauthorized access to the nonsensitive files. Under a court protective order, sensitive evidence in the case must be reviewed by a U.S. government “firewall” counsel, and then a judge must give permission before the evidence can be given to any non-U.S. national.\\n\\nThe facts “establish that the person(s) who created the Web page had access to at least some of the nonsensitive discovery produced by the government in this case,” wrote Justice Department national security division attorney Heather N. Alpino for a team including prosecutors with Mueller’s office and the U.S. attorney’s office of the District.\\n\\n\\nMueller’s team firmly pushed back on the request in the filing Wednesday, asserting releasing the files to the firm’s employees in Russia – including Prigozhin – would risk U.S. national security. \\n\\n“Concord’s request to send the discovery to the Russian Federation unreasonably risks the national security interests of the United States,” the filing states. “The government’s concerns are only heightened by the apparent release and manipulation of information produced to Concord as ‘non-sensitive’ discovery in this case.” \\n\\nThe filing also notes that the discovery files labeled \"sensitive\" identify \"uncharged individuals\" who government investigators believe are \"continuing to engage in operations to interfere with lawful U.S. government functions like those activities charged in the indictment.” \\n\\nMueller’s prosecutors did not oppose allowing Concord employees to view the files at their defense attorney’s offices under security protections, noting that “appearance in the United States would allow them to stand trial.”\\n']]" + ] + }, + "execution_count": 21, + "metadata": {}, + "output_type": "execute_result" + } + ], + "source": [ + "import os\n", + "import glob\n", + "\n", + "warntext = 'DO NOT EDIT ABOVE THIS LINE - PLEASE ADD NOTES BELOW'\n", + "warnlen = len(warntext)\n", + "\n", + "objecttypes = {'phase','tactic','technique','task','incident',\n", + " 'counter','metatechnique','actortype',#'resource',\n", + " #'responsetype',#'detection'\n", + "}\n", + "\n", + "foundtext = []\n", + "for objecttype in objecttypes:\n", + "\n", + " objecttypeplural = objecttype + 's'\n", + " objecttypedir = '../{}'.format(objecttypeplural)\n", + " if not os.path.exists(objecttypedir):\n", + " print(\"directory {} doesn't exist\".format(objecttypedir))\n", + " continue\n", + "\n", + " for datafile in glob.glob(objecttypedir + '/*.md'):\n", + " with open(datafile) as f:\n", + " filetext = f.read()\n", + " warnpos = filetext.find(warntext)\n", + " endpos = warnpos+len(warntext)\n", + " if endpos != len(filetext):\n", + " objectname = datafile[datafile.rfind('/')+1:-3]\n", + " print('warning text in {} {}'.format(objecttype, objectname)) \n", + " foundtext += [[objecttype, objectname, filetext[endpos:]]]\n", + "foundtext" + ] + }, + { + "cell_type": "code", + "execution_count": 26, + "metadata": {}, + "outputs": [ + { + "data": { + "text/html": [ + "
\n", + "\n", + "\n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + "
012
0counterC00066\\n\\nNew content. \\n\\nIf a group has the abili...
1incidentI00002\\n\\nActor: IRA, individuals (e.g. Larry Cook)....
2incidentI00053\\n\\nActor: China\\n\\nTimeframe: December 5, 201...
3incidentI00032\\n\\nSummary: \\n\\nActors: \\n\\n* IRA; other Rus...
4incidentI00063\\n\\nActor: Russia\\n\\nTimeframe: July 18, 2016 ...
5incidentI00006\\n\\nActor: probably IRA (source: recordedfutur...
6incidentI00047\\n\\nActor: Russia\\n\\nTimeframe: November 25, 2...
7incidentI00022\\n\\nActor: \\n\\n* 4chan user with Latvian IP ad...
8incidentI00033\\n\\nActor: China\\n\\nTimeframe: 2011\\n\\nDate:\\n...
9incidentI00062\\n\\nSee also I00005.
10incidentI00056\\n\\nActor: Iran\\n\\nTimeframe: 2012 - ongoing\\n...
11incidentI00007\\n\\nActor: RT/Sputnik\\n\\nTimeframe: 2 weeks\\n\\...
12incidentI00017\\n\\nActor: IRA\\n\\nTimeframe: 2 years\\n\\nDate: ...
13incidentI00003\\n\\nActor: IRA\\n\\nTimeframe: \\n\\nDate: \\n\\nPre...
14incidentI00042\\n\\nActor: \\n\\n* Saudi Arabia / Qatar /Turkey....
15incidentI00008\\n\\nActor: \\n\\nTimeframe: \\n\\nDate: \\n\\nPresum...
16incidentI00049\\n\\nActor: Russia, Syrian Government and Iran\\...
17incidentI00039\\n\\nActor:\\n\\n* Right-wing FB pages\\n* Fake ne...
18incidentI00029\\n\\nActor: Russia \\n\\nTimeframe: July 2014 - s...
19incidentI00009\\n\\nSuspected actors:\\n\\n* Attacker: IRA or m...
20incidentI00019\\n\\nActor: \\n\\n* individual accounts on 4chan ...
21incidentI00004\\n\\nActor: IRA\\n\\nTimeframe: 1 day (plus prepa...
22incidentI00045\\n\\nActor: Russia\\n\\nTimeframe: March 4, 2018 ...
23incidentI00051\\n\\nActor: Russia\\n\\nTimeframe: December 2018 ...
24incidentI00034\\n\\nActor: China\\n\\nTimeframe: 72 hours?\\n\\nDa...
25incidentI00010\\n\\nActors: IRA, Alex Jones, far right and far...
26incidentI00050\\n\\nActor: Russia, Cuba, China, Iran\\n\\nTimefr...
27incidentI00001\\n\\nActor: \\n\\nTimeframe: \\n\\nDate: \\n\\nPresum...
28incidentI00035\\n\\nSummary: \\n\\nActor: \\n\\nTimeframe: \\n\\nDa...
29incidentI00025\\n\\nActor: Russia\\n\\nTimeframe: November 6, 20...
30incidentI00060\\n\\nActors: \\n\\nTimeframe:\\n\\nDate: \\n\\nPresum...
31incidentI00005\\n\\nActor: Russia/ Internet Research Agency (I...
32incidentI00044\\n\\nActors: \\n\\n* SVR and IRA; \\n* Alex Jones;...
33incidentI00015\\n\\nActors: Russian state actors, Concord Mana...
\n", + "
" + ], + "text/plain": [ + " 0 1 2\n", + "0 counter C00066 \\n\\nNew content. \\n\\nIf a group has the abili...\n", + "1 incident I00002 \\n\\nActor: IRA, individuals (e.g. Larry Cook)....\n", + "2 incident I00053 \\n\\nActor: China\\n\\nTimeframe: December 5, 201...\n", + "3 incident I00032 \\n\\nSummary: \\n\\nActors: \\n\\n* IRA; other Rus...\n", + "4 incident I00063 \\n\\nActor: Russia\\n\\nTimeframe: July 18, 2016 ...\n", + "5 incident I00006 \\n\\nActor: probably IRA (source: recordedfutur...\n", + "6 incident I00047 \\n\\nActor: Russia\\n\\nTimeframe: November 25, 2...\n", + "7 incident I00022 \\n\\nActor: \\n\\n* 4chan user with Latvian IP ad...\n", + "8 incident I00033 \\n\\nActor: China\\n\\nTimeframe: 2011\\n\\nDate:\\n...\n", + "9 incident I00062 \\n\\nSee also I00005.\n", + "10 incident I00056 \\n\\nActor: Iran\\n\\nTimeframe: 2012 - ongoing\\n...\n", + "11 incident I00007 \\n\\nActor: RT/Sputnik\\n\\nTimeframe: 2 weeks\\n\\...\n", + "12 incident I00017 \\n\\nActor: IRA\\n\\nTimeframe: 2 years\\n\\nDate: ...\n", + "13 incident I00003 \\n\\nActor: IRA\\n\\nTimeframe: \\n\\nDate: \\n\\nPre...\n", + "14 incident I00042 \\n\\nActor: \\n\\n* Saudi Arabia / Qatar /Turkey....\n", + "15 incident I00008 \\n\\nActor: \\n\\nTimeframe: \\n\\nDate: \\n\\nPresum...\n", + "16 incident I00049 \\n\\nActor: Russia, Syrian Government and Iran\\...\n", + "17 incident I00039 \\n\\nActor:\\n\\n* Right-wing FB pages\\n* Fake ne...\n", + "18 incident I00029 \\n\\nActor: Russia \\n\\nTimeframe: July 2014 - s...\n", + "19 incident I00009 \\n\\nSuspected actors:\\n\\n* Attacker: IRA or m...\n", + "20 incident I00019 \\n\\nActor: \\n\\n* individual accounts on 4chan ...\n", + "21 incident I00004 \\n\\nActor: IRA\\n\\nTimeframe: 1 day (plus prepa...\n", + "22 incident I00045 \\n\\nActor: Russia\\n\\nTimeframe: March 4, 2018 ...\n", + "23 incident I00051 \\n\\nActor: Russia\\n\\nTimeframe: December 2018 ...\n", + "24 incident I00034 \\n\\nActor: China\\n\\nTimeframe: 72 hours?\\n\\nDa...\n", + "25 incident I00010 \\n\\nActors: IRA, Alex Jones, far right and far...\n", + "26 incident I00050 \\n\\nActor: Russia, Cuba, China, Iran\\n\\nTimefr...\n", + "27 incident I00001 \\n\\nActor: \\n\\nTimeframe: \\n\\nDate: \\n\\nPresum...\n", + "28 incident I00035 \\n\\nSummary: \\n\\nActor: \\n\\nTimeframe: \\n\\nDa...\n", + "29 incident I00025 \\n\\nActor: Russia\\n\\nTimeframe: November 6, 20...\n", + "30 incident I00060 \\n\\nActors: \\n\\nTimeframe:\\n\\nDate: \\n\\nPresum...\n", + "31 incident I00005 \\n\\nActor: Russia/ Internet Research Agency (I...\n", + "32 incident I00044 \\n\\nActors: \\n\\n* SVR and IRA; \\n* Alex Jones;...\n", + "33 incident I00015 \\n\\nActors: Russian state actors, Concord Mana..." + ] + }, + "execution_count": 26, + "metadata": {}, + "output_type": "execute_result" + } + ], + "source": [ + "import pandas as pd\n", + "import csv\n", + "\n", + "dffound = pd.DataFrame(foundtext)\n", + "dffound.to_csv('TEST_foundtext.csv', quoting=csv.QUOTE_NONNUMERIC,\n", + " index=False)\n", + "dffound" + ] + }, + { + "cell_type": "code", + "execution_count": null, + "metadata": {}, + "outputs": [], + "source": [] + } + ], + "metadata": { + "kernelspec": { + "display_name": "Python 3", + "language": "python", + "name": "python3" + }, + "language_info": { + "codemirror_mode": { + "name": "ipython", + "version": 3 + }, + "file_extension": ".py", + "mimetype": "text/x-python", + "name": "python", + "nbconvert_exporter": "python", + "pygments_lexer": "ipython3", + "version": "3.8.3" + } + }, + "nbformat": 4, + "nbformat_minor": 4 +} diff --git a/HTML_GENERATING_CODE/AMITT_generate_github_files.ipynb b/HTML_GENERATING_CODE/AMITT_generate_github_files.ipynb index 5dc1e17..44d2ab9 100644 --- a/HTML_GENERATING_CODE/AMITT_generate_github_files.ipynb +++ b/HTML_GENERATING_CODE/AMITT_generate_github_files.ipynb @@ -11,7 +11,7 @@ }, { "cell_type": "code", - "execution_count": 2, + "execution_count": 1, "metadata": { "scrolled": true }, @@ -24,14 +24,55 @@ "updated ../amitt_red_framework_clickable.html\n", "updated ../amitt_blue_framework.md\n", "updated ../amitt_blue_framework_clickable.html\n", + "Temp: objecttype phase\n", "updated ../phases_index.md\n", + "Temp: objecttype tactic\n", "updated ../tactics_index.md\n", + "Temp: objecttype technique\n", "updated ../techniques_index.md\n", + "Temp: objecttype task\n", "updated ../tasks_index.md\n", + "Temp: objecttype incident\n", "updated ../incidents_index.md\n", + "Temp: objecttype counter\n", "updated ../counters_index.md\n", + "Temp: objecttype metatechnique\n", "updated ../metatechniques_index.md\n", + "Temp: objecttype actortype\n", "updated ../actortypes_index.md\n", + "Updating ../actortypes/A001.md\n", + "Updating ../actortypes/A002.md\n", + "Updating ../actortypes/A003.md\n", + "Updating ../actortypes/A004.md\n", + "Updating ../actortypes/A005.md\n", + "Updating ../actortypes/A006.md\n", + "Updating ../actortypes/A007.md\n", + "Updating ../actortypes/A008.md\n", + "Updating ../actortypes/A009.md\n", + "Updating ../actortypes/A010.md\n", + "Updating ../actortypes/A011.md\n", + "Updating ../actortypes/A012.md\n", + "Updating ../actortypes/A013.md\n", + "Updating ../actortypes/A014.md\n", + "Updating ../actortypes/A015.md\n", + "Updating ../actortypes/A016.md\n", + "Updating ../actortypes/A017.md\n", + "Updating ../actortypes/A018.md\n", + "Updating ../actortypes/A019.md\n", + "Updating ../actortypes/A020.md\n", + "Updating ../actortypes/A021.md\n", + "Updating ../actortypes/A022.md\n", + "Updating ../actortypes/A023.md\n", + "Updating ../actortypes/A024.md\n", + "Updating ../actortypes/A025.md\n", + "Updating ../actortypes/A026.md\n", + "Updating ../actortypes/A027.md\n", + "Updating ../actortypes/A028.md\n", + "Updating ../actortypes/A029.md\n", + "Updating ../actortypes/A030.md\n", + "Updating ../actortypes/A031.md\n", + "Updating ../actortypes/A032.md\n", + "Updating ../actortypes/A033.md\n", "updated ../responsetype_index.md\n", "updated ../detections_index.md\n", "updated ../tactics_by_responsetype_table.md\n", @@ -48,7 +89,7 @@ }, { "cell_type": "code", - "execution_count": 3, + "execution_count": 2, "metadata": { "scrolled": true }, @@ -76,376 +117,463 @@ " \n", " amitt_id\n", " name\n", - " metatechnique\n", " summary\n", - " actortypes\n", - " resources_needed\n", - " how_found\n", - " references\n", - " incident_ids\n", - " tactic\n", - " responsetype\n", - " notes\n", - " techniques\n", + " sector_ids\n", + " framework_ids\n", " longname\n", - " tactic_id\n", - " tactic_name\n", - " metatechnique_id\n", - " metatechnique_name\n", " \n", " \n", " \n", " \n", " 0\n", - " C00006\n", - " Charge for social media\n", - " M004 - friction\n", - " Include a paid-for privacy option, e.g. pay Fa...\n", - " A033 - social media platform owner\n", - " \n", - " 2019-11-workshop\n", - " \n", - " \n", - " TA01 Strategic Planning\n", - " D2 Deny\n", - " \n", - " T0007 - Create fake Social Media Profiles / Pa...\n", - " C00006 - Charge for social media\n", - " TA01\n", - " Strategic Planning\n", - " M004\n", - " - friction\n", + " A001\n", + " data scientist\n", + " Person who can wrangle data, implement machine...\n", + " S001, S002, S003, S004, S005, S006, S007, S008...\n", + " FW01, FW02\n", + " A001 - data scientist\n", " \n", " \n", " 1\n", - " C00008\n", - " Create shared fact-checking database\n", - " M006 - scoring\n", - " Share fact-checking resources - tips, response...\n", - " A007 - factchecker\n", - " \n", - " 2019-11-workshop\\n2019-11-search\n", - " \n", - " I00049,I00050\n", - " TA01 Strategic Planning\n", - " D4 Degrade\n", - " \n", - " T0001 - 5Ds (dismiss, distort, distract, disma...\n", - " C00008 - Create shared fact-checking database\n", - " TA01\n", - " Strategic Planning\n", - " M006\n", - " - scoring\n", + " A002\n", + " target\n", + " Person being targeted by disinformation campaign\n", + " S001, S002, S003, S004, S005, S006, S007, S008...\n", + " FW02\n", + " A002 - target\n", " \n", " \n", " 2\n", - " C00009\n", - " Educate high profile influencers on best pract...\n", - " M001 - resilience\n", - " Find online influencers. Provide training in t...\n", - " A016 - influencer,A006 - educator\n", - " \n", - " 2019-11-workshop\n", - " \n", - " \n", - " TA02 Objective Planning\n", - " D2 Deny\n", - " \n", - " T0010 - Cultivate ignorant agents\\nT0039 - Bai...\n", - " C00009 - Educate high profile influencers on b...\n", - " TA02\n", - " Objective Planning\n", - " M001\n", - " - resilience\n", + " A003\n", + " trusted authority\n", + " Influencer\n", + " S001, S002, S003, S004, S005, S006, S007, S008...\n", + " FW01, FW02\n", + " A003 - trusted authority\n", " \n", " \n", " 3\n", - " C00010\n", - " Enhanced privacy regulation for social media\n", - " M004 - friction\n", - " Implement stronger privacy standards, to reduc...\n", - " A020 - policy maker\n", + " A004\n", + " activist\n", " \n", - " 2019-11-workshop\n", - " \n", - " \n", - " TA01 Strategic Planning\n", - " D2 Deny\n", - " \n", - " T0005 - Center of gravity analysis\\nT0018 - Pa...\n", - " C00010 - Enhanced privacy regulation for socia...\n", - " TA01\n", - " Strategic Planning\n", - " M004\n", - " - friction\n", + " S002\n", + " FW02\n", + " A004 - activist\n", " \n", " \n", " 4\n", - " C00011\n", - " Media literacy. Games to identify fake news\n", - " M001 - resilience\n", - " Create and use games to show people the mechan...\n", - " A006 - educator,A026 - games designer,A024 - d...\n", + " A005\n", + " community group\n", " \n", - " 2019-11-workshop\n", - " \n", - " \n", - " TA02 Objective Planning\n", - " D2 Deny\n", - " \n", - " T0001 - 5Ds (dismiss, distort, distract, disma...\n", - " C00011 - Media literacy. Games to identify fak...\n", - " TA02\n", - " Objective Planning\n", - " M001\n", - " - resilience\n", + " S002\n", + " FW02\n", + " A005 - community group\n", " \n", " \n", - " ...\n", - " ...\n", - " ...\n", - " ...\n", - " ...\n", - " ...\n", - " ...\n", - " ...\n", - " ...\n", - " ...\n", - " ...\n", - " ...\n", - " ...\n", - " ...\n", - " ...\n", - " ...\n", - " ...\n", - " ...\n", - " ...\n", + " 5\n", + " A006\n", + " educator\n", + " \n", + " S002\n", + " FW02\n", + " A006 - educator\n", " \n", " \n", - " 135\n", - " C00219\n", - " Add metadata to content that’s out of the cont...\n", - " M003 - daylight\n", - " Steganography. Adding date, signatures etc to ...\n", - " \n", - " \n", - " grugq\n", - " \n", - " \n", - " TA06 Develop Content\n", - " D4 Degrade\n", - " \n", - " T0024 - Create fake videos and images\\nT0026 -...\n", - " C00219 - Add metadata to content that’s out of...\n", - " TA06\n", - " Develop Content\n", - " M003\n", - " - daylight\n", + " 6\n", + " A007\n", + " factchecker\n", + " Someone with the skills to verify whether info...\n", + " S002\n", + " FW02\n", + " A007 - factchecker\n", " \n", " \n", - " 136\n", - " C00220\n", - " Develop a monitoring and intelligence plan\n", - " M007 - metatechnique\n", - " Create a plan for misinformation and disinform...\n", + " 7\n", + " A008\n", + " library\n", " \n", - " \n", - " Counters cleanup\n", - " \n", - " \n", - " TA01 Strategic Planning\n", - " D3 Disrupt\n", - " \n", - " \n", - " C00220 - Develop a monitoring and intelligence...\n", - " TA01\n", - " Strategic Planning\n", - " M007\n", - " - metatechnique\n", + " S002\n", + " FW02\n", + " A008 - library\n", " \n", " \n", - " 137\n", - " C00221\n", - " Run a disinformation red team, and design miti...\n", - " M007 - metatechnique\n", - " Include PACE plans - Primary, Alternate, Conti...\n", + " 8\n", + " A009\n", + " NGO\n", " \n", - " \n", - " Counters cleanup\n", - " \n", - " \n", - " TA01 Strategic Planning\n", - " D3 Disrupt\n", - " \n", - " \n", - " C00221 - Run a disinformation red team, and de...\n", - " TA01\n", - " Strategic Planning\n", - " M007\n", - " - metatechnique\n", + " S002\n", + " FW02\n", + " A009 - NGO\n", " \n", " \n", - " 138\n", - " C00222\n", - " Tabletop simulations\n", - " M007 - metatechnique\n", - " Simulate misinformation and disinformation cam...\n", + " 9\n", + " A010\n", + " religious organisation\n", " \n", - " \n", - " \n", - " \n", - " \n", - " TA02 Objective Planning\n", - " D3 Disrupt\n", - " \n", - " \n", - " C00222 - Tabletop simulations\n", - " TA02\n", - " Objective Planning\n", - " M007\n", - " - metatechnique\n", + " S002\n", + " FW02\n", + " A010 - religious organisation\n", " \n", " \n", - " 139\n", - " C00223\n", - " Strengthen Trust in social media platforms\n", - " M001 - resilience\n", - " Improve trust in the misinformation responses ...\n", + " 10\n", + " A011\n", + " school\n", " \n", + " S002\n", + " FW02\n", + " A011 - school\n", + " \n", + " \n", + " 11\n", + " A012\n", + " account owner\n", + " Anyone who owns an account online\n", + " S006\n", + " FW01\\nFW02\n", + " A012 - account owner\n", + " \n", + " \n", + " 12\n", + " A013\n", + " content creator\n", " \n", + " S006\n", + " FW01\\nFW02\n", + " A013 - content creator\n", + " \n", + " \n", + " 13\n", + " A014\n", + " elves\n", " \n", + " S006\n", + " FW02\n", + " A014 - elves\n", + " \n", + " \n", + " 14\n", + " A015\n", + " general public\n", " \n", + " S006\n", + " FW02\n", + " A015 - general public\n", + " \n", + " \n", + " 15\n", + " A016\n", + " influencer\n", " \n", - " TA01 Strategic Planning\n", - " D3 Disrupt\n", + " S006\n", + " FW01\\nFW02\n", + " A016 - influencer\n", + " \n", + " \n", + " 16\n", + " A017\n", + " coordinating body\n", + " For example the DHS\n", + " S003\n", + " FW02\n", + " A017 - coordinating body\n", + " \n", + " \n", + " 17\n", + " A018\n", + " government\n", + " Government agencies\n", + " S003\n", + " FW01\\nFW02\n", + " A018 - government\n", + " \n", + " \n", + " 18\n", + " A019\n", + " military\n", " \n", + " S003\n", + " FW02\n", + " A019 - military\n", + " \n", + " \n", + " 19\n", + " A020\n", + " policy maker\n", " \n", - " C00223 - Strengthen Trust in social media plat...\n", - " TA01\n", - " Strategic Planning\n", - " M001\n", - " - resilience\n", + " S003\n", + " FW02\n", + " A020 - policy maker\n", + " \n", + " \n", + " 20\n", + " A021\n", + " media organisation\n", + " \n", + " S010\n", + " FW01\\nFW02\n", + " A021 - media organisation\n", + " \n", + " \n", + " 21\n", + " A022\n", + " company\n", + " \n", + " S009\n", + " FW02\n", + " A022 - company\n", + " \n", + " \n", + " 22\n", + " A023\n", + " adtech provider\n", + " \n", + " S008\n", + " FW02\n", + " A023 - adtech provider\n", + " \n", + " \n", + " 23\n", + " A024\n", + " developer\n", + " \n", + " S008\n", + " FW02\n", + " A024 - developer\n", + " \n", + " \n", + " 24\n", + " A025\n", + " funding_site_admin\n", + " Funding site admin\n", + " S008\n", + " FW02\n", + " A025 - funding_site_admin\n", + " \n", + " \n", + " 25\n", + " A026\n", + " games designer\n", + " \n", + " S008\n", + " FW01, FW02\n", + " A026 - games designer\n", + " \n", + " \n", + " 26\n", + " A027\n", + " information security\n", + " \n", + " S008\n", + " FW02\n", + " A027 - information security\n", + " \n", + " \n", + " 27\n", + " A028\n", + " platform administrator\n", + " \n", + " S008\n", + " FW02\n", + " A028 - platform administrator\n", + " \n", + " \n", + " 28\n", + " A029\n", + " server admininistrator\n", + " \n", + " S008\n", + " FW02\n", + " A029 - server admininistrator\n", + " \n", + " \n", + " 29\n", + " A030\n", + " platforms\n", + " \n", + " S007\n", + " FW02\n", + " A030 - platforms\n", + " \n", + " \n", + " 30\n", + " A031\n", + " social media platform adminstrator\n", + " Person with the authority to make changes to a...\n", + " S007\n", + " FW02\n", + " A031 - social media platform adminstrator\n", + " \n", + " \n", + " 31\n", + " A032\n", + " social media platform outreach\n", + " \n", + " S007\n", + " FW02\n", + " A032 - social media platform outreach\n", + " \n", + " \n", + " 32\n", + " A033\n", + " social media platform owner\n", + " Person with authority to make changes to a soc...\n", + " S007\n", + " FW02\n", + " A033 - social media platform owner\n", " \n", " \n", "\n", - "

140 rows × 18 columns

\n", "" ], "text/plain": [ - " amitt_id name \\\n", - "0 C00006 Charge for social media \n", - "1 C00008 Create shared fact-checking database \n", - "2 C00009 Educate high profile influencers on best pract... \n", - "3 C00010 Enhanced privacy regulation for social media \n", - "4 C00011 Media literacy. Games to identify fake news \n", - ".. ... ... \n", - "135 C00219 Add metadata to content that’s out of the cont... \n", - "136 C00220 Develop a monitoring and intelligence plan \n", - "137 C00221 Run a disinformation red team, and design miti... \n", - "138 C00222 Tabletop simulations \n", - "139 C00223 Strengthen Trust in social media platforms \n", + " amitt_id name \\\n", + "0 A001 data scientist \n", + "1 A002 target \n", + "2 A003 trusted authority \n", + "3 A004 activist \n", + "4 A005 community group \n", + "5 A006 educator \n", + "6 A007 factchecker \n", + "7 A008 library \n", + "8 A009 NGO \n", + "9 A010 religious organisation \n", + "10 A011 school \n", + "11 A012 account owner \n", + "12 A013 content creator \n", + "13 A014 elves \n", + "14 A015 general public \n", + "15 A016 influencer \n", + "16 A017 coordinating body \n", + "17 A018 government \n", + "18 A019 military \n", + "19 A020 policy maker \n", + "20 A021 media organisation \n", + "21 A022 company \n", + "22 A023 adtech provider \n", + "23 A024 developer \n", + "24 A025 funding_site_admin \n", + "25 A026 games designer \n", + "26 A027 information security \n", + "27 A028 platform administrator \n", + "28 A029 server admininistrator \n", + "29 A030 platforms \n", + "30 A031 social media platform adminstrator \n", + "31 A032 social media platform outreach \n", + "32 A033 social media platform owner \n", "\n", - " metatechnique summary \\\n", - "0 M004 - friction Include a paid-for privacy option, e.g. pay Fa... \n", - "1 M006 - scoring Share fact-checking resources - tips, response... \n", - "2 M001 - resilience Find online influencers. Provide training in t... \n", - "3 M004 - friction Implement stronger privacy standards, to reduc... \n", - "4 M001 - resilience Create and use games to show people the mechan... \n", - ".. ... ... \n", - "135 M003 - daylight Steganography. Adding date, signatures etc to ... \n", - "136 M007 - metatechnique Create a plan for misinformation and disinform... \n", - "137 M007 - metatechnique Include PACE plans - Primary, Alternate, Conti... \n", - "138 M007 - metatechnique Simulate misinformation and disinformation cam... \n", - "139 M001 - resilience Improve trust in the misinformation responses ... \n", + " summary \\\n", + "0 Person who can wrangle data, implement machine... \n", + "1 Person being targeted by disinformation campaign \n", + "2 Influencer \n", + "3 \n", + "4 \n", + "5 \n", + "6 Someone with the skills to verify whether info... \n", + "7 \n", + "8 \n", + "9 \n", + "10 \n", + "11 Anyone who owns an account online \n", + "12 \n", + "13 \n", + "14 \n", + "15 \n", + "16 For example the DHS \n", + "17 Government agencies \n", + "18 \n", + "19 \n", + "20 \n", + "21 \n", + "22 \n", + "23 \n", + "24 Funding site admin \n", + "25 \n", + "26 \n", + "27 \n", + "28 \n", + "29 \n", + "30 Person with the authority to make changes to a... \n", + "31 \n", + "32 Person with authority to make changes to a soc... \n", "\n", - " actortypes resources_needed \\\n", - "0 A033 - social media platform owner \n", - "1 A007 - factchecker \n", - "2 A016 - influencer,A006 - educator \n", - "3 A020 - policy maker \n", - "4 A006 - educator,A026 - games designer,A024 - d... \n", - ".. ... ... \n", - "135 \n", - "136 \n", - "137 \n", - "138 \n", - "139 \n", + " sector_ids framework_ids \\\n", + "0 S001, S002, S003, S004, S005, S006, S007, S008... FW01, FW02 \n", + "1 S001, S002, S003, S004, S005, S006, S007, S008... FW02 \n", + "2 S001, S002, S003, S004, S005, S006, S007, S008... FW01, FW02 \n", + "3 S002 FW02 \n", + "4 S002 FW02 \n", + "5 S002 FW02 \n", + "6 S002 FW02 \n", + "7 S002 FW02 \n", + "8 S002 FW02 \n", + "9 S002 FW02 \n", + "10 S002 FW02 \n", + "11 S006 FW01\\nFW02 \n", + "12 S006 FW01\\nFW02 \n", + "13 S006 FW02 \n", + "14 S006 FW02 \n", + "15 S006 FW01\\nFW02 \n", + "16 S003 FW02 \n", + "17 S003 FW01\\nFW02 \n", + "18 S003 FW02 \n", + "19 S003 FW02 \n", + "20 S010 FW01\\nFW02 \n", + "21 S009 FW02 \n", + "22 S008 FW02 \n", + "23 S008 FW02 \n", + "24 S008 FW02 \n", + "25 S008 FW01, FW02 \n", + "26 S008 FW02 \n", + "27 S008 FW02 \n", + "28 S008 FW02 \n", + "29 S007 FW02 \n", + "30 S007 FW02 \n", + "31 S007 FW02 \n", + "32 S007 FW02 \n", "\n", - " how_found references incident_ids \\\n", - "0 2019-11-workshop \n", - "1 2019-11-workshop\\n2019-11-search I00049,I00050 \n", - "2 2019-11-workshop \n", - "3 2019-11-workshop \n", - "4 2019-11-workshop \n", - ".. ... ... ... \n", - "135 grugq \n", - "136 Counters cleanup \n", - "137 Counters cleanup \n", - "138 \n", - "139 \n", - "\n", - " tactic responsetype notes \\\n", - "0 TA01 Strategic Planning D2 Deny \n", - "1 TA01 Strategic Planning D4 Degrade \n", - "2 TA02 Objective Planning D2 Deny \n", - "3 TA01 Strategic Planning D2 Deny \n", - "4 TA02 Objective Planning D2 Deny \n", - ".. ... ... ... \n", - "135 TA06 Develop Content D4 Degrade \n", - "136 TA01 Strategic Planning D3 Disrupt \n", - "137 TA01 Strategic Planning D3 Disrupt \n", - "138 TA02 Objective Planning D3 Disrupt \n", - "139 TA01 Strategic Planning D3 Disrupt \n", - "\n", - " techniques \\\n", - "0 T0007 - Create fake Social Media Profiles / Pa... \n", - "1 T0001 - 5Ds (dismiss, distort, distract, disma... \n", - "2 T0010 - Cultivate ignorant agents\\nT0039 - Bai... \n", - "3 T0005 - Center of gravity analysis\\nT0018 - Pa... \n", - "4 T0001 - 5Ds (dismiss, distort, distract, disma... \n", - ".. ... \n", - "135 T0024 - Create fake videos and images\\nT0026 -... \n", - "136 \n", - "137 \n", - "138 \n", - "139 \n", - "\n", - " longname tactic_id \\\n", - "0 C00006 - Charge for social media TA01 \n", - "1 C00008 - Create shared fact-checking database TA01 \n", - "2 C00009 - Educate high profile influencers on b... TA02 \n", - "3 C00010 - Enhanced privacy regulation for socia... TA01 \n", - "4 C00011 - Media literacy. Games to identify fak... TA02 \n", - ".. ... ... \n", - "135 C00219 - Add metadata to content that’s out of... TA06 \n", - "136 C00220 - Develop a monitoring and intelligence... TA01 \n", - "137 C00221 - Run a disinformation red team, and de... TA01 \n", - "138 C00222 - Tabletop simulations TA02 \n", - "139 C00223 - Strengthen Trust in social media plat... TA01 \n", - "\n", - " tactic_name metatechnique_id metatechnique_name \n", - "0 Strategic Planning M004 - friction \n", - "1 Strategic Planning M006 - scoring \n", - "2 Objective Planning M001 - resilience \n", - "3 Strategic Planning M004 - friction \n", - "4 Objective Planning M001 - resilience \n", - ".. ... ... ... \n", - "135 Develop Content M003 - daylight \n", - "136 Strategic Planning M007 - metatechnique \n", - "137 Strategic Planning M007 - metatechnique \n", - "138 Objective Planning M007 - metatechnique \n", - "139 Strategic Planning M001 - resilience \n", - "\n", - "[140 rows x 18 columns]" + " longname \n", + "0 A001 - data scientist \n", + "1 A002 - target \n", + "2 A003 - trusted authority \n", + "3 A004 - activist \n", + "4 A005 - community group \n", + "5 A006 - educator \n", + "6 A007 - factchecker \n", + "7 A008 - library \n", + "8 A009 - NGO \n", + "9 A010 - religious organisation \n", + "10 A011 - school \n", + "11 A012 - account owner \n", + "12 A013 - content creator \n", + "13 A014 - elves \n", + "14 A015 - general public \n", + "15 A016 - influencer \n", + "16 A017 - coordinating body \n", + "17 A018 - government \n", + "18 A019 - military \n", + "19 A020 - policy maker \n", + "20 A021 - media organisation \n", + "21 A022 - company \n", + "22 A023 - adtech provider \n", + "23 A024 - developer \n", + "24 A025 - funding_site_admin \n", + "25 A026 - games designer \n", + "26 A027 - information security \n", + "27 A028 - platform administrator \n", + "28 A029 - server admininistrator \n", + "29 A030 - platforms \n", + "30 A031 - social media platform adminstrator \n", + "31 A032 - social media platform outreach \n", + "32 A033 - social media platform owner " ] }, - "execution_count": 3, + "execution_count": 2, "metadata": {}, "output_type": "execute_result" } ], "source": [ - "amitt.df_counters" + "amitt.df_actortypes" ] }, { diff --git a/HTML_GENERATING_CODE/Find_warning_text.ipynb b/HTML_GENERATING_CODE/Find_warning_text.ipynb new file mode 100644 index 0000000..1027598 --- /dev/null +++ b/HTML_GENERATING_CODE/Find_warning_text.ipynb @@ -0,0 +1,522 @@ +{ + "cells": [ + { + "cell_type": "markdown", + "metadata": {}, + "source": [ + "# Find warning text in AMITT generated files" + ] + }, + { + "cell_type": "code", + "execution_count": 21, + "metadata": { + "scrolled": true + }, + "outputs": [ + { + "name": "stdout", + "output_type": "stream", + "text": [ + "warning text in counter C00066\n", + "warning text in incident I00002\n", + "warning text in incident I00053\n", + "warning text in incident I00032\n", + "warning text in incident I00063\n", + "warning text in incident I00006\n", + "warning text in incident I00047\n", + "warning text in incident I00022\n", + "warning text in incident I00033\n", + "warning text in incident I00062\n", + "warning text in incident I00056\n", + "warning text in incident I00007\n", + "warning text in incident I00017\n", + "warning text in incident I00003\n", + "warning text in incident I00042\n", + "warning text in incident I00008\n", + "warning text in incident I00049\n", + "warning text in incident I00039\n", + "warning text in incident I00029\n", + "warning text in incident I00009\n", + "warning text in incident I00019\n", + "warning text in incident I00004\n", + "warning text in incident I00045\n", + "warning text in incident I00051\n", + "warning text in incident I00034\n", + "warning text in incident I00010\n", + "warning text in incident I00050\n", + "warning text in incident I00001\n", + "warning text in incident I00035\n", + "warning text in incident I00025\n", + "warning text in incident I00060\n", + "warning text in incident I00005\n", + "warning text in incident I00044\n", + "warning text in incident I00015\n" + ] + }, + { + "data": { + "text/plain": [ + "[['counter',\n", + " 'C00066',\n", + " \"\\n\\nNew content. \\n\\nIf a group has the ability - e.g. enough dedicated person-hours - it can hijack the artifacts and narratives of a disinformation incident, by flooding them with counter-content. This has been seen in the past as accidental hashtag flooding - e.g. a new disinformation hashtag was unknowingly chosen that was the same as a children's swim team, which became active during a swim meet. In 2020, kPop stans flooded disinformation-carrying hashtags including #whitelivesmatter, and gay men flooded the #proudboys hashtag. \\n\\nThis is an example of a countertechnique that mirrors an existing disinformation technique - in this case T0049. \\n\"],\n", + " ['incident',\n", + " 'I00002',\n", + " '\\n\\nActor: IRA, individuals (e.g. Larry Cook).\\n\\nTimeframe: \\n\\nDate: \\n\\nPresumed goals:\\nPhysical damage to country? \\n\\nMethod: \\n\\n* Targetted facebook ads (Larry Cook, targetting Washington State mothers, $1,776 to boost posts over 9 months). \\n* Gofundme campaigns to pay for ads (Larry Cook)\\n\\nEffects:\\n\\n* “The U.S. anti-vax movement has been blamed for two outbreaks of measles that have infected some 300 people—mostly children—in New York and the Pacific Northwest.”\\n\\nCounters:\\n\\n* American Medical Association “warned social-media giants, including Amazon, Facebook, Google, Pinterest, Twitter, and YouTube, that they were helping to amplify the propaganda and confuse parents.”\\n* Gofundme banned antivaxxers: “Campaigns raising money to promote misinformation about vaccines violate GoFundMe’s terms of service and will be removed from the platform”. Less than 10 campaigns reported as removed.\\n\\nRelated incidents:\\n\\nArtefacts:\\n\\nSearch terms vaccination, anti-vaccination, “vaccine choice”. \\n\\nNotes:\\n\\nStarted by looking for vaccine-related content in my misinformation datasets\\nThen did google search for “antivax misinformation” to get references etc. \\nLarry Cook runs “Stop Mandatory Vaccination”: “donations go “directly” to his bank account and funds “may be used to pay [his] personal bills.”\\n\\n\\nReferences;\\n\\n* https://www.thedailybeast.com/brooklyn-hasidic-community-is-in-the-midst-of-a-dire-measles-outbreak\\n* https://www.thedailybeast.com/amazon-wont-take-a-stand-in-war-over-forrest-maready-book-the-autism-vaccine\\n* https://www.bmj.com/content/362/bmj.k3739\\n* https://hub.jhu.edu/2018/08/24/russian-trolls-bots-spread-vaccine-misinformation/\\n* https://ajph.aphapublications.org/doi/full/10.2105/AJPH.2018.304567 \\n* Arciga, [GoFundMe Bans Anti-Vaxxers Who Raise Money to Spread Misinformation](https://www.thedailybeast.com/gofundme-bans-anti-vaxxers-who-raise-money-to-spread-misinformation), Daily Beast 2019-03-22\\n* Arciga, [Anti-Vaxxer Larry Cook Has Weaponized Facebook Ads in War Against Science](https://www.thedailybeast.com/anti-vaxxer-larry-cook-has-weaponized-facebook-ads-in-war-against-science), Daily Beast 2019-02-15\\n* Gofundmes (removed, but check archives) https://www.gofundme.com/help-save-vaccine-exemptions-in-washington-state https://www.gofundme.com/parents-wake-up-vaccines-kill \\n* Markay, [Anti-Vaccine Facebook Ads Target Women in Measles-Stricken States](https://www.thedailybeast.com/anti-vaccine-facebook-ads-target-women-in-measles-stricken-states/), Daily Beast 2019-02-14\\n\\nData\\n\\n\\n'],\n", + " ['incident',\n", + " 'I00053',\n", + " '\\n\\nActor: China\\n\\nTimeframe: December 5, 2018 - still active on 04/03/2019\\n\\nDate: December 5, 2018\\n\\nPresumed goals: \\n\\n* Unlike Russia, Chinese state has employed a plethora of state-run media to exploit the openness of American democratic society in an effort to insert an intentionally distorted and biased narrative portraying a utopian view of the Chinese government and party. \\n\\nMethod: \\n\\n* China’s state-run social media operations are largely positive and coordinated because those techniques support Chinese strategic goals. State-run media seeds foreign influence environment\\n* Distorted, saccharine “news” about the Chinese State and Party\\n* Events coordinated and promoted across media platforms\\n* Extend from digital into physical space with gatherings, ie: support for Meng outside courthouse\\n\\n* In the case of Chinese state-run information manipulation campaigns — to distinguish the political intent and national strategies underlying these campaigns as different from simply another perspective on the news. China also play’s victim, innocence, plays by rules, misunderstood narrative… they too have their version of the 4D’s. Examples: “Chinese ambassador Lu Shaye has accused Canada of applying a double standard, and has decried what he sees as “Western egotism and white supremacy” in the treatment of detained Huawei executive Meng Wanzhou.” - Op-Ed in Globe & Mail. The Chinese embassy in Canada says the Vancouver arrest of a top Huawei executive amounts to a “political conspiracy” to undermine the telecom giant and it dismisses Prime Minister Justin Trudeau’s assertion that he had no role in the high-profile case. Canada\\'s arrest of a senior Huawei executive was the \"backstabbing\" of a friend, Chinese ambassador Lu Shaye said Thursday, and he warned of repercussions if the federal government bars her telecom company from building a Canadian 5G network.\\n\\nCounters: none identified/researched\\n\\nRelated incidents: \\n\\n* See Poland (arrest of Huawei employee); Czech republic; \\n* Five Eyes to ban or not ban Huawei 5G network equipment \\n\\n\\nReferences: \\n\\n* https://www.theglobeandmail.com/politics/article-chinas-envoy-says-white-supremacy-played-part-in-canadas-arrest-of/\\n* https://twitter.com/globaltimesnews\\n* https://twitter.com/UserExperienceU\\n* https://www.universityworldnews.com/post.php?story=20190125061623487\\n* https://www.theglobeandmail.com/business/article-canadian-universities-continuing-rd-funding-partnerships-with/\\n* http://fortune.com/2019/01/18/oxford-university-huawei-research-funding/\\n* https://www.reuters.com/article/us-usa-china-security-universities-insig/u-s-universities-unplug-from-chinas-huawei-under-pressure-from-trump-idUSKCN1PI0GV\\n\\n\\n* Beyond Hybrid War: How China Exploits Social Media to Sway American Opinion\\nhttps://www.theglobeandmail.com/politics/article-china-says-arrest-of-huawei-cfo-part-of-political-conspiracy-by/\\n* https://www.theatlantic.com/international/archive/2019/03/czech-zeman-babis-huawei-xi-trump/584158\\n* https://www.defenseone.com/technology/2019/04/installing-chinese-5g-gear-dangerous-and-probably-inevitable-nato-report/156007/?oref=defenseone_today_nl\\n* https://www.ctvnews.ca/politics/canada-s-arrest-of-huawei-exec-an-act-of-backstabbing-chinese-ambassador-says-1.4258201\\n* https://www.cnn.com/2019/01/09/asia/china-canada-meng-huawei-intl/index.html\\n* https://www.theglobeandmail.com/opinion/article-on-china-has-canada-lost-its-sense-of-justice/\\n* https://portswigger.net/daily-swig/proper-news-or-propaganda-chinas-social-media-manipulations-exposed\\n* https://globalnews.ca/news/4758109/china-bully-canada-release-huawei-cfo/\\n* https://www.ctvnews.ca/canada/canada-will-pay-chinese-state-media-threaten-repercussions-over-huawei-arrest-1.4216293\\n* https://business.financialpost.com/telecom/inside-huaweis-rather-awkward-charm-offensive-to-convince-the-world-its-ok\\n* https://www.scmp.com/comment/letters/article/3001272/despite-us-allegations-huawei-has-done-nothing-wrong-why-should-it\\n\\nDatasets: none identified (mining more Twitter data, Reddit, and comment forums could be valuable research)\\n\\nNotes: \\n\\nWhile a hypothesis and not related to Meng’s arrest, research done by John Gray (using Mentionmapp data from January 13, 2019) also suggests the need to look at adjecent/tangential flow of social data. In this case (could be coincidence) simutatneaous flow of tweets via State Media @globaltimesnews (reporting on Poland arrest) and of “influencer” (using bots to amplify content) @UserExperienceU tweeting favorable about Huawei technology. Need to consider the amplifiers/influencers operate to support/put the happy face on Huawei. More work needs to be done researching social behavior outside the “Great Firewall” using trolls, bots, cyborgs, and “willing/unwitting” idiots. Just like Russia, we also need to give more consideration to how bots/automation (low-volume in particular) is operating to amplify State Media in order to gain higher fidelity in search engines. \\n\\nWe should also recognize another form of Huawei/China manipulation in the form of research programs in Universities across North America and Europe\\nhttps://www.universityworldnews.com/post.php?story=20190125061623487\\nhttps://www.theglobeandmail.com/business/article-canadian-universities-continuing-rd-funding-partnerships-with/\\nfortune.com/2019/01/18/oxford-university-huawei-research-funding/\\nhttps://www.reuters.com/article/us-usa-china-security-universities-insig/u-s-universities-unplug-from-chinas-huawei-under-pressure-from-trump-idUSKCN1PI0GV\\n\\nTimeline of events\\n\\nDec. 6: China demands Canada release Meng and “immediately correct the mistake” officials made in arresting her. The Chinese also say they were not briefed on the reasons for Meng’s arrest.\\nIn Ottawa, Prime Minister Justin Trudeau says Meng’s case is part of an independent legal process with no outside political influence.\\nDec. 7: In Vancouver, Meng appears in court, where allegations of fraud are laid out. The U.S. alleges Meng misled American banks in a bid to get around American sanctions on Iran.\\nDec. 8: Canada’s ambassador to China, John McCallum, is summoned to a meeting with China’s assistant foreign minister so the country can register complaints about Meng’s arrest. “China strongly urges the Canadian side to immediately release the detained Huawei executive … or face grave consequences that the Canadian side should be held accountable for,” the assistant minister, Le Yucheng, says in a statement.\\n\\nDec. 12: China’s foreign ministry says it has no information about Kovrig, but says the organization he worked with – the International Crisis Group – was not registered in China, making its activities in the country illegal.\\n\\nDec. 13: China’s foreign ministry says Kovrig and Spavor have been detained on suspicion of “endangering national security.”\\n\\nDec. 20: Indictments unsealed in the United States allege two Chinese citizens targeted companies in Canada and around the world as part of a years-long hacking campaign to steal data.\\n\\nDec. 24: China’s foreign ministry calls out the U.S., Britain and EU, saying the trio should be condemning Canada for Meng’s arrest. Spokeswoman Hua Chunying says Canada should “correct its mistakes” and stop acting at the behest of the United States. She says Kovrig and Spavor’s rights are being respected in custody.\\n\\nJan. 9: China’s envoy in Ottawa suggests Canada and its Western allies are white supremacists for calling for the release of two Canadians imprisoned last month by his country’s communist government. Ambassador Lu Shaye makes the accusation in an op-ed in the Hill Times.\\n\\nJan. 15: China expresses its “strong dissatisfaction” with Trudeau over his criticism of Schellenberg’s sentence. Trudeau should “respect the rule of law, respect China’s judicial sovereignty, correct mistakes and stop making irresponsible remarks,” foreign ministry spokeswoman Hua Chunying says.\\n\\nJan. 17: Ambassador Shaye says Canada’s arrest of Meng was an act of “backstabbing” by a friend. Lu warns of “repercussions” if Canada bars the firm from its new 5G network for security reasons, as have three of its intelligence-sharing allies.\\n\\nJan. 22: China demands the U.S. drop a request that Canada extradite Meng. Foreign Ministry spokeswoman Hua Chunying said Meng’s case was out of the ordinary and Canada’s extradition treaty with the U.S. infringed on the “safety and legitimate rights and interests of Chinese citizens.”\\nJan. 28: The U.S. Department of Justice formally levels criminal charges against Huawei, two subsidiaries and Meng. The charges, contained in two newly unsealed indictments, allege that Huawei misrepresented its ownership of a Hong Kong-based subsidiary to circumvent American sanctions against Iran. Furthermore, they say Huawei stole telecommunications technology, trade secrets and equipment from U.S. cellphone provider T-Mobile USA. Meng is charged with bank fraud, wire fraud and two counts of conspiracy to commit both. In a statement, Huawei denied committing any of the violations cited in the indictment.\\n\\nJan. 29:China calls on the U.S. to “stop the unreasonable crackdown” on Huawei, saying it will “firmly defend” its companies.\\n\\nMarch 6: A lawyer for Meng tells a judge the United States’ bid for extradition raises serious concerns about the political motivations behind the case as the matter is scheduled to return to court on May 8 to set hearing dates.\\n\\n\\n'],\n", + " ['incident',\n", + " 'I00032',\n", + " '\\n\\nSummary: \\n\\nActors: \\n\\n* IRA; other Russian state actors; \\n* Roger Stone, Alex Jones, gamergaters\\n\\nTimeframe: Fall 2018\\n\\nDate: September-October 2018\\n\\nPresumed goals: \\n\\n* Divide the American public on gender and party lines; Harass and intimidate anti-Trump voices; \\n* Promote epistemic confusion; \\n* Seed the narrative terrain for future operations; \\n* Promote “both sides” relativism; \\n\\nMethod: \\n\\n* Amplify extreme and hyper-partisan rhetoric; \\n* Promote divisive conspiracy theories; \\n* Re-up debunked theories in new contexts (e.g. hashtags); \\n* Re-center debates on emotional, rather than rational, content; \\n* Alter “ground-truth” resources, such as Wikipedia\\n\\nCounters: None / Media exposure\\n\\nRelated incidents: \\n\\n* gamergate; \\n* 2016 election\\n\\nReferences\\n\\n* [Russian trolls and bots are flooding Twitter with Ford-Kavanaugh disinformation](https://qz.com/1409102/russian-trolls-and-bots-are-flooding-twitter-with-ford-kavanaugh-disinformation/)\\n* [Brett Kavanaugh and the information terrorists trying to reshape America](https://www.wired.com/story/information-terrorists-trying-to-reshape-america/)\\n* [How the Kavanaugh information war mirrors real warzones](https://www.wired.com/story/how-the-kavanaugh-information-war-mirrors-real-warzones/)\\n* [How Facebook polarized us during the Kavanaugh hearings](https://www.theverge.com/2018/10/6/17943680/facebook-polarization-kavanaugh-partisan-news-groups)\\n* [Brett Kavanaugh has huge opposition in the U.S. - but Russian state propaganda loves Donald Trump\\'s nominee](https://www.newsweek.com/brett-kavanaugh-has-huge-opposition-us-russian-state-propaganda-loves-donald-1155046)\\n\\nDetails\\n\\nLast month, the attorney of Christine Blasey Ford, the California professor who has accused Supreme Court nominee Brett Kavanaugh of sexual assault at a long-ago high school party, revealed that Blasey Ford and her family were in hiding and had hired private security after Blasey Ford received death threats over email and social media. Among those cheering on the hate-trollers were many familiar faces from the sewers of the modern far-right disinformation metropolis: dandified Republican rogue (and likely Mueller investigee) Roger Stone, his alt-media protégés Mike Cernovich and Jack Posobiec, anarchist turned Kremlin propaganda employee turned Bernie backer turned Trump backer Cassandra Fairbanks, and breathless Infowars conspiracist-in-chief Alex Jones. And not surprisingly, alt-right super-troll Chuck Johnson had his own connection to players in the scandal.\\n\\nThis is an operational unit of information terrorists helping to transform the way Americans consume news in the age of Trump—some of the central nodes that give order to the information deluge and around which bot armies and human amplification networks can be organized, wiped out, reconstituted, and armed for attack.\\n\\nThe attacks on Blasey Ford aimed to discredit and silence her using the same tactics that have been deployed to discredit and silence others over the past few years. As others have come forward to accuse Kavanaugh of wrongdoing—including Deborah Ramirez and Julie Swetnick—they have been similarly harassed and smeared by the same machinery and themes.\\n\\nOnline Twitter accounts tied to Russia are heavily involved in discussing the Supreme Court nominee and allegations against him online. Hamilton68, a project run by the German Marshall Fund think tank that tracks tweets “tied to Russia-linked influence networks,” listed Kavanaugh, Trump, the FBI, and Ford as the top four topics mentioned by Russia-linked accounts on the evening of Oct.1.\\n\\nThe Russia-linked accounts are largely lending their support to Kavanaugh, says Jonathon Morgan, CEO of New Knowledge, the company that built the software behind Hamilton68. Morgan, who is currently tracking a set of around 1,000 accounts he believes are tied to Russia, says the Kavanaugh hearings have unleashed more US domestic-focused propaganda from foreign-linked networks than his firm has seen in months.\\n\\nPosts about Ford and Kavanaugh are “really cluttered and confused,” with various pieces of clear fabrication from both sides, says Decker.\\n\\nThe effort to introduce a doppelganger aligned with another key method used in LikeWars around the world: muddying the debate by throwing out alternative theories. Russia has long been the master of this disinformation tactic. After its 2014 shootdown of the MH-17 airliner over Ukraine, for instance, Russia spread over a dozen different theories of what had really happened. Many were contradictory and debunked previous claims. But the goal wasn’t to find the truth—it was to obscure it behind a smokescreen of lies.\\n\\nSimilarly, the Kavanaugh debate has given rise to false claims and ridiculous photoshopped images, often spread under fake identities. There have been debunked rumors that Kavanaugh had ruled against Ford’s parents in a house foreclosure and that Ford’s brother was part of the Russia investigation. There was even a flurry of unsubstantiated sexual assault charges leveled against Kavanaugh in the hours before the hearing. His supporters were outraged; those opposed to Kavanaugh\\'s nomination speculated that they were placed so that his defenders could point to the media’s unreliability and cast doubt on Ford\\'s credibility.\\n\\nThe state-funded outlet RT, which was recently obligated to register its U.S. branch under the Foreign Agents Registration Act, trumpeted the news that the White House had found no proof of sexual misconduct by Kavanaugh after reviewing the findings of a time-limited FBI investigation into the allegations.\\n\\nThe same outlet also called attention to the arrest of several high-profile celebrities, actress and comedian Amy Schumer and model Emily Ratajkowski, who were protesting Kavanaugh’s potential appointment in front of the Supreme Court on Thursday. “Obstruction of Justice?” the outlet asked.\\n\\nPro-Kavanaugh accounts have pushed out false smears aimed at discrediting Ford. One notable anti-Kavanaugh post picked up more than 11,000 retweets while purporting to to cite a Wall Street Journal article that in fact didn’t exist.\\n\\nOther accounts are using popular interest in the Ford-Kavanaugh dispute to push unrelated disinformation. A common tactic is to re-up a conspiracy theory or previously debunked story and add tags related to Kavanaugh so the tweet gains more traction.\\n\\nExamples include re-circulating debunked sexual assault allegations against Democrats like representative Keith Ellison, senator Cory Booker, and former vice president Joe Biden; or against Republicans like senator Lindsey Graham. “Both sides are coopting matters that may have been killed off and never gained traction, and using the Kavanaugh incident to rehash these different claims,” Decker said.\\n\\nMorgan says the Russian bots he’s tracking are largely using this latter method, seemingly with the broad aim of making Kavanaugh seem no worse than Democrats. The approach differs from Russian activity during the 2016 election, where influence campaigns aimed to sow discontent among both liberals and conservatives by pushing propaganda that appealed to both sides.\\n\\nThis has all taken on a new heady energy as pushback to #MeToo—and riding the coattails of the conspiracy bandwagon. But the intent is the same: to demonize the opponent, define identity, activate the base around emotional rather than rational concepts, and build a narrative that can be used to normalize marginal and radical political views. It is, after all, very convenient to have a narrative positing that all your political opponents are part of a secret cabal of sexual predators, which thus exonerates your side by default.\\n\\nDaily Wire’s top story about Kavanaugh confirmation was published Oct. 1 with the headline “Prosecutor Who Questioned Ford Shreds Her Case In Five-Page Memo.” It’s generated more than 205,000 engagements. The site also received just under 180,000 engagements for the story, “Bill Clinton Rape Accuser Juanita Broaddrick Crashes Kavanaugh Hearing, Slams Dems For ‘Biggest Double Standard.’”\\n\\nOccupy Democrats’ top story about Kavanaugh-Ford is headlined “Matt Damon just DESTROYED Kavanaugh and Senate Republicans in hilarious SNL cold open.” It had just under 70,000 engagements. Another story about the Kavanaugh confirmation, “Bernie Sanders just demanded the FBI investigate five lies Kavanaugh told at his hearing,” generated over 44,000 engagements.\\n\\nThis is the ideological landscape that has been so swiftly leveraged in the defense of Brett Kavanaugh.\\n\\nThe cadre and their followers knew exactly what to do when the allegations made against Kavanaugh by Christine Blasey Ford became public. They did not disappoint. Rapid efforts by far-right blogs and personalities to dox and troll Blasey Ford resulted in the targeting of the wrong Christine Blasey Ford; Posobiec was one of those reportedly amping this misguided doxxing. Cernovich said Blasey Ford was a \"far left wing activist\" who had been \"scrubbing\" her social media profile, so her accusations were \"activism.\" Alex Jones made a joke of the whole thing, with Infowars saying Blasey Ford is a \"leftist\" whose accusations were a \"political ploy.\" Fairbanks: \"She can\\'t prove it… Her clothes were on… Fuck that lady.\" That\\'s a particularly strong comment from a one-time anti-rape activist. Stone: \"This is a woman looking for her Anita Hill moment.\"\\n\\nThis is the information that flowed through the architecture the Stone cadre popularized and mainstreamed over the past few years, moving it from the fringe to a central pillar of the conservative agenda, cartoonifying legitimate issues of conservative concern and recruiting new supporters as they went. The narrative was set long ago—allegations are false, men (especially white men) are oppressed, the people who stand against you are corrupt perverts worthy of demonization, and everything that is the America you know will fall apart if you don\\'t fight for some notion of the way things were and should be again. And the best way to achieve this, since the system will fight back, is viciousness.\\n\\nThis architecture is established, and permanently in transmit mode.\\n\\nConsider the now-infamous and disavowed (but archived here) Ed Whelan twitter thread, an odd diversionary narrative hyped as an alternate theory of the night Blasey Ford describes. Its gist: mistaken identity of the perpetrator. Potential defamation issues aside, it seemed to build on the groundwork being laid by Senate Republicans and the White House to carefully insinuate that Blasey Ford wasn\\'t lying, merely mistaken about who attacked her. But Whelan transformed it into a bonkers Twitterverse conspiracy theory about the bedroom at the top of the stairs.\\n\\nAn analysis of the accounts that retweeted Whelan\\'s teaser for his conspiracy most frequently post content from right and far-right media, several of which are anchors in the far-right disinformation ecosphere (and Russian disinformation, to boot).\\n\\nPosted for less than 24 hours, Whelan\\'s mistaken-identity theory sparked a wave of blog posts and discussions on far-right sites that live on even after Whelan backed off. This post, for example, repeats Whelan\\'s claims and suggests they all but vindicate Kavanaugh. It was a top-trending piece on disinformation trackers and was still being circulated on Twitter days after the source was deleted. And so was this one, this one, and this one. Some 1.5 million \"Fox and Friends\" viewers heard all about the mistaken-identity theory live on TV. Once it\\'s out there, you can\\'t pull it back.\\n\\nThe narratives to defend Kavanaugh were mostly about discrediting Blasey Ford: that she was part of a secret CIA mind-control project (the CIA connection was also alluded to by Kremlin disinformation purveyors); that George Soros was behind her allegations; that her lawyer was linked to Hillary Clinton; that she was motivated by profit; that she did this as revenge for a foreclosure case where Kavanaugh\\'s mother, also a judge, ruled against Blasey Ford\\'s parents (only, she didn\\'t—she ruled in their favor); that she had also made false allegations against Neil Gorsuch; and many more.\\n\\nIn the course of his angry self-defense, Kavanaugh stamped a lot of bingo squares: attempted rape allegations as a political tool, false allegations, Clinton, secret conspiracies. By going out and taking the big swing, he elicited a powerful emotional response in his defense—an activated response from a hardened base. #ConfirmKavanaugh was trending—with support of far-right and Russian-linked accounts—after the hearing.\\n\\nNot even history itself is safe—at least the online version of it, which we increasingly depend on. When Kavanaugh testified that Devil\\'s Triangle, as mentioned on his high school yearbook page, was a drinking game, there was no online evidence to back up his claim. (Other sources asserted it was a known sexual term.) So an anonymous person immediately updated Wikipedia to support Kavanaugh\\'s definition. It was a near perfect parallel to how Russian operatives repeatedly edited the Wikipedia entry for “MH17” in the hours after the airliner was shot down to try to provide an alternative history.\\n\\nExamples\\n\\n'],\n", + " ['incident',\n", + " 'I00063',\n", + " '\\n\\nActor: Russia\\n\\nTimeframe: July 18, 2016 - ongoing\\n\\nDate: July 18, 2016\\n\\nPresumed goals: \\n\\n* Sports ie the Olympics is another platform to project power, and bans on Russian athletes, the stripping of medals is serious business. Deflect from negative West perspective as state-run cheats/crooks; World/West plot against us; Proclaim Russian innocence & image to domestic audience; \\n\\nMethod: \\n\\n* Some Russians described the allegations as an anti-Russian plot while others stated that Russia was \"just doing what the rest of the world does\" Just like MH17 and Skripal, Russia gets caught and goes into 4-D mode… ie: the above comment - dismiss/”what-aboutism”\\n* Deny - Russian President Vladimir Putin said that Russia had \"never supported any violations in sport, we have never supported it at the state level, and we will never support this\" and that the allegations were part of an \"anti-Russia policy\" by the West.\\n* Dismiss - Russian Minister of Foreign Affairs, Sergey Lavrov, commented that the United States \"fears honest competition\", affirming Vladimir Putin\\'s position that the United States used its influence within the IOC to \"orchestrate the doping scandal\"\\n* Many Russians believed that the IOC was retaliating against Russia for their discriminatory anti-gay law which provoked considerable controversy with the IOC during the 2014 Winter Olympics. Russian MP Dmitry Svishchev, who is also the head of Russia\\'s Curling Federation, was quoted by Ria Novosti news agency as saying: \"This is what we expected. There\\'s nothing new, only empty allegations against all of us. If you are Russian, you\\'ll get accused of every single sin.\" Aleksei Pushkov, chairman of Russia\\'s parliamentary foreign affairs committee, said that the IAAF\\'s decision to uphold its ban was \"an act of political revenge against Russia for its independent foreign policy.\" A member of Russia\\'s parliament, Vadim Dengin, stated, \"The entire doping scandal is a pure falsification, invented to discredit and humiliate Russia\\nTalking points as above are futher amplifed/spun via Russian media, and public apologists; while this happened prior to 2016 US Elections, suggesting the IRA along with trolls & bots operating in the social space (Twitter, FB, YouTube, Reddit) could be deemed naive. \\n\\nCounters: \\n\\nRelated incidents: \\n\\n* Prelude to 2016\\n* the end of the 2014 Sochi Olympics where Russian athletes dominate (in combination with Euromaiden “crisis”) “emboldens” Putin/Russia to make move on Ukraine invasion. \\n* Russians allegedly tried to hack the World Anti-Doping Agency (WADA)... The Justice Department filed criminal charges against seven members of the GRU, Russia\\'s main military intelligence unit, accusing them of hacking into the U.S. Anti-Doping Agency in Colorado Springs, Colorado, as well as four international sports governing bodies. A grand jury indictment said the operation was in retaliation for the exposure of Russia\\'s state-sponsored athlete doping program that resulted in a ban from the 2016 summer Olympics in Brazil.\\n\\nReferences: \\n\\n* https://www.nbcnews.com/news/world/international-olympic-committee-bars-russia-2018-winter-games-over-doping-n826671\\n\\n* https://www.nytimes.com/2016/05/13/sports/russia-doping-sochi-olympics-2014.html?module=inline\\n* https://www.bbc.com/sport/38261608\\n* https://en.wikipedia.org/wiki/Doping_in_Russia\\n* https://www.theguardian.com/technology/2016/aug/22/russian-hackers-world-anti-doping-agency-dnc-hack-fancy-bear\\n* https://www.dw.com/en/two-russians-probed-for-hacking-anti-doping-agency-wada/a-45502397\\n* https://www.nytimes.com/2018/01/10/sports/olympics/russian-hackers-emails-doping.html\\n* https://qz.com/1413474/all-of-the-victims-named-in-the-latest-russian-hacking-scandal/\\n* https://www.nbcnews.com/news/us-news/7-russians-indicted-hacking-related-olympic-doping-scandal-nerve-agent-n916656\\n\\n\\n'],\n", + " ['incident',\n", + " 'I00006',\n", + " '\\n\\nActor: probably IRA (source: recordedfuture)\\n\\nTimeframe: 1 day\\n\\nDate: Sept 11 2014\\n\\nPresumed goals: test deployment\\n\\nMethod: \\n* Artefacts: text messages, images, video\\n* Create messages. e.g. “A powerful explosion heard from miles away happened at a chemical plant in Centerville, Louisiana #ColumbianChemicals”\\n* Post messages from fake twitter accounts; include handles of local and global influencers (journalists, media, politicians, e.g. @senjeffmerkley)\\n* Amplify, by repeating messages on twitter via fake twitter accounts\\n* Not seen: interaction, refutation etc. \\n* TL;DR: early attempts to create fake incidents had limited traction. \\n\\nCounters:\\n\\n* None seen. Fake stories were debunked very quickly. \\n\\nRelated incidents: \\n\\n* BP oil spill tsunami\\n* #PhosphorusDisaster - fake story about water contamination scare\\n* #EbolaInAtlanta - fake story about Ebola outbreak in Atlanta\\n* #shockingmurderinatlanta - fake story about unarmed black woman killed by police in Atlanta\\n\\nThese were all well-produced fake news stories, promoted on Twitter to influencers through a single dominant hashtag (the single hashtag might have been something learned from crisismapping practice of forcing a single hashtag for each disaster because it was easier to track)\\n\\nReferences:\\n\\n* [RecordedFuture trace of attack]()\\n\\n* https://en.wikipedia.org/wiki/Columbian_Chemicals_Plant_explosion_hoax \\n* https://www.recordedfuture.com/columbianchemicals-hoax-analysis/\\n* https://www.nytimes.com/2015/06/07/magazine/the-agency.html?_r=0 \\n* https://twitter.com/hashtag/PhosphorusDisaster?src=hash\\n\\n\\n'],\n", + " ['incident',\n", + " 'I00047',\n", + " '\\n\\nActor: Russia\\n\\nTimeframe: November 25, 2018 - ongoing\\n\\nDate: November 25, 2018\\n\\nPresumed goals: \\n\\n* Russian media,quoted authorities who accused Kyiv of seeking to “create a conflict situation.” \\n“The same Moscow spokespeople who assured us in 2014 that the little green men who seized Crimea were not Russian soldiers—until Vladimir Putin himself spilled the beans weeks later—are now telling the world that volatile maneuvers of Ukrainian ships led to the collision November 25. \\n* Russian FSB security service blamed Ukraine for sparking the clashes, saying their \"irrefutable\" evidence would \"soon be made public\". Foreign Minister Sergey Lavrov said on the next day that Ukraine had violated international legal norms by failing to obtain authorisation for its vessels. Deputy Chairman of the State Duma Pyotr Tolstoy warned of the danger of a war.\\n* The goal of this campaign is to create confusion, to portray Ukraine as the culprit for both the Kerch Strait incident and the deteriorating security situation in the region, and to exonerate Russia of any responsibility.\\n\\nMethod: \\n\\n* (Distort) Kremlin-controlled RT cited Russian Minister of Foreign Affairs Sergei Lavrov suggesting that Ukraine deliberately provoked Russia in hopes of gaining additional support from the United States and Europe.\\ndistracting the audience from the main issue – Russia shooting at Ukrainian boats and capturing the vessels and crews. Instead they target the president of Ukraine, Petro Poroshenko: “Washington incited Poroshenko to launch this “sea provocation” against Russia in order to “thwart the Putin -Trump meeting”” and “President of Ukraine Petro Poroshenko uses the Kerch provocation for a coup d’état“. But in reality, the Ukrainian Parliament adopted a resolution scheduling the presidential elections for 31 March 2019.\\nDismissing the critic has also found its place under the sun of Kremlin info-war. Claims were spread that the Russian ships have moved so far ahead “in their technological development” that they “do not use ramming as a tactic“.\\n\\n* Attempts to pollute the German Twitter: Russian disinformation does not only rely on its own resources to spread its narratives about Ukraine. Twitter has been used so heavily that Russia Today and Sputnik are scoring more engagement than some of the German quality media combined. Between Sunday and Tuesday, more than 10,000 German-language Tweets from 3,000 unique accounts mentioned Ukraine, almost all of them relating to the confrontation in the Sea of Azov. Despite the large overall number of tweeters, a small group of 30 accounts has been driving a significant share of the debate so far.\\n \\n* Dmitry Peskov described Ukrainian navy’s actions as “an invasion of foreign military ships into Russia’s territorial waters.” Belittling Ukraine’s navy; Ridiculing and dehumanising Ukrainians - This ridiculing of Ukraine’s navy echoes other cases when disinformation has been used to show Ukraine as weak and dependent.\\n\\nCounters: \\n\\nRelated incidents: \\n\\n* This is not the first time the Kremlin has used the four-D tactics. \\n* @DFRLab has documented the Kremlin’s use of the 4Ds of disinformation to deny its involvement in the downing of the Malaysian Airlines flight MH17 over Ukraine, the Skripal poisoning, and the interference in the U.S. Presidential elections in 2016.\\n\\nReferences: \\n\\n* https://euvsdisinfo.eu/report/washington-incited-poroshenko-to-launch-a-sea-provocation-to-thwart-the-putin-trump-meeting/\\n* https://euvsdisinfo.eu/report/kerch-confrontation-part-of-poroshenkos-plan-to-postpone-the-ukrainian-elections/\\n* https://euvsdisinfo.eu/report/russia-does-not-shirk-international-law/\\n* https://meduza.io/en/feature/2018/11/26/how-russia-captured-three-ukrainian-ships-in-the-black-sea\\n* https://medium.com/dfrlab/uk-poisoning-russia-recycles-responses-77e1d357b777\\n* https://medium.com/dfrlab/propaganda-pushed-around-indictment-f63b85ac0587\\n* https://www.dw.com/en/the-scars-of-ukraines-war-in-mariupol/a-19430738\\n* https://www.dw.com/en/crimea-applies-for-annexation-by-moscow-after-secession-referendum-wins-968-approval/a-17500659\\n\\n* https://euvsdisinfo.eu/wave-of-disinformation-from-the-azov-sea/\\n* https://medium.com/dfrlab/minskmonitor-disinformation-tactics-extend-to-kerch-c32351c7c293\\n* https://www.bellingcat.com/news/uk-and-europe/2018/11/30/investigating-the-kerch-strait-incident/\\n* https://www.justsecurity.org/61835/rogue-kremlin-push-international-law/\\n* https://www.stopfake.org/en/denigrating-ukraine-with-disinformation/\\n\\n* https://www.dw.com/en/what-you-need-to-know-about-the-conflict-in-the-sea-of-azov/a-46461361\\n* https://www.atlanticcouncil.org/blogs/new-atlanticist/russia-ukraine-feud-heats-up-the-sea-of-azov\\n* https://en.wikipedia.org/wiki/Kerch_Strait_incident\\n\\n\\nDatasets: \\n\\nNotes: \\n\\nGiven anything related to the ukraine is a key testing ground/flashpoint for Russia narrative manipultion & anti-democracy disinformation, the incident and geographic chokepoint will be an ongoing issue. \\n\\nThe Kerch Strait is the only connection between the Black Sea and the Sea of Azov, and the only way to reach two important Ukrainian ports, Mariupol and Berdiansk. The route is vital for Mariupol\\'s two large metallurgical plants. Russia has controlled the strait since annexing Crimea in 2014, which has made traffic significantly more difficult for Ukrainian ships. The consequences of Russian control have become particularly noticeable since the completion of the Crimean Bridge in May 2018. The bridge connects the Russian mainland with the occupied peninsula. The FSB inspects all ships bound for Ukraine, sometimes taking days, which has aggravated the situation. The volume of freight has steadily declined since then. The war in Ukraine\\'s Donbass region is also problematic for Ukraine\\'s ports.\\n\\nthis most recent escalation in the Kerch Strait is aggravating the already existing conflict between Ukraine and Russia that began after the annexation of Crimea in 2014.\\n \\nOn the evening of 28 November, Ukrainian Infrastructure Minister Volodymyr Omelyan said that vessels bound for the ports of Berdyansk and Mariupol awaited entrance to the Sea of Azov and vessels were also waiting to go southbound. He characterised this as a virtual blockade. No vessels were identified as Ukrainian. On 4 December Omelyan stated that Russia did let ships reach Berdyansk and Mariupol again. The same day the Ukrainian Ministry of Temporarily Occupied Territories and IDPs claimed that the accumulation of ships waiting to go to the Ukrainian ports had led to several accidents. Russia denied it ever blocked vessels from sailing to Ukrainian ports and asserted that any possible disruptions were due to bad weather\\nOn 19 January 2019, USS Donald Cook entered the Black Sea, being the second American vessel to arrive in the Black Sea after the Kerch Strait incident after USS Fort McHenry entered in 10 January 2019\\nIn March 2019, Canada, the United States and the EU imposed sanctions on Russian citizens and companies for their participation in the incident and activities in Crimea and separatist-controlled eastern Ukraine\\n\\n'],\n", + " ['incident',\n", + " 'I00022',\n", + " '\\n\\nActor: \\n\\n* 4chan user with Latvian IP address, \\n* pro-Trump Twitter accounts\\n\\nTimeframe: a few days\\n\\nDate: Two days before the second round of French 2017 election (May 5, 2017)\\n\\nPresumed goals: sabotaging Macron campaign in the last stage of the election.\\n\\nMethod:\\n\\n* Hashtag campaign: #MacronLeaks with use of bots. \\n* Hashtags initially launched in the US, then got publicized by alt-right influencer, Le Pen’s supporters, Wikileaks.\\n\\nCounters:\\n\\n* French agencies that monitor cybersecurity, electoral integrity.\\n* Technical precautions: ending e-voting.\\n* Facebook removed 70,000 suspicious accounts in France 10 days before the vote.\\n* Campaign staff responding to social media posts and comments.\\n* Technically, placing traps along the way, using fake passwords, email addresses, documents to trap hackers.\\n* Stop offering press credentials to propaganda outlets.\\n* Use encrypted apps for confidential communication.\\n* Requesting the media not to report false information.\\n\\nRelated incidents:\\n\\nReferences:\\n\\n* https://www.niemanlab.org/2018/09/how-france-beat-back-information-manipulation-and-how-other-democracies-might-do-the-same/\\n* https://www.buzzfeednews.com/article/ryanhatesthis/heres-how-far-right-trolls-are-spreading-hoaxes-about\\n* https://medium.com/dfrlab/hashtag-campaign-macronleaks-4a3fb870c4e8\\n'],\n", + " ['incident',\n", + " 'I00033',\n", + " '\\n\\nActor: China\\n\\nTimeframe: 2011\\n\\nDate:\\n\\nPresumed goals: \\n\\n* Commentators’ duty to guide public opinion in a “constructive” way and engage the internet as “an important battlefield of ideology.” The vice minister of public security said that the police should use microblogs as a communication platform to “release correct information and dispel misunderstandings.”\\n* Accounts describing the operations of progovernment commentators that have emerged in recent years indicate that they are also involved in identifying and recommending content for deletion. Other testimonies highlight the fact that the posts do not only praise or support the CCP and government policy, but also target government critics with negative remarks. Other forms of misdirection involve deliberate attempts to muddy the facts of a particular incident—for example, a false eyewitness can contradict the account of a netizen reporting a case of police abuse.\\n* The Chinese government has long been suspected of hiring as many as 2,000,000 people to surreptitiously insert huge numbers of pseudonymous and other deceptive writings into the stream of real social media posts, as if they were the genuine opinions of ordinary people. Many academics, and most journalists and activists, claim that these so-called “50c party” posts vociferously argue for the government’s side in political and policy debates.\\n\\nMethod: \\n\\n* Astroturfing: “surreptitiously post large numbers of fabricated social media comments, as if they were the genuine opinions of ordinary Chinese people\"\\n* Cow online opinion leaders into submission\\n* Bombard Taiwan social media (Facebook, twitter, chat groups) with ani-DPP, anti-Tsai content.\\n\\nCounters: \\n\\nRelated incidents: \\n\\nNotes: \\n\\n(Recorded Future) The term “Great Firewall” was coined in a June 1997 Wired magazine article in which an anonymous Communist Party official stated that the firewall was “designed to keep Chinese cyberspace free of pollutants of all sorts, by the simple means of requiring ISPs [internet service providers] to block access to ‘problem’ sites abroad.”\\n\\nOur research focused on the English-language social media activity of six major state-run propaganda organizations from October 1, 2018 through January 21, 2019, which included over 40,000 posts. We selected these six organizations — Xinhua, People’s Daily, China Global Television (CGTN), China Central Television (CCTV), China Plus News, and the Global Times — because they: Are highly digitized; Possess accounts on multiple English language social media platforms; Are associated with Chinese intelligence agencies and/or English language propaganda systems\\n\\nBecause our intent was to map out Chinese state-run influence campaigns targeting the American public, we evaluated only English language posts and comments, as the posts in Chinese were unlikely to affect most Americans. Further, our research focused on answering two fundamental questions about Chinese influence operations: Does China employ the same influence tactics in the English-language social media space as it does domestically? How do Chinese state-run influence operations differ from Russian ones? In what ways are they similar and different, and why?\\n\\nThe information-control regime in China has evolved to include a dizzying array of techniques, technologies, and resources: Blocking traffic via IP address and domain; Mobile application bans; Protocol blocking, specifically Virtual Private Network protocols and applications; Filtering and blocking keywords in domains (URL filtering); Resetting TCP connections; Packet filtering; Distributed denial-of-service (DDoS) attacks (the so-called Great Cannon); Man-in-the-middle (MiTM) attacks; Search engine keyword filtering; Government-paid social media commenters and astroturfers; Social media account blocking, topic filtering, content censorship; State-run media monopoly and censorship; Social Credit System; Mandatory real-name account registration; \\n\\nThis tool set, combined with the now-ubiquitous mass physical surveillance systems, place China at the forefront of integrating information technology, influence operations, surveillance, and censorship in a model referred to by two scholars from MERICS as “IT-based authoritarianism.”\\n\\nIn addition to the constraints imposed by the Great Firewall and content censorship, the Chinese state also employs a series of active disinformation and distortion measures to influence domestic social media users. One of the most widely studied has been the so-called “50 Cent Party.” The 50 Cent Party is a group of people hired by the Chinese government to “surreptitiously post large numbers of fabricated social media comments, as if they were the genuine opinions of ordinary Chinese people.” The name is derivative of a rumor that these fake commentators were paid 50 Chinese cents per comment (this has been largely disproven). This fabrication of social media comments and sentiment is largely known by the term “astroturfing.” Among scholars of the Chinese domestic social media environment, there is much disagreement regarding what the goals or objectives of government-paid astroturfers are. One study by professors at Harvard, Stanford, and UC San Diego, published in April 2017, determined that one in every 178 social media posts are fabricated by the government and that comments and campaigns are focused and directed against specific topics or issues. Additionally, these scholars have assessed that domestic social media influence operations focus primarily on “cheerleading” or presenting or furthering a positive narrative about the Chinese state. Conversely, a separate set of scholars at the University of Michigan, who also examined posts from the 50 Cent Party astroturfers, determined that at least one in every six posts on Chinese domestic social media was fabricated by the government. Further, these scholars argued that less than 40 percent of astroturfed comments could be classified as “cheerleading” and that the rest were a combination of vitriol, racism, insults, and rage against events or individuals. They additionally argue that censors and state-sponsored influence campaigns focus much of their resources on “opinion leaders” and users with large numbers of followers as opposed to simply intervening based on content.\\n\\n Chinese government has used a combination of muscle and guile to cow online opinion leaders into submission, muzzling social media as a political force, and leaching public dialogue of much of its independence. But beneath the peppy, pablum-filled surface that has resulted, Chinese social media remains a contested space.\\n\\n(Taiwan election) Tsai futilely urged Taiwanese citizens to see Beijing’s effort for what it was — a Russian-style influence campaign. The island’s 23 million citizens were bombarded with anti-Tsai and anti-DPP content through Facebook, Twitter and online chat groups, promoted by China’s “50-cent army” of paid social media trolls. There are also dozens of investigations into allegations that Chinese money went to fund Taiwanese candidates opposing Tsai and the DPP.\\nAfter the elections, Chinese state media pointed to Tsai’s losses as evidence that her tough stance vis-à-vis China was unpopular and wrongheaded. Beijing’s overall goal is to replace her with a more malleable leader in Taipei as part of its broad effort to exert control over Taiwan and weaken Taipei’s relationships with the international community.\\nThe Chinese government is bribing or coercing foreign governments to break diplomatic relations with Taiwan, pressuring them to evict Taiwan from international organizations. Beijing is also threatening foreign companies unless they literally erase Taiwan from their websites. Their ultimate goal is to dissolve the U.S.-Taiwan partnership and subjugate the island to the People’s Republic of China (PRC).\\n\\nThere are numerous agencies sponsoring internet commentators, including local propaganda offices, ministries and even schools and state-owned enterprises. For instance, China’s largest oil and gasoline producer, Sinopec, was found to be running an astroturfing campaign justifying rising gasoline prices in 2011 (Wang 2011). \\nThe following excerpt from a recruiting flyer from the Propaganda Department of the Zhengding Party Committee, Hebei, provides an example of what online commentators are expected to do (Zhonggong Zhengding Xianwei Xuanchuanbu 2009): \\ncompose original postings and carry out positive publicity online to promote the priorities and major deployments of the party committee and the government; \\nrelease authoritative information on major incidents to hinder the spread of rumours and ensure correct direction of online opinion; \\nanswer questions and clarify confusion for netizens on hotbutton incidents, interpret the policies of and measures taken by the party and the government and divert netizens’ emotions; \\nstrengthen information management on the internet and tightly integrate the analysis of online opinion, disposing of harmful information and guiding online opinion. \\n\\nThese instructions show that besides monitoring public opinion, the primary mission for online commentators is to facilitate state propaganda and defuse crises. In online propaganda campaigns, commentators work to attract public attention and fabricate an audience, if necessary. \\n\\n “American Cent Party” (美分党) who express western democratic values and criticize the Chinese communist regime online, and the “internet water army” (网络水军), which refers to for-hire astroturfers working for and advancing the interests of companies and other actors willing to pay their fees.\\nProminent dissident Ai Weiwei said “If you oppose the US and Japan [online], you are a member of the 50 cents army” (Strafella and Berg, 2015). 50c party members “combat hostile energy,” defined as posts that “go against socialist core values,” or “are not amenable to the unity of the people.” Such information should be “resolutely resisted, proactively refuted, and eagerly reported to Internet authorities.” 4 (Haley, 2010). Through active engagement of opposition views, they try to “sway public opinion” (Editors, 2016; Jason Ng, 2011), “influence public opinion. . . pretending to be ordinary citizens and defending or promoting the government’s point of view” (O. Lam, 2013), or “steer conversations in the right direction” (Editors, 2013). Estimates by journalists of the size of the 50c party is between 500,000 to 2 million (Philipp, 2015).\\n\\nReferences:\\n\\n* https://www.wired.com/1997/06/china-3/\\n* https://en.greatfire.org/analyzer\\n* https://www.nytimes.com/2017/01/04/business/media/new-york-times-apps-apple-china.html\\n* https://techcrunch.com/2017/07/29/apple-removes-vpn-apps-from-the-app-store-in-china/\\n* https://pdfs.semanticscholar.org/9fc1/d1815a678583c1e73233bb93aaaab7d0fd4f.pdf\\n* https://www.cl.cam.ac.uk/~rnc1/ignoring.pdf\\n* https://citizenlab.ca/2015/04/chinas-great-cannon/\\n* https://drive.google.com/file/d/1xjHWI0Ih3abONxL0WoXj2swlcBuiRCXO/view\\n* https://papers.ssrn.com/sol3/Papers.cfm?abstract_id=2738325\\n* http://www.spiegel.de/international/world/china-s-xinjiang-province-a-surveillance-state-unlike-any-the-world-has-ever-seen-a-1220174.html\\n* https://www.merics.org/sites/default/files/2018-07/MPOC_ChinasCoreExecutive_web.pdf\\n* https://www.freedomhouse.org/template.cfm?page=691&cmb=34#Vice\\n* http://cmp.hku.hk/2011/05/09/12125\\n* http://chinadigitaltimes.net/2008/05/chinese-bloggers-on-the-history-and-influence-of-the-fifty-cent-party/\\n* http://gking.harvard.edu/files/gking/files/50c.pdf?m=1463587807\\n* http://blakeapm.com/\\n* https://www.washingtonpost.com/news/monkey-cage/wp/2017/02/21/can-the-chinese-government-really-control-the-internet-we-found-cracks-in-the-great-firewall/\\n* https://drive.google.com/file/d/1xjHWI0Ih3abONxL0WoXj2swlcBuiRCXO/view\\n* https://foreignpolicy.com/2014/01/30/whisper-together/\\n* https://www.nytimes.com/2018/11/22/world/asia/taiwan-elections-meddling.html\\n* http://www.taipeitimes.com/News/front/archives/2018/10/23/2003702864\\n* https://www.aljazeera.com/news/2018/11/news-rattles-taiwan-elections-181123005140173.html\\n* https://www.reuters.com/article/us-taiwan-politics/china-heaps-pressure-on-taiwan-president-after-poll-defeat-idUSKCN1NV02X\\n* https://www.washingtonpost.com/opinions/global-opinions/trump-is-failing-to-counter-chinas-diplomatic-assault-on-taiwan/2018/09/06/e744f97c-b20c-11e8-9a6a-565d92a3585d_story.html\\n* https://www.washingtonpost.com/news/josh-rogin/wp/2018/05/05/white-house-calls-chinas-threats-to-airlines-orwellian-nonsense/\\n* https://gking.harvard.edu/files/gking/files/how_the_chinese_government_fabricates_social_media_posts_for_strategic_distraction_not_engaged_argument.pdf \\n* https://www.voanews.com/a/who-is-that-chinese-troll/3540663.html\\n* https://journals.sub.uni-hamburg.de/giga/jcca/article/viewFile/850/851\\n* https://www.scmp.com/culture/books/article/2144692/how-china-censors-its-internet-and-controls-information-great-firewall\\n* https://freedomhouse.org/blog/china%E2%80%99s-growing-army-paid-internet-commentators\\n* https://www.recordedfuture.com/china-social-media-operations/\\n* https://foreignpolicy.com/2016/05/19/meet-the-chinese-internet-trolls-pumping-488-million-posts-harvard-stanford-ucsd-research/\\n* https://www.washingtonpost.com/opinions/2018/12/18/chinas-interference-elections-succeeded-taiwan/\\n\\n'],\n", + " ['incident', 'I00062', '\\n\\nSee also I00005.'],\n", + " ['incident',\n", + " 'I00056',\n", + " '\\n\\nActor: Iran\\n\\nTimeframe: 2012 - ongoing\\n\\nDate: Aug 21, 20198\\n\\nPresumed goals: \\n\\n* Iran’s meddling in the politics of the Arab states has become more conspicuous since the Arab Spring of 2011. Iran has been trying to widen its influence in the region in its political jousting against Saudi Arabia which is sometimes referred to as “the Arab Cold War”. Although the two regional rivals have never declared war, the two players have been involved in proxy wars in the region including Syria and Yemen.\\n* Pages promoted or amplified views in line with Iranian government’s international stances. The pages posted content with strong bias for the government in Tehran and against the “West” and regional neighbors, such as Saudi Arabia and Israel.The operation was noteworthy, however, that more than 30 percent of the removed assets were active for five or more years, indicating that Iranian entities have been engaged in social media influence campaigns since as early as 2010 (DFRLab)\\n\\n\\nMethod: \\n\\n* In August 2018, Facebook removed 652 pages, groups, and accounts on Facebook and Instagram originating from Iran for engaging in a “coordinated inauthentic behaviour”. 15 These operations targeted people in the Middle East, Latin America, the UK, and the US. In October 2018, Facebook announced the removal of another 82 pages, groups, and accounts on Facebook and Instagram. This time the company announced that these accounts and pages targeted people in the US and the UK.16 Some of these accounts masqueraded as American citizens pushing anti-Saudi and anti-Israel narratives.\\n* In October 2018, Twitter published two data sets comprising 3,841 accounts affiliated with the Internet Research Agency (IRA), and 770 accounts that could be traced back to Iran. These accounts were suspended by Twitter in August 2018 for engaging in coordinated manipulation on the platform. Twitter believes that the information operations linked to Iran are potentially backed by the state\\n* 70 websites found by Reuters which push Iranian propaganda to 15 countries, in an operation that cybersecurity experts, social media firms and journalists are only starting to uncover. The sites found by Reuters are visited by more than half a million people a month, and have been promoted by social media accounts with more than a million followers… the sites in the campaign have been active at different times since 2012. They look like normal news and media outlets,but only a couple disclose any Iranian ties.\\n* The social media companies have closed hundreds of accounts that promoted the sites or pushed Iranian messaging. Facebook said last month it had taken down 82 pages, groups and accounts linked to the Iranian campaign; these had gathered more than one million followers in the United States and Britain. But the sites uncovered by Reuters have a much wider scope. They have published in 16 different languages, from Azerbaijani to Urdu, targeting Internet users in less-developed countries. That they reached readers in tightly controlled societies such as Egypt, which has blocked hundreds of news websites since 2017, highlights the campaign’s reach.\\n* Ten outlets targeting readers in Yemen, where Iran and U.S. ally Saudi Arabia have been fighting a proxy conflict since civil war broke out in 2015; A media outlet offering daily news and satirical cartoons in Sudan. Reuters could not reach any of its staff; A website called Realnie Novosti, or “Real News,” for Russian readers. It offers a downloadable mobile phone app but its operator could not be traced.\\n* One of IUVM’s most popular users is a site called Sudan Today, which SimilarWeb data shows receives almost 150,000 unique visitors each month. On Facebook, it tells its 57,000 followers that it operates without political bias. Its 18,000 followers on Twitter have included the Italian Embassy in Sudan, and its work has been cited in a report by the Egyptian Electricity Ministry.\\nThe office address registered for Sudan Today in 2016 covers a whole city district in north Khartoum, according to archived website registration details provided by WhoisAPI Inc and DomainTools LLC. The phone number listed in those records does not work.\\n* We have observed inauthentic social media personas, masquerading as American liberals supportive of U.S. Senator Bernie Sanders, heavily promoting Quds Day, a holiday established by Iran in 1979 to express support for Palestinians and opposition to Israel. (FireEye)\\n* Broadly speaking, the intent behind this activity appears to be to promote Iranian political interests, including anti-Saudi, anti-Israeli, and pro-Palestinian themes, as well as to promote support for specific U.S. policies favorable to Iran, such as the U.S.-Iran nuclear deal (JCPOA). In the context of the U.S.-focused activity, this also includes significant anti-Trump messaging and the alignment of social media personas with an American liberal identity. However, it is important to note that the activity does not appear to have been specifically designed to influence the 2018 U.S. midterm elections, as it extends well beyond U.S. audiences and U.S. politics. (FireEye)\\n* All 17 of the pages containing information about manager location had managers from Iran. Canada, Saudi Arabia, and Syria were other common locations of page managers. (DFRLab)\\nPromoting Shi’a Political and Militant Views\\n* One of the removed pages\\u200a—\\u200a@alalsadrr1\\u200a—\\u200apromoted Moqtada al-Sadr, an influential Shi’a cleric and militia leader from Iraq and leader of the Mahdi Army. According to the Wilson Center, in the mid-2000’s, the Mahdi Army received weapons and training from the Islamic Revolutionary Guard Corps and Lebanese Hezbollah agents. In May 2018, The Atlantic reported that the “controversial” leader and his followers had committed brutal atrocities in Iraq, fought the U.S. military in Sadr City and Basra, and were known for corruption. (DfRLab)\\n* In January, Facebook took down 783 accounts and pages, which it assessed as “directed from Iran, in some cases repurposing Iranian state media content.” (DFRLab - March 26, 2019)\\nThe operation strongly resembled the earlier IUVM operation. Facebook did not attribute it to IUVM directly, but the latest network used the same techniques and pointed to some of the same websites, making attribution to the same network likely, although not confirmed.\\nIn particular, pages across the network reproduced IUVM content, as well as content from other websites which have featured in earlier exposés and takedowns.\\nThe network functioned by steering users towards ostensibly independent news websites, which amplified Iranian regime propaganda, often copied verbatim from regime assets. The social media content therefore served as a secondary amplifier, rather than a direct audience-engagement tool.\\nDespite the heterogeneous nature of the assets\\u200a—\\u200athey were spread across many countries, languages, and cultures\\u200a—\\u200atheir messaging was largely homogeneous. It dealt with issues of importance to the Iranian government, supporting Palestinians and Shia Muslims on one hand, and attacking Israel, the United States, Saudi Arabia, and the conduct of the military campaign in Yemen on the other.\\nThe focus on South Asia was noteworthy. Indonesia and India had the most pages targeted at them; African countries also featured prominently. This expands the known area of Iranian influence operations, which have thus far been primarily exposed in the Middle East and in the West.\\n\\n\\nCounters: \\n\\n* Facebook and Twitter content take-downs\\n\\nRelated incidents: \\n\\n* See Venezuela:\\nhttps://www.bloomberg.com/news/articles/2019-02-01/iran-slams-u-s-over-venezuela-secretly-some-may-be-relieved\\nhttps://www.rand.org/blog/2019/02/hezbollah-is-in-venezuela-to-stay.html\\n\\n\\nReferences: \\n\\n* http://www.state.gov/e/eb/tfs/spi/iran/jcpoa/\\n* http://www.arabnews.com/node/1329971/middle-east\\n* https://www.wilsoncenter.org/article/part-2-pro-iran-militias-iraq\\n* https://www.theatlantic.com/international/archive/2018/05/iraq-moqtada-sadr/559499/\\n* https://www.amnesty.org/en/latest/news/2014/10/iraq-evidence-war-crimes-government-backed-shi-militias/\\n* http://www.washingtonpost.com/wp-dyn/content/article/2008/04/18/AR2008041803429.html\\n* https://www.telegraph.co.uk/news/worldnews/middleeast/iraq/1498970/UK-troops-left-isolated-as-Mahdi-Army-weaves-a-web-of-official-corruption.html\\n* https://medium.com/dfrlab/trolltracker-outward-influence-operation-from-iran-cc4539684c8d\\n* https://newsroom.fb.com/news/2019/01/removing-cib-iran/\\n* https://www.reuters.com/article/us-cyber-iran-specialreport/special-report-how-iran-spreads-disinformation-around-the-world-idUSKCN1NZ1FT\\n* https://www.rand.org/blog/2018/08/irans-disinformation-campaigns.html\\n* https://medium.com/dfrlab/takedown-details-of-the-iranian-propaganda-network-d1fad32fdf30\\n* https://medium.com/dfrlab/trolltracker-outward-influence-operation-from-iran-cc4539684c8d\\n* https://comprop.oii.ox.ac.uk/wp-content/uploads/sites/93/2019/04/Iran-Memo.pdf\\n* https://www.fireeye.com/blog/threat-research/2018/08/suspected-iranian-influence-operation.html\\n\\n'],\n", + " ['incident',\n", + " 'I00007',\n", + " '\\n\\nActor: RT/Sputnik\\n\\nTimeframe: 2 weeks\\n\\nDate: July-August 2016\\n\\nPresumed goals: \\n\\nMethod: \\n\\nCounters: \\n\\nRelated incidents: \\n\\n* Jade Helm exercise\\n* Black Lives Matter protests\\n* Bundy Ranch standoff\\n\\nNotes:\\n\\nStory was that the Incirlik NATO base in Turkey was under attack by terrorists. \\n2016-08-14 Paul Manafort cited that the Incirlik NATO base in Turkey was under attack by terrorists, as an example of an unreported true story. \\n“The weekend of July 30, RT.com and Sputnik reported 7,000 armed police with heavy vehicles had surrounded Incirlik air base in Adana, Turkey, where 2,500 U.S. troops are stationed and some 50 U.S. nuclear weapons are stored. The two Kremlin-funded outlets suggested that the lockdown was in response to another coup attempt after a faction of the Turkish military failed to overthrow Turkish President Recep Tayyip Erdoğan.”\\n“On the evening of 30 July 2016, my colleagues and I watched as RT and Sputnik news simultaneously launched false stories about the U.S. air base in Incirlik, Turkey being overrun by terrorists,” he told the committee. Within minutes pro-Russian social media aggregators and automated bots amplified this false news story,” Watts said. “There were more than 4,000 tweets in the first 75 to 78 minutes after launching this false story. Perhaps the most stunning development for Watt and his companions was that the rapid proliferation of that story was linked back to the active measures accounts (Russian bots) they had tracked for the preceding two years. These previously identified accounts almost simultaneously appearing from different geographic locations and communities amplified the big news story in unison,” Watts said. The hashtags promoted by the bots, according to Watts, were “nuclear, media, Trump and Benghazi. The most common words, he said found in English speaking Twitter user profiles were “God, military Trump, family, country, conservative, Christian, America and constitution. The objective of the messages, Watts said, “clearly sought to convince Americans that U.S. military bases being overrun in a terrorist attack.”\\n\\nData\\n\\n* Looked at Twitter for these dates: https://twitter.com/search?l=&q=incirlik%20until%3A2014-08-14&src=typd\\nhttps://twitter.com/ElectionLawCtr/status/492850603039522816\\n\\n\\nReferences: \\n* https://www.rt.com/news/354042-turkish-police-incirlik-nato-coup/\\n* https://sputniknews.com/middleeast/20160731/1043797161/incirlik-turkey-erdogan-nato-nukes.html\\n* https://www.politifact.com/truth-o-meter/statements/2016/aug/16/paul-manafort/trump-campaign-chair-misquotes-russian-media-makes/\\n* https://wtop.com/j-j-green-national/2017/09/anatomy-russian-attack-first-signs/slide/1/ \\n'],\n", + " ['incident',\n", + " 'I00017',\n", + " '\\n\\nActor: IRA\\n\\nTimeframe: 2 years\\n\\nDate: December 2015 - 2017\\n\\nPresumed goals: “Russia’s goals were to undermine public faith in the US democratic process, denigrate Secretary Clinton, and harm her electability and potential presidency” - James Clapper\\n\\nMethod:\\n\\n* Facebook ads promoting minor candidates (Jill Stein)\\n\\nReferences:\\n* https://medium.com/dfrlab/electionwatch-beyond-russian-impact-2f5777677cc0\\n* https://www.thedailybeast.com/exclusive-secret-documents-from-russias-election-trolls-leak\\n\\nNotes:\\n\\nDailyBeast article gives sizings and method - 80 people on this. If they were working 8-6, that gives us a sizing on how much trolling they could do. \\n\\n'],\n", + " ['incident',\n", + " 'I00003',\n", + " '\\n\\nActor: IRA\\n\\nTimeframe: \\n\\nDate: \\n\\nPresumed goals:\\n\\nMethod: \\n\\nCounters:\\n\\nRelated incidents:\\n\\n\\nReferences:\\n\\n* https://twitter.com/JuliaDavisNews/status/994704834577215495 \\n* https://twitter.com/donie/status/957246815056908288 \\n* https://www.theguardian.com/us-news/2018/may/10/russia-facebook-ads-us-elections-congress\\n'],\n", + " ['incident',\n", + " 'I00042',\n", + " '\\n\\nActor: \\n\\n* Saudi Arabia / Qatar /Turkey. \\n* While the dispute is between these two Kingdoms, it’s with certainty that one can suggest Iran (both projection and the containment of its power/influence in the region) is at the center of it.\\n\\nTimeframe: May - September 2017 \\n\\nDate: May, 2017\\n\\nPresumed goals: \\n\\n* The programmatic/synthetic amplification of respective “positions and/or plights.” \\n* The respective hashtags can not be categorized as organic in nature, but launched in conjunction with the botnet deployments. As well, none of the identified bot related activity points to an effort to drown out/flood the opponents. \\n\\nMethod: \\n\\n* Twitter campaign; bots/botnets seriously distorted the conversation on Twitter.\\n* Commercial botnets (these are created en masse and rented out to any user who is willing to pay for retweets, likes, and follow—either for their own account or for somebody else’s. They are thus the easiest and quickest way to obtain artificial amplification)\\n* On 24 May 2017, for example, pro-Qatar users launched the hashtag or “Qatar is not alone.”\\n* Supporters of Saudi Arabia also turned to apparently commercial bots to promote their messages. On 21 July, supporters of Qatar launched another hashtag, or “Tamim the Glorious,” in honor of the Emir. In response, supporters ,#تميم_المج ُد of Saudi Arabia used a botnet to attack the hashtag. The attack began when an account called @al_muhairiuae posted a photoshopped image of the Emir designed to make him look foolish.\\n* Combined with the Korean imagery, this suggests they were a commercial botnet that an unknown user rented to amplify the anti-Qatar tweet and to subvert the pro-Qatar hashtag, which had only just started to trend.\\n* At least one botnet seemed based in Turkey, joining the fray in mid-September in a bid to support Qatar.”\\n\\nCounters: \\n\\n* Essentially the was a tit-for-tat campaign with a brief “incursion”/support/spike of activity most likely (but not officially verified) from Turkey in support of Qatar\\n\\n* Global Research (Pro-Kremlin publication/organization located in Montreal, QC) contributed anti-Saudi spin via their blog. Global Research (anti-Saudi… campaign); Global Research (more)\\n\\nRelated incidents: \\n\\n* Jamal Khashoggi incident will bear hallmarks of the incident, but moves beyond a regional information operation into one of global significance. In 2018 the NY Times investigates Saudi Arabia’s Troll Army\\n\\nReferences: \\n\\n* https://www.globalresearch.ca/saudi-arabias-march-towards-civil-war/5616699\\n* https://www.globalresearch.ca/the-machiavellian-plot-to-provoke-saudi-arabia-and-qatar-into-a-blood-border-war/5593870\\n* https://www.nytimes.com/2018/10/20/us/politics/saudi-image-campaign-twitter.html\\n* https://jia.sipa.columbia.edu/robot-wars-how-bots-joined-battle-gulf\\n* https://www.washingtonpost.com/news/monkey-cage/wp/2017/06/07/hacking-bots-and-information-wars-in-the-qatar-spat/\\n* https://www.independent.co.uk/news/world/middle-east/russian-hackers-qatar-fake-news-gulf-diplomatic-row-fbi-doha-saudi-arabia-bahrain-uae-egypt-a7776446.html\\n* https://qz.com/1107023/the-inside-story-of-the-hack-that-nearly-started-another-middle-east-war/\\n* https://theconversation.com/the-world-cup-in-digital-and-social-the-viewers-the-tweets-and-the-trolls-99625\\n\\n* https://www.bbc.com/news/blogs-trending-44294826\\n* https://jia.sipa.columbia.edu/robot-wars-how-bots-joined-battle-gulf\\n\\nDatasets: Mining and analyzing Twitter data is unlikely to “prove” or offer much more insight than Ben Nimmo’s work.\\n\\nNotes: \\n\\nGiven the apparent use of commercial botnets, it’s difficult to attribute much of the activity to state actors, however it is fair to suggest some of this behavior would undoubtedly needed tacit state support… private “patriots” of the state?\\n\\nThis article https://jia.sipa.columbia.edu/robot-wars-how-bots-joined-battle-gulf highlights the mechanics and dynamics of the bot operations/amplification in some cases to short life span of the activity and assets (quickly deleted from the platform), but doesn’t communicate the underlying political issues that drove these incidents.\\n \\nThe focus of these Arabic-language hashtags was clearly local and regional rather than international; this was a question of messaging to the domestic population and to Arabic-language rivals, rather than the non-Arabic-speaking world.\\nClaims of Russian involvement/hack are reported by both the Washington Post and the Independent UK (cites CNN as source). Quartz as well cites the Russian connection, further citing documentation shared with them via Qatar (flimsy at best) and further point blame for the affair at President Trump. \\n\\nPost incident - Given Qatar is hosting the 2022 World Cup of Soccer, the World Cup 2018, was a “test” ground for this ongoing online “war” while subtle was evident (Mentionmapp Analytics… John’s research) '],\n", + " ['incident',\n", + " 'I00008',\n", + " '\\n\\nActor: \\n\\nTimeframe: \\n\\nDate: \\n\\nPresumed goals:\\n\\nMethod: \\n\\nCounters:\\n\\nRelated incidents:\\n\\nReferences:\\n\\n* https://www.ceas-serbia.org/images/2018/201803_CEAS_Report.pdf\\n* https://www.stopfake.org/en/vencislav-the-virgin-hostile-operation-by-vencislav-bujic-seas-foundation-and-its-network-of-collaborators/\\n* https://seas.foundation/en/2018/03/15/155\\n\\n'],\n", + " ['incident',\n", + " 'I00049',\n", + " '\\n\\nActor: Russia, Syrian Government and Iran\\n\\nTimeframe: April-June\\n\\nDate: April 8, 2018\\n\\nPresumed goals: \\n\\n* can’t trust anyone who is reporting about it & fit into the “false flag,” commonly used conspiracy trope positing that mass casualty incidents are engineered internally to provide pretext for either government repression or military action \\n\\nMethod: \\n\\n* One novel attack on the White Helmets in the wake of the Douma attacks featured the claim that the group had run a film studio in the besieged city, and used it to stage propaganda videos. This was initially reported by Lebanon-based Al-Aahed News[81] and Iran’s Fars News,[82] each of which attributed it to the other. It was then picked up by Russian state outlets in both Russian[83] and English.[84] As Bellingcat was quick to point out, the images of the studio were actually taken from the Facebook page of a film called Revolution Man.[85] The way in which this demonstrably false claim was amplified on pro-Assad channels reinforces the conclusion that its purpose was to discredit the White Helmets because their reporting was accurate—not because it was false.\\n* A separate line of argument focused on the Western response to the Douma attack, and the conclusion that the chemical attack had indeed been launched by Assad’s forces. This argument claimed, in essence, that the West’s response was hasty, ill-judged, and went beyond the evidence.[86]\\n* A third line of attack focused on accusing the West of condoning or staging chemical attacks, including the Douma one, and thus delegitimizing Western outrage. On April 13, the Russian Ministry of Defense said that it had “evidence proving the United Kingdom’s direct involvement in the organization of this provocation in eastern Ghouta,”[91]\\n* A fourth tactic featured apocalyptic warnings that any Western strike into Syria that harmed Russians could trigger World War III. On April 8, for example, the Russian Foreign Ministry warned of “very grave consequences” of an American strike.[93]\\n\\nCounters: \\n\\n* Fact checking (Snopes & Bellingcat)\\n\\nRelated incidents: \\n\\n* foundation to Russia ramping up chemical weapon disinformation leading-op to Idlib offensive \\n\\nReferences: \\n\\n* https://eeas.europa.eu/headquarters/headquarters-homepage/42657/syria-eu-calls-accountability-after-yet-another-chemical-attack_en\\n* This is the most detailed article/resource helps lay the background, details, players, tactics http://www.publications.atlanticcouncil.org/breakingghouta/disinformation-2/\\n* https://www.washingtonpost.com/news/monkey-cage/wp/2018/09/17/russia-is-gearing-up-to-misinform-the-u-s-public-about-syria-heres-our-cheat-sheet-to-identify-twitter-trolls/?utm_term=.7d3c56b0b03a\\n* https://euvsdisinfo.eu/report/bbc-admits-that-reason-for-bombing-syria-was-fake/\\n* https://www.bellingcat.com/news/mena/2018/12/18/chemical-weapons-and-absurdity-the-disinformation-campaign-against-the-white-helmets/\\n* https://www.bellingcat.com/news/mena/2018/08/30/russian-chem-disinfo-idlib/\\n* https://www.bellingcat.com/tag/chlorine/\\n* https://www.nybooks.com/daily/2018/10/16/why-assad-and-russia-target-the-white-helmets/\\n* https://www.snopes.com/news/2018/04/12/disinformation-conspiracy-trolling-syrian-chemical-attack/\\n* https://www.snopes.com/fact-check/is-this-proof-white-helmets-staged-chemical-attack/\\n* https://www.dw.com/en/russias-syria-chemical-weapons-attack-warning-dubious-experts-say/a-45250441\\n* https://euvsdisinfo.eu/report/new-chemical-attack-to-be-staged-by-the-white-helmets-in-idlib/\\n* https://www.nytimes.com/2018/04/08/world/middleeast/syria-chemical-attack-ghouta.html\\n\\nDatasets: \\n\\nNotes: \\n\\nFor the Syrian opposition, the use of these weapons in high-casualty attacks now brought the possibility of US military intervention. For the Syrian government and Russia, that same possibility brought an urgent need to sow doubt around the veracity of any claims of chemical weapons use—including by claiming that the reports of chemical weapons use were a conspiracy launched by foreign enemies to trigger more strikes.\\nIn parallel, perhaps in an attempt to deflect potential consequences, Russian government sources began claiming that rebel groups and the White Helmets rescue organization, backed by Western powers, were planning “false flag” chemical attacks, designed to kill civilians and point the blame at the Syrian government. Against the background of the 2017 US strikes that followed the Khan Sheikhoun attack, such claims introduced the idea of American complicity in any future attacks, suggesting that such attacks would be a false flag to cover an already-decided US engagement, rather than a consequence of the regime or Russia’s decision to use chemical weapons. This seeded a narrative that could later be passed on to anti-interventionist media outlets and campaigners in the West.\\nThe claim that a given incident was a false flag attack, designed to discredit the Russian government, has regularly been deployed by Kremlin supporters—for example, over the downing of Malaysia Airlines flight MH17 over Ukraine and the poisoning of former Russian spy Sergei Skripal in England, as well as in Syria. Such claims have been repeated and disseminated through a complex ecosystem of blogs and social media posts, largely written in English by self-styled “investigative journalists” with ties to Kremlin-operated media outlets.[18] These provided vital validation to the Syrian/Russian narrative, and played an important role in its dissemination.\\nThe disinformation campaign waged by the Syrian and Russian regimes was large scale, persistent, and supported by a range of Western commentators. In the immediate aftermath of the attack, its impact was limited, and the bulk of mainstream reporting focused on establishing the series of events. According to an online scan of Twitter mentions of the word “Douma” conducted with the Sysomos online service, none of the ten most-retweeted tweets posted on April 7-9 contained pro-Assad content, indicating that the conversation was dominated by other voices.[110] In all, the scan collected some 435,000 tweets. Progressively, however, the mainstream media shifted their focus to other issues, while the supporters of the Syrian and Russian regimes kept their focus on Douma; thus, the overall volume of traffic declined, and the share of the conversation dominated by pro-Assad voices increased. In a similar scan of the period from April 10-16, six of the ten most-retweeted posts came from Assad supporters, out of a total of 487,000 posts.[111]\\nThis analysis also reveals the integration of government-funded media (RT, SputnikNews) and geopolitical think tanks (GlobalResearch) as source content for anti-WH [anti-White Helmet] narratives.”[120]\\nPro-Assad and pro-Russian disinformation was further amplified by a group of ostensibly independent news websites that have since been demonstrated to have Iranian links,[121] and which systematically promoted pro-Iranian regime messaging.[122] These sites included IUVMPress.com, an apparent news site that reproduced content from Iranian regime and pro-regime sources, stripped it of its attribution, and passed it onto other sites; institutomanquehue.org, ostensibly a think tank focused on Latin America; and britishleft.com, apparently a site dedicated to left-wing British politics\\nCommentators such as Beeley, Bartlett, and 21st Century Wire colleague Patrick Henningsen bridged the gap between the “alt-right” movement in the United States and the Russian state communications network, being cited both on sites such as RT, and alt-right hubs such as Infowars. Beeley and Bartlett contribute to both 21st Century Wire[129] and RT;[130] Henningsen formerly wrote for Infowars,[131] writes for 21st Century Wire, and is featured as a contributor on RT’s site.[132] Their contributions helped to spread pro-Assad and pro-Kremlin messaging into US audiences, very much in the manner described by Simonyan, when she spoke of the need for “English-speaking talking heads” to validate the Kremlin’s view.\\n\\nOn at least one occasion, their messaging broke into the mainstream. On April 13, 2018, rock guitarist Roger Waters told a concert in Barcelona that he thought the White Helmets were a “fake organization that is creating propaganda for jihadists and terrorists”—a very similar misrepresentation to that publicized by the Kremlin disinformation networks.[134\\nA video clip of his comments was repeatedly uploaded to YouTube by Kremlin and pro-Kremlin users, including RT UK,[136]Beeley,[137] Hands Off Syria,[138] and Clarity of Signal.[139] Together, these totalled more than 140,000 views by September 19, 2018\\n\\nWhen incidents such as the Waters amplification are taken into account, the reason that Russia’s General Dvornikov spoke so highly of information operations becomes clear. The combination of state-funded outlets, covert outlets such as IUVMPress, official statements, and supporting bloggers and trolls allowed the pro-Assad narrative to dominate the online conversation for extended periods, especially during times when the credible media outlets were focusing on other issues.\\n'],\n", + " ['incident',\n", + " 'I00039',\n", + " '\\n\\nActor:\\n\\n* Right-wing FB pages\\n* Fake news sites e.g. yesimright.com; shoebat.com; endingthefed.com; truthfeed.com; yournewswire.com.\\n* British tabloids: Express, MailOnline.\\n\\nTimeframe: Data was collected and analyzed in 2016.\\n\\nDate: 2016.\\n\\nPresumed goals:\\n* To attack Merkel’s liberal position on the refugee crisis.\\n\\nMethod:\\n* Fake news sites mix legitimate partisan political content with false and conspiratorial information.\\n* Large right-wing FB pages in the US also share anti-Merkel content.\\n* Most popular Merkel articles on Facebook also come from legitimate, but negative and right-wing news sources.\\n* German links that generated most engagement in 2016 spread conspiratorial claims about Merkel’s mental health.\\n\\nCounters:\\n* No counter actions were taken.\\n\\nRelated incidents: \\n\\n* Defamation of Modamani – a Syrian refugee - who took a selfie with Merkel and was accused on social media as having links to terrorism.\\n\\nReferences:\\n\\n* Source: Buzzfeed analysis\\n* https://www.buzzfeed.com/albertonardelli/hyperpartisan-sites-and-facebook-pages-are-publishing-false\\n* https://www.nytimes.com/2017/02/06/business/syria-refugee-anas-modamani-germany-facebook.html\\n '],\n", + " ['incident',\n", + " 'I00029',\n", + " '\\n\\nActor: Russia \\n\\nTimeframe: July 2014 - still active\\n\\nDate: July 17, 2014\\n\\nPresumed goals: \\n\\n* Ongoing campaign to discredit/undermine Ukraine & NATO & Democracy\\n\\nMethod: \\n\\n* Multi-pronged media & source driven campaign… ie: \\n* Russian state sources military, embassy, media (RT, Sputnik, TASS); \\n* Kremlin’s “witting idiots” ie: 21Wire, Global research; trolls & bots. \\n* “All” media platforms… ie: Youtube; Twitter; Reddit\\n* See collection of visual assets \\n\\nCounters: \\n\\n* Bellingcat; Dutch gov’t, DFRLab\\n\\nRelated incidents: \\n\\n* Anything related to Ukraine\\n* Donetsk\\n* Crimea\\n* Sea of Azov\\n* Ukrainian election (2019)\\n\\nReferences:\\n\\n* [Bellingcat (collection of related investigations)](https://www.bellingcat.com/?s=MH17) \\nIe: [“The Kremlin’s Shifting, Self-Contradicting Narratives on MH17”](https://www.bellingcat.com/news/uk-and-europe/2018/01/05/kremlins-shifting-self-contradicting-narratives-mh17/)\\n\\n* [DFRLab MH17 4D\\'s \"playbook\"](https://medium.com/dfrlab/putinatwar-dismissing-mh17-8268d2968b9) \\n* [In social networks on the fingers showed how the Kremlin bots work](https://news.online.ua/754036/v-sotssetyah-na-paltsah-pokazali-kak-rabotayut-boty-kremlya-opublikovany-foto/):\\n“Censoring” the news (Facebook page “takedown”) [Facebook blocked Sergey Parkhomenko for commenting on the report of the downed \"Boeing\"](https://www.novayagazeta.ru/news/2015/05/07/112052-facebook-zablokiroval-sergeya-parhomenko-za-kommentariy-doklada-o-sbitom-171-boinge-187%20)\\n* [The most comprehensive guide ever to MH17 conspiracies](http://euromaidanpress.com/2015/10/14/confuse-and-obfuscate-the-most-comprehensive-guide-ever-to-mh17-conspiracies/)\\n\\n* http://tass.com/world/1050324\\n* https://www.mirror.co.uk/news/world-news/ukraine-involved-mh17-downing-claims-14184413\\n* https://www.bellingcat.com/resources/case-studies/2014/07/17/geolocating-the-missile-launcher-linked-to-the-downing-of-mh17/\\n* https://globalnews.ca/news/4993120/russia-rising-part-5-maskirovka/\\n* http://euromaidanpress.com/2018/12/06/ukraine-related-narratives-dominate-russian-propaganda/\\n\\nDatasets: none searched for\\n\\nNotes:\\n\\nRussia still accusing Ukraine (03.25.2019)... TASS and UK Daily Mirror \\n\\nFirst Bellingcat report: Efforts to Geolocate the Launcher 07/17/14\\nCountless example of Elliot Higgins & team getting trolled since, popular hashtag is #bellingcrap\\n\\nThis is a good summary: \\n“But not only did Russia fiercely deny those accusations, a number of Russian leaders, officials and broadcasters responded by offering dozens of different alternative explanations, “including quite outlandish theories,” says Nilsson.\\n\\n“For instance, that an airplane would’ve been loaded with already dead people and that Ukrainian airplanes would then have shot it down to make it look like Russia was shooting down passenger airplanes,” he explains.\\n\\n“There were tons of these stories going around, quite a few of them coming from official Russian sources. And they were not meant to be taken seriously. They were simply supposed to occupy the attention span of the world for a while, to the extent that everyone would lose track of the original explanation, which turned out to be quite the right one.” https://globalnews.ca/news/4993120/russia-rising-part-5-maskirovka/\\n\\nTopics of Ukraine-related narratives\\nhttp://euromaidanpress.com/2018/12/06/ukraine-related-narratives-dominate-russian-propaganda/\\nBack in 2016, StopFake co-founder Yevhen Fedchenko identified 18 major Ukraine-related fake narrative topics spread by Russian propaganda by analyzing 500 debunked disinformation items.\\nThe Euromaidan Revolution as a “coup d’état“\\nUkraine as a “fascist state“\\nUkraine as a “failed state“\\n“Russia is not a part of the occupation/war in Ukraine“\\nDiscrediting the Ukrainian Armed Forces (UAF)\\nDiscrediting the volunteer battalions (which officially became a part of UAF in 2015)\\nDonbas and Crimean internally displaced persons (IDPs) and refugees\\nTerritorial disintegration of Ukraine\\n“Territorial claims” for parts of Ukraine from neighboring Poland, Hungary, Romania, and Slovakia\\nFake “international legitimization” of annexation and occupation of Crimea\\nThe war in Ukraine “conducted by the US, NATO or Western private contractors”\\nThe West’s “Ukraine fatigue“\\nManipulating international organizations\\nFakes about EU-Ukraine relations\\n“Decay” of the US and West in general, and the “disintegration of the EU”\\nFlight MH17 crash fakes\\nThe West “uses biological weapons” in Ukraine\\nMix-ups of the fake narratives about Ukraine, Syria, ISIS terrorists (e.g., Crimean Tatars being depicted as jihadists or Ukraine as a training ground for terrorists)\\nFor post-Maidan Ukraine, Russian propaganda’s most used narratives were the Euromaidan as “coup d’etat” which brought a “Western-backed junta” (mostly “US-backed”) to power, and “fascism” as the main ideology of the post-Maidan government, Fedchenko notes.\\n\\n'],\n", + " ['incident',\n", + " 'I00009',\n", + " ' \\n\\nSuspected actors:\\n\\n* Attacker: IRA or more broadly Russian state-sponsored disinformation campaign.\\n* Amplifiers: through the persona of “Adam Garrie” (who first appeared on RT (Russian Today) and pro-Russia sites, with no background in Asia and Philippine affairs but suddenly rose to become a global affairs expert).\\n* Garrie was then promoted by pro-Duterte officials, social media pages and news outlets.\\n \\nTimeframe: After Putin and Philippine’s president Duterte met in Russia in May 2017 and forged a partnership in information dissemination. Duterte and Putin signed a number of national security agreements, including a deal on intelligence sharing, an “MOU on Cooperation in Mass Communications.”\\n \\nDate: 2017- ongoing\\n\\nPresumed goals:\\n\\n* To spread pro-Duterte and Russian propaganda through collaborative effort of both Philippine and Russian disinformation actors.\\n\\nMethod:\\n \\n* Footprint of Garrie on the Philippine media scene started from his connection with Russian IRA websites and pages (GI Analytics Facebook page, Russia Insider, The Duran, Geopolitica.ru, Mint Press News, Oriental Review, globalresearch.ca.)\\n \\n* RT, one of media outlets that interviewed Garrie, was identified by the US Office of the Director of National Intelligence in January 2017 as the primary source of propaganda that the Russians used to further their interests in the 2016 US elections.\\n \\n* Also has appearance on Iran’s IRIB (Islamic Republic of Iran Broadcasting), which was identified by the US Department of the Treasury in 2013 as a network that broadcasts false reports and forced confessions of political detainees and has ties with “politically motivated phishing” accounts on Google.\\n \\n* The Daily Sentry, a Philippine news site emerged at the start of 2018 (no ownership information), started citing Adam Garrie as a global expert after Philippine-Russian ties grew stronger. Between Feb 2018 and Jan 2019, The Daily Sentry cited Garrie in 41% of posts on Facebook that mentioned experts.\\n \\n* By March 2018, Garrie started to come to the mainstream: The Manila Times – a supporter outlet of the Philippine president, cited by pro-Duterte social media pages.\\n \\n* Philippine online groups and pages began to spread Russian propaganda. Some sites link to Duterte officials and supporters including Duterte’s former assistant secretary. For example, Duterte’s former assistant secretary shared content from Trending News Portal site.\\n \\nCounters:\\n\\n* Facebook took down 220 pages and 73 Philippine accounts for spam, including pages of The Daily Sentry and its affiliates, TNP page and related pages.\\n \\nRelated incidents:\\n\\nReferences:\\n\\n* http://www.interaksyon.com/breaking-news/2017/05/30/75431/ph-russia-communication-offices-to-partner-in-info-dissemination/\\n* https://www.rappler.com/nation/188378-ph-russia-sign-bilateral-agreements\\n* https://www.dni.gov/files/documents/ICA_2017_01.pdf\\n* \\n* https://codastory.com/disinformation/how-a-little-known-pro-kremlin-analyst-became-a-philippine-expert-overnight/\\n* https://www.rappler.com/technology/social-media/220741-facebook-remove-trending-news-portal-twinmark-media-enterprises\\n* https://www.rappler.com/thought-leaders/221422-facebook-maria-ressa-rappler-philippines\\n* https://www.rappler.com/nation/194814-maria-ressa-pcoo-training-china-russia\\n* http://www.interaksyon.com/breaking-news/2017/05/30/75431/ph-russia-communication-offices-to-partner-in-info-dissemination/\\n\\n'],\n", + " ['incident',\n", + " 'I00019',\n", + " '\\n\\nActor: \\n\\n* individual accounts on 4chan (IP addresses indicate locations of Sweden, US, France), \\n* accounts on Twitter (both identifiable and anonymous).\\n\\nTimeframe: a few days\\n\\nDate: few hours after Macron and Le Pen were declared winners of the first round of France’s presidential election (April 23, 2017).\\n\\nPresumed goals: creating and spreading hoaxes and misinformation related to Macron’s personal life, marriage, sexuality, position on terrorism, etc. to spur support for Le Pen in the second round of voting.\\n\\nMethod: posts and memes started on 4chan and later shared in Twitter\\n\\nCounters: no actions noted.\\n\\nRelated incidents:\\n\\n* #MacronGate and #MacronCacheCash: fake documents on 4chan about Macron’s alleged offshore account.\\n\\nReferences:\\n* https://www.buzzfeednews.com/article/ryanhatesthis/heres-how-far-right-trolls-are-spreading-hoaxes-about\\n* https://www.niemanlab.org/2018/09/how-france-beat-back-information-manipulation-and-how-other-democracies-might-do-the-same/\\n'],\n", + " ['incident',\n", + " 'I00004',\n", + " '\\n\\nActor: IRA\\n\\nTimeframe: 1 day (plus preparation)\\n\\nDate: May 2017\\n\\nPresumed goals: reduce Emmanuel Macron’s chance of winning French presidential election\\n\\nMethod:\\n\\n* fake documents posted on 4chan about Macron’s alleged offshore account, \\n* amplified by pro-Trump Twitter accounts using #MacronGate and #MacronCacheCash\\n\\nCounters: \\n\\n* preparation (resilience, account removals), \\n* honeytraps, \\n* counter-response with humour.\\n\\nRelated incidents:\\n\\n* DNC document release, US presidential elections, 2016\\n\\n\\nReferences:\\n\\n* Source: https://www.patreon.com/posts/macrongate-tied-11940855 \\n* http://www.niemanlab.org/2018/09/how-france-beat-back-information-manipulation-and-how-other-democracies-might-do-the-same/\\n* https://www.theguardian.com/world/2017/may/08/macron-hackers-linked-to-russian-affiliated-group-behind-us-attack \\n'],\n", + " ['incident',\n", + " 'I00045',\n", + " '\\n\\nActor: Russia\\n\\nTimeframe: March 4, 2018 - ongoing\\n\\nDate: March 4, 2018\\n\\nPresumed goals: \\n\\n* Russian officials have sought to exploit holes in the complicated narrative of the poisoning to suggest an anti-Russian conspiracy. Mark Galeotti, an expert on the Russian intelligence services, wrote in an op-ed in The Moscow Times… “The Kremlin is enjoying the reputation of being a swashbuckling maverick, ruthless, dangerous and decisive,” he wrote. “This has a certain value, not least in deterring the fainthearted.”\\n* Reuters: Commentary: For Putin’s Russia, a poisoned spy sends a political message “the poisoning as a sign of just how committed Vladimir Putin’s Kremlin has become to eradicating its enemies – and reminding others it can do so.”\\n\\nMethod: \\n\\n* Multi-source/channel/media response \\n* highlighting conspiracies: It was a British “false flag” operation; It could be the CIA; Because of Donald Trump; There’s always Ukraine\\n* The conspiracy theories did not stop here. Multiple special-interest groups have attempted to lay the blame for the Skripals’ poisoning at the door of their chosen enemies. A UKIP branch in High Wycombe, in the English Home Counties, tweeted to accuse “a third party such as the EU” of “trying to interfere in UK Russian relations.” Sputnik even misquoted former Kremlin advisor Alexander Nekrassov as accusing “rouge agents” [sic] of carrying out the attack, “for some sort agenda [sic] such as slander or tarnish Russia [sic] or cause friction between Britain and Russia.” Matteo Salvini, Italian politician and member of the Italian senate, shared an article on his Facebook page, titled “The Skripal Case is a hoax, the war of the West against Russia is terribly true”. His post was liked 3,800 times and generated over 800 shares.\\n* Here are 20 different narratives offered by Russian media and officials for the poisoning: The United Kingdom did it to fuel anti-Russian sentiment (source: Russia 1 TV channel); Ukraine did it to frame Russia (Russia 1); The United States did it to destabilize the world (Russia 1); Theresa May helped orchestrate the attack because she is a friend of CIA director Gina Haspel (Zvezda); It was an attempted suicide (Russia 1)\\nIt was an accidental overdose (RIA Novosti); It was due to accidental exposure from Britain’s Porton Down research facility (Russia 24 TV channel); The Porton Down lab carried out illicit human testing and is lying about not producing Novichok (RT); Skripal’s future mother-in-law did it (Moskovsky Komsomolets: mk.ru)\\nTerrorists did it (Russian ministry of foreign affairs spokesperson); American-British financier Bill Browder — blacklisted in Russia for denouncing corruption — did it (Russia 1); A drone did it (Zvezda and Russian defense ministry); Skripal was a chemical weapons smuggler (Pravda); The West is using the case to deflect attention from Russia’s successes in Syria (Russian ministry of foreign affairs spokesperson); Britain is using the case to deflect attention from Brexit (Russian Foreign Minister Sergei Lavrov, Russian UN ambassador, Russian OSCE ambassador); The attack was an attempt by a rival faction to undermine Vladimir Putin (state TV); Russia has destroyed all its stockpiles of Novichok (Sputnik); Russia never developed Novichok (Interfax); Only the Czech Republic, Slovakia, and Sweden have Novichok (Russian ministry of foreign affairs spokesperson). All three countries have denied the claim.; There is no evidence that the nerve agent used against the Skripals was Novichok, Porton Down lab is struggling to identify the substance (RT)\\n\\nCounters: \\n\\n* Bellingcat; \\n* DFRLab; \\n\\nRelated incidents: \\n\\n* ties to ongoing campaigns/narrative - Ukraine; NATO; EU; Brexit\\n\\nReferences:\\n\\n* https://www.themoscowtimes.com/2019/03/03/a-year-after-the-skripal-poisoning-how-much-has-really-changed-a64677\\n* https://www.reuters.com/article/us-apps-poisoning-commentary/commentary-for-putins-russia-a-poisoned-spy-sends-a-political-message-idUSKCN1GK309\\n* https://twitter.com/UKIPHighWycombe/status/971773863230164992\\n* https://sputniknews.com/analysis/201803141062498438-uk-novichok-nerve-agent-skripal/\\n* https://www.facebook.com/salviniofficial/posts/10155663618083155\\n* http://www.linkiesta.it/it/article/2018/03/28/il-caso-skripal-e-una-bufala-la-guerra-delloccidente-alla-russia-e-ter/37595/\\n* https://www.rt.com/news/452946-skripal-anniversary-truth-novichok/\\n* https://disinfoportal.org/sputnik-abkhazias-disinformation-about-porton-down-allegedly-denying-russian-trace-in-skripal-poisoning/\\n* https://www.nytimes.com/2019/03/04/world/europe/russia-skripal-poisoning-britain.html\\n\\n\\n* https://www.bellingcat.com/tag/skripal/\\n* https://medium.com/dfrlab/skripal-poisoning-if-not-russia-then-1d49f086e3e0\\n* https://medium.com/dfrlab/uk-poisoning-russia-recycles-responses-77e1d357b777\\n* https://medium.com/dfrlab/putinatwar-social-media-surge-on-skripal-b5132db6f439\\n* https://euvsdisinfo.eu/conspiracy-mania-marks-one-year-anniversary-of-the-skripal-poisoning/\\n* https://www.nytimes.com/2019/03/04/world/europe/russia-skripal-poisoning-britain.html\\n* https://www.reuters.com/article/us-britain-russia-skripal/third-suspect-in-skripal-poisoning-is-russian-gru-agent-bellingcat-idUSKCN1Q32BZ\\n* http://euromaidanpress.com/2018/04/11/five-ways-russia-is-generating-a-conspiracy-smokescreen-around-the-skripal-poisoning/\\n* http://euromaidanpress.com/2018/03/30/russian-media-have-published-20-different-narratives-on-skripal-poisoning/\\n* https://en.wikipedia.org/wiki/Poisoning_of_Sergei_and_Yulia_Skripal\\n\\nVisual assets (Google Drive)\\n\\nDatasets: \\n\\nNotes: \\n\\nOn 6 March 2018 Andrey Lugovoy, deputy of Russia\\'s State Duma (the Liberal Democratic Party of Russia) and alleged killer of Alexander Litvinenko, in his interview with the Echo of Moscow said: \"Something constantly happens to Russian citizens who either run away from Russian justice, or for some reason choose for themselves a way of life they call a change of their Motherland. So the more Britain accepts on its territory every good-for-nothing, every scum from all over the world, the more problems they will have.\"\\nRussian Foreign Minister Sergey Lavrov on 9 March rejected Britain\\'s claim of Russia\\'s involvement in Skripal\\'s poisoning and accused the United Kingdom of spreading \"propaganda\". Lavrov said that Russia was \"ready to cooperate\" and demanded access to the samples of the nerve-agent which was used to poison Skripal. The request was rejected by the British government.\\n\\nOngoing… one year later\\nhttps://disinfoportal.org/sputnik-abkhazias-disinformation-about-porton-down-allegedly-denying-russian-trace-in-skripal-poisoning/\\nOn February 7, 2019, Sputnik-Abkhazia released an article headlined “Scotland Yard about the third suspect in the Skripal case: the investigation continues.” According to Sputnik-Abkhazia, the Russian Foreign Ministry caught British Prime Minister Theresa May in a lie, because the Porton Down Laboratory denied that a nerve agent that poisoned Russian ex-spy, Sergei Skripal and his daughter, Yulia had been produced in Russia\\n\\nhttps://www.nytimes.com/2019/03/04/world/europe/russia-skripal-poisoning-britain.html\\nRather than ignoring the anniversary, however, Russia punctuated the occasion on Monday with an hourlong news conference at the United Nations and a 52-page report rehashing the episode in detail, amplified by extensive coverage on its English-language government channel, RT.\\n \\nRussian officials also have tried to turn the tables, accusing Britain of violating international law by refusing to provide Russian consular officials access to the Skripals, who survived and whose whereabouts has not been made public. \\n\\n\\n'],\n", + " ['incident',\n", + " 'I00051',\n", + " '\\n\\nActor: Russia\\n\\nTimeframe: December 2018 - (ongoing)\\n\\nDate: December 10, 2018\\n\\nPresumed goals: \\n\\n* Russian disinformation intended to confuse audiences and discredit an organisation (Integrity Inititative)which is working independently to tackle the threat of disinformation. Russia’s state-owned media outlets have seized on the posted materials, with the government’s RT and Sputnik news sites writing dozens of stories claiming that the materials prove that the British government, rather than Russia, is trying to poison internet discourse with propaganda.\\n \\nMethod: \\n\\n* Hack (email), leak, amplify, smear MSM\\n\\nCounters: none identified\\n\\nRelated incidents: \\n\\n* The campaign also threads other organization into the “conspiracy” such as Britsh Military, NATO and the CIA.\\n* With it, efforts to further discredit MH17 for instance; tie-in Soro’s (dog-whistle for the far-right); \\n* yet at the same defend the far-left alleging Integrity Initiative was running a smear campaign again UK Labour/Jeremy Corbyn\\n\\nReferences: \\n* https://eaworldview.com/2019/01/counter-russia-disinformation-integrity-initiative/\\n* https://www.stopfake.org/en/kremlin-watch-briefing-the-eu-has-to-start-taking-pro-kremlin-disinformation-seriously/\\n* https://www.buzzfeednews.com/article/kevincollier/russian-hackers-british-institute\\n* https://www.bbc.com/news/uk-46509956\\n* https://www.thetimes.co.uk/article/anti-propaganda-website-forced-offline-by-hacking-b0ds2bkbp\\n* https://eaworldview.com/2019/01/counter-russia-disinformation-integrity-initiative/\\n* https://news.sky.com/story/highly-likely-moscow-hacked-uk-agency-countering-russian-disinformation-11656539\\n* http://euromaidanpress.com/2019/01/17/russian-attack-on-the-integrity-initiative-what-makes-the-mafia-different-from-the-police/\\n\\nDatasets: \\n\\nNotes: \\n\\nRT and Sputnik claim that the Integrity Initiative hack was the work of freelancers aligned with the online Anonymous collective and who were not affiliated with the Russian government. The primary evidence for that, according to RT and Sputnik, is that the stolen Integrity Initiative material was posted to the website of a hacktivist collective called CyberGuerrilla, alongside manifestos claiming “We are Anonymous” and posts saying “We have warned the UK government that it must conduct an honest and transparent investigation into the activity of the Integrity Initiative and the Institute for Statecraft.”\\n\\nThe Integrity Initiative has pulled down its website, replacing it with a reiteration of its mission, a description of the hack, and a call for tips.\\n“This international public programme was set up in 2015 to counter disinformation and other forms of malign influence being conducted by states and sub-state actors seeking to interfere in democratic processes and to undermine public confidence in national political institutions,” a spokesperson said in a statement.\\n\\n \\n\\n'],\n", + " ['incident',\n", + " 'I00034',\n", + " \"\\n\\nActor: China\\n\\nTimeframe: 72 hours?\\n\\nDate: January 20th, 2016\\n\\nPresumed goals: \\n\\n* The trolls planned their attack for 7pm, China time, on January 20. Members of Di Ba—one of the largest message boards on the internet—would organize into groups, leap over the Great Firewall to reach Facebook, and flood it with the message that Taiwan is part of China. The anti-independence and pro-China posts started to take over the Facebook page of Tsai Ing-wen, Taiwan’s newly elected president\\n\\nMethod: \\n\\n* Tsai’s latest Facebook post, about a meeting she had with leaders from her Democratic Progressive Party (DPP), attracted nearly 40,000 Facebook comments in just eight hours.\\n* News of the attack spread far and wide, with a number of posts making their way around social network WeChat. * For most of the day “Di Ba’s Facebook battle” has been at the top of the list of searched terms on Weibo, a Chinese microblog site similar to Twitter. News outlets in Taiwan covered the story (link in Chinese).\\n* Information also spread suggesting that Di Ba’s battle was organized and well-prepared. Screenshots showed that attackers were separated into six “columns,” in the military sense: information gathering; posting; writing opinions and creating images; translation; miscellaneous Facebook tasks such as liking posts; and a vanguard to head things up.\\n* The majority of the 26K comments consisted of lines copied and pasted from the officially designated messages\\n* more than 42,000 people had made comments on a single post of Ms Tsai's Facebook page, demanding her self-ruled island be brought under Chinese control.\\n* Beginning at 7 pm on January 20, 2016 CST (China Standard Time), tens of thousands of\\ncomments against Taiwan independence appeared in posts of Taiwan President-elect Ms. Tsai Ing-Wen’s Facebook page as well as news media’s such as Sanli News and Apple Daily. While the organizers claim to taking further steps on issues against Taiwan independence, the event lasted for less than two days due to Chinese government’s intervention, leaving tens of thousands of comments either deleted or unattended.\\n* Within this most active group, every username posted 6 comments at least and 12 comments\\non average. The most productive one posted 192 comments during this period. Two interesting\\nfindings come from the discrepant mapping result of Facebook usernames and IDs, which imply\\nparticipants’ strategy. First, users might share account. We found five IDs, each of which is\\nassociated with different usernames. According to one internal document downloaded from the\\nQQ group, some participants would register Facebook accounts in advance, and then give them to those responsible for attack. Since Facebook allows users to change their usernames anytime, we speculate whether this may be due to the sharing of accounts but changing the name to differentiate the identity.\\n* Second, users shared some usernames to maintain the consistency of their identities. The total\\nnumber of IDs is more than the number of unique usernames. Many usernames are shared by\\ndifferent IDs, which account for 2.82% of all 16,891 IDs. One possible reason for this practice is\\nthat during the attack, reporting and blocking accounts is a prevalent tactic used by both sides as defense. Once the account is “dead”, the user has to register for a new account to keep fighting. One commenter said that he/she was blocked over 3 times, but kept registering new accounts to fight. It is thus not surprising to see a small percentage of users who have more than one ID while maintaining the same username.\\n* More notable is the case where one username is shared by more than 10 IDs. One possible\\nexplanation is that someone dedicates himself/herself to this event and intends to increase their\\nvisibility. However, for those usernames associated with over 30 IDs, we argue that it might be a\\nunique strategy for attacking or trolling, because it is difficult to log into multiple accounts and\\npost comments by a single user.\\n\\nCounters: \\n\\nRelated incidents: \\n\\nReferences:\\n\\n* https://www.ideals.illinois.edu/handle/2142/96746\\n* https://qz.com/598812/an-army-of-chinese-trolls-has-jumped-the-great-firewall-to-attack-taiwanese-independence-on-facebook/\\n* https://www.abc.net.au/news/2016-01-21/chinese-facebook-users-flooding-taiwan-president-elect-account/7105228\\n* https://www.businessinsider.com/chinese-people-are-flooding-the-internet-with-a-campaign-against-taiwan-2016-1\\n\\n\\n\\n\"],\n", + " ['incident',\n", + " 'I00010',\n", + " '\\n\\nActors: IRA, Alex Jones, far right and far left trolls\\n\\nTimeframe: Ongoing\\n\\nDate: February 2018\\n\\nPresumed goals: Divide the American public on the issues of guns, race, generational politics and activism\\n\\nMethod: Amplification via sockpuppet and cyborg accounts\\n\\nCounters: None / Media exposure\\n\\nRelated incidents: \\n\\n* Sandy Hook hoaxers / Sandy Hook fatalists\\n\\nReferences\\n\\n* [How Russian trolls exploited Parkland mass shooting on social media](https://www.politifact.com/truth-o-meter/article/2018/feb/22/how-russian-trolls-exploited-parkland-mass-shootin/)\\n* [PRO-GUN RUSSIAN BOTS FLOOD TWITTER AFTER PARKLAND SHOOTING](https://www.wired.com/story/pro-gun-russian-bots-flood-twitter-after-parkland-shooting/)\\n* [Russian trolls flood Twitter after Parkland shooting](https://www.nbcnews.com/tech/social-media/russian-trolls-flood-twitter-after-parkland-shooting-n848471)\\n* [Russian Trolls Are Tweeting Propaganda After Stoneman Shooting](http://nymag.com/intelligencer/2018/02/russian-trolls-tweet-propaganda-after-florida-shooting.html)\\n\\nDetails\\n\\nFollowing the Feb. 14 shooting at Marjory Stoneman Douglas High School that left 17 dead, an army of human-controlled and automated accounts spread related content across Twitter. \\n\\nHamilton 68, a website created by Alliance for Securing Democracy, tracks Twitter activity from accounts it has identified as linked to Russian influence campaigns. As of morning, shooting-related terms dominated the site’s trending hashtags and topics, including Parkland, guncontrolnow, Florida, guncontrol, and Nikolas Cruz, the name of the alleged shooter. Popular trending topics among the bot network include shooter, NRA, shooting, Nikolas, Florida, and teacher.\\n\\nAccording to the German Marshall Fund, which tracks Russian-linked Twitter activity, the following are some of the more popular narratives, themes and articles.\\nThe \\'crisis actor\\' conspiracy\\n\\'False flag\\' and other conspiracy hashtags\\nMeanwhile, some accounts with large bot followings are already spreading misinformation about the shooter\\'s ties to far-left group Antifa, even though the Associated Press reported that he was a member of a local white nationalist group.\\nOne theory associated with these hashtags is that Marjory Stoneman Douglas High School was targeted because the school’s namesake was opposed to \"draining the swamp\" of the Florida Everglades. Under this theory, the Parkland shooting was a cryptic message to Trump, who vowed during his campaign to \"drain the swamp\" in Washington by hollowing out its infrastructure of career politicians, insiders and influence peddlers.\\nSowing discord\\nExperts say the goal of Russian troll propagandists isn\\'t to sway people\\'s opinions in one way or another. Instead, the accounts seek to exploit divisions in order to break down society into smaller, warring groups. Trolls drum up persona accounts on every side of the ideological spectrum and take advantage of high-impact events to spread confusion and disarray. In particular, they\\'re able to take advantage of how Twitter doesn\\'t require users to verify their identity.\\nRussian accounts boosted erroneous content concerning the motives of the alleged shooter Nikolas Cruz.\\nAccording to the German Marshall Fund, one of the top links shared by Russia-linked accounts in the aftermath of the shooting was our 2014 article that largely debunked a statistic cited by pro-gun control group Everytown for Gun Safety.\\nA survey of tweets using the top hashtags flagged by the Hamilton 68 dashboard showed tweets adamantly in favor of gun control and saying the NRA had taken \"blood money.\" Other tweets attacked liberals, the media and lawmakers.\\nAnother top link shared by the network covers the “deranged” Instagram account of the shooter, showing images of him holding guns and knives, wearing army hats, and a screenshot of a Google search of the phrase “Allahu Akbar.” Characterizing shooters as deranged lone wolves with potential terrorist connections is a popular strategy of pro-gun groups because of the implication that new gun laws could not have prevented their actions.\\nThe use of pro-gun control hashtags like #guncontrolnow, along with the spread of anti-gun control links like the Politifact article, appear at first to show the Russian strategy of promoting discord on both sides of a debate.\\nIn other cases, the bots jump on existing hashtags to take control of the conversation and amplify a message. That’s likely what is happening with the Parkland shooting and the hashtag guncontrolnow.\\nPublic awareness that antagonistic bots flood the Twitter debate hasn’t stopped them from achieving their goals of ratcheting up the vitriol—even amid a live tragedy like the Parkland shooting. The goal, after all, isn\\'t to help one side or the other of the gun control debate win. It\\'s to amplify the loudest voices in that fight, deepening the divisions between us.\\n\\nExamples\\n\\n'],\n", + " ['incident',\n", + " 'I00050',\n", + " '\\n\\nActor: Russia, Cuba, China, Iran\\n\\nTimeframe: January 23, 2019\\n\\nDate: January 29, 2019 - ongoing\\n\\nPresumed goals: \\n\\n* Given the history (going back to the Monroe Doctrine) the US is easily characterized with “imperialist” aspirations. Of course there’s the connected issue of oil and Venezuela’s indebtedness to Russia and China. The relationship between Cuba and Venezuela can not be underscored going back to Castro & Chavez’s relationship.\\n\\n* Search (google) #handsofvenezuela the results are largely linking to articles denouncing the US and those countries opposed to the Maduro regime. “There\\'s been a lot of misinformation in the international media about whether what is happening in Venezuela is a brazen US-led power grab or a constitutional …” Jan 13, 2019 - An attempt at an imperialist coup d\\'état is underway in Venezuela. It must ... Most likely this is another attempt by Washington to spread misinformation and ... socialist and anti-imperialist, is to reject this scandalous imperialist …\\n\\n* Activists to Trump: \\'Hands Off Venezuela\\' - Truthdig\\nhttps://www.truthdig.com/articles/activists-to-trump-hands-off-venezuela/\\nMar 17, 2019 - medeabenjamin “We are absolutely opposed to economic sanctions in Venezuela” at the #HandsOffVenezuela rally. pic.twitter.com/ ... Packed London meeting says: “US-UK, hands off Venezuela!\"\\nhttps://www.marxist.com/packed-london-meeting-says-us-uk-hands-off-venezuela.htm\\nJan 31, 2019 - Nearly 100 people packed the #HandsOffVenezuela meeting in London on 30 January, and heard Venezuelan ambassador Rocío Manero, ...\\n\\nMethod: \\n\\n* From efforts via blogs, “news” sites and media supporting the left/socialism/stateism positioning anti-Maduro efforts as “imperialisitic” it’s noteworthy to documented the efforts in February to deliver aid to the country. For instance this case study - analysis demonstrates that the depiction of Russia’s role as “peacekeeper” and “defender” has had a big impact on the networks. We filtered all mentions to include only those containing the words “Russia”, “Moscow” or “Putin” in reference to Venezuela. This resulted in a total number of 60,315 tweets for the period. A few peaks can be noticed at times when Russian sources, mainly RT and Sputnik, forward Venezuela-related news.\\nA: Russia expresses an adamant position that Maduro is the legitimate president of Venezuela\\nB: Russia will defend the Venezuelan Constitution\\nC: The US is massing troops at the Venezuelan border\\nE: Russia is sending humanitarian aid to Venezuela\\n* The Trojan Horse. The most striking success of the Russian disinformation campaign is the impact of the Trojan Horse Narrative. The first case of describing US and EU humanitarian aid to Venezuela as a Trojan horse, in Spanish Caballo de Troya, appeared in Spanish language networks on 24 January:\\nFrom February 23, 2019 - Billionaire businessman Richard Branson says he hopes his Live Aid-inspired concert to raise funds for Venezuelans will persuade members of the country\\'s military to defy President Nicolas Maduro and allow humanitarian aid to cross the border.\\nBranson, who will host \"Venezuela Aid Live\" on Friday in the Colombian border town of Cucuta, said he is aiming to raise about $100 million to buy food and medicine, essential supplies for the country, which is gripped by a political and humanitarian crisis.\\nIn reaction to - Maduro’s government announced that it would accept contributions from China and Cuba, but called Guaidó-organized aid, which includes contributions from the United States, a “handout.” In an interview with the Associated Press this week, Maduro blamed U.S. sanctions for Venezuela’s economic woes, saying “the infected hand of Donald Trump is hurting Venezuela.”\\n* Like the White Helmets (Musician) Roger Waters (willing idiot) weighs in - In a two-minute video posted on Twitter, the musician says Mr Branson\\'s \"Live-Aid-ish\" concert has \"nothing to do with humanitarian aid at all\". \"It has to do with Richard Branson, and I\\'m not surprised by this, having bought the US saying: \\'We have decided to take over Venezuela, for whatever our reasons may be,\\'\" Mr Waters says. \"But it has nothing to do with the needs of the Venezuelan people, it has nothing to do with democracy, it has nothing to do with freedom, and it has nothing to do with aid.\" He adds that he has \"friends that are in Caracas\" who claim there is \"no civil war, no mayhem, no murder, no apparent dictatorship, no suppression of the press\"\\nMaduro government holds their own concert to counter Branson’s efforts\\nhttps://www.cnbc.com/2019/02/19/richard-branson-maduro-concert-on-venezuela-border.html\\nhttps://www.theguardian.com/world/2019/feb/19/maduro-government-richard-branson-rival-venezuela-concerts\\nJust 300 metres away, the first of some 150 artists began performing at Maduro\\'s Hands off Venezuela festival. \\nhttps://www.aljazeera.com/news/2019/02/rival-concerts-backdrop-venezuela-power-struggle-190222142807321.html\\n\\n* The Russian official line - (talking points for trolls & willing/unwitting idiots)\\nOn Tuesday, Russian Foreign Minister Sergey Lavrov criticized the U.S. sanctions, which meant that proceeds from the sale of Venezuelan oil would be withheld from Maduro’s government.\\nIn a press conference, Lavrov dubbed the U.S. sanctions “illegitimate” and “cynical,” adding that Russia “along with other responsible members of the global community will do everything to support the legal government of the president,” RIA Novosti reported.\\nThere is concern in Moscow about the level of debt Caracas owes Russia. Russian Deputy Finance Minister Sergei Storchak said the sanctions may mean Venezuela will have problems servicing sovereign debt to Russia.\\nVenezuela has two months to pay Russian $100 million and there is uncertainty as to whether PDVSA can service its debt to Russia’s state energy giant Rosneft, Radio Free Europe reported\\nThe evolution/spread of talking points \\nBut while the Canadian government, which accused Maduro of seizing power through fraudulent elections, has expressed full support for Guaido, some Canadian protesters are calling it out for what they say is an attack on Venezuela’s sovereignty.\\n“What is brewing, what is being organized is an actual military intervention of Venezuela,” said Margaret Villamizar, who attended a protest in Windsor, Ont. “If it doesn’t turn out to be full-scale military, what’s being called diplomacy is really an attack on Venezuela’s sovereignty.”\\n \\n* Also - In an interview with Foreign Policy, Adm. Craig Faller, the four-star military officer who heads U.S. Southern Command, pointed to a Chinese disinformation campaign designed to blame the United States for the blackouts that devastated Venezuela in recent weeks. https://foreignpolicy.com/2019/04/08/us-military-wary-of-chinas-foothold-in-venezuela-maduro-faller-guaido-trump-pentagon/\\nA Chinese plane loaded with 65 tons of medical supplies landed in Venezuela\\'s capital of Caracas on Friday amid a power struggle between President Nicolas Maduro and opposition leader Juan Guaido.\\nMaduro welcomed the arrival of the humanitarian aid on Twitter, saying \"Venezuela is breaking the imperialist siege and advancing with a victory.\"\\nHe shared photos showing the arrival of the aid as well as a photo of him taken with his Chinese counterpart Xi Jinping during his visit to China last year.\\nChina\\'s move came after Russia sent humanitarian aid to Caracas last week.\\nVenezuela has been rocked by protests since Jan. 10, when Maduro was sworn in for a second term following a vote boycotted by the opposition.\\nhttps://www.aa.com.tr/en/americas/venezuela-welcomes-arrival-of-chinese-medical-aid/1435166\\n \\nCounters: \\n\\n* Every report suggesting that Venezuela is mired in a humanitarian crisis.\\nApril 10, 2019 The UN reports “There is a very real humanitarian problem in Venezuela,” said Mark Lowcock, the UN humanitarian chief. “We estimate that 7 million people in Venezuela need humanitarian assistance. That is some 25 per cent of the population,”\\nApril 10, 2019 NY Times ‘You Shouldn’t Be Here’: U.S. Pushes U.N. to Pull Venezuela Envoy’s Credentials\\nGo back to October 2018 Washington Post: A humanitarian crisis in Venezuela? Nothing to see here, government says. Human Rights Watch Report\\n\\nRelated incidents: \\n\\n* Speculation but research worthy… right/left regional binary pitting new right wing governments in Brazil & Columbia and hosility/percieved hosility to regimes like Venezuela & Ecuador\\n\\nReferences: \\n\\n* https://www.truthdig.com/articles/activists-to-trump-hands-off-venezuela/\\n* https://www.marxist.com/packed-london-meeting-says-us-uk-hands-off-venezuela.htm\\n* https://euvsdisinfo.eu/twitter-as-an-information-battlefield-venezuela-a-case-study/\\n* https://www.washingtonpost.com/world/the_americas/in-venezuela-humanitarian-aid-has-become-a-political-weapon/2019/02/14/5eab781a-3089-11e9-8781-763619f12cb4_story.html\\n* https://www.apnews.com/21b641f6def1400894125e3a8117f66c\\n* https://www.cnbc.com/2019/02/19/richard-branson-maduro-concert-on-venezuela-border.html\\n* https://www.theguardian.com/world/2019/feb/19/maduro-government-richard-branson-rival-venezuela-concerts\\n* https://www.aljazeera.com/news/2019/02/rival-concerts-backdrop-venezuela-power-struggle-190222142807321.html\\n* https://foreignpolicy.com/2019/04/08/us-military-wary-of-chinas-foothold-in-venezuela-maduro-faller-guaido-trump-pentagon/\\n* https://www.aa.com.tr/en/americas/venezuela-welcomes-arrival-of-chinese-medical-aid/1435166\\n* https://news.un.org/en/story/2019/04/1036441\\n* https://www.nytimes.com/2019/04/10/world/americas/pence-venezuela-un-envoy.html\\n* https://www.washingtonpost.com/world/the_americas/a-humanitarian-crisis-in-venezuela-nothing-to-see-here-government-says/2018/10/12/6ebd1aa6-c2ac-11e8-9451-e878f96be19b_story.html\\n* https://www.hrw.org/world-report/2019/country-chapters/venezuela\\n* https://euvsdisinfo.eu/twitter-as-an-information-battlefield-venezuela-a-case-study/\\n* https://www.npr.org/2019/03/25/706635580/venezuelas-maduro-faces-pressure-from-much-of-the-world-yet-he-persists\\n* https://cronkitenews.azpbs.org/2019/02/26/venezuela-protests-in-tucson/\\n* https://www.newsweek.com/donald-trump-told-hands-venezuela-countrys-president-who-has-full-backing-1309188\\n* https://www.dw.com/cda/en/venezuela-juan-guaido-urges-army-to-let-aid-through/a-47651164\\n* https://www.npr.org/2019/04/02/709306132/maduro-allies-move-against-rival-juan-guaid-in-venezuela\\n* https://www.washingtonpost.com/world/2019/04/02/trump-has-russia-problem-venezuela/?utm_term=.9233de48de14\\n* https://www.atlanticcouncil.org/blogs/new-atlanticist/russia-s-venezuela-challenge\\n* https://www.theglobeandmail.com/world/article-venezuelas-maduro-seeks-to-restore-power-stem-looting-as-china/\\n* https://www.npr.org/tags/587365601/venezuela-crisis\\n* https://www.washingtonpost.com/world/2019/02/16/richard-bransons-goal-million-venezuela-could-face-an-obstacle-maduro/?utm_term=.8a5ad46a730a\\n* https://www.bbc.com/news/world-latin-america-47271182\\n\\nNotes:\\n\\n\\n \\n\\n'],\n", + " ['incident',\n", + " 'I00001',\n", + " '\\n\\nActor: \\n\\nTimeframe: \\n\\nDate: \\n\\nPresumed goals: “Russian-linked social media accounts saw racial tensions as something to be exploited in order to achieve the broader Russian goal of dividing Americans and creating chaos in U.S. politics during a campaign in which race repeatedly became an issue.”\\n\\nMethod: \\nPossibly linked: black lives matter facebook ads, targetted at Baltimore, Ferguson, Missouri https://money.cnn.com/2017/09/27/media/facebook-black-lives-matter-targeting/index.html?iid=EL \\n\\nCounters:\\n\\nRelated incidents:\\n\\n* Txrebels facebook group\\n* MuslimAmerica facebook group\\n* Patriotus facebook group\\n* SecuredBorders facebook group\\n* Lgbtun facebook group\\n* Black Matters facebook group\\n\\nReferences:\\n* https://money.cnn.com/2017/09/28/media/blacktivist-russia-facebook-twitter/index.html\\n* https://news.docnow.io/blacktivists-in-the-archive-71c807aa247e\\n* https://www.thedailybeast.com/exclusive-secret-documents-from-russias-election-trolls-leak\\n\\n\\n\\nDatasets\\n\\n* https://docs.google.com/spreadsheets/d/1OZcRCZuz83bMpxVjpUYEALiS4OtKU-pTVtTveG_Ljs0/edit#gid=0 - from https://news.docnow.io/blacktivists-in-the-archive-71c807aa247e are the @blacktivists tweets that used the #blacklivesmatter hashtag\\n* Jonathan Albright got the facebook text: https://data.world/d1gi/missing-fb-posts-w-share-stats/workspace/file?filename=Blacktivist+Facebook+Page+%28Text%29.pdf https://data.world/d1gi/missing-fb-posts-w-share-stats/workspace/file?filename=Blacktivist+Facebook+Page+%28Text%29-2.docx \\n\\nNotes\\n\\nFirst i read the cnn article, then did a twitter search to see if there are traces of the accounts left online. Only discussion about the IRA operation seem to be on Twitter. Also searched twitter for some of the text found later (in datasets) - nothing matches. \\nReading the docnow.io post showed some interesting behavours. Also that there was no central data repo for the blacktivists posts. Classic was the tweets being sent only in 8am-6pm Moscow time. Also interesting: the followers grew over time, but they grew and dropped friends (people they followed) in batches periodically - was this to avoid hitting limits? \\nReading the dailybeast.com article (on an IRA leak), it seems specific individuals were targetted. Thinking about the places we need to search: if it’s Russia, seems like we need to check twitter, facebook, youtube, reddit, tumblr, instagram, 9gag. \\nNames some of the people contacted, e.g. Craig Carson, a Rochester, New York, attorney and civil rights activist; maybe Shanall LaRay Logan—who lives in Sacramento, California; \\n\\n\\n'],\n", + " ['incident',\n", + " 'I00035',\n", + " '\\n\\nSummary: \\n\\nActor: \\n\\nTimeframe: \\n\\nDate: \\n\\nPresumed goals: \\n\\nMethod:\\n\\n* Bot activity that inflates the visibility of and perceived support for certain candidates and ideologies in 2014 elections.\\n* Campaigns use bots or spread content favorable to their respective candidates in 2014. Neves’ operation used bots on a much larger scale than the Rousseff’s campaign (on FB, Twitter and WhatsApp).\\n\\nCounters:\\n\\n* Facebook removed 200 pages run by individuals connected to the right-wing activist organization Movimento Brasil Livre related to the Brazil elections.\\n\\nRelated incidents: \\n\\nReferences:\\n* https://blogs.oii.ox.ac.uk/politicalbots/wp-content/uploads/sites/89/2017/06/Comprop-Brazil-1.pdf\\n* https://www.wilsoncenter.org/blog-post/bots-brazil-the-activity-social-media-bots-brazilian-elections\\n \\n\\n'],\n", + " ['incident',\n", + " 'I00025',\n", + " '\\n\\nActor: Russia\\n\\nTimeframe: November 6, 2018 - end of November 2018\\n\\nDate: November 6, 2018\\n\\nPresumed goals:\\n\\n* Include - Leave campaigners have claimed that the UK would be forced into an ‘EU army’ under the rules allowing for these activities. https://fullfact.org/europe/hunt-eu-army/\\n* Baltic states are frightened by the single European army. The new European security system will be anti-American. To the leadership of the Baltic states, based on Russophobia, this doesn’t look good.\\n\\nMethod: \\n\\n* “Limited” engagement & channels. In this case Reddit was key forum. \\n* Could not find examples of engagement from “usual suspects” ie: Russian embassy; military or broad mentions via RT & Sputnik\\n\\nCounters: \\n\\nRelated incidents: \\n\\nReferences: \\n\\n* https://www.theguardian.com/politics/2016/may/27/is-there-a-secret-plan-to-create-an-eu-army\\n* https://medium.com/dfrlab/spread-it-on-reddit-3170a463e787\\n* https://www.atlanticcouncil.org/blogs/new-atlanticist/a-european-army-eminently-defensible-but-not-probable-for-a-long-time-to-come\\n* https://www.bbc.com/news/world-europe-46108633\\n* https://www.politico.eu/article/angela-merkel-emmanuel-macron-eu-army-to-complement-nato/\\n* https://euvsdisinfo.eu/report/baltic-states-frightened-by-the-single-european-army/\\n* https://www.theguardian.com/commentisfree/2019/jan/25/brexiters-european-army-myths-franco-german\\n* https://fullfact.org/europe/hunt-eu-army/\\n* https://www.theguardian.com/politics/2016/may/27/is-there-a-secret-plan-to-create-an-eu-army\\n\\n\\nDatasets: \\n\\nNotes:\\nWorth noting the Breitbart commentary (see visual assets); compared to campaigns against NATO for instance, this incident didn’t seemingly have much traction/momentum, and seemed more of a potential wedge for the pro-Brexit audience.\\n\\nVisual Assets\\n\\n'],\n", + " ['incident',\n", + " 'I00060',\n", + " \"\\n\\nActors: \\n\\nTimeframe:\\n\\nDate: \\n\\nPresumed goals: \\n\\nMethod: \\n\\nCounters:\\n\\nRelated incidents: \\n\\nReferences:\\n* (Trump’s White-Nationalist Pipeline)[https://www.theatlantic.com/politics/archive/2018/08/trump-white-nationalism/568393/] \\n* (Parallels between social media misinformation campaigns in the USA and South Africa)[https://www.iafrikan.com/2018/11/20/social-media-usa-south-africa-fake-news-disinformation/]\\n* (The high price of 'white genocide' politics for Australia)[https://www.smh.com.au/world/oceania/the-high-price-of-white-genocide-politics-for-australia-20180724-p4zt9k.html]\\n\"],\n", + " ['incident',\n", + " 'I00005',\n", + " \"\\n\\nActor: Russia/ Internet Research Agency (IRA)\\n\\nTimeframe: December 2015 - ongoing\\n\\nDate: June 23, 2016\\n\\nPresumed goals: Change Brexit vote to ‘leave’; continue to divide/undermine EU; drive Eurosceptic narrative/agenda\\n\\nMethod:\\n* (From The European Values Think-Tank)\\n* Before Brexit, Russia Today and Sputnik released more anti-EU articles than the official Vote Leave website and Leave.EU website. The British version of Sputnik has an annual budget of £ 1.8 million from the Russian government. Kremlin-owned channels potentially influenced 134 million impressions during the Brexit campaign\\n* Method: The data that was used by 89up was derived from the Twitter Search API, Buzzsumo, the Facebook API and other scraping methods. In the timeframe from January 2016 to the day of the British referendum, analysts identified and analysed 261 of the most shared and popular articles that were clearly anti-European. The two main media outlets were RT and Sputnik. Costs: The total value of Kremlin media for the Leave campaign in the six months before the EU referendum was £1,353,000. The PR value for the Leave campaign, based on the 261 heavily pro-Leave articles published by RT and Sputnik, is estimated at nearly £1,500,000based on figures from a leading media monitoring tool. This excludes the significant social media value of these news articles. Estimated value of Russian media Facebook impressions is around $102,000 and the estimated value of Russian media’s potential impressions on Twitter is between $47,000 - $100,000. \\n* Content: The analysis also shows that the overwhelming majority of articles published by RT and Sputnik (131 of the 200 most shared) were clearly for Leave; 59 articles were Neutral and only 10 were set to Remain. When the neutral articles are filtered out, numbers show that the negative articles of RT/Sputnik, together, elicited nearly the same number of engagements as the official Vote Leave website.\\n* Social reach: The report shows the social reach of these anti-EU articles published by the Kremlin-owned channels was 134 million potential impressions, in comparison with a total social reach of just 33 million and 11 million potential impressions for all content shared from the Vote Leave website and Leave.EU website respectively.\\n* (Jane Mayer, staff writer at The New Yorker, via NPR) Role of - Cambridge Analytica, which is a big data company that worked for the Trump campaign in the end - and it was owned principally by one of Trump's largest backers, Robert Mercer - was also involved in helping the early stages of the Brexit campaign in England.\\nAnd the man who spanned both countries and pushed for both, really, was Steve Bannon, it seems there was actually a lot of Russian money offered to Arron Banks, who was one of the major political figures leading the Brexit campaign. The Russian money was offered to him in the form of business opportunities and gold mines and diamond mines by the Russian ambassador to England. So there seems to be financial incentives that were dangled. \\n* There are bots and trolls and posts that are coming from the same Russian Internet agency in St. Petersburg. So in both countries, we see pushing Brexit and pushing Trump at the same time by the same trolls and bots. research conducted by a joint team of experts from the University of California at Berkeley and Swansea University reportedly identified 150,000 Twitter accounts with various Russian ties that disseminated messages about Brexit.\\n* A cache of posts from 2016, seen by WIRED, shows how a coordinated network of Russian-based Twitter accounts spread racial hatred in an attempt to disrupt politics in the UK and Europe.\\nA network of accounts posted pro and anti-Brexit, anti-immigration and racist tweets around the EU referendum vote while also targeting posts in response to terrorist attacks across the continent. \\n* More broadly, a Russian espionage operation funneling money into a political campaign aimed at unwinding European integration would be entirely consistent with the Kremlin’s perceived political interests and tactics of hybrid warfare. Covert financial infiltration is part of a toolkit Moscow uses to interfere in European and American politics. Another tool deployed ahead of the 2016 referendum was pro-Brexit messaging pumped out by RT, Sputnik, and the Internet Research Agency.\\n* From 1 to 8 February 2016, Sputnik ran 14 stories on the “Brexit” issue. Eight of them had negative headlines, either featuring criticism of the deal or focusing on the difficulties Cameron faces; five headlines were broadly factual; one reported a positive comment that the Bank of England had “not yet seen” an impact on investor sentiment, but gave it a negative slant by headlining, “Bank of England on Brexit: No need to panic, yet.” (The word “panic” did not appear in the story.) Not one headline reported reactions supporting the deal. Both Sputnik and RT quoted a disproportionate number of reactions from “Out” campaigners. RT, for example, quoted five “Out” partisans: MP Liam Fox; the founder of Leave.EU; London Mayor Boris Johnson; MEP Nigel Farage, the leader of the UK Independence Party; and UKIP member Paul Nuttall.\\n* anti-immigrant adverts were targeted at Facebook users in the UK and the US. One – headlined “You’re not the only one to despise immigration”, which cost 4,884 roubles (£58) and received 4,055 views – was placed in January 2016. Another, which accused immigrants of stealing jobs, cost 5,514 roubles and received 14,396 impressions\\n* A study of social media during the Brexit campaign by 89Up, a consultancy, found that Russian bots delivered 10m potential Twitter impressions—about a third of the number generated by the Vote Leave campaign’s Twitter account. Such echoing amplifies the effect of RT and Sputnik stories, which are in general not much watched.\\n\\nCounters: FB & Twitter content take-downs\\n\\nRelated incidents: \\n\\n* 2016 US Election… pick ‘em\\n\\nReferences:\\n\\n* https://publications.parliament.uk/pa/cm201719/cmselect/cmcumeds/363/36308.htm#_idTextAnchor033\\n* https://www.foreign.senate.gov/imo/media/doc/FinalRR.pdf\\n* https://www.theguardian.com/world/2017/nov/15/russian-troll-factories-researchers-damn-twitters-refusal-to-share-data\\n* https://www.atlanticcouncil.org/blogs/new-atlanticist/congress-should-explain-how-dark-russian-money-infiltrates-western-democracies\\n* http://sputniknews.com/search/?query=Brexit\\n* http://sputniknews.com/europe/20160202/1034093305/cameron-tusk-brexit-deal.html\\n* http://sputniknews.com/europe/20160203/1034124763/tusk-eu-reform.html\\n* http://sputniknews.com/europe/20160204/1034209396/cameron-eu-brexit-talks.html\\n* http://sputniknews.com/europe/20160205/1034290031/business-investments-brexit-europe.html\\n* https://www.rt.com/uk/331734-cameron-calais-jungle-brexit/\\n* https://www.rt.com/uk/331161-eu-referendum-date-brexit/\\n* https://www.rt.com/uk/330977-tusk-eu-deal-brexit/\\n* https://twitter.com/brexit_sham/status/994982969705189377\\n\\n* https://www.nytimes.com/2017/11/15/world/europe/russia-brexit-twitter-facebook.html \\n* https://www.forbes.com/sites/emmawoollacott/2018/11/01/russian-trolls-used-islamophobia-to-whip-up-support-for-brexit/#11ee8dd465f2\\n* https://www.theguardian.com/world/2018/jan/10/russian-influence-brexit-vote-detailed-us-senate-report\\n* https://www.npr.org/2019/01/19/686830510/senate-finds-russian-bots-bucks-helped-push-brexit-vote-through\\n* https://www.europeanvalues.net/wp-content/uploads/2019/02/Influence-of-Russian-Disinformation-Operations-Specific-examples-in-data-and-numbers.pdf\\n* https://blogs.lse.ac.uk/brexit/2018/11/14/the-extent-of-russian-backed-fraud-means-the-referendum-is-invalid/\\n* https://www.wired.co.uk/article/brexit-russia-influence-twitter-bots-internet-research-agency\\n* https://www.buzzfeed.com/jamesball/a-suspected-network-of-13000-twitter-bots-pumped-out-pro?utm_term=.ipWGa5zK#.oeeKD58v\\n* https://www.atlanticcouncil.org/blogs/new-atlanticist/use-brexit-delay-to-investigate-russian-money\\n* http://www.interpretermag.com/putins-media-are-pushing-britain-for-the-brexit/\\n* https://www.theguardian.com/technology/2018/may/12/facebook-brexit-russia-unresolved-40-questions\\n* https://www.economist.com/briefing/2018/02/22/russian-disinformation-distorts-american-and-european-democracy\\n\\n\\n\\n\"],\n", + " ['incident',\n", + " 'I00044',\n", + " '\\n\\nActors: \\n\\n* SVR and IRA; \\n* Alex Jones; \\n* Global Research; \\n* anti-gov trolls; rapture trolls; alt-right trolls;\\n\\nTimeframe: Most of 2015\\n\\nDate: May - Oct 2015\\n\\nPresumed goals: \\n\\n* US operational dry run; \\n* Test 2016 themes; \\n* Promote paranoia in right wing US populations; \\n* Establish and prime anti-government narratives for future use. \\n\\nMethod: \\n\\n* Amplification via sockpuppet and cyborg accounts; \\n* Social media groups and meetups; \\n* Promote fake “experts” with impressive (and scary) titles; \\n* Amplify US media derision of message “carriers” in Russian state media;\\n\\nCounters: \\n\\n* Media exposure; \\n* Texas Governor disavows \\n\\nRelated incidents: \\n\\n* 2016 US election; \\n* QAnon; \\n* Texas secession\\n\\nReferences\\n\\n* [That \\'Jade Helm\\' Conspiracy Freakout Was Spurred By Russian Bots, Ex-Intel Chief Says](https://taskandpurpose.com/jade-helm-conspiracy-russian-bots)\\n* [Russians Sowed Divisions in Texas Politics, Says U.S. Senate Report](https://www.texasmonthly.com/news/russians-sowed-divisions-texas-politics-says-u-s-senate-report/)\\n* [Case Analysis: Jade Helm 15 and Russian Active Measures](https://toinformistoinfluence.com/2015/11/16/case-analysis-jade-helm-15-and-russian-active-measures/)\\n* [Trolling for Trump: how Russia is trying to destroy our democracy](https://warontherocks.com/2016/11/trolling-for-trump-how-russia-is-trying-to-destroy-our-democracy/)\\n* [Anatomy of a Russian attack: First signs of the Kremlin’s attempt to influence the 2016 election](https://wtop.com/j-j-green-national/2017/09/anatomy-russian-attack-first-signs/slide/1/)\\n\\nDetails\\n\\nEven before the 2016 presidential election, the Russians had been testing disinformation in Texas by stirring up the controversy surrounding the Jade Helm military maneuver in the summer of 2015. Conspiracy theorists had created the idea that a joint military training exercise in Texas was cover for President Obama to declare martial law and seize Texas. The conspiracy theory gained traction when Abbott ordered the Texas State Guard to monitor the U.S. military. Earlier this year, a former head of the National Security Agency and the CIA—Air Force General Michael Hayden—said the Jade Helm disinformation campaign was pivotal to the Russians’ decision to try to influence the U.S. presidential campaign. “At that point, I’m figuring the Russians are saying, ‘We can go big-time.’ And at that point, I think they made the decision, ‘We’re going to play in the electoral process,’” Hayden said.\\n\\nWhen thousands of troops from Army Special Operations Command descended on the American southwest for the totally normal eight-week training exercise Jade Helm 15, Texas Gov. Greg Abbott — goaded on by anti-government ideologues, rapture-predicting ministries and alt-right internet famewhores — ordered the state\\'s volunteer guard to \"monitor\" the U.S. service members on their land to make sure they didn\\'t start kidnapping undesirables and grabbing people\\'s guns.\\n\\nIt was a precursor to martial law, they said. It was \"way worse than you realize: police, military working together toward population control,\" they said. It was \"secretly using recently closed Wal-Marts to stockpile supplies for Chinese troops who will be arriving to disarm Americans,\" they said. It was preparation for Obama\\'s takeover after an impending asteroid impact that would begin the global apocalypse, they said. It mobilized right-wing activists to prepare to fight their government — their uniformed soldiers! — to the death.\\n\\nRussian intelligence, state media, and trolls under President Vladimir Putin sought to bum steer U.S. domestic reactions to Jade Helm 15, the multi-state U.S.-based military training exercise concludedSeptember 15th. Russia has invested tens to hundreds of millions to infiltrate U.S. media markets with English language news, opinion, conspiracy, and troll content, often interlocking with the most popular U.S. conspiracy theory websites on the net.\\n\\nOn July 2015, at a community meeting in Bastrop, some Texans were up in arms about hosting part of a multi-state U.S. military training exercise named Jade Helm 15. While most locals were unswayed by the conspiracy theories of Jade Helm 15 ushering in martial law, the video of the crowd at the link records aspects of U.S. social and cognitive vulnerability to Russian “active measures.”\\n\\nIt\\'s an age-old problem; during the Cold War, Soviet agencies worked to whip up leftist anger at the U.S. government, highlighting America\\'s race and inequality problems. But today, they\\'ve found that the most effective, salient mode of fuckery in U.S. affairs is to push right-wing conspiracy theories — \"deep state,\" Hillary emails, Pizzagate, Seth Rich, Soros, Islamists sneaking over the Mexico-U.S. border, Benghazi — that reinforce the idea that anyone to the left of, say, President Donald Trump, is a robotic foreign-paid human-trafficking overlord doing the bidding of the Rothschilds or Trilaterals or Freemasons or Kellers some other inane shit.\\n\\nThe Russian SVR (Sluzhba vneshney razvedki) has chief responsibility for conducting active measures outside of Russia. The SVR’s active measures surrounding Jade Helm 15 generated fear to ignite a range of behaviors serving Russian foreign policy objectives, from feeding cynicism about the U.S. governing system and its people, to inciting violence and sabotage in the U.S.\\n\\nOne example of how this messaging worked in ramping up fear of Jade Helm 15 was found at “Global Research,” a media outlet for a Canadian non-profit called Centre for Research on Globalization. Entitled, Towards a Militarized Police State in America? Explosive New Revelations over “Jade Helm 15 Exercise” and Potential False Flags, the online article was posted May 27, 2015, roughly 48 days before the Jade Helm 15 training exercise was to begin. Such a lead would give the piece time to disseminate to conspiracist sites and gullible readers ample time to organize a response.\\n\\nThe idea is to get Americans thinking other Americans are the real enemies of humanity and progress. And it works, because a lot of Americans are already disposed to that way of thinking.\\n\\nOn the other hand, it’s an easy cop-out to blame the Russians for every insecure dumbass idea that excitable Americans run with.\\n\\nConsidering their interlocking content and links, Global Research and Alex Jones’s InfoWars.com (one of the most popular conspiracy websites on the internet) have a de facto alliance. Both sites published conspiracy pieces about Jade Helm 15 in advance of the exercise, as did many other conspiracist websites that link with one or both.\\n\\nThe blizzard of conspiracy has had an effect. By May 2015, a Rasmussen poll on Jade Helm 15 found that “45% of voters are concerned that the government will use U.S. military training operations to impose greater control over some states,” with 19% “Very Concerned.” Rasmussen also reported that “21% believe the government’s decision to conduct military training exercises in some states is an infringement on the rights of the citizens in those states.”\\n\\nSome debate the effectiveness of Russian active measures, propaganda, and trolling. Russia Today (RT) is a more sophisticated Kremlin media outlet, with slick television, internet, and periodical output. RT’s portrayal of Jade Helm 15was to depict Americans as prone to conspiracy theory, and to amplify left-leaning U.S. media derision of Texas demographics disturbed by Jade Helm 15, while casting doubt on the government operation with headlines and sub-headlines. Russia Today’s approach had accentuated personal caricatures and distrust driving partisan anger in the U.S.\\n\\nOn social media however, Kremlin-linked and other conspiracists sometimes represent themselves as insiders or experts whose content can be frightening and inciting.\\n\\nFor example, on LinkedIn.com, many Pulse posts have focused on Jade Helm 15. Below I profile two examples of Pulse writers who hit Jade Helm 15 theme especially hard, one of them naming himself a “Military Intelligence Analyst / Russian Regional CME” and the other a “Geopolitical Strategist, Journalist & Author”\\n\\nAre apocalyptic conspiracies harmless despite their over-the-top claims?\\n\\nApparently not. One ominous event may have turned Jade Helm 15 Active measures into a high-yield victory for Vladimir Putin’s Kremlin. Three North Carolina men amassed arms, munitions, and weapons and had been actively preparing to ambush Jade Helm 15 troops in training. Fortunately, the FBI received a tip from a gun and surplus store owner and arrested the would-be domestic-terrorists who feared that Jade Helm 15 was a prelude to martial law in the U.S.\\n\\nThe Russian SVR and Putin’s media have aimed at Texas before. Did Putin foresee that Texas politicians might respond to popular conspiracist fears ramped up by the Kremlin itself and so cause strife in the partisan divide? That happened when Governor Greg Abbot tried to reassure Texans about Jade Helm 15, and opposition media lampooned him.\\n\\nYet according to the San Antonio Express News, Governor Abbot, who is also a former Texas Supreme Court Justice not of the conspiracist mold, had initially a milder approach. Yet the opposing partisan media did more than just embarrass Gov. Abbot over his response, it called some of his constituents who had been moved by conspiracy propaganda “dumb,” which further tends to divide U.S. demographics along stereotypical lines. Mr. Putin must have been pleased.\\n\\nExamples\\n\\n\\n'],\n", + " ['incident',\n", + " 'I00015',\n", + " '\\n\\nActors: Russian state actors, Concord Management\\n\\nTimeframe: Fall 2018 - Winter 2019\\n\\nDate: October 2018\\n\\nPresumed goals: \\n\\n* Discredit Mueller findings; \\n* sow doubt about Russian active measures; \\n* expose investigatory sources, priorities and methods; \\n\\nMethod: \\n\\n* Release non-public documents with favorable amendments; \\n* Disguise document provenance as hacking (i.e. revelation); \\n* Circulate to media via DM, then release publicly \\n\\nCounters: \\n\\n* Media exposure; \\n* motions to limit future discovery\\n\\nRelated incidents: \\n\\n* 2016 US election\\n\\nReferences\\n\\n* [Document: Concord Management Used Discovery for Disinformation Campaign, Mueller Says](https://www.lawfareblog.com/document-concord-management-used-discovery-disinformation-campaign-mueller-says)\\n* [Mueller says some private case files were used in \\'disinformation campaign\\' to discredit Russia probe](https://thehill.com/policy/national-security/427723-mueller-says-some-of-his-private-case-files-were-used-in)\\n* [Mueller says Russians are using his discovery materials in disinformation effort](https://www.nbcnews.com/politics/justice-department/mueller-says-russians-using-his-discovery-materials-disinformation-effort-n964811)\\n* [Mueller says discovery materials in case against Russian firm were used in a cyber-disinformation campaign](https://www.washingtonpost.com/local/legal-issues/mueller-says-discovery-materials-in-case-against-russian-firm-were-used-in-a-cyber-disinformation-campaign/2019/01/30/9fd60218-24c9-11e9-81fd-b7b05d5bed90_story.html?utm_term=.4b814db9f811)\\n* [Mueller\\'s Team Questions How Files in Russia Case Ended Up Online](https://www.law.com/nationallawjournal/2019/01/30/muellers-team-questions-how-files-in-russia-case-ended-up-online/?slreturn=20190231112904)\\n* https://www.documentcloud.org/documents/5700929-Concord-Discovery-Opposition.html\\n\\nDetails\\n\\nThe special counsel\\'s office has filed a memorandum in U.S. v. Concord Management and Consulting, LLC in opposition to Concord\\'s motion to disclose documents identified as \"sensitive\" by the Special Counsel to certain Concord officers and employees. The memo alleges that subsequent investigations into Concord have \"revealed that certain non-sensitive discovery materials in the defense’s possession appear to have been altered and disseminated as part of a disinformation campaign\" apparently aimed at discrediting the special counsel\\'s investigation into Russian interference in the 2016 U.S. election.\\n\\nThat discovery — evidence and documents traded between both sides of a lawsuit — appears to have been altered and disseminated as part of a disinformation campaign apparently aimed at discrediting the ongoing investigations in Russian interference in the U.S. political system, according to the documents.\\n\\nProsecutors said sensitive evidence also could reveal government investigative techniques and identify cooperating individuals and companies.\\n\\nConcord is among 13 Russian individuals and entities charged last February in connection with Mueller’s probe. Concord is alleged to have funded the operation of the Internet Research Agency, a Russian troll farm that spread divisive content to U.S. audiences on social media as part of broader effort to meddle in the 2016 vote.\\n\\nProsecutors said that some nonpublic files supplied to Concord’s defense attorneys were apparently altered and disseminated using the Twitter account @HackingRedstone, which has since been suspended on the platform.\\n\\nOn Thursday, Mueller\\'s team updated their filing with precise dates for the actions taken on Twitter, noting that the account @HackingRedstone started sending direct messages to members of the media on October 22, before making a public tweet on October 30 in regards to the supposed discovery documents.\\n\\nThe filing cites an Oct. 22, 2018, tweet in which the account claimed, “We’ve got access to the Special Counsel Mueller’s probe database as we hacked Russian server with info from the Russian troll case Concord LLC v. Mueller. You can view all the files Mueller had about the IRA and Russia collusion. Enjoy the reading!” \\n\\nThe tweet linked to a webpage with folders containing scores of files that mimicked names and folder structures of materials produced by the special counsel’s office in discovery, the filing states.\\n\\nThe prosecutors’ filing said the matching files included images of political memes from Facebook and other social media accounts used online by the Internet Research Agency, many of which are presumably still available elsewhere on the Internet, but not with the unique identifiers used in materials turned over by prosecutors.\\n\\nProsecutors said in their filing that an FBI review found no evidence of a hack of the special counsel’s office. The filing also said that defense lawyers told the Mueller team that the vendor it was using reported no unauthorized access to the nonsensitive files. Under a court protective order, sensitive evidence in the case must be reviewed by a U.S. government “firewall” counsel, and then a judge must give permission before the evidence can be given to any non-U.S. national.\\n\\nThe facts “establish that the person(s) who created the Web page had access to at least some of the nonsensitive discovery produced by the government in this case,” wrote Justice Department national security division attorney Heather N. Alpino for a team including prosecutors with Mueller’s office and the U.S. attorney’s office of the District.\\n\\n\\nMueller’s team firmly pushed back on the request in the filing Wednesday, asserting releasing the files to the firm’s employees in Russia – including Prigozhin – would risk U.S. national security. \\n\\n“Concord’s request to send the discovery to the Russian Federation unreasonably risks the national security interests of the United States,” the filing states. “The government’s concerns are only heightened by the apparent release and manipulation of information produced to Concord as ‘non-sensitive’ discovery in this case.” \\n\\nThe filing also notes that the discovery files labeled \"sensitive\" identify \"uncharged individuals\" who government investigators believe are \"continuing to engage in operations to interfere with lawful U.S. government functions like those activities charged in the indictment.” \\n\\nMueller’s prosecutors did not oppose allowing Concord employees to view the files at their defense attorney’s offices under security protections, noting that “appearance in the United States would allow them to stand trial.”\\n']]" + ] + }, + "execution_count": 21, + "metadata": {}, + "output_type": "execute_result" + } + ], + "source": [ + "import os\n", + "import glob\n", + "\n", + "warntext = 'DO NOT EDIT ABOVE THIS LINE - PLEASE ADD NOTES BELOW'\n", + "warnlen = len(warntext)\n", + "\n", + "objecttypes = {'phase','tactic','technique','task','incident',\n", + " 'counter','metatechnique','actortype',#'resource',\n", + " #'responsetype',#'detection'\n", + "}\n", + "\n", + "foundtext = []\n", + "for objecttype in objecttypes:\n", + "\n", + " objecttypeplural = objecttype + 's'\n", + " objecttypedir = '../{}'.format(objecttypeplural)\n", + " if not os.path.exists(objecttypedir):\n", + " print(\"directory {} doesn't exist\".format(objecttypedir))\n", + " continue\n", + "\n", + " for datafile in glob.glob(objecttypedir + '/*.md'):\n", + " with open(datafile) as f:\n", + " filetext = f.read()\n", + " warnpos = filetext.find(warntext)\n", + " endpos = warnpos+len(warntext)\n", + " if endpos != len(filetext):\n", + " objectname = datafile[datafile.rfind('/')+1:-3]\n", + " print('warning text in {} {}'.format(objecttype, objectname)) \n", + " foundtext += [[objecttype, objectname, filetext[endpos:]]]\n", + "foundtext" + ] + }, + { + "cell_type": "code", + "execution_count": 26, + "metadata": {}, + "outputs": [ + { + "data": { + "text/html": [ + "
\n", + "\n", + "\n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + "
012
0counterC00066\\n\\nNew content. \\n\\nIf a group has the abili...
1incidentI00002\\n\\nActor: IRA, individuals (e.g. Larry Cook)....
2incidentI00053\\n\\nActor: China\\n\\nTimeframe: December 5, 201...
3incidentI00032\\n\\nSummary: \\n\\nActors: \\n\\n* IRA; other Rus...
4incidentI00063\\n\\nActor: Russia\\n\\nTimeframe: July 18, 2016 ...
5incidentI00006\\n\\nActor: probably IRA (source: recordedfutur...
6incidentI00047\\n\\nActor: Russia\\n\\nTimeframe: November 25, 2...
7incidentI00022\\n\\nActor: \\n\\n* 4chan user with Latvian IP ad...
8incidentI00033\\n\\nActor: China\\n\\nTimeframe: 2011\\n\\nDate:\\n...
9incidentI00062\\n\\nSee also I00005.
10incidentI00056\\n\\nActor: Iran\\n\\nTimeframe: 2012 - ongoing\\n...
11incidentI00007\\n\\nActor: RT/Sputnik\\n\\nTimeframe: 2 weeks\\n\\...
12incidentI00017\\n\\nActor: IRA\\n\\nTimeframe: 2 years\\n\\nDate: ...
13incidentI00003\\n\\nActor: IRA\\n\\nTimeframe: \\n\\nDate: \\n\\nPre...
14incidentI00042\\n\\nActor: \\n\\n* Saudi Arabia / Qatar /Turkey....
15incidentI00008\\n\\nActor: \\n\\nTimeframe: \\n\\nDate: \\n\\nPresum...
16incidentI00049\\n\\nActor: Russia, Syrian Government and Iran\\...
17incidentI00039\\n\\nActor:\\n\\n* Right-wing FB pages\\n* Fake ne...
18incidentI00029\\n\\nActor: Russia \\n\\nTimeframe: July 2014 - s...
19incidentI00009\\n\\nSuspected actors:\\n\\n* Attacker: IRA or m...
20incidentI00019\\n\\nActor: \\n\\n* individual accounts on 4chan ...
21incidentI00004\\n\\nActor: IRA\\n\\nTimeframe: 1 day (plus prepa...
22incidentI00045\\n\\nActor: Russia\\n\\nTimeframe: March 4, 2018 ...
23incidentI00051\\n\\nActor: Russia\\n\\nTimeframe: December 2018 ...
24incidentI00034\\n\\nActor: China\\n\\nTimeframe: 72 hours?\\n\\nDa...
25incidentI00010\\n\\nActors: IRA, Alex Jones, far right and far...
26incidentI00050\\n\\nActor: Russia, Cuba, China, Iran\\n\\nTimefr...
27incidentI00001\\n\\nActor: \\n\\nTimeframe: \\n\\nDate: \\n\\nPresum...
28incidentI00035\\n\\nSummary: \\n\\nActor: \\n\\nTimeframe: \\n\\nDa...
29incidentI00025\\n\\nActor: Russia\\n\\nTimeframe: November 6, 20...
30incidentI00060\\n\\nActors: \\n\\nTimeframe:\\n\\nDate: \\n\\nPresum...
31incidentI00005\\n\\nActor: Russia/ Internet Research Agency (I...
32incidentI00044\\n\\nActors: \\n\\n* SVR and IRA; \\n* Alex Jones;...
33incidentI00015\\n\\nActors: Russian state actors, Concord Mana...
\n", + "
" + ], + "text/plain": [ + " 0 1 2\n", + "0 counter C00066 \\n\\nNew content. \\n\\nIf a group has the abili...\n", + "1 incident I00002 \\n\\nActor: IRA, individuals (e.g. Larry Cook)....\n", + "2 incident I00053 \\n\\nActor: China\\n\\nTimeframe: December 5, 201...\n", + "3 incident I00032 \\n\\nSummary: \\n\\nActors: \\n\\n* IRA; other Rus...\n", + "4 incident I00063 \\n\\nActor: Russia\\n\\nTimeframe: July 18, 2016 ...\n", + "5 incident I00006 \\n\\nActor: probably IRA (source: recordedfutur...\n", + "6 incident I00047 \\n\\nActor: Russia\\n\\nTimeframe: November 25, 2...\n", + "7 incident I00022 \\n\\nActor: \\n\\n* 4chan user with Latvian IP ad...\n", + "8 incident I00033 \\n\\nActor: China\\n\\nTimeframe: 2011\\n\\nDate:\\n...\n", + "9 incident I00062 \\n\\nSee also I00005.\n", + "10 incident I00056 \\n\\nActor: Iran\\n\\nTimeframe: 2012 - ongoing\\n...\n", + "11 incident I00007 \\n\\nActor: RT/Sputnik\\n\\nTimeframe: 2 weeks\\n\\...\n", + "12 incident I00017 \\n\\nActor: IRA\\n\\nTimeframe: 2 years\\n\\nDate: ...\n", + "13 incident I00003 \\n\\nActor: IRA\\n\\nTimeframe: \\n\\nDate: \\n\\nPre...\n", + "14 incident I00042 \\n\\nActor: \\n\\n* Saudi Arabia / Qatar /Turkey....\n", + "15 incident I00008 \\n\\nActor: \\n\\nTimeframe: \\n\\nDate: \\n\\nPresum...\n", + "16 incident I00049 \\n\\nActor: Russia, Syrian Government and Iran\\...\n", + "17 incident I00039 \\n\\nActor:\\n\\n* Right-wing FB pages\\n* Fake ne...\n", + "18 incident I00029 \\n\\nActor: Russia \\n\\nTimeframe: July 2014 - s...\n", + "19 incident I00009 \\n\\nSuspected actors:\\n\\n* Attacker: IRA or m...\n", + "20 incident I00019 \\n\\nActor: \\n\\n* individual accounts on 4chan ...\n", + "21 incident I00004 \\n\\nActor: IRA\\n\\nTimeframe: 1 day (plus prepa...\n", + "22 incident I00045 \\n\\nActor: Russia\\n\\nTimeframe: March 4, 2018 ...\n", + "23 incident I00051 \\n\\nActor: Russia\\n\\nTimeframe: December 2018 ...\n", + "24 incident I00034 \\n\\nActor: China\\n\\nTimeframe: 72 hours?\\n\\nDa...\n", + "25 incident I00010 \\n\\nActors: IRA, Alex Jones, far right and far...\n", + "26 incident I00050 \\n\\nActor: Russia, Cuba, China, Iran\\n\\nTimefr...\n", + "27 incident I00001 \\n\\nActor: \\n\\nTimeframe: \\n\\nDate: \\n\\nPresum...\n", + "28 incident I00035 \\n\\nSummary: \\n\\nActor: \\n\\nTimeframe: \\n\\nDa...\n", + "29 incident I00025 \\n\\nActor: Russia\\n\\nTimeframe: November 6, 20...\n", + "30 incident I00060 \\n\\nActors: \\n\\nTimeframe:\\n\\nDate: \\n\\nPresum...\n", + "31 incident I00005 \\n\\nActor: Russia/ Internet Research Agency (I...\n", + "32 incident I00044 \\n\\nActors: \\n\\n* SVR and IRA; \\n* Alex Jones;...\n", + "33 incident I00015 \\n\\nActors: Russian state actors, Concord Mana..." + ] + }, + "execution_count": 26, + "metadata": {}, + "output_type": "execute_result" + } + ], + "source": [ + "import pandas as pd\n", + "import csv\n", + "\n", + "dffound = pd.DataFrame(foundtext)\n", + "dffound.to_csv('TEST_foundtext.csv', quoting=csv.QUOTE_NONNUMERIC,\n", + " index=False)\n", + "dffound" + ] + }, + { + "cell_type": "code", + "execution_count": null, + "metadata": {}, + "outputs": [], + "source": [] + } + ], + "metadata": { + "kernelspec": { + "display_name": "Python 3", + "language": "python", + "name": "python3" + }, + "language_info": { + "codemirror_mode": { + "name": "ipython", + "version": 3 + }, + "file_extension": ".py", + "mimetype": "text/x-python", + "name": "python", + "nbconvert_exporter": "python", + "pygments_lexer": "ipython3", + "version": "3.8.3" + } + }, + "nbformat": 4, + "nbformat_minor": 4 +} diff --git a/HTML_GENERATING_CODE/__pycache__/generate_amitt_ttps.cpython-38.pyc b/HTML_GENERATING_CODE/__pycache__/generate_amitt_ttps.cpython-38.pyc index 64a9edd..0346d8f 100644 Binary files a/HTML_GENERATING_CODE/__pycache__/generate_amitt_ttps.cpython-38.pyc and b/HTML_GENERATING_CODE/__pycache__/generate_amitt_ttps.cpython-38.pyc differ diff --git a/HTML_GENERATING_CODE/generate_amitt_ttps.py b/HTML_GENERATING_CODE/generate_amitt_ttps.py index b248c74..c5a3624 100644 --- a/HTML_GENERATING_CODE/generate_amitt_ttps.py +++ b/HTML_GENERATING_CODE/generate_amitt_ttps.py @@ -269,10 +269,10 @@ class Amitt: | ----------- | ------- | ''' counter_actortypes = self.cross_counterid_actortypeid[self.cross_counterid_actortypeid['amitt_id']==counter_id] - counter_actortypes = pd.merge(counter_actortypes, self.df_actortypes[['amitt_id', 'name', 'sector']], left_on='actortype_id', right_on='amitt_id') + counter_actortypes = pd.merge(counter_actortypes, self.df_actortypes[['amitt_id', 'name', 'sector_ids']], left_on='actortype_id', right_on='amitt_id') row_string = '| [{0} {1}](../actortypes/{0}.md) | {2} |\n' for index, row in counter_actortypes.sort_values('actortype_id').iterrows(): - table_string += row_string.format(row['actortype_id'], row['name'], row['sector']) + table_string += row_string.format(row['actortype_id'], row['name'], row['sector_ids']) return table_string def create_actortype_counters_string(self, actortype_id): @@ -407,17 +407,17 @@ class Amitt: 'tactic': ['name', 'summary', 'phase_id'], 'technique': ['name', 'summary', 'tactic_id'], 'task': ['name', 'summary', 'tactic_id'], - 'incident': ['name', 'type', 'year_started', 'to_country', 'found_via'], + 'incident': ['name', 'objecttype', 'year_started', 'found_in_country', 'found_via'], 'counter': ['name', 'summary', 'metatechnique', 'tactic', 'responsetype'], 'detection': ['name', 'summary', 'metatechnique', 'tactic', 'responsetype'], 'responsetype': ['name', 'summary'], 'metatechnique': ['name', 'summary'], - 'actortype': ['name', 'summary', 'sector'], + 'actortype': ['name', 'summary', 'sector_ids'], 'resource': ['name', 'summary', 'resource type'] } for objecttype, df in metadata.items(): - + print('Temp: objecttype {}'.format(objecttype)) # Create objecttype directory if needed. Create index file for objecttype objecttypeplural = objecttype + 's' objecttypedir = '../{}'.format(objecttypeplural) @@ -477,17 +477,17 @@ class Amitt: incidents=self.create_counter_incidents_string(row['amitt_id'])) if objecttype == 'incident': metatext = template.format(type = 'Incident', id=row['amitt_id'], name=row['name'], - incidenttype=row['type'], summary=row['summary'], + incidenttype=row['objecttype'], summary=row['summary'], yearstarted=row['year_started'], - fromcountry=row['from_country'], - tocountry=row['to_country'], + fromcountry=row['attributions_seen'], + tocountry=row['found_in_country'], foundvia=row['found_via'], dateadded=row['when_added'], techniques=self.create_incident_techniques_string(row['amitt_id'])) if objecttype == 'actortype': metatext = template.format(type = 'Actor', id=row['amitt_id'], name=row['name'], - summary=row['summary'], sector=row['sector'], - viewpoint=row['viewpoint'], + summary=row['summary'], sector=row['sector_ids'], + viewpoint=row['framework_ids'], counters=self.create_actortype_counters_string(row['amitt_id'])) if objecttype == 'resource': metatext = template.format(type = 'Resource', id=row['amitt_id'], name=row['name'], diff --git a/actortypes/A001.md b/actortypes/A001.md index 1debe11..003d36c 100644 --- a/actortypes/A001.md +++ b/actortypes/A001.md @@ -2,15 +2,15 @@ * **Summary:** Person who can wrangle data, implement machine learning algorithms etc -* **Sector:** All +* **Sector:** S001, S002, S003, S004, S005, S006, S007, S008, S009, S010 -* **Viewpoint:** both +* **Viewpoint:** FW01, FW02 | Counters | Response types | | -------- | -------------- | -| [C00092 Establish a truth teller reputation score for influencers](../counters/C00092.md) | D7 Deter | -| [C00160 find and train influencers](../counters/C00160.md) | D2 Deny | +| [C00092 Establish a truth teller reputation score for influencers](../counters/C00092.md) | D07 | +| [C00160 find and train influencers](../counters/C00160.md) | D02 | DO NOT EDIT ABOVE THIS LINE - PLEASE ADD NOTES BELOW \ No newline at end of file diff --git a/actortypes/A002.md b/actortypes/A002.md index 78a1cef..dc015a5 100644 --- a/actortypes/A002.md +++ b/actortypes/A002.md @@ -2,9 +2,9 @@ * **Summary:** Person being targeted by disinformation campaign -* **Sector:** All +* **Sector:** S001, S002, S003, S004, S005, S006, S007, S008, S009, S010 -* **Viewpoint:** blue +* **Viewpoint:** FW02 | Counters | Response types | diff --git a/actortypes/A003.md b/actortypes/A003.md index 599fea0..8accf3a 100644 --- a/actortypes/A003.md +++ b/actortypes/A003.md @@ -2,14 +2,14 @@ * **Summary:** Influencer -* **Sector:** All +* **Sector:** S001, S002, S003, S004, S005, S006, S007, S008, S009, S010 -* **Viewpoint:** both +* **Viewpoint:** FW01, FW02 | Counters | Response types | | -------- | -------------- | -| [C00128 Create friction by marking content with ridicule or other "decelerants"](../counters/C00128.md) | D3 Disrupt | +| [C00128 Create friction by marking content with ridicule or other "decelerants"](../counters/C00128.md) | D03 | DO NOT EDIT ABOVE THIS LINE - PLEASE ADD NOTES BELOW \ No newline at end of file diff --git a/actortypes/A004.md b/actortypes/A004.md index e320d3c..5d4a04a 100644 --- a/actortypes/A004.md +++ b/actortypes/A004.md @@ -2,15 +2,15 @@ * **Summary:** -* **Sector:** Civil Society +* **Sector:** S002 -* **Viewpoint:** blue +* **Viewpoint:** FW02 | Counters | Response types | | -------- | -------------- | -| [C00052 Infiltrate platforms](../counters/C00052.md) | D4 Degrade | -| [C00197 remove suspicious accounts](../counters/C00197.md) | D2 Deny | +| [C00052 Infiltrate platforms](../counters/C00052.md) | D04 | +| [C00197 remove suspicious accounts](../counters/C00197.md) | D02 | DO NOT EDIT ABOVE THIS LINE - PLEASE ADD NOTES BELOW \ No newline at end of file diff --git a/actortypes/A005.md b/actortypes/A005.md index 8e1421f..f263d73 100644 --- a/actortypes/A005.md +++ b/actortypes/A005.md @@ -2,14 +2,14 @@ * **Summary:** -* **Sector:** Civil Society +* **Sector:** S002 -* **Viewpoint:** blue +* **Viewpoint:** FW02 | Counters | Response types | | -------- | -------------- | -| [C00073 Inoculate populations through media literacy training](../counters/C00073.md) | D2 Deny | +| [C00073 Inoculate populations through media literacy training](../counters/C00073.md) | D02 | DO NOT EDIT ABOVE THIS LINE - PLEASE ADD NOTES BELOW \ No newline at end of file diff --git a/actortypes/A006.md b/actortypes/A006.md index 12e5164..09b6ca0 100644 --- a/actortypes/A006.md +++ b/actortypes/A006.md @@ -2,19 +2,19 @@ * **Summary:** -* **Sector:** Civil Society +* **Sector:** S002 -* **Viewpoint:** blue +* **Viewpoint:** FW02 | Counters | Response types | | -------- | -------------- | -| [C00009 Educate high profile influencers on best practices](../counters/C00009.md) | D2 Deny | -| [C00011 Media literacy. Games to identify fake news](../counters/C00011.md) | D2 Deny | -| [C00051 Counter social engineering training](../counters/C00051.md) | D2 Deny | -| [C00073 Inoculate populations through media literacy training](../counters/C00073.md) | D2 Deny | -| [C00188 Newsroom/Journalist training to counter influence moves](../counters/C00188.md) | D3 Disrupt | -| [C00212 build public resilience by making civil society more vibrant](../counters/C00212.md) | D3 Disrupt | +| [C00009 Educate high profile influencers on best practices](../counters/C00009.md) | D02 | +| [C00011 Media literacy. Games to identify fake news](../counters/C00011.md) | D02 | +| [C00051 Counter social engineering training](../counters/C00051.md) | D02 | +| [C00073 Inoculate populations through media literacy training](../counters/C00073.md) | D02 | +| [C00188 Newsroom/Journalist training to counter influence moves](../counters/C00188.md) | D03 | +| [C00212 build public resilience by making civil society more vibrant](../counters/C00212.md) | D03 | DO NOT EDIT ABOVE THIS LINE - PLEASE ADD NOTES BELOW \ No newline at end of file diff --git a/actortypes/A007.md b/actortypes/A007.md index 092c683..bc12c37 100644 --- a/actortypes/A007.md +++ b/actortypes/A007.md @@ -2,15 +2,15 @@ * **Summary:** Someone with the skills to verify whether information posted is factual -* **Sector:** Civil Society +* **Sector:** S002 -* **Viewpoint:** blue +* **Viewpoint:** FW02 | Counters | Response types | | -------- | -------------- | -| [C00008 Create shared fact-checking database](../counters/C00008.md) | D4 Degrade | -| [C00014 Real-time updates to fact-checking database](../counters/C00014.md) | D4 Degrade | +| [C00008 Create shared fact-checking database](../counters/C00008.md) | D04 | +| [C00014 Real-time updates to fact-checking database](../counters/C00014.md) | D04 | DO NOT EDIT ABOVE THIS LINE - PLEASE ADD NOTES BELOW \ No newline at end of file diff --git a/actortypes/A008.md b/actortypes/A008.md index fced9e6..a65f5bb 100644 --- a/actortypes/A008.md +++ b/actortypes/A008.md @@ -2,14 +2,14 @@ * **Summary:** -* **Sector:** Civil Society +* **Sector:** S002 -* **Viewpoint:** blue +* **Viewpoint:** FW02 | Counters | Response types | | -------- | -------------- | -| [C00073 Inoculate populations through media literacy training](../counters/C00073.md) | D2 Deny | +| [C00073 Inoculate populations through media literacy training](../counters/C00073.md) | D02 | DO NOT EDIT ABOVE THIS LINE - PLEASE ADD NOTES BELOW \ No newline at end of file diff --git a/actortypes/A009.md b/actortypes/A009.md index c3cf96a..4797aca 100644 --- a/actortypes/A009.md +++ b/actortypes/A009.md @@ -2,14 +2,14 @@ * **Summary:** -* **Sector:** Civil Society +* **Sector:** S002 -* **Viewpoint:** blue +* **Viewpoint:** FW02 | Counters | Response types | | -------- | -------------- | -| [C00073 Inoculate populations through media literacy training](../counters/C00073.md) | D2 Deny | +| [C00073 Inoculate populations through media literacy training](../counters/C00073.md) | D02 | DO NOT EDIT ABOVE THIS LINE - PLEASE ADD NOTES BELOW \ No newline at end of file diff --git a/actortypes/A010.md b/actortypes/A010.md index d0942c0..a21712b 100644 --- a/actortypes/A010.md +++ b/actortypes/A010.md @@ -2,14 +2,14 @@ * **Summary:** -* **Sector:** Civil Society +* **Sector:** S002 -* **Viewpoint:** blue +* **Viewpoint:** FW02 | Counters | Response types | | -------- | -------------- | -| [C00073 Inoculate populations through media literacy training](../counters/C00073.md) | D2 Deny | +| [C00073 Inoculate populations through media literacy training](../counters/C00073.md) | D02 | DO NOT EDIT ABOVE THIS LINE - PLEASE ADD NOTES BELOW \ No newline at end of file diff --git a/actortypes/A011.md b/actortypes/A011.md index 9ea4d0b..1408338 100644 --- a/actortypes/A011.md +++ b/actortypes/A011.md @@ -2,9 +2,9 @@ * **Summary:** -* **Sector:** Civil Society +* **Sector:** S002 -* **Viewpoint:** blue +* **Viewpoint:** FW02 | Counters | Response types | diff --git a/actortypes/A012.md b/actortypes/A012.md index 1b2f33e..7bf276f 100644 --- a/actortypes/A012.md +++ b/actortypes/A012.md @@ -2,14 +2,15 @@ * **Summary:** Anyone who owns an account online -* **Sector:** General Public +* **Sector:** S006 -* **Viewpoint:** both +* **Viewpoint:** FW01 +FW02 | Counters | Response types | | -------- | -------------- | -| [C00053 Delete old accounts / Remove unused social media accounts](../counters/C00053.md) | D4 Degrade | +| [C00053 Delete old accounts / Remove unused social media accounts](../counters/C00053.md) | D04 | DO NOT EDIT ABOVE THIS LINE - PLEASE ADD NOTES BELOW \ No newline at end of file diff --git a/actortypes/A013.md b/actortypes/A013.md index 08828d9..cc7b4b7 100644 --- a/actortypes/A013.md +++ b/actortypes/A013.md @@ -2,14 +2,15 @@ * **Summary:** -* **Sector:** General Public +* **Sector:** S006 -* **Viewpoint:** both +* **Viewpoint:** FW01 +FW02 | Counters | Response types | | -------- | -------------- | -| [C00111 Reduce polarisation by connecting and presenting sympathetic renditions of opposite views](../counters/C00111.md) | D4 Degrade | +| [C00111 Reduce polarisation by connecting and presenting sympathetic renditions of opposite views](../counters/C00111.md) | D04 | DO NOT EDIT ABOVE THIS LINE - PLEASE ADD NOTES BELOW \ No newline at end of file diff --git a/actortypes/A014.md b/actortypes/A014.md index c775ea9..a752bd7 100644 --- a/actortypes/A014.md +++ b/actortypes/A014.md @@ -2,14 +2,14 @@ * **Summary:** -* **Sector:** General Public +* **Sector:** S006 -* **Viewpoint:** blue +* **Viewpoint:** FW02 | Counters | Response types | | -------- | -------------- | -| [C00143 (botnet) DMCA takedown requests to waste group time](../counters/C00143.md) | D4 Degrade | +| [C00143 (botnet) DMCA takedown requests to waste group time](../counters/C00143.md) | D04 | DO NOT EDIT ABOVE THIS LINE - PLEASE ADD NOTES BELOW \ No newline at end of file diff --git a/actortypes/A015.md b/actortypes/A015.md index 354fe0f..2332c2c 100644 --- a/actortypes/A015.md +++ b/actortypes/A015.md @@ -2,17 +2,17 @@ * **Summary:** -* **Sector:** General Public +* **Sector:** S006 -* **Viewpoint:** blue +* **Viewpoint:** FW02 | Counters | Response types | | -------- | -------------- | -| [C00114 Don't engage with payloads](../counters/C00114.md) | D2 Deny | -| [C00124 Don't feed the trolls](../counters/C00124.md) | D3 Disrupt | -| [C00143 (botnet) DMCA takedown requests to waste group time](../counters/C00143.md) | D4 Degrade | -| [C00190 open engagement with civil society](../counters/C00190.md) | D3 Disrupt | +| [C00114 Don't engage with payloads](../counters/C00114.md) | D02 | +| [C00124 Don't feed the trolls](../counters/C00124.md) | D03 | +| [C00143 (botnet) DMCA takedown requests to waste group time](../counters/C00143.md) | D04 | +| [C00190 open engagement with civil society](../counters/C00190.md) | D03 | DO NOT EDIT ABOVE THIS LINE - PLEASE ADD NOTES BELOW \ No newline at end of file diff --git a/actortypes/A016.md b/actortypes/A016.md index 7b995a1..76e04e6 100644 --- a/actortypes/A016.md +++ b/actortypes/A016.md @@ -2,16 +2,17 @@ * **Summary:** -* **Sector:** General Public +* **Sector:** S006 -* **Viewpoint:** both +* **Viewpoint:** FW01 +FW02 | Counters | Response types | | -------- | -------------- | -| [C00009 Educate high profile influencers on best practices](../counters/C00009.md) | D2 Deny | -| [C00160 find and train influencers](../counters/C00160.md) | D2 Deny | -| [C00200 Respected figure (influencer) disavows misinfo](../counters/C00200.md) | D3 Disrupt | +| [C00009 Educate high profile influencers on best practices](../counters/C00009.md) | D02 | +| [C00160 find and train influencers](../counters/C00160.md) | D02 | +| [C00200 Respected figure (influencer) disavows misinfo](../counters/C00200.md) | D03 | DO NOT EDIT ABOVE THIS LINE - PLEASE ADD NOTES BELOW \ No newline at end of file diff --git a/actortypes/A017.md b/actortypes/A017.md index 5e3fe25..109e0a7 100644 --- a/actortypes/A017.md +++ b/actortypes/A017.md @@ -2,14 +2,14 @@ * **Summary:** For example the DHS -* **Sector:** Government +* **Sector:** S003 -* **Viewpoint:** blue +* **Viewpoint:** FW02 | Counters | Response types | | -------- | -------------- | -| [C00073 Inoculate populations through media literacy training](../counters/C00073.md) | D2 Deny | +| [C00073 Inoculate populations through media literacy training](../counters/C00073.md) | D02 | DO NOT EDIT ABOVE THIS LINE - PLEASE ADD NOTES BELOW \ No newline at end of file diff --git a/actortypes/A018.md b/actortypes/A018.md index 0f4c612..2bf7406 100644 --- a/actortypes/A018.md +++ b/actortypes/A018.md @@ -2,19 +2,20 @@ * **Summary:** Government agencies -* **Sector:** Government +* **Sector:** S003 -* **Viewpoint:** both +* **Viewpoint:** FW01 +FW02 | Counters | Response types | | -------- | -------------- | -| [C00012 Platform regulation](../counters/C00012.md) | D2 Deny | -| [C00156 Better tell your country or organization story](../counters/C00156.md) | D3 Disrupt | -| [C00203 Stop offering press credentials to propaganda outlets](../counters/C00203.md) | D3 Disrupt | -| [C00205 strong dialogue between the federal government and private sector to encourage better reporting](../counters/C00205.md) | D3 Disrupt | -| [C00207 Run a competing disinformation campaign - not recommended](../counters/C00207.md) | D7 Deter | -| [C00212 build public resilience by making civil society more vibrant](../counters/C00212.md) | D3 Disrupt | +| [C00012 Platform regulation](../counters/C00012.md) | D02 | +| [C00156 Better tell your country or organization story](../counters/C00156.md) | D03 | +| [C00203 Stop offering press credentials to propaganda outlets](../counters/C00203.md) | D03 | +| [C00205 strong dialogue between the federal government and private sector to encourage better reporting](../counters/C00205.md) | D03 | +| [C00207 Run a competing disinformation campaign - not recommended](../counters/C00207.md) | D07 | +| [C00212 build public resilience by making civil society more vibrant](../counters/C00212.md) | D03 | DO NOT EDIT ABOVE THIS LINE - PLEASE ADD NOTES BELOW \ No newline at end of file diff --git a/actortypes/A019.md b/actortypes/A019.md index 8618295..00c7001 100644 --- a/actortypes/A019.md +++ b/actortypes/A019.md @@ -2,14 +2,14 @@ * **Summary:** -* **Sector:** Government +* **Sector:** S003 -* **Viewpoint:** blue +* **Viewpoint:** FW02 | Counters | Response types | | -------- | -------------- | -| [C00156 Better tell your country or organization story](../counters/C00156.md) | D3 Disrupt | +| [C00156 Better tell your country or organization story](../counters/C00156.md) | D03 | DO NOT EDIT ABOVE THIS LINE - PLEASE ADD NOTES BELOW \ No newline at end of file diff --git a/actortypes/A020.md b/actortypes/A020.md index 7954d8c..a1effc4 100644 --- a/actortypes/A020.md +++ b/actortypes/A020.md @@ -2,17 +2,17 @@ * **Summary:** -* **Sector:** Government +* **Sector:** S003 -* **Viewpoint:** blue +* **Viewpoint:** FW02 | Counters | Response types | | -------- | -------------- | -| [C00010 Enhanced privacy regulation for social media](../counters/C00010.md) | D2 Deny | -| [C00012 Platform regulation](../counters/C00012.md) | D2 Deny | -| [C00060 Legal action against for-profit engagement factories](../counters/C00060.md) | D3 Disrupt | -| [C00065 Reduce political targeting](../counters/C00065.md) | D3 Disrupt | +| [C00010 Enhanced privacy regulation for social media](../counters/C00010.md) | D02 | +| [C00012 Platform regulation](../counters/C00012.md) | D02 | +| [C00060 Legal action against for-profit engagement factories](../counters/C00060.md) | D03 | +| [C00065 Reduce political targeting](../counters/C00065.md) | D03 | DO NOT EDIT ABOVE THIS LINE - PLEASE ADD NOTES BELOW \ No newline at end of file diff --git a/actortypes/A021.md b/actortypes/A021.md index ee85a54..18fb286 100644 --- a/actortypes/A021.md +++ b/actortypes/A021.md @@ -2,20 +2,21 @@ * **Summary:** -* **Sector:** Media +* **Sector:** S010 -* **Viewpoint:** both +* **Viewpoint:** FW01 +FW02 | Counters | Response types | | -------- | -------------- | -| [C00017 Repair broken social connections](../counters/C00017.md) | D3 Disrupt | -| [C00073 Inoculate populations through media literacy training](../counters/C00073.md) | D2 Deny | -| [C00111 Reduce polarisation by connecting and presenting sympathetic renditions of opposite views](../counters/C00111.md) | D4 Degrade | -| [C00124 Don't feed the trolls](../counters/C00124.md) | D3 Disrupt | -| [C00154 Ask media not to report false information](../counters/C00154.md) | D2 Deny | -| [C00174 Create a healthier news environment](../counters/C00174.md) | D2 Deny | -| [C00188 Newsroom/Journalist training to counter influence moves](../counters/C00188.md) | D3 Disrupt | +| [C00017 Repair broken social connections](../counters/C00017.md) | D03 | +| [C00073 Inoculate populations through media literacy training](../counters/C00073.md) | D02 | +| [C00111 Reduce polarisation by connecting and presenting sympathetic renditions of opposite views](../counters/C00111.md) | D04 | +| [C00124 Don't feed the trolls](../counters/C00124.md) | D03 | +| [C00154 Ask media not to report false information](../counters/C00154.md) | D02 | +| [C00174 Create a healthier news environment](../counters/C00174.md) | D02 | +| [C00188 Newsroom/Journalist training to counter influence moves](../counters/C00188.md) | D03 | DO NOT EDIT ABOVE THIS LINE - PLEASE ADD NOTES BELOW \ No newline at end of file diff --git a/actortypes/A022.md b/actortypes/A022.md index e661eb1..103f79f 100644 --- a/actortypes/A022.md +++ b/actortypes/A022.md @@ -2,9 +2,9 @@ * **Summary:** -* **Sector:** Other Company +* **Sector:** S009 -* **Viewpoint:** blue +* **Viewpoint:** FW02 | Counters | Response types | diff --git a/actortypes/A023.md b/actortypes/A023.md index 2f1ba24..0e0cb7f 100644 --- a/actortypes/A023.md +++ b/actortypes/A023.md @@ -2,15 +2,15 @@ * **Summary:** -* **Sector:** Other Tech Company +* **Sector:** S008 -* **Viewpoint:** blue +* **Viewpoint:** FW02 | Counters | Response types | | -------- | -------------- | -| [C00105 Buy more advertising than misinformation creators](../counters/C00105.md) | D3 Disrupt | -| [C00216 Use advertiser controls to stem flow of funds to bad actors](../counters/C00216.md) | D2 Deny | +| [C00105 Buy more advertising than misinformation creators](../counters/C00105.md) | D03 | +| [C00216 Use advertiser controls to stem flow of funds to bad actors](../counters/C00216.md) | D02 | DO NOT EDIT ABOVE THIS LINE - PLEASE ADD NOTES BELOW \ No newline at end of file diff --git a/actortypes/A024.md b/actortypes/A024.md index fa4f33e..9396a9d 100644 --- a/actortypes/A024.md +++ b/actortypes/A024.md @@ -2,15 +2,15 @@ * **Summary:** -* **Sector:** Other Tech Company +* **Sector:** S008 -* **Viewpoint:** blue +* **Viewpoint:** FW02 | Counters | Response types | | -------- | -------------- | -| [C00011 Media literacy. Games to identify fake news](../counters/C00011.md) | D2 Deny | -| [C00103 Create a bot that engages / distract trolls](../counters/C00103.md) | D5 Deceive | +| [C00011 Media literacy. Games to identify fake news](../counters/C00011.md) | D02 | +| [C00103 Create a bot that engages / distract trolls](../counters/C00103.md) | D05 | DO NOT EDIT ABOVE THIS LINE - PLEASE ADD NOTES BELOW \ No newline at end of file diff --git a/actortypes/A025.md b/actortypes/A025.md index 164ef8f..e1ac0f8 100644 --- a/actortypes/A025.md +++ b/actortypes/A025.md @@ -2,14 +2,14 @@ * **Summary:** Funding site admin -* **Sector:** Other Tech Company +* **Sector:** S008 -* **Viewpoint:** blue +* **Viewpoint:** FW02 | Counters | Response types | | -------- | -------------- | -| [C00155 Ban incident actors from funding sites](../counters/C00155.md) | D2 Deny | +| [C00155 Ban incident actors from funding sites](../counters/C00155.md) | D02 | DO NOT EDIT ABOVE THIS LINE - PLEASE ADD NOTES BELOW \ No newline at end of file diff --git a/actortypes/A026.md b/actortypes/A026.md index a1a3438..8d5ae1b 100644 --- a/actortypes/A026.md +++ b/actortypes/A026.md @@ -2,14 +2,14 @@ * **Summary:** -* **Sector:** Other Tech Company +* **Sector:** S008 -* **Viewpoint:** both +* **Viewpoint:** FW01, FW02 | Counters | Response types | | -------- | -------------- | -| [C00011 Media literacy. Games to identify fake news](../counters/C00011.md) | D2 Deny | +| [C00011 Media literacy. Games to identify fake news](../counters/C00011.md) | D02 | DO NOT EDIT ABOVE THIS LINE - PLEASE ADD NOTES BELOW \ No newline at end of file diff --git a/actortypes/A027.md b/actortypes/A027.md index f50a2b8..24bb83a 100644 --- a/actortypes/A027.md +++ b/actortypes/A027.md @@ -2,15 +2,15 @@ * **Summary:** -* **Sector:** Other Tech Company +* **Sector:** S008 -* **Viewpoint:** blue +* **Viewpoint:** FW02 | Counters | Response types | | -------- | -------------- | -| [C00153 Take pre-emptive action against actors' infrastructure](../counters/C00153.md) | D3 Disrupt | -| [C00182 Redirection / malware detection/ remediation](../counters/C00182.md) | D2 Deny | +| [C00153 Take pre-emptive action against actors' infrastructure](../counters/C00153.md) | D03 | +| [C00182 Redirection / malware detection/ remediation](../counters/C00182.md) | D02 | DO NOT EDIT ABOVE THIS LINE - PLEASE ADD NOTES BELOW \ No newline at end of file diff --git a/actortypes/A028.md b/actortypes/A028.md index 68a5032..f1589ca 100644 --- a/actortypes/A028.md +++ b/actortypes/A028.md @@ -2,15 +2,15 @@ * **Summary:** -* **Sector:** Other Tech Company +* **Sector:** S008 -* **Viewpoint:** blue +* **Viewpoint:** FW02 | Counters | Response types | | -------- | -------------- | -| [C00053 Delete old accounts / Remove unused social media accounts](../counters/C00053.md) | D4 Degrade | -| [C00074 Identify and delete or rate limit identical content](../counters/C00074.md) | D2 Deny | +| [C00053 Delete old accounts / Remove unused social media accounts](../counters/C00053.md) | D04 | +| [C00074 Identify and delete or rate limit identical content](../counters/C00074.md) | D02 | DO NOT EDIT ABOVE THIS LINE - PLEASE ADD NOTES BELOW \ No newline at end of file diff --git a/actortypes/A029.md b/actortypes/A029.md index edf59fa..d46247e 100644 --- a/actortypes/A029.md +++ b/actortypes/A029.md @@ -2,14 +2,14 @@ * **Summary:** -* **Sector:** Other Tech Company +* **Sector:** S008 -* **Viewpoint:** blue +* **Viewpoint:** FW02 | Counters | Response types | | -------- | -------------- | -| [C00131 Seize and analyse botnet servers](../counters/C00131.md) | D2 Deny | +| [C00131 Seize and analyse botnet servers](../counters/C00131.md) | D02 | DO NOT EDIT ABOVE THIS LINE - PLEASE ADD NOTES BELOW \ No newline at end of file diff --git a/actortypes/A030.md b/actortypes/A030.md index 1506171..317b17c 100644 --- a/actortypes/A030.md +++ b/actortypes/A030.md @@ -2,9 +2,9 @@ * **Summary:** -* **Sector:** Social Media Company +* **Sector:** S007 -* **Viewpoint:** blue +* **Viewpoint:** FW02 | Counters | Response types | diff --git a/actortypes/A031.md b/actortypes/A031.md index e304143..c85995b 100644 --- a/actortypes/A031.md +++ b/actortypes/A031.md @@ -2,30 +2,30 @@ * **Summary:** Person with the authority to make changes to algorithms, take down content etc. -* **Sector:** Social Media Company +* **Sector:** S007 -* **Viewpoint:** blue +* **Viewpoint:** FW02 | Counters | Response types | | -------- | -------------- | -| [C00016 Censorship](../counters/C00016.md) | D2 Deny | -| [C00044 Keep people from posting to social media immediately](../counters/C00044.md) | D3 Disrupt | -| [C00053 Delete old accounts / Remove unused social media accounts](../counters/C00053.md) | D4 Degrade | -| [C00074 Identify and delete or rate limit identical content](../counters/C00074.md) | D2 Deny | -| [C00097 Require use of verified identities to contribute to poll or comment](../counters/C00097.md) | D2 Deny | -| [C00098 Revocation of allowlisted or "verified" status](../counters/C00098.md) | D2 Deny | -| [C00099 Strengthen verification methods](../counters/C00099.md) | D2 Deny | -| [C00101 Create friction by rate-limiting engagement](../counters/C00101.md) | D4 Degrade | -| [C00107 Content moderation](../counters/C00107.md) | D2 Deny | -| [C00122 Content moderation](../counters/C00122.md) | D2 Deny | -| [C00133 Deplatform Account*](../counters/C00133.md) | D3 Disrupt | -| [C00135 Deplatform message groups and/or message boards](../counters/C00135.md) | D3 Disrupt | -| [C00142 Platform adds warning label and decision point when sharing content](../counters/C00142.md) | D4 Degrade | -| [C00147 Make amplification of social media posts expire (e.g. can't like/ retweet after n days)](../counters/C00147.md) | D3 Disrupt | -| [C00148 Add random links to network graphs](../counters/C00148.md) | D4 Degrade | -| [C00172 social media source removal](../counters/C00172.md) | D2 Deny | -| [C00197 remove suspicious accounts](../counters/C00197.md) | D2 Deny | +| [C00016 Censorship](../counters/C00016.md) | D02 | +| [C00044 Keep people from posting to social media immediately](../counters/C00044.md) | D03 | +| [C00053 Delete old accounts / Remove unused social media accounts](../counters/C00053.md) | D04 | +| [C00074 Identify and delete or rate limit identical content](../counters/C00074.md) | D02 | +| [C00097 Require use of verified identities to contribute to poll or comment](../counters/C00097.md) | D02 | +| [C00098 Revocation of allowlisted or "verified" status](../counters/C00098.md) | D02 | +| [C00099 Strengthen verification methods](../counters/C00099.md) | D02 | +| [C00101 Create friction by rate-limiting engagement](../counters/C00101.md) | D04 | +| [C00107 Content moderation](../counters/C00107.md) | D02 | +| [C00122 Content moderation](../counters/C00122.md) | D02 | +| [C00133 Deplatform Account*](../counters/C00133.md) | D03 | +| [C00135 Deplatform message groups and/or message boards](../counters/C00135.md) | D03 | +| [C00142 Platform adds warning label and decision point when sharing content](../counters/C00142.md) | D04 | +| [C00147 Make amplification of social media posts expire (e.g. can't like/ retweet after n days)](../counters/C00147.md) | D03 | +| [C00148 Add random links to network graphs](../counters/C00148.md) | D04 | +| [C00172 social media source removal](../counters/C00172.md) | D02 | +| [C00197 remove suspicious accounts](../counters/C00197.md) | D02 | DO NOT EDIT ABOVE THIS LINE - PLEASE ADD NOTES BELOW \ No newline at end of file diff --git a/actortypes/A032.md b/actortypes/A032.md index ecafbc3..7fe1742 100644 --- a/actortypes/A032.md +++ b/actortypes/A032.md @@ -2,14 +2,14 @@ * **Summary:** -* **Sector:** Social Media Company +* **Sector:** S007 -* **Viewpoint:** blue +* **Viewpoint:** FW02 | Counters | Response types | | -------- | -------------- | -| [C00073 Inoculate populations through media literacy training](../counters/C00073.md) | D2 Deny | +| [C00073 Inoculate populations through media literacy training](../counters/C00073.md) | D02 | DO NOT EDIT ABOVE THIS LINE - PLEASE ADD NOTES BELOW \ No newline at end of file diff --git a/actortypes/A033.md b/actortypes/A033.md index 26d16e3..ba200c1 100644 --- a/actortypes/A033.md +++ b/actortypes/A033.md @@ -2,17 +2,17 @@ * **Summary:** Person with authority to make changes to a social media company’s business model -* **Sector:** Social Media Company +* **Sector:** S007 -* **Viewpoint:** blue +* **Viewpoint:** FW02 | Counters | Response types | | -------- | -------------- | -| [C00006 Charge for social media](../counters/C00006.md) | D2 Deny | -| [C00012 Platform regulation](../counters/C00012.md) | D2 Deny | -| [C00205 strong dialogue between the federal government and private sector to encourage better reporting](../counters/C00205.md) | D3 Disrupt | -| [C00207 Run a competing disinformation campaign - not recommended](../counters/C00207.md) | D7 Deter | +| [C00006 Charge for social media](../counters/C00006.md) | D02 | +| [C00012 Platform regulation](../counters/C00012.md) | D02 | +| [C00205 strong dialogue between the federal government and private sector to encourage better reporting](../counters/C00205.md) | D03 | +| [C00207 Run a competing disinformation campaign - not recommended](../counters/C00207.md) | D07 | DO NOT EDIT ABOVE THIS LINE - PLEASE ADD NOTES BELOW \ No newline at end of file diff --git a/actortypes_index.md b/actortypes_index.md index 132b606..72a5aae 100644 --- a/actortypes_index.md +++ b/actortypes_index.md @@ -5,204 +5,204 @@ amitt_id name summary -sector +sector_ids A001 data scientist Person who can wrangle data, implement machine learning algorithms etc -All +S001, S002, S003, S004, S005, S006, S007, S008, S009, S010 A002 target Person being targeted by disinformation campaign -All +S001, S002, S003, S004, S005, S006, S007, S008, S009, S010 A003 trusted authority Influencer -All +S001, S002, S003, S004, S005, S006, S007, S008, S009, S010 A004 activist -Civil Society +S002 A005 community group -Civil Society +S002 A006 educator -Civil Society +S002 A007 factchecker Someone with the skills to verify whether information posted is factual -Civil Society +S002 A008 library -Civil Society +S002 A009 NGO -Civil Society +S002 A010 religious organisation -Civil Society +S002 A011 school -Civil Society +S002 A012 account owner Anyone who owns an account online -General Public +S006 A013 content creator -General Public +S006 A014 elves -General Public +S006 A015 general public -General Public +S006 A016 influencer -General Public +S006 A017 coordinating body For example the DHS -Government +S003 A018 government Government agencies -Government +S003 A019 military -Government +S003 A020 policy maker -Government +S003 A021 media organisation -Media +S010 A022 company -Other Company +S009 A023 adtech provider -Other Tech Company +S008 A024 developer -Other Tech Company +S008 A025 funding_site_admin Funding site admin -Other Tech Company +S008 A026 games designer -Other Tech Company +S008 A027 information security -Other Tech Company +S008 A028 platform administrator -Other Tech Company +S008 A029 server admininistrator -Other Tech Company +S008 A030 platforms -Social Media Company +S007 A031 social media platform adminstrator Person with the authority to make changes to algorithms, take down content etc. -Social Media Company +S007 A032 social media platform outreach -Social Media Company +S007 A033 social media platform owner Person with authority to make changes to a social media company’s business model -Social Media Company +S007 diff --git a/counters/C00006.md b/counters/C00006.md index dcca00b..b2a429d 100644 --- a/counters/C00006.md +++ b/counters/C00006.md @@ -13,7 +13,7 @@ | Actor types | Sectors | | ----------- | ------- | -| [A033 social media platform owner](../actortypes/A033.md) | Social Media Company | +| [A033 social media platform owner](../actortypes/A033.md) | S007 | diff --git a/counters/C00008.md b/counters/C00008.md index d1b6c7b..6004c65 100644 --- a/counters/C00008.md +++ b/counters/C00008.md @@ -13,7 +13,7 @@ | Actor types | Sectors | | ----------- | ------- | -| [A007 factchecker](../actortypes/A007.md) | Civil Society | +| [A007 factchecker](../actortypes/A007.md) | S002 | diff --git a/counters/C00009.md b/counters/C00009.md index 5f4b114..7c6c6f4 100644 --- a/counters/C00009.md +++ b/counters/C00009.md @@ -13,8 +13,8 @@ | Actor types | Sectors | | ----------- | ------- | -| [A006 educator](../actortypes/A006.md) | Civil Society | -| [A016 influencer](../actortypes/A016.md) | General Public | +| [A006 educator](../actortypes/A006.md) | S002 | +| [A016 influencer](../actortypes/A016.md) | S006 | diff --git a/counters/C00010.md b/counters/C00010.md index 3bf4e2e..702ef32 100644 --- a/counters/C00010.md +++ b/counters/C00010.md @@ -13,7 +13,7 @@ | Actor types | Sectors | | ----------- | ------- | -| [A020 policy maker](../actortypes/A020.md) | Government | +| [A020 policy maker](../actortypes/A020.md) | S003 | diff --git a/counters/C00011.md b/counters/C00011.md index d43f327..319d205 100644 --- a/counters/C00011.md +++ b/counters/C00011.md @@ -13,9 +13,9 @@ | Actor types | Sectors | | ----------- | ------- | -| [A006 educator](../actortypes/A006.md) | Civil Society | -| [A024 developer](../actortypes/A024.md) | Other Tech Company | -| [A026 games designer](../actortypes/A026.md) | Other Tech Company | +| [A006 educator](../actortypes/A006.md) | S002 | +| [A024 developer](../actortypes/A024.md) | S008 | +| [A026 games designer](../actortypes/A026.md) | S008 | diff --git a/counters/C00012.md b/counters/C00012.md index a347d44..f03a0c1 100644 --- a/counters/C00012.md +++ b/counters/C00012.md @@ -13,9 +13,9 @@ | Actor types | Sectors | | ----------- | ------- | -| [A018 government ](../actortypes/A018.md) | Government | -| [A020 policy maker](../actortypes/A020.md) | Government | -| [A033 social media platform owner](../actortypes/A033.md) | Social Media Company | +| [A018 government ](../actortypes/A018.md) | S003 | +| [A020 policy maker](../actortypes/A020.md) | S003 | +| [A033 social media platform owner](../actortypes/A033.md) | S007 | diff --git a/counters/C00014.md b/counters/C00014.md index 2b32400..e39784b 100644 --- a/counters/C00014.md +++ b/counters/C00014.md @@ -13,7 +13,7 @@ | Actor types | Sectors | | ----------- | ------- | -| [A007 factchecker](../actortypes/A007.md) | Civil Society | +| [A007 factchecker](../actortypes/A007.md) | S002 | diff --git a/counters/C00016.md b/counters/C00016.md index ba8cf95..0f1f7e2 100644 --- a/counters/C00016.md +++ b/counters/C00016.md @@ -13,7 +13,7 @@ | Actor types | Sectors | | ----------- | ------- | -| [A031 social media platform adminstrator](../actortypes/A031.md) | Social Media Company | +| [A031 social media platform adminstrator](../actortypes/A031.md) | S007 | diff --git a/counters/C00017.md b/counters/C00017.md index ba55e2d..819c096 100644 --- a/counters/C00017.md +++ b/counters/C00017.md @@ -13,7 +13,7 @@ | Actor types | Sectors | | ----------- | ------- | -| [A021 media organisation](../actortypes/A021.md) | Media | +| [A021 media organisation](../actortypes/A021.md) | S010 | diff --git a/counters/C00044.md b/counters/C00044.md index f74106d..d7c7919 100644 --- a/counters/C00044.md +++ b/counters/C00044.md @@ -13,7 +13,7 @@ | Actor types | Sectors | | ----------- | ------- | -| [A031 social media platform adminstrator](../actortypes/A031.md) | Social Media Company | +| [A031 social media platform adminstrator](../actortypes/A031.md) | S007 | diff --git a/counters/C00051.md b/counters/C00051.md index 7fd00b1..f3a44b7 100644 --- a/counters/C00051.md +++ b/counters/C00051.md @@ -13,7 +13,7 @@ | Actor types | Sectors | | ----------- | ------- | -| [A006 educator](../actortypes/A006.md) | Civil Society | +| [A006 educator](../actortypes/A006.md) | S002 | diff --git a/counters/C00052.md b/counters/C00052.md index 87f780e..406fb57 100644 --- a/counters/C00052.md +++ b/counters/C00052.md @@ -13,7 +13,7 @@ | Actor types | Sectors | | ----------- | ------- | -| [A004 activist](../actortypes/A004.md) | Civil Society | +| [A004 activist](../actortypes/A004.md) | S002 | diff --git a/counters/C00053.md b/counters/C00053.md index 6724956..f8929ee 100644 --- a/counters/C00053.md +++ b/counters/C00053.md @@ -13,9 +13,9 @@ | Actor types | Sectors | | ----------- | ------- | -| [A012 account owner](../actortypes/A012.md) | General Public | -| [A028 platform administrator](../actortypes/A028.md) | Other Tech Company | -| [A031 social media platform adminstrator](../actortypes/A031.md) | Social Media Company | +| [A012 account owner](../actortypes/A012.md) | S006 | +| [A028 platform administrator](../actortypes/A028.md) | S008 | +| [A031 social media platform adminstrator](../actortypes/A031.md) | S007 | diff --git a/counters/C00060.md b/counters/C00060.md index 7f3a715..d9beb92 100644 --- a/counters/C00060.md +++ b/counters/C00060.md @@ -13,7 +13,7 @@ | Actor types | Sectors | | ----------- | ------- | -| [A020 policy maker](../actortypes/A020.md) | Government | +| [A020 policy maker](../actortypes/A020.md) | S003 | diff --git a/counters/C00065.md b/counters/C00065.md index e837b23..f176596 100644 --- a/counters/C00065.md +++ b/counters/C00065.md @@ -13,7 +13,7 @@ | Actor types | Sectors | | ----------- | ------- | -| [A020 policy maker](../actortypes/A020.md) | Government | +| [A020 policy maker](../actortypes/A020.md) | S003 | diff --git a/counters/C00073.md b/counters/C00073.md index 2a6052d..5e16b39 100644 --- a/counters/C00073.md +++ b/counters/C00073.md @@ -13,14 +13,14 @@ | Actor types | Sectors | | ----------- | ------- | -| [A005 community group](../actortypes/A005.md) | Civil Society | -| [A006 educator](../actortypes/A006.md) | Civil Society | -| [A008 library](../actortypes/A008.md) | Civil Society | -| [A009 NGO](../actortypes/A009.md) | Civil Society | -| [A010 religious organisation ](../actortypes/A010.md) | Civil Society | -| [A017 coordinating body](../actortypes/A017.md) | Government | -| [A021 media organisation](../actortypes/A021.md) | Media | -| [A032 social media platform outreach ](../actortypes/A032.md) | Social Media Company | +| [A005 community group](../actortypes/A005.md) | S002 | +| [A006 educator](../actortypes/A006.md) | S002 | +| [A008 library](../actortypes/A008.md) | S002 | +| [A009 NGO](../actortypes/A009.md) | S002 | +| [A010 religious organisation ](../actortypes/A010.md) | S002 | +| [A017 coordinating body](../actortypes/A017.md) | S003 | +| [A021 media organisation](../actortypes/A021.md) | S010 | +| [A032 social media platform outreach ](../actortypes/A032.md) | S007 | diff --git a/counters/C00074.md b/counters/C00074.md index 9313c72..8dc170b 100644 --- a/counters/C00074.md +++ b/counters/C00074.md @@ -1,6 +1,6 @@ # Counter C00074: Identify and delete or rate limit identical content -* **Summary**: Search for repeated content (text, images, videos etc); check for misinformation, rate-limit or delete repeats. +* **Summary**: C00000 * **Playbooks**: @@ -13,8 +13,8 @@ | Actor types | Sectors | | ----------- | ------- | -| [A028 platform administrator](../actortypes/A028.md) | Other Tech Company | -| [A031 social media platform adminstrator](../actortypes/A031.md) | Social Media Company | +| [A028 platform administrator](../actortypes/A028.md) | S008 | +| [A031 social media platform adminstrator](../actortypes/A031.md) | S007 | diff --git a/counters/C00092.md b/counters/C00092.md index c30523f..79633c0 100644 --- a/counters/C00092.md +++ b/counters/C00092.md @@ -13,7 +13,7 @@ | Actor types | Sectors | | ----------- | ------- | -| [A001 data scientist ](../actortypes/A001.md) | All | +| [A001 data scientist ](../actortypes/A001.md) | S001, S002, S003, S004, S005, S006, S007, S008, S009, S010 | diff --git a/counters/C00097.md b/counters/C00097.md index aaf5caa..25d829f 100644 --- a/counters/C00097.md +++ b/counters/C00097.md @@ -13,7 +13,7 @@ | Actor types | Sectors | | ----------- | ------- | -| [A031 social media platform adminstrator](../actortypes/A031.md) | Social Media Company | +| [A031 social media platform adminstrator](../actortypes/A031.md) | S007 | diff --git a/counters/C00098.md b/counters/C00098.md index 4af43ab..2a230dd 100644 --- a/counters/C00098.md +++ b/counters/C00098.md @@ -13,7 +13,7 @@ | Actor types | Sectors | | ----------- | ------- | -| [A031 social media platform adminstrator](../actortypes/A031.md) | Social Media Company | +| [A031 social media platform adminstrator](../actortypes/A031.md) | S007 | diff --git a/counters/C00099.md b/counters/C00099.md index e5d5c07..4379ad4 100644 --- a/counters/C00099.md +++ b/counters/C00099.md @@ -13,7 +13,7 @@ | Actor types | Sectors | | ----------- | ------- | -| [A031 social media platform adminstrator](../actortypes/A031.md) | Social Media Company | +| [A031 social media platform adminstrator](../actortypes/A031.md) | S007 | diff --git a/counters/C00101.md b/counters/C00101.md index 01aed9d..3ae2b74 100644 --- a/counters/C00101.md +++ b/counters/C00101.md @@ -13,7 +13,7 @@ | Actor types | Sectors | | ----------- | ------- | -| [A031 social media platform adminstrator](../actortypes/A031.md) | Social Media Company | +| [A031 social media platform adminstrator](../actortypes/A031.md) | S007 | diff --git a/counters/C00103.md b/counters/C00103.md index 8bbc6a4..c268382 100644 --- a/counters/C00103.md +++ b/counters/C00103.md @@ -13,7 +13,7 @@ | Actor types | Sectors | | ----------- | ------- | -| [A024 developer](../actortypes/A024.md) | Other Tech Company | +| [A024 developer](../actortypes/A024.md) | S008 | diff --git a/counters/C00105.md b/counters/C00105.md index 3963fcd..747ba50 100644 --- a/counters/C00105.md +++ b/counters/C00105.md @@ -13,7 +13,7 @@ | Actor types | Sectors | | ----------- | ------- | -| [A023 adtech provider](../actortypes/A023.md) | Other Tech Company | +| [A023 adtech provider](../actortypes/A023.md) | S008 | diff --git a/counters/C00107.md b/counters/C00107.md index a8bb8f7..7272596 100644 --- a/counters/C00107.md +++ b/counters/C00107.md @@ -13,7 +13,7 @@ | Actor types | Sectors | | ----------- | ------- | -| [A031 social media platform adminstrator](../actortypes/A031.md) | Social Media Company | +| [A031 social media platform adminstrator](../actortypes/A031.md) | S007 | diff --git a/counters/C00111.md b/counters/C00111.md index 9e858f7..d313eeb 100644 --- a/counters/C00111.md +++ b/counters/C00111.md @@ -13,8 +13,8 @@ | Actor types | Sectors | | ----------- | ------- | -| [A013 content creator ](../actortypes/A013.md) | General Public | -| [A021 media organisation](../actortypes/A021.md) | Media | +| [A013 content creator ](../actortypes/A013.md) | S006 | +| [A021 media organisation](../actortypes/A021.md) | S010 | diff --git a/counters/C00114.md b/counters/C00114.md index 5b9c1ae..6602db1 100644 --- a/counters/C00114.md +++ b/counters/C00114.md @@ -13,7 +13,7 @@ | Actor types | Sectors | | ----------- | ------- | -| [A015 general public](../actortypes/A015.md) | General Public | +| [A015 general public](../actortypes/A015.md) | S006 | diff --git a/counters/C00122.md b/counters/C00122.md index f7a5d50..1b94b8e 100644 --- a/counters/C00122.md +++ b/counters/C00122.md @@ -13,7 +13,7 @@ | Actor types | Sectors | | ----------- | ------- | -| [A031 social media platform adminstrator](../actortypes/A031.md) | Social Media Company | +| [A031 social media platform adminstrator](../actortypes/A031.md) | S007 | diff --git a/counters/C00124.md b/counters/C00124.md index 5a7af1b..c0182dd 100644 --- a/counters/C00124.md +++ b/counters/C00124.md @@ -13,8 +13,8 @@ | Actor types | Sectors | | ----------- | ------- | -| [A015 general public](../actortypes/A015.md) | General Public | -| [A021 media organisation](../actortypes/A021.md) | Media | +| [A015 general public](../actortypes/A015.md) | S006 | +| [A021 media organisation](../actortypes/A021.md) | S010 | diff --git a/counters/C00128.md b/counters/C00128.md index a7c9c34..8ace10b 100644 --- a/counters/C00128.md +++ b/counters/C00128.md @@ -13,7 +13,7 @@ | Actor types | Sectors | | ----------- | ------- | -| [A003 trusted authority ](../actortypes/A003.md) | All | +| [A003 trusted authority ](../actortypes/A003.md) | S001, S002, S003, S004, S005, S006, S007, S008, S009, S010 | diff --git a/counters/C00131.md b/counters/C00131.md index a8d7bda..e43b842 100644 --- a/counters/C00131.md +++ b/counters/C00131.md @@ -13,7 +13,7 @@ | Actor types | Sectors | | ----------- | ------- | -| [A029 server admininistrator ](../actortypes/A029.md) | Other Tech Company | +| [A029 server admininistrator ](../actortypes/A029.md) | S008 | diff --git a/counters/C00133.md b/counters/C00133.md index 9222bd2..054e93c 100644 --- a/counters/C00133.md +++ b/counters/C00133.md @@ -13,7 +13,7 @@ | Actor types | Sectors | | ----------- | ------- | -| [A031 social media platform adminstrator](../actortypes/A031.md) | Social Media Company | +| [A031 social media platform adminstrator](../actortypes/A031.md) | S007 | diff --git a/counters/C00135.md b/counters/C00135.md index 387d96c..f87924d 100644 --- a/counters/C00135.md +++ b/counters/C00135.md @@ -13,7 +13,7 @@ | Actor types | Sectors | | ----------- | ------- | -| [A031 social media platform adminstrator](../actortypes/A031.md) | Social Media Company | +| [A031 social media platform adminstrator](../actortypes/A031.md) | S007 | diff --git a/counters/C00142.md b/counters/C00142.md index 6ec17aa..408ee1a 100644 --- a/counters/C00142.md +++ b/counters/C00142.md @@ -13,7 +13,7 @@ | Actor types | Sectors | | ----------- | ------- | -| [A031 social media platform adminstrator](../actortypes/A031.md) | Social Media Company | +| [A031 social media platform adminstrator](../actortypes/A031.md) | S007 | diff --git a/counters/C00143.md b/counters/C00143.md index 4179e21..e5b4425 100644 --- a/counters/C00143.md +++ b/counters/C00143.md @@ -13,8 +13,8 @@ | Actor types | Sectors | | ----------- | ------- | -| [A014 elves](../actortypes/A014.md) | General Public | -| [A015 general public](../actortypes/A015.md) | General Public | +| [A014 elves](../actortypes/A014.md) | S006 | +| [A015 general public](../actortypes/A015.md) | S006 | diff --git a/counters/C00147.md b/counters/C00147.md index 6565f08..7fa0288 100644 --- a/counters/C00147.md +++ b/counters/C00147.md @@ -13,7 +13,7 @@ | Actor types | Sectors | | ----------- | ------- | -| [A031 social media platform adminstrator](../actortypes/A031.md) | Social Media Company | +| [A031 social media platform adminstrator](../actortypes/A031.md) | S007 | diff --git a/counters/C00148.md b/counters/C00148.md index 8e99678..5473d77 100644 --- a/counters/C00148.md +++ b/counters/C00148.md @@ -13,7 +13,7 @@ | Actor types | Sectors | | ----------- | ------- | -| [A031 social media platform adminstrator](../actortypes/A031.md) | Social Media Company | +| [A031 social media platform adminstrator](../actortypes/A031.md) | S007 | diff --git a/counters/C00153.md b/counters/C00153.md index 5e01adf..e557aa1 100644 --- a/counters/C00153.md +++ b/counters/C00153.md @@ -13,7 +13,7 @@ | Actor types | Sectors | | ----------- | ------- | -| [A027 information security](../actortypes/A027.md) | Other Tech Company | +| [A027 information security](../actortypes/A027.md) | S008 | diff --git a/counters/C00154.md b/counters/C00154.md index 11b162b..04f73bc 100644 --- a/counters/C00154.md +++ b/counters/C00154.md @@ -13,7 +13,7 @@ | Actor types | Sectors | | ----------- | ------- | -| [A021 media organisation](../actortypes/A021.md) | Media | +| [A021 media organisation](../actortypes/A021.md) | S010 | diff --git a/counters/C00155.md b/counters/C00155.md index d73c1bc..0474b13 100644 --- a/counters/C00155.md +++ b/counters/C00155.md @@ -13,7 +13,7 @@ | Actor types | Sectors | | ----------- | ------- | -| [A025 funding_site_admin](../actortypes/A025.md) | Other Tech Company | +| [A025 funding_site_admin](../actortypes/A025.md) | S008 | diff --git a/counters/C00156.md b/counters/C00156.md index dd97f7f..3aed16a 100644 --- a/counters/C00156.md +++ b/counters/C00156.md @@ -13,8 +13,8 @@ | Actor types | Sectors | | ----------- | ------- | -| [A018 government ](../actortypes/A018.md) | Government | -| [A019 military ](../actortypes/A019.md) | Government | +| [A018 government ](../actortypes/A018.md) | S003 | +| [A019 military ](../actortypes/A019.md) | S003 | diff --git a/counters/C00160.md b/counters/C00160.md index 1104694..5b5f522 100644 --- a/counters/C00160.md +++ b/counters/C00160.md @@ -13,8 +13,8 @@ | Actor types | Sectors | | ----------- | ------- | -| [A001 data scientist ](../actortypes/A001.md) | All | -| [A016 influencer](../actortypes/A016.md) | General Public | +| [A001 data scientist ](../actortypes/A001.md) | S001, S002, S003, S004, S005, S006, S007, S008, S009, S010 | +| [A016 influencer](../actortypes/A016.md) | S006 | diff --git a/counters/C00172.md b/counters/C00172.md index 8e03294..5dfebf4 100644 --- a/counters/C00172.md +++ b/counters/C00172.md @@ -13,7 +13,7 @@ | Actor types | Sectors | | ----------- | ------- | -| [A031 social media platform adminstrator](../actortypes/A031.md) | Social Media Company | +| [A031 social media platform adminstrator](../actortypes/A031.md) | S007 | diff --git a/counters/C00174.md b/counters/C00174.md index eda7a87..0d690b0 100644 --- a/counters/C00174.md +++ b/counters/C00174.md @@ -13,7 +13,7 @@ | Actor types | Sectors | | ----------- | ------- | -| [A021 media organisation](../actortypes/A021.md) | Media | +| [A021 media organisation](../actortypes/A021.md) | S010 | diff --git a/counters/C00182.md b/counters/C00182.md index 49f3f63..a987b62 100644 --- a/counters/C00182.md +++ b/counters/C00182.md @@ -13,7 +13,7 @@ | Actor types | Sectors | | ----------- | ------- | -| [A027 information security](../actortypes/A027.md) | Other Tech Company | +| [A027 information security](../actortypes/A027.md) | S008 | diff --git a/counters/C00188.md b/counters/C00188.md index d2338be..b36e2c1 100644 --- a/counters/C00188.md +++ b/counters/C00188.md @@ -13,8 +13,8 @@ | Actor types | Sectors | | ----------- | ------- | -| [A006 educator](../actortypes/A006.md) | Civil Society | -| [A021 media organisation](../actortypes/A021.md) | Media | +| [A006 educator](../actortypes/A006.md) | S002 | +| [A021 media organisation](../actortypes/A021.md) | S010 | diff --git a/counters/C00190.md b/counters/C00190.md index 5c5ce6e..13f8f29 100644 --- a/counters/C00190.md +++ b/counters/C00190.md @@ -13,7 +13,7 @@ | Actor types | Sectors | | ----------- | ------- | -| [A015 general public](../actortypes/A015.md) | General Public | +| [A015 general public](../actortypes/A015.md) | S006 | diff --git a/counters/C00197.md b/counters/C00197.md index be229b5..2b21630 100644 --- a/counters/C00197.md +++ b/counters/C00197.md @@ -13,8 +13,8 @@ | Actor types | Sectors | | ----------- | ------- | -| [A004 activist](../actortypes/A004.md) | Civil Society | -| [A031 social media platform adminstrator](../actortypes/A031.md) | Social Media Company | +| [A004 activist](../actortypes/A004.md) | S002 | +| [A031 social media platform adminstrator](../actortypes/A031.md) | S007 | diff --git a/counters/C00200.md b/counters/C00200.md index ac982c5..b09d886 100644 --- a/counters/C00200.md +++ b/counters/C00200.md @@ -13,7 +13,7 @@ | Actor types | Sectors | | ----------- | ------- | -| [A016 influencer](../actortypes/A016.md) | General Public | +| [A016 influencer](../actortypes/A016.md) | S006 | diff --git a/counters/C00203.md b/counters/C00203.md index cb83001..c8e1ab7 100644 --- a/counters/C00203.md +++ b/counters/C00203.md @@ -13,7 +13,7 @@ | Actor types | Sectors | | ----------- | ------- | -| [A018 government ](../actortypes/A018.md) | Government | +| [A018 government ](../actortypes/A018.md) | S003 | diff --git a/counters/C00205.md b/counters/C00205.md index f857ba5..72a0f7f 100644 --- a/counters/C00205.md +++ b/counters/C00205.md @@ -13,8 +13,8 @@ | Actor types | Sectors | | ----------- | ------- | -| [A018 government ](../actortypes/A018.md) | Government | -| [A033 social media platform owner](../actortypes/A033.md) | Social Media Company | +| [A018 government ](../actortypes/A018.md) | S003 | +| [A033 social media platform owner](../actortypes/A033.md) | S007 | diff --git a/counters/C00207.md b/counters/C00207.md index bcc8620..ec3c783 100644 --- a/counters/C00207.md +++ b/counters/C00207.md @@ -13,8 +13,8 @@ | Actor types | Sectors | | ----------- | ------- | -| [A018 government ](../actortypes/A018.md) | Government | -| [A033 social media platform owner](../actortypes/A033.md) | Social Media Company | +| [A018 government ](../actortypes/A018.md) | S003 | +| [A033 social media platform owner](../actortypes/A033.md) | S007 | diff --git a/counters/C00212.md b/counters/C00212.md index 11b1f09..66f771d 100644 --- a/counters/C00212.md +++ b/counters/C00212.md @@ -13,8 +13,8 @@ | Actor types | Sectors | | ----------- | ------- | -| [A006 educator](../actortypes/A006.md) | Civil Society | -| [A018 government ](../actortypes/A018.md) | Government | +| [A006 educator](../actortypes/A006.md) | S002 | +| [A018 government ](../actortypes/A018.md) | S003 | diff --git a/counters/C00216.md b/counters/C00216.md index 31133c2..4dc90c2 100644 --- a/counters/C00216.md +++ b/counters/C00216.md @@ -13,7 +13,7 @@ | Actor types | Sectors | | ----------- | ------- | -| [A023 adtech provider](../actortypes/A023.md) | Other Tech Company | +| [A023 adtech provider](../actortypes/A023.md) | S008 | diff --git a/counters_index.md b/counters_index.md index 818024f..012b3dc 100644 --- a/counters_index.md +++ b/counters_index.md @@ -15,7 +15,7 @@ Include a paid-for privacy option, e.g. pay Facebook for an option of them not collecting your personal information. There are examples of this not work, e.g. most people don’t use proton mail etc. M004 - friction TA01 Strategic Planning -D2 Deny +D02 C00008 @@ -23,7 +23,7 @@ Share fact-checking resources - tips, responses, countermessages, across respose groups. Snopes is best-known example of fact-checking sites. M006 - scoring TA01 Strategic Planning -D4 Degrade +D04 C00009 @@ -31,7 +31,7 @@ Find online influencers. Provide training in the mechanisms of disinformation, how to spot campaigns, and/or how to contribute to responses by countermessaging, boosting information sites etc. M001 - resilience TA02 Objective Planning -D2 Deny +D02 C00010 @@ -39,7 +39,7 @@ Implement stronger privacy standards, to reduce the ability to microtarget community members. M004 - friction TA01 Strategic Planning -D2 Deny +D02 C00011 @@ -47,7 +47,7 @@ Create and use games to show people the mechanics of disinformation, and how to counter them. M001 - resilience TA02 Objective Planning -D2 Deny +D02 C00012 @@ -55,7 +55,7 @@ Empower existing regulators to govern social media. Also covers Destroy. Includes: Include the role of social media in the regulatory framework for media - The European Union created significant new regulations in 2018; the U.S. approach will need to be carefully crafted to protect First Amendment principles, create needed transparency, ensure liability, and impose costs for noncompliance. Includes Create policy that makes social media police disinformation - example: German model: facebook forced to police content by law. Includes: Use fraud legislation to clean up social media M007 - metatechnique TA01 Strategic Planning -D2 Deny +D02 C00013 @@ -63,7 +63,7 @@ This is "strategic innoculation", raising the standards of what people expect in terms of evidence when consuming news. Example: journalistic ethics, or journalistic licensing body. Include full transcripts, link source, add items. M006 - scoring TA01 Strategic Planning -D2 Deny +D02 C00014 @@ -71,7 +71,7 @@ Update fact-checking databases and resources in real time. Especially import for time-limited events like natural disasters. Existing examples at Buzzfeed and Fema. M006 - scoring TA06 Develop Content -D4 Degrade +D04 C00016 @@ -79,7 +79,7 @@ Alter and/or block the publication/dissemination of information controlled by disinformation creators. Not recommended. M005 - removal TA01 Strategic Planning -D2 Deny +D02 C00017 @@ -87,7 +87,7 @@ For example, use a media campaign to promote in-group to out-group in person communication / activities . Technique could be in terms of forcing a reality-check by talking to people instead of reading about bogeymen. M010 - countermessaging TA01 Strategic Planning -D3 Disrupt +D03 C00019 @@ -95,7 +95,7 @@ includes Promote constructive communication by shaming division-enablers, and Promote playbooks to call out division-enablers M003 - daylight TA01 Strategic Planning -D3 Disrupt +D03 C00021 @@ -103,7 +103,7 @@ Encourage offline communication M001 - resilience TA01 Strategic Planning -D4 Degrade +D04 C00022 @@ -111,7 +111,7 @@ Used to counter ability based and fear based attacks M001 - resilience TA01 Strategic Planning -D4 Degrade +D04 C00024 @@ -119,7 +119,7 @@ Includes promoting constructive narratives i.e. not polarising (e.g. pro-life, pro-choice, pro-USA). Includes promoting identity neutral narratives. M001 - resilience TA01 Strategic Planning -D4 Degrade +D04 C00026 @@ -127,7 +127,7 @@ Messages about e.g. peace, freedom. And make it sexy. Includes Deploy Information and Narrative-Building in Service of Statecraft: Promote a narrative of transparency, truthfulness, liberal values, and democracy. Implement a compelling narrative via effective mechanisms of communication. Continually reassess U.S. messages, mechanisms, and audiences over time. Counteract efforts to manipulate media, undermine free markets, and suppress political freedoms via public diplomacy M010 - countermessaging TA01 Strategic Planning -D4 Degrade +D04 C00027 @@ -135,7 +135,7 @@ This is passive. Includes promoting civility as an identity that people will defend. M001 - resilience TA01 Strategic Planning -D7 Deter +D07 C00028 @@ -145,7 +145,7 @@ This could be used to adjust upvote weight via a trust factor of people and organisations you trust, or other criteria. M011 - verification TA02 Objective Planning -D3 Disrupt +D03 C00029 @@ -153,7 +153,7 @@ This could be used to adjust upvote weight via a trust factor of people and orga Create websites in disinformation voids - spaces where people are looking for known disinformation. M002 - diversion TA02 Objective Planning -D3 Disrupt +D03 C00030 @@ -162,7 +162,7 @@ This could be used to adjust upvote weight via a trust factor of people and orga https://www.isdglobal.org/wp-content/uploads/2016/06/Counter-narrative-Handbook_1.pdf M002 - diversion TA02 Objective Planning -D3 Disrupt +D03 C00031 @@ -170,7 +170,7 @@ https://www.isdglobal.org/wp-content/uploads/2016/06/Counter-narrative-Handbook_ Create competing narratives. Included "Facilitate State Propaganda" as diluting the narrative could have an effect on the pro-state narrative used by volunteers, or lower their involvement. M009 - dilution TA02 Objective Planning -D3 Disrupt +D03 C00032 @@ -178,7 +178,7 @@ https://www.isdglobal.org/wp-content/uploads/2016/06/Counter-narrative-Handbook_ Link to platform M002 - diversion TA06 Develop Content -D3 Disrupt +D03 C00034 @@ -186,7 +186,7 @@ https://www.isdglobal.org/wp-content/uploads/2016/06/Counter-narrative-Handbook_ Counters fake account M004 - friction TA03 Develop People -D4 Degrade +D04 C00036 @@ -194,7 +194,7 @@ https://www.isdglobal.org/wp-content/uploads/2016/06/Counter-narrative-Handbook_ All of these would be highly affected by infiltration or false-claims of infiltration. M013 - targeting TA03 Develop People -D2 Deny +D02 C00040 @@ -202,7 +202,7 @@ https://www.isdglobal.org/wp-content/uploads/2016/06/Counter-narrative-Handbook_ counters fake experts M011 - verification TA03 Develop People -D2 Deny +D02 C00042 @@ -210,7 +210,7 @@ https://www.isdglobal.org/wp-content/uploads/2016/06/Counter-narrative-Handbook_ Focus on and boost truths in misinformation narratives, removing misinformation from them. M010 - countermessaging TA03 Develop People -D4 Degrade +D04 C00044 @@ -218,7 +218,7 @@ https://www.isdglobal.org/wp-content/uploads/2016/06/Counter-narrative-Handbook_ Platforms can introduce friction to slow down activities, force a small delay between posts, or replies to posts. M004 - friction TA03 Develop People -D3 Disrupt +D03 C00046 @@ -226,7 +226,7 @@ https://www.isdglobal.org/wp-content/uploads/2016/06/Counter-narrative-Handbook_ Reduce the credibility of extremist groups posting misinformation. M013 - targeting TA03 Develop People -D4 Degrade +D04 C00047 @@ -234,7 +234,7 @@ https://www.isdglobal.org/wp-content/uploads/2016/06/Counter-narrative-Handbook_ Flood disinformation spaces with obviously fake content, to dilute core misinformation narratives in them. M008 - data pollution TA04 Develop Networks -D5 Deceive +D05 C00048 @@ -242,7 +242,7 @@ https://www.isdglobal.org/wp-content/uploads/2016/06/Counter-narrative-Handbook_ Think about the different levels: individual vs state-sponsored account. Includes “call them out” and “name and shame”. Note that USAID operations were at a different level. Identify social media accounts as sources of propaganda—“calling them out”— might be helpful to prevent the spread of their message to audiences that otherwise would consider them factual. USAID has been restructuring its programs to address predatory Chinese development projects and the information operations that support them. USAID’s new strategy has tailored programs to counter Chinese educational exchange programs and to support free and fair elections, youth empowerment, democratic governance, and free press. USAID’s Russia regional teams have also been compiling a strategy for Russia’s information operations. One strong point of USAID’s programming is a system of indicators and measurements for a country’s vulnerability to foreign influence and information operations. Identify, monitor, and, if necessary, target externally-based nonattributed social media accounts. Impact of and Dealing with Trolls - "Chatham House has observed that trolls also sometimes function as decoys, as a way of “keeping the infantry busy” that “aims to wear down the other side” (Lough et al., 2014). Another type of troll involves “false accounts posing as authoritative information sources on social media”. M003 - daylight TA03 Develop People -D7 Deter +D07 C00051 @@ -250,7 +250,7 @@ https://www.isdglobal.org/wp-content/uploads/2016/06/Counter-narrative-Handbook_ Includes anti-elicitation training, phishing prevention education. M001 - resilience TA03 Develop People -D2 Deny +D02 C00052 @@ -258,7 +258,7 @@ https://www.isdglobal.org/wp-content/uploads/2016/06/Counter-narrative-Handbook_ Detect and degrade M013 - targeting TA04 Develop Networks -D4 Degrade +D04 C00053 @@ -266,7 +266,7 @@ https://www.isdglobal.org/wp-content/uploads/2016/06/Counter-narrative-Handbook_ remove or remove access to (e.g. stop the ability to update) old social media accounts, to reduce the pool of accounts available for takeover, botnets etc. M012 - cleaning TA04 Develop Networks -D4 Degrade +D04 C00056 @@ -274,7 +274,7 @@ https://www.isdglobal.org/wp-content/uploads/2016/06/Counter-narrative-Handbook_ Encourage people to leave spcial media. We don't expect this to work M004 - friction TA04 Develop Networks -D2 Deny +D02 C00058 @@ -282,7 +282,7 @@ https://www.isdglobal.org/wp-content/uploads/2016/06/Counter-narrative-Handbook_ counters crowdfunding. Includes ‘Expose online funding as fake”. M005 - removal TA03 Develop People -D2 Deny +D02 C00059 @@ -290,7 +290,7 @@ https://www.isdglobal.org/wp-content/uploads/2016/06/Counter-narrative-Handbook_ third-party verification of projects posting funding campaigns before those campaigns can be posted. M011 - verification TA04 Develop Networks -D2 Deny +D02 C00060 @@ -298,7 +298,7 @@ https://www.isdglobal.org/wp-content/uploads/2016/06/Counter-narrative-Handbook_ Take legal action against for-profit "factories" creating misinformation. M013 - targeting TA02 Objective Planning -D3 Disrupt +D03 C00062 @@ -306,7 +306,7 @@ https://www.isdglobal.org/wp-content/uploads/2016/06/Counter-narrative-Handbook_ Open-source libraries could be created that aid in some way for each technique. Even for Strategic Planning, some open-source frameworks such as AMITT can be created to counter the adversarial efforts. M010 - countermessaging TA04 Develop Networks -D4 Degrade +D04 C00065 @@ -314,7 +314,7 @@ https://www.isdglobal.org/wp-content/uploads/2016/06/Counter-narrative-Handbook_ Includes “ban political micro targeting” and “ban political ads” M005 - removal TA05 Microtargeting -D3 Disrupt +D03 C00066 @@ -322,7 +322,7 @@ https://www.isdglobal.org/wp-content/uploads/2016/06/Counter-narrative-Handbook_ Flood a disinformation-related hashtag with other content. Examples include kPop stans flooding extremist hashtags with pop videos and images. M009 - dilution TA05 Microtargeting -D3 Disrupt +D03 C00067 @@ -330,7 +330,7 @@ https://www.isdglobal.org/wp-content/uploads/2016/06/Counter-narrative-Handbook_ Reduce the credibility of groups behind misinformation-linked funding campaigns. M013 - targeting TA03 Develop People -D3 Disrupt +D03 C00070 @@ -346,7 +346,7 @@ Hashtag: Against the platform, by drowning the hashtag. T0046 - Search Engine Optimization: Sub-optimal website performance affect its search engine rank, which I interpret as "blocking access to a platform". M005 - removal TA02 Objective Planning -D2 Deny +D02 C00071 @@ -354,7 +354,7 @@ T0046 - Search Engine Optimization: Sub-optimal website performance affect its s Block websites, accounts, groups etc connected to misinformation and other information pollution. M005 - removal TA06 Develop Content -D2 Deny +D02 C00072 @@ -362,7 +362,7 @@ T0046 - Search Engine Optimization: Sub-optimal website performance affect its s Check special-interest groups (e.g. medical, knitting) for unrelated and misinformation-linked content, and remove it. M005 - removal TA06 Develop Content -D2 Deny +D02 C00073 @@ -370,15 +370,15 @@ T0046 - Search Engine Optimization: Sub-optimal website performance affect its s Use training to build the resilience of at-risk populations. Educate on how to handle info pollution. Push out targeted education on why it's pollution. Build cultural resistance to false content, e.g. cultural resistance to bullshit. Influence literacy training, to inoculate against “cult” recruiting. Media literacy training: leverage librarians / library for media literacy training. Inoculate at language. Strategic planning included as inoculating population has strategic value. Example is the "Learn to Discern" Program, funded by the Canadian government, operated in Ukraine from July 2015 to March 2016. The program trained 15,000 Ukrainians in ‘’safe, informed media consumption techniques,’’ including avoiding emotional manipulation, verifying sources, identifying hate speech, verifying expert credentials, detecting censorship, and debunking news, photos, and videos.” Example: NGO Baltic Centre for Media Excellence, with some international funding, provides training to journalists in the Baltics and conducts media literacy training in the region. In addition to helping journalists avoid becoming “unwitting multipliers of misleading information,” the organization works with school teachers in the region to help them “decode media and incorporate media research into teaching.” concepts of media literacy to a mass audience that authorities launch a public information campaign that teaches the program will take time to develop and establish impact, recommends curriculum-based training. Covers detect, deny, and degrade. M001 - resilience TA01 Strategic Planning -D2 Deny +D02 C00074 Identify and delete or rate limit identical content -Search for repeated content (text, images, videos etc); check for misinformation, rate-limit or delete repeats. +C00000 M012 - cleaning TA06 Develop Content -D2 Deny +D02 C00075 @@ -386,7 +386,7 @@ T0046 - Search Engine Optimization: Sub-optimal website performance affect its s normalise the language around disinformation and misinformation; give people the words for artifact and effect types. M010 - countermessaging TA06 Develop Content -D2 Deny +D02 C00076 @@ -394,7 +394,7 @@ T0046 - Search Engine Optimization: Sub-optimal website performance affect its s Make political discussion channels text-only. M005 - removal TA06 Develop Content -D2 Deny +D02 C00077 @@ -402,7 +402,7 @@ T0046 - Search Engine Optimization: Sub-optimal website performance affect its s Develop networks of communities and influencers around counter-misinformation. Match them to misinformation creators M013 - targeting TA03 Develop People -D3 Disrupt +D03 C00078 @@ -410,7 +410,7 @@ T0046 - Search Engine Optimization: Sub-optimal website performance affect its s Includes “change image search algorithms for hate groups and extremists” and “Change search algorithms for hate and extremist queries to show content sympathetic to opposite side” M002 - diversion TA06 Develop Content -D3 Disrupt +D03 C00080 @@ -418,7 +418,7 @@ T0046 - Search Engine Optimization: Sub-optimal website performance affect its s Create counternarratives, or narratives that compete in the same spaces as misinformation narratives. Could also be degrade M002 - diversion TA06 Develop Content -D3 Disrupt +D03 C00081 @@ -426,7 +426,7 @@ T0046 - Search Engine Optimization: Sub-optimal website performance affect its s Discredit by pointing out the "noise" and informing public that "flooding" is a technique of disinformation campaigns; point out intended objective of "noise" M003 - daylight TA06 Develop Content -D3 Disrupt +D03 C00082 @@ -434,7 +434,7 @@ T0046 - Search Engine Optimization: Sub-optimal website performance affect its s e.g. RealityTeam work that adds clear information to spaces with disinformation in. Also inoculation. M010 - countermessaging TA06 Develop Content -D3 Disrupt +D03 C00084 @@ -442,7 +442,7 @@ T0046 - Search Engine Optimization: Sub-optimal website performance affect its s Includes “poison pill recasting of message” and “steal their truths”. Many techniques involve promotion which could be manipulated. For example, online fundings or rallies could be advertised, through compromised or fake channels, as being associated with "far-up/down/left/right" actors. "Long Game" narratives could be subjected in a similar way with negative connotations. Can also replay technique T0003. M002 - diversion TA06 Develop Content -D3 Disrupt +D03 C00085 @@ -452,7 +452,7 @@ T0046 - Search Engine Optimization: Sub-optimal website performance affect its s Online archives of content (archives of websites, social media profiles, media, copies of published advertisements; or archives of comments attributed to bad actors, as well as anonymized metadata about users who interacted with them and analysis of the effect) is useful for intelligence analysis and public transparency, but will need similar muting or tagging/ shaming as associated with bad actors. M003 - daylight TA06 Develop Content -D3 Disrupt +D03 C00086 @@ -462,7 +462,7 @@ Online archives of content (archives of websites, social media profiles, media, Note: This sounds eerlily like many Reddit communities where the most upvoted comments are all jokes, preventing serious discussion from being discovered by those who filter by upvotes. M002 - diversion TA06 Develop Content -D4 Degrade +D04 C00087 @@ -470,7 +470,7 @@ Note: This sounds eerlily like many Reddit communities where the most upvoted co Examples: kPop stans, #proudboys takeover by LGBT community M009 - dilution TA06 Develop Content -D4 Degrade +D04 C00090 @@ -478,7 +478,7 @@ Note: This sounds eerlily like many Reddit communities where the most upvoted co Create honeypots for misinformation creators to engage with, and reduce the resources they have available for misinformation campaigns. M002 - diversion TA07 Channel Selection -D5 Deceive +D05 C00091 @@ -486,7 +486,7 @@ Note: This sounds eerlily like many Reddit communities where the most upvoted co Set honeypots, e.g. communities, in networks likely to be used for disinformation. M002 - diversion TA06 Develop Content -D5 Deceive +D05 C00092 @@ -494,7 +494,7 @@ Note: This sounds eerlily like many Reddit communities where the most upvoted co Includes "Establish a truth teller reputation score for influencers” and “Reputation scores for social media users”. Influencers are individuals or accounts with many followers. M006 - scoring TA02 Objective Planning -D7 Deter +D07 C00093 @@ -502,7 +502,7 @@ Note: This sounds eerlily like many Reddit communities where the most upvoted co Establish tailored code of conduct for individuals with many followers. Can be platform code of conduct; can also be community code, e.g. the Pro-Truth Pledge. M001 - resilience TA03 Develop People -D7 Deter +D07 C00094 @@ -510,7 +510,7 @@ Note: This sounds eerlily like many Reddit communities where the most upvoted co Accountability move: make sure research is published with its funding sources. M003 - daylight TA06 Develop Content -D4 Degrade +D04 C00096 @@ -518,7 +518,7 @@ Note: This sounds eerlily like many Reddit communities where the most upvoted co Increase credibility, visibility, and reach of positive influencers in the information space. M006 - scoring TA01 Strategic Planning -D7 Deter +D07 C00097 @@ -526,7 +526,7 @@ Note: This sounds eerlily like many Reddit communities where the most upvoted co Reduce poll flooding by online taking comments or poll entries from verified accounts. M004 - friction TA07 Channel Selection -D2 Deny +D02 C00098 @@ -534,7 +534,7 @@ Note: This sounds eerlily like many Reddit communities where the most upvoted co remove blue checkmarks etc from known misinformation accounts. M004 - friction TA07 Channel Selection -D2 Deny +D02 C00099 @@ -542,7 +542,7 @@ Note: This sounds eerlily like many Reddit communities where the most upvoted co Improve content veerification methods available to groups, individuals etc. M004 - friction TA07 Channel Selection -D2 Deny +D02 C00100 @@ -550,7 +550,7 @@ Note: This sounds eerlily like many Reddit communities where the most upvoted co Post large volumes of unrelated content on known misinformation hashtags M002 - diversion TA08 Pump Priming -D3 Disrupt +D03 C00101 @@ -558,7 +558,7 @@ Note: This sounds eerlily like many Reddit communities where the most upvoted co Create participant friction. Includes Make repeat voting hard, and throttle number of forwards. M004 - friction TA07 Channel Selection -D4 Degrade +D04 C00103 @@ -566,7 +566,7 @@ Note: This sounds eerlily like many Reddit communities where the most upvoted co This is reactive, not active measure (honeypots are active). It's a platform controlled measure. M002 - diversion TA07 Channel Selection -D5 Deceive +D05 C00105 @@ -574,7 +574,7 @@ Note: This sounds eerlily like many Reddit communities where the most upvoted co Shift influence and algorithms by posting more adverts into spaces than misinformation creators. M009 - dilution TA07 Channel Selection -D3 Disrupt +D03 C00106 @@ -582,7 +582,7 @@ Note: This sounds eerlily like many Reddit communities where the most upvoted co Create emotive centrist content that gets more clicks M002 - diversion TA06 Develop Content -D3 Disrupt +D03 C00107 @@ -590,7 +590,7 @@ Note: This sounds eerlily like many Reddit communities where the most upvoted co includes social media content take-downs, e.g. facebook or Twitter content take-downs M006 - scoring, M005 - removal TA06 Develop Content -D2 Deny +D02 C00109 @@ -598,7 +598,7 @@ Note: This sounds eerlily like many Reddit communities where the most upvoted co Reduce emotional responses to misinformation through calming messages, etc. M001 - resilience TA09 Exposure -D3 Disrupt +D03 C00111 @@ -606,7 +606,7 @@ Note: This sounds eerlily like many Reddit communities where the most upvoted co Example: The Commons Project (BuildUp) work. M001 - resilience TA01 Strategic Planning -D4 Degrade +D04 C00112 @@ -614,7 +614,7 @@ Note: This sounds eerlily like many Reddit communities where the most upvoted co Challenge misinformation creators to prove they're not an information operation. M004 - friction TA08 Pump Priming -D2 Deny +D02 C00113 @@ -622,7 +622,7 @@ Note: This sounds eerlily like many Reddit communities where the most upvoted co Debunk fake experts, their credentials, and potentially also their audience quality M003 - daylight TA08 Pump Priming -D2 Deny +D02 C00114 @@ -630,7 +630,7 @@ Note: This sounds eerlily like many Reddit communities where the most upvoted co Stop passing on misinformation M004 - friction TA08 Pump Priming -D2 Deny +D02 C00115 @@ -638,7 +638,7 @@ Note: This sounds eerlily like many Reddit communities where the most upvoted co Debunk misinformation creators and posters. M003 - daylight TA08 Pump Priming -D2 Deny +D02 C00116 @@ -646,7 +646,7 @@ Note: This sounds eerlily like many Reddit communities where the most upvoted co Build and post information about groups etc's involvement in misinformation incidents. M003 - daylight TA08 Pump Priming -D2 Deny +D02 C00117 @@ -654,7 +654,7 @@ Note: This sounds eerlily like many Reddit communities where the most upvoted co Label promote counter to disinformation M010 - countermessaging TA08 Pump Priming -D4 Degrade +D04 C00118 @@ -662,7 +662,7 @@ Note: This sounds eerlily like many Reddit communities where the most upvoted co Add countermessage text to iamges used in misinformation incidents. M010 - countermessaging TA08 Pump Priming -D4 Degrade +D04 C00119 @@ -670,7 +670,7 @@ Note: This sounds eerlily like many Reddit communities where the most upvoted co debunk misinformation content. Provide link to facts. M010 - countermessaging TA08 Pump Priming -D7 Deter +D07 C00120 @@ -678,7 +678,7 @@ Note: This sounds eerlily like many Reddit communities where the most upvoted co Redesign platforms and algorithms to reduce the effectiveness of disinformation M007 - metatechnique TA08 Pump Priming -D7 Deter +D07 C00121 @@ -686,7 +686,7 @@ Note: This sounds eerlily like many Reddit communities where the most upvoted co Make algorithms in platforms explainable, and visible to people using those platforms. M001 - resilience TA08 Pump Priming -D7 Deter +D07 C00122 @@ -694,7 +694,7 @@ Note: This sounds eerlily like many Reddit communities where the most upvoted co Beware: content moderation misused becomes censorship. M004 - friction TA09 Exposure -D2 Deny +D02 C00123 @@ -702,7 +702,7 @@ Note: This sounds eerlily like many Reddit communities where the most upvoted co reduce the visibility of known botnets online. M004 - friction TA09 Exposure -D3 Disrupt +D03 C00124 @@ -710,7 +710,7 @@ Note: This sounds eerlily like many Reddit communities where the most upvoted co Don't engage with individuals relaying misinformation. M004 - friction TA09 Exposure -D3 Disrupt +D03 C00125 @@ -718,7 +718,7 @@ Note: This sounds eerlily like many Reddit communities where the most upvoted co Produce material in advance of misinformation incidents, by anticipating the narratives used in them, and debunking them. M001 - resilience TA09 Exposure -D3 Disrupt +D03 C00126 @@ -726,7 +726,7 @@ Note: This sounds eerlily like many Reddit communities where the most upvoted co Create an alert system around disinformation and misinformation artifacts, narratives, and incidents M003 - daylight TA09 Exposure -D3 Disrupt +D03 C00128 @@ -734,7 +734,7 @@ Note: This sounds eerlily like many Reddit communities where the most upvoted co Repost or comment on misinformation artifacts, using ridicule or other content to reduce the likelihood of reposting. M009 - dilution TA09 Exposure -D3 Disrupt +D03 C00129 @@ -742,7 +742,7 @@ Note: This sounds eerlily like many Reddit communities where the most upvoted co fiscal sanctions; parallel to counter terrorism M014 - reduce resources TA09 Exposure -D2 Deny +D02 C00130 @@ -750,7 +750,7 @@ Note: This sounds eerlily like many Reddit communities where the most upvoted co Train local influencers in countering misinformation. M001 - resilience TA05 Microtargeting -D7 Deter +D07 C00131 @@ -758,7 +758,7 @@ Note: This sounds eerlily like many Reddit communities where the most upvoted co Take botnet servers offline by seizing them. M005 - removal TA11 Persistence -D2 Deny +D02 C00133 @@ -766,7 +766,7 @@ Note: This sounds eerlily like many Reddit communities where the most upvoted co Note: Similar to Deplatform People but less generic. Perhaps both should be left. M005 - removal TA03 Develop People -D3 Disrupt +D03 C00135 @@ -774,7 +774,7 @@ Note: This sounds eerlily like many Reddit communities where the most upvoted co Merged two rows here. M005 - removal TA04 Develop Networks -D3 Disrupt +D03 C00136 @@ -782,7 +782,7 @@ Note: This sounds eerlily like many Reddit communities where the most upvoted co Find communities likely to be targetted by misinformation campaigns, and send them countermessages or pointers to information sources. M010 - countermessaging TA08 Pump Priming -D3 Disrupt +D03 C00138 @@ -790,7 +790,7 @@ Note: This sounds eerlily like many Reddit communities where the most upvoted co File multiple lawsuits against known misinformation creators and posters, to distract them from disinformation creation. M014 - reduce resources TA11 Persistence -D3 Disrupt +D03 C00139 @@ -798,7 +798,7 @@ Note: This sounds eerlily like many Reddit communities where the most upvoted co God knows what this is. Keeping temporarily in case we work it out. M004 - friction TA11 Persistence -D3 Disrupt +D03 C00140 @@ -806,7 +806,7 @@ Note: This sounds eerlily like many Reddit communities where the most upvoted co Applies to most of the content used by exposure techniques except "T0055 - Use hashtag”. Applies to analytics M008 - data pollution TA12 Measure Effectiveness -D3 Disrupt +D03 C00142 @@ -814,7 +814,7 @@ Note: This sounds eerlily like many Reddit communities where the most upvoted co Includes “this has been disproved: do you want to forward it”. Includes “"Hey this story is old" popup when messaging with old URL” - this assumes that this technique is based on visits to an URL shortener or a captured news site that can publish a message of our choice. Includes “mark clickbait visually”. M004 - friction TA06 Develop Content -D4 Degrade +D04 C00143 @@ -822,7 +822,7 @@ Note: This sounds eerlily like many Reddit communities where the most upvoted co Use copyright infringement claims to remove videos etc. M013 - targeting TA11 Persistence -D4 Degrade +D04 C00144 @@ -830,7 +830,7 @@ Note: This sounds eerlily like many Reddit communities where the most upvoted co Degrade the infrastructure. Could e.g. pay to not act for 30 days. Not recommended M014 - reduce resources TA02 Objective Planning -D4 Degrade +D04 C00147 @@ -838,7 +838,7 @@ Note: This sounds eerlily like many Reddit communities where the most upvoted co Stop new community activity (likes, comments) on old social media posts. M004 - friction TA09 Exposure -D3 Disrupt +D03 C00148 @@ -846,7 +846,7 @@ Note: This sounds eerlily like many Reddit communities where the most upvoted co If creators are using network analysis to determine how to attack networks, then adding random extra links to those networks might throw that analysis out enough to change attack outcomes. Unsure which AMITT techniques. M008 - data pollution TA12 Measure Effectiveness -D4 Degrade +D04 C00149 @@ -854,7 +854,7 @@ Note: This sounds eerlily like many Reddit communities where the most upvoted co Includes Pollute the AB-testing data feeds: Polluting A/B testing requires knowledge of MOEs and MOPs. A/B testing must be caught early when there is relatively little data available so infiltration of TAs and understanding of how content is migrated from testing to larger audiences is fundamental. M008 - data pollution TA12 Measure Effectiveness -D4 Degrade +D04 C00153 @@ -862,7 +862,7 @@ Note: This sounds eerlily like many Reddit communities where the most upvoted co Align offensive cyber action with information operations and counter disinformation approaches, where appropriate. M013 - targeting TA01 Strategic Planning -D3 Disrupt +D03 C00154 @@ -870,7 +870,7 @@ Note: This sounds eerlily like many Reddit communities where the most upvoted co Train media to spot and respond to misinformation, and ask them not to post or transmit misinformation they've found. M005 - removal TA08 Pump Priming -D2 Deny +D02 C00155 @@ -878,7 +878,7 @@ Note: This sounds eerlily like many Reddit communities where the most upvoted co Ban misinformation creators and posters from funding sites M005 - removal TA03 Develop People -D2 Deny +D02 C00156 @@ -886,7 +886,7 @@ Note: This sounds eerlily like many Reddit communities where the most upvoted co Civil engagement activities conducted on the part of EFP forces. In Latvia, for example, U.S. soldiers have reportedly conducted numerous civil engagements with the local populations. In one example, soldiers cut firewood for local Russian-speaking Latvians. Locals were reportedly overheard saying, “A Russian soldier wouldn’t do that.” NATO should likewise provide support and training, where needed, to local public affairs and other communication personnel. Local government and military public affairs personnel can play their part in creating and disseminating entertaining and sharable content that supports the EFP mission. M010 - countermessaging TA02 Objective Planning -D3 Disrupt +D03 C00159 @@ -894,7 +894,7 @@ Note: This sounds eerlily like many Reddit communities where the most upvoted co e.g. Create a campaign plan and toolkit for competition short of armed conflict (this used to be called “the grey zone”). The campaign plan should account for own vulnerabilities and strengths, and not over-rely on any one tool of statecraft or line of effort. It will identify and employ a broad spectrum of national power to deter, compete, and counter (where necessary) other countries’ approaches, and will include understanding of own capabilities, capabilities of disinformation creators, and international standards of conduct to compete in, shrink the size, and ultimately deter use of competition short of armed conflict. M007 - metatechnique TA01 Strategic Planning -D3 Disrupt +D03 C00160 @@ -902,7 +902,7 @@ Note: This sounds eerlily like many Reddit communities where the most upvoted co Identify key influencers (e.g. use network analysis), then reach out to identified users and offer support, through either training or resources. M001 - resilience TA03 Develop People -D2 Deny +D02 C00161 @@ -910,7 +910,7 @@ Note: This sounds eerlily like many Reddit communities where the most upvoted co Advance coalitions across borders and sectors, spanning public and private, as well as foreign and domestic, divides. Improve mechanisms to collaborate, share information, and develop coordinated approaches with the private sector at home and allies and partners abroad. M007 - metatechnique TA01 Strategic Planning -D7 Deter +D07 C00162 @@ -918,7 +918,7 @@ Note: This sounds eerlily like many Reddit communities where the most upvoted co Kremlin’s narrative spin extends through constellations of “civil society” organizations, political parties, churches, and other actors. Moscow leverages think tanks, human rights groups, election observers, Eurasianist integration groups, and orthodox groups. A collection of Russian civil society organizations, such as the Federal Agency for the Commonwealth of Independent States Affairs, Compatriots Living Abroad, and International Humanitarian Cooperation, together receive at least US$100 million per year, in addition to government-organized nongovernmental organizations (NGOs), at least 150 of which are funded by Russian presidential grants totaling US$70 million per year. M013 - targeting TA04 Develop Networks -D3 Disrupt +D03 C00164 @@ -926,7 +926,7 @@ Note: This sounds eerlily like many Reddit communities where the most upvoted co protect the interests of this population and, more importantly, influence the population to support pro-Russia causes and effectively influence the politics of its neighbors M013 - targeting TA02 Objective Planning -D3 Disrupt +D03 C00165 @@ -934,7 +934,7 @@ Note: This sounds eerlily like many Reddit communities where the most upvoted co e.g. for leaked legal documents, use court motions to limit future discovery actions M004 - friction TA06 Develop Content -D2 Deny +D02 C00169 @@ -942,7 +942,7 @@ Note: This sounds eerlily like many Reddit communities where the most upvoted co international donors will donate to a basket fund that will pay a committee of local experts who will, in turn, manage and distribute the money to Russian-language producers and broadcasters that pitch various projects. M010 - countermessaging TA02 Objective Planning -D3 Disrupt +D03 C00170 @@ -950,7 +950,7 @@ Note: This sounds eerlily like many Reddit communities where the most upvoted co Shift from reactive to proactive response, with priority on sharing relevant information with the public and mobilizing private-sector engagement. Recent advances in data-driven technologies have elevated information as a source of power to influence the political and economic environment, to foster economic growth, to enable a decision-making advantage over competitors, and to communicate securely and quickly. M007 - metatechnique TA01 Strategic Planning -D3 Disrupt +D03 C00172 @@ -958,7 +958,7 @@ Note: This sounds eerlily like many Reddit communities where the most upvoted co Removing accounts, pages, groups, e.g. facebook page removal M005 - removal TA04 Develop Networks -D2 Deny +D02 C00174 @@ -966,7 +966,7 @@ Note: This sounds eerlily like many Reddit communities where the most upvoted co Free and fair press: create bipartisan, patriotic commitment to press freedom. Note difference between news and editorialising. Build alternative news sources: create alternative local-language news sources to counter local-language propaganda outlets. Delegitimize the 24 hour news cycle. includes Provide an alternative to disinformation content by expanding and improving local content: Develop content that can displace geopolitically-motivated narratives in the entire media environment, both new and old media alike. M007 - metatechnique, M002 - diversion TA01 Strategic Planning -D2 Deny +D02 C00176 @@ -974,7 +974,7 @@ Note: This sounds eerlily like many Reddit communities where the most upvoted co Coordinated disinformation challenges are increasingly multidisciplinary, there are few organizations within the national security structures that are equipped with the broad-spectrum capability to effectively counter large-scale conflict short of war tactics in real-time. Institutional hurdles currently impede diverse subject matter experts, hailing from outside of the traditional national security and foreign policy disciplines (e.g., physical science, engineering, media, legal, and economics fields), from contributing to the direct development of national security countermeasures to emerging conflict short of war threat vectors. A Cognitive Security Action Group (CSAG), akin to the Counterterrorism Security Group (CSG), could drive interagency alignment across equivalents of DHS, DoS, DoD, Intelligence Community, and other implementing agencies, in areas including strategic narrative, and the nexus of cyber and information operations. M007 - metatechnique TA01 Strategic Planning -D7 Deter +D07 C00178 @@ -982,7 +982,7 @@ Note: This sounds eerlily like many Reddit communities where the most upvoted co 1) Pollute the data voids with wholesome content (Kittens! Babyshark!). 2) fill data voids with relevant information, e.g. increase Russian-language programming in areas subject to Russian disinformation. Examples include using Current Time videos (viewed 40 million times online) to draw viewers away from Russian TV programming in RT and Sputnik. POtential content for this includes conventional entertainment programming (source: The conomist, “America’s Answer to Russian Propaganda TV,” 2017). M009 - dilution, M008 - data pollution TA05 Microtargeting -D4 Degrade +D04 C00182 @@ -990,7 +990,7 @@ Note: This sounds eerlily like many Reddit communities where the most upvoted co Detect redirction or malware, then quarantine or delete. Example: (2015) Trustwave reported that a Bedep Trojan malware kit had begun infecting machines and forcing them to browse certain sites, artificially inflating traffic to a set of pro-Russia M005 - removal TA09 Exposure -D2 Deny +D02 C00184 @@ -998,7 +998,7 @@ Note: This sounds eerlily like many Reddit communities where the most upvoted co highlight misinformation activities and actors in media M003 - daylight TA08 Pump Priming -D4 Degrade +D04 C00188 @@ -1006,7 +1006,7 @@ Note: This sounds eerlily like many Reddit communities where the most upvoted co Includes SEO influence. August 2014, Russian news agency Rossiya Segodnya commissioned a poll in France with poorly worded questions and a statistically insignificant subsample that RT used to back a story titled “15% of French people back ISIS [Islamic State of Iraq and Syria] militants, poll finds.” The story and summary infographic circulated on the internet, initially appearing primarily on French sites. After a week, the generally respectable digital U.S. news outlet Vox ran the story, now titled “One in Six French People Say They Support ISIS.” Although this effect has now worn off or been overwritten, for a time—despite a later story from The Washington Post debunking the claim—typing “ISIS France” into Google resulted in an autosuggestion of “ISIS France support” (Borthwick, 2015). Includes promotion of a “higher standard of journalism”: journalism training “would be helpful, especially for the online community. Includes Strengthen local media: Improve effectiveness of local media outlets. Using eastern Latvia media outlets as an example, one expert noted that the media outlets are “very weak,” are often politically affiliated, or have “little local oligarchs that control them.” M001 - resilience TA08 Pump Priming -D3 Disrupt +D03 C00189 @@ -1014,7 +1014,7 @@ Note: This sounds eerlily like many Reddit communities where the most upvoted co Use ongoing analysis/monitoring of "flagged" profiles. Confirm whether platforms are actively removing flagged accounts, and raise pressure via e.g. government organizations to encourage removal M003 - daylight TA03 Develop People -D6 Destroy +D06 C00190 @@ -1022,7 +1022,7 @@ Note: This sounds eerlily like many Reddit communities where the most upvoted co Government open engagement with civil society as an independent check on government action and messaging. Government seeks to coordinate and synchronize narrative themes with allies and partners while calibrating action in cases where elements in these countries may have been co-opted by competitor nations. Includes “fight in the light”: Use leadership in the arts, entertainment, and media to highlight and build on fundamental tenets of democracy. M001 - resilience TA01 Strategic Planning -D3 Disrupt +D03 C00195 @@ -1030,7 +1030,7 @@ Note: This sounds eerlily like many Reddit communities where the most upvoted co Use Google AdWords to identify instances in which people search Google about particular fake-news stories or Russian propaganda themes. Taking advantage of the technology behind Google AdWords, this method identifies potential ISIS recruits through their Google searches and exposes them to curated YouTube videos debunking ISIS recruiting themes. Apply this method to Russian propaganda. Includes Monetize centrist SEO by subsidizing the difference in greater clicks towards extremist content. M002 - diversion TA07 Channel Selection -D2 Deny +D02 C00197 @@ -1038,7 +1038,7 @@ Note: This sounds eerlily like many Reddit communities where the most upvoted co Standard reporting for false profiles (identity issues). Includes detecting hijacked accounts and reallocating them - if possible, back to original owners. M005 - removal TA03 Develop People -D2 Deny +D02 C00200 @@ -1046,7 +1046,7 @@ Note: This sounds eerlily like many Reddit communities where the most upvoted co Has been done in e.g. India. FIXIT: standardize language used for influencer/ respected figure. M010 - countermessaging TA09 Exposure -D3 Disrupt +D03 C00202 @@ -1054,7 +1054,7 @@ Note: This sounds eerlily like many Reddit communities where the most upvoted co Set honeytraps in content likely to be accessed for disinformation. NB Macron election team modified docs to spike a hack and leak. M002 - diversion TA06 Develop Content -D2 Deny +D02 C00203 @@ -1062,7 +1062,7 @@ Note: This sounds eerlily like many Reddit communities where the most upvoted co Remove access to official press events from known misinformation actors. M004 - friction TA04 Develop Networks -D3 Disrupt +D03 C00205 @@ -1070,7 +1070,7 @@ Note: This sounds eerlily like many Reddit communities where the most upvoted co Increase civic resilience by partnering with business community to combat gray zone threats and ensuring adequate reporting and enforcement mechanisms. M007 - metatechnique TA01 Strategic Planning -D3 Disrupt +D03 C00207 @@ -1078,7 +1078,7 @@ Note: This sounds eerlily like many Reddit communities where the most upvoted co E.g. Saudi tit-for-tat campaign M013 - targeting TA02 Objective Planning -D7 Deter +D07 C00211 @@ -1092,7 +1092,7 @@ https://balkaninsight.com/2019/06/07/disinformation-nation-the-slovaks-fighting- https://internews.org/story/using-comedy-and-social-media-educate-disinformation M010 - countermessaging TA09 Exposure -D3 Disrupt +D03 C00212 @@ -1100,7 +1100,7 @@ https://internews.org/story/using-comedy-and-social-media-educate-disinformation Increase public service experience, and support wider civics and history education. M001 - resilience TA01 Strategic Planning -D3 Disrupt +D03 C00216 @@ -1108,7 +1108,7 @@ https://internews.org/story/using-comedy-and-social-media-educate-disinformation Prevent ad revenue going to disinformation domains M014 - reduce resources TA05 Microtargeting -D2 Deny +D02 C00219 @@ -1116,7 +1116,7 @@ https://internews.org/story/using-comedy-and-social-media-educate-disinformation Steganography. Adding date, signatures etc to stop issue of photo relabelling etc. M003 - daylight TA06 Develop Content -D4 Degrade +D04 C00220 @@ -1124,7 +1124,7 @@ https://internews.org/story/using-comedy-and-social-media-educate-disinformation Create a plan for misinformation and disinformation response, before it's needed. Include connections / contacts needed, expected counteremessages etc. M007 - metatechnique TA01 Strategic Planning -D3 Disrupt +D03 C00221 @@ -1132,7 +1132,7 @@ https://internews.org/story/using-comedy-and-social-media-educate-disinformation Include PACE plans - Primary, Alternate, Contingency, Emergency M007 - metatechnique TA01 Strategic Planning -D3 Disrupt +D03 C00222 @@ -1140,7 +1140,7 @@ https://internews.org/story/using-comedy-and-social-media-educate-disinformation Simulate misinformation and disinformation campaigns, and responses to them, before campaigns happen. M007 - metatechnique TA02 Objective Planning -D3 Disrupt +D03 C00223 @@ -1148,6 +1148,6 @@ https://internews.org/story/using-comedy-and-social-media-educate-disinformation Improve trust in the misinformation responses from social media and other platforms. Examples include creating greater transparancy on their actions and algorithms. M001 - resilience TA01 Strategic Planning -D3 Disrupt +D03 diff --git a/detections_index.md b/detections_index.md index 0753398..78df332 100644 --- a/detections_index.md +++ b/detections_index.md @@ -15,7 +15,7 @@ Examine failed campaigns. How did they fail? Can we create useful activities that increase these failures? TA01 Strategic Planning -D1 Detect +D01 F00002 @@ -23,7 +23,7 @@ We have no idea what this means. Is it something to do with the way a viral story spreads? TA01 Strategic Planning -D1 Detect +D01 F00003 @@ -31,7 +31,7 @@ TA01 Strategic Planning -D1 Detect +D01 F00004 @@ -39,7 +39,7 @@ TA01 Strategic Planning -D1 Detect +D01 F00005 @@ -47,7 +47,7 @@ Strengths, Weaknesses, Opportunities, Threats analysis of groups and audience segments. TA01 Strategic Planning -D1 Detect +D01 F00006 @@ -55,7 +55,7 @@ TA01 Strategic Planning -D1 Detect +D01 F00007 @@ -63,7 +63,7 @@ TA02 Objective Planning -D1 Detect +D01 F00008 @@ -71,7 +71,7 @@ TA03 Develop People -D1 Detect +D01 F00009 @@ -79,7 +79,7 @@ TA03 Develop People -D1 Detect +D01 F00010 @@ -87,7 +87,7 @@ TA03 Develop People -D1 Detect +D01 F00011 @@ -95,7 +95,7 @@ TA03 Develop People -D1 Detect +D01 F00012 @@ -103,7 +103,7 @@ TA03 Develop People -D1 Detect +D01 F00013 @@ -111,7 +111,7 @@ TA03 Develop People -D1 Detect +D01 F00014 @@ -119,7 +119,7 @@ for e.g. fake news sites TA03 Develop People -D1 Detect +D01 F00015 @@ -127,7 +127,7 @@ I include Fake Experts as they may use funding campaigns such as Patreon to fund their operations and so these should be watched. TA03 Develop People -D1 Detect +D01 F00016 @@ -137,7 +137,7 @@ In TA08-11, the engagement level of victims could be identified to detect and respond to increasing engagement. TA03 Develop People -D1 Detect +D01 F00017 @@ -145,7 +145,7 @@ In TA08-11, the engagement level of victims could be identified to detect and re TA03 Develop People -D1 Detect +D01 F00018 @@ -153,7 +153,7 @@ In TA08-11, the engagement level of victims could be identified to detect and re track funding sources TA03 Develop People -D1 Detect +D01 F00019 @@ -161,7 +161,7 @@ In TA08-11, the engagement level of victims could be identified to detect and re TA04 Develop Networks -D1 Detect +D01 F00020 @@ -169,7 +169,7 @@ In TA08-11, the engagement level of victims could be identified to detect and re TA04 Develop Networks -D1 Detect +D01 F00021 @@ -177,7 +177,7 @@ In TA08-11, the engagement level of victims could be identified to detect and re TA04 Develop Networks -D1 Detect +D01 F00022 @@ -185,7 +185,7 @@ In TA08-11, the engagement level of victims could be identified to detect and re TA04 Develop Networks -D1 Detect +D01 F00023 @@ -193,7 +193,7 @@ In TA08-11, the engagement level of victims could be identified to detect and re TA04 Develop Networks -D1 Detect +D01 F00024 @@ -201,7 +201,7 @@ In TA08-11, the engagement level of victims could be identified to detect and re TA04 Develop Networks -D1 Detect +D01 F00025 @@ -209,7 +209,7 @@ In TA08-11, the engagement level of victims could be identified to detect and re TA05 Microtargeting -D1 Detect +D01 F00026 @@ -217,7 +217,7 @@ In TA08-11, the engagement level of victims could be identified to detect and re TA05 Microtargeting -D1 Detect +D01 F00027 @@ -225,7 +225,7 @@ In TA08-11, the engagement level of victims could be identified to detect and re TA05 Microtargeting -D1 Detect +D01 F00028 @@ -233,7 +233,7 @@ In TA08-11, the engagement level of victims could be identified to detect and re TA06 Develop Content -D1 Detect +D01 F00029 @@ -241,7 +241,7 @@ In TA08-11, the engagement level of victims could be identified to detect and re TA06 Develop Content -D1 Detect +D01 F00030 @@ -249,7 +249,7 @@ In TA08-11, the engagement level of victims could be identified to detect and re TA06 Develop Content -D1 Detect +D01 F00031 @@ -257,7 +257,7 @@ In TA08-11, the engagement level of victims could be identified to detect and re Strategic planning included as innoculating population has strategic value. TA06 Develop Content -D1 Detect +D01 F00032 @@ -265,7 +265,7 @@ In TA08-11, the engagement level of victims could be identified to detect and re DUPLICATE - DELETE TA06 Develop Content -D1 Detect +D01 F00033 @@ -273,7 +273,7 @@ In TA08-11, the engagement level of victims could be identified to detect and re TA06 Develop Content -D1 Detect +D01 F00034 @@ -281,7 +281,7 @@ In TA08-11, the engagement level of victims could be identified to detect and re TA06 Develop Content -D1 Detect +D01 F00035 @@ -289,7 +289,7 @@ In TA08-11, the engagement level of victims could be identified to detect and re TA06 Develop Content -D1 Detect +D01 F00036 @@ -297,7 +297,7 @@ In TA08-11, the engagement level of victims could be identified to detect and re TA06 Develop Content -D1 Detect +D01 F00037 @@ -307,7 +307,7 @@ In TA08-11, the engagement level of victims could be identified to detect and re Technique should be in terms of "strategic innoculation", raising the standards of what people expect in terms of evidence when consuming news. TA06 Develop Content -D1 Detect +D01 F00038 @@ -315,7 +315,7 @@ Technique should be in terms of "strategic innoculation", raising the standards Unsure I understood the original intention or what it applied to. Therefore the techniques listed (10, 39, 43, 57, 61) are under my interpretation - which is that we want to track ignorant agents who fall into the enemy's trap and show a cost to financing/reposting/helping the adversary via public shaming or other means. TA06 Develop Content -D1 Detect +D01 F00039 @@ -323,7 +323,7 @@ Technique should be in terms of "strategic innoculation", raising the standards TA06 Develop Content -D1 Detect +D01 F00040 @@ -331,7 +331,7 @@ Technique should be in terms of "strategic innoculation", raising the standards TA06 Develop Content -D1 Detect +D01 F00041 @@ -339,7 +339,7 @@ Technique should be in terms of "strategic innoculation", raising the standards Not technically left of boom TA07 Channel Selection -D1 Detect +D01 F00042 @@ -347,7 +347,7 @@ Technique should be in terms of "strategic innoculation", raising the standards Use T00029, but against the creators TA07 Channel Selection -D1 Detect +D01 F00043 @@ -355,7 +355,7 @@ Technique should be in terms of "strategic innoculation", raising the standards Platform companies and some information security companies (e.g. ZeroFox) do this. TA07 Channel Selection -D1 Detect +D01 F00044 @@ -363,7 +363,7 @@ Technique should be in terms of "strategic innoculation", raising the standards Can be used in all phases for all techniques. TA08 Pump Priming -D1 Detect +D01 F00045 @@ -371,7 +371,7 @@ Technique should be in terms of "strategic innoculation", raising the standards Can be used in all phases for all techniques. TA08 Pump Priming -D1 Detect +D01 F00046 @@ -379,7 +379,7 @@ Technique should be in terms of "strategic innoculation", raising the standards TA08 Pump Priming -D1 Detect +D01 F00047 @@ -387,7 +387,7 @@ Technique should be in terms of "strategic innoculation", raising the standards TA08 Pump Priming -D1 Detect +D01 F00048 @@ -395,7 +395,7 @@ Technique should be in terms of "strategic innoculation", raising the standards TA08 Pump Priming -D1 Detect +D01 F00049 @@ -403,7 +403,7 @@ Technique should be in terms of "strategic innoculation", raising the standards TA08 Pump Priming -D1 Detect +D01 F00050 @@ -411,7 +411,7 @@ Technique should be in terms of "strategic innoculation", raising the standards TA08 Pump Priming -D1 Detect +D01 F00051 @@ -419,7 +419,7 @@ Technique should be in terms of "strategic innoculation", raising the standards TA09 Exposure -D1 Detect +D01 F00052 @@ -427,7 +427,7 @@ Technique should be in terms of "strategic innoculation", raising the standards Discovering the sponsors behind a campaign, narrative, bot, a set of accounts, or a social media comment, or anything else is useful. TA09 Exposure -D1 Detect +D01 F00053 @@ -435,7 +435,7 @@ Technique should be in terms of "strategic innoculation", raising the standards TA09 Exposure -D1 Detect +D01 F00054 @@ -443,7 +443,7 @@ Technique should be in terms of "strategic innoculation", raising the standards TA09 Exposure -D1 Detect +D01 F00055 @@ -451,7 +451,7 @@ Technique should be in terms of "strategic innoculation", raising the standards TA09 Exposure -D1 Detect +D01 F00056 @@ -459,7 +459,7 @@ Technique should be in terms of "strategic innoculation", raising the standards TA09 Exposure -D1 Detect +D01 F00057 @@ -467,7 +467,7 @@ Technique should be in terms of "strategic innoculation", raising the standards TA09 Exposure -D1 Detect +D01 F00058 @@ -477,7 +477,7 @@ Technique should be in terms of "strategic innoculation", raising the standards For example, other ways of deplatforming people include attacking their sources of funds, their allies, their followers, etc. TA10 Go Physical -D1 Detect +D01 F00059 @@ -485,7 +485,7 @@ For example, other ways of deplatforming people include attacking their sources All techniques provide or are susceptible to being countered by, or leveraged for, knowledge about user demographics. TA10 Go Physical -D1 Detect +D01 F00060 @@ -493,7 +493,7 @@ For example, other ways of deplatforming people include attacking their sources I assume this was a transcript error. Otherwise, "Identify Susceptible Influences" as in the various methods of influences that may work against a victim could also be a technique. Nope, wasn't a transcript error: original note says influencers, as in find people of influence that might be targetted. TA10 Go Physical -D1 Detect +D01 F00061 @@ -501,7 +501,7 @@ For example, other ways of deplatforming people include attacking their sources TA10 Go Physical -D1 Detect +D01 F00062 @@ -509,7 +509,7 @@ For example, other ways of deplatforming people include attacking their sources TA11 Persistence -D1 Detect +D01 F00063 @@ -517,7 +517,7 @@ For example, other ways of deplatforming people include attacking their sources TA11 Persistence -D1 Detect +D01 F00064 @@ -525,7 +525,7 @@ For example, other ways of deplatforming people include attacking their sources TA11 Persistence -D1 Detect +D01 F00065 @@ -533,7 +533,7 @@ For example, other ways of deplatforming people include attacking their sources TA11 Persistence -D1 Detect +D01 F00066 @@ -541,7 +541,7 @@ For example, other ways of deplatforming people include attacking their sources TA11 Persistence -D1 Detect +D01 F00067 @@ -549,7 +549,7 @@ For example, other ways of deplatforming people include attacking their sources -D1 Detect +D01 F00068 @@ -557,7 +557,7 @@ For example, other ways of deplatforming people include attacking their sources a developing methodology for identifying statistical differences in how social groups use language and quantifying how common those statistical differences are within a larger population. In essence, it hypothesizes how much affinity might exist for a specific group within a general population, based on the language its members employ -D1 Detect +D01 F00069 @@ -565,7 +565,7 @@ For example, other ways of deplatforming people include attacking their sources To effectively counter Russian propaganda, it will be critical to track Russian influence efforts. The information requirements are varied and include the following: • Identify fake-news stories and their sources. • Understand narrative themes and content that pervade various Russian media sources. • Understand the broader Russian strategy that underlies tactical propaganda messaging. -D1 Detect +D01 F00070 @@ -573,7 +573,7 @@ For example, other ways of deplatforming people include attacking their sources ALL -D1 Detect +D01 F00071 @@ -581,7 +581,7 @@ For example, other ways of deplatforming people include attacking their sources Local influencers detected via Twitter networks are likely local influencers in other online and off-line channels as well. In addition, the content and themes gleaned from Russia and Russia-supporting populations, as well as anti-Russia activists, likely swirl in other online and off-line mediums as well. -D1 Detect +D01 F00072 @@ -589,7 +589,7 @@ For example, other ways of deplatforming people include attacking their sources It is possible that some of these are bots or trolls and could be flagged for suspension for violating Twitter’s terms of service. -D1 Detect +D01 F00073 @@ -597,7 +597,7 @@ For example, other ways of deplatforming people include attacking their sources Players at the level of covert attribution, referred to as “black” in the grayscale of deniability, produce content on user-generated media, such as YouTube, but also add fear-mongering commentary to and amplify content produced by others and supply exploitable content to data dump websites. These activities are conducted by a network of trolls, bots, honeypots, and hackers. -D1 Detect +D01 F00074 @@ -605,7 +605,7 @@ For example, other ways of deplatforming people include attacking their sources brand ambassador programs could be used with influencers across a variety of social media channels. It could also target other prominent experts, such as academics, business leaders, and other potentially prominent people. Authorities must ultimately take care in implementing such a program given the risk that contact with U.S. or NATO authorities might damage influencer reputations. Engagements must consequently be made with care, and, if possible, government interlocutors should work through local NGOs. -D1 Detect +D01 F00075 @@ -613,7 +613,7 @@ For example, other ways of deplatforming people include attacking their sources significant amounts of quality open-source information are now available and should be leveraged to build products and analysis prior to problem prioritization in the areas of observation, attribution, and intent. Successfully distinguishing the gray zone campaign signal through the global noise requires action through the entirety of the national security community. Policy, process, and tools must all adapt and evolve to detect, discern, and act upon a new type of signal -D1 Detect +D01 F00076 @@ -622,7 +622,7 @@ For example, other ways of deplatforming people include attacking their sources -D1 Detect +D01 F00077 @@ -630,7 +630,7 @@ For example, other ways of deplatforming people include attacking their sources Bot account: action based, people. Unsure which AMITT techniques. TA03 Develop People -D1 Detect +D01 F00078 @@ -638,7 +638,7 @@ For example, other ways of deplatforming people include attacking their sources All techniques benefit from careful analysis and monitoring of activities on social network. TA03 Develop People -D1 Detect +D01 F00079 @@ -646,7 +646,7 @@ For example, other ways of deplatforming people include attacking their sources TA05 Microtargeting -D1 Detect +D01 F00080 @@ -654,7 +654,7 @@ For example, other ways of deplatforming people include attacking their sources Two wrongs don't make a right? But if you hack your own polls, you do learn how it could be done, and learn what to look for TA07 Channel Selection -D1 Detect +D01 F00081 @@ -662,7 +662,7 @@ For example, other ways of deplatforming people include attacking their sources TA09 Exposure -D1 Detect +D01 F00082 @@ -670,7 +670,7 @@ For example, other ways of deplatforming people include attacking their sources TA11 Persistence -D3 Disrupt +D03 F00083 @@ -678,7 +678,7 @@ For example, other ways of deplatforming people include attacking their sources TA11 Persistence -D5 Deceive +D05 F00084 @@ -686,7 +686,7 @@ For example, other ways of deplatforming people include attacking their sources TA03 Develop People -D1 Detect +D01 F00085 @@ -705,7 +705,7 @@ Intent: judgement of adversarial intent to conduct gray zone activity. Indeed, t Develop an intelligence-based understanding of foreign actors’ motivations, psychologies, and societal and geopolitical contexts. Leverage artificial intelligence to identify patterns and infer competitors’ intent TA02 Objective planning -D1 Detect +D01 F00087 @@ -713,7 +713,7 @@ Intent: judgement of adversarial intent to conduct gray zone activity. Indeed, t United States has not adequately adapted its information indicators and thresholds for warning policymakers to account for gray zone tactics. Competitors have undertaken a marked shift to slow-burn, deceptive, non-military, and indirect challenges to U.S. interests. Relative to traditional security indicators and warnings, these are more numerous and harder to detect and make it difficult for analysts to infer intent. -D1 Detect +D01 F00088 @@ -721,7 +721,7 @@ Intent: judgement of adversarial intent to conduct gray zone activity. Indeed, t Recognize campaigns from weak signals, including rivals’ intent, capability, impact, interactive effects, and impact on U.S. interests... focus on adversarial covert action aspects of campaigning. -D1 Detect +D01 F00089 @@ -729,7 +729,7 @@ Intent: judgement of adversarial intent to conduct gray zone activity. Indeed, t "Gray zone" is second level of content producers and circulators, composed of outlets with uncertain attribution. This category covers conspiracy websites, far-right or far-left websites, news aggregators, and data dump websites TA04 Develop Networks -D1 Detect +D01 F00090 @@ -737,7 +737,7 @@ Intent: judgement of adversarial intent to conduct gray zone activity. Indeed, t Bring private sector and civil society into accord on U.S. interests TA01 Strategic Planning -D1 Detect +D01 F00091 @@ -745,7 +745,7 @@ Intent: judgement of adversarial intent to conduct gray zone activity. Indeed, t This might include working with relevant technology firms to ensure that contracted analytic support is available. Contracted support is reportedly valuable because technology to monitor social media data is continually evolving, and such firms can provide the expertise to help identify and analyze trends, and they can more effectively stay abreast of the changing systems and develop new models as they are required TA01 Strategic Planning -D1 Detect +D01 F00092 @@ -753,7 +753,7 @@ Intent: judgement of adversarial intent to conduct gray zone activity. Indeed, t Warn social media companies about an ongoing campaign (e.g. antivax sites). Anyone with datasets or data summaries can help with this TA09 Exposure -D1 Detect +D01 F00093 @@ -761,7 +761,7 @@ Intent: judgement of adversarial intent to conduct gray zone activity. Indeed, t S4D is a way to separate out different speakers in text, audio. M004 - friction TA03 Develop People -D3 Disrupt +D01 F00094 @@ -769,6 +769,14 @@ Intent: judgement of adversarial intent to conduct gray zone activity. Indeed, t M003 - daylight TA07 Channel Selection -D2 Deny +D01 + + +F00095 +Fact checking +Process suspicious artifacts, narratives, and incidents + +TA09 Exposure +D01 diff --git a/incidents/I00002.md b/incidents/I00002.md index c514d45..874a109 100644 --- a/incidents/I00002.md +++ b/incidents/I00002.md @@ -15,13 +15,13 @@ | Technique | Description given for this incident | | --------- | ------------------------- | -| [T0017 Promote online funding](../techniques/T0017.md) | I00002T002 Promote "funding" campaign | -| [T0018 Paid targeted ads](../techniques/T0018.md) | I00002T001 buy FB targeted ads | -| [T0019 Generate information pollution](../techniques/T0019.md) | I00002T003 create web-site - information pollution | -| [T0046 Search Engine Optimization](../techniques/T0046.md) | I00002T004 SEO optimisation/manipulation ("key words") | -| [T0056 Dedicated channels disseminate information pollution](../techniques/T0056.md) | I00002T003 create web-site - information pollution | -| [T0058 Legacy web content](../techniques/T0058.md) | I00002T005 legacy web content | -| [T0058 Legacy web content](../techniques/T0058.md) | I00002T006 hard to remove content and/or campaign/exploit TOS | +| [T0017 Promote online funding](../techniques/T0017.md) | IT00000002 Promote "funding" campaign | +| [T0018 Paid targeted ads](../techniques/T0018.md) | IT00000001 buy FB targeted ads | +| [T0019 Generate information pollution](../techniques/T0019.md) | IT00000003 create web-site - information pollution | +| [T0046 Search Engine Optimization](../techniques/T0046.md) | IT00000005 SEO optimisation/manipulation ("key words") | +| [T0056 Dedicated channels disseminate information pollution](../techniques/T0056.md) | IT00000004 create web-site - information pollution | +| [T0058 Legacy web content](../techniques/T0058.md) | IT00000006 legacy web content | +| [T0058 Legacy web content](../techniques/T0058.md) | IT00000007 hard to remove content and/or campaign/exploit TOS | DO NOT EDIT ABOVE THIS LINE - PLEASE ADD NOTES BELOW diff --git a/incidents/I00005.md b/incidents/I00005.md index 0383cec..8f8d19b 100644 --- a/incidents/I00005.md +++ b/incidents/I00005.md @@ -24,23 +24,23 @@ The report adds that although officially the Russian government asserted its neu | Technique | Description given for this incident | | --------- | ------------------------- | -| [T0007 Create fake Social Media Profiles / Pages / Groups](../techniques/T0007.md) | I00005T004 Fake FB groups + dark content | -| [T0010 Cultivate ignorant agents](../techniques/T0010.md) | I00005T008 cultivate, manipulate, exploit useful idiots | -| [T0018 Paid targeted ads](../techniques/T0018.md) | I00005T003 Targeted FB paid ads | -| [T0019 Generate information pollution](../techniques/T0019.md) | I00005T007 RT & Sputnik generate information pollution | -| [T0021 Memes](../techniques/T0021.md) | I00005T011 Memes... anti-immigration; euroskepticism; fear, outrage, conspiracy narratives | -| [T0029 Manipulate online polls](../techniques/T0029.md) | I00005T006 manipulate social media "online polls"? | -| [T0030 Backstop personas](../techniques/T0030.md) | I00005T012 Backstop personas | -| [T0031 YouTube](../techniques/T0031.md) | I00005T009 YouTube; Reddit; LinkedIn; Pinterest; WhatsApp? | -| [T0032 Reddit](../techniques/T0032.md) | I00005T009 YouTube; Reddit; LinkedIn; Pinterest; WhatsApp? | -| [T0034 LinkedIn](../techniques/T0034.md) | I00005T009 YouTube; Reddit; LinkedIn; Pinterest; WhatsApp? | -| [T0035 Pinterest](../techniques/T0035.md) | I00005T009 YouTube; Reddit; LinkedIn; Pinterest; WhatsApp? | -| [T0036 WhatsApp](../techniques/T0036.md) | I00005T009 YouTube; Reddit; LinkedIn; Pinterest; WhatsApp? | -| [T0046 Search Engine Optimization](../techniques/T0046.md) | I00005T010 SEO optimisation/manipulation ("key words") | -| [T0053 Twitter trolls amplify and manipulate](../techniques/T0053.md) | I00005T002 Twitter trolls amplify & manipulate | -| [T0054 Twitter bots amplify](../techniques/T0054.md) | I00005T001 Twitter bots amplify & manipulate | -| [T0056 Dedicated channels disseminate information pollution](../techniques/T0056.md) | I00005T007 RT & Sputnik generate information pollution | -| [T0057 Organise remote rallies and events](../techniques/T0057.md) | I00005T005 Digital to physical "organize+promote" rallies & events? | +| [T0007 Create fake Social Media Profiles / Pages / Groups](../techniques/T0007.md) | IT00000011 Fake FB groups + dark content | +| [T0010 Cultivate ignorant agents](../techniques/T0010.md) | IT00000016 cultivate, manipulate, exploit useful idiots | +| [T0018 Paid targeted ads](../techniques/T0018.md) | IT00000010 Targeted FB paid ads | +| [T0019 Generate information pollution](../techniques/T0019.md) | IT00000014 RT & Sputnik generate information pollution | +| [T0021 Memes](../techniques/T0021.md) | IT00000023 Memes... anti-immigration; euroskepticism; fear, outrage, conspiracy narratives | +| [T0029 Manipulate online polls](../techniques/T0029.md) | IT00000013 manipulate social media "online polls"? | +| [T0030 Backstop personas](../techniques/T0030.md) | IT00000024 Backstop personas | +| [T0031 YouTube](../techniques/T0031.md) | IT00000017 YouTube; Reddit; LinkedIn; Pinterest; WhatsApp? | +| [T0032 Reddit](../techniques/T0032.md) | IT00000018 YouTube; Reddit; LinkedIn; Pinterest; WhatsApp? | +| [T0034 LinkedIn](../techniques/T0034.md) | IT00000019 YouTube; Reddit; LinkedIn; Pinterest; WhatsApp? | +| [T0035 Pinterest](../techniques/T0035.md) | IT00000020 YouTube; Reddit; LinkedIn; Pinterest; WhatsApp? | +| [T0036 WhatsApp](../techniques/T0036.md) | IT00000021 YouTube; Reddit; LinkedIn; Pinterest; WhatsApp? | +| [T0046 Search Engine Optimization](../techniques/T0046.md) | IT00000022 SEO optimisation/manipulation ("key words") | +| [T0053 Twitter trolls amplify and manipulate](../techniques/T0053.md) | IT00000009 Twitter trolls amplify & manipulate | +| [T0054 Twitter bots amplify](../techniques/T0054.md) | IT00000008 Twitter bots amplify & manipulate | +| [T0056 Dedicated channels disseminate information pollution](../techniques/T0056.md) | IT00000015 RT & Sputnik generate information pollution | +| [T0057 Organise remote rallies and events](../techniques/T0057.md) | IT00000012 Digital to physical "organize+promote" rallies & events? | DO NOT EDIT ABOVE THIS LINE - PLEASE ADD NOTES BELOW diff --git a/incidents/I00006.md b/incidents/I00006.md index b2ca173..1da131a 100644 --- a/incidents/I00006.md +++ b/incidents/I00006.md @@ -15,12 +15,12 @@ | Technique | Description given for this incident | | --------- | ------------------------- | -| [T0007 Create fake Social Media Profiles / Pages / Groups](../techniques/T0007.md) | I00006T004 Fake twitter profiles to amplify | -| [T0015 Create hashtag](../techniques/T0015.md) | I00006T003 Create and use hashtag | -| [T0024 Create fake videos and images](../techniques/T0024.md) | I00006T002 Fake video/images | -| [T0039 Bait legitimate influencers](../techniques/T0039.md) | I00006T005 bait journalists/media/politicians | -| [T0043 Use SMS/ WhatsApp/ Chat apps](../techniques/T0043.md) | I00006T001 Use SMS/text messages | -| [T0055 Use hashtag](../techniques/T0055.md) | I00006T003 Create and use hashtag | +| [T0007 Create fake Social Media Profiles / Pages / Groups](../techniques/T0007.md) | IT00000029 Fake twitter profiles to amplify | +| [T0015 Create hashtag](../techniques/T0015.md) | IT00000027 Create and use hashtag | +| [T0024 Create fake videos and images](../techniques/T0024.md) | IT00000026 Fake video/images | +| [T0039 Bait legitimate influencers](../techniques/T0039.md) | IT00000030 bait journalists/media/politicians | +| [T0043 Use SMS/ WhatsApp/ Chat apps](../techniques/T0043.md) | IT00000025 Use SMS/text messages | +| [T0055 Use hashtag](../techniques/T0055.md) | IT00000028 Create and use hashtag | DO NOT EDIT ABOVE THIS LINE - PLEASE ADD NOTES BELOW diff --git a/incidents/I00007.md b/incidents/I00007.md index c4abac9..9313f16 100644 --- a/incidents/I00007.md +++ b/incidents/I00007.md @@ -15,11 +15,11 @@ | Technique | Description given for this incident | | --------- | ------------------------- | -| [T0010 Cultivate ignorant agents](../techniques/T0010.md) | I00007T002 cultivate, manipulate, exploit useful idiots (in the case Paul Manafort) | -| [T0019 Generate information pollution](../techniques/T0019.md) | I00007T001 RT & Sputnik generate information pollution (report an unreported false story/event) | -| [T0053 Twitter trolls amplify and manipulate](../techniques/T0053.md) | I00007T004 Twitter trolls amplify & manipulate | -| [T0054 Twitter bots amplify](../techniques/T0054.md) | I00007T003 Twitter bots amplify & manipulate | -| [T0056 Dedicated channels disseminate information pollution](../techniques/T0056.md) | I00007T001 RT & Sputnik generate information pollution (report an unreported false story/event) | +| [T0010 Cultivate ignorant agents](../techniques/T0010.md) | IT00000033 cultivate, manipulate, exploit useful idiots (in the case Paul Manafort) | +| [T0019 Generate information pollution](../techniques/T0019.md) | IT00000031 RT & Sputnik generate information pollution (report an unreported false story/event) | +| [T0053 Twitter trolls amplify and manipulate](../techniques/T0053.md) | IT00000035 Twitter trolls amplify & manipulate | +| [T0054 Twitter bots amplify](../techniques/T0054.md) | IT00000034 Twitter bots amplify & manipulate | +| [T0056 Dedicated channels disseminate information pollution](../techniques/T0056.md) | IT00000032 RT & Sputnik generate information pollution (report an unreported false story/event) | DO NOT EDIT ABOVE THIS LINE - PLEASE ADD NOTES BELOW diff --git a/incidents/I00009.md b/incidents/I00009.md index 2dd01d4..23c0a66 100644 --- a/incidents/I00009.md +++ b/incidents/I00009.md @@ -15,11 +15,11 @@ | Technique | Description given for this incident | | --------- | ------------------------- | -| [T0007 Create fake Social Media Profiles / Pages / Groups](../techniques/T0007.md) | I00009T003 FB pages | -| [T0019 Generate information pollution](../techniques/T0019.md) | I00009T002 RT & Sputnik generate information pollution | -| [T0045 Use fake experts](../techniques/T0045.md) | I00009T001 Using "expert" | -| [T0052 Tertiary sites amplify news](../techniques/T0052.md) | I00009T004 News circulated/amplifed by tertiary sites (Russia Insider, The Duran, Geopolitica.ru, Mint Press News, Oriental Review, globalresearch.ca) | -| [T0056 Dedicated channels disseminate information pollution](../techniques/T0056.md) | I00009T002 RT & Sputnik generate information pollution | +| [T0007 Create fake Social Media Profiles / Pages / Groups](../techniques/T0007.md) | IT00000039 FB pages | +| [T0019 Generate information pollution](../techniques/T0019.md) | IT00000037 RT & Sputnik generate information pollution | +| [T0045 Use fake experts](../techniques/T0045.md) | IT00000036 Using "expert" | +| [T0052 Tertiary sites amplify news](../techniques/T0052.md) | IT00000040 News circulated/amplifed by tertiary sites (Russia Insider, The Duran, Geopolitica.ru, Mint Press News, Oriental Review, globalresearch.ca) | +| [T0056 Dedicated channels disseminate information pollution](../techniques/T0056.md) | IT00000038 RT & Sputnik generate information pollution | DO NOT EDIT ABOVE THIS LINE - PLEASE ADD NOTES BELOW diff --git a/incidents/I00010.md b/incidents/I00010.md index 7692ddf..fe89a11 100644 --- a/incidents/I00010.md +++ b/incidents/I00010.md @@ -6,7 +6,7 @@ * **Year started:** 2018 -* **Countries:** ?? , USA +* **Countries:** Unknown , USA * **Found via:** @@ -15,15 +15,15 @@ | Technique | Description given for this incident | | --------- | ------------------------- | -| [T0007 Create fake Social Media Profiles / Pages / Groups](../techniques/T0007.md) | I00010T005 FB pages/groups/profiles | -| [T0010 Cultivate ignorant agents](../techniques/T0010.md) | I00010T004 cultivate, manipulate, exploit useful idiots (Alex Jones... drives conspiracy theories; false flags, crisis actors) | -| [T0020 Trial content](../techniques/T0020.md) | I00010T007 4Chan/8Chan - trial content | -| [T0031 YouTube](../techniques/T0031.md) | I00010T006 YouTube; Reddit | -| [T0032 Reddit](../techniques/T0032.md) | I00010T006 YouTube; Reddit | -| [T0039 Bait legitimate influencers](../techniques/T0039.md) | I00010T008 journalist/media baiting | -| [T0046 Search Engine Optimization](../techniques/T0046.md) | I00010T003 SEO optimisation/manipulation ("key words") | -| [T0053 Twitter trolls amplify and manipulate](../techniques/T0053.md) | I00010T002 Twitter trolls amplify & manipulate | -| [T0054 Twitter bots amplify](../techniques/T0054.md) | I00010T001 Twitter bots amplify & manipulate | +| [T0007 Create fake Social Media Profiles / Pages / Groups](../techniques/T0007.md) | IT00000045 FB pages/groups/profiles | +| [T0010 Cultivate ignorant agents](../techniques/T0010.md) | IT00000044 cultivate, manipulate, exploit useful idiots (Alex Jones... drives conspiracy theories; false flags, crisis actors) | +| [T0020 Trial content](../techniques/T0020.md) | IT00000048 4Chan/8Chan - trial content | +| [T0031 YouTube](../techniques/T0031.md) | IT00000046 YouTube; Reddit | +| [T0032 Reddit](../techniques/T0032.md) | IT00000047 YouTube; Reddit | +| [T0039 Bait legitimate influencers](../techniques/T0039.md) | IT00000049 journalist/media baiting | +| [T0046 Search Engine Optimization](../techniques/T0046.md) | IT00000043 SEO optimisation/manipulation ("key words") | +| [T0053 Twitter trolls amplify and manipulate](../techniques/T0053.md) | IT00000042 Twitter trolls amplify & manipulate | +| [T0054 Twitter bots amplify](../techniques/T0054.md) | IT00000041 Twitter bots amplify & manipulate | DO NOT EDIT ABOVE THIS LINE - PLEASE ADD NOTES BELOW diff --git a/incidents/I00011.md b/incidents/I00011.md index be7f5d3..f6c5daa 100644 --- a/incidents/I00011.md +++ b/incidents/I00011.md @@ -6,7 +6,7 @@ * **Year started:** 2019 -* **Countries:** ?? , USA +* **Countries:** Unknown , USA * **Found via:** diff --git a/incidents/I00015.md b/incidents/I00015.md index 4adb5d3..9dcb1d1 100644 --- a/incidents/I00015.md +++ b/incidents/I00015.md @@ -15,10 +15,10 @@ | Technique | Description given for this incident | | --------- | ------------------------- | -| [T0025 Leak altered documents](../techniques/T0025.md) | I00015T001 Forge ('release' altered hacked documents) | -| [T0025 Leak altered documents](../techniques/T0025.md) | I00015T002 hack/leak/manipulate/distort | -| [T0039 Bait legitimate influencers](../techniques/T0039.md) | I00015T004 journalist/media baiting | -| [T0044 Seed distortions](../techniques/T0044.md) | I00015T003 Circulate to media via DM, then release publicly | +| [T0025 Leak altered documents](../techniques/T0025.md) | IT00000050 Forge ('release' altered hacked documents) | +| [T0025 Leak altered documents](../techniques/T0025.md) | IT00000051 hack/leak/manipulate/distort | +| [T0039 Bait legitimate influencers](../techniques/T0039.md) | IT00000053 journalist/media baiting | +| [T0044 Seed distortions](../techniques/T0044.md) | IT00000052 Circulate to media via DM, then release publicly | DO NOT EDIT ABOVE THIS LINE - PLEASE ADD NOTES BELOW diff --git a/incidents/I00017.md b/incidents/I00017.md index a3f0b41..fa50a28 100644 --- a/incidents/I00017.md +++ b/incidents/I00017.md @@ -15,27 +15,27 @@ | Technique | Description given for this incident | | --------- | ------------------------- | -| [T0007 Create fake Social Media Profiles / Pages / Groups](../techniques/T0007.md) | I00017T005 Fake FB groups + dark content | -| [T0010 Cultivate ignorant agents](../techniques/T0010.md) | I00017T009 cultivate, manipulate, exploit useful idiots | -| [T0016 Clickbait](../techniques/T0016.md) | I00017T014 Click-bait (economic actors) fake news sites (ie: Denver Guardian; Macedonian teens) | -| [T0018 Paid targeted ads](../techniques/T0018.md) | I00017T004 Targeted FB paid ads | -| [T0019 Generate information pollution](../techniques/T0019.md) | I00017T008 RT & Sputnik generate information pollution | -| [T0020 Trial content](../techniques/T0020.md) | I00017T011 4Chan/8Chan - trial content | -| [T0021 Memes](../techniques/T0021.md) | I00017T013 Memes... anti-immigration; euroskepticism; fear, outrage, conspiracy narratives | -| [T0025 Leak altered documents](../techniques/T0025.md) | I00017T001 hack/leak/manipulate/distort | -| [T0029 Manipulate online polls](../techniques/T0029.md) | I00017T007 manipulate social media "online polls"? | -| [T0030 Backstop personas](../techniques/T0030.md) | I00017T015 Backstop personas | -| [T0031 YouTube](../techniques/T0031.md) | I00017T010 YouTube; Reddit; (Instagram, LinkedIn; Pinterest; WhatsApp?) | -| [T0032 Reddit](../techniques/T0032.md) | I00017T010 YouTube; Reddit; (Instagram, LinkedIn; Pinterest; WhatsApp?) | -| [T0033 Instagram](../techniques/T0033.md) | I00017T010 YouTube; Reddit; (Instagram, LinkedIn; Pinterest; WhatsApp?) | -| [T0034 LinkedIn](../techniques/T0034.md) | I00017T010 YouTube; Reddit; (Instagram, LinkedIn; Pinterest; WhatsApp?) | -| [T0035 Pinterest](../techniques/T0035.md) | I00017T010 YouTube; Reddit; (Instagram, LinkedIn; Pinterest; WhatsApp?) | -| [T0036 WhatsApp](../techniques/T0036.md) | I00017T010 YouTube; Reddit; (Instagram, LinkedIn; Pinterest; WhatsApp?) | -| [T0046 Search Engine Optimization](../techniques/T0046.md) | I00017T012 SEO optimisation/manipulation ("key words") | -| [T0053 Twitter trolls amplify and manipulate](../techniques/T0053.md) | I00017T003 Twitter trolls amplify & manipulate | -| [T0054 Twitter bots amplify](../techniques/T0054.md) | I00017T002 Twitter bots amplify & manipulate | -| [T0056 Dedicated channels disseminate information pollution](../techniques/T0056.md) | I00017T008 RT & Sputnik generate information pollution | -| [T0057 Organise remote rallies and events](../techniques/T0057.md) | I00017T006 Digital to physical "organize+promote" rallies & events | +| [T0007 Create fake Social Media Profiles / Pages / Groups](../techniques/T0007.md) | IT00000058 Fake FB groups + dark content | +| [T0010 Cultivate ignorant agents](../techniques/T0010.md) | IT00000063 cultivate, manipulate, exploit useful idiots | +| [T0016 Clickbait](../techniques/T0016.md) | IT00000073 Click-bait (economic actors) fake news sites (ie: Denver Guardian; Macedonian teens) | +| [T0018 Paid targeted ads](../techniques/T0018.md) | IT00000057 Targeted FB paid ads | +| [T0019 Generate information pollution](../techniques/T0019.md) | IT00000061 RT & Sputnik generate information pollution | +| [T0020 Trial content](../techniques/T0020.md) | IT00000070 4Chan/8Chan - trial content | +| [T0021 Memes](../techniques/T0021.md) | IT00000072 Memes... anti-immigration; euroskepticism; fear, outrage, conspiracy narratives | +| [T0025 Leak altered documents](../techniques/T0025.md) | IT00000054 hack/leak/manipulate/distort | +| [T0029 Manipulate online polls](../techniques/T0029.md) | IT00000060 manipulate social media "online polls"? | +| [T0030 Backstop personas](../techniques/T0030.md) | IT00000074 Backstop personas | +| [T0031 YouTube](../techniques/T0031.md) | IT00000064 YouTube; Reddit; (Instagram, LinkedIn; Pinterest; WhatsApp?) | +| [T0032 Reddit](../techniques/T0032.md) | IT00000065 YouTube; Reddit; (Instagram, LinkedIn; Pinterest; WhatsApp?) | +| [T0033 Instagram](../techniques/T0033.md) | IT00000066 YouTube; Reddit; (Instagram, LinkedIn; Pinterest; WhatsApp?) | +| [T0034 LinkedIn](../techniques/T0034.md) | IT00000067 YouTube; Reddit; (Instagram, LinkedIn; Pinterest; WhatsApp?) | +| [T0035 Pinterest](../techniques/T0035.md) | IT00000068 YouTube; Reddit; (Instagram, LinkedIn; Pinterest; WhatsApp?) | +| [T0036 WhatsApp](../techniques/T0036.md) | IT00000069 YouTube; Reddit; (Instagram, LinkedIn; Pinterest; WhatsApp?) | +| [T0046 Search Engine Optimization](../techniques/T0046.md) | IT00000071 SEO optimisation/manipulation ("key words") | +| [T0053 Twitter trolls amplify and manipulate](../techniques/T0053.md) | IT00000056 Twitter trolls amplify & manipulate | +| [T0054 Twitter bots amplify](../techniques/T0054.md) | IT00000055 Twitter bots amplify & manipulate | +| [T0056 Dedicated channels disseminate information pollution](../techniques/T0056.md) | IT00000062 RT & Sputnik generate information pollution | +| [T0057 Organise remote rallies and events](../techniques/T0057.md) | IT00000059 Digital to physical "organize+promote" rallies & events | DO NOT EDIT ABOVE THIS LINE - PLEASE ADD NOTES BELOW diff --git a/incidents/I00019.md b/incidents/I00019.md index 1971426..5c6e599 100644 --- a/incidents/I00019.md +++ b/incidents/I00019.md @@ -6,7 +6,7 @@ * **Year started:** 2017 -* **Countries:** unknown , France +* **Countries:** , France * **Found via:** OII diff --git a/incidents/I00022.md b/incidents/I00022.md index 5c60b4c..ccd201f 100644 --- a/incidents/I00022.md +++ b/incidents/I00022.md @@ -15,10 +15,10 @@ | Technique | Description given for this incident | | --------- | ------------------------- | -| [T0007 Create fake Social Media Profiles / Pages / Groups](../techniques/T0007.md) | I00022T004 Fake FB groups/pages/profiles + dark content | -| [T0025 Leak altered documents](../techniques/T0025.md) | I00022T001 hack/leak/manipulate/distort | -| [T0053 Twitter trolls amplify and manipulate](../techniques/T0053.md) | I00022T003 Twitter trolls amplify & manipulate | -| [T0054 Twitter bots amplify](../techniques/T0054.md) | I00022T002 Twitter bots amplify & manipulate | +| [T0007 Create fake Social Media Profiles / Pages / Groups](../techniques/T0007.md) | IT00000078 Fake FB groups/pages/profiles + dark content | +| [T0025 Leak altered documents](../techniques/T0025.md) | IT00000075 hack/leak/manipulate/distort | +| [T0053 Twitter trolls amplify and manipulate](../techniques/T0053.md) | IT00000077 Twitter trolls amplify & manipulate | +| [T0054 Twitter bots amplify](../techniques/T0054.md) | IT00000076 Twitter bots amplify & manipulate | DO NOT EDIT ABOVE THIS LINE - PLEASE ADD NOTES BELOW diff --git a/incidents/I00029.md b/incidents/I00029.md index 155d652..13a6190 100644 --- a/incidents/I00029.md +++ b/incidents/I00029.md @@ -15,17 +15,17 @@ | Technique | Description given for this incident | | --------- | ------------------------- | -| [T0001 5Ds (dismiss, distort, distract, dismay, divide)](../techniques/T0001.md) | I00029T003 4 D's (dismiss, distort, distract, dismay...Official channels ie: Embassies & Defence Ministry; TASS | -| [T0010 Cultivate ignorant agents](../techniques/T0010.md) | I00029T005 cultivate, manipulate, exploit useful idiots | -| [T0019 Generate information pollution](../techniques/T0019.md) | I00029T004 RT & Sputnik generate information pollution (synthetic media) | -| [T0031 YouTube](../techniques/T0031.md) | I00029T008 YouTube; Reddit; | -| [T0032 Reddit](../techniques/T0032.md) | I00029T008 YouTube; Reddit; | -| [T0040 Demand unsurmountable proof](../techniques/T0040.md) | I00029T009 Demand insurmountable proof | -| [T0046 Search Engine Optimization](../techniques/T0046.md) | I00029T006 SEO optimisation/manipulation ("key words") | -| [T0052 Tertiary sites amplify news](../techniques/T0052.md) | I00029T007 News circulated/amplifed by tertiary sites (Russia Insider, The Duran, Geopolitica.ru, Mint Press News, Oriental Review, globalresearch.ca) | -| [T0053 Twitter trolls amplify and manipulate](../techniques/T0053.md) | I00029T002 Twitter trolls amplify & manipulate | -| [T0054 Twitter bots amplify](../techniques/T0054.md) | I00029T001 Twitter bots amplify & manipulate | -| [T0056 Dedicated channels disseminate information pollution](../techniques/T0056.md) | I00029T004 RT & Sputnik generate information pollution (synthetic media) | +| [T0001 5Ds (dismiss, distort, distract, dismay, divide)](../techniques/T0001.md) | IT00000081 4 D's (dismiss, distort, distract, dismay...Official channels ie: Embassies & Defence Ministry; TASS | +| [T0010 Cultivate ignorant agents](../techniques/T0010.md) | IT00000084 cultivate, manipulate, exploit useful idiots | +| [T0019 Generate information pollution](../techniques/T0019.md) | IT00000082 RT & Sputnik generate information pollution (synthetic media) | +| [T0031 YouTube](../techniques/T0031.md) | IT00000087 YouTube; Reddit; | +| [T0032 Reddit](../techniques/T0032.md) | IT00000088 YouTube; Reddit; | +| [T0040 Demand unsurmountable proof](../techniques/T0040.md) | IT00000089 Demand insurmountable proof | +| [T0046 Search Engine Optimization](../techniques/T0046.md) | IT00000085 SEO optimisation/manipulation ("key words") | +| [T0052 Tertiary sites amplify news](../techniques/T0052.md) | IT00000086 News circulated/amplifed by tertiary sites (Russia Insider, The Duran, Geopolitica.ru, Mint Press News, Oriental Review, globalresearch.ca) | +| [T0053 Twitter trolls amplify and manipulate](../techniques/T0053.md) | IT00000080 Twitter trolls amplify & manipulate | +| [T0054 Twitter bots amplify](../techniques/T0054.md) | IT00000079 Twitter bots amplify & manipulate | +| [T0056 Dedicated channels disseminate information pollution](../techniques/T0056.md) | IT00000083 RT & Sputnik generate information pollution (synthetic media) | DO NOT EDIT ABOVE THIS LINE - PLEASE ADD NOTES BELOW diff --git a/incidents/I00032.md b/incidents/I00032.md index b820066..2911871 100644 --- a/incidents/I00032.md +++ b/incidents/I00032.md @@ -15,21 +15,21 @@ | Technique | Description given for this incident | | --------- | ------------------------- | -| [T0007 Create fake Social Media Profiles / Pages / Groups](../techniques/T0007.md) | I00032T003 Fake FB groups/pages/profiles | -| [T0010 Cultivate ignorant agents](../techniques/T0010.md) | I00032T009 cultivate, manipulate, exploit useful idiots (Alex Jones... drives conspiracy theories) | -| [T0019 Generate information pollution](../techniques/T0019.md) | I00032T005 RT & Sputnik generate information pollution | -| [T0020 Trial content](../techniques/T0020.md) | I00032T007 4Chan/8Chan - trial content | -| [T0031 YouTube](../techniques/T0031.md) | I00032T006 YouTube; Reddit; (Instagram, LinkedIn; Pinterest; WhatsApp?) | -| [T0032 Reddit](../techniques/T0032.md) | I00032T006 YouTube; Reddit; (Instagram, LinkedIn; Pinterest; WhatsApp?) | -| [T0033 Instagram](../techniques/T0033.md) | I00032T006 YouTube; Reddit; (Instagram, LinkedIn; Pinterest; WhatsApp?) | -| [T0034 LinkedIn](../techniques/T0034.md) | I00032T006 YouTube; Reddit; (Instagram, LinkedIn; Pinterest; WhatsApp?) | -| [T0035 Pinterest](../techniques/T0035.md) | I00032T006 YouTube; Reddit; (Instagram, LinkedIn; Pinterest; WhatsApp?) | -| [T0036 WhatsApp](../techniques/T0036.md) | I00032T006 YouTube; Reddit; (Instagram, LinkedIn; Pinterest; WhatsApp?) | -| [T0046 Search Engine Optimization](../techniques/T0046.md) | I00032T008 SEO optimisation/manipulation ("key words") | -| [T0053 Twitter trolls amplify and manipulate](../techniques/T0053.md) | I00032T002 Twitter trolls amplify & manipulate | -| [T0054 Twitter bots amplify](../techniques/T0054.md) | I00032T001 Twitter bots amplify & manipulate | -| [T0056 Dedicated channels disseminate information pollution](../techniques/T0056.md) | I00032T005 RT & Sputnik generate information pollution | -| [T0057 Organise remote rallies and events](../techniques/T0057.md) | I00032T004 Digital to physical "organize+promote" rallies & events? | +| [T0007 Create fake Social Media Profiles / Pages / Groups](../techniques/T0007.md) | IT00000092 Fake FB groups/pages/profiles | +| [T0010 Cultivate ignorant agents](../techniques/T0010.md) | IT00000104 cultivate, manipulate, exploit useful idiots (Alex Jones... drives conspiracy theories) | +| [T0019 Generate information pollution](../techniques/T0019.md) | IT00000094 RT & Sputnik generate information pollution | +| [T0020 Trial content](../techniques/T0020.md) | IT00000102 4Chan/8Chan - trial content | +| [T0031 YouTube](../techniques/T0031.md) | IT00000096 YouTube; Reddit; (Instagram, LinkedIn; Pinterest; WhatsApp?) | +| [T0032 Reddit](../techniques/T0032.md) | IT00000097 YouTube; Reddit; (Instagram, LinkedIn; Pinterest; WhatsApp?) | +| [T0033 Instagram](../techniques/T0033.md) | IT00000098 YouTube; Reddit; (Instagram, LinkedIn; Pinterest; WhatsApp?) | +| [T0034 LinkedIn](../techniques/T0034.md) | IT00000099 YouTube; Reddit; (Instagram, LinkedIn; Pinterest; WhatsApp?) | +| [T0035 Pinterest](../techniques/T0035.md) | IT00000100 YouTube; Reddit; (Instagram, LinkedIn; Pinterest; WhatsApp?) | +| [T0036 WhatsApp](../techniques/T0036.md) | IT00000101 YouTube; Reddit; (Instagram, LinkedIn; Pinterest; WhatsApp?) | +| [T0046 Search Engine Optimization](../techniques/T0046.md) | IT00000103 SEO optimisation/manipulation ("key words") | +| [T0053 Twitter trolls amplify and manipulate](../techniques/T0053.md) | IT00000091 Twitter trolls amplify & manipulate | +| [T0054 Twitter bots amplify](../techniques/T0054.md) | IT00000090 Twitter bots amplify & manipulate | +| [T0056 Dedicated channels disseminate information pollution](../techniques/T0056.md) | IT00000095 RT & Sputnik generate information pollution | +| [T0057 Organise remote rallies and events](../techniques/T0057.md) | IT00000093 Digital to physical "organize+promote" rallies & events? | DO NOT EDIT ABOVE THIS LINE - PLEASE ADD NOTES BELOW diff --git a/incidents/I00033.md b/incidents/I00033.md index 8ba3554..72ceafd 100644 --- a/incidents/I00033.md +++ b/incidents/I00033.md @@ -15,12 +15,12 @@ | Technique | Description given for this incident | | --------- | ------------------------- | -| [T0002 Facilitate State Propaganda](../techniques/T0002.md) | I00033T005 facilitate state propaganda and defuse crises | -| [T0047 Muzzle social media as a political force](../techniques/T0047.md) | I00033T004 cow online opinion leaders into submission, muzzling social media as a political force | -| [T0048 Cow online opinion leaders](../techniques/T0048.md) | I00033T004 cow online opinion leaders into submission, muzzling social media as a political force | -| [T0049 Flooding](../techniques/T0049.md) | I00033T001 2,000,000 people (est.) part of state run/sponsored astroturfing | -| [T0050 Cheerleading domestic social media ops](../techniques/T0050.md) | I00033T003 domestic social media influence operations focus primarily on “cheerleading” or presenting or furthering a positive narrative about the Chinese state | -| [T0051 Fabricate social media comment](../techniques/T0051.md) | I00033T002 fabricated social media comment | +| [T0002 Facilitate State Propaganda](../techniques/T0002.md) | IT00000110 facilitate state propaganda and defuse crises | +| [T0047 Muzzle social media as a political force](../techniques/T0047.md) | IT00000108 cow online opinion leaders into submission, muzzling social media as a political force | +| [T0048 Cow online opinion leaders](../techniques/T0048.md) | IT00000109 cow online opinion leaders into submission, muzzling social media as a political force | +| [T0049 Flooding](../techniques/T0049.md) | IT00000105 2,000,000 people (est.) part of state run/sponsored astroturfing | +| [T0050 Cheerleading domestic social media ops](../techniques/T0050.md) | IT00000107 domestic social media influence operations focus primarily on “cheerleading” or presenting or furthering a positive narrative about the Chinese state | +| [T0051 Fabricate social media comment](../techniques/T0051.md) | IT00000106 fabricated social media comment | DO NOT EDIT ABOVE THIS LINE - PLEASE ADD NOTES BELOW diff --git a/incidents/I00034.md b/incidents/I00034.md index abe3e20..0a9fa4f 100644 --- a/incidents/I00034.md +++ b/incidents/I00034.md @@ -17,9 +17,9 @@ Unique for taking place outside of the Chinese Internet system, both transgressi | Technique | Description given for this incident | | --------- | ------------------------- | -| [T0002 Facilitate State Propaganda](../techniques/T0002.md) | I00034T001 Netizens from one of the largest discussion forums in China, known as Diba, coordinated to overcome China’s Great Firewall | -| [T0049 Flooding](../techniques/T0049.md) | I00034T002 flood the Facebook pages of Taiwanese politicians and news agencies with a pro-PRC message | -| [T0049 Flooding](../techniques/T0049.md) | I00034T003 Democratic Progressive Party (DPP), attracted nearly 40,000 Facebook comments in just eight hours. | +| [T0002 Facilitate State Propaganda](../techniques/T0002.md) | IT00000111 Netizens from one of the largest discussion forums in China, known as Diba, coordinated to overcome China’s Great Firewall | +| [T0049 Flooding](../techniques/T0049.md) | IT00000112 flood the Facebook pages of Taiwanese politicians and news agencies with a pro-PRC message | +| [T0049 Flooding](../techniques/T0049.md) | IT00000113 Democratic Progressive Party (DPP), attracted nearly 40,000 Facebook comments in just eight hours. | DO NOT EDIT ABOVE THIS LINE - PLEASE ADD NOTES BELOW diff --git a/incidents/I00039.md b/incidents/I00039.md index 6c9e5c1..78b4231 100644 --- a/incidents/I00039.md +++ b/incidents/I00039.md @@ -6,7 +6,7 @@ * **Year started:** 2017 -* **Countries:** unknown , Germany +* **Countries:** Unknown , Germany * **Found via:** OII diff --git a/incidents/I00040.md b/incidents/I00040.md index 7a35914..da57fba 100644 --- a/incidents/I00040.md +++ b/incidents/I00040.md @@ -6,7 +6,7 @@ * **Year started:** 2015 -* **Countries:** unknown , Germany +* **Countries:** Unknown , Germany * **Found via:** OII diff --git a/incidents/I00041.md b/incidents/I00041.md index 1249544..8040974 100644 --- a/incidents/I00041.md +++ b/incidents/I00041.md @@ -6,7 +6,7 @@ * **Year started:** 2017 -* **Countries:** unknown , Germany +* **Countries:** Unknown , Germany * **Found via:** OII diff --git a/incidents/I00042.md b/incidents/I00042.md index f4173ac..e329bfb 100644 --- a/incidents/I00042.md +++ b/incidents/I00042.md @@ -15,10 +15,10 @@ | Technique | Description given for this incident | | --------- | ------------------------- | -| [T0011 Hijack legitimate account](../techniques/T0011.md) | I00042T001 “hack” of Qatar’s official news agency | -| [T0021 Memes](../techniques/T0021.md) | I00042T004 memes | -| [T0024 Create fake videos and images](../techniques/T0024.md) | I00042T003 photoshopped/fake images | -| [T0054 Twitter bots amplify](../techniques/T0054.md) | I00042T002 Twitter bots amplify & manipulate | +| [T0011 Hijack legitimate account](../techniques/T0011.md) | IT00000114 “hack” of Qatar’s official news agency | +| [T0021 Memes](../techniques/T0021.md) | IT00000117 memes | +| [T0024 Create fake videos and images](../techniques/T0024.md) | IT00000116 photoshopped/fake images | +| [T0054 Twitter bots amplify](../techniques/T0054.md) | IT00000115 Twitter bots amplify & manipulate | DO NOT EDIT ABOVE THIS LINE - PLEASE ADD NOTES BELOW diff --git a/incidents/I00043.md b/incidents/I00043.md index b6eb1c3..9c4260c 100644 --- a/incidents/I00043.md +++ b/incidents/I00043.md @@ -6,7 +6,7 @@ * **Year started:** 2017 -* **Countries:** unknown , USA +* **Countries:** Unknown , USA * **Found via:** MIS diff --git a/incidents/I00044.md b/incidents/I00044.md index 1770f8a..6ebdd46 100644 --- a/incidents/I00044.md +++ b/incidents/I00044.md @@ -6,7 +6,7 @@ * **Year started:** 2015 -* **Countries:** , USA +* **Countries:** Russia , USA * **Found via:** MIS @@ -15,16 +15,16 @@ | Technique | Description given for this incident | | --------- | ------------------------- | -| [T0009 Create fake experts](../techniques/T0009.md) | I00044T008 Promote fake “experts” with impressive (and scary) titles | -| [T0010 Cultivate ignorant agents](../techniques/T0010.md) | I00044T007 cultivate, manipulate, exploit useful idiots (Alex Jones... drives conspiracy theories) | -| [T0019 Generate information pollution](../techniques/T0019.md) | I00044T003 RT & Sputnik generate information pollution | -| [T0020 Trial content](../techniques/T0020.md) | I00044T005 4Chan/8Chan - trial content | -| [T0031 YouTube](../techniques/T0031.md) | I00044T004 YouTube; Reddit | -| [T0032 Reddit](../techniques/T0032.md) | I00044T004 YouTube; Reddit | -| [T0046 Search Engine Optimization](../techniques/T0046.md) | I00044T006 SEO optimisation/manipulation ("key words") | -| [T0053 Twitter trolls amplify and manipulate](../techniques/T0053.md) | I00044T002 Twitter trolls amplify & manipulate | -| [T0054 Twitter bots amplify](../techniques/T0054.md) | I00044T001 Twitter bots amplify & manipulate | -| [T0056 Dedicated channels disseminate information pollution](../techniques/T0056.md) | I00044T003 RT & Sputnik generate information pollution | +| [T0009 Create fake experts](../techniques/T0009.md) | IT00000127 Promote fake “experts” with impressive (and scary) titles | +| [T0010 Cultivate ignorant agents](../techniques/T0010.md) | IT00000126 cultivate, manipulate, exploit useful idiots (Alex Jones... drives conspiracy theories) | +| [T0019 Generate information pollution](../techniques/T0019.md) | IT00000120 RT & Sputnik generate information pollution | +| [T0020 Trial content](../techniques/T0020.md) | IT00000124 4Chan/8Chan - trial content | +| [T0031 YouTube](../techniques/T0031.md) | IT00000122 YouTube; Reddit | +| [T0032 Reddit](../techniques/T0032.md) | IT00000123 YouTube; Reddit | +| [T0046 Search Engine Optimization](../techniques/T0046.md) | IT00000125 SEO optimisation/manipulation ("key words") | +| [T0053 Twitter trolls amplify and manipulate](../techniques/T0053.md) | IT00000119 Twitter trolls amplify & manipulate | +| [T0054 Twitter bots amplify](../techniques/T0054.md) | IT00000118 Twitter bots amplify & manipulate | +| [T0056 Dedicated channels disseminate information pollution](../techniques/T0056.md) | IT00000121 RT & Sputnik generate information pollution | DO NOT EDIT ABOVE THIS LINE - PLEASE ADD NOTES BELOW diff --git a/incidents/I00047.md b/incidents/I00047.md index a7c7a4a..3a9282e 100644 --- a/incidents/I00047.md +++ b/incidents/I00047.md @@ -16,12 +16,12 @@ The Russian Federal Security Service (FSB), which is also responsible for border | Technique | Description given for this incident | | --------- | ------------------------- | -| [T0001 5Ds (dismiss, distort, distract, dismay, divide)](../techniques/T0001.md) | I00047T001 4 D's (dismiss, distort, distract, dismay...Official channels ie: Embassies & Defence Ministry; TASS | -| [T0001 5Ds (dismiss, distort, distract, dismay, divide)](../techniques/T0001.md) | I00047T002 Russian FSB security service blamed Ukraine for sparking the clashes, saying their "irrefutable" evidence would "soon be made public | -| [T0023 Distort facts](../techniques/T0023.md) | I00047T003 (Distort) Kremlin-controlled RT cited Russian Minister of Foreign Affairs Sergei Lavrov suggesting that Ukraine deliberately provoked Russia in hopes of gaining additional support from the United States and Europe. | -| [T0040 Demand unsurmountable proof](../techniques/T0040.md) | I00047T006 Demand insurmountable proof | -| [T0053 Twitter trolls amplify and manipulate](../techniques/T0053.md) | I00047T005 Twitter trolls amplify & manipulate | -| [T0054 Twitter bots amplify](../techniques/T0054.md) | I00047T004 Twitter bots amplify & manipulate | +| [T0001 5Ds (dismiss, distort, distract, dismay, divide)](../techniques/T0001.md) | IT00000128 4 D's (dismiss, distort, distract, dismay...Official channels ie: Embassies & Defence Ministry; TASS | +| [T0001 5Ds (dismiss, distort, distract, dismay, divide)](../techniques/T0001.md) | IT00000129 Russian FSB security service blamed Ukraine for sparking the clashes, saying their "irrefutable" evidence would "soon be made public | +| [T0023 Distort facts](../techniques/T0023.md) | IT00000130 (Distort) Kremlin-controlled RT cited Russian Minister of Foreign Affairs Sergei Lavrov suggesting that Ukraine deliberately provoked Russia in hopes of gaining additional support from the United States and Europe. | +| [T0040 Demand unsurmountable proof](../techniques/T0040.md) | IT00000133 Demand insurmountable proof | +| [T0053 Twitter trolls amplify and manipulate](../techniques/T0053.md) | IT00000132 Twitter trolls amplify & manipulate | +| [T0054 Twitter bots amplify](../techniques/T0054.md) | IT00000131 Twitter bots amplify & manipulate | DO NOT EDIT ABOVE THIS LINE - PLEASE ADD NOTES BELOW diff --git a/incidents/I00049.md b/incidents/I00049.md index 1943fcd..fd5f4a8 100644 --- a/incidents/I00049.md +++ b/incidents/I00049.md @@ -15,16 +15,16 @@ | Technique | Description given for this incident | | --------- | ------------------------- | -| [T0001 5Ds (dismiss, distort, distract, dismay, divide)](../techniques/T0001.md) | I00049T003 4 D's (dismiss, distort, distract, dismay...Official channels ie: Embassies & Defence Ministry; TASS | -| [T0010 Cultivate ignorant agents](../techniques/T0010.md) | I00049T005 cultivate, manipulate, exploit useful idiots (Roger Waters; Venessa Beeley...) | -| [T0019 Generate information pollution](../techniques/T0019.md) | I00049T004 RT & Sputnik generate information pollution (synthetic media) | -| [T0031 YouTube](../techniques/T0031.md) | I00049T008 YouTube; Reddit; | -| [T0032 Reddit](../techniques/T0032.md) | I00049T008 YouTube; Reddit; | -| [T0046 Search Engine Optimization](../techniques/T0046.md) | I00049T006 SEO optimisation/manipulation ("key words") | -| [T0052 Tertiary sites amplify news](../techniques/T0052.md) | I00049T007 News circulated/amplifed by tertiary sites (Russia Insider, The Duran, Geopolitica.ru, Mint Press News, Oriental Review, globalresearch.ca) | -| [T0053 Twitter trolls amplify and manipulate](../techniques/T0053.md) | I00049T002 Twitter trolls amplify & manipulate | -| [T0054 Twitter bots amplify](../techniques/T0054.md) | I00049T001 Twitter bots amplify & manipulate | -| [T0056 Dedicated channels disseminate information pollution](../techniques/T0056.md) | I00049T004 RT & Sputnik generate information pollution (synthetic media) | +| [T0001 5Ds (dismiss, distort, distract, dismay, divide)](../techniques/T0001.md) | IT00000136 4 D's (dismiss, distort, distract, dismay...Official channels ie: Embassies & Defence Ministry; TASS | +| [T0010 Cultivate ignorant agents](../techniques/T0010.md) | IT00000139 cultivate, manipulate, exploit useful idiots (Roger Waters; Venessa Beeley...) | +| [T0019 Generate information pollution](../techniques/T0019.md) | IT00000137 RT & Sputnik generate information pollution (synthetic media) | +| [T0031 YouTube](../techniques/T0031.md) | IT00000142 YouTube; Reddit; | +| [T0032 Reddit](../techniques/T0032.md) | IT00000143 YouTube; Reddit; | +| [T0046 Search Engine Optimization](../techniques/T0046.md) | IT00000140 SEO optimisation/manipulation ("key words") | +| [T0052 Tertiary sites amplify news](../techniques/T0052.md) | IT00000141 News circulated/amplifed by tertiary sites (Russia Insider, The Duran, Geopolitica.ru, Mint Press News, Oriental Review, globalresearch.ca) | +| [T0053 Twitter trolls amplify and manipulate](../techniques/T0053.md) | IT00000135 Twitter trolls amplify & manipulate | +| [T0054 Twitter bots amplify](../techniques/T0054.md) | IT00000134 Twitter bots amplify & manipulate | +| [T0056 Dedicated channels disseminate information pollution](../techniques/T0056.md) | IT00000138 RT & Sputnik generate information pollution (synthetic media) | DO NOT EDIT ABOVE THIS LINE - PLEASE ADD NOTES BELOW diff --git a/incidents/I00050.md b/incidents/I00050.md index bb6b9b6..c63a156 100644 --- a/incidents/I00050.md +++ b/incidents/I00050.md @@ -18,15 +18,15 @@ Maduro has remained defiant in the face of domestic and international pressure, | Technique | Description given for this incident | | --------- | ------------------------- | -| [T0010 Cultivate ignorant agents](../techniques/T0010.md) | I00050T004 cultivate, manipulate, exploit useful idiots (Roger Waters) | -| [T0019 Generate information pollution](../techniques/T0019.md) | I00050T003 RT & Sputnik generate information pollution (synthetic media) | -| [T0031 YouTube](../techniques/T0031.md) | I00050T007 YouTube; Reddit; | -| [T0032 Reddit](../techniques/T0032.md) | I00050T007 YouTube; Reddit; | -| [T0046 Search Engine Optimization](../techniques/T0046.md) | I00050T005 SEO optimisation/manipulation ("key words") | -| [T0052 Tertiary sites amplify news](../techniques/T0052.md) | I00050T006 News circulated/amplifed by tertiary sites (Mint Press News, globalresearch.ca) | -| [T0053 Twitter trolls amplify and manipulate](../techniques/T0053.md) | I00050T002 Twitter trolls amplify & manipulate | -| [T0054 Twitter bots amplify](../techniques/T0054.md) | I00050T001 Twitter bots amplify & manipulate | -| [T0056 Dedicated channels disseminate information pollution](../techniques/T0056.md) | I00050T003 RT & Sputnik generate information pollution (synthetic media) | +| [T0010 Cultivate ignorant agents](../techniques/T0010.md) | IT00000148 cultivate, manipulate, exploit useful idiots (Roger Waters) | +| [T0019 Generate information pollution](../techniques/T0019.md) | IT00000146 RT & Sputnik generate information pollution (synthetic media) | +| [T0031 YouTube](../techniques/T0031.md) | IT00000151 YouTube; Reddit; | +| [T0032 Reddit](../techniques/T0032.md) | IT00000152 YouTube; Reddit; | +| [T0046 Search Engine Optimization](../techniques/T0046.md) | IT00000149 SEO optimisation/manipulation ("key words") | +| [T0052 Tertiary sites amplify news](../techniques/T0052.md) | IT00000150 News circulated/amplifed by tertiary sites (Mint Press News, globalresearch.ca) | +| [T0053 Twitter trolls amplify and manipulate](../techniques/T0053.md) | IT00000145 Twitter trolls amplify & manipulate | +| [T0054 Twitter bots amplify](../techniques/T0054.md) | IT00000144 Twitter bots amplify & manipulate | +| [T0056 Dedicated channels disseminate information pollution](../techniques/T0056.md) | IT00000147 RT & Sputnik generate information pollution (synthetic media) | DO NOT EDIT ABOVE THIS LINE - PLEASE ADD NOTES BELOW diff --git a/incidents/I00051.md b/incidents/I00051.md index 3e3d840..ed56283 100644 --- a/incidents/I00051.md +++ b/incidents/I00051.md @@ -16,15 +16,15 @@ The FCO comments on the IfS were issued after a news report said the group had r | Technique | Description given for this incident | | --------- | ------------------------- | -| [T0010 Cultivate ignorant agents](../techniques/T0010.md) | I00051T005 cultivate, manipulate, exploit useful idiots | -| [T0019 Generate information pollution](../techniques/T0019.md) | I00051T004 RT & Sputnik generate information pollution | -| [T0025 Leak altered documents](../techniques/T0025.md) | I00051T001 hack/leak/manipulate/distort | -| [T0031 YouTube](../techniques/T0031.md) | I00051T006 YouTube; Reddit | -| [T0032 Reddit](../techniques/T0032.md) | I00051T006 YouTube; Reddit | -| [T0046 Search Engine Optimization](../techniques/T0046.md) | I00051T007 SEO optimisation/manipulation ("key words") | -| [T0053 Twitter trolls amplify and manipulate](../techniques/T0053.md) | I00051T003 Twitter trolls amplify & manipulate | -| [T0054 Twitter bots amplify](../techniques/T0054.md) | I00051T002 Twitter bots amplify & manipulate | -| [T0056 Dedicated channels disseminate information pollution](../techniques/T0056.md) | I00051T004 RT & Sputnik generate information pollution | +| [T0010 Cultivate ignorant agents](../techniques/T0010.md) | IT00000158 cultivate, manipulate, exploit useful idiots | +| [T0019 Generate information pollution](../techniques/T0019.md) | IT00000156 RT & Sputnik generate information pollution | +| [T0025 Leak altered documents](../techniques/T0025.md) | IT00000153 hack/leak/manipulate/distort | +| [T0031 YouTube](../techniques/T0031.md) | IT00000159 YouTube; Reddit | +| [T0032 Reddit](../techniques/T0032.md) | IT00000160 YouTube; Reddit | +| [T0046 Search Engine Optimization](../techniques/T0046.md) | IT00000161 SEO optimisation/manipulation ("key words") | +| [T0053 Twitter trolls amplify and manipulate](../techniques/T0053.md) | IT00000155 Twitter trolls amplify & manipulate | +| [T0054 Twitter bots amplify](../techniques/T0054.md) | IT00000154 Twitter bots amplify & manipulate | +| [T0056 Dedicated channels disseminate information pollution](../techniques/T0056.md) | IT00000157 RT & Sputnik generate information pollution | DO NOT EDIT ABOVE THIS LINE - PLEASE ADD NOTES BELOW diff --git a/incidents/I00053.md b/incidents/I00053.md index 50f5068..8bb4518 100644 --- a/incidents/I00053.md +++ b/incidents/I00053.md @@ -16,13 +16,13 @@ Geopolitically complex issue combines US/China trade; Security concerns/issues r | Technique | Description given for this incident | | --------- | ------------------------- | -| [T0001 5Ds (dismiss, distort, distract, dismay, divide)](../techniques/T0001.md) | I00053T005 China also plays victim, innocence, plays by rules, misunderstood narrative | -| [T0001 5Ds (dismiss, distort, distract, dismay, divide)](../techniques/T0001.md) | I00053T006 Chinese ambassador Lu Shaye accused Canada of applying a double standard, and has decried what he sees as “Western egotism and white supremacy” in the treatment of detained Huawei executive Meng Wanzhou.” | -| [T0023 Distort facts](../techniques/T0023.md) | I00053T002 Distorted, saccharine “news” about the Chinese State and Party | -| [T0050 Cheerleading domestic social media ops](../techniques/T0050.md) | I00053T004 Extend digital the physical space… gatherings ie: support for Meng outside courthouse | -| [T0056 Dedicated channels disseminate information pollution](../techniques/T0056.md) | I00053T001 State-run media seeds foreign influence environment | -| [T0057 Organise remote rallies and events](../techniques/T0057.md) | I00053T003 Events coordinated and promoted across media platforms | -| [T0057 Organise remote rallies and events](../techniques/T0057.md) | I00053T004 Extend digital the physical space… gatherings ie: support for Meng outside courthouse | +| [T0001 5Ds (dismiss, distort, distract, dismay, divide)](../techniques/T0001.md) | IT00000167 China also plays victim, innocence, plays by rules, misunderstood narrative | +| [T0001 5Ds (dismiss, distort, distract, dismay, divide)](../techniques/T0001.md) | IT00000168 Chinese ambassador Lu Shaye accused Canada of applying a double standard, and has decried what he sees as “Western egotism and white supremacy” in the treatment of detained Huawei executive Meng Wanzhou.” | +| [T0023 Distort facts](../techniques/T0023.md) | IT00000163 Distorted, saccharine “news” about the Chinese State and Party | +| [T0050 Cheerleading domestic social media ops](../techniques/T0050.md) | IT00000165 Extend digital the physical space… gatherings ie: support for Meng outside courthouse | +| [T0056 Dedicated channels disseminate information pollution](../techniques/T0056.md) | IT00000162 State-run media seeds foreign influence environment | +| [T0057 Organise remote rallies and events](../techniques/T0057.md) | IT00000164 Events coordinated and promoted across media platforms | +| [T0057 Organise remote rallies and events](../techniques/T0057.md) | IT00000166 Extend digital the physical space… gatherings ie: support for Meng outside courthouse | DO NOT EDIT ABOVE THIS LINE - PLEASE ADD NOTES BELOW diff --git a/incidents/I00056.md b/incidents/I00056.md index 84d5005..354442a 100644 --- a/incidents/I00056.md +++ b/incidents/I00056.md @@ -16,14 +16,14 @@ While there is history to Iran’s information/influence operations, starting wi | Technique | Description given for this incident | | --------- | ------------------------- | -| [T0007 Create fake Social Media Profiles / Pages / Groups](../techniques/T0007.md) | I00056T003 Fake FB groups/pages/profiles + dark content (non-paid advertising) | -| [T0008 Create fake or imposter news sites](../techniques/T0008.md) | I00056T006 Fake news/synthetic web-sites | -| [T0021 Memes](../techniques/T0021.md) | I00056T005 Memes... anti-Isreal/USA/West, conspiracy narratives | -| [T0022 Conspiracy narratives](../techniques/T0022.md) | I00056T005 Memes... anti-Isreal/USA/West, conspiracy narratives | -| [T0046 Search Engine Optimization](../techniques/T0046.md) | I00056T004 SEO optimisation/manipulation ("key words") | -| [T0053 Twitter trolls amplify and manipulate](../techniques/T0053.md) | I00056T002 Twitter trolls amplify & manipulate | -| [T0054 Twitter bots amplify](../techniques/T0054.md) | I00056T001 Twitter bots amplify & manipulate | -| [T0058 Legacy web content](../techniques/T0058.md) | I00056T007 legacy web content | +| [T0007 Create fake Social Media Profiles / Pages / Groups](../techniques/T0007.md) | IT00000171 Fake FB groups/pages/profiles + dark content (non-paid advertising) | +| [T0008 Create fake or imposter news sites](../techniques/T0008.md) | IT00000175 Fake news/synthetic web-sites | +| [T0021 Memes](../techniques/T0021.md) | IT00000173 Memes... anti-Isreal/USA/West, conspiracy narratives | +| [T0022 Conspiracy narratives](../techniques/T0022.md) | IT00000174 Memes... anti-Isreal/USA/West, conspiracy narratives | +| [T0046 Search Engine Optimization](../techniques/T0046.md) | IT00000172 SEO optimisation/manipulation ("key words") | +| [T0053 Twitter trolls amplify and manipulate](../techniques/T0053.md) | IT00000170 Twitter trolls amplify & manipulate | +| [T0054 Twitter bots amplify](../techniques/T0054.md) | IT00000169 Twitter bots amplify & manipulate | +| [T0058 Legacy web content](../techniques/T0058.md) | IT00000176 legacy web content | DO NOT EDIT ABOVE THIS LINE - PLEASE ADD NOTES BELOW diff --git a/incidents/I00057.md b/incidents/I00057.md index a4ed5bc..dd242d9 100644 --- a/incidents/I00057.md +++ b/incidents/I00057.md @@ -6,7 +6,7 @@ * **Year started:** 2018 -* **Countries:** Russia/domestic , Mexico +* **Countries:** Russia,Mexico , Mexico * **Found via:** diff --git a/incidents/I00062.md b/incidents/I00062.md index c768ea7..cf813a8 100644 --- a/incidents/I00062.md +++ b/incidents/I00062.md @@ -6,7 +6,7 @@ * **Year started:** 2015 -* **Countries:** Russia/domestic , UK +* **Countries:** Russia,UK , UK * **Found via:** diff --git a/incidents/I00063.md b/incidents/I00063.md index 1579f49..77f87c5 100644 --- a/incidents/I00063.md +++ b/incidents/I00063.md @@ -17,16 +17,16 @@ The investigation found corroborating evidence after conducting witness intervie | Technique | Description given for this incident | | --------- | ------------------------- | -| [T0001 5Ds (dismiss, distort, distract, dismay, divide)](../techniques/T0001.md) | I00063T003 4 D's (dismiss, distort, distract, dismay...Official channels ie: Putin himself; Embassies & Sports Ministry; TASS | -| [T0010 Cultivate ignorant agents](../techniques/T0010.md) | I00063T005 cultivate, manipulate, exploit useful idiots | -| [T0019 Generate information pollution](../techniques/T0019.md) | I00063T004 RT & Sputnik generate information pollution (synthetic media) | -| [T0031 YouTube](../techniques/T0031.md) | I00063T008 YouTube; Reddit; | -| [T0032 Reddit](../techniques/T0032.md) | I00063T008 YouTube; Reddit; | -| [T0046 Search Engine Optimization](../techniques/T0046.md) | I00063T006 SEO optimisation/manipulation ("key words") | -| [T0052 Tertiary sites amplify news](../techniques/T0052.md) | I00063T007 News circulated/amplifed by tertiary sites (Russia Insider, The Duran, Geopolitica.ru, Mint Press News, Oriental Review, globalresearch.ca) | -| [T0053 Twitter trolls amplify and manipulate](../techniques/T0053.md) | I00063T002 Twitter trolls amplify & manipulate | -| [T0054 Twitter bots amplify](../techniques/T0054.md) | I00063T001 Twitter bots amplify & manipulate | -| [T0056 Dedicated channels disseminate information pollution](../techniques/T0056.md) | I00063T004 RT & Sputnik generate information pollution (synthetic media) | +| [T0001 5Ds (dismiss, distort, distract, dismay, divide)](../techniques/T0001.md) | IT00000179 4 D's (dismiss, distort, distract, dismay...Official channels ie: Putin himself; Embassies & Sports Ministry; TASS | +| [T0010 Cultivate ignorant agents](../techniques/T0010.md) | IT00000182 cultivate, manipulate, exploit useful idiots | +| [T0019 Generate information pollution](../techniques/T0019.md) | IT00000180 RT & Sputnik generate information pollution (synthetic media) | +| [T0031 YouTube](../techniques/T0031.md) | IT00000185 YouTube; Reddit; | +| [T0032 Reddit](../techniques/T0032.md) | IT00000186 YouTube; Reddit; | +| [T0046 Search Engine Optimization](../techniques/T0046.md) | IT00000183 SEO optimisation/manipulation ("key words") | +| [T0052 Tertiary sites amplify news](../techniques/T0052.md) | IT00000184 News circulated/amplifed by tertiary sites (Russia Insider, The Duran, Geopolitica.ru, Mint Press News, Oriental Review, globalresearch.ca) | +| [T0053 Twitter trolls amplify and manipulate](../techniques/T0053.md) | IT00000178 Twitter trolls amplify & manipulate | +| [T0054 Twitter bots amplify](../techniques/T0054.md) | IT00000177 Twitter bots amplify & manipulate | +| [T0056 Dedicated channels disseminate information pollution](../techniques/T0056.md) | IT00000181 RT & Sputnik generate information pollution (synthetic media) | DO NOT EDIT ABOVE THIS LINE - PLEASE ADD NOTES BELOW diff --git a/incidents_index.md b/incidents_index.md index ece2eda..e43a695 100644 --- a/incidents_index.md +++ b/incidents_index.md @@ -4,9 +4,9 @@ amitt_id name -type +objecttype year_started -to_country +found_in_country found_via diff --git a/metatechniques/M001.md b/metatechniques/M001.md index 69eeb2e..9ce4c3f 100644 --- a/metatechniques/M001.md +++ b/metatechniques/M001.md @@ -5,25 +5,25 @@ | Counters | Response types | | -------- | -------------- | -| [C00009 Educate high profile influencers on best practices](../counters/C00009.md) | D2 Deny | -| [C00011 Media literacy. Games to identify fake news](../counters/C00011.md) | D2 Deny | -| [C00051 Counter social engineering training](../counters/C00051.md) | D2 Deny | -| [C00073 Inoculate populations through media literacy training](../counters/C00073.md) | D2 Deny | -| [C00160 find and train influencers](../counters/C00160.md) | D2 Deny | -| [C00109 Dampen Emotional Reaction](../counters/C00109.md) | D3 Disrupt | -| [C00125 Prebunking](../counters/C00125.md) | D3 Disrupt | -| [C00188 Newsroom/Journalist training to counter influence moves](../counters/C00188.md) | D3 Disrupt | -| [C00190 open engagement with civil society](../counters/C00190.md) | D3 Disrupt | -| [C00212 build public resilience by making civil society more vibrant](../counters/C00212.md) | D3 Disrupt | -| [C00223 Strengthen Trust in social media platforms](../counters/C00223.md) | D3 Disrupt | -| [C00021 Encourage in-person communication](../counters/C00021.md) | D4 Degrade | -| [C00022 Innoculate. Positive campaign to promote feeling of safety](../counters/C00022.md) | D4 Degrade | -| [C00024 Promote healthy narratives](../counters/C00024.md) | D4 Degrade | -| [C00111 Reduce polarisation by connecting and presenting sympathetic renditions of opposite views](../counters/C00111.md) | D4 Degrade | -| [C00027 Create culture of civility](../counters/C00027.md) | D7 Deter | -| [C00093 Influencer code of conduct](../counters/C00093.md) | D7 Deter | -| [C00121 Tool transparency and literacy for channels people follow. ](../counters/C00121.md) | D7 Deter | -| [C00130 Mentorship: elders, youth, credit. Learn vicariously.](../counters/C00130.md) | D7 Deter | +| [C00009 Educate high profile influencers on best practices](../counters/C00009.md) | D02 | +| [C00011 Media literacy. Games to identify fake news](../counters/C00011.md) | D02 | +| [C00051 Counter social engineering training](../counters/C00051.md) | D02 | +| [C00073 Inoculate populations through media literacy training](../counters/C00073.md) | D02 | +| [C00160 find and train influencers](../counters/C00160.md) | D02 | +| [C00109 Dampen Emotional Reaction](../counters/C00109.md) | D03 | +| [C00125 Prebunking](../counters/C00125.md) | D03 | +| [C00188 Newsroom/Journalist training to counter influence moves](../counters/C00188.md) | D03 | +| [C00190 open engagement with civil society](../counters/C00190.md) | D03 | +| [C00212 build public resilience by making civil society more vibrant](../counters/C00212.md) | D03 | +| [C00223 Strengthen Trust in social media platforms](../counters/C00223.md) | D03 | +| [C00021 Encourage in-person communication](../counters/C00021.md) | D04 | +| [C00022 Innoculate. Positive campaign to promote feeling of safety](../counters/C00022.md) | D04 | +| [C00024 Promote healthy narratives](../counters/C00024.md) | D04 | +| [C00111 Reduce polarisation by connecting and presenting sympathetic renditions of opposite views](../counters/C00111.md) | D04 | +| [C00027 Create culture of civility](../counters/C00027.md) | D07 | +| [C00093 Influencer code of conduct](../counters/C00093.md) | D07 | +| [C00121 Tool transparency and literacy for channels people follow. ](../counters/C00121.md) | D07 | +| [C00130 Mentorship: elders, youth, credit. Learn vicariously.](../counters/C00130.md) | D07 | diff --git a/metatechniques/M002.md b/metatechniques/M002.md index 0771032..96e4672 100644 --- a/metatechniques/M002.md +++ b/metatechniques/M002.md @@ -5,20 +5,20 @@ | Counters | Response types | | -------- | -------------- | -| [C00195 Redirect searches away from disinformation or extremist content ](../counters/C00195.md) | D2 Deny | -| [C00202 Set data 'honeytraps'](../counters/C00202.md) | D2 Deny | -| [C00029 Create fake website to issue counter narrative and counter narrative through physical merchandise](../counters/C00029.md) | D3 Disrupt | -| [C00030 Develop a compelling counter narrative (truth based)](../counters/C00030.md) | D3 Disrupt | -| [C00032 Hijack content and link to truth- based info](../counters/C00032.md) | D3 Disrupt | -| [C00078 Change Search Algorithms for Disinformation Content](../counters/C00078.md) | D3 Disrupt | -| [C00080 Create competing narrative](../counters/C00080.md) | D3 Disrupt | -| [C00084 Modify disinformation narratives, and rebroadcast them](../counters/C00084.md) | D3 Disrupt | -| [C00100 Hashtag jacking](../counters/C00100.md) | D3 Disrupt | -| [C00106 Click-bait centrist content](../counters/C00106.md) | D3 Disrupt | -| [C00086 Distract from noise with addictive content](../counters/C00086.md) | D4 Degrade | -| [C00090 Fake engagement system](../counters/C00090.md) | D5 Deceive | -| [C00091 Honeypot social community](../counters/C00091.md) | D5 Deceive | -| [C00103 Create a bot that engages / distract trolls](../counters/C00103.md) | D5 Deceive | +| [C00195 Redirect searches away from disinformation or extremist content ](../counters/C00195.md) | D02 | +| [C00202 Set data 'honeytraps'](../counters/C00202.md) | D02 | +| [C00029 Create fake website to issue counter narrative and counter narrative through physical merchandise](../counters/C00029.md) | D03 | +| [C00030 Develop a compelling counter narrative (truth based)](../counters/C00030.md) | D03 | +| [C00032 Hijack content and link to truth- based info](../counters/C00032.md) | D03 | +| [C00078 Change Search Algorithms for Disinformation Content](../counters/C00078.md) | D03 | +| [C00080 Create competing narrative](../counters/C00080.md) | D03 | +| [C00084 Modify disinformation narratives, and rebroadcast them](../counters/C00084.md) | D03 | +| [C00100 Hashtag jacking](../counters/C00100.md) | D03 | +| [C00106 Click-bait centrist content](../counters/C00106.md) | D03 | +| [C00086 Distract from noise with addictive content](../counters/C00086.md) | D04 | +| [C00090 Fake engagement system](../counters/C00090.md) | D05 | +| [C00091 Honeypot social community](../counters/C00091.md) | D05 | +| [C00103 Create a bot that engages / distract trolls](../counters/C00103.md) | D05 | diff --git a/metatechniques/M003.md b/metatechniques/M003.md index 9073a1d..a188bb4 100644 --- a/metatechniques/M003.md +++ b/metatechniques/M003.md @@ -5,18 +5,18 @@ | Counters | Response types | | -------- | -------------- | -| [C00113 Debunk and defuse a fake expert / credentials.](../counters/C00113.md) | D2 Deny | -| [C00115 Expose actor and intentions](../counters/C00115.md) | D2 Deny | -| [C00116 Provide proof of involvement](../counters/C00116.md) | D2 Deny | -| [C00019 Reduce effect of division-enablers](../counters/C00019.md) | D3 Disrupt | -| [C00081 Highlight flooding and noise, and explain motivations](../counters/C00081.md) | D3 Disrupt | -| [C00085 Mute content](../counters/C00085.md) | D3 Disrupt | -| [C00126 Social media amber alert](../counters/C00126.md) | D3 Disrupt | -| [C00094 Force full disclosure on corporate sponsor of research](../counters/C00094.md) | D4 Degrade | -| [C00184 Media exposure](../counters/C00184.md) | D4 Degrade | -| [C00219 Add metadata to content that’s out of the control of disinformation creators](../counters/C00219.md) | D4 Degrade | -| [C00189 Ensure that platforms are taking down flagged accounts](../counters/C00189.md) | D6 Destroy | -| [C00048 Name and Shame Influencers](../counters/C00048.md) | D7 Deter | +| [C00113 Debunk and defuse a fake expert / credentials.](../counters/C00113.md) | D02 | +| [C00115 Expose actor and intentions](../counters/C00115.md) | D02 | +| [C00116 Provide proof of involvement](../counters/C00116.md) | D02 | +| [C00019 Reduce effect of division-enablers](../counters/C00019.md) | D03 | +| [C00081 Highlight flooding and noise, and explain motivations](../counters/C00081.md) | D03 | +| [C00085 Mute content](../counters/C00085.md) | D03 | +| [C00126 Social media amber alert](../counters/C00126.md) | D03 | +| [C00094 Force full disclosure on corporate sponsor of research](../counters/C00094.md) | D04 | +| [C00184 Media exposure](../counters/C00184.md) | D04 | +| [C00219 Add metadata to content that’s out of the control of disinformation creators](../counters/C00219.md) | D04 | +| [C00189 Ensure that platforms are taking down flagged accounts](../counters/C00189.md) | D06 | +| [C00048 Name and Shame Influencers](../counters/C00048.md) | D07 | diff --git a/metatechniques/M004.md b/metatechniques/M004.md index eefd961..ca6e9d2 100644 --- a/metatechniques/M004.md +++ b/metatechniques/M004.md @@ -5,25 +5,25 @@ | Counters | Response types | | -------- | -------------- | -| [C00006 Charge for social media](../counters/C00006.md) | D2 Deny | -| [C00010 Enhanced privacy regulation for social media](../counters/C00010.md) | D2 Deny | -| [C00056 Encourage people to leave social media](../counters/C00056.md) | D2 Deny | -| [C00097 Require use of verified identities to contribute to poll or comment](../counters/C00097.md) | D2 Deny | -| [C00098 Revocation of allowlisted or "verified" status](../counters/C00098.md) | D2 Deny | -| [C00099 Strengthen verification methods](../counters/C00099.md) | D2 Deny | -| [C00112 "Prove they are not an op!"](../counters/C00112.md) | D2 Deny | -| [C00114 Don't engage with payloads](../counters/C00114.md) | D2 Deny | -| [C00122 Content moderation](../counters/C00122.md) | D2 Deny | -| [C00165 Ensure integrity of official documents](../counters/C00165.md) | D2 Deny | -| [C00044 Keep people from posting to social media immediately](../counters/C00044.md) | D3 Disrupt | -| [C00123 Remove or rate limit botnets](../counters/C00123.md) | D3 Disrupt | -| [C00124 Don't feed the trolls](../counters/C00124.md) | D3 Disrupt | -| [C00139 Weaponise youtube content matrices](../counters/C00139.md) | D3 Disrupt | -| [C00147 Make amplification of social media posts expire (e.g. can't like/ retweet after n days)](../counters/C00147.md) | D3 Disrupt | -| [C00203 Stop offering press credentials to propaganda outlets](../counters/C00203.md) | D3 Disrupt | -| [C00034 Create more friction at account creation](../counters/C00034.md) | D4 Degrade | -| [C00101 Create friction by rate-limiting engagement](../counters/C00101.md) | D4 Degrade | -| [C00142 Platform adds warning label and decision point when sharing content](../counters/C00142.md) | D4 Degrade | +| [C00006 Charge for social media](../counters/C00006.md) | D02 | +| [C00010 Enhanced privacy regulation for social media](../counters/C00010.md) | D02 | +| [C00056 Encourage people to leave social media](../counters/C00056.md) | D02 | +| [C00097 Require use of verified identities to contribute to poll or comment](../counters/C00097.md) | D02 | +| [C00098 Revocation of allowlisted or "verified" status](../counters/C00098.md) | D02 | +| [C00099 Strengthen verification methods](../counters/C00099.md) | D02 | +| [C00112 "Prove they are not an op!"](../counters/C00112.md) | D02 | +| [C00114 Don't engage with payloads](../counters/C00114.md) | D02 | +| [C00122 Content moderation](../counters/C00122.md) | D02 | +| [C00165 Ensure integrity of official documents](../counters/C00165.md) | D02 | +| [C00044 Keep people from posting to social media immediately](../counters/C00044.md) | D03 | +| [C00123 Remove or rate limit botnets](../counters/C00123.md) | D03 | +| [C00124 Don't feed the trolls](../counters/C00124.md) | D03 | +| [C00139 Weaponise youtube content matrices](../counters/C00139.md) | D03 | +| [C00147 Make amplification of social media posts expire (e.g. can't like/ retweet after n days)](../counters/C00147.md) | D03 | +| [C00203 Stop offering press credentials to propaganda outlets](../counters/C00203.md) | D03 | +| [C00034 Create more friction at account creation](../counters/C00034.md) | D04 | +| [C00101 Create friction by rate-limiting engagement](../counters/C00101.md) | D04 | +| [C00142 Platform adds warning label and decision point when sharing content](../counters/C00142.md) | D04 | diff --git a/metatechniques/M005.md b/metatechniques/M005.md index e922e43..a8dbbb5 100644 --- a/metatechniques/M005.md +++ b/metatechniques/M005.md @@ -5,21 +5,21 @@ | Counters | Response types | | -------- | -------------- | -| [C00016 Censorship](../counters/C00016.md) | D2 Deny | -| [C00058 Report crowdfunder as violator](../counters/C00058.md) | D2 Deny | -| [C00070 Block access to disinformation resources](../counters/C00070.md) | D2 Deny | -| [C00071 Block source of pollution](../counters/C00071.md) | D2 Deny | -| [C00072 Remove non-relevant content from special interest groups - not recommended](../counters/C00072.md) | D2 Deny | -| [C00076 Prohibit images in political discourse channels](../counters/C00076.md) | D2 Deny | -| [C00131 Seize and analyse botnet servers](../counters/C00131.md) | D2 Deny | -| [C00154 Ask media not to report false information](../counters/C00154.md) | D2 Deny | -| [C00155 Ban incident actors from funding sites](../counters/C00155.md) | D2 Deny | -| [C00172 social media source removal](../counters/C00172.md) | D2 Deny | -| [C00182 Redirection / malware detection/ remediation](../counters/C00182.md) | D2 Deny | -| [C00197 remove suspicious accounts](../counters/C00197.md) | D2 Deny | -| [C00065 Reduce political targeting](../counters/C00065.md) | D3 Disrupt | -| [C00133 Deplatform Account*](../counters/C00133.md) | D3 Disrupt | -| [C00135 Deplatform message groups and/or message boards](../counters/C00135.md) | D3 Disrupt | +| [C00016 Censorship](../counters/C00016.md) | D02 | +| [C00058 Report crowdfunder as violator](../counters/C00058.md) | D02 | +| [C00070 Block access to disinformation resources](../counters/C00070.md) | D02 | +| [C00071 Block source of pollution](../counters/C00071.md) | D02 | +| [C00072 Remove non-relevant content from special interest groups - not recommended](../counters/C00072.md) | D02 | +| [C00076 Prohibit images in political discourse channels](../counters/C00076.md) | D02 | +| [C00131 Seize and analyse botnet servers](../counters/C00131.md) | D02 | +| [C00154 Ask media not to report false information](../counters/C00154.md) | D02 | +| [C00155 Ban incident actors from funding sites](../counters/C00155.md) | D02 | +| [C00172 social media source removal](../counters/C00172.md) | D02 | +| [C00182 Redirection / malware detection/ remediation](../counters/C00182.md) | D02 | +| [C00197 remove suspicious accounts](../counters/C00197.md) | D02 | +| [C00065 Reduce political targeting](../counters/C00065.md) | D03 | +| [C00133 Deplatform Account*](../counters/C00133.md) | D03 | +| [C00135 Deplatform message groups and/or message boards](../counters/C00135.md) | D03 | diff --git a/metatechniques/M006.md b/metatechniques/M006.md index e26411e..f262c8e 100644 --- a/metatechniques/M006.md +++ b/metatechniques/M006.md @@ -5,12 +5,12 @@ | Counters | Response types | | -------- | -------------- | -| [C00013 Rating framework for news](../counters/C00013.md) | D2 Deny | -| [C00107 Content moderation](../counters/C00107.md) | D2 Deny | -| [C00008 Create shared fact-checking database](../counters/C00008.md) | D4 Degrade | -| [C00014 Real-time updates to fact-checking database](../counters/C00014.md) | D4 Degrade | -| [C00092 Establish a truth teller reputation score for influencers](../counters/C00092.md) | D7 Deter | -| [C00096 Strengthen institutions that are always truth tellers](../counters/C00096.md) | D7 Deter | +| [C00013 Rating framework for news](../counters/C00013.md) | D02 | +| [C00107 Content moderation](../counters/C00107.md) | D02 | +| [C00008 Create shared fact-checking database](../counters/C00008.md) | D04 | +| [C00014 Real-time updates to fact-checking database](../counters/C00014.md) | D04 | +| [C00092 Establish a truth teller reputation score for influencers](../counters/C00092.md) | D07 | +| [C00096 Strengthen institutions that are always truth tellers](../counters/C00096.md) | D07 | diff --git a/metatechniques/M007.md b/metatechniques/M007.md index 1e87cc9..e658afe 100644 --- a/metatechniques/M007.md +++ b/metatechniques/M007.md @@ -5,17 +5,17 @@ | Counters | Response types | | -------- | -------------- | -| [C00012 Platform regulation](../counters/C00012.md) | D2 Deny | -| [C00174 Create a healthier news environment](../counters/C00174.md) | D2 Deny | -| [C00159 Have a disinformation response plan](../counters/C00159.md) | D3 Disrupt | -| [C00170 elevate information as a critical domain of statecraft](../counters/C00170.md) | D3 Disrupt | -| [C00205 strong dialogue between the federal government and private sector to encourage better reporting](../counters/C00205.md) | D3 Disrupt | -| [C00220 Develop a monitoring and intelligence plan](../counters/C00220.md) | D3 Disrupt | -| [C00221 Run a disinformation red team, and design mitigation factors](../counters/C00221.md) | D3 Disrupt | -| [C00222 Tabletop simulations](../counters/C00222.md) | D3 Disrupt | -| [C00120 Open dialogue about design of platforms to produce different outcomes](../counters/C00120.md) | D7 Deter | -| [C00161 Coalition Building with stakeholders and Third-Party Inducements](../counters/C00161.md) | D7 Deter | -| [C00176 Improve Coordination amongst stakeholders: public and private](../counters/C00176.md) | D7 Deter | +| [C00012 Platform regulation](../counters/C00012.md) | D02 | +| [C00174 Create a healthier news environment](../counters/C00174.md) | D02 | +| [C00159 Have a disinformation response plan](../counters/C00159.md) | D03 | +| [C00170 elevate information as a critical domain of statecraft](../counters/C00170.md) | D03 | +| [C00205 strong dialogue between the federal government and private sector to encourage better reporting](../counters/C00205.md) | D03 | +| [C00220 Develop a monitoring and intelligence plan](../counters/C00220.md) | D03 | +| [C00221 Run a disinformation red team, and design mitigation factors](../counters/C00221.md) | D03 | +| [C00222 Tabletop simulations](../counters/C00222.md) | D03 | +| [C00120 Open dialogue about design of platforms to produce different outcomes](../counters/C00120.md) | D07 | +| [C00161 Coalition Building with stakeholders and Third-Party Inducements](../counters/C00161.md) | D07 | +| [C00176 Improve Coordination amongst stakeholders: public and private](../counters/C00176.md) | D07 | diff --git a/metatechniques/M008.md b/metatechniques/M008.md index afba99f..c3f1eb0 100644 --- a/metatechniques/M008.md +++ b/metatechniques/M008.md @@ -5,10 +5,10 @@ | Counters | Response types | | -------- | -------------- | -| [C00140 "Bomb" link shorteners with lots of calls](../counters/C00140.md) | D3 Disrupt | -| [C00148 Add random links to network graphs](../counters/C00148.md) | D4 Degrade | -| [C00149 Poison the monitoring & evaluation data](../counters/C00149.md) | D4 Degrade | -| [C00047 Honeypot with coordinated inauthentics](../counters/C00047.md) | D5 Deceive | +| [C00140 "Bomb" link shorteners with lots of calls](../counters/C00140.md) | D03 | +| [C00148 Add random links to network graphs](../counters/C00148.md) | D04 | +| [C00149 Poison the monitoring & evaluation data](../counters/C00149.md) | D04 | +| [C00047 Honeypot with coordinated inauthentics](../counters/C00047.md) | D05 | diff --git a/metatechniques/M009.md b/metatechniques/M009.md index 219220e..dca0f66 100644 --- a/metatechniques/M009.md +++ b/metatechniques/M009.md @@ -5,12 +5,12 @@ | Counters | Response types | | -------- | -------------- | -| [C00031 Dilute the core narrative - create multiple permutations, target / amplify](../counters/C00031.md) | D3 Disrupt | -| [C00066 Co-opt a hashtag and drown it out (hijack it back)](../counters/C00066.md) | D3 Disrupt | -| [C00105 Buy more advertising than misinformation creators](../counters/C00105.md) | D3 Disrupt | -| [C00128 Create friction by marking content with ridicule or other "decelerants"](../counters/C00128.md) | D3 Disrupt | -| [C00087 Make more noise than the disinformation](../counters/C00087.md) | D4 Degrade | -| [C00178 Fill information voids with non-disinformation content](../counters/C00178.md) | D4 Degrade | +| [C00031 Dilute the core narrative - create multiple permutations, target / amplify](../counters/C00031.md) | D03 | +| [C00066 Co-opt a hashtag and drown it out (hijack it back)](../counters/C00066.md) | D03 | +| [C00105 Buy more advertising than misinformation creators](../counters/C00105.md) | D03 | +| [C00128 Create friction by marking content with ridicule or other "decelerants"](../counters/C00128.md) | D03 | +| [C00087 Make more noise than the disinformation](../counters/C00087.md) | D04 | +| [C00178 Fill information voids with non-disinformation content](../counters/C00178.md) | D04 | diff --git a/metatechniques/M010.md b/metatechniques/M010.md index d273525..6922d5e 100644 --- a/metatechniques/M010.md +++ b/metatechniques/M010.md @@ -5,20 +5,20 @@ | Counters | Response types | | -------- | -------------- | -| [C00075 normalise language](../counters/C00075.md) | D2 Deny | -| [C00017 Repair broken social connections](../counters/C00017.md) | D3 Disrupt | -| [C00082 Ground truthing as automated response to pollution](../counters/C00082.md) | D3 Disrupt | -| [C00136 Microtarget most likely targets then send them countermessages](../counters/C00136.md) | D3 Disrupt | -| [C00156 Better tell your country or organization story](../counters/C00156.md) | D3 Disrupt | -| [C00169 develop a creative content hub](../counters/C00169.md) | D3 Disrupt | -| [C00200 Respected figure (influencer) disavows misinfo](../counters/C00200.md) | D3 Disrupt | -| [C00211 Use humorous counter-narratives](../counters/C00211.md) | D3 Disrupt | -| [C00026 Shore up democracy based messages](../counters/C00026.md) | D4 Degrade | -| [C00042 Address truth contained in narratives](../counters/C00042.md) | D4 Degrade | -| [C00062 Free open library sources worldwide](../counters/C00062.md) | D4 Degrade | -| [C00117 Downgrade / de-amplify so message is seen by fewer people](../counters/C00117.md) | D4 Degrade | -| [C00118 Repurpose images with new text](../counters/C00118.md) | D4 Degrade | -| [C00119 Engage payload and debunk.](../counters/C00119.md) | D7 Deter | +| [C00075 normalise language](../counters/C00075.md) | D02 | +| [C00017 Repair broken social connections](../counters/C00017.md) | D03 | +| [C00082 Ground truthing as automated response to pollution](../counters/C00082.md) | D03 | +| [C00136 Microtarget most likely targets then send them countermessages](../counters/C00136.md) | D03 | +| [C00156 Better tell your country or organization story](../counters/C00156.md) | D03 | +| [C00169 develop a creative content hub](../counters/C00169.md) | D03 | +| [C00200 Respected figure (influencer) disavows misinfo](../counters/C00200.md) | D03 | +| [C00211 Use humorous counter-narratives](../counters/C00211.md) | D03 | +| [C00026 Shore up democracy based messages](../counters/C00026.md) | D04 | +| [C00042 Address truth contained in narratives](../counters/C00042.md) | D04 | +| [C00062 Free open library sources worldwide](../counters/C00062.md) | D04 | +| [C00117 Downgrade / de-amplify so message is seen by fewer people](../counters/C00117.md) | D04 | +| [C00118 Repurpose images with new text](../counters/C00118.md) | D04 | +| [C00119 Engage payload and debunk.](../counters/C00119.md) | D07 | diff --git a/metatechniques/M011.md b/metatechniques/M011.md index 73d635e..26ee04f 100644 --- a/metatechniques/M011.md +++ b/metatechniques/M011.md @@ -5,9 +5,9 @@ | Counters | Response types | | -------- | -------------- | -| [C00040 third party verification for people](../counters/C00040.md) | D2 Deny | -| [C00059 Verification of project before posting fund requests](../counters/C00059.md) | D2 Deny | -| [C00028 Make information provenance available](../counters/C00028.md) | D3 Disrupt | +| [C00040 third party verification for people](../counters/C00040.md) | D02 | +| [C00059 Verification of project before posting fund requests](../counters/C00059.md) | D02 | +| [C00028 Make information provenance available](../counters/C00028.md) | D03 | diff --git a/metatechniques/M012.md b/metatechniques/M012.md index c6ceadc..52bc7b1 100644 --- a/metatechniques/M012.md +++ b/metatechniques/M012.md @@ -5,8 +5,8 @@ | Counters | Response types | | -------- | -------------- | -| [C00074 Identify and delete or rate limit identical content](../counters/C00074.md) | D2 Deny | -| [C00053 Delete old accounts / Remove unused social media accounts](../counters/C00053.md) | D4 Degrade | +| [C00074 Identify and delete or rate limit identical content](../counters/C00074.md) | D02 | +| [C00053 Delete old accounts / Remove unused social media accounts](../counters/C00053.md) | D04 | diff --git a/metatechniques/M013.md b/metatechniques/M013.md index 59e0205..ed54d3d 100644 --- a/metatechniques/M013.md +++ b/metatechniques/M013.md @@ -5,17 +5,17 @@ | Counters | Response types | | -------- | -------------- | -| [C00036 Infiltrate the in-group to discredit leaders (divide)](../counters/C00036.md) | D2 Deny | -| [C00060 Legal action against for-profit engagement factories](../counters/C00060.md) | D3 Disrupt | -| [C00067 Denigrate the recipient/ project (of online funding)](../counters/C00067.md) | D3 Disrupt | -| [C00077 Active defence: run TA03 "develop people” - not recommended](../counters/C00077.md) | D3 Disrupt | -| [C00153 Take pre-emptive action against actors' infrastructure](../counters/C00153.md) | D3 Disrupt | -| [C00162 Unravel/target the Potemkin villages](../counters/C00162.md) | D3 Disrupt | -| [C00164 compatriot policy](../counters/C00164.md) | D3 Disrupt | -| [C00046 Marginalise and discredit extremist groups](../counters/C00046.md) | D4 Degrade | -| [C00052 Infiltrate platforms](../counters/C00052.md) | D4 Degrade | -| [C00143 (botnet) DMCA takedown requests to waste group time](../counters/C00143.md) | D4 Degrade | -| [C00207 Run a competing disinformation campaign - not recommended](../counters/C00207.md) | D7 Deter | +| [C00036 Infiltrate the in-group to discredit leaders (divide)](../counters/C00036.md) | D02 | +| [C00060 Legal action against for-profit engagement factories](../counters/C00060.md) | D03 | +| [C00067 Denigrate the recipient/ project (of online funding)](../counters/C00067.md) | D03 | +| [C00077 Active defence: run TA03 "develop people” - not recommended](../counters/C00077.md) | D03 | +| [C00153 Take pre-emptive action against actors' infrastructure](../counters/C00153.md) | D03 | +| [C00162 Unravel/target the Potemkin villages](../counters/C00162.md) | D03 | +| [C00164 compatriot policy](../counters/C00164.md) | D03 | +| [C00046 Marginalise and discredit extremist groups](../counters/C00046.md) | D04 | +| [C00052 Infiltrate platforms](../counters/C00052.md) | D04 | +| [C00143 (botnet) DMCA takedown requests to waste group time](../counters/C00143.md) | D04 | +| [C00207 Run a competing disinformation campaign - not recommended](../counters/C00207.md) | D07 | diff --git a/metatechniques/M014.md b/metatechniques/M014.md index 9b4eaf2..ec79cd8 100644 --- a/metatechniques/M014.md +++ b/metatechniques/M014.md @@ -5,10 +5,10 @@ | Counters | Response types | | -------- | -------------- | -| [C00129 Use banking to cut off access ](../counters/C00129.md) | D2 Deny | -| [C00216 Use advertiser controls to stem flow of funds to bad actors](../counters/C00216.md) | D2 Deny | -| [C00138 Spam domestic actors with lawsuits](../counters/C00138.md) | D3 Disrupt | -| [C00144 Buy out troll farm employees / offer them jobs](../counters/C00144.md) | D4 Degrade | +| [C00129 Use banking to cut off access ](../counters/C00129.md) | D02 | +| [C00216 Use advertiser controls to stem flow of funds to bad actors](../counters/C00216.md) | D02 | +| [C00138 Spam domestic actors with lawsuits](../counters/C00138.md) | D03 | +| [C00144 Buy out troll farm employees / offer them jobs](../counters/C00144.md) | D04 | diff --git a/metatechniques_by_responsetype_table.md b/metatechniques_by_responsetype_table.md index 3266c59..2b02999 100644 --- a/metatechniques_by_responsetype_table.md +++ b/metatechniques_by_responsetype_table.md @@ -3,12 +3,12 @@ - - - - - - + + + + + + diff --git a/phases/P02.md b/phases/P02.md index 8b4e734..dea998e 100644 --- a/phases/P02.md +++ b/phases/P02.md @@ -2,4 +2,4 @@ * **Summary:** Activities conducted before execution to improve the ability to conduct the action. Examples include: development of the ecosystem needed to support the action: people, network, channels, content etc. -DO NOT EDIT ABOVE THIS LINE - PLEASE ADD NOTES BELOW +DO NOT EDIT ABOVE THIS LINE - PLEASE ADD NOTES BELOW \ No newline at end of file diff --git a/responsetype_index.md b/responsetype_index.md index fe66d01..c0d2e17 100644 --- a/responsetype_index.md +++ b/responsetype_index.md @@ -7,37 +7,37 @@ - + - + - + - + - + - + - + diff --git a/tactics/TA01.md b/tactics/TA01.md index 824fe7a..ffcc531 100644 --- a/tactics/TA01.md +++ b/tactics/TA01.md @@ -26,34 +26,34 @@ | Counters | Response types | | -------- | -------------- | -| [C00006 Charge for social media](../counters/C00006.md) | D2 Deny | -| [C00010 Enhanced privacy regulation for social media](../counters/C00010.md) | D2 Deny | -| [C00012 Platform regulation](../counters/C00012.md) | D2 Deny | -| [C00013 Rating framework for news](../counters/C00013.md) | D2 Deny | -| [C00016 Censorship](../counters/C00016.md) | D2 Deny | -| [C00073 Inoculate populations through media literacy training](../counters/C00073.md) | D2 Deny | -| [C00174 Create a healthier news environment](../counters/C00174.md) | D2 Deny | -| [C00017 Repair broken social connections](../counters/C00017.md) | D3 Disrupt | -| [C00019 Reduce effect of division-enablers](../counters/C00019.md) | D3 Disrupt | -| [C00153 Take pre-emptive action against actors' infrastructure](../counters/C00153.md) | D3 Disrupt | -| [C00159 Have a disinformation response plan](../counters/C00159.md) | D3 Disrupt | -| [C00170 elevate information as a critical domain of statecraft](../counters/C00170.md) | D3 Disrupt | -| [C00190 open engagement with civil society](../counters/C00190.md) | D3 Disrupt | -| [C00205 strong dialogue between the federal government and private sector to encourage better reporting](../counters/C00205.md) | D3 Disrupt | -| [C00212 build public resilience by making civil society more vibrant](../counters/C00212.md) | D3 Disrupt | -| [C00220 Develop a monitoring and intelligence plan](../counters/C00220.md) | D3 Disrupt | -| [C00221 Run a disinformation red team, and design mitigation factors](../counters/C00221.md) | D3 Disrupt | -| [C00223 Strengthen Trust in social media platforms](../counters/C00223.md) | D3 Disrupt | -| [C00008 Create shared fact-checking database](../counters/C00008.md) | D4 Degrade | -| [C00021 Encourage in-person communication](../counters/C00021.md) | D4 Degrade | -| [C00022 Innoculate. Positive campaign to promote feeling of safety](../counters/C00022.md) | D4 Degrade | -| [C00024 Promote healthy narratives](../counters/C00024.md) | D4 Degrade | -| [C00026 Shore up democracy based messages](../counters/C00026.md) | D4 Degrade | -| [C00111 Reduce polarisation by connecting and presenting sympathetic renditions of opposite views](../counters/C00111.md) | D4 Degrade | -| [C00027 Create culture of civility](../counters/C00027.md) | D7 Deter | -| [C00096 Strengthen institutions that are always truth tellers](../counters/C00096.md) | D7 Deter | -| [C00161 Coalition Building with stakeholders and Third-Party Inducements](../counters/C00161.md) | D7 Deter | -| [C00176 Improve Coordination amongst stakeholders: public and private](../counters/C00176.md) | D7 Deter | +| [C00006 Charge for social media](../counters/C00006.md) | D02 | +| [C00010 Enhanced privacy regulation for social media](../counters/C00010.md) | D02 | +| [C00012 Platform regulation](../counters/C00012.md) | D02 | +| [C00013 Rating framework for news](../counters/C00013.md) | D02 | +| [C00016 Censorship](../counters/C00016.md) | D02 | +| [C00073 Inoculate populations through media literacy training](../counters/C00073.md) | D02 | +| [C00174 Create a healthier news environment](../counters/C00174.md) | D02 | +| [C00017 Repair broken social connections](../counters/C00017.md) | D03 | +| [C00019 Reduce effect of division-enablers](../counters/C00019.md) | D03 | +| [C00153 Take pre-emptive action against actors' infrastructure](../counters/C00153.md) | D03 | +| [C00159 Have a disinformation response plan](../counters/C00159.md) | D03 | +| [C00170 elevate information as a critical domain of statecraft](../counters/C00170.md) | D03 | +| [C00190 open engagement with civil society](../counters/C00190.md) | D03 | +| [C00205 strong dialogue between the federal government and private sector to encourage better reporting](../counters/C00205.md) | D03 | +| [C00212 build public resilience by making civil society more vibrant](../counters/C00212.md) | D03 | +| [C00220 Develop a monitoring and intelligence plan](../counters/C00220.md) | D03 | +| [C00221 Run a disinformation red team, and design mitigation factors](../counters/C00221.md) | D03 | +| [C00223 Strengthen Trust in social media platforms](../counters/C00223.md) | D03 | +| [C00008 Create shared fact-checking database](../counters/C00008.md) | D04 | +| [C00021 Encourage in-person communication](../counters/C00021.md) | D04 | +| [C00022 Innoculate. Positive campaign to promote feeling of safety](../counters/C00022.md) | D04 | +| [C00024 Promote healthy narratives](../counters/C00024.md) | D04 | +| [C00026 Shore up democracy based messages](../counters/C00026.md) | D04 | +| [C00111 Reduce polarisation by connecting and presenting sympathetic renditions of opposite views](../counters/C00111.md) | D04 | +| [C00027 Create culture of civility](../counters/C00027.md) | D07 | +| [C00096 Strengthen institutions that are always truth tellers](../counters/C00096.md) | D07 | +| [C00161 Coalition Building with stakeholders and Third-Party Inducements](../counters/C00161.md) | D07 | +| [C00176 Improve Coordination amongst stakeholders: public and private](../counters/C00176.md) | D07 | DO NOT EDIT ABOVE THIS LINE - PLEASE ADD NOTES BELOW \ No newline at end of file diff --git a/tactics/TA02.md b/tactics/TA02.md index 507fc03..823a701 100644 --- a/tactics/TA02.md +++ b/tactics/TA02.md @@ -31,21 +31,21 @@ | Counters | Response types | | -------- | -------------- | -| [C00009 Educate high profile influencers on best practices](../counters/C00009.md) | D2 Deny | -| [C00011 Media literacy. Games to identify fake news](../counters/C00011.md) | D2 Deny | -| [C00070 Block access to disinformation resources](../counters/C00070.md) | D2 Deny | -| [C00028 Make information provenance available](../counters/C00028.md) | D3 Disrupt | -| [C00029 Create fake website to issue counter narrative and counter narrative through physical merchandise](../counters/C00029.md) | D3 Disrupt | -| [C00030 Develop a compelling counter narrative (truth based)](../counters/C00030.md) | D3 Disrupt | -| [C00031 Dilute the core narrative - create multiple permutations, target / amplify](../counters/C00031.md) | D3 Disrupt | -| [C00060 Legal action against for-profit engagement factories](../counters/C00060.md) | D3 Disrupt | -| [C00156 Better tell your country or organization story](../counters/C00156.md) | D3 Disrupt | -| [C00164 compatriot policy](../counters/C00164.md) | D3 Disrupt | -| [C00169 develop a creative content hub](../counters/C00169.md) | D3 Disrupt | -| [C00222 Tabletop simulations](../counters/C00222.md) | D3 Disrupt | -| [C00144 Buy out troll farm employees / offer them jobs](../counters/C00144.md) | D4 Degrade | -| [C00092 Establish a truth teller reputation score for influencers](../counters/C00092.md) | D7 Deter | -| [C00207 Run a competing disinformation campaign - not recommended](../counters/C00207.md) | D7 Deter | +| [C00009 Educate high profile influencers on best practices](../counters/C00009.md) | D02 | +| [C00011 Media literacy. Games to identify fake news](../counters/C00011.md) | D02 | +| [C00070 Block access to disinformation resources](../counters/C00070.md) | D02 | +| [C00028 Make information provenance available](../counters/C00028.md) | D03 | +| [C00029 Create fake website to issue counter narrative and counter narrative through physical merchandise](../counters/C00029.md) | D03 | +| [C00030 Develop a compelling counter narrative (truth based)](../counters/C00030.md) | D03 | +| [C00031 Dilute the core narrative - create multiple permutations, target / amplify](../counters/C00031.md) | D03 | +| [C00060 Legal action against for-profit engagement factories](../counters/C00060.md) | D03 | +| [C00156 Better tell your country or organization story](../counters/C00156.md) | D03 | +| [C00164 compatriot policy](../counters/C00164.md) | D03 | +| [C00169 develop a creative content hub](../counters/C00169.md) | D03 | +| [C00222 Tabletop simulations](../counters/C00222.md) | D03 | +| [C00144 Buy out troll farm employees / offer them jobs](../counters/C00144.md) | D04 | +| [C00092 Establish a truth teller reputation score for influencers](../counters/C00092.md) | D07 | +| [C00207 Run a competing disinformation campaign - not recommended](../counters/C00207.md) | D07 | DO NOT EDIT ABOVE THIS LINE - PLEASE ADD NOTES BELOW \ No newline at end of file diff --git a/tactics/TA03.md b/tactics/TA03.md index d9344b0..1decd06 100644 --- a/tactics/TA03.md +++ b/tactics/TA03.md @@ -26,23 +26,23 @@ | Counters | Response types | | -------- | -------------- | -| [C00036 Infiltrate the in-group to discredit leaders (divide)](../counters/C00036.md) | D2 Deny | -| [C00040 third party verification for people](../counters/C00040.md) | D2 Deny | -| [C00051 Counter social engineering training](../counters/C00051.md) | D2 Deny | -| [C00058 Report crowdfunder as violator](../counters/C00058.md) | D2 Deny | -| [C00155 Ban incident actors from funding sites](../counters/C00155.md) | D2 Deny | -| [C00160 find and train influencers](../counters/C00160.md) | D2 Deny | -| [C00197 remove suspicious accounts](../counters/C00197.md) | D2 Deny | -| [C00044 Keep people from posting to social media immediately](../counters/C00044.md) | D3 Disrupt | -| [C00067 Denigrate the recipient/ project (of online funding)](../counters/C00067.md) | D3 Disrupt | -| [C00077 Active defence: run TA03 "develop people” - not recommended](../counters/C00077.md) | D3 Disrupt | -| [C00133 Deplatform Account*](../counters/C00133.md) | D3 Disrupt | -| [C00034 Create more friction at account creation](../counters/C00034.md) | D4 Degrade | -| [C00042 Address truth contained in narratives](../counters/C00042.md) | D4 Degrade | -| [C00046 Marginalise and discredit extremist groups](../counters/C00046.md) | D4 Degrade | -| [C00189 Ensure that platforms are taking down flagged accounts](../counters/C00189.md) | D6 Destroy | -| [C00048 Name and Shame Influencers](../counters/C00048.md) | D7 Deter | -| [C00093 Influencer code of conduct](../counters/C00093.md) | D7 Deter | +| [C00036 Infiltrate the in-group to discredit leaders (divide)](../counters/C00036.md) | D02 | +| [C00040 third party verification for people](../counters/C00040.md) | D02 | +| [C00051 Counter social engineering training](../counters/C00051.md) | D02 | +| [C00058 Report crowdfunder as violator](../counters/C00058.md) | D02 | +| [C00155 Ban incident actors from funding sites](../counters/C00155.md) | D02 | +| [C00160 find and train influencers](../counters/C00160.md) | D02 | +| [C00197 remove suspicious accounts](../counters/C00197.md) | D02 | +| [C00044 Keep people from posting to social media immediately](../counters/C00044.md) | D03 | +| [C00067 Denigrate the recipient/ project (of online funding)](../counters/C00067.md) | D03 | +| [C00077 Active defence: run TA03 "develop people” - not recommended](../counters/C00077.md) | D03 | +| [C00133 Deplatform Account*](../counters/C00133.md) | D03 | +| [C00034 Create more friction at account creation](../counters/C00034.md) | D04 | +| [C00042 Address truth contained in narratives](../counters/C00042.md) | D04 | +| [C00046 Marginalise and discredit extremist groups](../counters/C00046.md) | D04 | +| [C00189 Ensure that platforms are taking down flagged accounts](../counters/C00189.md) | D06 | +| [C00048 Name and Shame Influencers](../counters/C00048.md) | D07 | +| [C00093 Influencer code of conduct](../counters/C00093.md) | D07 | DO NOT EDIT ABOVE THIS LINE - PLEASE ADD NOTES BELOW \ No newline at end of file diff --git a/tactics/TA04.md b/tactics/TA04.md index b675268..40d07e3 100644 --- a/tactics/TA04.md +++ b/tactics/TA04.md @@ -28,16 +28,16 @@ | Counters | Response types | | -------- | -------------- | -| [C00056 Encourage people to leave social media](../counters/C00056.md) | D2 Deny | -| [C00059 Verification of project before posting fund requests](../counters/C00059.md) | D2 Deny | -| [C00172 social media source removal](../counters/C00172.md) | D2 Deny | -| [C00135 Deplatform message groups and/or message boards](../counters/C00135.md) | D3 Disrupt | -| [C00162 Unravel/target the Potemkin villages](../counters/C00162.md) | D3 Disrupt | -| [C00203 Stop offering press credentials to propaganda outlets](../counters/C00203.md) | D3 Disrupt | -| [C00052 Infiltrate platforms](../counters/C00052.md) | D4 Degrade | -| [C00053 Delete old accounts / Remove unused social media accounts](../counters/C00053.md) | D4 Degrade | -| [C00062 Free open library sources worldwide](../counters/C00062.md) | D4 Degrade | -| [C00047 Honeypot with coordinated inauthentics](../counters/C00047.md) | D5 Deceive | +| [C00056 Encourage people to leave social media](../counters/C00056.md) | D02 | +| [C00059 Verification of project before posting fund requests](../counters/C00059.md) | D02 | +| [C00172 social media source removal](../counters/C00172.md) | D02 | +| [C00135 Deplatform message groups and/or message boards](../counters/C00135.md) | D03 | +| [C00162 Unravel/target the Potemkin villages](../counters/C00162.md) | D03 | +| [C00203 Stop offering press credentials to propaganda outlets](../counters/C00203.md) | D03 | +| [C00052 Infiltrate platforms](../counters/C00052.md) | D04 | +| [C00053 Delete old accounts / Remove unused social media accounts](../counters/C00053.md) | D04 | +| [C00062 Free open library sources worldwide](../counters/C00062.md) | D04 | +| [C00047 Honeypot with coordinated inauthentics](../counters/C00047.md) | D05 | DO NOT EDIT ABOVE THIS LINE - PLEASE ADD NOTES BELOW \ No newline at end of file diff --git a/tactics/TA05.md b/tactics/TA05.md index c6cf694..43a8cc5 100644 --- a/tactics/TA05.md +++ b/tactics/TA05.md @@ -22,11 +22,11 @@ | Counters | Response types | | -------- | -------------- | -| [C00216 Use advertiser controls to stem flow of funds to bad actors](../counters/C00216.md) | D2 Deny | -| [C00065 Reduce political targeting](../counters/C00065.md) | D3 Disrupt | -| [C00066 Co-opt a hashtag and drown it out (hijack it back)](../counters/C00066.md) | D3 Disrupt | -| [C00178 Fill information voids with non-disinformation content](../counters/C00178.md) | D4 Degrade | -| [C00130 Mentorship: elders, youth, credit. Learn vicariously.](../counters/C00130.md) | D7 Deter | +| [C00216 Use advertiser controls to stem flow of funds to bad actors](../counters/C00216.md) | D02 | +| [C00065 Reduce political targeting](../counters/C00065.md) | D03 | +| [C00066 Co-opt a hashtag and drown it out (hijack it back)](../counters/C00066.md) | D03 | +| [C00178 Fill information voids with non-disinformation content](../counters/C00178.md) | D04 | +| [C00130 Mentorship: elders, youth, credit. Learn vicariously.](../counters/C00130.md) | D07 | DO NOT EDIT ABOVE THIS LINE - PLEASE ADD NOTES BELOW \ No newline at end of file diff --git a/tactics/TA06.md b/tactics/TA06.md index a660c1b..3cd6e3d 100644 --- a/tactics/TA06.md +++ b/tactics/TA06.md @@ -31,29 +31,29 @@ | Counters | Response types | | -------- | -------------- | -| [C00071 Block source of pollution](../counters/C00071.md) | D2 Deny | -| [C00072 Remove non-relevant content from special interest groups - not recommended](../counters/C00072.md) | D2 Deny | -| [C00074 Identify and delete or rate limit identical content](../counters/C00074.md) | D2 Deny | -| [C00075 normalise language](../counters/C00075.md) | D2 Deny | -| [C00076 Prohibit images in political discourse channels](../counters/C00076.md) | D2 Deny | -| [C00107 Content moderation](../counters/C00107.md) | D2 Deny | -| [C00165 Ensure integrity of official documents](../counters/C00165.md) | D2 Deny | -| [C00202 Set data 'honeytraps'](../counters/C00202.md) | D2 Deny | -| [C00032 Hijack content and link to truth- based info](../counters/C00032.md) | D3 Disrupt | -| [C00078 Change Search Algorithms for Disinformation Content](../counters/C00078.md) | D3 Disrupt | -| [C00080 Create competing narrative](../counters/C00080.md) | D3 Disrupt | -| [C00081 Highlight flooding and noise, and explain motivations](../counters/C00081.md) | D3 Disrupt | -| [C00082 Ground truthing as automated response to pollution](../counters/C00082.md) | D3 Disrupt | -| [C00084 Modify disinformation narratives, and rebroadcast them](../counters/C00084.md) | D3 Disrupt | -| [C00085 Mute content](../counters/C00085.md) | D3 Disrupt | -| [C00106 Click-bait centrist content](../counters/C00106.md) | D3 Disrupt | -| [C00014 Real-time updates to fact-checking database](../counters/C00014.md) | D4 Degrade | -| [C00086 Distract from noise with addictive content](../counters/C00086.md) | D4 Degrade | -| [C00087 Make more noise than the disinformation](../counters/C00087.md) | D4 Degrade | -| [C00094 Force full disclosure on corporate sponsor of research](../counters/C00094.md) | D4 Degrade | -| [C00142 Platform adds warning label and decision point when sharing content](../counters/C00142.md) | D4 Degrade | -| [C00219 Add metadata to content that’s out of the control of disinformation creators](../counters/C00219.md) | D4 Degrade | -| [C00091 Honeypot social community](../counters/C00091.md) | D5 Deceive | +| [C00071 Block source of pollution](../counters/C00071.md) | D02 | +| [C00072 Remove non-relevant content from special interest groups - not recommended](../counters/C00072.md) | D02 | +| [C00074 Identify and delete or rate limit identical content](../counters/C00074.md) | D02 | +| [C00075 normalise language](../counters/C00075.md) | D02 | +| [C00076 Prohibit images in political discourse channels](../counters/C00076.md) | D02 | +| [C00107 Content moderation](../counters/C00107.md) | D02 | +| [C00165 Ensure integrity of official documents](../counters/C00165.md) | D02 | +| [C00202 Set data 'honeytraps'](../counters/C00202.md) | D02 | +| [C00032 Hijack content and link to truth- based info](../counters/C00032.md) | D03 | +| [C00078 Change Search Algorithms for Disinformation Content](../counters/C00078.md) | D03 | +| [C00080 Create competing narrative](../counters/C00080.md) | D03 | +| [C00081 Highlight flooding and noise, and explain motivations](../counters/C00081.md) | D03 | +| [C00082 Ground truthing as automated response to pollution](../counters/C00082.md) | D03 | +| [C00084 Modify disinformation narratives, and rebroadcast them](../counters/C00084.md) | D03 | +| [C00085 Mute content](../counters/C00085.md) | D03 | +| [C00106 Click-bait centrist content](../counters/C00106.md) | D03 | +| [C00014 Real-time updates to fact-checking database](../counters/C00014.md) | D04 | +| [C00086 Distract from noise with addictive content](../counters/C00086.md) | D04 | +| [C00087 Make more noise than the disinformation](../counters/C00087.md) | D04 | +| [C00094 Force full disclosure on corporate sponsor of research](../counters/C00094.md) | D04 | +| [C00142 Platform adds warning label and decision point when sharing content](../counters/C00142.md) | D04 | +| [C00219 Add metadata to content that’s out of the control of disinformation creators](../counters/C00219.md) | D04 | +| [C00091 Honeypot social community](../counters/C00091.md) | D05 | DO NOT EDIT ABOVE THIS LINE - PLEASE ADD NOTES BELOW \ No newline at end of file diff --git a/tactics/TA07.md b/tactics/TA07.md index 9e3ecbe..a90741f 100644 --- a/tactics/TA07.md +++ b/tactics/TA07.md @@ -29,14 +29,14 @@ | Counters | Response types | | -------- | -------------- | -| [C00097 Require use of verified identities to contribute to poll or comment](../counters/C00097.md) | D2 Deny | -| [C00098 Revocation of allowlisted or "verified" status](../counters/C00098.md) | D2 Deny | -| [C00099 Strengthen verification methods](../counters/C00099.md) | D2 Deny | -| [C00195 Redirect searches away from disinformation or extremist content ](../counters/C00195.md) | D2 Deny | -| [C00105 Buy more advertising than misinformation creators](../counters/C00105.md) | D3 Disrupt | -| [C00101 Create friction by rate-limiting engagement](../counters/C00101.md) | D4 Degrade | -| [C00090 Fake engagement system](../counters/C00090.md) | D5 Deceive | -| [C00103 Create a bot that engages / distract trolls](../counters/C00103.md) | D5 Deceive | +| [C00097 Require use of verified identities to contribute to poll or comment](../counters/C00097.md) | D02 | +| [C00098 Revocation of allowlisted or "verified" status](../counters/C00098.md) | D02 | +| [C00099 Strengthen verification methods](../counters/C00099.md) | D02 | +| [C00195 Redirect searches away from disinformation or extremist content ](../counters/C00195.md) | D02 | +| [C00105 Buy more advertising than misinformation creators](../counters/C00105.md) | D03 | +| [C00101 Create friction by rate-limiting engagement](../counters/C00101.md) | D04 | +| [C00090 Fake engagement system](../counters/C00090.md) | D05 | +| [C00103 Create a bot that engages / distract trolls](../counters/C00103.md) | D05 | DO NOT EDIT ABOVE THIS LINE - PLEASE ADD NOTES BELOW \ No newline at end of file diff --git a/tactics/TA08.md b/tactics/TA08.md index d4c1baf..29c0b75 100644 --- a/tactics/TA08.md +++ b/tactics/TA08.md @@ -29,21 +29,21 @@ | Counters | Response types | | -------- | -------------- | -| [C00112 "Prove they are not an op!"](../counters/C00112.md) | D2 Deny | -| [C00113 Debunk and defuse a fake expert / credentials.](../counters/C00113.md) | D2 Deny | -| [C00114 Don't engage with payloads](../counters/C00114.md) | D2 Deny | -| [C00115 Expose actor and intentions](../counters/C00115.md) | D2 Deny | -| [C00116 Provide proof of involvement](../counters/C00116.md) | D2 Deny | -| [C00154 Ask media not to report false information](../counters/C00154.md) | D2 Deny | -| [C00100 Hashtag jacking](../counters/C00100.md) | D3 Disrupt | -| [C00136 Microtarget most likely targets then send them countermessages](../counters/C00136.md) | D3 Disrupt | -| [C00188 Newsroom/Journalist training to counter influence moves](../counters/C00188.md) | D3 Disrupt | -| [C00117 Downgrade / de-amplify so message is seen by fewer people](../counters/C00117.md) | D4 Degrade | -| [C00118 Repurpose images with new text](../counters/C00118.md) | D4 Degrade | -| [C00184 Media exposure](../counters/C00184.md) | D4 Degrade | -| [C00119 Engage payload and debunk.](../counters/C00119.md) | D7 Deter | -| [C00120 Open dialogue about design of platforms to produce different outcomes](../counters/C00120.md) | D7 Deter | -| [C00121 Tool transparency and literacy for channels people follow. ](../counters/C00121.md) | D7 Deter | +| [C00112 "Prove they are not an op!"](../counters/C00112.md) | D02 | +| [C00113 Debunk and defuse a fake expert / credentials.](../counters/C00113.md) | D02 | +| [C00114 Don't engage with payloads](../counters/C00114.md) | D02 | +| [C00115 Expose actor and intentions](../counters/C00115.md) | D02 | +| [C00116 Provide proof of involvement](../counters/C00116.md) | D02 | +| [C00154 Ask media not to report false information](../counters/C00154.md) | D02 | +| [C00100 Hashtag jacking](../counters/C00100.md) | D03 | +| [C00136 Microtarget most likely targets then send them countermessages](../counters/C00136.md) | D03 | +| [C00188 Newsroom/Journalist training to counter influence moves](../counters/C00188.md) | D03 | +| [C00117 Downgrade / de-amplify so message is seen by fewer people](../counters/C00117.md) | D04 | +| [C00118 Repurpose images with new text](../counters/C00118.md) | D04 | +| [C00184 Media exposure](../counters/C00184.md) | D04 | +| [C00119 Engage payload and debunk.](../counters/C00119.md) | D07 | +| [C00120 Open dialogue about design of platforms to produce different outcomes](../counters/C00120.md) | D07 | +| [C00121 Tool transparency and literacy for channels people follow. ](../counters/C00121.md) | D07 | DO NOT EDIT ABOVE THIS LINE - PLEASE ADD NOTES BELOW \ No newline at end of file diff --git a/tactics/TA09.md b/tactics/TA09.md index bcd449f..4ab2d28 100644 --- a/tactics/TA09.md +++ b/tactics/TA09.md @@ -31,18 +31,18 @@ | Counters | Response types | | -------- | -------------- | -| [C00122 Content moderation](../counters/C00122.md) | D2 Deny | -| [C00129 Use banking to cut off access ](../counters/C00129.md) | D2 Deny | -| [C00182 Redirection / malware detection/ remediation](../counters/C00182.md) | D2 Deny | -| [C00109 Dampen Emotional Reaction](../counters/C00109.md) | D3 Disrupt | -| [C00123 Remove or rate limit botnets](../counters/C00123.md) | D3 Disrupt | -| [C00124 Don't feed the trolls](../counters/C00124.md) | D3 Disrupt | -| [C00125 Prebunking](../counters/C00125.md) | D3 Disrupt | -| [C00126 Social media amber alert](../counters/C00126.md) | D3 Disrupt | -| [C00128 Create friction by marking content with ridicule or other "decelerants"](../counters/C00128.md) | D3 Disrupt | -| [C00147 Make amplification of social media posts expire (e.g. can't like/ retweet after n days)](../counters/C00147.md) | D3 Disrupt | -| [C00200 Respected figure (influencer) disavows misinfo](../counters/C00200.md) | D3 Disrupt | -| [C00211 Use humorous counter-narratives](../counters/C00211.md) | D3 Disrupt | +| [C00122 Content moderation](../counters/C00122.md) | D02 | +| [C00129 Use banking to cut off access ](../counters/C00129.md) | D02 | +| [C00182 Redirection / malware detection/ remediation](../counters/C00182.md) | D02 | +| [C00109 Dampen Emotional Reaction](../counters/C00109.md) | D03 | +| [C00123 Remove or rate limit botnets](../counters/C00123.md) | D03 | +| [C00124 Don't feed the trolls](../counters/C00124.md) | D03 | +| [C00125 Prebunking](../counters/C00125.md) | D03 | +| [C00126 Social media amber alert](../counters/C00126.md) | D03 | +| [C00128 Create friction by marking content with ridicule or other "decelerants"](../counters/C00128.md) | D03 | +| [C00147 Make amplification of social media posts expire (e.g. can't like/ retweet after n days)](../counters/C00147.md) | D03 | +| [C00200 Respected figure (influencer) disavows misinfo](../counters/C00200.md) | D03 | +| [C00211 Use humorous counter-narratives](../counters/C00211.md) | D03 | DO NOT EDIT ABOVE THIS LINE - PLEASE ADD NOTES BELOW \ No newline at end of file diff --git a/tactics/TA11.md b/tactics/TA11.md index 8aa488e..ef05c16 100644 --- a/tactics/TA11.md +++ b/tactics/TA11.md @@ -27,10 +27,10 @@ | Counters | Response types | | -------- | -------------- | -| [C00131 Seize and analyse botnet servers](../counters/C00131.md) | D2 Deny | -| [C00138 Spam domestic actors with lawsuits](../counters/C00138.md) | D3 Disrupt | -| [C00139 Weaponise youtube content matrices](../counters/C00139.md) | D3 Disrupt | -| [C00143 (botnet) DMCA takedown requests to waste group time](../counters/C00143.md) | D4 Degrade | +| [C00131 Seize and analyse botnet servers](../counters/C00131.md) | D02 | +| [C00138 Spam domestic actors with lawsuits](../counters/C00138.md) | D03 | +| [C00139 Weaponise youtube content matrices](../counters/C00139.md) | D03 | +| [C00143 (botnet) DMCA takedown requests to waste group time](../counters/C00143.md) | D04 | DO NOT EDIT ABOVE THIS LINE - PLEASE ADD NOTES BELOW \ No newline at end of file diff --git a/tactics/TA12.md b/tactics/TA12.md index 1bcd3e2..617762e 100644 --- a/tactics/TA12.md +++ b/tactics/TA12.md @@ -25,9 +25,9 @@ | Counters | Response types | | -------- | -------------- | -| [C00140 "Bomb" link shorteners with lots of calls](../counters/C00140.md) | D3 Disrupt | -| [C00148 Add random links to network graphs](../counters/C00148.md) | D4 Degrade | -| [C00149 Poison the monitoring & evaluation data](../counters/C00149.md) | D4 Degrade | +| [C00140 "Bomb" link shorteners with lots of calls](../counters/C00140.md) | D03 | +| [C00148 Add random links to network graphs](../counters/C00148.md) | D04 | +| [C00149 Poison the monitoring & evaluation data](../counters/C00149.md) | D04 | DO NOT EDIT ABOVE THIS LINE - PLEASE ADD NOTES BELOW \ No newline at end of file diff --git a/tactics_by_responsetype_table.md b/tactics_by_responsetype_table.md index 8625e81..b27f42b 100644 --- a/tactics_by_responsetype_table.md +++ b/tactics_by_responsetype_table.md @@ -3,12 +3,12 @@
D2 DenyD3 DisruptD4 DegradeD5 DeceiveD6 DestroyD7 DeterD02D03D04D05D06D07 TOTALS
M001 resilience 5summary
D1D01 Detect Discover or discern the existence, presence, or fact of an intrusion into information systems.
D2D02 Deny Prevent disinformation creators from accessing and using critical information, systems, and services. Deny is for an indefinite time period.
D3D03 Disrupt Completely break or interrupt the flow of information, for a fixed amount of time. (Deny, for a limited time period). Not allowing any efficacy, for a short amount of time.
D4D04 Degrade Reduce the effectiveness or efficiency of disinformation creators’ command and control or communications systems, and information collection efforts or means, either indefinitely, or for a limited time period.
D5D05 Deceive Cause a person to believe what is not true. military deception seeks to mislead adversary decision makers by manipulating their perception of reality.
D6D06 Destroy Damage a system or entity so badly that it cannot perform any function or be restored to a usable condition without being entirely rebuilt. Destroy is permanent, e.g. you can rebuild a website, but it’s not the same website.
D7D07 Deter Discourage.
- - - - - - + + + + + + diff --git a/tasks/TK0002.md b/tasks/TK0002.md index 521a05a..52e9e12 100644 --- a/tasks/TK0002.md +++ b/tasks/TK0002.md @@ -1,6 +1,6 @@ # Task TK0002: Population research / audience analysis (centre of gravity) -* **Summary:** +* **Summary:** Research intended audience. Includes audience segmentation, hot-button issues etc. * **Belongs to tactic stage:** TA01 diff --git a/tasks/TK0003.md b/tasks/TK0003.md index 3b38882..91a170f 100644 --- a/tasks/TK0003.md +++ b/tasks/TK0003.md @@ -1,6 +1,6 @@ # Task TK0003: Campaign design (objective design) -* **Summary:** +* **Summary:** Design the campaign(s) needed to meet the incident goals * **Belongs to tactic stage:** TA01 diff --git a/tasks/TK0004.md b/tasks/TK0004.md index bb776da..6dd23f6 100644 --- a/tasks/TK0004.md +++ b/tasks/TK0004.md @@ -1,6 +1,6 @@ # Task TK0004: Identify target subgroups -* **Summary:** +* **Summary:** Identify groups that can best be used to meet incident goals * **Belongs to tactic stage:** TA02 diff --git a/tasks/TK0005.md b/tasks/TK0005.md index d3822ea..3fa3407 100644 --- a/tasks/TK0005.md +++ b/tasks/TK0005.md @@ -1,6 +1,6 @@ # Task TK0005: Analyse subgroups -* **Summary:** +* **Summary:** Analyse subgroups * **Belongs to tactic stage:** TA02 diff --git a/tasks/TK0006.md b/tasks/TK0006.md index b7e50ad..de50d34 100644 --- a/tasks/TK0006.md +++ b/tasks/TK0006.md @@ -1,6 +1,6 @@ # Task TK0006: create master narratives -* **Summary:** +* **Summary:** create master narratives * **Belongs to tactic stage:** TA02 diff --git a/tasks/TK0007.md b/tasks/TK0007.md index 54ef472..18f17cd 100644 --- a/tasks/TK0007.md +++ b/tasks/TK0007.md @@ -1,6 +1,6 @@ # Task TK0007: Decide on techniques (4Ds etc) -* **Summary:** +* **Summary:** Decide on techniques (4Ds etc) * **Belongs to tactic stage:** TA02 diff --git a/tasks/TK0008.md b/tasks/TK0008.md index d45e0f2..0c2b902 100644 --- a/tasks/TK0008.md +++ b/tasks/TK0008.md @@ -1,6 +1,6 @@ # Task TK0008: Create subnarratives -* **Summary:** +* **Summary:** Create subnarratives * **Belongs to tactic stage:** TA02 diff --git a/tasks/TK0009.md b/tasks/TK0009.md index 025e47f..786dfae 100644 --- a/tasks/TK0009.md +++ b/tasks/TK0009.md @@ -1,6 +1,6 @@ # Task TK0009: 4chan/8chan coordinating content -* **Summary:** +* **Summary:** 4chan/8chan coordinating content * **Belongs to tactic stage:** TA02 diff --git a/tasks/TK0010.md b/tasks/TK0010.md index fa83f52..9d2f494 100644 --- a/tasks/TK0010.md +++ b/tasks/TK0010.md @@ -1,6 +1,6 @@ # Task TK0010: Create personas -* **Summary:** +* **Summary:** Create personas * **Belongs to tactic stage:** TA03 diff --git a/tasks/TK0011.md b/tasks/TK0011.md index 38d8a5d..be96efd 100644 --- a/tasks/TK0011.md +++ b/tasks/TK0011.md @@ -1,6 +1,6 @@ # Task TK0011: Recruit contractors -* **Summary:** +* **Summary:** Recruit contractors * **Belongs to tactic stage:** TA03 diff --git a/tasks/TK0012.md b/tasks/TK0012.md index a783cf7..08c916d 100644 --- a/tasks/TK0012.md +++ b/tasks/TK0012.md @@ -1,6 +1,6 @@ # Task TK0012: Recruit partisans -* **Summary:** +* **Summary:** Recruit partisans * **Belongs to tactic stage:** TA03 diff --git a/tasks/TK0013.md b/tasks/TK0013.md index 5b7bce2..1cc4560 100644 --- a/tasks/TK0013.md +++ b/tasks/TK0013.md @@ -1,6 +1,6 @@ # Task TK0013: find influencers -* **Summary:** +* **Summary:** find influencers * **Belongs to tactic stage:** TA03 diff --git a/tasks/TK0014.md b/tasks/TK0014.md index ff43130..6d050f7 100644 --- a/tasks/TK0014.md +++ b/tasks/TK0014.md @@ -1,6 +1,6 @@ # Task TK0014: Network building -* **Summary:** +* **Summary:** Network building * **Belongs to tactic stage:** TA04 diff --git a/tasks/TK0015.md b/tasks/TK0015.md index 364477e..c1751dd 100644 --- a/tasks/TK0015.md +++ b/tasks/TK0015.md @@ -1,6 +1,6 @@ # Task TK0015: Network infiltration -* **Summary:** +* **Summary:** Network infiltration * **Belongs to tactic stage:** TA04 diff --git a/tasks/TK0016.md b/tasks/TK0016.md index ce36a87..2eb1d3e 100644 --- a/tasks/TK0016.md +++ b/tasks/TK0016.md @@ -1,6 +1,6 @@ # Task TK0016: identify targets - susceptible audience members in networks -* **Summary:** +* **Summary:** identify targets - susceptible audience members in networks * **Belongs to tactic stage:** TA04 diff --git a/tasks/TK0017.md b/tasks/TK0017.md index fef435e..f955ad8 100644 --- a/tasks/TK0017.md +++ b/tasks/TK0017.md @@ -1,6 +1,6 @@ # Task TK0017: content creation -* **Summary:** +* **Summary:** content creation * **Belongs to tactic stage:** TA06 diff --git a/tasks/TK0018.md b/tasks/TK0018.md index 7ee4872..9a7d187 100644 --- a/tasks/TK0018.md +++ b/tasks/TK0018.md @@ -1,6 +1,6 @@ # Task TK0018: content appropriation -* **Summary:** +* **Summary:** content appropriation * **Belongs to tactic stage:** TA06 diff --git a/tasks/TK0019.md b/tasks/TK0019.md index c061773..61bd05e 100644 --- a/tasks/TK0019.md +++ b/tasks/TK0019.md @@ -1,6 +1,6 @@ # Task TK0019: anchor trust / credibility -* **Summary:** +* **Summary:** anchor trust / credibility * **Belongs to tactic stage:** TA08 diff --git a/tasks/TK0020.md b/tasks/TK0020.md index 55ff2aa..1ceb493 100644 --- a/tasks/TK0020.md +++ b/tasks/TK0020.md @@ -1,6 +1,6 @@ # Task TK0020: insert themes -* **Summary:** +* **Summary:** insert themes * **Belongs to tactic stage:** TA08 diff --git a/tasks/TK0021.md b/tasks/TK0021.md index b6bb74f..5e1d49c 100644 --- a/tasks/TK0021.md +++ b/tasks/TK0021.md @@ -1,6 +1,6 @@ # Task TK0021: deamplification (suppression, censoring) -* **Summary:** +* **Summary:** deamplification (suppression, censoring) * **Belongs to tactic stage:** TA09 diff --git a/tasks/TK0022.md b/tasks/TK0022.md index 803b279..51015dd 100644 --- a/tasks/TK0022.md +++ b/tasks/TK0022.md @@ -1,6 +1,6 @@ # Task TK0022: amplification -* **Summary:** +* **Summary:** amplification * **Belongs to tactic stage:** TA09 diff --git a/tasks/TK0023.md b/tasks/TK0023.md index 8cdd28d..e529fae 100644 --- a/tasks/TK0023.md +++ b/tasks/TK0023.md @@ -1,6 +1,6 @@ # Task TK0023: retention -* **Summary:** +* **Summary:** retention * **Belongs to tactic stage:** TA11 diff --git a/tasks/TK0024.md b/tasks/TK0024.md index 1f556ce..a0ca66d 100644 --- a/tasks/TK0024.md +++ b/tasks/TK0024.md @@ -1,6 +1,6 @@ # Task TK0024: customer relationship -* **Summary:** +* **Summary:** customer relationship * **Belongs to tactic stage:** TA11 diff --git a/tasks/TK0025.md b/tasks/TK0025.md index 199d31e..1036443 100644 --- a/tasks/TK0025.md +++ b/tasks/TK0025.md @@ -1,6 +1,6 @@ # Task TK0025: advocacy/ zealotry -* **Summary:** +* **Summary:** advocacy/ zealotry * **Belongs to tactic stage:** TA11 diff --git a/tasks/TK0026.md b/tasks/TK0026.md index 3e9355a..ff162cf 100644 --- a/tasks/TK0026.md +++ b/tasks/TK0026.md @@ -1,6 +1,6 @@ # Task TK0026: conversion -* **Summary:** +* **Summary:** conversion * **Belongs to tactic stage:** TA11 diff --git a/tasks/TK0027.md b/tasks/TK0027.md index fc72fac..c68df99 100644 --- a/tasks/TK0027.md +++ b/tasks/TK0027.md @@ -1,6 +1,6 @@ # Task TK0027: keep recruiting/prospecting -* **Summary:** +* **Summary:** keep recruiting/prospecting * **Belongs to tactic stage:** TA11 diff --git a/tasks/TK0028.md b/tasks/TK0028.md index c06a24d..159f86d 100644 --- a/tasks/TK0028.md +++ b/tasks/TK0028.md @@ -1,6 +1,6 @@ # Task TK0028: evaluation -* **Summary:** +* **Summary:** evaluation * **Belongs to tactic stage:** TA12 diff --git a/tasks/TK0029.md b/tasks/TK0029.md index 79c2cfe..41a0723 100644 --- a/tasks/TK0029.md +++ b/tasks/TK0029.md @@ -1,6 +1,6 @@ # Task TK0029: post-mortem -* **Summary:** +* **Summary:** post-mortem * **Belongs to tactic stage:** TA12 diff --git a/tasks/TK0030.md b/tasks/TK0030.md index 9db9fed..35a428d 100644 --- a/tasks/TK0030.md +++ b/tasks/TK0030.md @@ -1,6 +1,6 @@ # Task TK0030: after-action analysis -* **Summary:** +* **Summary:** after-action analysis * **Belongs to tactic stage:** TA12 diff --git a/tasks/TK0031.md b/tasks/TK0031.md index 9bea86e..2e08dab 100644 --- a/tasks/TK0031.md +++ b/tasks/TK0031.md @@ -1,6 +1,6 @@ # Task TK0031: OPSEC for TA01 -* **Summary:** +* **Summary:** OPSEC for TA01 * **Belongs to tactic stage:** TA01 diff --git a/tasks/TK0032.md b/tasks/TK0032.md index 44599ad..d9bbda5 100644 --- a/tasks/TK0032.md +++ b/tasks/TK0032.md @@ -1,6 +1,6 @@ # Task TK0032: OPSEC for TA02 -* **Summary:** +* **Summary:** OPSEC for TA02 * **Belongs to tactic stage:** TA02 diff --git a/tasks/TK0033.md b/tasks/TK0033.md index 4eef41d..7e10a88 100644 --- a/tasks/TK0033.md +++ b/tasks/TK0033.md @@ -1,6 +1,6 @@ # Task TK0033: OPSEC for TA03 -* **Summary:** +* **Summary:** OPSEC for TA03 * **Belongs to tactic stage:** TA03 diff --git a/tasks/TK0034.md b/tasks/TK0034.md index 6c5e50d..4f8db7e 100644 --- a/tasks/TK0034.md +++ b/tasks/TK0034.md @@ -1,6 +1,6 @@ # Task TK0034: OPSEC for TA04 -* **Summary:** +* **Summary:** OPSEC for TA04 * **Belongs to tactic stage:** TA04 diff --git a/tasks/TK0035.md b/tasks/TK0035.md index 65f672c..5dc730e 100644 --- a/tasks/TK0035.md +++ b/tasks/TK0035.md @@ -1,6 +1,6 @@ # Task TK0035: OPSEC for TA05 -* **Summary:** +* **Summary:** OPSEC for TA05 * **Belongs to tactic stage:** TA05 diff --git a/tasks/TK0036.md b/tasks/TK0036.md index ccdf56e..2710b09 100644 --- a/tasks/TK0036.md +++ b/tasks/TK0036.md @@ -1,6 +1,6 @@ # Task TK0036: OPSEC for TA06 -* **Summary:** +* **Summary:** OPSEC for TA06 * **Belongs to tactic stage:** TA06 diff --git a/tasks/TK0037.md b/tasks/TK0037.md index d206e42..1e849c8 100644 --- a/tasks/TK0037.md +++ b/tasks/TK0037.md @@ -1,6 +1,6 @@ # Task TK0037: OPSEC for TA07 -* **Summary:** +* **Summary:** OPSEC for TA07 * **Belongs to tactic stage:** TA07 diff --git a/tasks/TK0038.md b/tasks/TK0038.md index a870cae..7133b26 100644 --- a/tasks/TK0038.md +++ b/tasks/TK0038.md @@ -1,6 +1,6 @@ # Task TK0038: OPSEC for TA08 -* **Summary:** +* **Summary:** OPSEC for TA08 * **Belongs to tactic stage:** TA08 diff --git a/tasks/TK0039.md b/tasks/TK0039.md index d491130..9da8432 100644 --- a/tasks/TK0039.md +++ b/tasks/TK0039.md @@ -1,6 +1,6 @@ # Task TK0039: OPSEC for TA09 -* **Summary:** +* **Summary:** OPSEC for TA09 * **Belongs to tactic stage:** TA09 diff --git a/tasks/TK0040.md b/tasks/TK0040.md index fd573af..db92d1e 100644 --- a/tasks/TK0040.md +++ b/tasks/TK0040.md @@ -1,6 +1,6 @@ # Task TK0040: OPSEC for TA10 -* **Summary:** +* **Summary:** OPSEC for TA10 * **Belongs to tactic stage:** TA10 diff --git a/tasks/TK0041.md b/tasks/TK0041.md index f16046f..de24dee 100644 --- a/tasks/TK0041.md +++ b/tasks/TK0041.md @@ -1,6 +1,6 @@ # Task TK0041: OPSEC for TA11 -* **Summary:** +* **Summary:** OPSEC for TA11 * **Belongs to tactic stage:** TA11 diff --git a/tasks/TK0042.md b/tasks/TK0042.md index 5e744d5..766d6e3 100644 --- a/tasks/TK0042.md +++ b/tasks/TK0042.md @@ -1,6 +1,6 @@ # Task TK0042: OPSEC for TA12 -* **Summary:** +* **Summary:** OPSEC for TA12 * **Belongs to tactic stage:** TA12 diff --git a/tasks_index.md b/tasks_index.md index dad2ea5..13a85c4 100644 --- a/tasks_index.md +++ b/tasks_index.md @@ -16,247 +16,247 @@ - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - +
D2 DenyD3 DisruptD4 DegradeD5 DeceiveD6 DestroyD7 DeterD02D03D04D05D06D07 TOTALS
TA01 Strategic Planning 7
TK0002 Population research / audience analysis (centre of gravity)Research intended audience. Includes audience segmentation, hot-button issues etc. TA01
TK0003 Campaign design (objective design)Design the campaign(s) needed to meet the incident goals TA01
TK0004 Identify target subgroupsIdentify groups that can best be used to meet incident goals TA02
TK0005 Analyse subgroupsAnalyse subgroups TA02
TK0006 create master narrativescreate master narratives TA02
TK0007 Decide on techniques (4Ds etc)Decide on techniques (4Ds etc) TA02
TK0008 Create subnarrativesCreate subnarratives TA02
TK0009 4chan/8chan coordinating content4chan/8chan coordinating content TA02
TK0010 Create personasCreate personas TA03
TK0011 Recruit contractorsRecruit contractors TA03
TK0012 Recruit partisansRecruit partisans TA03
TK0013 find influencersfind influencers TA03
TK0014 Network buildingNetwork building TA04
TK0015 Network infiltrationNetwork infiltration TA04
TK0016 identify targets - susceptible audience members in networksidentify targets - susceptible audience members in networks TA04
TK0017 content creationcontent creation TA06
TK0018 content appropriationcontent appropriation TA06
TK0019 anchor trust / credibilityanchor trust / credibility TA08
TK0020 insert themesinsert themes TA08
TK0021 deamplification (suppression, censoring)deamplification (suppression, censoring) TA09
TK0022 amplificationamplification TA09
TK0023 retentionretention TA11
TK0024 customer relationshipcustomer relationship TA11
TK0025 advocacy/ zealotryadvocacy/ zealotry TA11
TK0026 conversionconversion TA11
TK0027 keep recruiting/prospectingkeep recruiting/prospecting TA11
TK0028 evaluationevaluation TA12
TK0029 post-mortempost-mortem TA12
TK0030 after-action analysisafter-action analysis TA12
TK0031 OPSEC for TA01OPSEC for TA01 TA01
TK0032 OPSEC for TA02OPSEC for TA02 TA02
TK0033 OPSEC for TA03OPSEC for TA03 TA03
TK0034 OPSEC for TA04OPSEC for TA04 TA04
TK0035 OPSEC for TA05OPSEC for TA05 TA05
TK0036 OPSEC for TA06OPSEC for TA06 TA06
TK0037 OPSEC for TA07OPSEC for TA07 TA07
TK0038 OPSEC for TA08OPSEC for TA08 TA08
TK0039 OPSEC for TA09OPSEC for TA09 TA09
TK0040 OPSEC for TA10OPSEC for TA10 TA10
TK0041 OPSEC for TA11OPSEC for TA11 TA11
TK0042 OPSEC for TA12OPSEC for TA12 TA12
diff --git a/techniques/T0001.md b/techniques/T0001.md index 881d0f6..894f157 100644 --- a/techniques/T0001.md +++ b/techniques/T0001.md @@ -17,26 +17,26 @@ | Counters | Response types | | -------- | -------------- | -| [C00008 Create shared fact-checking database](../counters/C00008.md) | D4 Degrade | -| [C00011 Media literacy. Games to identify fake news](../counters/C00011.md) | D2 Deny | -| [C00012 Platform regulation](../counters/C00012.md) | D2 Deny | -| [C00013 Rating framework for news](../counters/C00013.md) | D2 Deny | -| [C00014 Real-time updates to fact-checking database](../counters/C00014.md) | D4 Degrade | -| [C00016 Censorship](../counters/C00016.md) | D2 Deny | -| [C00017 Repair broken social connections](../counters/C00017.md) | D3 Disrupt | -| [C00019 Reduce effect of division-enablers](../counters/C00019.md) | D3 Disrupt | -| [C00021 Encourage in-person communication](../counters/C00021.md) | D4 Degrade | -| [C00022 Innoculate. Positive campaign to promote feeling of safety](../counters/C00022.md) | D4 Degrade | -| [C00024 Promote healthy narratives](../counters/C00024.md) | D4 Degrade | -| [C00026 Shore up democracy based messages](../counters/C00026.md) | D4 Degrade | -| [C00027 Create culture of civility](../counters/C00027.md) | D7 Deter | -| [C00107 Content moderation](../counters/C00107.md) | D2 Deny | -| [C00174 Create a healthier news environment](../counters/C00174.md) | D2 Deny | -| [C00176 Improve Coordination amongst stakeholders: public and private](../counters/C00176.md) | D7 Deter | -| [C00188 Newsroom/Journalist training to counter influence moves](../counters/C00188.md) | D3 Disrupt | -| [C00190 open engagement with civil society](../counters/C00190.md) | D3 Disrupt | -| [C00205 strong dialogue between the federal government and private sector to encourage better reporting](../counters/C00205.md) | D3 Disrupt | -| [C00212 build public resilience by making civil society more vibrant](../counters/C00212.md) | D3 Disrupt | +| [C00008 Create shared fact-checking database](../counters/C00008.md) | D04 | +| [C00011 Media literacy. Games to identify fake news](../counters/C00011.md) | D02 | +| [C00012 Platform regulation](../counters/C00012.md) | D02 | +| [C00013 Rating framework for news](../counters/C00013.md) | D02 | +| [C00014 Real-time updates to fact-checking database](../counters/C00014.md) | D04 | +| [C00016 Censorship](../counters/C00016.md) | D02 | +| [C00017 Repair broken social connections](../counters/C00017.md) | D03 | +| [C00019 Reduce effect of division-enablers](../counters/C00019.md) | D03 | +| [C00021 Encourage in-person communication](../counters/C00021.md) | D04 | +| [C00022 Innoculate. Positive campaign to promote feeling of safety](../counters/C00022.md) | D04 | +| [C00024 Promote healthy narratives](../counters/C00024.md) | D04 | +| [C00026 Shore up democracy based messages](../counters/C00026.md) | D04 | +| [C00027 Create culture of civility](../counters/C00027.md) | D07 | +| [C00107 Content moderation](../counters/C00107.md) | D02 | +| [C00174 Create a healthier news environment](../counters/C00174.md) | D02 | +| [C00176 Improve Coordination amongst stakeholders: public and private](../counters/C00176.md) | D07 | +| [C00188 Newsroom/Journalist training to counter influence moves](../counters/C00188.md) | D03 | +| [C00190 open engagement with civil society](../counters/C00190.md) | D03 | +| [C00205 strong dialogue between the federal government and private sector to encourage better reporting](../counters/C00205.md) | D03 | +| [C00212 build public resilience by making civil society more vibrant](../counters/C00212.md) | D03 | DO NOT EDIT ABOVE THIS LINE - PLEASE ADD NOTES BELOW \ No newline at end of file diff --git a/techniques/T0002.md b/techniques/T0002.md index f0205b8..61372fa 100644 --- a/techniques/T0002.md +++ b/techniques/T0002.md @@ -1,6 +1,6 @@ # Technique T0002: Facilitate State Propaganda -* **Summary**: Organize citizens around pro-state messaging. Paid or volunteer groups coordinated to push state propaganda (examples include 2016 Diba Facebook Expedition, coordinated to overcome China’s Great Firewall, to flood the Facebook pages of Taiwanese politicians and news agencies with a pro-PRC message). +* **Summary**: Organize citizens around pro-state messaging. Coordinate paid or volunteer groups to push state propaganda. * **Belongs to tactic stage**: TA01 @@ -14,31 +14,31 @@ | Counters | Response types | | -------- | -------------- | -| [C00008 Create shared fact-checking database](../counters/C00008.md) | D4 Degrade | -| [C00011 Media literacy. Games to identify fake news](../counters/C00011.md) | D2 Deny | -| [C00012 Platform regulation](../counters/C00012.md) | D2 Deny | -| [C00013 Rating framework for news](../counters/C00013.md) | D2 Deny | -| [C00014 Real-time updates to fact-checking database](../counters/C00014.md) | D4 Degrade | -| [C00016 Censorship](../counters/C00016.md) | D2 Deny | -| [C00017 Repair broken social connections](../counters/C00017.md) | D3 Disrupt | -| [C00019 Reduce effect of division-enablers](../counters/C00019.md) | D3 Disrupt | -| [C00021 Encourage in-person communication](../counters/C00021.md) | D4 Degrade | -| [C00022 Innoculate. Positive campaign to promote feeling of safety](../counters/C00022.md) | D4 Degrade | -| [C00024 Promote healthy narratives](../counters/C00024.md) | D4 Degrade | -| [C00026 Shore up democracy based messages](../counters/C00026.md) | D4 Degrade | -| [C00027 Create culture of civility](../counters/C00027.md) | D7 Deter | -| [C00029 Create fake website to issue counter narrative and counter narrative through physical merchandise](../counters/C00029.md) | D3 Disrupt | -| [C00030 Develop a compelling counter narrative (truth based)](../counters/C00030.md) | D3 Disrupt | -| [C00031 Dilute the core narrative - create multiple permutations, target / amplify](../counters/C00031.md) | D3 Disrupt | -| [C00082 Ground truthing as automated response to pollution](../counters/C00082.md) | D3 Disrupt | -| [C00084 Modify disinformation narratives, and rebroadcast them](../counters/C00084.md) | D3 Disrupt | -| [C00125 Prebunking](../counters/C00125.md) | D3 Disrupt | -| [C00126 Social media amber alert](../counters/C00126.md) | D3 Disrupt | -| [C00156 Better tell your country or organization story](../counters/C00156.md) | D3 Disrupt | -| [C00161 Coalition Building with stakeholders and Third-Party Inducements](../counters/C00161.md) | D7 Deter | -| [C00162 Unravel/target the Potemkin villages](../counters/C00162.md) | D3 Disrupt | -| [C00164 compatriot policy](../counters/C00164.md) | D3 Disrupt | -| [C00169 develop a creative content hub](../counters/C00169.md) | D3 Disrupt | +| [C00008 Create shared fact-checking database](../counters/C00008.md) | D04 | +| [C00011 Media literacy. Games to identify fake news](../counters/C00011.md) | D02 | +| [C00012 Platform regulation](../counters/C00012.md) | D02 | +| [C00013 Rating framework for news](../counters/C00013.md) | D02 | +| [C00014 Real-time updates to fact-checking database](../counters/C00014.md) | D04 | +| [C00016 Censorship](../counters/C00016.md) | D02 | +| [C00017 Repair broken social connections](../counters/C00017.md) | D03 | +| [C00019 Reduce effect of division-enablers](../counters/C00019.md) | D03 | +| [C00021 Encourage in-person communication](../counters/C00021.md) | D04 | +| [C00022 Innoculate. Positive campaign to promote feeling of safety](../counters/C00022.md) | D04 | +| [C00024 Promote healthy narratives](../counters/C00024.md) | D04 | +| [C00026 Shore up democracy based messages](../counters/C00026.md) | D04 | +| [C00027 Create culture of civility](../counters/C00027.md) | D07 | +| [C00029 Create fake website to issue counter narrative and counter narrative through physical merchandise](../counters/C00029.md) | D03 | +| [C00030 Develop a compelling counter narrative (truth based)](../counters/C00030.md) | D03 | +| [C00031 Dilute the core narrative - create multiple permutations, target / amplify](../counters/C00031.md) | D03 | +| [C00082 Ground truthing as automated response to pollution](../counters/C00082.md) | D03 | +| [C00084 Modify disinformation narratives, and rebroadcast them](../counters/C00084.md) | D03 | +| [C00125 Prebunking](../counters/C00125.md) | D03 | +| [C00126 Social media amber alert](../counters/C00126.md) | D03 | +| [C00156 Better tell your country or organization story](../counters/C00156.md) | D03 | +| [C00161 Coalition Building with stakeholders and Third-Party Inducements](../counters/C00161.md) | D07 | +| [C00162 Unravel/target the Potemkin villages](../counters/C00162.md) | D03 | +| [C00164 compatriot policy](../counters/C00164.md) | D03 | +| [C00169 develop a creative content hub](../counters/C00169.md) | D03 | DO NOT EDIT ABOVE THIS LINE - PLEASE ADD NOTES BELOW \ No newline at end of file diff --git a/techniques/T0003.md b/techniques/T0003.md index e38363b..b2210ea 100644 --- a/techniques/T0003.md +++ b/techniques/T0003.md @@ -1,6 +1,6 @@ # Technique T0003: Leverage Existing Narratives -* **Summary**: Use or adapt existing narrative themes, where narratives are the baseline stories of a target audience. Narratives form the bedrock of our worldviews. New information is understood through a process firmly grounded in this bedrock. If new information is not consitent with the prevailing narratives of an audience, it will be ignored. Effective campaigns will frame their misinformation in the context of these narratives. Highly effective campaigns will make extensive use of audience-appropriate archetypes and meta-narratives throughout their content creation and amplifiction practices. Examples include midwesterners are generous, Russia is under attack from outside. +* **Summary**: Use or adapt existing narrative themes, where narratives are the baseline stories of a target audience. Narratives form the bedrock of our worldviews. New information is understood through a process firmly grounded in this bedrock. If new information is not consitent with the prevailing narratives of an audience, it will be ignored. Effective campaigns will frame their misinformation in the context of these narratives. Highly effective campaigns will make extensive use of audience-appropriate archetypes and meta-narratives throughout their content creation and amplifiction practices. * **Belongs to tactic stage**: TA01 @@ -12,37 +12,37 @@ | Counters | Response types | | -------- | -------------- | -| [C00008 Create shared fact-checking database](../counters/C00008.md) | D4 Degrade | -| [C00011 Media literacy. Games to identify fake news](../counters/C00011.md) | D2 Deny | -| [C00012 Platform regulation](../counters/C00012.md) | D2 Deny | -| [C00013 Rating framework for news](../counters/C00013.md) | D2 Deny | -| [C00014 Real-time updates to fact-checking database](../counters/C00014.md) | D4 Degrade | -| [C00016 Censorship](../counters/C00016.md) | D2 Deny | -| [C00017 Repair broken social connections](../counters/C00017.md) | D3 Disrupt | -| [C00019 Reduce effect of division-enablers](../counters/C00019.md) | D3 Disrupt | -| [C00021 Encourage in-person communication](../counters/C00021.md) | D4 Degrade | -| [C00022 Innoculate. Positive campaign to promote feeling of safety](../counters/C00022.md) | D4 Degrade | -| [C00024 Promote healthy narratives](../counters/C00024.md) | D4 Degrade | -| [C00027 Create culture of civility](../counters/C00027.md) | D7 Deter | -| [C00029 Create fake website to issue counter narrative and counter narrative through physical merchandise](../counters/C00029.md) | D3 Disrupt | -| [C00030 Develop a compelling counter narrative (truth based)](../counters/C00030.md) | D3 Disrupt | -| [C00031 Dilute the core narrative - create multiple permutations, target / amplify](../counters/C00031.md) | D3 Disrupt | -| [C00080 Create competing narrative](../counters/C00080.md) | D3 Disrupt | -| [C00081 Highlight flooding and noise, and explain motivations](../counters/C00081.md) | D3 Disrupt | -| [C00082 Ground truthing as automated response to pollution](../counters/C00082.md) | D3 Disrupt | -| [C00084 Modify disinformation narratives, and rebroadcast them](../counters/C00084.md) | D3 Disrupt | -| [C00125 Prebunking](../counters/C00125.md) | D3 Disrupt | -| [C00126 Social media amber alert](../counters/C00126.md) | D3 Disrupt | -| [C00156 Better tell your country or organization story](../counters/C00156.md) | D3 Disrupt | -| [C00161 Coalition Building with stakeholders and Third-Party Inducements](../counters/C00161.md) | D7 Deter | -| [C00162 Unravel/target the Potemkin villages](../counters/C00162.md) | D3 Disrupt | -| [C00164 compatriot policy](../counters/C00164.md) | D3 Disrupt | -| [C00169 develop a creative content hub](../counters/C00169.md) | D3 Disrupt | -| [C00176 Improve Coordination amongst stakeholders: public and private](../counters/C00176.md) | D7 Deter | -| [C00188 Newsroom/Journalist training to counter influence moves](../counters/C00188.md) | D3 Disrupt | -| [C00190 open engagement with civil society](../counters/C00190.md) | D3 Disrupt | -| [C00205 strong dialogue between the federal government and private sector to encourage better reporting](../counters/C00205.md) | D3 Disrupt | -| [C00212 build public resilience by making civil society more vibrant](../counters/C00212.md) | D3 Disrupt | +| [C00008 Create shared fact-checking database](../counters/C00008.md) | D04 | +| [C00011 Media literacy. Games to identify fake news](../counters/C00011.md) | D02 | +| [C00012 Platform regulation](../counters/C00012.md) | D02 | +| [C00013 Rating framework for news](../counters/C00013.md) | D02 | +| [C00014 Real-time updates to fact-checking database](../counters/C00014.md) | D04 | +| [C00016 Censorship](../counters/C00016.md) | D02 | +| [C00017 Repair broken social connections](../counters/C00017.md) | D03 | +| [C00019 Reduce effect of division-enablers](../counters/C00019.md) | D03 | +| [C00021 Encourage in-person communication](../counters/C00021.md) | D04 | +| [C00022 Innoculate. Positive campaign to promote feeling of safety](../counters/C00022.md) | D04 | +| [C00024 Promote healthy narratives](../counters/C00024.md) | D04 | +| [C00027 Create culture of civility](../counters/C00027.md) | D07 | +| [C00029 Create fake website to issue counter narrative and counter narrative through physical merchandise](../counters/C00029.md) | D03 | +| [C00030 Develop a compelling counter narrative (truth based)](../counters/C00030.md) | D03 | +| [C00031 Dilute the core narrative - create multiple permutations, target / amplify](../counters/C00031.md) | D03 | +| [C00080 Create competing narrative](../counters/C00080.md) | D03 | +| [C00081 Highlight flooding and noise, and explain motivations](../counters/C00081.md) | D03 | +| [C00082 Ground truthing as automated response to pollution](../counters/C00082.md) | D03 | +| [C00084 Modify disinformation narratives, and rebroadcast them](../counters/C00084.md) | D03 | +| [C00125 Prebunking](../counters/C00125.md) | D03 | +| [C00126 Social media amber alert](../counters/C00126.md) | D03 | +| [C00156 Better tell your country or organization story](../counters/C00156.md) | D03 | +| [C00161 Coalition Building with stakeholders and Third-Party Inducements](../counters/C00161.md) | D07 | +| [C00162 Unravel/target the Potemkin villages](../counters/C00162.md) | D03 | +| [C00164 compatriot policy](../counters/C00164.md) | D03 | +| [C00169 develop a creative content hub](../counters/C00169.md) | D03 | +| [C00176 Improve Coordination amongst stakeholders: public and private](../counters/C00176.md) | D07 | +| [C00188 Newsroom/Journalist training to counter influence moves](../counters/C00188.md) | D03 | +| [C00190 open engagement with civil society](../counters/C00190.md) | D03 | +| [C00205 strong dialogue between the federal government and private sector to encourage better reporting](../counters/C00205.md) | D03 | +| [C00212 build public resilience by making civil society more vibrant](../counters/C00212.md) | D03 | DO NOT EDIT ABOVE THIS LINE - PLEASE ADD NOTES BELOW \ No newline at end of file diff --git a/techniques/T0004.md b/techniques/T0004.md index 8c1f16a..e6f6ef3 100644 --- a/techniques/T0004.md +++ b/techniques/T0004.md @@ -1,6 +1,6 @@ # Technique T0004: Competing Narratives -* **Summary**: Advance competing narratives connected to same issue ie: on one hand deny incident while at same time expresses dismiss. MH17 (example) "Russian Foreign Ministry again claimed that “absolutely groundless accusations are put forward against the Russian side, which are aimed at discrediting Russia in the eyes of the international community" (deny); "The Dutch MH17 investigation is biased, anti-Russian and factually inaccurate" (dismiss). +* **Summary**: Advance competing narratives connected to same issue ie: on one hand deny incident while at same time expresses dismiss. Suppressing or discouraging narratives already spreading requires an alternative. The most simple set of narrative techniques in response would be the construction and promotion of contradictory alternatives centered on denial, deflection, dismissal, counter-charges, excessive standards of proof, bias in prohibition or enforcement, and so on. @@ -16,18 +16,18 @@ These competing narratives allow loyalists cover, but are less compelling to opp | Counters | Response types | | -------- | -------------- | -| [C00042 Address truth contained in narratives](../counters/C00042.md) | D4 Degrade | -| [C00080 Create competing narrative](../counters/C00080.md) | D3 Disrupt | -| [C00081 Highlight flooding and noise, and explain motivations](../counters/C00081.md) | D3 Disrupt | -| [C00082 Ground truthing as automated response to pollution](../counters/C00082.md) | D3 Disrupt | -| [C00084 Modify disinformation narratives, and rebroadcast them](../counters/C00084.md) | D3 Disrupt | -| [C00125 Prebunking](../counters/C00125.md) | D3 Disrupt | -| [C00126 Social media amber alert](../counters/C00126.md) | D3 Disrupt | -| [C00156 Better tell your country or organization story](../counters/C00156.md) | D3 Disrupt | -| [C00161 Coalition Building with stakeholders and Third-Party Inducements](../counters/C00161.md) | D7 Deter | -| [C00162 Unravel/target the Potemkin villages](../counters/C00162.md) | D3 Disrupt | -| [C00164 compatriot policy](../counters/C00164.md) | D3 Disrupt | -| [C00169 develop a creative content hub](../counters/C00169.md) | D3 Disrupt | +| [C00042 Address truth contained in narratives](../counters/C00042.md) | D04 | +| [C00080 Create competing narrative](../counters/C00080.md) | D03 | +| [C00081 Highlight flooding and noise, and explain motivations](../counters/C00081.md) | D03 | +| [C00082 Ground truthing as automated response to pollution](../counters/C00082.md) | D03 | +| [C00084 Modify disinformation narratives, and rebroadcast them](../counters/C00084.md) | D03 | +| [C00125 Prebunking](../counters/C00125.md) | D03 | +| [C00126 Social media amber alert](../counters/C00126.md) | D03 | +| [C00156 Better tell your country or organization story](../counters/C00156.md) | D03 | +| [C00161 Coalition Building with stakeholders and Third-Party Inducements](../counters/C00161.md) | D07 | +| [C00162 Unravel/target the Potemkin villages](../counters/C00162.md) | D03 | +| [C00164 compatriot policy](../counters/C00164.md) | D03 | +| [C00169 develop a creative content hub](../counters/C00169.md) | D03 | DO NOT EDIT ABOVE THIS LINE - PLEASE ADD NOTES BELOW \ No newline at end of file diff --git a/techniques/T0005.md b/techniques/T0005.md index 5964d73..1112608 100644 --- a/techniques/T0005.md +++ b/techniques/T0005.md @@ -12,8 +12,8 @@ | Counters | Response types | | -------- | -------------- | -| [C00010 Enhanced privacy regulation for social media](../counters/C00010.md) | D2 Deny | -| [C00036 Infiltrate the in-group to discredit leaders (divide)](../counters/C00036.md) | D2 Deny | +| [C00010 Enhanced privacy regulation for social media](../counters/C00010.md) | D02 | +| [C00036 Infiltrate the in-group to discredit leaders (divide)](../counters/C00036.md) | D02 | DO NOT EDIT ABOVE THIS LINE - PLEASE ADD NOTES BELOW \ No newline at end of file diff --git a/techniques/T0006.md b/techniques/T0006.md index 0629801..7cb5707 100644 --- a/techniques/T0006.md +++ b/techniques/T0006.md @@ -1,13 +1,6 @@ # Technique T0006: Create Master Narratives -* **Summary**: The promotion of beneficial master narratives is perhaps the most effective method for achieving long-term strategic narrative dominance. From a "whole of society" perpective the promotion of the society's core master narratives should occupy a central strategic role. From a misinformation campaign / cognitive security perpectve the tactics around master narratives center more precisely on the day-to-day promotion and reinforcement of this messaging. In other words, beneficial, high-coverage master narratives are a central strategic goal and their promotion consitutes an ongoing tactical struggle carried out at a whole-of-society level. - -By way of example, major powers are promoting master narratives such as: -* "Huawei is detetmined to build trustworthy networks" -* "Russia is the victim of bullying by NATO powers" -* "USA is guided by its founding principles of liberty and egalitarianism" - -Tactically, their promotion covers a broad spectrum of activities both on- and offline. +* **Summary**: The promotion of beneficial master narratives is perhaps the most effective method for achieving long-term strategic narrative dominance. From a "whole of society" perspective the promotion of the society's core master narratives should occupy a central strategic role. From a misinformation campaign / cognitive security perpectve the tactics around master narratives center more precisely on the day-to-day promotion and reinforcement of this messaging. In other words, beneficial, high-coverage master narratives are a central strategic goal and their promotion consitutes an ongoing tactical struggle carried out at a whole-of-society level. Tactically, their promotion covers a broad spectrum of activities both on- and offline. * **Belongs to tactic stage**: TA02 @@ -19,19 +12,19 @@ Tactically, their promotion covers a broad spectrum of activities both on- and o | Counters | Response types | | -------- | -------------- | -| [C00008 Create shared fact-checking database](../counters/C00008.md) | D4 Degrade | -| [C00011 Media literacy. Games to identify fake news](../counters/C00011.md) | D2 Deny | -| [C00014 Real-time updates to fact-checking database](../counters/C00014.md) | D4 Degrade | -| [C00021 Encourage in-person communication](../counters/C00021.md) | D4 Degrade | -| [C00022 Innoculate. Positive campaign to promote feeling of safety](../counters/C00022.md) | D4 Degrade | -| [C00024 Promote healthy narratives](../counters/C00024.md) | D4 Degrade | -| [C00027 Create culture of civility](../counters/C00027.md) | D7 Deter | -| [C00029 Create fake website to issue counter narrative and counter narrative through physical merchandise](../counters/C00029.md) | D3 Disrupt | -| [C00030 Develop a compelling counter narrative (truth based)](../counters/C00030.md) | D3 Disrupt | -| [C00031 Dilute the core narrative - create multiple permutations, target / amplify](../counters/C00031.md) | D3 Disrupt | -| [C00081 Highlight flooding and noise, and explain motivations](../counters/C00081.md) | D3 Disrupt | -| [C00082 Ground truthing as automated response to pollution](../counters/C00082.md) | D3 Disrupt | -| [C00084 Modify disinformation narratives, and rebroadcast them](../counters/C00084.md) | D3 Disrupt | +| [C00008 Create shared fact-checking database](../counters/C00008.md) | D04 | +| [C00011 Media literacy. Games to identify fake news](../counters/C00011.md) | D02 | +| [C00014 Real-time updates to fact-checking database](../counters/C00014.md) | D04 | +| [C00021 Encourage in-person communication](../counters/C00021.md) | D04 | +| [C00022 Innoculate. Positive campaign to promote feeling of safety](../counters/C00022.md) | D04 | +| [C00024 Promote healthy narratives](../counters/C00024.md) | D04 | +| [C00027 Create culture of civility](../counters/C00027.md) | D07 | +| [C00029 Create fake website to issue counter narrative and counter narrative through physical merchandise](../counters/C00029.md) | D03 | +| [C00030 Develop a compelling counter narrative (truth based)](../counters/C00030.md) | D03 | +| [C00031 Dilute the core narrative - create multiple permutations, target / amplify](../counters/C00031.md) | D03 | +| [C00081 Highlight flooding and noise, and explain motivations](../counters/C00081.md) | D03 | +| [C00082 Ground truthing as automated response to pollution](../counters/C00082.md) | D03 | +| [C00084 Modify disinformation narratives, and rebroadcast them](../counters/C00084.md) | D03 | DO NOT EDIT ABOVE THIS LINE - PLEASE ADD NOTES BELOW \ No newline at end of file diff --git a/techniques/T0007.md b/techniques/T0007.md index 983e6e8..be23fc1 100644 --- a/techniques/T0007.md +++ b/techniques/T0007.md @@ -4,7 +4,6 @@ Computational propaganda depends substantially on false perceptions of credibility and acceptance. By creating fake users and groups with a variety of interests and commitments, attackers can ensure that their messages both come from trusted sources and appear more widely adopted than they actually are. -Examples: Ukraine elections (2019) circumvent Facebook’s new safeguards by paying Ukrainian citizens to give a Russian agent access to their personal pages. EU Elections (2019) Avaaz reported more than 500 suspicious pages and groups to Facebook related to the three-month investigation of Facebook disinformation networks in Europe. Mueller report (2016) The IRA was able to reach up to 126 million Americans on Facebook via a mixture of fraudulent accounts, groups, and advertisements, the report says. Twitter accounts it created were portrayed as real American voices by major news outlets. It was even able to hold real-life rallies, mobilizing hundreds of people at a time in major cities like Philadelphia and Miami. * **Belongs to tactic stage**: TA03 @@ -24,24 +23,24 @@ Examples: Ukraine elections (2019) circumvent Facebook’s new safeguards by pay | Counters | Response types | | -------- | -------------- | -| [C00006 Charge for social media](../counters/C00006.md) | D2 Deny | -| [C00012 Platform regulation](../counters/C00012.md) | D2 Deny | -| [C00016 Censorship](../counters/C00016.md) | D2 Deny | -| [C00034 Create more friction at account creation](../counters/C00034.md) | D4 Degrade | -| [C00036 Infiltrate the in-group to discredit leaders (divide)](../counters/C00036.md) | D2 Deny | -| [C00040 third party verification for people](../counters/C00040.md) | D2 Deny | -| [C00085 Mute content](../counters/C00085.md) | D3 Disrupt | -| [C00097 Require use of verified identities to contribute to poll or comment](../counters/C00097.md) | D2 Deny | -| [C00099 Strengthen verification methods](../counters/C00099.md) | D2 Deny | -| [C00107 Content moderation](../counters/C00107.md) | D2 Deny | -| [C00122 Content moderation](../counters/C00122.md) | D2 Deny | -| [C00133 Deplatform Account*](../counters/C00133.md) | D3 Disrupt | -| [C00135 Deplatform message groups and/or message boards](../counters/C00135.md) | D3 Disrupt | -| [C00153 Take pre-emptive action against actors' infrastructure](../counters/C00153.md) | D3 Disrupt | -| [C00172 social media source removal](../counters/C00172.md) | D2 Deny | -| [C00176 Improve Coordination amongst stakeholders: public and private](../counters/C00176.md) | D7 Deter | -| [C00189 Ensure that platforms are taking down flagged accounts](../counters/C00189.md) | D6 Destroy | -| [C00197 remove suspicious accounts](../counters/C00197.md) | D2 Deny | +| [C00006 Charge for social media](../counters/C00006.md) | D02 | +| [C00012 Platform regulation](../counters/C00012.md) | D02 | +| [C00016 Censorship](../counters/C00016.md) | D02 | +| [C00034 Create more friction at account creation](../counters/C00034.md) | D04 | +| [C00036 Infiltrate the in-group to discredit leaders (divide)](../counters/C00036.md) | D02 | +| [C00040 third party verification for people](../counters/C00040.md) | D02 | +| [C00085 Mute content](../counters/C00085.md) | D03 | +| [C00097 Require use of verified identities to contribute to poll or comment](../counters/C00097.md) | D02 | +| [C00099 Strengthen verification methods](../counters/C00099.md) | D02 | +| [C00107 Content moderation](../counters/C00107.md) | D02 | +| [C00122 Content moderation](../counters/C00122.md) | D02 | +| [C00133 Deplatform Account*](../counters/C00133.md) | D03 | +| [C00135 Deplatform message groups and/or message boards](../counters/C00135.md) | D03 | +| [C00153 Take pre-emptive action against actors' infrastructure](../counters/C00153.md) | D03 | +| [C00172 social media source removal](../counters/C00172.md) | D02 | +| [C00176 Improve Coordination amongst stakeholders: public and private](../counters/C00176.md) | D07 | +| [C00189 Ensure that platforms are taking down flagged accounts](../counters/C00189.md) | D06 | +| [C00197 remove suspicious accounts](../counters/C00197.md) | D02 | DO NOT EDIT ABOVE THIS LINE - PLEASE ADD NOTES BELOW \ No newline at end of file diff --git a/techniques/T0008.md b/techniques/T0008.md index ca0bb40..4bf1195 100644 --- a/techniques/T0008.md +++ b/techniques/T0008.md @@ -1,6 +1,6 @@ # Technique T0008: Create fake or imposter news sites -* **Summary**: Modern computational propaganda makes use of a cadre of imposter news sites spreading globally. These sites, sometimes motivated by concerns other than propaganda--for instance, click-based revenue--often have some superficial markers of authenticity, such as naming and site-design. But many can be quickly exposed with reference to their owenership, reporting history and adverstising details. A prominent case from the 2016 era was the _Denver Guardian_, which purported to be a local newspaper in Colorado and specialized in negative stories about Hillary Clinton. +* **Summary**: Modern computational propaganda makes use of a cadre of imposter news sites spreading globally. These sites, sometimes motivated by concerns other than propaganda--for instance, click-based revenue--often have some superficial markers of authenticity, such as naming and site-design. But many can be quickly exposed with reference to their owenership, reporting history and adverstising details. * **Belongs to tactic stage**: TA03 @@ -13,21 +13,21 @@ | Counters | Response types | | -------- | -------------- | -| [C00008 Create shared fact-checking database](../counters/C00008.md) | D4 Degrade | -| [C00011 Media literacy. Games to identify fake news](../counters/C00011.md) | D2 Deny | -| [C00012 Platform regulation](../counters/C00012.md) | D2 Deny | -| [C00014 Real-time updates to fact-checking database](../counters/C00014.md) | D4 Degrade | -| [C00016 Censorship](../counters/C00016.md) | D2 Deny | -| [C00070 Block access to disinformation resources](../counters/C00070.md) | D2 Deny | -| [C00085 Mute content](../counters/C00085.md) | D3 Disrupt | -| [C00099 Strengthen verification methods](../counters/C00099.md) | D2 Deny | -| [C00107 Content moderation](../counters/C00107.md) | D2 Deny | -| [C00122 Content moderation](../counters/C00122.md) | D2 Deny | -| [C00153 Take pre-emptive action against actors' infrastructure](../counters/C00153.md) | D3 Disrupt | -| [C00172 social media source removal](../counters/C00172.md) | D2 Deny | -| [C00176 Improve Coordination amongst stakeholders: public and private](../counters/C00176.md) | D7 Deter | -| [C00188 Newsroom/Journalist training to counter influence moves](../counters/C00188.md) | D3 Disrupt | -| [C00189 Ensure that platforms are taking down flagged accounts](../counters/C00189.md) | D6 Destroy | +| [C00008 Create shared fact-checking database](../counters/C00008.md) | D04 | +| [C00011 Media literacy. Games to identify fake news](../counters/C00011.md) | D02 | +| [C00012 Platform regulation](../counters/C00012.md) | D02 | +| [C00014 Real-time updates to fact-checking database](../counters/C00014.md) | D04 | +| [C00016 Censorship](../counters/C00016.md) | D02 | +| [C00070 Block access to disinformation resources](../counters/C00070.md) | D02 | +| [C00085 Mute content](../counters/C00085.md) | D03 | +| [C00099 Strengthen verification methods](../counters/C00099.md) | D02 | +| [C00107 Content moderation](../counters/C00107.md) | D02 | +| [C00122 Content moderation](../counters/C00122.md) | D02 | +| [C00153 Take pre-emptive action against actors' infrastructure](../counters/C00153.md) | D03 | +| [C00172 social media source removal](../counters/C00172.md) | D02 | +| [C00176 Improve Coordination amongst stakeholders: public and private](../counters/C00176.md) | D07 | +| [C00188 Newsroom/Journalist training to counter influence moves](../counters/C00188.md) | D03 | +| [C00189 Ensure that platforms are taking down flagged accounts](../counters/C00189.md) | D06 | DO NOT EDIT ABOVE THIS LINE - PLEASE ADD NOTES BELOW \ No newline at end of file diff --git a/techniques/T0009.md b/techniques/T0009.md index 23cefc9..94b9544 100644 --- a/techniques/T0009.md +++ b/techniques/T0009.md @@ -1,6 +1,6 @@ # Technique T0009: Create fake experts -* **Summary**: Stories planted or promoted in computational propaganda operations often make use of experts fabricated from whole cloth, sometimes specifically for the story itself. For example, in the Jade Helm conspiracy theory promoted by SVR in 2015, a pair of experts--one of them naming himself a “Military Intelligence Analyst / Russian Regional CME” and the other a “Geopolitical Strategist, Journalist & Author”--pushed the story heavily on LinkedIn. +* **Summary**: Stories planted or promoted in computational propaganda operations often make use of experts fabricated from whole cloth, sometimes specifically for the story itself. * **Belongs to tactic stage**: TA03 @@ -13,20 +13,20 @@ | Counters | Response types | | -------- | -------------- | -| [C00008 Create shared fact-checking database](../counters/C00008.md) | D4 Degrade | -| [C00011 Media literacy. Games to identify fake news](../counters/C00011.md) | D2 Deny | -| [C00012 Platform regulation](../counters/C00012.md) | D2 Deny | -| [C00014 Real-time updates to fact-checking database](../counters/C00014.md) | D4 Degrade | -| [C00016 Censorship](../counters/C00016.md) | D2 Deny | -| [C00034 Create more friction at account creation](../counters/C00034.md) | D4 Degrade | -| [C00040 third party verification for people](../counters/C00040.md) | D2 Deny | -| [C00097 Require use of verified identities to contribute to poll or comment](../counters/C00097.md) | D2 Deny | -| [C00099 Strengthen verification methods](../counters/C00099.md) | D2 Deny | -| [C00107 Content moderation](../counters/C00107.md) | D2 Deny | -| [C00133 Deplatform Account*](../counters/C00133.md) | D3 Disrupt | -| [C00176 Improve Coordination amongst stakeholders: public and private](../counters/C00176.md) | D7 Deter | -| [C00189 Ensure that platforms are taking down flagged accounts](../counters/C00189.md) | D6 Destroy | -| [C00197 remove suspicious accounts](../counters/C00197.md) | D2 Deny | +| [C00008 Create shared fact-checking database](../counters/C00008.md) | D04 | +| [C00011 Media literacy. Games to identify fake news](../counters/C00011.md) | D02 | +| [C00012 Platform regulation](../counters/C00012.md) | D02 | +| [C00014 Real-time updates to fact-checking database](../counters/C00014.md) | D04 | +| [C00016 Censorship](../counters/C00016.md) | D02 | +| [C00034 Create more friction at account creation](../counters/C00034.md) | D04 | +| [C00040 third party verification for people](../counters/C00040.md) | D02 | +| [C00097 Require use of verified identities to contribute to poll or comment](../counters/C00097.md) | D02 | +| [C00099 Strengthen verification methods](../counters/C00099.md) | D02 | +| [C00107 Content moderation](../counters/C00107.md) | D02 | +| [C00133 Deplatform Account*](../counters/C00133.md) | D03 | +| [C00176 Improve Coordination amongst stakeholders: public and private](../counters/C00176.md) | D07 | +| [C00189 Ensure that platforms are taking down flagged accounts](../counters/C00189.md) | D06 | +| [C00197 remove suspicious accounts](../counters/C00197.md) | D02 | DO NOT EDIT ABOVE THIS LINE - PLEASE ADD NOTES BELOW \ No newline at end of file diff --git a/techniques/T0010.md b/techniques/T0010.md index 497dc95..4f761d5 100644 --- a/techniques/T0010.md +++ b/techniques/T0010.md @@ -23,33 +23,33 @@ | Counters | Response types | | -------- | -------------- | -| [C00009 Educate high profile influencers on best practices](../counters/C00009.md) | D2 Deny | -| [C00036 Infiltrate the in-group to discredit leaders (divide)](../counters/C00036.md) | D2 Deny | -| [C00046 Marginalise and discredit extremist groups](../counters/C00046.md) | D4 Degrade | -| [C00048 Name and Shame Influencers](../counters/C00048.md) | D7 Deter | -| [C00051 Counter social engineering training](../counters/C00051.md) | D2 Deny | -| [C00072 Remove non-relevant content from special interest groups - not recommended](../counters/C00072.md) | D2 Deny | -| [C00073 Inoculate populations through media literacy training](../counters/C00073.md) | D2 Deny | -| [C00092 Establish a truth teller reputation score for influencers](../counters/C00092.md) | D7 Deter | -| [C00093 Influencer code of conduct](../counters/C00093.md) | D7 Deter | -| [C00111 Reduce polarisation by connecting and presenting sympathetic renditions of opposite views](../counters/C00111.md) | D4 Degrade | -| [C00125 Prebunking](../counters/C00125.md) | D3 Disrupt | -| [C00126 Social media amber alert](../counters/C00126.md) | D3 Disrupt | -| [C00130 Mentorship: elders, youth, credit. Learn vicariously.](../counters/C00130.md) | D7 Deter | -| [C00136 Microtarget most likely targets then send them countermessages](../counters/C00136.md) | D3 Disrupt | -| [C00156 Better tell your country or organization story](../counters/C00156.md) | D3 Disrupt | -| [C00160 find and train influencers](../counters/C00160.md) | D2 Deny | -| [C00162 Unravel/target the Potemkin villages](../counters/C00162.md) | D3 Disrupt | -| [C00169 develop a creative content hub](../counters/C00169.md) | D3 Disrupt | -| [C00174 Create a healthier news environment](../counters/C00174.md) | D2 Deny | -| [C00176 Improve Coordination amongst stakeholders: public and private](../counters/C00176.md) | D7 Deter | -| [C00184 Media exposure](../counters/C00184.md) | D4 Degrade | -| [C00188 Newsroom/Journalist training to counter influence moves](../counters/C00188.md) | D3 Disrupt | -| [C00190 open engagement with civil society](../counters/C00190.md) | D3 Disrupt | -| [C00195 Redirect searches away from disinformation or extremist content ](../counters/C00195.md) | D2 Deny | -| [C00200 Respected figure (influencer) disavows misinfo](../counters/C00200.md) | D3 Disrupt | -| [C00203 Stop offering press credentials to propaganda outlets](../counters/C00203.md) | D3 Disrupt | -| [C00212 build public resilience by making civil society more vibrant](../counters/C00212.md) | D3 Disrupt | +| [C00009 Educate high profile influencers on best practices](../counters/C00009.md) | D02 | +| [C00036 Infiltrate the in-group to discredit leaders (divide)](../counters/C00036.md) | D02 | +| [C00046 Marginalise and discredit extremist groups](../counters/C00046.md) | D04 | +| [C00048 Name and Shame Influencers](../counters/C00048.md) | D07 | +| [C00051 Counter social engineering training](../counters/C00051.md) | D02 | +| [C00072 Remove non-relevant content from special interest groups - not recommended](../counters/C00072.md) | D02 | +| [C00073 Inoculate populations through media literacy training](../counters/C00073.md) | D02 | +| [C00092 Establish a truth teller reputation score for influencers](../counters/C00092.md) | D07 | +| [C00093 Influencer code of conduct](../counters/C00093.md) | D07 | +| [C00111 Reduce polarisation by connecting and presenting sympathetic renditions of opposite views](../counters/C00111.md) | D04 | +| [C00125 Prebunking](../counters/C00125.md) | D03 | +| [C00126 Social media amber alert](../counters/C00126.md) | D03 | +| [C00130 Mentorship: elders, youth, credit. Learn vicariously.](../counters/C00130.md) | D07 | +| [C00136 Microtarget most likely targets then send them countermessages](../counters/C00136.md) | D03 | +| [C00156 Better tell your country or organization story](../counters/C00156.md) | D03 | +| [C00160 find and train influencers](../counters/C00160.md) | D02 | +| [C00162 Unravel/target the Potemkin villages](../counters/C00162.md) | D03 | +| [C00169 develop a creative content hub](../counters/C00169.md) | D03 | +| [C00174 Create a healthier news environment](../counters/C00174.md) | D02 | +| [C00176 Improve Coordination amongst stakeholders: public and private](../counters/C00176.md) | D07 | +| [C00184 Media exposure](../counters/C00184.md) | D04 | +| [C00188 Newsroom/Journalist training to counter influence moves](../counters/C00188.md) | D03 | +| [C00190 open engagement with civil society](../counters/C00190.md) | D03 | +| [C00195 Redirect searches away from disinformation or extremist content ](../counters/C00195.md) | D02 | +| [C00200 Respected figure (influencer) disavows misinfo](../counters/C00200.md) | D03 | +| [C00203 Stop offering press credentials to propaganda outlets](../counters/C00203.md) | D03 | +| [C00212 build public resilience by making civil society more vibrant](../counters/C00212.md) | D03 | DO NOT EDIT ABOVE THIS LINE - PLEASE ADD NOTES BELOW \ No newline at end of file diff --git a/techniques/T0011.md b/techniques/T0011.md index d491314..fa41348 100644 --- a/techniques/T0011.md +++ b/techniques/T0011.md @@ -1,6 +1,6 @@ # Technique T0011: Hijack legitimate account -* **Summary**: Hack or take over legimate accounts to distribute misinformation or damaging content. Examples include Syrian Electronic Army (2013) series of false tweets from a hijacked Associated Press Twitter account claiming that President Barack Obama had been injured in a series of explosions near the White House. The false report caused a temporary plunge of 143 points on the Dow Jones Industrial Average. +* **Summary**: Hack or take over legimate accounts to distribute misinformation or damaging content. * **Belongs to tactic stage**: TA04 @@ -13,13 +13,13 @@ | Counters | Response types | | -------- | -------------- | -| [C00053 Delete old accounts / Remove unused social media accounts](../counters/C00053.md) | D4 Degrade | -| [C00098 Revocation of allowlisted or "verified" status](../counters/C00098.md) | D2 Deny | -| [C00133 Deplatform Account*](../counters/C00133.md) | D3 Disrupt | -| [C00153 Take pre-emptive action against actors' infrastructure](../counters/C00153.md) | D3 Disrupt | -| [C00182 Redirection / malware detection/ remediation](../counters/C00182.md) | D2 Deny | -| [C00189 Ensure that platforms are taking down flagged accounts](../counters/C00189.md) | D6 Destroy | -| [C00197 remove suspicious accounts](../counters/C00197.md) | D2 Deny | +| [C00053 Delete old accounts / Remove unused social media accounts](../counters/C00053.md) | D04 | +| [C00098 Revocation of allowlisted or "verified" status](../counters/C00098.md) | D02 | +| [C00133 Deplatform Account*](../counters/C00133.md) | D03 | +| [C00153 Take pre-emptive action against actors' infrastructure](../counters/C00153.md) | D03 | +| [C00182 Redirection / malware detection/ remediation](../counters/C00182.md) | D02 | +| [C00189 Ensure that platforms are taking down flagged accounts](../counters/C00189.md) | D06 | +| [C00197 remove suspicious accounts](../counters/C00197.md) | D02 | DO NOT EDIT ABOVE THIS LINE - PLEASE ADD NOTES BELOW \ No newline at end of file diff --git a/techniques/T0012.md b/techniques/T0012.md index f74f829..51d178d 100644 --- a/techniques/T0012.md +++ b/techniques/T0012.md @@ -2,8 +2,6 @@ * **Summary**: Use anonymous social media profiles. Examples include page or group administrators, masked "whois" website directory data, no bylines connected to news article, no masthead connect to news websites. -Example is 2016 @TEN_GOP profile where the actual Tennessee Republican Party tried unsuccessfully for months to get Twitter to shut it down, and 2019 Endless Mayfly is an Iran-aligned network of inauthentic personas and social media accounts that spreads falsehoods and amplifies narratives critical of Saudi Arabia, the United States, and Israel. - * **Belongs to tactic stage**: TA04 @@ -14,11 +12,11 @@ Example is 2016 @TEN_GOP profile where the actual Tennessee Republican Party tri | Counters | Response types | | -------- | -------------- | -| [C00034 Create more friction at account creation](../counters/C00034.md) | D4 Degrade | -| [C00036 Infiltrate the in-group to discredit leaders (divide)](../counters/C00036.md) | D2 Deny | -| [C00040 third party verification for people](../counters/C00040.md) | D2 Deny | -| [C00051 Counter social engineering training](../counters/C00051.md) | D2 Deny | -| [C00052 Infiltrate platforms](../counters/C00052.md) | D4 Degrade | +| [C00034 Create more friction at account creation](../counters/C00034.md) | D04 | +| [C00036 Infiltrate the in-group to discredit leaders (divide)](../counters/C00036.md) | D02 | +| [C00040 third party verification for people](../counters/C00040.md) | D02 | +| [C00051 Counter social engineering training](../counters/C00051.md) | D02 | +| [C00052 Infiltrate platforms](../counters/C00052.md) | D04 | DO NOT EDIT ABOVE THIS LINE - PLEASE ADD NOTES BELOW \ No newline at end of file diff --git a/techniques/T0013.md b/techniques/T0013.md index c16a72e..68efd45 100644 --- a/techniques/T0013.md +++ b/techniques/T0013.md @@ -12,15 +12,15 @@ | Counters | Response types | | -------- | -------------- | -| [C00008 Create shared fact-checking database](../counters/C00008.md) | D4 Degrade | -| [C00011 Media literacy. Games to identify fake news](../counters/C00011.md) | D2 Deny | -| [C00012 Platform regulation](../counters/C00012.md) | D2 Deny | -| [C00014 Real-time updates to fact-checking database](../counters/C00014.md) | D4 Degrade | -| [C00016 Censorship](../counters/C00016.md) | D2 Deny | -| [C00107 Content moderation](../counters/C00107.md) | D2 Deny | -| [C00153 Take pre-emptive action against actors' infrastructure](../counters/C00153.md) | D3 Disrupt | -| [C00172 social media source removal](../counters/C00172.md) | D2 Deny | -| [C00176 Improve Coordination amongst stakeholders: public and private](../counters/C00176.md) | D7 Deter | +| [C00008 Create shared fact-checking database](../counters/C00008.md) | D04 | +| [C00011 Media literacy. Games to identify fake news](../counters/C00011.md) | D02 | +| [C00012 Platform regulation](../counters/C00012.md) | D02 | +| [C00014 Real-time updates to fact-checking database](../counters/C00014.md) | D04 | +| [C00016 Censorship](../counters/C00016.md) | D02 | +| [C00107 Content moderation](../counters/C00107.md) | D02 | +| [C00153 Take pre-emptive action against actors' infrastructure](../counters/C00153.md) | D03 | +| [C00172 social media source removal](../counters/C00172.md) | D02 | +| [C00176 Improve Coordination amongst stakeholders: public and private](../counters/C00176.md) | D07 | DO NOT EDIT ABOVE THIS LINE - PLEASE ADD NOTES BELOW \ No newline at end of file diff --git a/techniques/T0014.md b/techniques/T0014.md index 0b534dc..af2ecde 100644 --- a/techniques/T0014.md +++ b/techniques/T0014.md @@ -1,6 +1,6 @@ # Technique T0014: Create funding campaigns -* **Summary**: Generate revenue through online funding campaigns. e.g. Gather data, advance credible persona via Gofundme; Patreon; or via fake website connecting via PayPal or Stripe. (Example 2016) #VaccinateUS Gofundme campaigns to pay for Targetted facebook ads (Larry Cook, targetting Washington State mothers, $1,776 to boost posts over 9 months). +* **Summary**: Generate revenue through online funding campaigns. e.g. Gather data, advance credible persona via Gofundme; Patreon; or via fake website connecting via PayPal or Stripe. * **Belongs to tactic stage**: TA04 @@ -12,20 +12,20 @@ | Counters | Response types | | -------- | -------------- | -| [C00008 Create shared fact-checking database](../counters/C00008.md) | D4 Degrade | -| [C00012 Platform regulation](../counters/C00012.md) | D2 Deny | -| [C00014 Real-time updates to fact-checking database](../counters/C00014.md) | D4 Degrade | -| [C00016 Censorship](../counters/C00016.md) | D2 Deny | -| [C00059 Verification of project before posting fund requests](../counters/C00059.md) | D2 Deny | -| [C00070 Block access to disinformation resources](../counters/C00070.md) | D2 Deny | -| [C00107 Content moderation](../counters/C00107.md) | D2 Deny | -| [C00122 Content moderation](../counters/C00122.md) | D2 Deny | -| [C00129 Use banking to cut off access ](../counters/C00129.md) | D2 Deny | -| [C00153 Take pre-emptive action against actors' infrastructure](../counters/C00153.md) | D3 Disrupt | -| [C00155 Ban incident actors from funding sites](../counters/C00155.md) | D2 Deny | -| [C00176 Improve Coordination amongst stakeholders: public and private](../counters/C00176.md) | D7 Deter | -| [C00189 Ensure that platforms are taking down flagged accounts](../counters/C00189.md) | D6 Destroy | -| [C00216 Use advertiser controls to stem flow of funds to bad actors](../counters/C00216.md) | D2 Deny | +| [C00008 Create shared fact-checking database](../counters/C00008.md) | D04 | +| [C00012 Platform regulation](../counters/C00012.md) | D02 | +| [C00014 Real-time updates to fact-checking database](../counters/C00014.md) | D04 | +| [C00016 Censorship](../counters/C00016.md) | D02 | +| [C00059 Verification of project before posting fund requests](../counters/C00059.md) | D02 | +| [C00070 Block access to disinformation resources](../counters/C00070.md) | D02 | +| [C00107 Content moderation](../counters/C00107.md) | D02 | +| [C00122 Content moderation](../counters/C00122.md) | D02 | +| [C00129 Use banking to cut off access ](../counters/C00129.md) | D02 | +| [C00153 Take pre-emptive action against actors' infrastructure](../counters/C00153.md) | D03 | +| [C00155 Ban incident actors from funding sites](../counters/C00155.md) | D02 | +| [C00176 Improve Coordination amongst stakeholders: public and private](../counters/C00176.md) | D07 | +| [C00189 Ensure that platforms are taking down flagged accounts](../counters/C00189.md) | D06 | +| [C00216 Use advertiser controls to stem flow of funds to bad actors](../counters/C00216.md) | D02 | DO NOT EDIT ABOVE THIS LINE - PLEASE ADD NOTES BELOW \ No newline at end of file diff --git a/techniques/T0015.md b/techniques/T0015.md index 21b38cc..1c5d7b5 100644 --- a/techniques/T0015.md +++ b/techniques/T0015.md @@ -1,6 +1,6 @@ # Technique T0015: Create hashtag -* **Summary**: Many incident-based campaigns will create a hashtag to promote their fabricated event (e.g. #ColumbianChemicals to promote a fake story about a chemical spill in Louisiana). +* **Summary**: Many incident-based campaigns will create a hashtag to promote their fabricated event. Creating a hashtag for an incident can have two important effects: 1. Create a perception of reality around an event. Certainly only "real" events would be discussed in a hashtag. After all, the event has a name! @@ -19,14 +19,14 @@ Asset needed to direct/control/manage "conversation" connected to launching new | Counters | Response types | | -------- | -------------- | -| [C00006 Charge for social media](../counters/C00006.md) | D2 Deny | -| [C00012 Platform regulation](../counters/C00012.md) | D2 Deny | -| [C00016 Censorship](../counters/C00016.md) | D2 Deny | -| [C00066 Co-opt a hashtag and drown it out (hijack it back)](../counters/C00066.md) | D3 Disrupt | -| [C00070 Block access to disinformation resources](../counters/C00070.md) | D2 Deny | -| [C00107 Content moderation](../counters/C00107.md) | D2 Deny | -| [C00122 Content moderation](../counters/C00122.md) | D2 Deny | -| [C00176 Improve Coordination amongst stakeholders: public and private](../counters/C00176.md) | D7 Deter | +| [C00006 Charge for social media](../counters/C00006.md) | D02 | +| [C00012 Platform regulation](../counters/C00012.md) | D02 | +| [C00016 Censorship](../counters/C00016.md) | D02 | +| [C00066 Co-opt a hashtag and drown it out (hijack it back)](../counters/C00066.md) | D03 | +| [C00070 Block access to disinformation resources](../counters/C00070.md) | D02 | +| [C00107 Content moderation](../counters/C00107.md) | D02 | +| [C00122 Content moderation](../counters/C00122.md) | D02 | +| [C00176 Improve Coordination amongst stakeholders: public and private](../counters/C00176.md) | D07 | DO NOT EDIT ABOVE THIS LINE - PLEASE ADD NOTES BELOW \ No newline at end of file diff --git a/techniques/T0016.md b/techniques/T0016.md index 391f7b4..6d855be 100644 --- a/techniques/T0016.md +++ b/techniques/T0016.md @@ -1,6 +1,6 @@ # Technique T0016: Clickbait -* **Summary**: Create attention grabbing headlines (outrage, doubt, humor) required to drive traffic & engagement. (example 2016) “Pope Francis shocks world, endorses Donald Trump for president.” (example 2016) "FBI director received millions from Clinton Foundation, his brother’s law firm does Clinton’s taxes”. This is a key asset +* **Summary**: Create attention grabbing headlines (outrage, doubt, humor) required to drive traffic & engagement. This is a key asset * **Belongs to tactic stage**: TA05 @@ -13,19 +13,19 @@ | Counters | Response types | | -------- | -------------- | -| [C00012 Platform regulation](../counters/C00012.md) | D2 Deny | -| [C00016 Censorship](../counters/C00016.md) | D2 Deny | -| [C00073 Inoculate populations through media literacy training](../counters/C00073.md) | D2 Deny | -| [C00076 Prohibit images in political discourse channels](../counters/C00076.md) | D2 Deny | -| [C00105 Buy more advertising than misinformation creators](../counters/C00105.md) | D3 Disrupt | -| [C00106 Click-bait centrist content](../counters/C00106.md) | D3 Disrupt | -| [C00107 Content moderation](../counters/C00107.md) | D2 Deny | -| [C00122 Content moderation](../counters/C00122.md) | D2 Deny | -| [C00142 Platform adds warning label and decision point when sharing content](../counters/C00142.md) | D4 Degrade | -| [C00176 Improve Coordination amongst stakeholders: public and private](../counters/C00176.md) | D7 Deter | -| [C00178 Fill information voids with non-disinformation content](../counters/C00178.md) | D4 Degrade | -| [C00195 Redirect searches away from disinformation or extremist content ](../counters/C00195.md) | D2 Deny | -| [C00216 Use advertiser controls to stem flow of funds to bad actors](../counters/C00216.md) | D2 Deny | +| [C00012 Platform regulation](../counters/C00012.md) | D02 | +| [C00016 Censorship](../counters/C00016.md) | D02 | +| [C00073 Inoculate populations through media literacy training](../counters/C00073.md) | D02 | +| [C00076 Prohibit images in political discourse channels](../counters/C00076.md) | D02 | +| [C00105 Buy more advertising than misinformation creators](../counters/C00105.md) | D03 | +| [C00106 Click-bait centrist content](../counters/C00106.md) | D03 | +| [C00107 Content moderation](../counters/C00107.md) | D02 | +| [C00122 Content moderation](../counters/C00122.md) | D02 | +| [C00142 Platform adds warning label and decision point when sharing content](../counters/C00142.md) | D04 | +| [C00176 Improve Coordination amongst stakeholders: public and private](../counters/C00176.md) | D07 | +| [C00178 Fill information voids with non-disinformation content](../counters/C00178.md) | D04 | +| [C00195 Redirect searches away from disinformation or extremist content ](../counters/C00195.md) | D02 | +| [C00216 Use advertiser controls to stem flow of funds to bad actors](../counters/C00216.md) | D02 | DO NOT EDIT ABOVE THIS LINE - PLEASE ADD NOTES BELOW \ No newline at end of file diff --git a/techniques/T0017.md b/techniques/T0017.md index 74ccf54..7debd87 100644 --- a/techniques/T0017.md +++ b/techniques/T0017.md @@ -13,21 +13,21 @@ | Counters | Response types | | -------- | -------------- | -| [C00012 Platform regulation](../counters/C00012.md) | D2 Deny | -| [C00016 Censorship](../counters/C00016.md) | D2 Deny | -| [C00058 Report crowdfunder as violator](../counters/C00058.md) | D2 Deny | -| [C00067 Denigrate the recipient/ project (of online funding)](../counters/C00067.md) | D3 Disrupt | -| [C00070 Block access to disinformation resources](../counters/C00070.md) | D2 Deny | -| [C00085 Mute content](../counters/C00085.md) | D3 Disrupt | -| [C00093 Influencer code of conduct](../counters/C00093.md) | D7 Deter | -| [C00107 Content moderation](../counters/C00107.md) | D2 Deny | -| [C00122 Content moderation](../counters/C00122.md) | D2 Deny | -| [C00129 Use banking to cut off access ](../counters/C00129.md) | D2 Deny | -| [C00153 Take pre-emptive action against actors' infrastructure](../counters/C00153.md) | D3 Disrupt | -| [C00155 Ban incident actors from funding sites](../counters/C00155.md) | D2 Deny | -| [C00176 Improve Coordination amongst stakeholders: public and private](../counters/C00176.md) | D7 Deter | -| [C00178 Fill information voids with non-disinformation content](../counters/C00178.md) | D4 Degrade | -| [C00216 Use advertiser controls to stem flow of funds to bad actors](../counters/C00216.md) | D2 Deny | +| [C00012 Platform regulation](../counters/C00012.md) | D02 | +| [C00016 Censorship](../counters/C00016.md) | D02 | +| [C00058 Report crowdfunder as violator](../counters/C00058.md) | D02 | +| [C00067 Denigrate the recipient/ project (of online funding)](../counters/C00067.md) | D03 | +| [C00070 Block access to disinformation resources](../counters/C00070.md) | D02 | +| [C00085 Mute content](../counters/C00085.md) | D03 | +| [C00093 Influencer code of conduct](../counters/C00093.md) | D07 | +| [C00107 Content moderation](../counters/C00107.md) | D02 | +| [C00122 Content moderation](../counters/C00122.md) | D02 | +| [C00129 Use banking to cut off access ](../counters/C00129.md) | D02 | +| [C00153 Take pre-emptive action against actors' infrastructure](../counters/C00153.md) | D03 | +| [C00155 Ban incident actors from funding sites](../counters/C00155.md) | D02 | +| [C00176 Improve Coordination amongst stakeholders: public and private](../counters/C00176.md) | D07 | +| [C00178 Fill information voids with non-disinformation content](../counters/C00178.md) | D04 | +| [C00216 Use advertiser controls to stem flow of funds to bad actors](../counters/C00216.md) | D02 | DO NOT EDIT ABOVE THIS LINE - PLEASE ADD NOTES BELOW \ No newline at end of file diff --git a/techniques/T0018.md b/techniques/T0018.md index d5eddb0..296aa1b 100644 --- a/techniques/T0018.md +++ b/techniques/T0018.md @@ -15,21 +15,21 @@ | Counters | Response types | | -------- | -------------- | -| [C00006 Charge for social media](../counters/C00006.md) | D2 Deny | -| [C00010 Enhanced privacy regulation for social media](../counters/C00010.md) | D2 Deny | -| [C00012 Platform regulation](../counters/C00012.md) | D2 Deny | -| [C00016 Censorship](../counters/C00016.md) | D2 Deny | -| [C00065 Reduce political targeting](../counters/C00065.md) | D3 Disrupt | -| [C00076 Prohibit images in political discourse channels](../counters/C00076.md) | D2 Deny | -| [C00105 Buy more advertising than misinformation creators](../counters/C00105.md) | D3 Disrupt | -| [C00107 Content moderation](../counters/C00107.md) | D2 Deny | -| [C00122 Content moderation](../counters/C00122.md) | D2 Deny | -| [C00129 Use banking to cut off access ](../counters/C00129.md) | D2 Deny | -| [C00153 Take pre-emptive action against actors' infrastructure](../counters/C00153.md) | D3 Disrupt | -| [C00176 Improve Coordination amongst stakeholders: public and private](../counters/C00176.md) | D7 Deter | -| [C00178 Fill information voids with non-disinformation content](../counters/C00178.md) | D4 Degrade | -| [C00195 Redirect searches away from disinformation or extremist content ](../counters/C00195.md) | D2 Deny | -| [C00216 Use advertiser controls to stem flow of funds to bad actors](../counters/C00216.md) | D2 Deny | +| [C00006 Charge for social media](../counters/C00006.md) | D02 | +| [C00010 Enhanced privacy regulation for social media](../counters/C00010.md) | D02 | +| [C00012 Platform regulation](../counters/C00012.md) | D02 | +| [C00016 Censorship](../counters/C00016.md) | D02 | +| [C00065 Reduce political targeting](../counters/C00065.md) | D03 | +| [C00076 Prohibit images in political discourse channels](../counters/C00076.md) | D02 | +| [C00105 Buy more advertising than misinformation creators](../counters/C00105.md) | D03 | +| [C00107 Content moderation](../counters/C00107.md) | D02 | +| [C00122 Content moderation](../counters/C00122.md) | D02 | +| [C00129 Use banking to cut off access ](../counters/C00129.md) | D02 | +| [C00153 Take pre-emptive action against actors' infrastructure](../counters/C00153.md) | D03 | +| [C00176 Improve Coordination amongst stakeholders: public and private](../counters/C00176.md) | D07 | +| [C00178 Fill information voids with non-disinformation content](../counters/C00178.md) | D04 | +| [C00195 Redirect searches away from disinformation or extremist content ](../counters/C00195.md) | D02 | +| [C00216 Use advertiser controls to stem flow of funds to bad actors](../counters/C00216.md) | D02 | DO NOT EDIT ABOVE THIS LINE - PLEASE ADD NOTES BELOW \ No newline at end of file diff --git a/techniques/T0019.md b/techniques/T0019.md index bb47be4..2d2bfb7 100644 --- a/techniques/T0019.md +++ b/techniques/T0019.md @@ -24,11 +24,11 @@ | Counters | Response types | | -------- | -------------- | -| [C00042 Address truth contained in narratives](../counters/C00042.md) | D4 Degrade | -| [C00071 Block source of pollution](../counters/C00071.md) | D2 Deny | -| [C00072 Remove non-relevant content from special interest groups - not recommended](../counters/C00072.md) | D2 Deny | -| [C00073 Inoculate populations through media literacy training](../counters/C00073.md) | D2 Deny | -| [C00074 Identify and delete or rate limit identical content](../counters/C00074.md) | D2 Deny | +| [C00042 Address truth contained in narratives](../counters/C00042.md) | D04 | +| [C00071 Block source of pollution](../counters/C00071.md) | D02 | +| [C00072 Remove non-relevant content from special interest groups - not recommended](../counters/C00072.md) | D02 | +| [C00073 Inoculate populations through media literacy training](../counters/C00073.md) | D02 | +| [C00074 Identify and delete or rate limit identical content](../counters/C00074.md) | D02 | DO NOT EDIT ABOVE THIS LINE - PLEASE ADD NOTES BELOW \ No newline at end of file diff --git a/techniques/T0020.md b/techniques/T0020.md index 34b1b80..5dd0376 100644 --- a/techniques/T0020.md +++ b/techniques/T0020.md @@ -16,11 +16,11 @@ | Counters | Response types | | -------- | -------------- | -| [C00090 Fake engagement system](../counters/C00090.md) | D5 Deceive | -| [C00136 Microtarget most likely targets then send them countermessages](../counters/C00136.md) | D3 Disrupt | -| [C00149 Poison the monitoring & evaluation data](../counters/C00149.md) | D4 Degrade | -| [C00178 Fill information voids with non-disinformation content](../counters/C00178.md) | D4 Degrade | -| [C00211 Use humorous counter-narratives](../counters/C00211.md) | D3 Disrupt | +| [C00090 Fake engagement system](../counters/C00090.md) | D05 | +| [C00136 Microtarget most likely targets then send them countermessages](../counters/C00136.md) | D03 | +| [C00149 Poison the monitoring & evaluation data](../counters/C00149.md) | D04 | +| [C00178 Fill information voids with non-disinformation content](../counters/C00178.md) | D04 | +| [C00211 Use humorous counter-narratives](../counters/C00211.md) | D03 | DO NOT EDIT ABOVE THIS LINE - PLEASE ADD NOTES BELOW \ No newline at end of file diff --git a/techniques/T0021.md b/techniques/T0021.md index db3b6b2..b872962 100644 --- a/techniques/T0021.md +++ b/techniques/T0021.md @@ -16,25 +16,25 @@ | Counters | Response types | | -------- | -------------- | -| [C00008 Create shared fact-checking database](../counters/C00008.md) | D4 Degrade | -| [C00011 Media literacy. Games to identify fake news](../counters/C00011.md) | D2 Deny | -| [C00012 Platform regulation](../counters/C00012.md) | D2 Deny | -| [C00014 Real-time updates to fact-checking database](../counters/C00014.md) | D4 Degrade | -| [C00016 Censorship](../counters/C00016.md) | D2 Deny | -| [C00027 Create culture of civility](../counters/C00027.md) | D7 Deter | -| [C00046 Marginalise and discredit extremist groups](../counters/C00046.md) | D4 Degrade | -| [C00072 Remove non-relevant content from special interest groups - not recommended](../counters/C00072.md) | D2 Deny | -| [C00073 Inoculate populations through media literacy training](../counters/C00073.md) | D2 Deny | -| [C00074 Identify and delete or rate limit identical content](../counters/C00074.md) | D2 Deny | -| [C00076 Prohibit images in political discourse channels](../counters/C00076.md) | D2 Deny | -| [C00085 Mute content](../counters/C00085.md) | D3 Disrupt | -| [C00107 Content moderation](../counters/C00107.md) | D2 Deny | -| [C00117 Downgrade / de-amplify so message is seen by fewer people](../counters/C00117.md) | D4 Degrade | -| [C00118 Repurpose images with new text](../counters/C00118.md) | D4 Degrade | -| [C00119 Engage payload and debunk.](../counters/C00119.md) | D7 Deter | -| [C00122 Content moderation](../counters/C00122.md) | D2 Deny | -| [C00176 Improve Coordination amongst stakeholders: public and private](../counters/C00176.md) | D7 Deter | -| [C00211 Use humorous counter-narratives](../counters/C00211.md) | D3 Disrupt | +| [C00008 Create shared fact-checking database](../counters/C00008.md) | D04 | +| [C00011 Media literacy. Games to identify fake news](../counters/C00011.md) | D02 | +| [C00012 Platform regulation](../counters/C00012.md) | D02 | +| [C00014 Real-time updates to fact-checking database](../counters/C00014.md) | D04 | +| [C00016 Censorship](../counters/C00016.md) | D02 | +| [C00027 Create culture of civility](../counters/C00027.md) | D07 | +| [C00046 Marginalise and discredit extremist groups](../counters/C00046.md) | D04 | +| [C00072 Remove non-relevant content from special interest groups - not recommended](../counters/C00072.md) | D02 | +| [C00073 Inoculate populations through media literacy training](../counters/C00073.md) | D02 | +| [C00074 Identify and delete or rate limit identical content](../counters/C00074.md) | D02 | +| [C00076 Prohibit images in political discourse channels](../counters/C00076.md) | D02 | +| [C00085 Mute content](../counters/C00085.md) | D03 | +| [C00107 Content moderation](../counters/C00107.md) | D02 | +| [C00117 Downgrade / de-amplify so message is seen by fewer people](../counters/C00117.md) | D04 | +| [C00118 Repurpose images with new text](../counters/C00118.md) | D04 | +| [C00119 Engage payload and debunk.](../counters/C00119.md) | D07 | +| [C00122 Content moderation](../counters/C00122.md) | D02 | +| [C00176 Improve Coordination amongst stakeholders: public and private](../counters/C00176.md) | D07 | +| [C00211 Use humorous counter-narratives](../counters/C00211.md) | D03 | DO NOT EDIT ABOVE THIS LINE - PLEASE ADD NOTES BELOW \ No newline at end of file diff --git a/techniques/T0022.md b/techniques/T0022.md index 0172e38..e5ef715 100644 --- a/techniques/T0022.md +++ b/techniques/T0022.md @@ -2,8 +2,6 @@ * **Summary**: "Conspiracy narratives appeal to the human desire for explanatory order, by invoking the participation of poweful (often sinister) actors in pursuit of their own political goals. These narratives are especially appealing when an audience is low-information, marginalized or otherwise inclined to reject the prevailing explanation. Conspiracy narratives are an important component of the ""firehose of falsehoods"" model. -Example: QAnon: conspiracy theory is an explanation of an event or situation that invokes a conspiracy by sinister and powerful actors, often political in motivation, when other explanations are more probable " - * **Belongs to tactic stage**: TA06 @@ -15,48 +13,48 @@ Example: QAnon: conspiracy theory is an explanation of an event or situation tha | Counters | Response types | | -------- | -------------- | -| [C00012 Platform regulation](../counters/C00012.md) | D2 Deny | -| [C00016 Censorship](../counters/C00016.md) | D2 Deny | -| [C00017 Repair broken social connections](../counters/C00017.md) | D3 Disrupt | -| [C00019 Reduce effect of division-enablers](../counters/C00019.md) | D3 Disrupt | -| [C00021 Encourage in-person communication](../counters/C00021.md) | D4 Degrade | -| [C00022 Innoculate. Positive campaign to promote feeling of safety](../counters/C00022.md) | D4 Degrade | -| [C00024 Promote healthy narratives](../counters/C00024.md) | D4 Degrade | -| [C00027 Create culture of civility](../counters/C00027.md) | D7 Deter | -| [C00029 Create fake website to issue counter narrative and counter narrative through physical merchandise](../counters/C00029.md) | D3 Disrupt | -| [C00030 Develop a compelling counter narrative (truth based)](../counters/C00030.md) | D3 Disrupt | -| [C00042 Address truth contained in narratives](../counters/C00042.md) | D4 Degrade | -| [C00046 Marginalise and discredit extremist groups](../counters/C00046.md) | D4 Degrade | -| [C00072 Remove non-relevant content from special interest groups - not recommended](../counters/C00072.md) | D2 Deny | -| [C00073 Inoculate populations through media literacy training](../counters/C00073.md) | D2 Deny | -| [C00074 Identify and delete or rate limit identical content](../counters/C00074.md) | D2 Deny | -| [C00080 Create competing narrative](../counters/C00080.md) | D3 Disrupt | -| [C00081 Highlight flooding and noise, and explain motivations](../counters/C00081.md) | D3 Disrupt | -| [C00082 Ground truthing as automated response to pollution](../counters/C00082.md) | D3 Disrupt | -| [C00084 Modify disinformation narratives, and rebroadcast them](../counters/C00084.md) | D3 Disrupt | -| [C00085 Mute content](../counters/C00085.md) | D3 Disrupt | -| [C00096 Strengthen institutions that are always truth tellers](../counters/C00096.md) | D7 Deter | -| [C00107 Content moderation](../counters/C00107.md) | D2 Deny | -| [C00117 Downgrade / de-amplify so message is seen by fewer people](../counters/C00117.md) | D4 Degrade | -| [C00119 Engage payload and debunk.](../counters/C00119.md) | D7 Deter | -| [C00122 Content moderation](../counters/C00122.md) | D2 Deny | -| [C00125 Prebunking](../counters/C00125.md) | D3 Disrupt | -| [C00126 Social media amber alert](../counters/C00126.md) | D3 Disrupt | -| [C00156 Better tell your country or organization story](../counters/C00156.md) | D3 Disrupt | -| [C00161 Coalition Building with stakeholders and Third-Party Inducements](../counters/C00161.md) | D7 Deter | -| [C00162 Unravel/target the Potemkin villages](../counters/C00162.md) | D3 Disrupt | -| [C00164 compatriot policy](../counters/C00164.md) | D3 Disrupt | -| [C00169 develop a creative content hub](../counters/C00169.md) | D3 Disrupt | -| [C00174 Create a healthier news environment](../counters/C00174.md) | D2 Deny | -| [C00176 Improve Coordination amongst stakeholders: public and private](../counters/C00176.md) | D7 Deter | -| [C00188 Newsroom/Journalist training to counter influence moves](../counters/C00188.md) | D3 Disrupt | -| [C00190 open engagement with civil society](../counters/C00190.md) | D3 Disrupt | -| [C00195 Redirect searches away from disinformation or extremist content ](../counters/C00195.md) | D2 Deny | -| [C00200 Respected figure (influencer) disavows misinfo](../counters/C00200.md) | D3 Disrupt | -| [C00203 Stop offering press credentials to propaganda outlets](../counters/C00203.md) | D3 Disrupt | -| [C00205 strong dialogue between the federal government and private sector to encourage better reporting](../counters/C00205.md) | D3 Disrupt | -| [C00211 Use humorous counter-narratives](../counters/C00211.md) | D3 Disrupt | -| [C00212 build public resilience by making civil society more vibrant](../counters/C00212.md) | D3 Disrupt | +| [C00012 Platform regulation](../counters/C00012.md) | D02 | +| [C00016 Censorship](../counters/C00016.md) | D02 | +| [C00017 Repair broken social connections](../counters/C00017.md) | D03 | +| [C00019 Reduce effect of division-enablers](../counters/C00019.md) | D03 | +| [C00021 Encourage in-person communication](../counters/C00021.md) | D04 | +| [C00022 Innoculate. Positive campaign to promote feeling of safety](../counters/C00022.md) | D04 | +| [C00024 Promote healthy narratives](../counters/C00024.md) | D04 | +| [C00027 Create culture of civility](../counters/C00027.md) | D07 | +| [C00029 Create fake website to issue counter narrative and counter narrative through physical merchandise](../counters/C00029.md) | D03 | +| [C00030 Develop a compelling counter narrative (truth based)](../counters/C00030.md) | D03 | +| [C00042 Address truth contained in narratives](../counters/C00042.md) | D04 | +| [C00046 Marginalise and discredit extremist groups](../counters/C00046.md) | D04 | +| [C00072 Remove non-relevant content from special interest groups - not recommended](../counters/C00072.md) | D02 | +| [C00073 Inoculate populations through media literacy training](../counters/C00073.md) | D02 | +| [C00074 Identify and delete or rate limit identical content](../counters/C00074.md) | D02 | +| [C00080 Create competing narrative](../counters/C00080.md) | D03 | +| [C00081 Highlight flooding and noise, and explain motivations](../counters/C00081.md) | D03 | +| [C00082 Ground truthing as automated response to pollution](../counters/C00082.md) | D03 | +| [C00084 Modify disinformation narratives, and rebroadcast them](../counters/C00084.md) | D03 | +| [C00085 Mute content](../counters/C00085.md) | D03 | +| [C00096 Strengthen institutions that are always truth tellers](../counters/C00096.md) | D07 | +| [C00107 Content moderation](../counters/C00107.md) | D02 | +| [C00117 Downgrade / de-amplify so message is seen by fewer people](../counters/C00117.md) | D04 | +| [C00119 Engage payload and debunk.](../counters/C00119.md) | D07 | +| [C00122 Content moderation](../counters/C00122.md) | D02 | +| [C00125 Prebunking](../counters/C00125.md) | D03 | +| [C00126 Social media amber alert](../counters/C00126.md) | D03 | +| [C00156 Better tell your country or organization story](../counters/C00156.md) | D03 | +| [C00161 Coalition Building with stakeholders and Third-Party Inducements](../counters/C00161.md) | D07 | +| [C00162 Unravel/target the Potemkin villages](../counters/C00162.md) | D03 | +| [C00164 compatriot policy](../counters/C00164.md) | D03 | +| [C00169 develop a creative content hub](../counters/C00169.md) | D03 | +| [C00174 Create a healthier news environment](../counters/C00174.md) | D02 | +| [C00176 Improve Coordination amongst stakeholders: public and private](../counters/C00176.md) | D07 | +| [C00188 Newsroom/Journalist training to counter influence moves](../counters/C00188.md) | D03 | +| [C00190 open engagement with civil society](../counters/C00190.md) | D03 | +| [C00195 Redirect searches away from disinformation or extremist content ](../counters/C00195.md) | D02 | +| [C00200 Respected figure (influencer) disavows misinfo](../counters/C00200.md) | D03 | +| [C00203 Stop offering press credentials to propaganda outlets](../counters/C00203.md) | D03 | +| [C00205 strong dialogue between the federal government and private sector to encourage better reporting](../counters/C00205.md) | D03 | +| [C00211 Use humorous counter-narratives](../counters/C00211.md) | D03 | +| [C00212 build public resilience by making civil society more vibrant](../counters/C00212.md) | D03 | DO NOT EDIT ABOVE THIS LINE - PLEASE ADD NOTES BELOW \ No newline at end of file diff --git a/techniques/T0023.md b/techniques/T0023.md index 0fdd731..41b167b 100644 --- a/techniques/T0023.md +++ b/techniques/T0023.md @@ -14,19 +14,19 @@ | Counters | Response types | | -------- | -------------- | -| [C00017 Repair broken social connections](../counters/C00017.md) | D3 Disrupt | -| [C00019 Reduce effect of division-enablers](../counters/C00019.md) | D3 Disrupt | -| [C00021 Encourage in-person communication](../counters/C00021.md) | D4 Degrade | -| [C00022 Innoculate. Positive campaign to promote feeling of safety](../counters/C00022.md) | D4 Degrade | -| [C00024 Promote healthy narratives](../counters/C00024.md) | D4 Degrade | -| [C00027 Create culture of civility](../counters/C00027.md) | D7 Deter | -| [C00046 Marginalise and discredit extremist groups](../counters/C00046.md) | D4 Degrade | -| [C00072 Remove non-relevant content from special interest groups - not recommended](../counters/C00072.md) | D2 Deny | -| [C00073 Inoculate populations through media literacy training](../counters/C00073.md) | D2 Deny | -| [C00081 Highlight flooding and noise, and explain motivations](../counters/C00081.md) | D3 Disrupt | -| [C00082 Ground truthing as automated response to pollution](../counters/C00082.md) | D3 Disrupt | -| [C00092 Establish a truth teller reputation score for influencers](../counters/C00092.md) | D7 Deter | -| [C00096 Strengthen institutions that are always truth tellers](../counters/C00096.md) | D7 Deter | +| [C00017 Repair broken social connections](../counters/C00017.md) | D03 | +| [C00019 Reduce effect of division-enablers](../counters/C00019.md) | D03 | +| [C00021 Encourage in-person communication](../counters/C00021.md) | D04 | +| [C00022 Innoculate. Positive campaign to promote feeling of safety](../counters/C00022.md) | D04 | +| [C00024 Promote healthy narratives](../counters/C00024.md) | D04 | +| [C00027 Create culture of civility](../counters/C00027.md) | D07 | +| [C00046 Marginalise and discredit extremist groups](../counters/C00046.md) | D04 | +| [C00072 Remove non-relevant content from special interest groups - not recommended](../counters/C00072.md) | D02 | +| [C00073 Inoculate populations through media literacy training](../counters/C00073.md) | D02 | +| [C00081 Highlight flooding and noise, and explain motivations](../counters/C00081.md) | D03 | +| [C00082 Ground truthing as automated response to pollution](../counters/C00082.md) | D03 | +| [C00092 Establish a truth teller reputation score for influencers](../counters/C00092.md) | D07 | +| [C00096 Strengthen institutions that are always truth tellers](../counters/C00096.md) | D07 | DO NOT EDIT ABOVE THIS LINE - PLEASE ADD NOTES BELOW \ No newline at end of file diff --git a/techniques/T0024.md b/techniques/T0024.md index ffc2c8a..3d33b16 100644 --- a/techniques/T0024.md +++ b/techniques/T0024.md @@ -1,6 +1,6 @@ # Technique T0024: Create fake videos and images -* **Summary**: Create fake videos and/or images by manipulating existing content or generating new content (e.g. deepfakes). Examples include Pelosi video (making her appear drunk) and photoshoped shark on flooded streets of Houston TX. +* **Summary**: Create fake videos and/or images by manipulating existing content or generating new content (e.g. deepfakes). * **Belongs to tactic stage**: TA06 @@ -14,23 +14,23 @@ | Counters | Response types | | -------- | -------------- | -| [C00008 Create shared fact-checking database](../counters/C00008.md) | D4 Degrade | -| [C00011 Media literacy. Games to identify fake news](../counters/C00011.md) | D2 Deny | -| [C00012 Platform regulation](../counters/C00012.md) | D2 Deny | -| [C00014 Real-time updates to fact-checking database](../counters/C00014.md) | D4 Degrade | -| [C00016 Censorship](../counters/C00016.md) | D2 Deny | -| [C00085 Mute content](../counters/C00085.md) | D3 Disrupt | -| [C00096 Strengthen institutions that are always truth tellers](../counters/C00096.md) | D7 Deter | -| [C00107 Content moderation](../counters/C00107.md) | D2 Deny | -| [C00117 Downgrade / de-amplify so message is seen by fewer people](../counters/C00117.md) | D4 Degrade | -| [C00118 Repurpose images with new text](../counters/C00118.md) | D4 Degrade | -| [C00119 Engage payload and debunk.](../counters/C00119.md) | D7 Deter | -| [C00122 Content moderation](../counters/C00122.md) | D2 Deny | -| [C00143 (botnet) DMCA takedown requests to waste group time](../counters/C00143.md) | D4 Degrade | -| [C00176 Improve Coordination amongst stakeholders: public and private](../counters/C00176.md) | D7 Deter | -| [C00195 Redirect searches away from disinformation or extremist content ](../counters/C00195.md) | D2 Deny | -| [C00211 Use humorous counter-narratives](../counters/C00211.md) | D3 Disrupt | -| [C00219 Add metadata to content that’s out of the control of disinformation creators](../counters/C00219.md) | D4 Degrade | +| [C00008 Create shared fact-checking database](../counters/C00008.md) | D04 | +| [C00011 Media literacy. Games to identify fake news](../counters/C00011.md) | D02 | +| [C00012 Platform regulation](../counters/C00012.md) | D02 | +| [C00014 Real-time updates to fact-checking database](../counters/C00014.md) | D04 | +| [C00016 Censorship](../counters/C00016.md) | D02 | +| [C00085 Mute content](../counters/C00085.md) | D03 | +| [C00096 Strengthen institutions that are always truth tellers](../counters/C00096.md) | D07 | +| [C00107 Content moderation](../counters/C00107.md) | D02 | +| [C00117 Downgrade / de-amplify so message is seen by fewer people](../counters/C00117.md) | D04 | +| [C00118 Repurpose images with new text](../counters/C00118.md) | D04 | +| [C00119 Engage payload and debunk.](../counters/C00119.md) | D07 | +| [C00122 Content moderation](../counters/C00122.md) | D02 | +| [C00143 (botnet) DMCA takedown requests to waste group time](../counters/C00143.md) | D04 | +| [C00176 Improve Coordination amongst stakeholders: public and private](../counters/C00176.md) | D07 | +| [C00195 Redirect searches away from disinformation or extremist content ](../counters/C00195.md) | D02 | +| [C00211 Use humorous counter-narratives](../counters/C00211.md) | D03 | +| [C00219 Add metadata to content that’s out of the control of disinformation creators](../counters/C00219.md) | D04 | DO NOT EDIT ABOVE THIS LINE - PLEASE ADD NOTES BELOW \ No newline at end of file diff --git a/techniques/T0025.md b/techniques/T0025.md index bd765e8..9b2491b 100644 --- a/techniques/T0025.md +++ b/techniques/T0025.md @@ -2,8 +2,6 @@ * **Summary**: Obtain documents (eg by theft or leak), then alter and release, possibly among factual documents/sources. -Example (2019) DFRLab report "Secondary Infektion” highlights incident with key asset being a forged “letter” created by the operation to provide ammunition for far-right forces in Europe ahead of the election. - * **Belongs to tactic stage**: TA06 @@ -18,29 +16,29 @@ Example (2019) DFRLab report "Secondary Infektion” highlights incident with ke | Counters | Response types | | -------- | -------------- | -| [C00008 Create shared fact-checking database](../counters/C00008.md) | D4 Degrade | -| [C00011 Media literacy. Games to identify fake news](../counters/C00011.md) | D2 Deny | -| [C00012 Platform regulation](../counters/C00012.md) | D2 Deny | -| [C00014 Real-time updates to fact-checking database](../counters/C00014.md) | D4 Degrade | -| [C00016 Censorship](../counters/C00016.md) | D2 Deny | -| [C00073 Inoculate populations through media literacy training](../counters/C00073.md) | D2 Deny | -| [C00074 Identify and delete or rate limit identical content](../counters/C00074.md) | D2 Deny | -| [C00082 Ground truthing as automated response to pollution](../counters/C00082.md) | D3 Disrupt | -| [C00085 Mute content](../counters/C00085.md) | D3 Disrupt | -| [C00096 Strengthen institutions that are always truth tellers](../counters/C00096.md) | D7 Deter | -| [C00107 Content moderation](../counters/C00107.md) | D2 Deny | -| [C00117 Downgrade / de-amplify so message is seen by fewer people](../counters/C00117.md) | D4 Degrade | -| [C00119 Engage payload and debunk.](../counters/C00119.md) | D7 Deter | -| [C00122 Content moderation](../counters/C00122.md) | D2 Deny | -| [C00165 Ensure integrity of official documents](../counters/C00165.md) | D2 Deny | -| [C00176 Improve Coordination amongst stakeholders: public and private](../counters/C00176.md) | D7 Deter | -| [C00190 open engagement with civil society](../counters/C00190.md) | D3 Disrupt | -| [C00195 Redirect searches away from disinformation or extremist content ](../counters/C00195.md) | D2 Deny | -| [C00200 Respected figure (influencer) disavows misinfo](../counters/C00200.md) | D3 Disrupt | -| [C00202 Set data 'honeytraps'](../counters/C00202.md) | D2 Deny | -| [C00205 strong dialogue between the federal government and private sector to encourage better reporting](../counters/C00205.md) | D3 Disrupt | -| [C00211 Use humorous counter-narratives](../counters/C00211.md) | D3 Disrupt | -| [C00219 Add metadata to content that’s out of the control of disinformation creators](../counters/C00219.md) | D4 Degrade | +| [C00008 Create shared fact-checking database](../counters/C00008.md) | D04 | +| [C00011 Media literacy. Games to identify fake news](../counters/C00011.md) | D02 | +| [C00012 Platform regulation](../counters/C00012.md) | D02 | +| [C00014 Real-time updates to fact-checking database](../counters/C00014.md) | D04 | +| [C00016 Censorship](../counters/C00016.md) | D02 | +| [C00073 Inoculate populations through media literacy training](../counters/C00073.md) | D02 | +| [C00074 Identify and delete or rate limit identical content](../counters/C00074.md) | D02 | +| [C00082 Ground truthing as automated response to pollution](../counters/C00082.md) | D03 | +| [C00085 Mute content](../counters/C00085.md) | D03 | +| [C00096 Strengthen institutions that are always truth tellers](../counters/C00096.md) | D07 | +| [C00107 Content moderation](../counters/C00107.md) | D02 | +| [C00117 Downgrade / de-amplify so message is seen by fewer people](../counters/C00117.md) | D04 | +| [C00119 Engage payload and debunk.](../counters/C00119.md) | D07 | +| [C00122 Content moderation](../counters/C00122.md) | D02 | +| [C00165 Ensure integrity of official documents](../counters/C00165.md) | D02 | +| [C00176 Improve Coordination amongst stakeholders: public and private](../counters/C00176.md) | D07 | +| [C00190 open engagement with civil society](../counters/C00190.md) | D03 | +| [C00195 Redirect searches away from disinformation or extremist content ](../counters/C00195.md) | D02 | +| [C00200 Respected figure (influencer) disavows misinfo](../counters/C00200.md) | D03 | +| [C00202 Set data 'honeytraps'](../counters/C00202.md) | D02 | +| [C00205 strong dialogue between the federal government and private sector to encourage better reporting](../counters/C00205.md) | D03 | +| [C00211 Use humorous counter-narratives](../counters/C00211.md) | D03 | +| [C00219 Add metadata to content that’s out of the control of disinformation creators](../counters/C00219.md) | D04 | DO NOT EDIT ABOVE THIS LINE - PLEASE ADD NOTES BELOW \ No newline at end of file diff --git a/techniques/T0026.md b/techniques/T0026.md index e64633e..f8c6b5e 100644 --- a/techniques/T0026.md +++ b/techniques/T0026.md @@ -12,27 +12,27 @@ | Counters | Response types | | -------- | -------------- | -| [C00008 Create shared fact-checking database](../counters/C00008.md) | D4 Degrade | -| [C00011 Media literacy. Games to identify fake news](../counters/C00011.md) | D2 Deny | -| [C00012 Platform regulation](../counters/C00012.md) | D2 Deny | -| [C00014 Real-time updates to fact-checking database](../counters/C00014.md) | D4 Degrade | -| [C00016 Censorship](../counters/C00016.md) | D2 Deny | -| [C00073 Inoculate populations through media literacy training](../counters/C00073.md) | D2 Deny | -| [C00074 Identify and delete or rate limit identical content](../counters/C00074.md) | D2 Deny | -| [C00081 Highlight flooding and noise, and explain motivations](../counters/C00081.md) | D3 Disrupt | -| [C00082 Ground truthing as automated response to pollution](../counters/C00082.md) | D3 Disrupt | -| [C00085 Mute content](../counters/C00085.md) | D3 Disrupt | -| [C00094 Force full disclosure on corporate sponsor of research](../counters/C00094.md) | D4 Degrade | -| [C00096 Strengthen institutions that are always truth tellers](../counters/C00096.md) | D7 Deter | -| [C00107 Content moderation](../counters/C00107.md) | D2 Deny | -| [C00117 Downgrade / de-amplify so message is seen by fewer people](../counters/C00117.md) | D4 Degrade | -| [C00119 Engage payload and debunk.](../counters/C00119.md) | D7 Deter | -| [C00122 Content moderation](../counters/C00122.md) | D2 Deny | -| [C00176 Improve Coordination amongst stakeholders: public and private](../counters/C00176.md) | D7 Deter | -| [C00195 Redirect searches away from disinformation or extremist content ](../counters/C00195.md) | D2 Deny | -| [C00211 Use humorous counter-narratives](../counters/C00211.md) | D3 Disrupt | -| [C00211 Use humorous counter-narratives](../counters/C00211.md) | D3 Disrupt | -| [C00219 Add metadata to content that’s out of the control of disinformation creators](../counters/C00219.md) | D4 Degrade | +| [C00008 Create shared fact-checking database](../counters/C00008.md) | D04 | +| [C00011 Media literacy. Games to identify fake news](../counters/C00011.md) | D02 | +| [C00012 Platform regulation](../counters/C00012.md) | D02 | +| [C00014 Real-time updates to fact-checking database](../counters/C00014.md) | D04 | +| [C00016 Censorship](../counters/C00016.md) | D02 | +| [C00073 Inoculate populations through media literacy training](../counters/C00073.md) | D02 | +| [C00074 Identify and delete or rate limit identical content](../counters/C00074.md) | D02 | +| [C00081 Highlight flooding and noise, and explain motivations](../counters/C00081.md) | D03 | +| [C00082 Ground truthing as automated response to pollution](../counters/C00082.md) | D03 | +| [C00085 Mute content](../counters/C00085.md) | D03 | +| [C00094 Force full disclosure on corporate sponsor of research](../counters/C00094.md) | D04 | +| [C00096 Strengthen institutions that are always truth tellers](../counters/C00096.md) | D07 | +| [C00107 Content moderation](../counters/C00107.md) | D02 | +| [C00117 Downgrade / de-amplify so message is seen by fewer people](../counters/C00117.md) | D04 | +| [C00119 Engage payload and debunk.](../counters/C00119.md) | D07 | +| [C00122 Content moderation](../counters/C00122.md) | D02 | +| [C00176 Improve Coordination amongst stakeholders: public and private](../counters/C00176.md) | D07 | +| [C00195 Redirect searches away from disinformation or extremist content ](../counters/C00195.md) | D02 | +| [C00211 Use humorous counter-narratives](../counters/C00211.md) | D03 | +| [C00211 Use humorous counter-narratives](../counters/C00211.md) | D03 | +| [C00219 Add metadata to content that’s out of the control of disinformation creators](../counters/C00219.md) | D04 | DO NOT EDIT ABOVE THIS LINE - PLEASE ADD NOTES BELOW \ No newline at end of file diff --git a/techniques/T0027.md b/techniques/T0027.md index ea63ec8..dd46bc5 100644 --- a/techniques/T0027.md +++ b/techniques/T0027.md @@ -12,46 +12,46 @@ | Counters | Response types | | -------- | -------------- | -| [C00008 Create shared fact-checking database](../counters/C00008.md) | D4 Degrade | -| [C00011 Media literacy. Games to identify fake news](../counters/C00011.md) | D2 Deny | -| [C00013 Rating framework for news](../counters/C00013.md) | D2 Deny | -| [C00014 Real-time updates to fact-checking database](../counters/C00014.md) | D4 Degrade | -| [C00016 Censorship](../counters/C00016.md) | D2 Deny | -| [C00017 Repair broken social connections](../counters/C00017.md) | D3 Disrupt | -| [C00019 Reduce effect of division-enablers](../counters/C00019.md) | D3 Disrupt | -| [C00021 Encourage in-person communication](../counters/C00021.md) | D4 Degrade | -| [C00022 Innoculate. Positive campaign to promote feeling of safety](../counters/C00022.md) | D4 Degrade | -| [C00024 Promote healthy narratives](../counters/C00024.md) | D4 Degrade | -| [C00027 Create culture of civility](../counters/C00027.md) | D7 Deter | -| [C00029 Create fake website to issue counter narrative and counter narrative through physical merchandise](../counters/C00029.md) | D3 Disrupt | -| [C00030 Develop a compelling counter narrative (truth based)](../counters/C00030.md) | D3 Disrupt | -| [C00031 Dilute the core narrative - create multiple permutations, target / amplify](../counters/C00031.md) | D3 Disrupt | -| [C00042 Address truth contained in narratives](../counters/C00042.md) | D4 Degrade | -| [C00046 Marginalise and discredit extremist groups](../counters/C00046.md) | D4 Degrade | -| [C00072 Remove non-relevant content from special interest groups - not recommended](../counters/C00072.md) | D2 Deny | -| [C00073 Inoculate populations through media literacy training](../counters/C00073.md) | D2 Deny | -| [C00080 Create competing narrative](../counters/C00080.md) | D3 Disrupt | -| [C00081 Highlight flooding and noise, and explain motivations](../counters/C00081.md) | D3 Disrupt | -| [C00082 Ground truthing as automated response to pollution](../counters/C00082.md) | D3 Disrupt | -| [C00084 Modify disinformation narratives, and rebroadcast them](../counters/C00084.md) | D3 Disrupt | -| [C00096 Strengthen institutions that are always truth tellers](../counters/C00096.md) | D7 Deter | -| [C00107 Content moderation](../counters/C00107.md) | D2 Deny | -| [C00125 Prebunking](../counters/C00125.md) | D3 Disrupt | -| [C00126 Social media amber alert](../counters/C00126.md) | D3 Disrupt | -| [C00156 Better tell your country or organization story](../counters/C00156.md) | D3 Disrupt | -| [C00161 Coalition Building with stakeholders and Third-Party Inducements](../counters/C00161.md) | D7 Deter | -| [C00162 Unravel/target the Potemkin villages](../counters/C00162.md) | D3 Disrupt | -| [C00164 compatriot policy](../counters/C00164.md) | D3 Disrupt | -| [C00169 develop a creative content hub](../counters/C00169.md) | D3 Disrupt | -| [C00174 Create a healthier news environment](../counters/C00174.md) | D2 Deny | -| [C00176 Improve Coordination amongst stakeholders: public and private](../counters/C00176.md) | D7 Deter | -| [C00188 Newsroom/Journalist training to counter influence moves](../counters/C00188.md) | D3 Disrupt | -| [C00190 open engagement with civil society](../counters/C00190.md) | D3 Disrupt | -| [C00195 Redirect searches away from disinformation or extremist content ](../counters/C00195.md) | D2 Deny | -| [C00200 Respected figure (influencer) disavows misinfo](../counters/C00200.md) | D3 Disrupt | -| [C00203 Stop offering press credentials to propaganda outlets](../counters/C00203.md) | D3 Disrupt | -| [C00205 strong dialogue between the federal government and private sector to encourage better reporting](../counters/C00205.md) | D3 Disrupt | -| [C00211 Use humorous counter-narratives](../counters/C00211.md) | D3 Disrupt | +| [C00008 Create shared fact-checking database](../counters/C00008.md) | D04 | +| [C00011 Media literacy. Games to identify fake news](../counters/C00011.md) | D02 | +| [C00013 Rating framework for news](../counters/C00013.md) | D02 | +| [C00014 Real-time updates to fact-checking database](../counters/C00014.md) | D04 | +| [C00016 Censorship](../counters/C00016.md) | D02 | +| [C00017 Repair broken social connections](../counters/C00017.md) | D03 | +| [C00019 Reduce effect of division-enablers](../counters/C00019.md) | D03 | +| [C00021 Encourage in-person communication](../counters/C00021.md) | D04 | +| [C00022 Innoculate. Positive campaign to promote feeling of safety](../counters/C00022.md) | D04 | +| [C00024 Promote healthy narratives](../counters/C00024.md) | D04 | +| [C00027 Create culture of civility](../counters/C00027.md) | D07 | +| [C00029 Create fake website to issue counter narrative and counter narrative through physical merchandise](../counters/C00029.md) | D03 | +| [C00030 Develop a compelling counter narrative (truth based)](../counters/C00030.md) | D03 | +| [C00031 Dilute the core narrative - create multiple permutations, target / amplify](../counters/C00031.md) | D03 | +| [C00042 Address truth contained in narratives](../counters/C00042.md) | D04 | +| [C00046 Marginalise and discredit extremist groups](../counters/C00046.md) | D04 | +| [C00072 Remove non-relevant content from special interest groups - not recommended](../counters/C00072.md) | D02 | +| [C00073 Inoculate populations through media literacy training](../counters/C00073.md) | D02 | +| [C00080 Create competing narrative](../counters/C00080.md) | D03 | +| [C00081 Highlight flooding and noise, and explain motivations](../counters/C00081.md) | D03 | +| [C00082 Ground truthing as automated response to pollution](../counters/C00082.md) | D03 | +| [C00084 Modify disinformation narratives, and rebroadcast them](../counters/C00084.md) | D03 | +| [C00096 Strengthen institutions that are always truth tellers](../counters/C00096.md) | D07 | +| [C00107 Content moderation](../counters/C00107.md) | D02 | +| [C00125 Prebunking](../counters/C00125.md) | D03 | +| [C00126 Social media amber alert](../counters/C00126.md) | D03 | +| [C00156 Better tell your country or organization story](../counters/C00156.md) | D03 | +| [C00161 Coalition Building with stakeholders and Third-Party Inducements](../counters/C00161.md) | D07 | +| [C00162 Unravel/target the Potemkin villages](../counters/C00162.md) | D03 | +| [C00164 compatriot policy](../counters/C00164.md) | D03 | +| [C00169 develop a creative content hub](../counters/C00169.md) | D03 | +| [C00174 Create a healthier news environment](../counters/C00174.md) | D02 | +| [C00176 Improve Coordination amongst stakeholders: public and private](../counters/C00176.md) | D07 | +| [C00188 Newsroom/Journalist training to counter influence moves](../counters/C00188.md) | D03 | +| [C00190 open engagement with civil society](../counters/C00190.md) | D03 | +| [C00195 Redirect searches away from disinformation or extremist content ](../counters/C00195.md) | D02 | +| [C00200 Respected figure (influencer) disavows misinfo](../counters/C00200.md) | D03 | +| [C00203 Stop offering press credentials to propaganda outlets](../counters/C00203.md) | D03 | +| [C00205 strong dialogue between the federal government and private sector to encourage better reporting](../counters/C00205.md) | D03 | +| [C00211 Use humorous counter-narratives](../counters/C00211.md) | D03 | DO NOT EDIT ABOVE THIS LINE - PLEASE ADD NOTES BELOW \ No newline at end of file diff --git a/techniques/T0028.md b/techniques/T0028.md index 8997bf8..603c1b8 100644 --- a/techniques/T0028.md +++ b/techniques/T0028.md @@ -16,27 +16,27 @@ These competing narratives allow loyalists cover, but are less compelling to opp | Counters | Response types | | -------- | -------------- | -| [C00008 Create shared fact-checking database](../counters/C00008.md) | D4 Degrade | -| [C00011 Media literacy. Games to identify fake news](../counters/C00011.md) | D2 Deny | -| [C00013 Rating framework for news](../counters/C00013.md) | D2 Deny | -| [C00014 Real-time updates to fact-checking database](../counters/C00014.md) | D4 Degrade | -| [C00016 Censorship](../counters/C00016.md) | D2 Deny | -| [C00017 Repair broken social connections](../counters/C00017.md) | D3 Disrupt | -| [C00019 Reduce effect of division-enablers](../counters/C00019.md) | D3 Disrupt | -| [C00021 Encourage in-person communication](../counters/C00021.md) | D4 Degrade | -| [C00022 Innoculate. Positive campaign to promote feeling of safety](../counters/C00022.md) | D4 Degrade | -| [C00024 Promote healthy narratives](../counters/C00024.md) | D4 Degrade | -| [C00027 Create culture of civility](../counters/C00027.md) | D7 Deter | -| [C00029 Create fake website to issue counter narrative and counter narrative through physical merchandise](../counters/C00029.md) | D3 Disrupt | -| [C00030 Develop a compelling counter narrative (truth based)](../counters/C00030.md) | D3 Disrupt | -| [C00031 Dilute the core narrative - create multiple permutations, target / amplify](../counters/C00031.md) | D3 Disrupt | -| [C00042 Address truth contained in narratives](../counters/C00042.md) | D4 Degrade | -| [C00080 Create competing narrative](../counters/C00080.md) | D3 Disrupt | -| [C00081 Highlight flooding and noise, and explain motivations](../counters/C00081.md) | D3 Disrupt | -| [C00082 Ground truthing as automated response to pollution](../counters/C00082.md) | D3 Disrupt | -| [C00084 Modify disinformation narratives, and rebroadcast them](../counters/C00084.md) | D3 Disrupt | -| [C00203 Stop offering press credentials to propaganda outlets](../counters/C00203.md) | D3 Disrupt | -| [C00211 Use humorous counter-narratives](../counters/C00211.md) | D3 Disrupt | +| [C00008 Create shared fact-checking database](../counters/C00008.md) | D04 | +| [C00011 Media literacy. Games to identify fake news](../counters/C00011.md) | D02 | +| [C00013 Rating framework for news](../counters/C00013.md) | D02 | +| [C00014 Real-time updates to fact-checking database](../counters/C00014.md) | D04 | +| [C00016 Censorship](../counters/C00016.md) | D02 | +| [C00017 Repair broken social connections](../counters/C00017.md) | D03 | +| [C00019 Reduce effect of division-enablers](../counters/C00019.md) | D03 | +| [C00021 Encourage in-person communication](../counters/C00021.md) | D04 | +| [C00022 Innoculate. Positive campaign to promote feeling of safety](../counters/C00022.md) | D04 | +| [C00024 Promote healthy narratives](../counters/C00024.md) | D04 | +| [C00027 Create culture of civility](../counters/C00027.md) | D07 | +| [C00029 Create fake website to issue counter narrative and counter narrative through physical merchandise](../counters/C00029.md) | D03 | +| [C00030 Develop a compelling counter narrative (truth based)](../counters/C00030.md) | D03 | +| [C00031 Dilute the core narrative - create multiple permutations, target / amplify](../counters/C00031.md) | D03 | +| [C00042 Address truth contained in narratives](../counters/C00042.md) | D04 | +| [C00080 Create competing narrative](../counters/C00080.md) | D03 | +| [C00081 Highlight flooding and noise, and explain motivations](../counters/C00081.md) | D03 | +| [C00082 Ground truthing as automated response to pollution](../counters/C00082.md) | D03 | +| [C00084 Modify disinformation narratives, and rebroadcast them](../counters/C00084.md) | D03 | +| [C00203 Stop offering press credentials to propaganda outlets](../counters/C00203.md) | D03 | +| [C00211 Use humorous counter-narratives](../counters/C00211.md) | D03 | DO NOT EDIT ABOVE THIS LINE - PLEASE ADD NOTES BELOW \ No newline at end of file diff --git a/techniques/T0029.md b/techniques/T0029.md index 29eb5ac..e0fe26b 100644 --- a/techniques/T0029.md +++ b/techniques/T0029.md @@ -1,6 +1,6 @@ # Technique T0029: Manipulate online polls -* **Summary**: Create fake online polls, or manipulate existing online polls. Examples: flooding FCC with comments; creating fake engagement metrics of Twitter/Facebook polls to manipulate perception of given issue. Data gathering tactic to target those who engage, and potentially their networks of friends/followers as well +* **Summary**: Create fake online polls, or manipulate existing online polls. Data gathering tactic to target those who engage, and potentially their networks of friends/followers as well * **Belongs to tactic stage**: TA07 @@ -14,11 +14,11 @@ | Counters | Response types | | -------- | -------------- | -| [C00044 Keep people from posting to social media immediately](../counters/C00044.md) | D3 Disrupt | -| [C00097 Require use of verified identities to contribute to poll or comment](../counters/C00097.md) | D2 Deny | -| [C00101 Create friction by rate-limiting engagement](../counters/C00101.md) | D4 Degrade | -| [C00103 Create a bot that engages / distract trolls](../counters/C00103.md) | D5 Deceive | -| [C00123 Remove or rate limit botnets](../counters/C00123.md) | D3 Disrupt | +| [C00044 Keep people from posting to social media immediately](../counters/C00044.md) | D03 | +| [C00097 Require use of verified identities to contribute to poll or comment](../counters/C00097.md) | D02 | +| [C00101 Create friction by rate-limiting engagement](../counters/C00101.md) | D04 | +| [C00103 Create a bot that engages / distract trolls](../counters/C00103.md) | D05 | +| [C00123 Remove or rate limit botnets](../counters/C00123.md) | D03 | DO NOT EDIT ABOVE THIS LINE - PLEASE ADD NOTES BELOW \ No newline at end of file diff --git a/techniques/T0030.md b/techniques/T0030.md index 547d0b9..61bae75 100644 --- a/techniques/T0030.md +++ b/techniques/T0030.md @@ -14,12 +14,12 @@ | Counters | Response types | | -------- | -------------- | -| [C00034 Create more friction at account creation](../counters/C00034.md) | D4 Degrade | -| [C00036 Infiltrate the in-group to discredit leaders (divide)](../counters/C00036.md) | D2 Deny | -| [C00052 Infiltrate platforms](../counters/C00052.md) | D4 Degrade | -| [C00053 Delete old accounts / Remove unused social media accounts](../counters/C00053.md) | D4 Degrade | -| [C00097 Require use of verified identities to contribute to poll or comment](../counters/C00097.md) | D2 Deny | -| [C00099 Strengthen verification methods](../counters/C00099.md) | D2 Deny | +| [C00034 Create more friction at account creation](../counters/C00034.md) | D04 | +| [C00036 Infiltrate the in-group to discredit leaders (divide)](../counters/C00036.md) | D02 | +| [C00052 Infiltrate platforms](../counters/C00052.md) | D04 | +| [C00053 Delete old accounts / Remove unused social media accounts](../counters/C00053.md) | D04 | +| [C00097 Require use of verified identities to contribute to poll or comment](../counters/C00097.md) | D02 | +| [C00099 Strengthen verification methods](../counters/C00099.md) | D02 | DO NOT EDIT ABOVE THIS LINE - PLEASE ADD NOTES BELOW \ No newline at end of file diff --git a/techniques/T0038.md b/techniques/T0038.md index 41f6299..599d8f8 100644 --- a/techniques/T0038.md +++ b/techniques/T0038.md @@ -12,7 +12,7 @@ | Counters | Response types | | -------- | -------------- | -| [C00098 Revocation of allowlisted or "verified" status](../counters/C00098.md) | D2 Deny | +| [C00098 Revocation of allowlisted or "verified" status](../counters/C00098.md) | D02 | DO NOT EDIT ABOVE THIS LINE - PLEASE ADD NOTES BELOW \ No newline at end of file diff --git a/techniques/T0039.md b/techniques/T0039.md index 0303f6c..a143fc1 100644 --- a/techniques/T0039.md +++ b/techniques/T0039.md @@ -17,23 +17,23 @@ By targeting high-influence people and organizations in all types of media with | Counters | Response types | | -------- | -------------- | -| [C00009 Educate high profile influencers on best practices](../counters/C00009.md) | D2 Deny | -| [C00027 Create culture of civility](../counters/C00027.md) | D7 Deter | -| [C00046 Marginalise and discredit extremist groups](../counters/C00046.md) | D4 Degrade | -| [C00072 Remove non-relevant content from special interest groups - not recommended](../counters/C00072.md) | D2 Deny | -| [C00073 Inoculate populations through media literacy training](../counters/C00073.md) | D2 Deny | -| [C00076 Prohibit images in political discourse channels](../counters/C00076.md) | D2 Deny | -| [C00087 Make more noise than the disinformation](../counters/C00087.md) | D4 Degrade | -| [C00092 Establish a truth teller reputation score for influencers](../counters/C00092.md) | D7 Deter | -| [C00093 Influencer code of conduct](../counters/C00093.md) | D7 Deter | -| [C00114 Don't engage with payloads](../counters/C00114.md) | D2 Deny | -| [C00154 Ask media not to report false information](../counters/C00154.md) | D2 Deny | -| [C00160 find and train influencers](../counters/C00160.md) | D2 Deny | -| [C00162 Unravel/target the Potemkin villages](../counters/C00162.md) | D3 Disrupt | -| [C00169 develop a creative content hub](../counters/C00169.md) | D3 Disrupt | -| [C00184 Media exposure](../counters/C00184.md) | D4 Degrade | -| [C00188 Newsroom/Journalist training to counter influence moves](../counters/C00188.md) | D3 Disrupt | -| [C00203 Stop offering press credentials to propaganda outlets](../counters/C00203.md) | D3 Disrupt | +| [C00009 Educate high profile influencers on best practices](../counters/C00009.md) | D02 | +| [C00027 Create culture of civility](../counters/C00027.md) | D07 | +| [C00046 Marginalise and discredit extremist groups](../counters/C00046.md) | D04 | +| [C00072 Remove non-relevant content from special interest groups - not recommended](../counters/C00072.md) | D02 | +| [C00073 Inoculate populations through media literacy training](../counters/C00073.md) | D02 | +| [C00076 Prohibit images in political discourse channels](../counters/C00076.md) | D02 | +| [C00087 Make more noise than the disinformation](../counters/C00087.md) | D04 | +| [C00092 Establish a truth teller reputation score for influencers](../counters/C00092.md) | D07 | +| [C00093 Influencer code of conduct](../counters/C00093.md) | D07 | +| [C00114 Don't engage with payloads](../counters/C00114.md) | D02 | +| [C00154 Ask media not to report false information](../counters/C00154.md) | D02 | +| [C00160 find and train influencers](../counters/C00160.md) | D02 | +| [C00162 Unravel/target the Potemkin villages](../counters/C00162.md) | D03 | +| [C00169 develop a creative content hub](../counters/C00169.md) | D03 | +| [C00184 Media exposure](../counters/C00184.md) | D04 | +| [C00188 Newsroom/Journalist training to counter influence moves](../counters/C00188.md) | D03 | +| [C00203 Stop offering press credentials to propaganda outlets](../counters/C00203.md) | D03 | DO NOT EDIT ABOVE THIS LINE - PLEASE ADD NOTES BELOW \ No newline at end of file diff --git a/techniques/T0040.md b/techniques/T0040.md index 59c75f2..942c58f 100644 --- a/techniques/T0040.md +++ b/techniques/T0040.md @@ -14,8 +14,8 @@ | Counters | Response types | | -------- | -------------- | -| [C00073 Inoculate populations through media literacy training](../counters/C00073.md) | D2 Deny | -| [C00112 "Prove they are not an op!"](../counters/C00112.md) | D2 Deny | +| [C00073 Inoculate populations through media literacy training](../counters/C00073.md) | D02 | +| [C00112 "Prove they are not an op!"](../counters/C00112.md) | D02 | DO NOT EDIT ABOVE THIS LINE - PLEASE ADD NOTES BELOW \ No newline at end of file diff --git a/techniques/T0041.md b/techniques/T0041.md index 2c06e5b..1f0827c 100644 --- a/techniques/T0041.md +++ b/techniques/T0041.md @@ -12,9 +12,9 @@ | Counters | Response types | | -------- | -------------- | -| [C00115 Expose actor and intentions](../counters/C00115.md) | D2 Deny | -| [C00116 Provide proof of involvement](../counters/C00116.md) | D2 Deny | -| [C00184 Media exposure](../counters/C00184.md) | D4 Degrade | +| [C00115 Expose actor and intentions](../counters/C00115.md) | D02 | +| [C00116 Provide proof of involvement](../counters/C00116.md) | D02 | +| [C00184 Media exposure](../counters/C00184.md) | D04 | DO NOT EDIT ABOVE THIS LINE - PLEASE ADD NOTES BELOW \ No newline at end of file diff --git a/techniques/T0042.md b/techniques/T0042.md index 3eb8a86..f241a73 100644 --- a/techniques/T0042.md +++ b/techniques/T0042.md @@ -16,9 +16,9 @@ When messaging makes use of factual reporting to promote these adjustments in th | Counters | Response types | | -------- | -------------- | -| [C00009 Educate high profile influencers on best practices](../counters/C00009.md) | D2 Deny | -| [C00042 Address truth contained in narratives](../counters/C00042.md) | D4 Degrade | -| [C00112 "Prove they are not an op!"](../counters/C00112.md) | D2 Deny | +| [C00009 Educate high profile influencers on best practices](../counters/C00009.md) | D02 | +| [C00042 Address truth contained in narratives](../counters/C00042.md) | D04 | +| [C00112 "Prove they are not an op!"](../counters/C00112.md) | D02 | DO NOT EDIT ABOVE THIS LINE - PLEASE ADD NOTES BELOW \ No newline at end of file diff --git a/techniques/T0043.md b/techniques/T0043.md index c70e140..b45939e 100644 --- a/techniques/T0043.md +++ b/techniques/T0043.md @@ -13,13 +13,13 @@ | Counters | Response types | | -------- | -------------- | -| [C00006 Charge for social media](../counters/C00006.md) | D2 Deny | -| [C00012 Platform regulation](../counters/C00012.md) | D2 Deny | -| [C00016 Censorship](../counters/C00016.md) | D2 Deny | -| [C00074 Identify and delete or rate limit identical content](../counters/C00074.md) | D2 Deny | -| [C00121 Tool transparency and literacy for channels people follow. ](../counters/C00121.md) | D7 Deter | -| [C00135 Deplatform message groups and/or message boards](../counters/C00135.md) | D3 Disrupt | -| [C00176 Improve Coordination amongst stakeholders: public and private](../counters/C00176.md) | D7 Deter | +| [C00006 Charge for social media](../counters/C00006.md) | D02 | +| [C00012 Platform regulation](../counters/C00012.md) | D02 | +| [C00016 Censorship](../counters/C00016.md) | D02 | +| [C00074 Identify and delete or rate limit identical content](../counters/C00074.md) | D02 | +| [C00121 Tool transparency and literacy for channels people follow. ](../counters/C00121.md) | D07 | +| [C00135 Deplatform message groups and/or message boards](../counters/C00135.md) | D03 | +| [C00176 Improve Coordination amongst stakeholders: public and private](../counters/C00176.md) | D07 | DO NOT EDIT ABOVE THIS LINE - PLEASE ADD NOTES BELOW \ No newline at end of file diff --git a/techniques/T0044.md b/techniques/T0044.md index d6539d9..56692b5 100644 --- a/techniques/T0044.md +++ b/techniques/T0044.md @@ -1,8 +1,6 @@ # Technique T0044: Seed distortions -* **Summary**: Incident creators often try a wide variety of messages in the early hours surrounding an incident or event in order to give a misleading account or impression. - -Examples: (2019) China formally arrests Canadians Spavor and Kovrig, accuses them of spying (in retaliation to detention of Hauwei CFO). (2018) The Russian ministry of defence put out a press release, claiming that they had intelligence Syrian rebel forces were about to gas their own people in Idlib province as part of a “false flag” operation to frame the Syrian government. +* **Summary**: Try a wide variety of messages in the early hours surrounding an incident or event, to give a misleading account or impression. * **Belongs to tactic stage**: TA08 @@ -15,34 +13,34 @@ Examples: (2019) China formally arrests Canadians Spavor and Kovrig, accuses the | Counters | Response types | | -------- | -------------- | -| [C00008 Create shared fact-checking database](../counters/C00008.md) | D4 Degrade | -| [C00009 Educate high profile influencers on best practices](../counters/C00009.md) | D2 Deny | -| [C00011 Media literacy. Games to identify fake news](../counters/C00011.md) | D2 Deny | -| [C00014 Real-time updates to fact-checking database](../counters/C00014.md) | D4 Degrade | -| [C00016 Censorship](../counters/C00016.md) | D2 Deny | -| [C00019 Reduce effect of division-enablers](../counters/C00019.md) | D3 Disrupt | -| [C00021 Encourage in-person communication](../counters/C00021.md) | D4 Degrade | -| [C00022 Innoculate. Positive campaign to promote feeling of safety](../counters/C00022.md) | D4 Degrade | -| [C00024 Promote healthy narratives](../counters/C00024.md) | D4 Degrade | -| [C00027 Create culture of civility](../counters/C00027.md) | D7 Deter | -| [C00042 Address truth contained in narratives](../counters/C00042.md) | D4 Degrade | -| [C00046 Marginalise and discredit extremist groups](../counters/C00046.md) | D4 Degrade | -| [C00072 Remove non-relevant content from special interest groups - not recommended](../counters/C00072.md) | D2 Deny | -| [C00073 Inoculate populations through media literacy training](../counters/C00073.md) | D2 Deny | -| [C00076 Prohibit images in political discourse channels](../counters/C00076.md) | D2 Deny | -| [C00078 Change Search Algorithms for Disinformation Content](../counters/C00078.md) | D3 Disrupt | -| [C00081 Highlight flooding and noise, and explain motivations](../counters/C00081.md) | D3 Disrupt | -| [C00082 Ground truthing as automated response to pollution](../counters/C00082.md) | D3 Disrupt | -| [C00085 Mute content](../counters/C00085.md) | D3 Disrupt | -| [C00086 Distract from noise with addictive content](../counters/C00086.md) | D4 Degrade | -| [C00087 Make more noise than the disinformation](../counters/C00087.md) | D4 Degrade | -| [C00092 Establish a truth teller reputation score for influencers](../counters/C00092.md) | D7 Deter | -| [C00117 Downgrade / de-amplify so message is seen by fewer people](../counters/C00117.md) | D4 Degrade | -| [C00118 Repurpose images with new text](../counters/C00118.md) | D4 Degrade | -| [C00119 Engage payload and debunk.](../counters/C00119.md) | D7 Deter | -| [C00122 Content moderation](../counters/C00122.md) | D2 Deny | -| [C00174 Create a healthier news environment](../counters/C00174.md) | D2 Deny | -| [C00184 Media exposure](../counters/C00184.md) | D4 Degrade | +| [C00008 Create shared fact-checking database](../counters/C00008.md) | D04 | +| [C00009 Educate high profile influencers on best practices](../counters/C00009.md) | D02 | +| [C00011 Media literacy. Games to identify fake news](../counters/C00011.md) | D02 | +| [C00014 Real-time updates to fact-checking database](../counters/C00014.md) | D04 | +| [C00016 Censorship](../counters/C00016.md) | D02 | +| [C00019 Reduce effect of division-enablers](../counters/C00019.md) | D03 | +| [C00021 Encourage in-person communication](../counters/C00021.md) | D04 | +| [C00022 Innoculate. Positive campaign to promote feeling of safety](../counters/C00022.md) | D04 | +| [C00024 Promote healthy narratives](../counters/C00024.md) | D04 | +| [C00027 Create culture of civility](../counters/C00027.md) | D07 | +| [C00042 Address truth contained in narratives](../counters/C00042.md) | D04 | +| [C00046 Marginalise and discredit extremist groups](../counters/C00046.md) | D04 | +| [C00072 Remove non-relevant content from special interest groups - not recommended](../counters/C00072.md) | D02 | +| [C00073 Inoculate populations through media literacy training](../counters/C00073.md) | D02 | +| [C00076 Prohibit images in political discourse channels](../counters/C00076.md) | D02 | +| [C00078 Change Search Algorithms for Disinformation Content](../counters/C00078.md) | D03 | +| [C00081 Highlight flooding and noise, and explain motivations](../counters/C00081.md) | D03 | +| [C00082 Ground truthing as automated response to pollution](../counters/C00082.md) | D03 | +| [C00085 Mute content](../counters/C00085.md) | D03 | +| [C00086 Distract from noise with addictive content](../counters/C00086.md) | D04 | +| [C00087 Make more noise than the disinformation](../counters/C00087.md) | D04 | +| [C00092 Establish a truth teller reputation score for influencers](../counters/C00092.md) | D07 | +| [C00117 Downgrade / de-amplify so message is seen by fewer people](../counters/C00117.md) | D04 | +| [C00118 Repurpose images with new text](../counters/C00118.md) | D04 | +| [C00119 Engage payload and debunk.](../counters/C00119.md) | D07 | +| [C00122 Content moderation](../counters/C00122.md) | D02 | +| [C00174 Create a healthier news environment](../counters/C00174.md) | D02 | +| [C00184 Media exposure](../counters/C00184.md) | D04 | DO NOT EDIT ABOVE THIS LINE - PLEASE ADD NOTES BELOW \ No newline at end of file diff --git a/techniques/T0045.md b/techniques/T0045.md index 171c46d..ecaea83 100644 --- a/techniques/T0045.md +++ b/techniques/T0045.md @@ -13,38 +13,38 @@ | Counters | Response types | | -------- | -------------- | -| [C00008 Create shared fact-checking database](../counters/C00008.md) | D4 Degrade | -| [C00011 Media literacy. Games to identify fake news](../counters/C00011.md) | D2 Deny | -| [C00012 Platform regulation](../counters/C00012.md) | D2 Deny | -| [C00014 Real-time updates to fact-checking database](../counters/C00014.md) | D4 Degrade | -| [C00016 Censorship](../counters/C00016.md) | D2 Deny | -| [C00036 Infiltrate the in-group to discredit leaders (divide)](../counters/C00036.md) | D2 Deny | -| [C00046 Marginalise and discredit extremist groups](../counters/C00046.md) | D4 Degrade | -| [C00048 Name and Shame Influencers](../counters/C00048.md) | D7 Deter | -| [C00073 Inoculate populations through media literacy training](../counters/C00073.md) | D2 Deny | -| [C00085 Mute content](../counters/C00085.md) | D3 Disrupt | -| [C00092 Establish a truth teller reputation score for influencers](../counters/C00092.md) | D7 Deter | -| [C00097 Require use of verified identities to contribute to poll or comment](../counters/C00097.md) | D2 Deny | -| [C00099 Strengthen verification methods](../counters/C00099.md) | D2 Deny | -| [C00107 Content moderation](../counters/C00107.md) | D2 Deny | -| [C00113 Debunk and defuse a fake expert / credentials.](../counters/C00113.md) | D2 Deny | -| [C00117 Downgrade / de-amplify so message is seen by fewer people](../counters/C00117.md) | D4 Degrade | -| [C00119 Engage payload and debunk.](../counters/C00119.md) | D7 Deter | -| [C00122 Content moderation](../counters/C00122.md) | D2 Deny | -| [C00125 Prebunking](../counters/C00125.md) | D3 Disrupt | -| [C00126 Social media amber alert](../counters/C00126.md) | D3 Disrupt | -| [C00133 Deplatform Account*](../counters/C00133.md) | D3 Disrupt | -| [C00133 Deplatform Account*](../counters/C00133.md) | D3 Disrupt | -| [C00154 Ask media not to report false information](../counters/C00154.md) | D2 Deny | -| [C00174 Create a healthier news environment](../counters/C00174.md) | D2 Deny | -| [C00176 Improve Coordination amongst stakeholders: public and private](../counters/C00176.md) | D7 Deter | -| [C00184 Media exposure](../counters/C00184.md) | D4 Degrade | -| [C00184 Media exposure](../counters/C00184.md) | D4 Degrade | -| [C00188 Newsroom/Journalist training to counter influence moves](../counters/C00188.md) | D3 Disrupt | -| [C00195 Redirect searches away from disinformation or extremist content ](../counters/C00195.md) | D2 Deny | -| [C00200 Respected figure (influencer) disavows misinfo](../counters/C00200.md) | D3 Disrupt | -| [C00203 Stop offering press credentials to propaganda outlets](../counters/C00203.md) | D3 Disrupt | -| [C00211 Use humorous counter-narratives](../counters/C00211.md) | D3 Disrupt | +| [C00008 Create shared fact-checking database](../counters/C00008.md) | D04 | +| [C00011 Media literacy. Games to identify fake news](../counters/C00011.md) | D02 | +| [C00012 Platform regulation](../counters/C00012.md) | D02 | +| [C00014 Real-time updates to fact-checking database](../counters/C00014.md) | D04 | +| [C00016 Censorship](../counters/C00016.md) | D02 | +| [C00036 Infiltrate the in-group to discredit leaders (divide)](../counters/C00036.md) | D02 | +| [C00046 Marginalise and discredit extremist groups](../counters/C00046.md) | D04 | +| [C00048 Name and Shame Influencers](../counters/C00048.md) | D07 | +| [C00073 Inoculate populations through media literacy training](../counters/C00073.md) | D02 | +| [C00085 Mute content](../counters/C00085.md) | D03 | +| [C00092 Establish a truth teller reputation score for influencers](../counters/C00092.md) | D07 | +| [C00097 Require use of verified identities to contribute to poll or comment](../counters/C00097.md) | D02 | +| [C00099 Strengthen verification methods](../counters/C00099.md) | D02 | +| [C00107 Content moderation](../counters/C00107.md) | D02 | +| [C00113 Debunk and defuse a fake expert / credentials.](../counters/C00113.md) | D02 | +| [C00117 Downgrade / de-amplify so message is seen by fewer people](../counters/C00117.md) | D04 | +| [C00119 Engage payload and debunk.](../counters/C00119.md) | D07 | +| [C00122 Content moderation](../counters/C00122.md) | D02 | +| [C00125 Prebunking](../counters/C00125.md) | D03 | +| [C00126 Social media amber alert](../counters/C00126.md) | D03 | +| [C00133 Deplatform Account*](../counters/C00133.md) | D03 | +| [C00133 Deplatform Account*](../counters/C00133.md) | D03 | +| [C00154 Ask media not to report false information](../counters/C00154.md) | D02 | +| [C00174 Create a healthier news environment](../counters/C00174.md) | D02 | +| [C00176 Improve Coordination amongst stakeholders: public and private](../counters/C00176.md) | D07 | +| [C00184 Media exposure](../counters/C00184.md) | D04 | +| [C00184 Media exposure](../counters/C00184.md) | D04 | +| [C00188 Newsroom/Journalist training to counter influence moves](../counters/C00188.md) | D03 | +| [C00195 Redirect searches away from disinformation or extremist content ](../counters/C00195.md) | D02 | +| [C00200 Respected figure (influencer) disavows misinfo](../counters/C00200.md) | D03 | +| [C00203 Stop offering press credentials to propaganda outlets](../counters/C00203.md) | D03 | +| [C00211 Use humorous counter-narratives](../counters/C00211.md) | D03 | DO NOT EDIT ABOVE THIS LINE - PLEASE ADD NOTES BELOW \ No newline at end of file diff --git a/techniques/T0046.md b/techniques/T0046.md index 1cf7a2c..8d49447 100644 --- a/techniques/T0046.md +++ b/techniques/T0046.md @@ -24,13 +24,13 @@ | Counters | Response types | | -------- | -------------- | -| [C00012 Platform regulation](../counters/C00012.md) | D2 Deny | -| [C00070 Block access to disinformation resources](../counters/C00070.md) | D2 Deny | -| [C00078 Change Search Algorithms for Disinformation Content](../counters/C00078.md) | D3 Disrupt | -| [C00117 Downgrade / de-amplify so message is seen by fewer people](../counters/C00117.md) | D4 Degrade | -| [C00149 Poison the monitoring & evaluation data](../counters/C00149.md) | D4 Degrade | -| [C00188 Newsroom/Journalist training to counter influence moves](../counters/C00188.md) | D3 Disrupt | -| [C00195 Redirect searches away from disinformation or extremist content ](../counters/C00195.md) | D2 Deny | +| [C00012 Platform regulation](../counters/C00012.md) | D02 | +| [C00070 Block access to disinformation resources](../counters/C00070.md) | D02 | +| [C00078 Change Search Algorithms for Disinformation Content](../counters/C00078.md) | D03 | +| [C00117 Downgrade / de-amplify so message is seen by fewer people](../counters/C00117.md) | D04 | +| [C00149 Poison the monitoring & evaluation data](../counters/C00149.md) | D04 | +| [C00188 Newsroom/Journalist training to counter influence moves](../counters/C00188.md) | D03 | +| [C00195 Redirect searches away from disinformation or extremist content ](../counters/C00195.md) | D02 | -DO NOT EDIT ABOVE THIS LINE - PLEASE ADD NOTES BELOW +DO NOT EDIT ABOVE THIS LINE - PLEASE ADD NOTES BELOW \ No newline at end of file diff --git a/techniques/T0047.md b/techniques/T0047.md index def44b7..dde16aa 100644 --- a/techniques/T0047.md +++ b/techniques/T0047.md @@ -1,6 +1,6 @@ # Technique T0047: Muzzle social media as a political force -* **Summary**: Use political influence or the power of state to stop critical social media comments. Government requested/driven content take downs (see Google Transperancy reports. (Example 20190 Singapore Protection from Online Falsehoods and Manipulation Bill would make it illegal to spread "false statements of fact" in Singapore, where that information is "prejudicial" to Singapore's security or "public tranquility." Or India/New Delhi has cut off services to Facebook and Twitter in Kashmir 28 times in the past five years, and in 2016, access was blocked for five months -- on the grounds that these platforms were being used for anti-social and "anti-national" purposes. +* **Summary**: Use political influence or the power of state to stop critical social media comments. Government requested/driven content take downs (see Google Transperancy reports. * **Belongs to tactic stage**: TA09 @@ -13,10 +13,10 @@ | Counters | Response types | | -------- | -------------- | -| [C00012 Platform regulation](../counters/C00012.md) | D2 Deny | -| [C00060 Legal action against for-profit engagement factories](../counters/C00060.md) | D3 Disrupt | -| [C00093 Influencer code of conduct](../counters/C00093.md) | D7 Deter | -| [C00120 Open dialogue about design of platforms to produce different outcomes](../counters/C00120.md) | D7 Deter | +| [C00012 Platform regulation](../counters/C00012.md) | D02 | +| [C00060 Legal action against for-profit engagement factories](../counters/C00060.md) | D03 | +| [C00093 Influencer code of conduct](../counters/C00093.md) | D07 | +| [C00120 Open dialogue about design of platforms to produce different outcomes](../counters/C00120.md) | D07 | DO NOT EDIT ABOVE THIS LINE - PLEASE ADD NOTES BELOW \ No newline at end of file diff --git a/techniques/T0048.md b/techniques/T0048.md index b2922fc..faf1459 100644 --- a/techniques/T0048.md +++ b/techniques/T0048.md @@ -1,6 +1,6 @@ # Technique T0048: Cow online opinion leaders -* **Summary**: Intimidate, coerce, threaten critics/dissidents/journalists via trolling, doxing. Examples: Philippines, Maria Ressa and Rappler journalists targeted Duterte regime, lawsuits, trollings, banned from the presidential palace where press briefings take place; 2017 bot attack on five ProPublica Journalists. +* **Summary**: Intimidate, coerce, threaten critics/dissidents/journalists via trolling, doxing. * **Belongs to tactic stage**: TA09 @@ -13,18 +13,18 @@ | Counters | Response types | | -------- | -------------- | -| [C00009 Educate high profile influencers on best practices](../counters/C00009.md) | D2 Deny | -| [C00012 Platform regulation](../counters/C00012.md) | D2 Deny | -| [C00027 Create culture of civility](../counters/C00027.md) | D7 Deter | -| [C00046 Marginalise and discredit extremist groups](../counters/C00046.md) | D4 Degrade | -| [C00048 Name and Shame Influencers](../counters/C00048.md) | D7 Deter | -| [C00073 Inoculate populations through media literacy training](../counters/C00073.md) | D2 Deny | -| [C00087 Make more noise than the disinformation](../counters/C00087.md) | D4 Degrade | -| [C00093 Influencer code of conduct](../counters/C00093.md) | D7 Deter | -| [C00114 Don't engage with payloads](../counters/C00114.md) | D2 Deny | -| [C00115 Expose actor and intentions](../counters/C00115.md) | D2 Deny | -| [C00154 Ask media not to report false information](../counters/C00154.md) | D2 Deny | -| [C00160 find and train influencers](../counters/C00160.md) | D2 Deny | +| [C00009 Educate high profile influencers on best practices](../counters/C00009.md) | D02 | +| [C00012 Platform regulation](../counters/C00012.md) | D02 | +| [C00027 Create culture of civility](../counters/C00027.md) | D07 | +| [C00046 Marginalise and discredit extremist groups](../counters/C00046.md) | D04 | +| [C00048 Name and Shame Influencers](../counters/C00048.md) | D07 | +| [C00073 Inoculate populations through media literacy training](../counters/C00073.md) | D02 | +| [C00087 Make more noise than the disinformation](../counters/C00087.md) | D04 | +| [C00093 Influencer code of conduct](../counters/C00093.md) | D07 | +| [C00114 Don't engage with payloads](../counters/C00114.md) | D02 | +| [C00115 Expose actor and intentions](../counters/C00115.md) | D02 | +| [C00154 Ask media not to report false information](../counters/C00154.md) | D02 | +| [C00160 find and train influencers](../counters/C00160.md) | D02 | DO NOT EDIT ABOVE THIS LINE - PLEASE ADD NOTES BELOW \ No newline at end of file diff --git a/techniques/T0049.md b/techniques/T0049.md index 000e00e..1f89374 100644 --- a/techniques/T0049.md +++ b/techniques/T0049.md @@ -2,8 +2,6 @@ * **Summary**: Flooding and/or mobbing social media channels feeds and/or hashtag with excessive volume of content to control/shape online conversations and/or drown out opposing points of view. Bots and/or patriotic trolls are effective tools to acheive this effect. -Example (2018): bots flood social media promoting messages which support Saudi Arabia with intent to cast doubt on allegations that the kingdom was involved in Khashoggi’s death. - * **Belongs to tactic stage**: TA09 @@ -16,22 +14,22 @@ Example (2018): bots flood social media promoting messages which support Saudi A | Counters | Response types | | -------- | -------------- | -| [C00012 Platform regulation](../counters/C00012.md) | D2 Deny | -| [C00016 Censorship](../counters/C00016.md) | D2 Deny | -| [C00044 Keep people from posting to social media immediately](../counters/C00044.md) | D3 Disrupt | -| [C00072 Remove non-relevant content from special interest groups - not recommended](../counters/C00072.md) | D2 Deny | -| [C00074 Identify and delete or rate limit identical content](../counters/C00074.md) | D2 Deny | -| [C00085 Mute content](../counters/C00085.md) | D3 Disrupt | -| [C00086 Distract from noise with addictive content](../counters/C00086.md) | D4 Degrade | -| [C00087 Make more noise than the disinformation](../counters/C00087.md) | D4 Degrade | -| [C00091 Honeypot social community](../counters/C00091.md) | D5 Deceive | -| [C00101 Create friction by rate-limiting engagement](../counters/C00101.md) | D4 Degrade | -| [C00122 Content moderation](../counters/C00122.md) | D2 Deny | -| [C00123 Remove or rate limit botnets](../counters/C00123.md) | D3 Disrupt | -| [C00128 Create friction by marking content with ridicule or other "decelerants"](../counters/C00128.md) | D3 Disrupt | -| [C00131 Seize and analyse botnet servers](../counters/C00131.md) | D2 Deny | -| [C00153 Take pre-emptive action against actors' infrastructure](../counters/C00153.md) | D3 Disrupt | -| [C00176 Improve Coordination amongst stakeholders: public and private](../counters/C00176.md) | D7 Deter | +| [C00012 Platform regulation](../counters/C00012.md) | D02 | +| [C00016 Censorship](../counters/C00016.md) | D02 | +| [C00044 Keep people from posting to social media immediately](../counters/C00044.md) | D03 | +| [C00072 Remove non-relevant content from special interest groups - not recommended](../counters/C00072.md) | D02 | +| [C00074 Identify and delete or rate limit identical content](../counters/C00074.md) | D02 | +| [C00085 Mute content](../counters/C00085.md) | D03 | +| [C00086 Distract from noise with addictive content](../counters/C00086.md) | D04 | +| [C00087 Make more noise than the disinformation](../counters/C00087.md) | D04 | +| [C00091 Honeypot social community](../counters/C00091.md) | D05 | +| [C00101 Create friction by rate-limiting engagement](../counters/C00101.md) | D04 | +| [C00122 Content moderation](../counters/C00122.md) | D02 | +| [C00123 Remove or rate limit botnets](../counters/C00123.md) | D03 | +| [C00128 Create friction by marking content with ridicule or other "decelerants"](../counters/C00128.md) | D03 | +| [C00131 Seize and analyse botnet servers](../counters/C00131.md) | D02 | +| [C00153 Take pre-emptive action against actors' infrastructure](../counters/C00153.md) | D03 | +| [C00176 Improve Coordination amongst stakeholders: public and private](../counters/C00176.md) | D07 | DO NOT EDIT ABOVE THIS LINE - PLEASE ADD NOTES BELOW \ No newline at end of file diff --git a/techniques/T0050.md b/techniques/T0050.md index ff88796..306167b 100644 --- a/techniques/T0050.md +++ b/techniques/T0050.md @@ -1,6 +1,6 @@ # Technique T0050: Cheerleading domestic social media ops -* **Summary**: Deploy state-coordinated social media commenters and astroturfers. Both internal/domestic and external social media influence operations, popularized by China (50cent Army manage message inside the "Great Firewall") but also technique used by Chinese English-language social media influence operations are seeded by state-run media, which overwhelmingly present a positive, benign, and cooperative image of China. +* **Summary**: Deploy state-coordinated social media commenters and astroturfers. Both internal/domestic and external social media influence operations. * **Belongs to tactic stage**: TA09 @@ -14,13 +14,13 @@ | Counters | Response types | | -------- | -------------- | -| [C00012 Platform regulation](../counters/C00012.md) | D2 Deny | -| [C00044 Keep people from posting to social media immediately](../counters/C00044.md) | D3 Disrupt | -| [C00074 Identify and delete or rate limit identical content](../counters/C00074.md) | D2 Deny | -| [C00086 Distract from noise with addictive content](../counters/C00086.md) | D4 Degrade | -| [C00087 Make more noise than the disinformation](../counters/C00087.md) | D4 Degrade | -| [C00128 Create friction by marking content with ridicule or other "decelerants"](../counters/C00128.md) | D3 Disrupt | -| [C00162 Unravel/target the Potemkin villages](../counters/C00162.md) | D3 Disrupt | +| [C00012 Platform regulation](../counters/C00012.md) | D02 | +| [C00044 Keep people from posting to social media immediately](../counters/C00044.md) | D03 | +| [C00074 Identify and delete or rate limit identical content](../counters/C00074.md) | D02 | +| [C00086 Distract from noise with addictive content](../counters/C00086.md) | D04 | +| [C00087 Make more noise than the disinformation](../counters/C00087.md) | D04 | +| [C00128 Create friction by marking content with ridicule or other "decelerants"](../counters/C00128.md) | D03 | +| [C00162 Unravel/target the Potemkin villages](../counters/C00162.md) | D03 | DO NOT EDIT ABOVE THIS LINE - PLEASE ADD NOTES BELOW \ No newline at end of file diff --git a/techniques/T0051.md b/techniques/T0051.md index 1e88b9f..c01762c 100644 --- a/techniques/T0051.md +++ b/techniques/T0051.md @@ -1,6 +1,6 @@ # Technique T0051: Fabricate social media comment -* **Summary**: Use government-paid social media commenters, astroturfers, chat bots (programmed to reply to specific key words/hashtags) influence online conversations, product reviews, web-site comment forums. (2017 example) the FCC was inundated with nearly 22 million public comments on net neutrality (many from fake accounts) +* **Summary**: Use government-paid social media commenters, astroturfers, chat bots (programmed to reply to specific key words/hashtags) influence online conversations, product reviews, web-site comment forums. * **Belongs to tactic stage**: TA09 @@ -13,20 +13,20 @@ | Counters | Response types | | -------- | -------------- | -| [C00008 Create shared fact-checking database](../counters/C00008.md) | D4 Degrade | -| [C00011 Media literacy. Games to identify fake news](../counters/C00011.md) | D2 Deny | -| [C00012 Platform regulation](../counters/C00012.md) | D2 Deny | -| [C00014 Real-time updates to fact-checking database](../counters/C00014.md) | D4 Degrade | -| [C00016 Censorship](../counters/C00016.md) | D2 Deny | -| [C00044 Keep people from posting to social media immediately](../counters/C00044.md) | D3 Disrupt | -| [C00046 Marginalise and discredit extremist groups](../counters/C00046.md) | D4 Degrade | -| [C00048 Name and Shame Influencers](../counters/C00048.md) | D7 Deter | -| [C00074 Identify and delete or rate limit identical content](../counters/C00074.md) | D2 Deny | -| [C00085 Mute content](../counters/C00085.md) | D3 Disrupt | -| [C00086 Distract from noise with addictive content](../counters/C00086.md) | D4 Degrade | -| [C00087 Make more noise than the disinformation](../counters/C00087.md) | D4 Degrade | -| [C00122 Content moderation](../counters/C00122.md) | D2 Deny | -| [C00176 Improve Coordination amongst stakeholders: public and private](../counters/C00176.md) | D7 Deter | +| [C00008 Create shared fact-checking database](../counters/C00008.md) | D04 | +| [C00011 Media literacy. Games to identify fake news](../counters/C00011.md) | D02 | +| [C00012 Platform regulation](../counters/C00012.md) | D02 | +| [C00014 Real-time updates to fact-checking database](../counters/C00014.md) | D04 | +| [C00016 Censorship](../counters/C00016.md) | D02 | +| [C00044 Keep people from posting to social media immediately](../counters/C00044.md) | D03 | +| [C00046 Marginalise and discredit extremist groups](../counters/C00046.md) | D04 | +| [C00048 Name and Shame Influencers](../counters/C00048.md) | D07 | +| [C00074 Identify and delete or rate limit identical content](../counters/C00074.md) | D02 | +| [C00085 Mute content](../counters/C00085.md) | D03 | +| [C00086 Distract from noise with addictive content](../counters/C00086.md) | D04 | +| [C00087 Make more noise than the disinformation](../counters/C00087.md) | D04 | +| [C00122 Content moderation](../counters/C00122.md) | D02 | +| [C00176 Improve Coordination amongst stakeholders: public and private](../counters/C00176.md) | D07 | DO NOT EDIT ABOVE THIS LINE - PLEASE ADD NOTES BELOW \ No newline at end of file diff --git a/techniques/T0052.md b/techniques/T0052.md index 6420cf4..557cd04 100644 --- a/techniques/T0052.md +++ b/techniques/T0052.md @@ -2,8 +2,6 @@ * **Summary**: Create content/news/opinion web-sites to cross-post stories. Tertiary sites circulate and amplify narratives. Often these sites have no masthead, bylines or attribution. -Examples of tertiary sites include Russia Insider, The Duran, geopolitica.ru, Mint Press News, Oriental Review, globalresearch.ca. Examples: (2019, Domestic news): Snopes reveals Star News Digital Media, Inc. may look like a media company that produces local news, but operates via undisclosed connections to political activism. (2018) FireEye reports on Iranian campaign that created between April 2018 and March 2019 sites used to spread inauthentic content from websites such as Liberty Front Press (LFP), US Journal, and Real Progressive Front during the 2018 US mid-terms. - * **Belongs to tactic stage**: TA09 @@ -19,28 +17,28 @@ Examples of tertiary sites include Russia Insider, The Duran, geopolitica.ru, Mi | Counters | Response types | | -------- | -------------- | -| [C00009 Educate high profile influencers on best practices](../counters/C00009.md) | D2 Deny | -| [C00012 Platform regulation](../counters/C00012.md) | D2 Deny | -| [C00013 Rating framework for news](../counters/C00013.md) | D2 Deny | -| [C00016 Censorship](../counters/C00016.md) | D2 Deny | -| [C00019 Reduce effect of division-enablers](../counters/C00019.md) | D3 Disrupt | -| [C00046 Marginalise and discredit extremist groups](../counters/C00046.md) | D4 Degrade | -| [C00048 Name and Shame Influencers](../counters/C00048.md) | D7 Deter | -| [C00070 Block access to disinformation resources](../counters/C00070.md) | D2 Deny | -| [C00074 Identify and delete or rate limit identical content](../counters/C00074.md) | D2 Deny | -| [C00078 Change Search Algorithms for Disinformation Content](../counters/C00078.md) | D3 Disrupt | -| [C00085 Mute content](../counters/C00085.md) | D3 Disrupt | -| [C00087 Make more noise than the disinformation](../counters/C00087.md) | D4 Degrade | -| [C00115 Expose actor and intentions](../counters/C00115.md) | D2 Deny | -| [C00120 Open dialogue about design of platforms to produce different outcomes](../counters/C00120.md) | D7 Deter | -| [C00122 Content moderation](../counters/C00122.md) | D2 Deny | -| [C00125 Prebunking](../counters/C00125.md) | D3 Disrupt | -| [C00126 Social media amber alert](../counters/C00126.md) | D3 Disrupt | -| [C00128 Create friction by marking content with ridicule or other "decelerants"](../counters/C00128.md) | D3 Disrupt | -| [C00153 Take pre-emptive action against actors' infrastructure](../counters/C00153.md) | D3 Disrupt | -| [C00162 Unravel/target the Potemkin villages](../counters/C00162.md) | D3 Disrupt | -| [C00176 Improve Coordination amongst stakeholders: public and private](../counters/C00176.md) | D7 Deter | -| [C00203 Stop offering press credentials to propaganda outlets](../counters/C00203.md) | D3 Disrupt | +| [C00009 Educate high profile influencers on best practices](../counters/C00009.md) | D02 | +| [C00012 Platform regulation](../counters/C00012.md) | D02 | +| [C00013 Rating framework for news](../counters/C00013.md) | D02 | +| [C00016 Censorship](../counters/C00016.md) | D02 | +| [C00019 Reduce effect of division-enablers](../counters/C00019.md) | D03 | +| [C00046 Marginalise and discredit extremist groups](../counters/C00046.md) | D04 | +| [C00048 Name and Shame Influencers](../counters/C00048.md) | D07 | +| [C00070 Block access to disinformation resources](../counters/C00070.md) | D02 | +| [C00074 Identify and delete or rate limit identical content](../counters/C00074.md) | D02 | +| [C00078 Change Search Algorithms for Disinformation Content](../counters/C00078.md) | D03 | +| [C00085 Mute content](../counters/C00085.md) | D03 | +| [C00087 Make more noise than the disinformation](../counters/C00087.md) | D04 | +| [C00115 Expose actor and intentions](../counters/C00115.md) | D02 | +| [C00120 Open dialogue about design of platforms to produce different outcomes](../counters/C00120.md) | D07 | +| [C00122 Content moderation](../counters/C00122.md) | D02 | +| [C00125 Prebunking](../counters/C00125.md) | D03 | +| [C00126 Social media amber alert](../counters/C00126.md) | D03 | +| [C00128 Create friction by marking content with ridicule or other "decelerants"](../counters/C00128.md) | D03 | +| [C00153 Take pre-emptive action against actors' infrastructure](../counters/C00153.md) | D03 | +| [C00162 Unravel/target the Potemkin villages](../counters/C00162.md) | D03 | +| [C00176 Improve Coordination amongst stakeholders: public and private](../counters/C00176.md) | D07 | +| [C00203 Stop offering press credentials to propaganda outlets](../counters/C00203.md) | D03 | DO NOT EDIT ABOVE THIS LINE - PLEASE ADD NOTES BELOW \ No newline at end of file diff --git a/techniques/T0053.md b/techniques/T0053.md index 35f5d45..0ad14fa 100644 --- a/techniques/T0053.md +++ b/techniques/T0053.md @@ -1,6 +1,6 @@ # Technique T0053: Twitter trolls amplify and manipulate -* **Summary**: Use trolls to amplify narratives and/or manipulate narratives. Fake profiles/sockpuppets operating to support individuals/narratives from the entire political spectrum (left/right binary). Operating with increased emphasis on promoting local content and promoting real Twitter users generating their own, often divisive political content, as it's easier to amplify existing content than create new/original content. Trolls operate where ever there's a socially divisive issue (issues that can/are be politicized) e.g. BlackLivesMatter or MeToo +* **Summary**: Use trolls to amplify narratives and/or manipulate narratives. Fake profiles/sockpuppets operating to support individuals/narratives from the entire political spectrum (left/right binary). Operating with increased emphasis on promoting local content and promoting real Twitter users generating their own, often divisive political content, as it's easier to amplify existing content than create new/original content. Trolls operate where ever there's a socially divisive issue (issues that can/are be politicized). * **Belongs to tactic stage**: TA09 @@ -26,41 +26,41 @@ | Counters | Response types | | -------- | -------------- | -| [C00006 Charge for social media](../counters/C00006.md) | D2 Deny | -| [C00009 Educate high profile influencers on best practices](../counters/C00009.md) | D2 Deny | -| [C00012 Platform regulation](../counters/C00012.md) | D2 Deny | -| [C00016 Censorship](../counters/C00016.md) | D2 Deny | -| [C00019 Reduce effect of division-enablers](../counters/C00019.md) | D3 Disrupt | -| [C00021 Encourage in-person communication](../counters/C00021.md) | D4 Degrade | -| [C00022 Innoculate. Positive campaign to promote feeling of safety](../counters/C00022.md) | D4 Degrade | -| [C00024 Promote healthy narratives](../counters/C00024.md) | D4 Degrade | -| [C00027 Create culture of civility](../counters/C00027.md) | D7 Deter | -| [C00044 Keep people from posting to social media immediately](../counters/C00044.md) | D3 Disrupt | -| [C00046 Marginalise and discredit extremist groups](../counters/C00046.md) | D4 Degrade | -| [C00048 Name and Shame Influencers](../counters/C00048.md) | D7 Deter | -| [C00073 Inoculate populations through media literacy training](../counters/C00073.md) | D2 Deny | -| [C00074 Identify and delete or rate limit identical content](../counters/C00074.md) | D2 Deny | -| [C00081 Highlight flooding and noise, and explain motivations](../counters/C00081.md) | D3 Disrupt | -| [C00082 Ground truthing as automated response to pollution](../counters/C00082.md) | D3 Disrupt | -| [C00085 Mute content](../counters/C00085.md) | D3 Disrupt | -| [C00086 Distract from noise with addictive content](../counters/C00086.md) | D4 Degrade | -| [C00087 Make more noise than the disinformation](../counters/C00087.md) | D4 Degrade | -| [C00091 Honeypot social community](../counters/C00091.md) | D5 Deceive | -| [C00092 Establish a truth teller reputation score for influencers](../counters/C00092.md) | D7 Deter | -| [C00093 Influencer code of conduct](../counters/C00093.md) | D7 Deter | -| [C00097 Require use of verified identities to contribute to poll or comment](../counters/C00097.md) | D2 Deny | -| [C00101 Create friction by rate-limiting engagement](../counters/C00101.md) | D4 Degrade | -| [C00103 Create a bot that engages / distract trolls](../counters/C00103.md) | D5 Deceive | -| [C00115 Expose actor and intentions](../counters/C00115.md) | D2 Deny | -| [C00120 Open dialogue about design of platforms to produce different outcomes](../counters/C00120.md) | D7 Deter | -| [C00122 Content moderation](../counters/C00122.md) | D2 Deny | -| [C00124 Don't feed the trolls](../counters/C00124.md) | D3 Disrupt | -| [C00125 Prebunking](../counters/C00125.md) | D3 Disrupt | -| [C00126 Social media amber alert](../counters/C00126.md) | D3 Disrupt | -| [C00128 Create friction by marking content with ridicule or other "decelerants"](../counters/C00128.md) | D3 Disrupt | -| [C00144 Buy out troll farm employees / offer them jobs](../counters/C00144.md) | D4 Degrade | -| [C00153 Take pre-emptive action against actors' infrastructure](../counters/C00153.md) | D3 Disrupt | -| [C00176 Improve Coordination amongst stakeholders: public and private](../counters/C00176.md) | D7 Deter | +| [C00006 Charge for social media](../counters/C00006.md) | D02 | +| [C00009 Educate high profile influencers on best practices](../counters/C00009.md) | D02 | +| [C00012 Platform regulation](../counters/C00012.md) | D02 | +| [C00016 Censorship](../counters/C00016.md) | D02 | +| [C00019 Reduce effect of division-enablers](../counters/C00019.md) | D03 | +| [C00021 Encourage in-person communication](../counters/C00021.md) | D04 | +| [C00022 Innoculate. Positive campaign to promote feeling of safety](../counters/C00022.md) | D04 | +| [C00024 Promote healthy narratives](../counters/C00024.md) | D04 | +| [C00027 Create culture of civility](../counters/C00027.md) | D07 | +| [C00044 Keep people from posting to social media immediately](../counters/C00044.md) | D03 | +| [C00046 Marginalise and discredit extremist groups](../counters/C00046.md) | D04 | +| [C00048 Name and Shame Influencers](../counters/C00048.md) | D07 | +| [C00073 Inoculate populations through media literacy training](../counters/C00073.md) | D02 | +| [C00074 Identify and delete or rate limit identical content](../counters/C00074.md) | D02 | +| [C00081 Highlight flooding and noise, and explain motivations](../counters/C00081.md) | D03 | +| [C00082 Ground truthing as automated response to pollution](../counters/C00082.md) | D03 | +| [C00085 Mute content](../counters/C00085.md) | D03 | +| [C00086 Distract from noise with addictive content](../counters/C00086.md) | D04 | +| [C00087 Make more noise than the disinformation](../counters/C00087.md) | D04 | +| [C00091 Honeypot social community](../counters/C00091.md) | D05 | +| [C00092 Establish a truth teller reputation score for influencers](../counters/C00092.md) | D07 | +| [C00093 Influencer code of conduct](../counters/C00093.md) | D07 | +| [C00097 Require use of verified identities to contribute to poll or comment](../counters/C00097.md) | D02 | +| [C00101 Create friction by rate-limiting engagement](../counters/C00101.md) | D04 | +| [C00103 Create a bot that engages / distract trolls](../counters/C00103.md) | D05 | +| [C00115 Expose actor and intentions](../counters/C00115.md) | D02 | +| [C00120 Open dialogue about design of platforms to produce different outcomes](../counters/C00120.md) | D07 | +| [C00122 Content moderation](../counters/C00122.md) | D02 | +| [C00124 Don't feed the trolls](../counters/C00124.md) | D03 | +| [C00125 Prebunking](../counters/C00125.md) | D03 | +| [C00126 Social media amber alert](../counters/C00126.md) | D03 | +| [C00128 Create friction by marking content with ridicule or other "decelerants"](../counters/C00128.md) | D03 | +| [C00144 Buy out troll farm employees / offer them jobs](../counters/C00144.md) | D04 | +| [C00153 Take pre-emptive action against actors' infrastructure](../counters/C00153.md) | D03 | +| [C00176 Improve Coordination amongst stakeholders: public and private](../counters/C00176.md) | D07 | DO NOT EDIT ABOVE THIS LINE - PLEASE ADD NOTES BELOW \ No newline at end of file diff --git a/techniques/T0054.md b/techniques/T0054.md index cb8cef9..7372c62 100644 --- a/techniques/T0054.md +++ b/techniques/T0054.md @@ -1,6 +1,6 @@ # Technique T0054: Twitter bots amplify -* **Summary**: Use bots to amplify narratives above algorithm thresholds. Bots are automated/programmed profiles designed to amplify content (ie: automatically retweet or like) and give appearance it's more "popular" than it is. They can operate as a network, to function in a coordinated/orchestrated manner. In some cases (more so now) they are an inexpensive/disposable assets used for minimal deployment as bot detection tools improve and platforms are more responsive.(example 2019) #TrudeauMustGo +* **Summary**: Use bots to amplify narratives above algorithm thresholds. Bots are automated/programmed profiles designed to amplify content (ie: automatically retweet or like) and give appearance it's more "popular" than it is. They can operate as a network, to function in a coordinated/orchestrated manner. In some cases (more so now) they are an inexpensive/disposable assets used for minimal deployment as bot detection tools improve and platforms are more responsive. * **Belongs to tactic stage**: TA09 @@ -27,32 +27,32 @@ | Counters | Response types | | -------- | -------------- | -| [C00006 Charge for social media](../counters/C00006.md) | D2 Deny | -| [C00012 Platform regulation](../counters/C00012.md) | D2 Deny | -| [C00016 Censorship](../counters/C00016.md) | D2 Deny | -| [C00044 Keep people from posting to social media immediately](../counters/C00044.md) | D3 Disrupt | -| [C00046 Marginalise and discredit extremist groups](../counters/C00046.md) | D4 Degrade | -| [C00048 Name and Shame Influencers](../counters/C00048.md) | D7 Deter | -| [C00074 Identify and delete or rate limit identical content](../counters/C00074.md) | D2 Deny | -| [C00081 Highlight flooding and noise, and explain motivations](../counters/C00081.md) | D3 Disrupt | -| [C00082 Ground truthing as automated response to pollution](../counters/C00082.md) | D3 Disrupt | -| [C00085 Mute content](../counters/C00085.md) | D3 Disrupt | -| [C00086 Distract from noise with addictive content](../counters/C00086.md) | D4 Degrade | -| [C00087 Make more noise than the disinformation](../counters/C00087.md) | D4 Degrade | -| [C00091 Honeypot social community](../counters/C00091.md) | D5 Deceive | -| [C00092 Establish a truth teller reputation score for influencers](../counters/C00092.md) | D7 Deter | -| [C00097 Require use of verified identities to contribute to poll or comment](../counters/C00097.md) | D2 Deny | -| [C00101 Create friction by rate-limiting engagement](../counters/C00101.md) | D4 Degrade | -| [C00120 Open dialogue about design of platforms to produce different outcomes](../counters/C00120.md) | D7 Deter | -| [C00122 Content moderation](../counters/C00122.md) | D2 Deny | -| [C00123 Remove or rate limit botnets](../counters/C00123.md) | D3 Disrupt | -| [C00125 Prebunking](../counters/C00125.md) | D3 Disrupt | -| [C00126 Social media amber alert](../counters/C00126.md) | D3 Disrupt | -| [C00128 Create friction by marking content with ridicule or other "decelerants"](../counters/C00128.md) | D3 Disrupt | -| [C00131 Seize and analyse botnet servers](../counters/C00131.md) | D2 Deny | -| [C00153 Take pre-emptive action against actors' infrastructure](../counters/C00153.md) | D3 Disrupt | -| [C00176 Improve Coordination amongst stakeholders: public and private](../counters/C00176.md) | D7 Deter | -| [C00182 Redirection / malware detection/ remediation](../counters/C00182.md) | D2 Deny | +| [C00006 Charge for social media](../counters/C00006.md) | D02 | +| [C00012 Platform regulation](../counters/C00012.md) | D02 | +| [C00016 Censorship](../counters/C00016.md) | D02 | +| [C00044 Keep people from posting to social media immediately](../counters/C00044.md) | D03 | +| [C00046 Marginalise and discredit extremist groups](../counters/C00046.md) | D04 | +| [C00048 Name and Shame Influencers](../counters/C00048.md) | D07 | +| [C00074 Identify and delete or rate limit identical content](../counters/C00074.md) | D02 | +| [C00081 Highlight flooding and noise, and explain motivations](../counters/C00081.md) | D03 | +| [C00082 Ground truthing as automated response to pollution](../counters/C00082.md) | D03 | +| [C00085 Mute content](../counters/C00085.md) | D03 | +| [C00086 Distract from noise with addictive content](../counters/C00086.md) | D04 | +| [C00087 Make more noise than the disinformation](../counters/C00087.md) | D04 | +| [C00091 Honeypot social community](../counters/C00091.md) | D05 | +| [C00092 Establish a truth teller reputation score for influencers](../counters/C00092.md) | D07 | +| [C00097 Require use of verified identities to contribute to poll or comment](../counters/C00097.md) | D02 | +| [C00101 Create friction by rate-limiting engagement](../counters/C00101.md) | D04 | +| [C00120 Open dialogue about design of platforms to produce different outcomes](../counters/C00120.md) | D07 | +| [C00122 Content moderation](../counters/C00122.md) | D02 | +| [C00123 Remove or rate limit botnets](../counters/C00123.md) | D03 | +| [C00125 Prebunking](../counters/C00125.md) | D03 | +| [C00126 Social media amber alert](../counters/C00126.md) | D03 | +| [C00128 Create friction by marking content with ridicule or other "decelerants"](../counters/C00128.md) | D03 | +| [C00131 Seize and analyse botnet servers](../counters/C00131.md) | D02 | +| [C00153 Take pre-emptive action against actors' infrastructure](../counters/C00153.md) | D03 | +| [C00176 Improve Coordination amongst stakeholders: public and private](../counters/C00176.md) | D07 | +| [C00182 Redirection / malware detection/ remediation](../counters/C00182.md) | D02 | DO NOT EDIT ABOVE THIS LINE - PLEASE ADD NOTES BELOW \ No newline at end of file diff --git a/techniques/T0055.md b/techniques/T0055.md index 58a765b..90e66de 100644 --- a/techniques/T0055.md +++ b/techniques/T0055.md @@ -1,6 +1,6 @@ # Technique T0055: Use hashtag -* **Summary**: Use a dedicated hashtag for the incident (e.g. #PhosphorusDisaster) - either create a campaign/incident specific hashtag, or take over an existing hashtag. +* **Summary**: Use a dedicated hashtag for the incident - either create a campaign/incident specific hashtag, or take over an existing hashtag. * **Belongs to tactic stage**: TA09 @@ -13,31 +13,31 @@ | Counters | Response types | | -------- | -------------- | -| [C00009 Educate high profile influencers on best practices](../counters/C00009.md) | D2 Deny | -| [C00012 Platform regulation](../counters/C00012.md) | D2 Deny | -| [C00016 Censorship](../counters/C00016.md) | D2 Deny | -| [C00032 Hijack content and link to truth- based info](../counters/C00032.md) | D3 Disrupt | -| [C00044 Keep people from posting to social media immediately](../counters/C00044.md) | D3 Disrupt | -| [C00066 Co-opt a hashtag and drown it out (hijack it back)](../counters/C00066.md) | D3 Disrupt | -| [C00070 Block access to disinformation resources](../counters/C00070.md) | D2 Deny | -| [C00072 Remove non-relevant content from special interest groups - not recommended](../counters/C00072.md) | D2 Deny | -| [C00074 Identify and delete or rate limit identical content](../counters/C00074.md) | D2 Deny | -| [C00081 Highlight flooding and noise, and explain motivations](../counters/C00081.md) | D3 Disrupt | -| [C00082 Ground truthing as automated response to pollution](../counters/C00082.md) | D3 Disrupt | -| [C00085 Mute content](../counters/C00085.md) | D3 Disrupt | -| [C00086 Distract from noise with addictive content](../counters/C00086.md) | D4 Degrade | -| [C00087 Make more noise than the disinformation](../counters/C00087.md) | D4 Degrade | -| [C00100 Hashtag jacking](../counters/C00100.md) | D3 Disrupt | -| [C00107 Content moderation](../counters/C00107.md) | D2 Deny | -| [C00120 Open dialogue about design of platforms to produce different outcomes](../counters/C00120.md) | D7 Deter | -| [C00122 Content moderation](../counters/C00122.md) | D2 Deny | -| [C00125 Prebunking](../counters/C00125.md) | D3 Disrupt | -| [C00126 Social media amber alert](../counters/C00126.md) | D3 Disrupt | -| [C00128 Create friction by marking content with ridicule or other "decelerants"](../counters/C00128.md) | D3 Disrupt | -| [C00176 Improve Coordination amongst stakeholders: public and private](../counters/C00176.md) | D7 Deter | -| [C00184 Media exposure](../counters/C00184.md) | D4 Degrade | -| [C00195 Redirect searches away from disinformation or extremist content ](../counters/C00195.md) | D2 Deny | -| [C00211 Use humorous counter-narratives](../counters/C00211.md) | D3 Disrupt | +| [C00009 Educate high profile influencers on best practices](../counters/C00009.md) | D02 | +| [C00012 Platform regulation](../counters/C00012.md) | D02 | +| [C00016 Censorship](../counters/C00016.md) | D02 | +| [C00032 Hijack content and link to truth- based info](../counters/C00032.md) | D03 | +| [C00044 Keep people from posting to social media immediately](../counters/C00044.md) | D03 | +| [C00066 Co-opt a hashtag and drown it out (hijack it back)](../counters/C00066.md) | D03 | +| [C00070 Block access to disinformation resources](../counters/C00070.md) | D02 | +| [C00072 Remove non-relevant content from special interest groups - not recommended](../counters/C00072.md) | D02 | +| [C00074 Identify and delete or rate limit identical content](../counters/C00074.md) | D02 | +| [C00081 Highlight flooding and noise, and explain motivations](../counters/C00081.md) | D03 | +| [C00082 Ground truthing as automated response to pollution](../counters/C00082.md) | D03 | +| [C00085 Mute content](../counters/C00085.md) | D03 | +| [C00086 Distract from noise with addictive content](../counters/C00086.md) | D04 | +| [C00087 Make more noise than the disinformation](../counters/C00087.md) | D04 | +| [C00100 Hashtag jacking](../counters/C00100.md) | D03 | +| [C00107 Content moderation](../counters/C00107.md) | D02 | +| [C00120 Open dialogue about design of platforms to produce different outcomes](../counters/C00120.md) | D07 | +| [C00122 Content moderation](../counters/C00122.md) | D02 | +| [C00125 Prebunking](../counters/C00125.md) | D03 | +| [C00126 Social media amber alert](../counters/C00126.md) | D03 | +| [C00128 Create friction by marking content with ridicule or other "decelerants"](../counters/C00128.md) | D03 | +| [C00176 Improve Coordination amongst stakeholders: public and private](../counters/C00176.md) | D07 | +| [C00184 Media exposure](../counters/C00184.md) | D04 | +| [C00195 Redirect searches away from disinformation or extremist content ](../counters/C00195.md) | D02 | +| [C00211 Use humorous counter-narratives](../counters/C00211.md) | D03 | DO NOT EDIT ABOVE THIS LINE - PLEASE ADD NOTES BELOW \ No newline at end of file diff --git a/techniques/T0056.md b/techniques/T0056.md index 7f3ac5f..562bbb7 100644 --- a/techniques/T0056.md +++ b/techniques/T0056.md @@ -1,6 +1,6 @@ # Technique T0056: Dedicated channels disseminate information pollution -* **Summary**: Output information pollution (e.g. articles on an unreported false story/event) through channels controlled by or related to the incident creator. Examples include RT/Sputnik or antivax websites seeding stories. +* **Summary**: Output information pollution (e.g. articles on an unreported false story/event) through channels controlled by or related to the incident creator. * **Belongs to tactic stage**: TA09 @@ -25,40 +25,40 @@ | Counters | Response types | | -------- | -------------- | -| [C00008 Create shared fact-checking database](../counters/C00008.md) | D4 Degrade | -| [C00009 Educate high profile influencers on best practices](../counters/C00009.md) | D2 Deny | -| [C00011 Media literacy. Games to identify fake news](../counters/C00011.md) | D2 Deny | -| [C00012 Platform regulation](../counters/C00012.md) | D2 Deny | -| [C00013 Rating framework for news](../counters/C00013.md) | D2 Deny | -| [C00014 Real-time updates to fact-checking database](../counters/C00014.md) | D4 Degrade | -| [C00016 Censorship](../counters/C00016.md) | D2 Deny | -| [C00019 Reduce effect of division-enablers](../counters/C00019.md) | D3 Disrupt | -| [C00036 Infiltrate the in-group to discredit leaders (divide)](../counters/C00036.md) | D2 Deny | -| [C00042 Address truth contained in narratives](../counters/C00042.md) | D4 Degrade | -| [C00044 Keep people from posting to social media immediately](../counters/C00044.md) | D3 Disrupt | -| [C00046 Marginalise and discredit extremist groups](../counters/C00046.md) | D4 Degrade | -| [C00048 Name and Shame Influencers](../counters/C00048.md) | D7 Deter | -| [C00070 Block access to disinformation resources](../counters/C00070.md) | D2 Deny | -| [C00071 Block source of pollution](../counters/C00071.md) | D2 Deny | -| [C00073 Inoculate populations through media literacy training](../counters/C00073.md) | D2 Deny | -| [C00073 Inoculate populations through media literacy training](../counters/C00073.md) | D2 Deny | -| [C00078 Change Search Algorithms for Disinformation Content](../counters/C00078.md) | D3 Disrupt | -| [C00081 Highlight flooding and noise, and explain motivations](../counters/C00081.md) | D3 Disrupt | -| [C00082 Ground truthing as automated response to pollution](../counters/C00082.md) | D3 Disrupt | -| [C00085 Mute content](../counters/C00085.md) | D3 Disrupt | -| [C00087 Make more noise than the disinformation](../counters/C00087.md) | D4 Degrade | -| [C00092 Establish a truth teller reputation score for influencers](../counters/C00092.md) | D7 Deter | -| [C00115 Expose actor and intentions](../counters/C00115.md) | D2 Deny | -| [C00120 Open dialogue about design of platforms to produce different outcomes](../counters/C00120.md) | D7 Deter | -| [C00122 Content moderation](../counters/C00122.md) | D2 Deny | -| [C00125 Prebunking](../counters/C00125.md) | D3 Disrupt | -| [C00126 Social media amber alert](../counters/C00126.md) | D3 Disrupt | -| [C00128 Create friction by marking content with ridicule or other "decelerants"](../counters/C00128.md) | D3 Disrupt | -| [C00138 Spam domestic actors with lawsuits](../counters/C00138.md) | D3 Disrupt | -| [C00153 Take pre-emptive action against actors' infrastructure](../counters/C00153.md) | D3 Disrupt | -| [C00162 Unravel/target the Potemkin villages](../counters/C00162.md) | D3 Disrupt | -| [C00176 Improve Coordination amongst stakeholders: public and private](../counters/C00176.md) | D7 Deter | -| [C00203 Stop offering press credentials to propaganda outlets](../counters/C00203.md) | D3 Disrupt | +| [C00008 Create shared fact-checking database](../counters/C00008.md) | D04 | +| [C00009 Educate high profile influencers on best practices](../counters/C00009.md) | D02 | +| [C00011 Media literacy. Games to identify fake news](../counters/C00011.md) | D02 | +| [C00012 Platform regulation](../counters/C00012.md) | D02 | +| [C00013 Rating framework for news](../counters/C00013.md) | D02 | +| [C00014 Real-time updates to fact-checking database](../counters/C00014.md) | D04 | +| [C00016 Censorship](../counters/C00016.md) | D02 | +| [C00019 Reduce effect of division-enablers](../counters/C00019.md) | D03 | +| [C00036 Infiltrate the in-group to discredit leaders (divide)](../counters/C00036.md) | D02 | +| [C00042 Address truth contained in narratives](../counters/C00042.md) | D04 | +| [C00044 Keep people from posting to social media immediately](../counters/C00044.md) | D03 | +| [C00046 Marginalise and discredit extremist groups](../counters/C00046.md) | D04 | +| [C00048 Name and Shame Influencers](../counters/C00048.md) | D07 | +| [C00070 Block access to disinformation resources](../counters/C00070.md) | D02 | +| [C00071 Block source of pollution](../counters/C00071.md) | D02 | +| [C00073 Inoculate populations through media literacy training](../counters/C00073.md) | D02 | +| [C00073 Inoculate populations through media literacy training](../counters/C00073.md) | D02 | +| [C00078 Change Search Algorithms for Disinformation Content](../counters/C00078.md) | D03 | +| [C00081 Highlight flooding and noise, and explain motivations](../counters/C00081.md) | D03 | +| [C00082 Ground truthing as automated response to pollution](../counters/C00082.md) | D03 | +| [C00085 Mute content](../counters/C00085.md) | D03 | +| [C00087 Make more noise than the disinformation](../counters/C00087.md) | D04 | +| [C00092 Establish a truth teller reputation score for influencers](../counters/C00092.md) | D07 | +| [C00115 Expose actor and intentions](../counters/C00115.md) | D02 | +| [C00120 Open dialogue about design of platforms to produce different outcomes](../counters/C00120.md) | D07 | +| [C00122 Content moderation](../counters/C00122.md) | D02 | +| [C00125 Prebunking](../counters/C00125.md) | D03 | +| [C00126 Social media amber alert](../counters/C00126.md) | D03 | +| [C00128 Create friction by marking content with ridicule or other "decelerants"](../counters/C00128.md) | D03 | +| [C00138 Spam domestic actors with lawsuits](../counters/C00138.md) | D03 | +| [C00153 Take pre-emptive action against actors' infrastructure](../counters/C00153.md) | D03 | +| [C00162 Unravel/target the Potemkin villages](../counters/C00162.md) | D03 | +| [C00176 Improve Coordination amongst stakeholders: public and private](../counters/C00176.md) | D07 | +| [C00203 Stop offering press credentials to propaganda outlets](../counters/C00203.md) | D03 | DO NOT EDIT ABOVE THIS LINE - PLEASE ADD NOTES BELOW \ No newline at end of file diff --git a/techniques/T0057.md b/techniques/T0057.md index 08fb090..e43a658 100644 --- a/techniques/T0057.md +++ b/techniques/T0057.md @@ -1,6 +1,6 @@ # Technique T0057: Organise remote rallies and events -* **Summary**: Coordinate and promote real-world events across media platforms, e.g. rallies, protests, gatherings in support of incident narratives. Example: Facebook groups/pages coordinate/more divisive/polarizing groups and actvities into the public space. (Example) Mueller's report, highlights, the IRA organized political rallies in the U.S. using social media starting in 2015 and continued to coordinate rallies after the 2016 election +* **Summary**: Coordinate and promote real-world events across media platforms, e.g. rallies, protests, gatherings in support of incident narratives. * **Belongs to tactic stage**: TA10 @@ -16,24 +16,24 @@ | Counters | Response types | | -------- | -------------- | -| [C00012 Platform regulation](../counters/C00012.md) | D2 Deny | -| [C00016 Censorship](../counters/C00016.md) | D2 Deny | -| [C00036 Infiltrate the in-group to discredit leaders (divide)](../counters/C00036.md) | D2 Deny | -| [C00046 Marginalise and discredit extremist groups](../counters/C00046.md) | D4 Degrade | -| [C00048 Name and Shame Influencers](../counters/C00048.md) | D7 Deter | -| [C00070 Block access to disinformation resources](../counters/C00070.md) | D2 Deny | -| [C00074 Identify and delete or rate limit identical content](../counters/C00074.md) | D2 Deny | -| [C00085 Mute content](../counters/C00085.md) | D3 Disrupt | -| [C00107 Content moderation](../counters/C00107.md) | D2 Deny | -| [C00122 Content moderation](../counters/C00122.md) | D2 Deny | -| [C00126 Social media amber alert](../counters/C00126.md) | D3 Disrupt | -| [C00128 Create friction by marking content with ridicule or other "decelerants"](../counters/C00128.md) | D3 Disrupt | -| [C00129 Use banking to cut off access ](../counters/C00129.md) | D2 Deny | -| [C00149 Poison the monitoring & evaluation data](../counters/C00149.md) | D4 Degrade | -| [C00153 Take pre-emptive action against actors' infrastructure](../counters/C00153.md) | D3 Disrupt | -| [C00176 Improve Coordination amongst stakeholders: public and private](../counters/C00176.md) | D7 Deter | -| [C00211 Use humorous counter-narratives](../counters/C00211.md) | D3 Disrupt | -| [C00216 Use advertiser controls to stem flow of funds to bad actors](../counters/C00216.md) | D2 Deny | +| [C00012 Platform regulation](../counters/C00012.md) | D02 | +| [C00016 Censorship](../counters/C00016.md) | D02 | +| [C00036 Infiltrate the in-group to discredit leaders (divide)](../counters/C00036.md) | D02 | +| [C00046 Marginalise and discredit extremist groups](../counters/C00046.md) | D04 | +| [C00048 Name and Shame Influencers](../counters/C00048.md) | D07 | +| [C00070 Block access to disinformation resources](../counters/C00070.md) | D02 | +| [C00074 Identify and delete or rate limit identical content](../counters/C00074.md) | D02 | +| [C00085 Mute content](../counters/C00085.md) | D03 | +| [C00107 Content moderation](../counters/C00107.md) | D02 | +| [C00122 Content moderation](../counters/C00122.md) | D02 | +| [C00126 Social media amber alert](../counters/C00126.md) | D03 | +| [C00128 Create friction by marking content with ridicule or other "decelerants"](../counters/C00128.md) | D03 | +| [C00129 Use banking to cut off access ](../counters/C00129.md) | D02 | +| [C00149 Poison the monitoring & evaluation data](../counters/C00149.md) | D04 | +| [C00153 Take pre-emptive action against actors' infrastructure](../counters/C00153.md) | D03 | +| [C00176 Improve Coordination amongst stakeholders: public and private](../counters/C00176.md) | D07 | +| [C00211 Use humorous counter-narratives](../counters/C00211.md) | D03 | +| [C00216 Use advertiser controls to stem flow of funds to bad actors](../counters/C00216.md) | D02 | DO NOT EDIT ABOVE THIS LINE - PLEASE ADD NOTES BELOW \ No newline at end of file diff --git a/techniques/T0058.md b/techniques/T0058.md index e731a44..d1f8377 100644 --- a/techniques/T0058.md +++ b/techniques/T0058.md @@ -14,11 +14,11 @@ | Counters | Response types | | -------- | -------------- | -| [C00016 Censorship](../counters/C00016.md) | D2 Deny | -| [C00070 Block access to disinformation resources](../counters/C00070.md) | D2 Deny | -| [C00143 (botnet) DMCA takedown requests to waste group time](../counters/C00143.md) | D4 Degrade | -| [C00153 Take pre-emptive action against actors' infrastructure](../counters/C00153.md) | D3 Disrupt | -| [C00176 Improve Coordination amongst stakeholders: public and private](../counters/C00176.md) | D7 Deter | +| [C00016 Censorship](../counters/C00016.md) | D02 | +| [C00070 Block access to disinformation resources](../counters/C00070.md) | D02 | +| [C00143 (botnet) DMCA takedown requests to waste group time](../counters/C00143.md) | D04 | +| [C00153 Take pre-emptive action against actors' infrastructure](../counters/C00153.md) | D03 | +| [C00176 Improve Coordination amongst stakeholders: public and private](../counters/C00176.md) | D07 | DO NOT EDIT ABOVE THIS LINE - PLEASE ADD NOTES BELOW \ No newline at end of file diff --git a/techniques/T0059.md b/techniques/T0059.md index b71a8b1..6c49b60 100644 --- a/techniques/T0059.md +++ b/techniques/T0059.md @@ -1,7 +1,7 @@ # Technique T0059: Play the long game * **Summary**: Play the long game can mean a couple of things: -1. To plan messaging and allow it to grow organically without conducting your own amplification. This is methodical and slow and requires years for the message to take hold (e.g. China and its constant messaging that Taiwan and Hong Kong are part of one China). +1. To plan messaging and allow it to grow organically without conducting your own amplification. This is methodical and slow and requires years for the message to take hold 2. To develop a series of seemingly disconnected messaging narratives that eventually combine into a new narrative. * **Belongs to tactic stage**: TA11 @@ -14,8 +14,8 @@ | Counters | Response types | | -------- | -------------- | -| [C00042 Address truth contained in narratives](../counters/C00042.md) | D4 Degrade | -| [C00084 Modify disinformation narratives, and rebroadcast them](../counters/C00084.md) | D3 Disrupt | +| [C00042 Address truth contained in narratives](../counters/C00042.md) | D04 | +| [C00084 Modify disinformation narratives, and rebroadcast them](../counters/C00084.md) | D03 | DO NOT EDIT ABOVE THIS LINE - PLEASE ADD NOTES BELOW \ No newline at end of file diff --git a/techniques/T0060.md b/techniques/T0060.md index 6e8f6c0..d63f79a 100644 --- a/techniques/T0060.md +++ b/techniques/T0060.md @@ -12,20 +12,20 @@ | Counters | Response types | | -------- | -------------- | -| [C00046 Marginalise and discredit extremist groups](../counters/C00046.md) | D4 Degrade | -| [C00048 Name and Shame Influencers](../counters/C00048.md) | D7 Deter | -| [C00073 Inoculate populations through media literacy training](../counters/C00073.md) | D2 Deny | -| [C00074 Identify and delete or rate limit identical content](../counters/C00074.md) | D2 Deny | -| [C00078 Change Search Algorithms for Disinformation Content](../counters/C00078.md) | D3 Disrupt | -| [C00085 Mute content](../counters/C00085.md) | D3 Disrupt | -| [C00117 Downgrade / de-amplify so message is seen by fewer people](../counters/C00117.md) | D4 Degrade | -| [C00119 Engage payload and debunk.](../counters/C00119.md) | D7 Deter | -| [C00122 Content moderation](../counters/C00122.md) | D2 Deny | -| [C00123 Remove or rate limit botnets](../counters/C00123.md) | D3 Disrupt | -| [C00131 Seize and analyse botnet servers](../counters/C00131.md) | D2 Deny | -| [C00138 Spam domestic actors with lawsuits](../counters/C00138.md) | D3 Disrupt | -| [C00143 (botnet) DMCA takedown requests to waste group time](../counters/C00143.md) | D4 Degrade | -| [C00147 Make amplification of social media posts expire (e.g. can't like/ retweet after n days)](../counters/C00147.md) | D3 Disrupt | +| [C00046 Marginalise and discredit extremist groups](../counters/C00046.md) | D04 | +| [C00048 Name and Shame Influencers](../counters/C00048.md) | D07 | +| [C00073 Inoculate populations through media literacy training](../counters/C00073.md) | D02 | +| [C00074 Identify and delete or rate limit identical content](../counters/C00074.md) | D02 | +| [C00078 Change Search Algorithms for Disinformation Content](../counters/C00078.md) | D03 | +| [C00085 Mute content](../counters/C00085.md) | D03 | +| [C00117 Downgrade / de-amplify so message is seen by fewer people](../counters/C00117.md) | D04 | +| [C00119 Engage payload and debunk.](../counters/C00119.md) | D07 | +| [C00122 Content moderation](../counters/C00122.md) | D02 | +| [C00123 Remove or rate limit botnets](../counters/C00123.md) | D03 | +| [C00131 Seize and analyse botnet servers](../counters/C00131.md) | D02 | +| [C00138 Spam domestic actors with lawsuits](../counters/C00138.md) | D03 | +| [C00143 (botnet) DMCA takedown requests to waste group time](../counters/C00143.md) | D04 | +| [C00147 Make amplification of social media posts expire (e.g. can't like/ retweet after n days)](../counters/C00147.md) | D03 | DO NOT EDIT ABOVE THIS LINE - PLEASE ADD NOTES BELOW \ No newline at end of file diff --git a/techniques/T0061.md b/techniques/T0061.md index f175f86..f292b25 100644 --- a/techniques/T0061.md +++ b/techniques/T0061.md @@ -12,20 +12,20 @@ | Counters | Response types | | -------- | -------------- | -| [C00012 Platform regulation](../counters/C00012.md) | D2 Deny | -| [C00046 Marginalise and discredit extremist groups](../counters/C00046.md) | D4 Degrade | -| [C00048 Name and Shame Influencers](../counters/C00048.md) | D7 Deter | -| [C00058 Report crowdfunder as violator](../counters/C00058.md) | D2 Deny | -| [C00067 Denigrate the recipient/ project (of online funding)](../counters/C00067.md) | D3 Disrupt | -| [C00074 Identify and delete or rate limit identical content](../counters/C00074.md) | D2 Deny | -| [C00085 Mute content](../counters/C00085.md) | D3 Disrupt | -| [C00107 Content moderation](../counters/C00107.md) | D2 Deny | -| [C00122 Content moderation](../counters/C00122.md) | D2 Deny | -| [C00128 Create friction by marking content with ridicule or other "decelerants"](../counters/C00128.md) | D3 Disrupt | -| [C00129 Use banking to cut off access ](../counters/C00129.md) | D2 Deny | -| [C00153 Take pre-emptive action against actors' infrastructure](../counters/C00153.md) | D3 Disrupt | -| [C00176 Improve Coordination amongst stakeholders: public and private](../counters/C00176.md) | D7 Deter | -| [C00216 Use advertiser controls to stem flow of funds to bad actors](../counters/C00216.md) | D2 Deny | +| [C00012 Platform regulation](../counters/C00012.md) | D02 | +| [C00046 Marginalise and discredit extremist groups](../counters/C00046.md) | D04 | +| [C00048 Name and Shame Influencers](../counters/C00048.md) | D07 | +| [C00058 Report crowdfunder as violator](../counters/C00058.md) | D02 | +| [C00067 Denigrate the recipient/ project (of online funding)](../counters/C00067.md) | D03 | +| [C00074 Identify and delete or rate limit identical content](../counters/C00074.md) | D02 | +| [C00085 Mute content](../counters/C00085.md) | D03 | +| [C00107 Content moderation](../counters/C00107.md) | D02 | +| [C00122 Content moderation](../counters/C00122.md) | D02 | +| [C00128 Create friction by marking content with ridicule or other "decelerants"](../counters/C00128.md) | D03 | +| [C00129 Use banking to cut off access ](../counters/C00129.md) | D02 | +| [C00153 Take pre-emptive action against actors' infrastructure](../counters/C00153.md) | D03 | +| [C00176 Improve Coordination amongst stakeholders: public and private](../counters/C00176.md) | D07 | +| [C00216 Use advertiser controls to stem flow of funds to bad actors](../counters/C00216.md) | D02 | DO NOT EDIT ABOVE THIS LINE - PLEASE ADD NOTES BELOW \ No newline at end of file diff --git a/techniques/T0062.md b/techniques/T0062.md index 7ea32e3..146ba3a 100644 --- a/techniques/T0062.md +++ b/techniques/T0062.md @@ -12,11 +12,11 @@ | Counters | Response types | | -------- | -------------- | -| [C00047 Honeypot with coordinated inauthentics](../counters/C00047.md) | D5 Deceive | -| [C00090 Fake engagement system](../counters/C00090.md) | D5 Deceive | -| [C00091 Honeypot social community](../counters/C00091.md) | D5 Deceive | -| [C00103 Create a bot that engages / distract trolls](../counters/C00103.md) | D5 Deceive | -| [C00148 Add random links to network graphs](../counters/C00148.md) | D4 Degrade | +| [C00047 Honeypot with coordinated inauthentics](../counters/C00047.md) | D05 | +| [C00090 Fake engagement system](../counters/C00090.md) | D05 | +| [C00091 Honeypot social community](../counters/C00091.md) | D05 | +| [C00103 Create a bot that engages / distract trolls](../counters/C00103.md) | D05 | +| [C00148 Add random links to network graphs](../counters/C00148.md) | D04 | DO NOT EDIT ABOVE THIS LINE - PLEASE ADD NOTES BELOW \ No newline at end of file diff --git a/techniques/T0063.md b/techniques/T0063.md index 313c4be..0379311 100644 --- a/techniques/T0063.md +++ b/techniques/T0063.md @@ -12,14 +12,14 @@ | Counters | Response types | | -------- | -------------- | -| [C00047 Honeypot with coordinated inauthentics](../counters/C00047.md) | D5 Deceive | -| [C00090 Fake engagement system](../counters/C00090.md) | D5 Deceive | -| [C00091 Honeypot social community](../counters/C00091.md) | D5 Deceive | -| [C00103 Create a bot that engages / distract trolls](../counters/C00103.md) | D5 Deceive | -| [C00124 Don't feed the trolls](../counters/C00124.md) | D3 Disrupt | -| [C00136 Microtarget most likely targets then send them countermessages](../counters/C00136.md) | D3 Disrupt | -| [C00148 Add random links to network graphs](../counters/C00148.md) | D4 Degrade | -| [C00149 Poison the monitoring & evaluation data](../counters/C00149.md) | D4 Degrade | +| [C00047 Honeypot with coordinated inauthentics](../counters/C00047.md) | D05 | +| [C00090 Fake engagement system](../counters/C00090.md) | D05 | +| [C00091 Honeypot social community](../counters/C00091.md) | D05 | +| [C00103 Create a bot that engages / distract trolls](../counters/C00103.md) | D05 | +| [C00124 Don't feed the trolls](../counters/C00124.md) | D03 | +| [C00136 Microtarget most likely targets then send them countermessages](../counters/C00136.md) | D03 | +| [C00148 Add random links to network graphs](../counters/C00148.md) | D04 | +| [C00149 Poison the monitoring & evaluation data](../counters/C00149.md) | D04 | DO NOT EDIT ABOVE THIS LINE - PLEASE ADD NOTES BELOW \ No newline at end of file diff --git a/techniques_index.md b/techniques_index.md index 69260a0..e6ce8c0 100644 --- a/techniques_index.md +++ b/techniques_index.md @@ -16,19 +16,19 @@ T0002 Facilitate State Propaganda -Organize citizens around pro-state messaging. Paid or volunteer groups coordinated to push state propaganda (examples include 2016 Diba Facebook Expedition, coordinated to overcome China’s Great Firewall, to flood the Facebook pages of Taiwanese politicians and news agencies with a pro-PRC message). +Organize citizens around pro-state messaging. Coordinate paid or volunteer groups to push state propaganda. TA01 T0003 Leverage Existing Narratives -Use or adapt existing narrative themes, where narratives are the baseline stories of a target audience. Narratives form the bedrock of our worldviews. New information is understood through a process firmly grounded in this bedrock. If new information is not consitent with the prevailing narratives of an audience, it will be ignored. Effective campaigns will frame their misinformation in the context of these narratives. Highly effective campaigns will make extensive use of audience-appropriate archetypes and meta-narratives throughout their content creation and amplifiction practices. Examples include midwesterners are generous, Russia is under attack from outside. +Use or adapt existing narrative themes, where narratives are the baseline stories of a target audience. Narratives form the bedrock of our worldviews. New information is understood through a process firmly grounded in this bedrock. If new information is not consitent with the prevailing narratives of an audience, it will be ignored. Effective campaigns will frame their misinformation in the context of these narratives. Highly effective campaigns will make extensive use of audience-appropriate archetypes and meta-narratives throughout their content creation and amplifiction practices. TA01 T0004 Competing Narratives -Advance competing narratives connected to same issue ie: on one hand deny incident while at same time expresses dismiss. MH17 (example) "Russian Foreign Ministry again claimed that “absolutely groundless accusations are put forward against the Russian side, which are aimed at discrediting Russia in the eyes of the international community" (deny); "The Dutch MH17 investigation is biased, anti-Russian and factually inaccurate" (dismiss). +Advance competing narratives connected to same issue ie: on one hand deny incident while at same time expresses dismiss. Suppressing or discouraging narratives already spreading requires an alternative. The most simple set of narrative techniques in response would be the construction and promotion of contradictory alternatives centered on denial, deflection, dismissal, counter-charges, excessive standards of proof, bias in prohibition or enforcement, and so on. @@ -44,14 +44,7 @@ These competing narratives allow loyalists cover, but are less compelling to opp T0006 Create Master Narratives -The promotion of beneficial master narratives is perhaps the most effective method for achieving long-term strategic narrative dominance. From a "whole of society" perpective the promotion of the society's core master narratives should occupy a central strategic role. From a misinformation campaign / cognitive security perpectve the tactics around master narratives center more precisely on the day-to-day promotion and reinforcement of this messaging. In other words, beneficial, high-coverage master narratives are a central strategic goal and their promotion consitutes an ongoing tactical struggle carried out at a whole-of-society level. - -By way of example, major powers are promoting master narratives such as: -* "Huawei is detetmined to build trustworthy networks" -* "Russia is the victim of bullying by NATO powers" -* "USA is guided by its founding principles of liberty and egalitarianism" - -Tactically, their promotion covers a broad spectrum of activities both on- and offline. +The promotion of beneficial master narratives is perhaps the most effective method for achieving long-term strategic narrative dominance. From a "whole of society" perspective the promotion of the society's core master narratives should occupy a central strategic role. From a misinformation campaign / cognitive security perpectve the tactics around master narratives center more precisely on the day-to-day promotion and reinforcement of this messaging. In other words, beneficial, high-coverage master narratives are a central strategic goal and their promotion consitutes an ongoing tactical struggle carried out at a whole-of-society level. Tactically, their promotion covers a broad spectrum of activities both on- and offline. TA02 @@ -60,20 +53,19 @@ Tactically, their promotion covers a broad spectrum of activities both on- and o Create key social engineering assets needed to amplify content, manipulate algorithms, fool public and/or specific incident/campaign targets. Computational propaganda depends substantially on false perceptions of credibility and acceptance. By creating fake users and groups with a variety of interests and commitments, attackers can ensure that their messages both come from trusted sources and appear more widely adopted than they actually are. - -Examples: Ukraine elections (2019) circumvent Facebook’s new safeguards by paying Ukrainian citizens to give a Russian agent access to their personal pages. EU Elections (2019) Avaaz reported more than 500 suspicious pages and groups to Facebook related to the three-month investigation of Facebook disinformation networks in Europe. Mueller report (2016) The IRA was able to reach up to 126 million Americans on Facebook via a mixture of fraudulent accounts, groups, and advertisements, the report says. Twitter accounts it created were portrayed as real American voices by major news outlets. It was even able to hold real-life rallies, mobilizing hundreds of people at a time in major cities like Philadelphia and Miami. + TA03 T0008 Create fake or imposter news sites -Modern computational propaganda makes use of a cadre of imposter news sites spreading globally. These sites, sometimes motivated by concerns other than propaganda--for instance, click-based revenue--often have some superficial markers of authenticity, such as naming and site-design. But many can be quickly exposed with reference to their owenership, reporting history and adverstising details. A prominent case from the 2016 era was the _Denver Guardian_, which purported to be a local newspaper in Colorado and specialized in negative stories about Hillary Clinton. +Modern computational propaganda makes use of a cadre of imposter news sites spreading globally. These sites, sometimes motivated by concerns other than propaganda--for instance, click-based revenue--often have some superficial markers of authenticity, such as naming and site-design. But many can be quickly exposed with reference to their owenership, reporting history and adverstising details. TA03 T0009 Create fake experts -Stories planted or promoted in computational propaganda operations often make use of experts fabricated from whole cloth, sometimes specifically for the story itself. For example, in the Jade Helm conspiracy theory promoted by SVR in 2015, a pair of experts--one of them naming himself a “Military Intelligence Analyst / Russian Regional CME” and the other a “Geopolitical Strategist, Journalist & Author”--pushed the story heavily on LinkedIn. +Stories planted or promoted in computational propaganda operations often make use of experts fabricated from whole cloth, sometimes specifically for the story itself. TA03 @@ -85,15 +77,13 @@ Examples: Ukraine elections (2019) circumvent Facebook’s new safeguards by pay T0011 Hijack legitimate account -Hack or take over legimate accounts to distribute misinformation or damaging content. Examples include Syrian Electronic Army (2013) series of false tweets from a hijacked Associated Press Twitter account claiming that President Barack Obama had been injured in a series of explosions near the White House. The false report caused a temporary plunge of 143 points on the Dow Jones Industrial Average. +Hack or take over legimate accounts to distribute misinformation or damaging content. TA04 T0012 Use concealment -Use anonymous social media profiles. Examples include page or group administrators, masked "whois" website directory data, no bylines connected to news article, no masthead connect to news websites. - -Example is 2016 @TEN_GOP profile where the actual Tennessee Republican Party tried unsuccessfully for months to get Twitter to shut it down, and 2019 Endless Mayfly is an Iran-aligned network of inauthentic personas and social media accounts that spreads falsehoods and amplifies narratives critical of Saudi Arabia, the United States, and Israel. +Use anonymous social media profiles. Examples include page or group administrators, masked "whois" website directory data, no bylines connected to news article, no masthead connect to news websites. TA04 @@ -105,13 +95,13 @@ Example is 2016 @TEN_GOP profile where the actual Tennessee Republican Party tri T0014 Create funding campaigns -Generate revenue through online funding campaigns. e.g. Gather data, advance credible persona via Gofundme; Patreon; or via fake website connecting via PayPal or Stripe. (Example 2016) #VaccinateUS Gofundme campaigns to pay for Targetted facebook ads (Larry Cook, targetting Washington State mothers, $1,776 to boost posts over 9 months). +Generate revenue through online funding campaigns. e.g. Gather data, advance credible persona via Gofundme; Patreon; or via fake website connecting via PayPal or Stripe. TA04 T0015 Create hashtag -Many incident-based campaigns will create a hashtag to promote their fabricated event (e.g. #ColumbianChemicals to promote a fake story about a chemical spill in Louisiana). +Many incident-based campaigns will create a hashtag to promote their fabricated event. Creating a hashtag for an incident can have two important effects: 1. Create a perception of reality around an event. Certainly only "real" events would be discussed in a hashtag. After all, the event has a name! @@ -123,7 +113,7 @@ Asset needed to direct/control/manage "conversation" connected to launching new T0016 Clickbait -Create attention grabbing headlines (outrage, doubt, humor) required to drive traffic & engagement. (example 2016) “Pope Francis shocks world, endorses Donald Trump for president.” (example 2016) "FBI director received millions from Clinton Foundation, his brother’s law firm does Clinton’s taxes”. This is a key asset +Create attention grabbing headlines (outrage, doubt, humor) required to drive traffic & engagement. This is a key asset TA05 @@ -159,9 +149,7 @@ Asset needed to direct/control/manage "conversation" connected to launching new T0022 Conspiracy narratives -"Conspiracy narratives appeal to the human desire for explanatory order, by invoking the participation of poweful (often sinister) actors in pursuit of their own political goals. These narratives are especially appealing when an audience is low-information, marginalized or otherwise inclined to reject the prevailing explanation. Conspiracy narratives are an important component of the ""firehose of falsehoods"" model. - -Example: QAnon: conspiracy theory is an explanation of an event or situation that invokes a conspiracy by sinister and powerful actors, often political in motivation, when other explanations are more probable " +"Conspiracy narratives appeal to the human desire for explanatory order, by invoking the participation of poweful (often sinister) actors in pursuit of their own political goals. These narratives are especially appealing when an audience is low-information, marginalized or otherwise inclined to reject the prevailing explanation. Conspiracy narratives are an important component of the ""firehose of falsehoods"" model. TA06 @@ -173,15 +161,13 @@ Example: QAnon: conspiracy theory is an explanation of an event or situation tha T0024 Create fake videos and images -Create fake videos and/or images by manipulating existing content or generating new content (e.g. deepfakes). Examples include Pelosi video (making her appear drunk) and photoshoped shark on flooded streets of Houston TX. +Create fake videos and/or images by manipulating existing content or generating new content (e.g. deepfakes). TA06 T0025 Leak altered documents -Obtain documents (eg by theft or leak), then alter and release, possibly among factual documents/sources. - -Example (2019) DFRLab report "Secondary Infektion” highlights incident with key asset being a forged “letter” created by the operation to provide ammunition for far-right forces in Europe ahead of the election. +Obtain documents (eg by theft or leak), then alter and release, possibly among factual documents/sources. TA06 @@ -209,7 +195,7 @@ These competing narratives allow loyalists cover, but are less compelling to opp T0029 Manipulate online polls -Create fake online polls, or manipulate existing online polls. Examples: flooding FCC with comments; creating fake engagement metrics of Twitter/Facebook polls to manipulate perception of given issue. Data gathering tactic to target those who engage, and potentially their networks of friends/followers as well +Create fake online polls, or manipulate existing online polls. Data gathering tactic to target those who engage, and potentially their networks of friends/followers as well TA07 @@ -305,9 +291,7 @@ When messaging makes use of factual reporting to promote these adjustments in th T0044 Seed distortions -Incident creators often try a wide variety of messages in the early hours surrounding an incident or event in order to give a misleading account or impression. - -Examples: (2019) China formally arrests Canadians Spavor and Kovrig, accuses them of spying (in retaliation to detention of Hauwei CFO). (2018) The Russian ministry of defence put out a press release, claiming that they had intelligence Syrian rebel forces were about to gas their own people in Idlib province as part of a “false flag” operation to frame the Syrian government. +Try a wide variety of messages in the early hours surrounding an incident or event, to give a misleading account or impression. TA08 @@ -325,71 +309,67 @@ Examples: (2019) China formally arrests Canadians Spavor and Kovrig, accuses the T0047 Muzzle social media as a political force -Use political influence or the power of state to stop critical social media comments. Government requested/driven content take downs (see Google Transperancy reports. (Example 20190 Singapore Protection from Online Falsehoods and Manipulation Bill would make it illegal to spread "false statements of fact" in Singapore, where that information is "prejudicial" to Singapore's security or "public tranquility." Or India/New Delhi has cut off services to Facebook and Twitter in Kashmir 28 times in the past five years, and in 2016, access was blocked for five months -- on the grounds that these platforms were being used for anti-social and "anti-national" purposes. +Use political influence or the power of state to stop critical social media comments. Government requested/driven content take downs (see Google Transperancy reports. TA09 T0048 Cow online opinion leaders -Intimidate, coerce, threaten critics/dissidents/journalists via trolling, doxing. Examples: Philippines, Maria Ressa and Rappler journalists targeted Duterte regime, lawsuits, trollings, banned from the presidential palace where press briefings take place; 2017 bot attack on five ProPublica Journalists. +Intimidate, coerce, threaten critics/dissidents/journalists via trolling, doxing. TA09 T0049 Flooding -Flooding and/or mobbing social media channels feeds and/or hashtag with excessive volume of content to control/shape online conversations and/or drown out opposing points of view. Bots and/or patriotic trolls are effective tools to acheive this effect. - -Example (2018): bots flood social media promoting messages which support Saudi Arabia with intent to cast doubt on allegations that the kingdom was involved in Khashoggi’s death. +Flooding and/or mobbing social media channels feeds and/or hashtag with excessive volume of content to control/shape online conversations and/or drown out opposing points of view. Bots and/or patriotic trolls are effective tools to acheive this effect. TA09 T0050 Cheerleading domestic social media ops -Deploy state-coordinated social media commenters and astroturfers. Both internal/domestic and external social media influence operations, popularized by China (50cent Army manage message inside the "Great Firewall") but also technique used by Chinese English-language social media influence operations are seeded by state-run media, which overwhelmingly present a positive, benign, and cooperative image of China. +Deploy state-coordinated social media commenters and astroturfers. Both internal/domestic and external social media influence operations. TA09 T0051 Fabricate social media comment -Use government-paid social media commenters, astroturfers, chat bots (programmed to reply to specific key words/hashtags) influence online conversations, product reviews, web-site comment forums. (2017 example) the FCC was inundated with nearly 22 million public comments on net neutrality (many from fake accounts) +Use government-paid social media commenters, astroturfers, chat bots (programmed to reply to specific key words/hashtags) influence online conversations, product reviews, web-site comment forums. TA09 T0052 Tertiary sites amplify news -Create content/news/opinion web-sites to cross-post stories. Tertiary sites circulate and amplify narratives. Often these sites have no masthead, bylines or attribution. - -Examples of tertiary sites include Russia Insider, The Duran, geopolitica.ru, Mint Press News, Oriental Review, globalresearch.ca. Examples: (2019, Domestic news): Snopes reveals Star News Digital Media, Inc. may look like a media company that produces local news, but operates via undisclosed connections to political activism. (2018) FireEye reports on Iranian campaign that created between April 2018 and March 2019 sites used to spread inauthentic content from websites such as Liberty Front Press (LFP), US Journal, and Real Progressive Front during the 2018 US mid-terms. +Create content/news/opinion web-sites to cross-post stories. Tertiary sites circulate and amplify narratives. Often these sites have no masthead, bylines or attribution. TA09 T0053 Twitter trolls amplify and manipulate -Use trolls to amplify narratives and/or manipulate narratives. Fake profiles/sockpuppets operating to support individuals/narratives from the entire political spectrum (left/right binary). Operating with increased emphasis on promoting local content and promoting real Twitter users generating their own, often divisive political content, as it's easier to amplify existing content than create new/original content. Trolls operate where ever there's a socially divisive issue (issues that can/are be politicized) e.g. BlackLivesMatter or MeToo +Use trolls to amplify narratives and/or manipulate narratives. Fake profiles/sockpuppets operating to support individuals/narratives from the entire political spectrum (left/right binary). Operating with increased emphasis on promoting local content and promoting real Twitter users generating their own, often divisive political content, as it's easier to amplify existing content than create new/original content. Trolls operate where ever there's a socially divisive issue (issues that can/are be politicized). TA09 T0054 Twitter bots amplify -Use bots to amplify narratives above algorithm thresholds. Bots are automated/programmed profiles designed to amplify content (ie: automatically retweet or like) and give appearance it's more "popular" than it is. They can operate as a network, to function in a coordinated/orchestrated manner. In some cases (more so now) they are an inexpensive/disposable assets used for minimal deployment as bot detection tools improve and platforms are more responsive.(example 2019) #TrudeauMustGo +Use bots to amplify narratives above algorithm thresholds. Bots are automated/programmed profiles designed to amplify content (ie: automatically retweet or like) and give appearance it's more "popular" than it is. They can operate as a network, to function in a coordinated/orchestrated manner. In some cases (more so now) they are an inexpensive/disposable assets used for minimal deployment as bot detection tools improve and platforms are more responsive. TA09 T0055 Use hashtag -Use a dedicated hashtag for the incident (e.g. #PhosphorusDisaster) - either create a campaign/incident specific hashtag, or take over an existing hashtag. +Use a dedicated hashtag for the incident - either create a campaign/incident specific hashtag, or take over an existing hashtag. TA09 T0056 Dedicated channels disseminate information pollution -Output information pollution (e.g. articles on an unreported false story/event) through channels controlled by or related to the incident creator. Examples include RT/Sputnik or antivax websites seeding stories. +Output information pollution (e.g. articles on an unreported false story/event) through channels controlled by or related to the incident creator. TA09 T0057 Organise remote rallies and events -Coordinate and promote real-world events across media platforms, e.g. rallies, protests, gatherings in support of incident narratives. Example: Facebook groups/pages coordinate/more divisive/polarizing groups and actvities into the public space. (Example) Mueller's report, highlights, the IRA organized political rallies in the U.S. using social media starting in 2015 and continued to coordinate rallies after the 2016 election +Coordinate and promote real-world events across media platforms, e.g. rallies, protests, gatherings in support of incident narratives. TA10 @@ -402,7 +382,7 @@ Examples of tertiary sites include Russia Insider, The Duran, geopolitica.ru, Mi T0059 Play the long game Play the long game can mean a couple of things: -1. To plan messaging and allow it to grow organically without conducting your own amplification. This is methodical and slow and requires years for the message to take hold (e.g. China and its constant messaging that Taiwan and Hong Kong are part of one China). +1. To plan messaging and allow it to grow organically without conducting your own amplification. This is methodical and slow and requires years for the message to take hold 2. To develop a series of seemingly disconnected messaging narratives that eventually combine into a new narrative. TA11