# df_phases

id: P01
name: Planning
rank: 1
longname: P01 - Planning
summary:
Envision the desired outcome. Lay out effective ways of achieving it. Communicate the vision, intent, and decisions, focusing on expected results.


id: P02
name: Preparation
rank: 2
longname: P02 - Preparation
summary:
Activities conducted before execution to improve the ability to conduct the action. Examples include: development of the ecosystem needed to support the action: people, network, channels, content etc.


# df_techniques

id: T0001
name: 5Ds (dismiss, distort, distract, dismay, divide)
tactic_id: TA01
longname: T0001 - 5Ds (dismiss, distort, distract, dismay, divide)
summary:
Nimmo's "4Ds of propaganda": dismiss, distort, distract, dismay (MisinfosecWG added divide in 2019). Misinformation promotes an agenda by advancing narratives supportive of that agenda. This is most effective when the advanced narrative pre-dates the revelation of the specific misinformation content. This is often not possible.


id: T0002
name: Facilitate State Propaganda
tactic_id: TA01
longname: T0002 - Facilitate State Propaganda
summary:
Organize citizens around pro-state messaging. Paid or volunteer groups coordinated to push state propaganda (examples include 2016 Diba Facebook Expedition, coordinated to overcome China’s Great Firewall, to flood the Facebook pages of Taiwanese politicians and news agencies with a pro-PRC message).


id: T0003
name: Leverage Existing Narratives
tactic_id: TA01
longname: T0003 - Leverage Existing Narratives
summary:
Use or adapt existing narrative themes, where narratives are the baseline stories of a target audience. Narratives form the bedrock of our worldviews. New information is understood through a process firmly grounded in this bedrock. If new information is not consitent with the prevailing narratives of an audience, it will be ignored. Effective campaigns will frame their misinformation in the context of these narratives. Highly effective campaigns will make extensive use of audience-appropriate archetypes and meta-narratives throughout their content creation and amplifiction practices. Examples include midwesterners are generous, Russia is under attack from outside.


id: T0004
name: Competing Narratives
tactic_id: TA01
longname: T0004 - Competing Narratives
summary:
Advance competing narratives connected to same issue ie: on one hand deny incident while at same time expresses dismiss. MH17 (example) "Russian Foreign Ministry again claimed that “absolutely groundless accusations are put forward against the Russian side, which are aimed at discrediting Russia in the eyes of the international community" (deny); "The Dutch MH17 investigation is biased, anti-Russian and factually inaccurate" (dismiss). 

Suppressing or discouraging narratives already spreading requires an alternative. The most simple set of narrative techniques in response would be the construction and promotion of contradictory alternatives centered on denial, deflection, dismissal, counter-charges, excessive standards of proof, bias in prohibition or enforcement, and so on.

These competing narratives allow loyalists cover, but are less compelling to opponents and fence-sitters than campaigns built around existing narratives or highly explanatory master narratives. Competing narratives, as such, are especially useful in the "firehose of misinformation" approach.


id: T0005
name: Center of Gravity Analysis
tactic_id: TA02
longname: T0005 - Center of Gravity Analysis
summary:
Recon/research to identify "the source of power that provides moral or physical strength, freedom of action, or will to act." Thus, the center of gravity is usually seen as the "source of strength". Includes demographic and network analysis of communities


id: T0006
name: Create Master Narratives
tactic_id: TA02
longname: T0006 - Create Master Narratives
summary:
The promotion of beneficial master narratives is perhaps the most effective method for achieving long-term strategic narrative dominance. From a "whole of society" perpective the promotion of the society's core master narratives should occupy a central strategic role. From a misinformation campaign / cognitive security perpectve the tactics around master narratives center more precisely on the day-to-day promotion and reinforcement of this messaging. In other words, beneficial, high-coverage master narratives are a central strategic goal and their promotion consitutes an ongoing tactical struggle carried out at a whole-of-society level. 

By way of example, major powers are promoting master narratives such as:
* "Huawei is detetmined to build trustworthy networks"
* "Russia is the victim of bullying by NATO powers"
* "USA is guided by its founding principles of liberty and egalitarianism"

Tactically, their promotion covers a broad spectrum of activities both on- and offline.


id: T0007
name: Create fake Social Media Profiles / Pages / Groups
tactic_id: TA03
longname: T0007 - Create fake Social Media Profiles / Pages / Groups
summary:
Create key social engineering assets needed to amplify content, manipulate algorithms, fool public and/or specific incident/campaign targets. 

Computational propaganda depends substantially on false perceptions of credibility and acceptance. By creating fake users and groups with a variety of interests and commitments, attackers can ensure that their messages both come from trusted sources and appear more widely adopted than they actually are. 

Examples: Ukraine elections (2019) circumvent Facebook’s new safeguards by paying Ukrainian citizens to give a Russian agent access to their personal pages. EU Elections (2019) Avaaz reported more than 500 suspicious pages and groups to Facebook related to the three-month investigation of Facebook disinformation networks in Europe. Mueller report (2016) The IRA was able to reach up to 126 million Americans on Facebook via a mixture of fraudulent accounts, groups, and advertisements, the report says. Twitter accounts it created were portrayed as real American voices by major news outlets. It was even able to hold real-life rallies, mobilizing hundreds of people at a time in major cities like Philadelphia and Miami. 


id: T0008
name: Create fake or imposter news sites
tactic_id: TA03
longname: T0008 - Create fake or imposter news sites
summary:
Modern computational propaganda makes use of a cadre of imposter news sites spreading globally. These sites, sometimes motivated by concerns other than propaganda--for instance, click-based revenue--often have some superficial markers of authenticity, such as naming and site-design. But many can be quickly exposed with reference to their owenership, reporting history and adverstising details. A prominent case from the 2016 era was the _Denver Guardian_, which purported to be a local newspaper in Colorado and specialized in negative stories about Hillary Clinton.


id: T0009
name: Create fake experts
tactic_id: TA03
longname: T0009 - Create fake experts
summary:
Stories planted or promoted in computational propaganda operations often make use of experts fabricated from whole cloth, sometimes specifically for the story itself. For example, in the Jade Helm conspiracy theory promoted by SVR in 2015, a pair of experts--one of them naming himself a “Military Intelligence Analyst / Russian Regional CME” and the other a “Geopolitical Strategist, Journalist & Author”--pushed the story heavily on LinkedIn.


id: T0010
name: Cultivate ignorant agents
tactic_id: TA04
longname: T0010 - Cultivate ignorant agents
summary:
Cultivate propagandists for a cause, the goals of which are not fully comprehended, and who are used cynically by the leaders of the cause. Independent actors use social media and specialised web sites to strategically reinforce and spread messages compatible with their own. Their networks are infiltrated and used by state media disinformation organisations to amplify the state’s own disinformation strategies against target populations. Many are traffickers in conspiracy theories or hoaxes, unified by a suspicion of Western governments and mainstream media. Their narratives, which appeal to leftists hostile to globalism and military intervention and nationalists against immigration, are frequently infiltrated and shaped by state-controlled trolls and altered news items from agencies such as RT and Sputnik. Also know as "useful idiots" or "unwitting agents".


id: T0011
name: Hijack legitimate account
tactic_id: TA04
longname: T0011 - Hijack legitimate account
summary:
Hack or take over legimate accounts to distribute misinformation or damaging content. Examples include Syrian Electronic Army (2013) series of false tweets from a hijacked Associated Press Twitter account claiming that President Barack Obama had been injured in a series of explosions near the White House. The false report caused a temporary plunge of 143 points on the Dow Jones Industrial Average.


id: T0012
name: Use concealment
tactic_id: TA04
longname: T0012 - Use concealment
summary:
Use anonymous social media profiles. Examples include page or group administrators, masked "whois" website directory data, no bylines connected to news article, no masthead connect to news websites. 

Example is 2016 @TEN_GOP profile where the actual Tennessee Republican Party tried unsuccessfully for months to get Twitter to shut it down, and 2019 Endless Mayfly is an Iran-aligned network of inauthentic personas and social media accounts that spreads falsehoods and amplifies narratives critical of Saudi Arabia, the United States, and Israel.


id: T0013
name: Create fake websites
tactic_id: TA04
longname: T0013 - Create fake websites
summary:
Create media assets to support fake organizations (e.g. think tank), people (e.g. experts) and/or serve as sites to distribute malware/launch phishing operations.


id: T0014
name: Create funding campaigns
tactic_id: TA04
longname: T0014 - Create funding campaigns
summary:
Generate revenue through online funding campaigns. e.g. Gather data, advance credible persona via Gofundme; Patreon; or via fake website connecting via PayPal or Stripe. (Example 2016) #VaccinateUS Gofundme campaigns to pay for Targetted facebook ads (Larry Cook, targetting Washington State mothers, $1,776 to boost posts over 9 months).


id: T0015
name: Create hashtag
tactic_id: TA04
longname: T0015 - Create hashtag
summary:
Many incident-based campaigns will create a hashtag to promote their fabricated event (e.g. #ColumbianChemicals to promote a fake story about a chemical spill in Louisiana). 

Creating a hashtag for an incident can have two important effects:
1. Create a perception of reality around an event. Certainly only "real" events would be discussed in a hashtag. After all, the event has a name!
2. Publicize the story more widely through trending lists and search behavior 

Asset needed to direct/control/manage "conversation" connected to launching new incident/campaign with new hashtag for applicable social media sites ie: Twitter, LinkedIn)


id: T0016
name: Clickbait
tactic_id: TA05
longname: T0016 - Clickbait
summary:
Create attention grabbing headlines (outrage, doubt, humor) required to drive traffic & engagement. (example 2016) “Pope Francis shocks world, endorses Donald Trump for president.” (example 2016) "FBI director received millions from Clinton Foundation, his brother’s law firm does Clinton’s taxes”. This is a key asset


id: T0017
name: Promote online funding
tactic_id: TA05
longname: T0017 - Promote online funding
summary:
Drive traffic/engagement to funding campaign sites; helps provide measurable metrics to assess conversion rates


id: T0019
name: Generate information pollution
tactic_id: TA06
longname: T0019 - Generate information pollution
summary:
Flood social channels; drive traffic/engagement to all assets; create aura/sense/perception of pervasiveness/consensus (for or against or both simultaneously) of an issue or topic. "Nothing is true, but everything is possible." Akin to astroturfing campaign.


id: T0020
name: Trial content
tactic_id: TA06
longname: T0020 - Trial content
summary:
Iteratively test incident performance (messages, content etc), e.g. A/B test headline/content enagagement metrics; website and/or funding campaign conversion rates


id: T0021
name: Memes
tactic_id: TA06
longname: T0021 - Memes
summary:
Memes are one of the most important single artefact types in all of computational propaganda. Memes in this framework denotes the narrow image-based definition. But that naming is no accident, as these items have most of the important properties of Dawkins' original conception as a self-replicating unit of culture. Memes pull together reference and commentary; image and narrative; emotion and message. Memes are a powerful tool and the heart of modern influence campaigns.


id: T0022
name: Conspiracy narratives
tactic_id: TA06
longname: T0022 - Conspiracy narratives
summary:
"Conspiracy narratives appeal to the human desire for explanatory order, by invoking the participation of poweful (often sinister) actors in pursuit of their own political goals. These narratives are especially appealing when an audience is low-information, marginalized or otherwise inclined to reject the prevailing explanation. Conspiracy narratives are an important component of the ""firehose of falsehoods"" model. 

Example: QAnon: conspiracy theory is an explanation of an event or situation that invokes a conspiracy by sinister and powerful actors, often political in motivation, when other explanations are more probable "


id: T0023
name: Distort facts
tactic_id: TA06
longname: T0023 - Distort facts
summary:
Change, twist, or exaggerate existing facts to construct a narrative that differs from reality. Examples: images and ideas can be distorted by being placed in an improper content


id: T0024
name: Create fake videos and images
tactic_id: TA06
longname: T0024 - Create fake videos and images
summary:
Create fake videos and/or images by manipulating existing content or generating new content (e.g. deepfakes). Examples include Pelosi video (making her appear drunk) and photoshoped shark on flooded streets of Houston TX.


id: T0025
name: Leak altered documents
tactic_id: TA06
longname: T0025 - Leak altered documents
summary:
Obtain documents (eg by theft or leak), then alter and release, possibly among factual documents/sources. 

Example (2019) DFRLab report "Secondary Infektion” highlights incident with key asset being a forged “letter” created by the operation to provide ammunition for far-right forces in Europe ahead of the election.


id: T0026
name: Create fake research
tactic_id: TA06
longname: T0026 - Create fake research
summary:
Create fake academic research. Example: fake social science research is often aimed at hot-button social issues such as gender, race and sexuality. Fake science research can target Climate Science debate or pseudoscience like anti-vaxx


id: T0027
name: Adapt existing narratives
tactic_id: TA06
longname: T0027 - Adapt existing narratives
summary:
Adapting existing narratives to current operational goals is the tactical sweet-spot for an effective misinformation campaign. Leveraging existing narratives is not only more effective, it requires substantially less resourcing, as the promotion of new master narratives operates on a much larger scale, both time and scope. Fluid, dynamic & often interchangeable key master narratives can be ("The morally corrupt West") adapted to divisive (LGBT propaganda) or to distort (individuals working as CIA operatives). For Western audiences, different but equally powerful framings are available, such as "USA has a fraught history in race relations, especially in criminal justice areas."


id: T0028
name: Create competing narratives
tactic_id: TA06
longname: T0028 - Create competing narratives
summary:
Misinformation promotes an agenda by advancing narratives supportive of that agenda. This is most effective when the advanced narrative pre-dates the revelation of the specific misinformation content. But this is often not possible. 

Suppressing or discouraging narratives already spreading requires an alternative. The most simple set of narrative techniques in response would be the construction and promotion of contradictory alternatives centered on denial, deflection, dismissal, counter-charges, excessive standards of proof, bias in prohibition or enforcement, and so on. 

These competing narratives allow loyalists cover, but are less compelling to opponents and fence-sitters than campaigns built around existing narratives or highly explanatory master narratives. Competing narratives, as such, are especially useful in the *firehose of misinformation* approach.


id: T0029
name: Manipulate online polls
tactic_id: TA07
longname: T0029 - Manipulate online polls
summary:
Create fake online polls, or manipulate existing online polls. Examples: flooding FCC with comments; creating fake engagement metrics of Twitter/Facebook polls to manipulate perception of given issue. Data gathering tactic to target those who engage, and potentially their networks of friends/followers as well


id: T0030
name: Backstop personas
tactic_id: TA07
longname: T0030 - Backstop personas
summary:
Create other assets/dossier/cover/fake relationships and/or connections or documents, sites, bylines, attributions, to establish/augment/inflate crediblity/believability


id: T0039
name: Bait legitimate influencers
tactic_id: TA08
longname: T0039 - Bait legitimate influencers
summary:
Credibility in a social media environment is often a function of the size of a user's network. "Influencers" are so-called because of their reach, typically understood as: 1) the size of their network (i.e. the number of followers, perhaps weighted by their own influence); and 2) The rate at which their comments are re-circulated (these two metrics are related). Add traditional media players at all levels of credibility and professionalism to this, and the number of potential influencial carriers available for unwitting amplification becomes substantial.

By targeting high-influence people and organizations in all types of media with narratives and content engineered to appeal their emotional or ideological drivers, influence campaigns are able to add perceived credibility to their messaging via saturation and adoption by trusted agents such as celebrities, journalists and local leaders.


id: T0040
name: Demand unsurmountable proof
tactic_id: TA08
longname: T0040 - Demand unsurmountable proof
summary:
Campaigns often leverage tactical and informational asymmetries on the threat surface, as seen in the Distort and Deny strategies, and the "firehose of misinformation". Specifically, conspiracy theorists can be repeatedly wrong, but advocates of the truth need to be perfect. By constantly escalating demands for proof, propagandists can effectively leverage this asymmetry while also priming its future use, often with an even greater asymmetric advantage. The conspiracist is offered freer rein for a broader range of "questions" while the truth teller is burdened with higher and higher standards of proof.


id: T0041
name: Deny involvement
tactic_id: TA08
longname: T0041 - Deny involvement
summary:
Without "smoking gun" proof (and even with proof), incident creator can or will deny involvement. This technique also leverages the attacker advantages outlined in T0040 "Demand unsurmountable proof", specifically the asymmetric disadvantage for truth-tellers in a "firehose of misinformation" environment.


id: T0042
name: Kernel of Truth
tactic_id: TA08
longname: T0042 - Kernel of Truth
summary:
Wrap lies or altered context/facts around truths. 

Influence campaigns pursue a variety of objectives with respect to target audiences, prominent among them: 1. undermine a narrative commonly referenced in the target audience; or 2. promote a narrative less common in the target audience, but preferred by the attacker. In both cases, the attacker is presented with a heavy lift. They must change the relative importance of various narratives in the interpretation of events, despite contrary tendencies. 

When messaging makes use of factual reporting to promote these adjustments in the narrative space, they are less likely to be dismissed out of hand; when messaging can juxtapose a (factual) truth about current affairs with the (abstract) truth explicated in these narratives, propagandists can undermine or promote them selectively. Context matters.


id: T0043
name: Use SMS/ WhatsApp/ Chat apps
tactic_id: TA08
longname: T0043 - Use SMS/ WhatsApp/ Chat apps
summary:
Direct messaging via encypted app is an increasing method of delivery. These messages are often automated and new delivery and storage methods make them anonymous, viral, and ephemeral. This is a diffucult space to monitor, but also a difficult space to build acclaim or notoriety.


id: T0044
name: Seed distortions
tactic_id: TA08
longname: T0044 - Seed distortions
summary:
Incident creators often try a wide variety of messages in the early hours surrounding an incident or event in order to give a misleading account or impression. 

Examples: (2019) China formally arrests Canadians Spavor and Kovrig, accuses them of spying (in retaliation to detention of Hauwei CFO). (2018) The Russian ministry of defence put out a press release, claiming that they had intelligence Syrian rebel forces were about to gas their own people in Idlib province as part of a “false flag” operation to frame the Syrian government.


id: T0045
name: Use fake experts
tactic_id: TA08
longname: T0045 - Use fake experts
summary:
Use the fake experts that were set up in T0009. Pseudo-experts are disposable assets that often appear once and then disappear. Give "credility" to misinformation. Take advantage of credential bias


id: T0046
name: Search Engine Optimization
tactic_id: TA08
longname: T0046 - Search Engine Optimization
summary:
Manipulate content engagement metrics (ie: Reddit & Twitter) to influence/impact news search results (e.g. Google), also elevates RT & Sputnik headline into Google news alert emails. aka "Black-hat SEO" 


id: T0047
name: Muzzle social media as a political force
tactic_id: TA09
longname: T0047 - Muzzle social media as a political force
summary:
Use political influence or the power of state to stop critical social media comments. Government requested/driven content take downs (see Google Transperancy reports. (Example 20190 Singapore Protection from Online Falsehoods and Manipulation Bill would make it illegal to spread "false statements of fact" in Singapore, where that information is "prejudicial" to Singapore's security or "public tranquility." Or India/New Delhi has cut off services to Facebook and Twitter in Kashmir 28 times in the past five years, and in 2016, access was blocked for five months -- on the grounds that these platforms were being used for anti-social and "anti-national" purposes.


id: T0048
name: Cow online opinion leaders
tactic_id: TA09
longname: T0048 - Cow online opinion leaders
summary:
Intimidate, coerce, threaten critics/dissidents/journalists via trolling, doxing. Examples: Philippines, Maria Ressa and Rappler journalists targeted Duterte regime, lawsuits, trollings, banned from the presidential palace where press briefings take place; 2017 bot attack on five ProPublica Journalists.


id: T0049
name: Flooding
tactic_id: TA09
longname: T0049 - Flooding
summary:
Flooding and/or mobbing social media channels feeds and/or hashtag with excessive volume of content to control/shape online conversations and/or drown out opposing points of view. Bots and/or patriotic trolls are effective tools to acheive this effect. 

Example (2018): bots flood social media promoting messages which support Saudi Arabia with intent to cast doubt on allegations that the kingdom was involved in Khashoggi’s death.


id: T0050
name: Cheerleading domestic social media ops
tactic_id: TA09
longname: T0050 - Cheerleading domestic social media ops
summary:
Deploy state-coordinated social media commenters and astroturfers. Both internal/domestic and external social media influence operations, popularized by China (50cent Army manage message inside the "Great Firewall") but also technique used by Chinese English-language social media influence operations are seeded by state-run media, which overwhelmingly present a positive, benign, and cooperative image of China. 


id: T0051
name: Fabricate social media comment
tactic_id: TA09
longname: T0051 - Fabricate social media comment
summary:
Use government-paid social media commenters, astroturfers, chat bots (programmed to reply to specific key words/hashtags) influence online conversations, product reviews, web-site comment forums. (2017 example) the FCC was inundated with nearly 22 million public comments on net neutrality (many from fake accounts)


id: T0052
name: Tertiary sites amplify news
tactic_id: TA09
longname: T0052 - Tertiary sites amplify news
summary:
Create content/news/opinion web-sites to cross-post stories. Tertiary sites circulate and amplify narratives. Often these sites have no masthead, bylines or attribution. 

Examples of tertiary sites include Russia Insider, The Duran, geopolitica.ru, Mint Press News, Oriental Review, globalresearch.ca. Examples: (2019, Domestic news): Snopes reveals Star News Digital Media, Inc. may look like a media company that produces local news, but operates via undisclosed connections to political activism. (2018) FireEye reports on Iranian campaign that created between April 2018 and March 2019 sites used to spread inauthentic content from websites such as Liberty Front Press (LFP), US Journal, and Real Progressive Front during the 2018 US mid-terms.


id: T0053
name: Twitter trolls amplify and manipulate
tactic_id: TA09
longname: T0053 - Twitter trolls amplify and manipulate
summary:
Use trolls to amplify narratives and/or manipulate narratives. Fake profiles/sockpuppets operating to support individuals/narratives from the entire political spectrum (left/right binary). Operating with increased emphasis on promoting local content and promoting real Twitter users generating their own, often divisive political content, as it's easier to amplify existing content than create new/original content. Trolls operate where ever there's a socially divisive issue (issues that can/are be politicized) e.g. BlackLivesMatter or MeToo


id: T0054
name: Twitter bots amplify
tactic_id: TA09
longname: T0054 - Twitter bots amplify
summary:
Use bots to amplify narratives above algorithm thresholds. Bots are automated/programmed profiles designed to amplify content (ie: automatically retweet or like) and give appearance it's more "popular" than it is. They can operate as a network, to function in a coordinated/orchestrated manner. In some cases (more so now) they are an inexpensive/disposable assets used for minimal deployment as bot detection tools improve and platforms are more responsive.(example 2019) #TrudeauMustGo 


id: T0055
name: Use hashtag
tactic_id: TA09
longname: T0055 - Use hashtag
summary:
Use a dedicated hashtag for the incident (e.g. #PhosphorusDisaster) - either create a campaign/incident specific hashtag, or take over an existing hashtag.


id: T0056
name: Dedicated channels disseminate information pollution
tactic_id: TA09
longname: T0056 - Dedicated channels disseminate information pollution
summary:
Output information pollution (e.g. articles on an unreported false story/event) through channels controlled by or related to the incident creator. Examples include RT/Sputnik or antivax websites seeding stories.


id: T0057
name: Organise remote rallies and events
tactic_id: TA10
longname: T0057 - Organise remote rallies and events
summary:
Coordinate and promote real-world events across media platforms, e.g. rallies, protests, gatherings in support of incident narratives. Example: Facebook groups/pages coordinate/more divisive/polarizing groups and actvities into the public space. (Example) Mueller's report, highlights, the IRA organized political rallies in the U.S. using social media starting in 2015 and continued to coordinate rallies after the 2016 election


id: T0058
name: Legacy web content
tactic_id: TA11
longname: T0058 - Legacy web content
summary:
Make incident content visible for a long time, e.g. by exploiting platform terms of service, or placing it where it's hard to remove or unlikely to be removed.


id: T0059
name: Play the long game
tactic_id: TA11
longname: T0059 - Play the long game
summary:
Play the long game can mean a couple of things:
1. To plan messaging and allow it to grow organically without conducting your own amplification. This is methodical and slow and requires years for the message to take hold (e.g. China and its constant messaging that Taiwan and Hong Kong are part of one China).
2. To develop a series of seemingly disconnected messaging narratives that eventually combine into a new narrative.


# df_incidents

id: I00002
name: #VaccinateUS
type: campaign
summary: use both pro- and anti- topic messaging to create an artificial argument online.
year_started: 2014
from_country: Russia
to_country: World
when_added: 2019-02-24
longname: I00002 - #VaccinateUS
urls:
https://www.washingtonpost.com/science/2018/08/23/russian-trolls-twitter-bots-exploit-vaccine-controversy/


id: I00004
name: #Macrongate
type: incident
summary: amplified document dump failed because France was prepared for it.
year_started: 2017
from_country: Russia
to_country: France
when_added: 2019-02-24
longname: I00004 - #Macrongate
urls:
http://www.niemanlab.org/2018/09/how-france-beat-back-information-manipulation-and-how-other-democracies-might-do-the-same/


id: I00005
name: Brexit vote
type: campaign
year_started: 2016
from_country: Russia
to_country: UK
when_added: 2019-02-24
longname: I00005 - Brexit vote
summary:
In early 2014, then UK PM David Cameron outlined the changes he aimed to bring about in the EU and in the UK's relationship with it. These were: additional immigration controls, especially for citizens of new EU member states; tougher immigration rules for present EU citizens; new powers for national parliaments collectively to veto proposed EU laws; new free-trade agreements and a reduction in bureaucracy for businesses; a lessening of the influence of the European Court of Human Rights on British police and courts; more power for individual member states, and less for the central EU; and abandonment of the EU notion of "ever closer union".He intended to bring these about during a series of negotiations with other EU leaders and then, if re-elected, to announce a referendum.
European Union Referendum Act was passed by the Parliament of the United Kingdom. It extended to include and take legislative effect in Gibraltar,and received royal assent on 17 December 2015.

Conservative-led Department for Culture, Media and Sport select committee concluded (2018) Russia engaged in ‘unconventional warfare’ during the Brexit campaign. This included ‘156,252 Russian accounts tweeting about #Brexit’ and posting ‘over 45,000 Brexit messages in the last 48 hours of the campaign.’ As it said, Kremlin-controlled media, ‘RT and Sputnik had more reach on Twitter for anti-EU content than either Vote Leave or Leave.EU, during the referendum campaign’.

The report by Democrats on the Senate foreign relations committee, titled Putin’s asymmetric assault on democracy in Russia and Europe: implications for US national security, pinpoints the way in which UK campaign finance laws do not require disclosure of political donations if they are from “the beneficial owners of non-British companies that are incorporated in the EU and carry out business in the UK”.

The senators point out that Ukip and its then-leader, Nigel Farage, did not just fan anti-EU sentiment but also “criticised European sanctions on Russia, and provided flattering assessments of Russian President Putin”.

The report adds that although officially the Russian government asserted its neutrality on Brexit, its English-language media outlets RT and Sputnik covered the referendum campaign extensively and offered ‘’systematically one-sided coverage’’.

urls:
https://www.forbes.com/sites/emmawoollacott/2018/11/01/russian-trolls-used-islamophobia-to-whip-up-support-for-brexit/#1369afb665f2


id: I00007
name: Incirlik terrorists
type: incident
summary: Fake story transmitted from Russian media to Trump campaign
year_started: 2016
from_country: Russia
to_country: USA
when_added: 2019-02-24
longname: I00007 - Incirlik terrorists
urls:
https://www.politifact.com/truth-o-meter/statements/2016/aug/16/paul-manafort/trump-campaign-chair-misquotes-russian-media-makes/


id: I00008
name: Bujic
type: incident
year_started: 2017
from_country: Russia
to_country: Serbia
Notes: Serbia pro-Kremlin disinfo campaign by Vencislav Bujic
when_added: 2019-02-24
longname: I00008 - Bujic
urls:
https://www.stopfake.org/en/vencislav-the-virgin-hostile-operation-by-vencislav-bujic-seas-foundation-and-its-network-of-collaborators/


id: I00009
name: PhilippinesExpert
type: incident
year_started: 2017
from_country: Russia
to_country: Philippines
Notes: Philippines Social Media: Russian Disinformation by fake “expert”
when_added: 2019-02-24
longname: I00009 - PhilippinesExpert
summary:
President of the Philippine visited Moscow and forged ties on information strategy in 2017, and afterwards a series of disinformation campaign was noted in Philippine social media and mainstream media, mostly in favor of Philippine president and promoting Russian propaganda. Among this is the appearance of an unknown-before expert on global affairs who was cited frequently in Russian IRA-connected outlets. 

urls:
https://codastory.com/disinformation/how-a-little-known-pro-kremlin-analyst-became-a-philippine-expert-overnight/


id: I00010
name: ParklandTeens
type: incident
year_started: 2018
from_country: ??
to_country: USA
urls: https://www.nytimes.com/2018/03/27/us/parkland-students-hogg-gonzalez.html
Notes: Parkland survivors
when_added: 2019-02-01
longname: I00010 - ParklandTeens
summary:
IRA trolls amplified the far right messaging around the attack. Most notably they amplified social media speculation that many of the teens involved were “crisis actors” nefariously injected into the conversation by outside actors with an anti-gun poltical agenda. Other amplifications included ongoing harassment of survivors and claims that the event is a hoax from the right; and fatalist cynicism about gun reform from the left.


id: I00011
name: CovingtonTeen
type: incident
year_started: 2019
from_country: ??
to_country: USA
Notes: MAGA kid (Covington)
when_added: 2019-02-01
longname: I00011 - CovingtonTeen
urls:
https://www.wcpo.com/news/national/fact-check-viral-misinformation-about-covington-catholic-nathan-phillips-infects-the-internet


id: I00015
name: ConcordDiscovery
type: incident
year_started: 2019
from_country: Russia
to_country: USA
when_added: 2019-02-01
longname: I00015 - ConcordDiscovery
summary:
The Office of Special Counsel accused Concord Management (an IRA funder/handler) and its counsel of abusing the discovery process by leaking discovery materials under false pretences: the documents were altered; the documents were portrayed as material obtained by hacking, rather than legal process; the released documents are selected to maximize exposure targets and methods. 

urls:
https://www.theatlantic.com/politics/archive/2019/02/new-mueller-filing-shows-how-russia-misuses-us-courts/581884/


id: I00017
name: US presidential elections
type: campaign
year_started: 2016
from_country: Russia
to_country: USA
urls: https://www.dni.gov/files/documents/ICA_2017_01.pdf
when_added: 2019-02-24
found_via: OII
longname: I00017 - US presidential elections
summary:
Make Clinton look bad or unpopular, and Trump look good over a long period, to change individuals’ voting intentions. 


id: I00019
name: MacronTiphaine
type: incident
year_started: 2017
from_country: unknown
to_country: France
Notes: Trolls OII
when_added: 2019-02-24
found_via: OII
longname: I00019 - MacronTiphaine
summary:
Far-right trolls on 4chan and Twitter spreading misinformation about French candidate Macron and spur support for rival candidate Le Pen.

urls:
https://www.buzzfeednews.com/article/ryanhatesthis/heres-how-far-right-trolls-are-spreading-hoaxes-about


id: I00025
name: EU Army
type: incident
year_started: 2018
from_country: Russia
to_country: EU
urls: https://medium.com/dfrlab/spread-it-on-reddit-3170a463e787
when_added: 2019-02-24
found_via: OII
longname: I00025 - EU Army
summary:
Traces back to 2016: Guardian “Is there a secret plan to create an EU army?” French President Emmanuel Macron has warned that Europeans cannot be protected without a "true, European army", as he marks the centenary of the World War One Armistice. On a visit to the former Western Front in Verdun, he said Russia had shown it could be a threat and Europe had to be able "to defend itself better alone". German Chancellor Angela Merkel backed the idea of an intervention force in June, but said it would have to be part of "the structure of defence co-operation".

Verdict: “An EU army marching out to war under Brussels’ command is a fantasy shared by Eurosceptics and a small number of federalists. Europe will continue down the road of defence cooperation in a halting way, but an EU army is only for armchair generals.”


id: I00026
name: Netherlands referendum on Ukraine
type: incident
year_started: 2016
from_country: Russia
to_country: Netherlands
when_added: 2019-02-24
found_via: OII
longname: I00026 - Netherlands referendum on Ukraine
urls:
https://www.washingtonpost.com/opinions/russias-influence-in-western-elections/2016/04/08/b427602a-fcf1-11e5-886f-a037dba38301_story.html


id: I00028
name: mh17 downed
type: incident
year_started: 2014
from_country: Russia
to_country: Ukraine
when_added: 2019-02-24
found_via: OII
longname: I00028 - mh17 downed
urls:
https://www.stopfake.org/en/lies-spanish-flight-operations-officer-from-kiev-informed-about-ukrainian-planes-involved-in-boeing-tragedy/%20https:/globalvoices.org/2014/07/20/the-russian-governments-7000-wikipedia-edits/%20https:/foreignpolicy.com/2016/09/29/how-mh17-gave-birth-to-the-modern-russian-spin-machine-putin-ukraine/


id: I00029
name: MH17 investigation
type: campaign
year_started: 2016
from_country: Russia
to_country: Ukraine
when_added: 2019-02-24
found_via: OII
longname: I00029 - MH17 investigation
summary:
Since the shooting down of Malaysia Airlines Flight 17 (MH17) a scheduled passenger flight from Amsterdam to Kuala Lumpur on 17 July 2014 while flying over eastern Ukraine, killing all 283 passengers and 15 crew on board… wreckage of the aircraft fell near Hrabove in Donetsk Oblast, Ukraine, 40 km (25 mi) from the border.The shoot-down occurred in the War in Donbass, during the Battle of Shakhtarsk, in an area controlled by pro-Russian rebels. This has proven to be an ongoing example of Russia and their proxies ability to wage a disinformation campaign, and exemplify the use of the 4 D’s (dismiss, distort, distract, and dismay) 

urls:
https://www.novayagazeta.ru/news/2015/05/07/112052-facebook-zablokiroval-sergeya-parhomenko-za-kommentariy-doklada-o-sbitom-171-boinge-187%20 https://news.online.ua/754036/v-sotssetyah-na-paltsah-pokazali-kak-rabotayut-boty-kremlya-opublikovany-foto/ https://www.mirror.co.uk/news/world-news/ukraine-involved-mh17-downing-claims-14184413

Notes:
Changed to campaign (still in the news, and still Russia accusing Ukraine... TASS 03/25/19 and UK Daily Mirror (see URL's). It's links to overall campaign directed against Ukraine


id: I00032
name: Kavanaugh
type: incident
year_started: 2018
from_country: Russia
to_country: USA
when_added: 2019-02-24
found_via: OII
longname: I00032 - Kavanaugh
summary:
Before the Senate SCOTUS confirmation hearings of Brett Kavanaugh, professor Christine Blasey Ford--first anonymously, then publicly--accused Kavanaugh of inappropriate or criminal sexual behavior. Amplified by Russian trolls Right wing operatives first tried to doxx Ford, then to discredit her. Many observers suggest that the Kavanaugh hearings were the largest anti-US Russian online operation for months. 

urls:
https://qz.com/1409102/russian-trolls-and-bots-are-flooding-twitter-with-ford-kavanaugh-disinformation/


id: I00033
name: China 50cent Army
type: apt
year_started: 2014
from_country: China
to_country: China
Notes: campaign (multiple incidents, e.g. Shanshan riots)
when_added: 2019-02-24
found_via: OII
longname: I00033 - China 50cent Army
summary:
50cent Army is a CCP “tool” - “massive secret operation” in China pumping out an estimated 488 million fabricated social media posts per year, part of an effort to “regularly distract the public and change the subject” from any policy-related issues that threaten to anger citizens enough to turn them out onto the streets. But the research finds no evidence these 50-centers are, in fact, paid 50 cents, nor does it find they engage in direct and angry argument with their opponents. Instead, they are mostly bureaucrats already on the public payroll, responding to government directives at a time of heightened tension to flood social media with pro-government cheerleading.

urls:
https://gking.harvard.edu/files/gking/files/how_the_chinese_government_fabricates_social_media_posts_for_strategic_distraction_not_engaged_argument.pdf https://www.voanews.com/a/who-is-that-chinese-troll/3540663.html


id: I00034
name: DibaFacebookExpedition
type: incident
year_started: 2016
from_country: China
to_country: Taiwan
when_added: 2019-02-24
found_via: OII
longname: I00034 - DibaFacebookExpedition
summary:
In the Expedition, Diba engaged in a highly organized cyber-attack of a Taiwanese political leader. On January 20, 2016 (the day of President Tsai Ing-wen’s inauguration) featuring the posting of an overwhelming number of social media comments in support of a PRC-sanctioned message. Netizens from one of the largest discussion forums in China, known as Diba, coordinated to overcome China’s Great Firewall to flood the Facebook pages of Taiwanese politicians and news agencies with a pro-PRC message, a cyberattack referred to as the “Diba Expedition to Facebook.” 

Unique for taking place outside of the Chinese Internet system, both transgressing technical and political norms while exposing their actions to an international audience. In spite of the transgressive nature of the action, “Diba Expedition” was highly praised by Chinese official media, in contrast to comparable activities in the past that lacked its explicit pro-government ideology. Yet—reflecting the complexity of Diba’s relationship with the PRC government—the Expedition was shut down after a few days.

urls:
https://www.ideals.illinois.edu/handle/2142/96746 https://qz.com/598812/an-army-of-chinese-trolls-has-jumped-the-great-firewall-to-attack-taiwanese-independence-on-facebook/


id: I00036
name: BrazilPresDebate
type: incident
year_started: 2014
from_country: Brazil
to_country: Brazil
when_added: 2019-02-24
found_via: OII
longname: I00036 - BrazilPresDebate
urls:
https://www.wilsoncenter.org/blog-post/bots-brazil-the-activity-social-media-bots-brazilian-elections


id: I00037
name: Rioelections
type: incident
year_started: 2016
from_country: Brazil
to_country: Brazil
when_added: 2019-02-24
found_via: OII
longname: I00037 - Rioelections
urls:
https://www1.folha.uol.com.br/poder/eleicoes-2016/2016/10/1823713-eleicao-no-rio-tem-tatica-antiboato-e-suspeita-de-uso-de-robos.shtml


id: I00038
name: Brazilimpeachment
type: incident
year_started: 2016
from_country: Brazil
to_country: Brazil
when_added: 2019-02-24
found_via: OII
longname: I00038 - Brazilimpeachment
urls:
http://www.labic.net/cartografia/a-rede-das-imagens-da-vaiadilma-novas-relacoes/ https://www.researchgate.net/publication/300415619_The_Influence_of_Retweeting_Robots_During_Brazilian_Protests


id: I00039
name: MerkelFacebook
type: incident
year_started: 2017
from_country: unknown
to_country: Germany
when_added: 2019-02-24
found_via: OII
longname: I00039 - MerkelFacebook
summary:
Top stories about Merkel in both German and English were negative and misleading, most published from fake news sites.

urls:
https://www.buzzfeed.com/albertonardelli/hyperpartisan-sites-and-facebook-pages-are-publishing-false


id: I00042
name: Saudi/Qatar bot dispute
type: incident
year_started: 2017
from_country: SaudiArabia
to_country: Qatar
urls: https://jia.sipa.columbia.edu/robot-wars-how-bots-joined-battle-gulf
Notes: robot wars how bots joined battle in the gulf"
when_added: 2019-02-24
found_via: MIS
longname: I00042 - Saudi/Qatar bot dispute
summary:
In the summer of 2017, Twitter bots—automated accounts—were deployed to boost messaging on both sides of the diplomatic dispute between Saudi Arabia and Qatar.” Calling this a “diplomatic dispute” understates the complexity of regional dynamics, at the center is an alleged report that Qatar’s emir, Sheikh Tamim bin Hamad al-Thani, had made an astonishing speech, and alleged “hack” of Qatar’s official news agency, and further woven into concerns Saudi Arabia has about the influence of public perception, the role of Al Jazeera. 


id: I00044
name: JadeHelm exercise
type: incident
year_started: 2015
to_country: USA
when_added: 2019-02-25
found_via: MIS
longname: I00044 - JadeHelm exercise
summary:
In the summer of 2015, thousands of troops from the US Army Special Operations command conducted and multi-state, weeks-long training operation across the southwest. Russian trolls amplified conspiracy theories promoted by far right media operatives such as Alex Jones, specifically: the Jade Helm 15 exercise was a precursor to domestic invasion and subsequent martial law by the Obama Administration in coordination with China. Some versions have deus ex machina such as an asteroid strike. Ultimately the Governor of Texas, Greg Abbot, was forced to speak out on the conspiracy theory, but he hedged on Obama’s motives.

urls:
https://www.politifact.com/texas/article/2018/may/03/jade-helm-15-greg-abbott-texas-state-guard-hayden-/


id: I00045
name: Skripal
type: incident
year_started: 2018
from_country: Russia
to_country: UK
Notes: This is Beliingcat's full library of Skirpal related reporting
when_added: 2019-03-20
longname: I00045 - Skripal
summary:
On 4 March 2018, Sergei Skripal, a former Russian military officer and double agent for the UK's intelligence services, and his daughter Yulia Skripal were poisoned in Salisbury, England, with a Novichok nerve agent known as A-234, according to official UK sources and the Organisation for the Prohibition of Chemical Weapons (OPCW)

urls:
https://www.bellingcat.com/tag/skripal/ https://euvsdisinfo.eu/conspiracy-mania-marks-one-year-anniversary-of-the-skripal-poisoning/


id: I00046
name: North Macedonia
type: incident
year_started: 2018
from_country: Russia
to_country: Macedonia
when_added: 2019-03-20
longname: I00046 - North Macedonia
urls:
https://www.nytimes.com/2018/09/16/world/europe/macedonia-referendum-russia-nato.html https://www.polygraph.info/a/disinfo-analysis-macedonia-nato-russia/29770631.html

Notes:
disinformation directed by Russian-backed groups trying to stoke fears and depress turnout in a vote that could put this Balkan nation on a path to join NATO.


id: I00047
name: Sea of Azov
type: incident
year_started: 2018
from_country: Russia
to_country: World
urls: https://euvsdisinfo.eu/wave-of-disinformation-from-the-azov-sea/
when_added: 2019-03-20
longname: I00047 - Sea of Azov
summary:
An international incident occurred on 25 November 2018 when the Russian Federal Security Service (FSB) coast guard fired upon and captured three Ukrainian Navy vessels attempting to pass from the Black Sea into the Sea of Azov through the Kerch Strait on their way to the port of Mariupol. In 2014, Russia had annexed the nearby Crimean Peninsula, which is dominantly internationally recognised as Ukrainian territory. It later constructed the Crimean Bridge across the strait. Under a 2003 treaty, the strait and the Azov Sea are intended to be the shared territorial waters of both countries, and freely accessible.
The Russian Federal Security Service (FSB), which is also responsible for border protection, claims that the ships illegally entered Russian waters. The FSB alleges that crews did not comply with demands to stop. In the scuffle, a Russian border patrol ship rammed and damaged a Ukrainian Navy tugboat. Russian forces later seized all three Ukrainian ships, confiscating them for violating Russia's border. Six Ukrainian navy soldiers were injured, the Ukrainian navy reported. 


id: I00048
name: White Helmets
type: campaign
year_started: 2015
from_country: Russia
to_country: World
when_added: 2019-03-20
longname: I00048 - White Helmets
urls:
https://thesyriacampaign.org/wp-content/uploads/2017/12/KillingtheTruth.pdf https://www.theguardian.com/world/2017/dec/18/syria-white-helmets-conspiracy-theories


id: I00049
name: White Helmets: Chemical Weapons
type: incident
year_started: 2017
from_country: Russia
to_country: World
when_added: 2019-03-20
longname: I00049 - White Helmets: Chemical Weapons
summary:
On 7 April 2018, a high number of civilians were killed in the besieged Syrian city of Douma, with evidence pointing towards another chemical attack by the regime, according to the EU. Subsequent to this event, a series of images "prove" that the White Helmets "staged" the chemical attack in Syria.

urls:
http://www.publications.atlanticcouncil.org/breakingghouta/disinformation-2/ https://www.bellingcat.com/news/mena/2018/12/18/chemical-weapons-and-absurdity-the-disinformation-campaign-against-the-white-helmets/ https://www.nybooks.com/daily/2018/10/16/why-assad-and-russia-target-the-white-helmets/


id: I00050
name: #HandsOffVenezuela
type: incident
year_started: 2019
from_country: Russia
to_country: World
urls: https://euvsdisinfo.eu/twitter-as-an-information-battlefield-venezuela-a-case-study/
when_added: 2019-03-20
longname: I00050 - #HandsOffVenezuela
summary:
Venezuela has been thrown into turmoil after Guaidó declared himself interim president Jan. 23. The 35-year-old president of the National Assembly says Venezuela's constitution grants him power to take control of the government because Maduro was re-elected last year by fraud. Guaidó has called for Maduro to leave office and call new elections.

More than 50 nations, including the United States and most of Latin America, concluded that Maduro's re-election last year was a fraud. They have recognized Juan Guaidó, president of the opposition-led National Assembly, as Venezuela's legitimate head of state, endorsing his mission to establish a transitional government and hold fresh elections.
Maduro has remained defiant in the face of domestic and international pressure, securing the support of the governments of Iran and Russia, as well as the loyalty of the Venezuelan military.


id: I00051
name: Integrity Initiative
type: incident
year_started: 2018
from_country: Russia
to_country: World
when_added: 2019-03-20
longname: I00051 - Integrity Initiative
summary:
The UK Foreign Office has accused Russian state media of trying to discredit a government-funded body that works to counter Kremlin disinformation. A spokesperson said the Institute for Statecraft was hacked several weeks ago and documents were "published and amplified by Kremlin news channels".
The FCO comments on the IfS were issued after a news report said the group had retweeted stories critical of Labour. Western officials believe the group involved in the hack is linked to the Russian state. Since then internal documents have been leaked to the Russian media about the organisation's activities, including lists of journalists it had contacted. The Foreign Office has provided £2.2m in funding to the institute over the last two years supported its work to counter disinformation overseas and not in the UK

urls:
https://eaworldview.com/2019/01/counter-russia-disinformation-integrity-initiative/ https://www.stopfake.org/en/kremlin-watch-briefing-the-eu-has-to-start-taking-pro-kremlin-disinformation-seriously/

Notes:
This is an excellent example of the tables getting turned, and how we need to carefully work through offensive measures


id: I00052
name: China overiew
type: campaign
year_started: 2015
from_country: China
to_country: World
urls: https://www.recordedfuture.com/china-social-media-operations/
when_added: 2019-03-20
longname: I00052 - China overiew
Notes:
global strategic goals for China different from those President Vladimir Putin has for Russia; as a result, the social media influence techniques used by China are different from those used by Russia.


id: I00053
name: China Huawei CFO Arrest
type: incident
year_started: 2018
from_country: China
to_country: World
when_added: 2019-03-20
longname: I00053 - China Huawei CFO Arrest
summary:
Dec. 1: Canadian authorities arrest Huawei's chief financial officer Meng Wanzhou at Vancouver’s airport while she is en route from Hong Kong to Mexico, after an extradition request from the Americans. The news becomes public on Dec. 5. Dec. 7: In Vancouver, Meng appears in court, where allegations of fraud are laid out. The U.S. alleges Meng misled American banks in a bid to get around American sanctions on Iran. 
Geopolitically complex issue combines US/China trade; Security concerns/issues related to Huawei’s 5G wireless equipment; diplomacy between Canada & China as Chinese subsequently arrest Canadian citizens.

urls:
https://www.theatlantic.com/international/archive/2019/03/czech-zeman-babis-huawei-xi-trump/584158/ https://www.theglobeandmail.com/politics/article-chinas-envoy-says-white-supremacy-played-part-in-canadas-arrest-of/

Notes:
“The Chinese have been very active here,” said General Andor Šándor, a former chief of the Czech military-intelligence service who is now a security consultant. “They don’t want to undermine our relationship with NATO, or the EU, unlike the Russians. What they are really keen on is to squeeze as much technological information from us as possible.”


id: I00054
name: China Muslims
type: incident
year_started: 2018
from_country: China
to_country: World
when_added: 2019-03-20
longname: I00054 - China Muslims
urls:
https://www.ctvnews.ca/world/china-says-foreign-concerns-over-muslim-rights-unwarranted-1.4178042 https://www.reuters.com/investigates/special-report/muslims-camps-china/

Notes:
China rejects the allegations that it has locked up large numbers of Muslims in re-education camps. The facilities, it says, are vocational training centers that emphasize “rehabilitation and redemption” and are part of its efforts to combat terrorism and religious extremism.


id: I00056
name: Iran Influence Operations
type: campaign
year_started: 2012
from_country: Iran
to_country: World
when_added: 2019-03-20
longname: I00056 - Iran Influence Operations
summary:
Iranian interference in the politics of Arab countries has become more self-evident since the Arab Spring of 2011. Iran has been trying to widen its influence in the region in a political confrontation with Saudi Arabia. Factor long-held hostility to US (Iran as a member of the “Axis of Evil”) & Isreal; it’s funding of proxies (Hezbolla) and Shia militia’s in Iraq; and most recently having the Revolutionary Guard being designated a terror organization; the seeming collapse of the Joint Comprehensive Plan of Action (nuclear programme) and expanding economic sanctions all add up to an increased likihood of Iran expanding their information operations.
While there is history to Iran’s information/influence operations, starting with FireEye’s report about Iranian “fake news” websites, and subsequent reports by DFRLab (Jan 31, 2019 and March 26, 2019) we have strong document proof and assets that highlight Iran’s activities.

urls:
https://www.fireeye.com/blog/threat-research/2018/08/suspected-iranian-influence-operation.html https://www.reuters.com/article/us-cyber-iran-specialreport/special-report-how-iran-spreads-disinformation-around-the-world-idUSKCN1NZ1FT https://www.reuters.com/article/us-cyber-iran-specialreport/special-report-how-iran-spreads-disinformation-around-the-world-idUSKCN1NZ1FT https://www.rand.org/blog/2018/08/irans-disinformation-campaigns.html https://medium.com/dfrlab/takedown-details-of-the-iranian-propaganda-network-d1fad32fdf30 https://medium.com/dfrlab/trolltracker-outward-influence-operation-from-iran-cc4539684c8dhttps://comprop.oii.ox.ac.uk/wp-content/uploads/sites/93/2019/04/Iran-Memo.pdf

Notes:
FireEye has identified a suspected influence operation that appears to originate from Iran aimed at audiences in the U.S., U.K., Latin America, and the Middle East.


id: I00057
name: Mexico Election
type: incident
year_started: 2018
from_country: Russia/domestic
to_country: Mexico
when_added: 2019-03-20
longname: I00057 - Mexico Election
urls:
https://www.smh.com.au/world/north-america/misinformation-seeded-by-bots-and-trolls-invades-mexico-s-election-20180502-p4zctx.html https://medium.com/dfrlab/electionwatch-russian-bots-in-mexico-46003fcab4


id: I00058
name: Chemnitz
type: incident
year_started: 2018
from_country: Russia
to_country: Germany
when_added: 2019-03-20
longname: I00058 - Chemnitz
urls:
https://www.thebureauinvestigates.com/stories/2018-09-04/chemnitz-far-right-alternative-news http://www.spiegel.de/international/germany/merkel-facing-turbulence-after-right-wing-unrest-a-1228121.html


id: I00059
name: Myanmar - Rohingya
type: campaign
year_started: 2014
from_country: Myanmar
to_country: Myanmar
Notes: Personal note (see Reuters side bar... end of article) JFG contributed research re: Twitter
when_added: 2019-03-20
longname: I00059 - Myanmar - Rohingya
urls:
https://www.reuters.com/investigates/special-report/myanmar-facebook-hate/ https://www.nytimes.com/2018/10/15/technology/myanmar-facebook-genocide.html?action=click&module=Top%20Stories&pgtype=Homepage https://www.lawfareblog.com/facebooks-role-genocide-myanmar-new-reporting-complicates-narrative


id: I00060
name: White Genocide
type: campaign
year_started: 2018
from_country: Russia
to_country: World
Notes: Personal note (see Reuters side bar... end of article) JFG contributed research re: Twitter
when_added: 2019-03-20
longname: I00060 - White Genocide
urls:
https://www.smh.com.au/world/oceania/the-high-price-of-white-genocide-politics-for-australia-20180724-p4zt9k.html https://www.theatlantic.com/politics/archive/2018/08/trump-white-nationalism/568393/ https://www.iafrikan.com/2018/11/20/social-media-usa-south-africa-fake-news-disinformation/


id: I00061
name: Military veterans Targetting
type: campaign
year_started: 2017
from_country: Russia
to_country: US
when_added: 2019-03-20
longname: I00061 - Military veterans Targetting
urls:
https://www.stripes.com/congressmen-urge-fbi-to-investigate-bots-targeting-veterans-with-fake-news-1.573284 https://www.voanews.com/a/russia-influence-operations-taking-aim-at-us-military/4640751.html https://www.washingtonpost.com/news/the-switch/wp/2017/10/09/russian-operatives-used-twitter-and-facebook-to-target-veterans-and-military-personnel-study-says/?utm_term=.d6fa34d4819c https://comprop.oii.ox.ac.uk/research/working-papers/vetops/


id: I00062
name: Brexit/UK ongoing
type: campaign
year_started: 2015
from_country: Russia/domestic
to_country: UK
when_added: 2019-03-20
longname: I00062 - Brexit/UK ongoing
urls:
https://www.politico.eu/article/britain-nationalist-dark-web-populism-tommy-robinson/? http://www.europarl.europa.eu/thinktank/en/document.html?reference=EPRS_STU(2019)634414

Notes:
This is current, and offers very good "Anatomy of an ecosystem" / EuroParl Think tank study... this is good CASE STUDY I: THE BREXIT CAMPAIGN and this Polarisation by manipulation


id: I00063
name: Olympic Doping Scandal
type: campaign
year_started: 2016
from_country: Russia
to_country: World
urls: https://www.nytimes.com/2016/05/13/sports/russia-doping-sochi-olympics-2014.html?module=inline
when_added: 2019-04-06
longname: I00063 - Olympic Doping Scandal
summary:
On 18 July 2016, Richard McLaren, a Canadian attorney retained by WADA to investigate Grigor Rodchenkov (the former head of Russia's national anti-doping laboratory, the Anti-Doping Center, which was suspended by the World Anti-Doping Agency (WADA) in November 2015 for facilitating Russia's elaborate state-sponsored doping program. Rodchenkov helped develop and distribute banned performance-enhancing substances for thousands of Russian Olympians from 2005 to 2015. He made headlines in 2016 as a whistleblower, helping expose the complex and extensive nature of Russia's doping program. His revelations lead to Russia's partial ban from the 2016 Summer Olympics and total ban from the 2018 Winter Olympics.). These allegations led to a 97-page report covering significant state-sponsored doping in Russia. 

The investigation found corroborating evidence after conducting witness interviews, reviewing thousands of documents, analysis of hard drives, forensic analysis of urine sample collection bottles, and laboratory analysis of individual athlete samples, with "more evidence becoming available by the day." The report concluded that it was shown "beyond a reasonable doubt" that Russia's Ministry of Sport, the Centre of Sports Preparation of the National Teams of Russia, the Federal Security Service (FSB), and the WADA-accredited laboratory in Moscow had "operated for the protection of doped Russian athletes" within a "state-directed failsafe system" using "the disappearing positive [test] methodology" (DPM) after the country's poor medal count during the 2010 Winter Olympic Games in Vancouver. McLaren stated that urine samples were opened in Sochi in order to swap them "without any evidence to the untrained eye". The official producer of BEREG-KIT security bottles used for anti-doping tests, Berlinger Group, stated, "We have no knowledge of the specifications, the methods or the procedures involved in the tests and experiments conducted by the McLaren Commission."


# df_counters

id: C00006
name: Charge for social media
metatechnique: M004 - friction
actors: A033 - social media platform owner
how_found: 2019-11-workshop
tactic: TA01 Strategic Planning
responsetype: D2 Deny
longname: C00006 - Charge for social media
tactic_id: TA01
tactic_name: Strategic Planning
metatechnique_id: M004
metatechnique_name: - friction
summary:
Include a paid-for privacy option, e.g. pay Facebook for an option of them not collecting your personal information.  There are examples of this not work, e.g. most people don’t use proton mail etc. 


id: C00006
name: Censorship
metatechnique: M005 - removal
summary: Alter and/or block the publication/dissemination of adversary controlled information
actors: A031 - social media platform administrator
how_found: grugq
references: Taylor81
tactic: TA01 Strategic Planning
responsetype: D2 Deny
longname: C00006 - Censorship
tactic_id: TA01
tactic_name: Strategic Planning
metatechnique_id: M005
metatechnique_name: - removal
techniques:
T0009 - Create fake experts
T0008 - Create fake or imposter news sites
T0007 - Create fake Social Media Profiles / Pages / Groups
T0013 - Create fake websites
T0014 - Create funding campaign
T0015 - Create hashtag
T0016 - Clickbait 
T0017 - Promote online funding
T0018 - Paid targeted ads
T0022 - Conspiracy narratives
T0021 - Memes 
T0025 - Leak altered documents
T0024 - Create fake videos and images
T0026 - Create fake research
T0045 - Use fake experts
T0043 - Use SMS/WhatsApp/ Chat apps
T0056 - Dedicated channels disseminate information pollution
T0051 - Fabricate social media comment
T0049 - Flooding 
T0052 - Tertiary sites amplify news
T0054 - Twitter bots amplify
T0053 - Twitter trolls amplify and manipulate
T0055 - Use hashtag
T0058 - Legacy web content
T0057 - Organise remote rallies and events


id: C00008
name: Create shared fact-checking database
metatechnique: M006 - scoring
summary: Snopes is best-known example
actors: A007 - factchecker
how_found: 2019-11-workshop 2019-11-search
incident_ids: I00049,I00050
tactic: TA01 Strategic Planning
responsetype: D4 Degrade
longname: C00008 - Create shared fact-checking database
tactic_id: TA01
tactic_name: Strategic Planning
metatechnique_id: M006
metatechnique_name: - scoring
techniques:
TA01 - Strategic Planning
TA06 - Develop Content
TA08 - Pump Priming
T0006 - Create Master Narratives
T0009 - Create fake experts
T0008 - Create fake or imposter news sites
T0013 - Create fake websites
T0014 - Create funding campaigns


id: C00011
name: Media literacy. Games to identify fake news
metatechnique: M001 - resilience
actors: A006 - educator,A026 - games designer,A024 - developer
how_found: 2019-11-workshop
tactic: TA02 Objective Planning
responsetype: D2 Deny
longname: C00011 - Media literacy. Games to identify fake news
tactic_id: TA02
tactic_name: Objective Planning
metatechnique_id: M001
metatechnique_name: - resilience
playbooks:
Game Mechanics:
-Show examples of fake news and train the user to identify them on the basis of various types of indicators
-Use a crowd-sourced mechanism so that the public can categorize newly spreading news sources or articles ala Re-Captcha

techniques:
TA03 - Develop People
TA04 - Develop Networks
TA05 - Microtargeting
TA08 - Pump Priming
TA09 - Exposure
T0059 - Play the long game


id: C00012
name: Platform regulation
metatechnique: M007 - metatechnique
actors: A020 - policy maker,A018 - government,A033 - social media platform owner
how_found: 2019-11-workshop, 2019-11-search
references: Hicks19
tactic: TA01 Strategic Planning
responsetype: D2 Deny
longname: C00012 - Platform regulation
tactic_id: TA01
tactic_name: Strategic Planning
metatechnique_id: M007
metatechnique_name: - metatechnique
summary:
Empower existing regulators to govern social media. Also covers Destroy.  Includes: Include the role of social media in the regulatory framework for media - The European Union created significant new regulations in 2018; the U.S. approach will need to be carefully crafted to protect First Amendment principles, create needed transparency, ensure liability, and impose costs for noncompliance. Includes Create policy that makes social media police disinformation - example: German model: facebook forced to police content by law. Includes: Use fraud legislation to clean up social media

playbooks:
P0001: Develop a regulatory body like the CFPB to regulate and enforce regulation for digital organizations. P0002: Government regulation. Government shutdown. 

techniques:
TA07 - Channel Selection
TA09 - Exposure
TA10 - Go Physical
T0001 - 5Ds (dismiss, distort, distract, dismay, divide)
T0002 - Facilitate State Propaganda
T0007 - Create fake Social Media Profiles / Pages / Groups
T0008 - Create fake or imposter news sites
T0009 - Create fake experts
T0013 - Create fake websites
T0014 - Create funding campaigns
T0015 - Create hashtag
T0016 - Clickbait
T0017 - Promote online funding
T0018 - Paid targeted ads
T0021 - Memes
T0022 - Conspiracy narratives
T0024 - Create fake videos and images
T0025 - Leak altered documents
T0026 - Create fake research
T0043 - Use SMS/ WhatsApp/ Chat apps
T0045 - Use fake experts
T0046 - Search Engine Optimization
T0047 - Muzzle social media as a political force
T0048 - Cow online opinion leaders
T0049 - Flooding
T0051 - Fabricate social media comment
T0052 - Tertiary sites amplify news
T0053 - Twitter trolls amplify and manipulate
T0054 - Twitter bots amplify
T0055 - Use hashtag
T0056 - Dedicated channels disseminate information pollution
T0057 - Organise remote rallies and events
T0061 - Sell merchandising


id: C00013
name: Rating framework for news
metatechnique: M006 - scoring
how_found: 2019-11-workshop
tactic: TA01 Strategic Planning
responsetype: D2 Deny
longname: C00013 - Rating framework for news
tactic_id: TA01
tactic_name: Strategic Planning
metatechnique_id: M006
metatechnique_name: - scoring
summary:
This is "strategic innoculation", raising the standards of what people expect in terms of evidence when consuming news. Example: journalistic ethics, or journalistic licensing body.  Include full transcripts, link source, add items. 


id: C00017
name: Repair broken social connections
metatechnique: M010 - countermessaging
actors: A021 - media organisation
how_found: 2019-11-workshop
tactic: TA01 Strategic Planning
responsetype: D3 Disrupt
longname: C00017 - Repair broken social connections
tactic_id: TA01
tactic_name: Strategic Planning
metatechnique_id: M010
metatechnique_name: - countermessaging
summary:
For example, use a media campaign to promote in-group to out-group in person communication / activities . Technique could be in terms of forcing a reality-check by talking to people instead of reading about bogeymen. 


id: C00019
name: Reduce effect of division-enablers
metatechnique: M003 - daylight
how_found: 2019-11-workshop
tactic: TA01 Strategic Planning
responsetype: D3 Disrupt
techniques: TA08 - Pump Priming TA09 - Exposure TA10 - Go Physical
longname: C00019 - Reduce effect of division-enablers
tactic_id: TA01
tactic_name: Strategic Planning
metatechnique_id: M003
metatechnique_name: - daylight
summary:
includes Promote constructive communication by shaming division-enablers, and Promote playbooks to call out division-enablers

playbooks:
Spread Infographics & Training Material teaching ways to identify and counter divisive rhetorical techniques and content, by stimulating their sense of outrage at being manipulated. Show them how to address the rhetorical technique rather than the content

-Twitter hashtags & paid advertising
-Teach people to identify non-civil/unconstructive conversations and call them out
-Popularize (via memes, infographics) and get the centrists demographic who are tired of polarization to identify such messaging, call it out and display their outrage on the basis of divisive rhetorical techniques rather than merely arguing about the content


id: C00024
name: Promote healthy narratives
metatechnique: M001 - resilience
how_found: 2019-11-workshop
tactic: TA01 Strategic Planning
responsetype: D4 Degrade
longname: C00024 - Promote healthy narratives
tactic_id: TA01
tactic_name: Strategic Planning
metatechnique_id: M001
metatechnique_name: - resilience
summary:
Includes promoting constructive narratives i.e. not polarising (e.g. pro-life, pro-choice, pro-USA).  Includes promoting identity neutral narratives. 

techniques:
TA01 - Strategic Planning
T0006 - Create Master Narratives
T0027 - Adapt existing narratives
T0022 - Conspiracy narratives
T0023 - Distort facts


id: C00026
name: Shore up democracy based messages
metatechnique: M010 - countermessaging
how_found: 2019-11-workshop, 2019-11-search
references: Hicks19
tactic: TA01 Strategic Planning
responsetype: D4 Degrade
techniques: T0002 - Facilitate State Propaganda
longname: C00026 - Shore up democracy based messages
tactic_id: TA01
tactic_name: Strategic Planning
metatechnique_id: M010
metatechnique_name: - countermessaging
summary:
Messages about e.g. peace, freedom. And make it sexy. Includes Deploy Information and Narrative-Building in Service of Statecraft: Promote a narrative of transparency, truthfulness, liberal values, and democracy. Implement a compelling narrative via effective mechanisms of communication. Continually reassess U.S. messages, mechanisms, and audiences over time. Counteract efforts to manipulate media, undermine free markets, and suppress political freedoms via public diplomacy


id: C00027
name: Create culture of civility
metatechnique: M001 - resilience
summary: This is passive. Includes promoting civility as an identity that people will defend.
how_found: 2019-11-workshop
tactic: TA01 Strategic Planning
responsetype: D7 Deter
longname: C00027 - Create culture of civility
tactic_id: TA01
tactic_name: Strategic Planning
metatechnique_id: M001
metatechnique_name: - resilience
playbooks:
Playbook 1: Recruit respected thought leaders to model behavior
Playbook 2: Feature established respected thought leaders to model behavior
Playbook 3: Promote dialog from communities with disparate viewpoints
Playbook 4: Establish facilitation guidelines for "civil" interaction.

techniques:
TA01 - Strategic Planning
TA08 - Pump Priming
T0006 - Create Master Narratives
T0022 - Conspiracy narratives
T0023 - Distort facts
T0027 - Adapt existing narratives
T0047 - Muzzle social media as a political force
T0048 - Cow online opinion leaders
T0053 - Twitter trolls amplify and manipulate


id: C00028
name: Make information provenance available
metatechnique: M011 - verification
how_found: 2019-11-workshop
tactic: TA02 Objective Planning
responsetype: D3 Disrupt
techniques: TA07 - Channel Selection TA08 - Pump Priming TA09 - Exposure TA10 - Go Physical
longname: C00028 - Make information provenance available
tactic_id: TA02
tactic_name: Objective Planning
metatechnique_id: M011
metatechnique_name: - verification
summary:
Blockchain audit log and validation with collaborative decryption to post comments.  Use blockchain technology to require collaborative validation before posts or comments are submitted.

This could be used to adjust upvote weight via a trust factor of people and organisations you trust, or other criteria.


id: C00029
name: Create fake website to issue counter narrative and counter narrative through physical merchandise
metatechnique: M002 - diversion
how_found: 2019-11-workshop
tactic: TA02 Objective Planning
responsetype: D3 Disrupt
tactic_id: TA02
tactic_name: Objective Planning
metatechnique_id: M002
metatechnique_name: - diversion
playbooks:
-Identify ignorant agents (ex: anti-vaxx people willing to pay money to advertise their cause)
-Sell physical merchandise that has instructive counter-effect

Secondary Objective:
-Obtain real-life identity of ignorant agents, to further disrupt their influence activities

longname:
C00029 - Create fake website to issue counter narrative and counter narrative through physical merchandise


id: C00030
name: Develop a compelling counter narrative (truth based)
metatechnique: M002 - diversion
how_found: 2019-11-workshop
tactic: TA02 Objective Planning
responsetype: D3 Disrupt
longname: C00030 - Develop a compelling counter narrative (truth based)
tactic_id: TA02
tactic_name: Objective Planning
metatechnique_id: M002
metatechnique_name: - diversion
summary:
Example: Reality Team.
https://www.isdglobal.org/wp-content/uploads/2016/06/Counter-narrative-Handbook_1.pdf 


id: C00031
name: Dilute the core narrative - create multiple permutations, target / amplify
metatechnique: M009 - dilution
how_found: 2019-11-workshop
tactic: TA02 Objective Planning
responsetype: D3 Disrupt
longname: C00031 - Dilute the core narrative - create multiple permutations, target / amplify
tactic_id: TA02
tactic_name: Objective Planning
metatechnique_id: M009
metatechnique_name: - dilution
summary:
Create competing narratives. Included "Facilitate State Propaganda" as diluting the narrative could have an effect on the pro-state narrative used by volunteers, or lower their involvement.

playbooks:
Playbook 1: Create multiple versions of the narrative and amplify. 
Playbook 2: Dissect narrative, piecemeal the components and then amplify

notes:
CAVEAT: some element of disinformation is simply filling the information space with so much data that it overwhelms people and they shutdown. Any swarm-counter-narrative needs to be cautious of this outcome.

techniques:
T0002 - Facilitate State Propaganda
T0003 - Leverage Existing Narratives
T0006 - Create Master Narratives


id: C00032
name: Hijack content and link to truth- based info
metatechnique: M002 - diversion
summary: Link to platform
how_found: 2019-11-workshop
tactic: TA06 Develop Content
responsetype: D3 Disrupt
longname: C00032 - Hijack content and link to truth- based info
tactic_id: TA06
tactic_name: Develop Content
metatechnique_id: M002
metatechnique_name: - diversion
playbooks:
Playbook 1: Hijack hashtag and redirect conversation to truth based content. 
Playbook 2: Hijack (man in the middle) redirect from bad content to good content


id: C00036
name: Infiltrate the in-group to discredit leaders (divide)
metatechnique: M013 - targeting
summary: All of these would be highly affected by infiltration or false-claims of infiltration.
how_found: 2019-11-workshop
tactic: TA03 Develop People
responsetype: D2 Deny
longname: C00036 - Infiltrate the in-group to discredit leaders (divide)
tactic_id: TA03
tactic_name: Develop People
metatechnique_id: M013
metatechnique_name: - targeting
playbooks:
-Discredit via backstopped blogs/websites showing their past activity and opinions as being opposite to their current ingroup
-Create a trail of commentary about their idea of infiltrating the enemy (current in-group)
-Publicize this by targeting their in-group competitors (ignorant agents)

techniques:
T0005 - Center of Gravity Analysis
T0007 - Create fake Social Media Profiles / Pages / Groups
T0017 - Promote online funding
T0025 - Leak altered documents
T0056 - Dedicated channels disseminate information pollution
T0057 - Organise remote rallies and events


id: C00040
name: third party verification for people
metatechnique: M011 - verification
summary: counters fake experts
how_found: 2019-11-workshop
tactic: TA03 Develop People
responsetype: D2 Deny
techniques: T0009 - Create fake experts
longname: C00040 - third party verification for people
tactic_id: TA03
tactic_name: Develop People
metatechnique_id: M011
metatechnique_name: - verification
playbooks:
- Verify personal credentials 
- Syndicated reputation management (fact-checking syndication) 
- Academia ISAO


id: C00042
name: Address truth contained in narratives
metatechnique: M010 - countermessaging
how_found: 2019-11-workshop
tactic: TA03 Develop People
responsetype: D3 Disrupt
longname: C00042 - Address truth contained in narratives
tactic_id: TA03
tactic_name: Develop People
metatechnique_id: M010
metatechnique_name: - countermessaging
techniques:
T0004 - Competing Narratives
T0019 - Generate information pollution
T0022 - Conspiracy narratives
T0027 - Adapt existing narratives
T0028 - Create competing narratives
T0042 - Kernel of Truth
T0044 - Seed distortions
T0056 - Dedicated channels disseminate information pollution
T0059 - Play the long game


id: C00044
name: Keep people from posting to social media immediately
metatechnique: M004 - friction
actors: A031 - social media platform administrator
resources_needed: R004 - platform algorithms
how_found: 2019-11-workshop
tactic: TA03 Develop People
responsetype: D3 Disrupt
techniques: TA07 - Channel Selection T0049 - Flooding T0054 - Twitter bots amplify
longname: C00044 - Keep people from posting to social media immediately
tactic_id: TA03
tactic_name: Develop People
metatechnique_id: M004
metatechnique_name: - friction
summary:
My interpretation is that this is method would be used to slow down activities or force a small delay between posts or replies to new posts.

playbooks:
Rate restrict via regulation posting above a statistical threshold
Unless account is de-anonymized and advertised as automated messaging


id: C00048
name: Name and Shame Influencers
metatechnique: M003 - daylight
playbooks: Identify the accounts, the real person's name and shame them on social media.
how_found: 2019-11-workshop, 2019-11-search
references: Rand2237 and Dalton19
tactic: TA03 Develop People
responsetype: D7 Deter
longname: C00048 - Name and Shame Influencers
tactic_id: TA03
tactic_name: Develop People
metatechnique_id: M003
metatechnique_name: - daylight
summary:
Think about the different levels: individual vs state-sponsored account.  Includes “call them out” and “name and shame”.  Note that USAID operations were at a different level. Identify social media accounts as sources of propaganda—“calling them out”— might be helpful to prevent the spread of their message to audiences that otherwise would consider them factual. USAID has been restructuring its programs to address predatory Chinese development projects and the information operations that support them. USAID’s new strategy has tailored programs to counter Chinese educational exchange programs and to support free and fair elections, youth empowerment, democratic governance, and free press. USAID’s Russia regional teams have also been compiling a strategy for Russia’s information operations. One strong point of USAID’s programming is a system of indicators and measurements for a country’s vulnerability to foreign influence and information operations.  Identify, monitor, and, if necessary, target externally-based nonattributed social media accounts.  Impact of and Dealing with Trolls - "Chatham House has observed that trolls also sometimes function as decoys, as a way of “keeping the infantry busy” that “aims to wear down the other side” (Lough et al., 2014). Another type of troll involves “false accounts posing as authoritative information sources on social media”.

techniques:
TA08 - Pump Priming
T0048 - Cow online opinion leaders
T0057 - Organise remote rallies and events
T0061 - Sell merchandising


id: C00053
name: Delete old accounts / Remove unused social media accounts
metatechnique: M012 - cleaning
actors: A031 - social media platform administrator,A028 - platform administrator,A012 - account owner
how_found: 2019-11-workshop,2019-11-search
incident_ids: I00004
tactic: TA04 Develop Networks
responsetype: D4 Degrade
techniques: T0011 - Hijack accounts TA06 - Develop Content (D2 Deny) T0008 - Create fake or imposter news sites
longname: C00053 - Delete old accounts / Remove unused social media accounts
tactic_id: TA04
tactic_name: Develop Networks
metatechnique_id: M012
metatechnique_name: - cleaning
playbooks:
Social media companies remove inactive accounts. Account holders remove accounts they're no longer using. Influencers encourage people to remove their inactive accounts "Do you really need that old account" campaign, world-war-two poster-style. Create alternative memorial websites for accounts of deceased people, so their accounts can't be reactivated on 'live' sites. Educate/scare users on the risks of losing control over a dormant account (would their employer be forgiving if an account associated with the user suddenly starting posting extremist content?).


id: C00062
name: Free open library sources worldwide
metatechnique: M010 - countermessaging
how_found: 2019-11-workshop
tactic: TA04 Develop Networks
responsetype: D4 Degrade
techniques: All
longname: C00062 - Free open library sources worldwide
tactic_id: TA04
tactic_name: Develop Networks
metatechnique_id: M010
metatechnique_name: - countermessaging
summary:
Open-source libraries could be created that aid in some way for each technique. Even for Strategic Planning, some open-source frameworks such as AMITT can be created to counter the adversarial efforts.


id: C00070
name: Block access to disinformation resources
metatechnique: M005 - removal
how_found: 2019-11-workshop
tactic: TA02 Objective Planning
responsetype: D2 Deny
longname: C00070 - Block access to disinformation resources
tactic_id: TA02
tactic_name: Objective Planning
metatechnique_id: M005
metatechnique_name: - removal
summary:
Resources = accounts, channels etc.  Block access to platform. DDOS an attacker.

TA02*: DDOS at the critical time (ie. midterm-2018 elections DDOS against troll farms) to deny an adversary's time-bound objective.

T0008: A quick response to a proto-viral story will affect it's ability to spread and raise questions about their legitimacy.

Hashtag: Against the platform, by drowning the hashtag.

T0046 - Search Engine Optimization: Sub-optimal website performance affect its search engine rank, which I interpret as "blocking access to a platform".

techniques:
T0008 - Create fake or imposter news sites
T0014 - Create funding campaigns
T0015 - Create hashtag
T0017 - Promote online funding
T0046 - Search Engine Optimization
T0052 - Tertiary sites amplify news
T0055 - Use hashtag
T0057 - Organise remote rallies and events
T0056 - Dedicated channels disseminate information pollution


id: C00072
name: Remove non-relevant content from special interest groups – not recommended
metatechnique: M005 - removal
how_found: 2019-11-workshop
tactic: TA06 Develop Content
responsetype: D2 Deny
longname: C00072 - Remove non-relevant content from special interest groups – not recommended
tactic_id: TA06
tactic_name: Develop Content
metatechnique_id: M005
metatechnique_name: - removal
techniques:
T0019 - Generate information pollution
T0010 - Cultivate ignorant agents
T0044 - Seed distortions
T0021 - Memes
T0022 - Conspiracy narratives
T0023 - Distort facts
T0026 - Create fake research
T0025 - Leak altered documents
T0027 - Adapt existing narratives
T0039 - Bait legitimate influencers
T0055 - Use hashtag
T0049 - Flooding


id: C00073
name: Inoculate populations through media literacy training
metatechnique: M001 - resilience
how_found: 2019-11-workshop,2019-11-search
references: Rand2237
tactic: TA01 Strategic Planning
responsetype: D2 Deny
longname: C00073 - Inoculate populations through media literacy training
tactic_id: TA01
tactic_name: Strategic Planning
metatechnique_id: M001
metatechnique_name: - resilience
summary:
Use training to build the resilience of at-risk populations. Educate on how to handle info pollution. Push out targeted education on why it's pollution.  Build cultural resistance to false content, e.g. cultural resistance to bullshit.  Influence literacy training, to inoculate against “cult” recruiting.  Media literacy training: leverage librarians / library for media literacy training. Inoculate at language.   Strategic planning included as inoculating population has strategic value. Example is the "Learn to Discern" Program, funded by the Canadian government, operated in Ukraine from July 2015 to March 2016. The program trained 15,000 Ukrainians in ‘’safe, informed media consumption techniques,’’ including avoiding emotional manipulation, verifying sources, identifying hate speech, verifying expert credentials, detecting censorship, and debunking news, photos, and videos.”  Example: NGO Baltic Centre for Media Excellence, with some international funding, provides training to journalists in the Baltics and conducts media literacy training in the region. In addition to helping journalists avoid becoming “unwitting multipliers of misleading information,” the organization works with school teachers in the region to help them “decode media and incorporate media research into teaching.” concepts of media literacy to a mass audience that authorities launch a public information campaign that teaches the program will take time to develop and establish impact, recommends curriculum-based training.  Covers detect, deny, and degrade. 

actors:
A006 - educator,A008 - library,A017 - coordinating body,A009 - NGO,A032 - social media platform outreach,A021 - media organization,A005 - community group,A010 - religious organisation

techniques:
T0016 - Clickbait 
T0019 - Generate information pollution
T0056 - Dedicated channels disseminate information pollution
T0010 - Cultivate ignorant agents
T0021 - Memes
T0022 - Conspiracy narratives
T0023 - Distort facts
T0026 - Create fake research
T0025 - Leak altered documents
T0027 - Adapt existing narratives
T0039 - Bait legitimate influencers
T0040 - Deny insurmountable proof
T0044 - Seed distortions
T0045 - Use fake experts
T0048 - Cow online opinion leaders
T0053 - Twitter trolls amplify and manipulate
T0056 - Dedicated channels disseminate information pollution
T0060 - Continue to amplify


id: C00074
name: Identify and delete or rate limit identical content
metatechnique: M012 - cleaning
actors: A031 - social media platform administrator,A028 - platform administrator
how_found: 2019-11-workshop
tactic: TA06 Develop Content
responsetype: D2 Deny
longname: C00074 - Identify and delete or rate limit identical content
tactic_id: TA06
tactic_name: Develop Content
metatechnique_id: M012
metatechnique_name: - cleaning
playbooks:
In all cases some checks need to prevent deplatforming of highly correlated organic traffic such as a community group copy/pasting their bake sale advert.
Playbook 1: Platform adds a hash of the post to the post metadata and make it publicly available (content addressing). Scrape for duplicate content and deplatform the content/users across affected platforms.
Playbook 2: Platform adds plagiarism score metadata to a post and makes it publicly available. Scrape for duplicate content and deplatform the content/users across affected platforms.
Playbook 3: Use message hashing and fuzzy hashing to detect identical/similar content.
Playbook 4: Use plagiarism algorithm to detect similar blog posts.
Playbook 5: Use basic web scraping techniques, Google dorks, etc to identify similar head lines, uniques phrases, authorship, embedded links and any other correlating data point.

techniques:
T0019 - Generate information pollution
T0021 - Memes
T0022 - Conspiracy narratives
T0026 - Create fake research
T0025 - Leak altered documents
T0043 - Use SMS
T0050 - Cheerleading domestic social media ops
T0051 - Fabricate social media comment
T0049 - Flooding
T0052 - Tertiary sites amplify news
T0053 - Twitter trolls amplify and manipulate
T0054 - Twitter bots amplify
T0055 - Use hashtag
T0057 - Organise remote rallies and events
T0061 - Sell merchandising
T0060 - Continue to amplify


id: C00076
name: Prohibit images in political discourse channels
metatechnique: M005 - removal
how_found: 2019-11-workshop
tactic: TA06 Develop Content
responsetype: D2 Deny
longname: C00076 - Prohibit images in political discourse channels
tactic_id: TA06
tactic_name: Develop Content
metatechnique_id: M005
metatechnique_name: - removal
techniques:
T0016 - Clickbait 
T0018 - Paid targeted ads
T0039 - Bait legitimate influencers
T0044 - Seed distortions
T0021 - Memes


id: C00078
name: Change Search Algorithms for Disinformation Content
metatechnique: M002 - diversion
how_found: 2019-11-workshop
tactic: TA06 Develop Content
responsetype: D3 Disrupt
longname: C00078 - Change Search Algorithms for Disinformation Content
tactic_id: TA06
tactic_name: Develop Content
metatechnique_id: M002
metatechnique_name: - diversion
summary:
Includes “change image search algorithms for hate groups and extremists” and “Change search algorithms for hate and extremist queries to show content sympathetic to opposite side”

techniques:
TA07 - Channel Selection
T0044 - Seed distortions
T0046 - Search Engine Optimization
T0056 - Dedicated channels disseminate information pollution
T0052 - Tertiary sites amplify news
T0060 - Continue to amplify


id: C00080
name: Create competing narrative
metatechnique: M002 - diversion
summary: Could also be degrade
how_found: 2019-11-workshop
tactic: TA06 Develop Content
responsetype: D3 Disrupt
longname: C00080 - Create competing narrative
tactic_id: TA06
tactic_name: Develop Content
metatechnique_id: M002
metatechnique_name: - diversion
techniques:
T0003 - Leverate existing narratives
T0004 - Competing narratives
T0028 - Create competing narratives
T0022 - Conspiracy narratives 
T0027 - Adapt existing narratives 


id: C00081
name: Highlight flooding and noise, and explain motivations
metatechnique: M003 - daylight
how_found: 2019-11-workshop
tactic: TA06 Develop Content
responsetype: D3 Disrupt
longname: C00081 - Highlight flooding and noise, and explain motivations
tactic_id: TA06
tactic_name: Develop Content
metatechnique_id: M003
metatechnique_name: - daylight
summary:
Discredit by pointing out the "noise" and informing public that "flooding" is a technique of disinformation campaigns; point out intended objective of "noise"

techniques:
T0003 - Leverate existing narratives
T0004 - Competing narratives
T0028 - Create competing narratives
T0006 - Create Master Narratives
T0022 - Conspiracy narratives
T0023 - Distort facts
T0026 - Create fake research
T0027 - Adapt existing narratives
T0044 - Seed distortions
T0053 - Twitter trolls amplify and manipulate
T0054 - Twitter bots amplify
T0055 - Use hashtag
T0056 - Dedicated channels disseminate information pollution


id: C00082
name: Ground truthing as automated response to pollution
metatechnique: M010 - countermessaging
how_found: 2019-11-workshop
tactic: TA06 Develop Content
responsetype: D3 Disrupt
longname: C00082 - Ground truthing as automated response to pollution
tactic_id: TA06
tactic_name: Develop Content
metatechnique_id: M010
metatechnique_name: - countermessaging
summary:
e.g. RealityTeam work that adds clear information to spaces with disinformation in.  Also inoculation.

techniques:
T0002 - Facilitate State Propaganda
T0003 - Leverate existing narratives
T0004 - Competing narratives
T0028 - Create competing narratives
T0006 - Create Master Narratives
T0022 - Conspiracy narratives
T0023 - Distort facts
T0025 - Leak altered documents
T0026 - Create fake research
T0027 - Adapt existing narratives
T0044 - Seed distortions
T0053 - Twitter trolls amplify and manipulate
T0054 - Twitter bots amplify
T0055 - Use hashtag
T0056 - Dedicated channels disseminate information pollution


id: C00084
name: Modify disinformation narratives, and rebroadcast them
metatechnique: M002 - diversion
how_found: 2019-11-workshop
tactic: TA06 Develop Content
responsetype: D3 Disrupt
longname: C00084 - Modify disinformation narratives, and rebroadcast them
tactic_id: TA06
tactic_name: Develop Content
metatechnique_id: M002
metatechnique_name: - diversion
summary:
Includes “poison pill recasting of message” and “steal their truths”.  Many techniques involve promotion which could be manipulated. For example, online fundings or rallies could be advertised, through compromised or fake channels, as being associated with "far-up/down/left/right" actors. "Long Game" narratives could be subjected in a similar way with negative connotations.  Can also replay technique T0003. 

techniques:
T0002 - Facilitate State Propaganda
T0003 - Leverate existing narratives
T0004 - Competing narratives
T0028 - Create competing narratives
T0006 - Create Master Narratives
T0022 - Conspiracy narratives
T0027 - Adapt existing narratives
T0059 - Play the long game


id: C00085
name: Mute content
metatechnique: M003 - daylight
how_found: 2019-11-workshop
tactic: TA06 Develop Content
responsetype: D3 Disrupt
longname: C00085 - Mute content
tactic_id: TA06
tactic_name: Develop Content
metatechnique_id: M003
metatechnique_name: - daylight
summary:
Rate-limit disinformation content.  Reduces its effects, whilst not running afoul of censorship concerns.

Online archives of content (archives of websites, social media profiles, media, copies of published advertisements; or archives of comments attributed to bad actors, as well as anonymized metadata about users who interacted with them and analysis of the effect) is useful for intelligence analysis and public transparency, but will need similar muting or tagging/ shaming as associated with bad actors.

techniques:
T0008 - Create fake or imposter news sites
T0007 - Create fake Social Media Profiles / Pages / Groups
T0017 - Promote online funding
T0022 - Conspiracy narratives
T0021 - Memes 
T0025 - Leak altered documents
T0024 - Create fake videos and images
T0026 - Create fake research
T0045 - Use fake experts
T0044 - Seed distortions
T0049 - Flooding 
T0051 - Fabcricate social media comment
T0052 - Tertiary sites amplify news
T0053 - Twitter trolls amplify and manipulate
T0054 - Twitter bots amplify
T0055 - Use hashtag
T0056 - Dedicated channels disseminate information pollution
T0057 - Organise remote rallies and events
T0061 - Sell merchandising
T0060 - Continue to amplify


id: C00086
name: Distract from noise with addictive content
metatechnique: M002 - diversion
how_found: 2019-11-workshop
tactic: TA06 Develop Content
responsetype: D4 Degrade
longname: C00086 - Distract from noise with addictive content
tactic_id: TA06
tactic_name: Develop Content
metatechnique_id: M002
metatechnique_name: - diversion
summary:
Example: Interject addictive links or contents into discussions of disinformation materials and measure a "conversion rate" of users who engage with your content and away from the social media channel's "information bubble" around the disinformation item. Use bots to amplify and upvote the addictive content. 

Note: This sounds eerlily like many Reddit communities where the most upvoted comments are all jokes, preventing serious discussion from being discovered by those who filter by upvotes.

techniques:
T0044 - Seed distortions
T0050 - Cheerleading domestic social media ops
T0051 - Fabricate social media comment
T0049 - Flooding 
T0054 - Twitter bots amplify
T0053 - Twitter trolls amplify and manipulate
T0055 - Use hashtag


id: C00087
name: Make more noise than the disinformation
metatechnique: M009 - dilution
summary: Examples: kPop stans, #proudboys takeover by LGBT community
how_found: 2019-11-workshop
tactic: TA06 Develop Content
responsetype: D4 Degrade
longname: C00087 - Make more noise than the disinformation
tactic_id: TA06
tactic_name: Develop Content
metatechnique_id: M009
metatechnique_name: - dilution
techniques:
T0039 - Bait legitimate influencers
T0044 - Seed distortions
T0048 - Cow online opinion leaders
T0050 - Cheerleading domestic social media ops
T0051 - Fabricate social media comment
T0049 - Flooding 
T0052 - Tertiary sites amplify news
T0054 - Twitter bots amplify
T0053 - Twitter trolls amplify and manipulate
T0055 - Use hashtag
T0056 - Dedicated channels disseminate information pollution


id: C00091
name: Honeypot social community
metatechnique: M002 - diversion
summary: Set honeypots, e.g. communities, in networks likely to be used for disinformation.
how_found: 2019-11-workshop
tactic: TA06 Develop Content
responsetype: D5 Deceive
longname: C00091 - Honeypot social community
tactic_id: TA06
tactic_name: Develop Content
metatechnique_id: M002
metatechnique_name: - diversion
techniques:
T0062 - Message reach
T0063 - Social media engagement
T0054 - Twitter bots amplify
T0053 - Twitter trolls amplify and manipulate
T0049 - Flooding


id: C00092
name: Establish a truth teller reputation score for influencers
metatechnique: M006 - scoring
actors: A001 - data scientist
resources_needed: R001 - datastreams
how_found: 2019-11-workshop
tactic: TA02 Objective Planning
responsetype: D7 Deter
longname: C00092 - Establish a truth teller reputation score for influencers
tactic_id: TA02
tactic_name: Objective Planning
metatechnique_id: M006
metatechnique_name: - scoring
summary:
Includes "Establish a truth teller reputation score for influencers” and “Reputation scores for social media users”.  Influencers are individuals or accounts with many followers. 

techniques:
TA07 - Channel Selection
TA08 - Pump Priming
T0010 - Cultivate ignorant agents
T0023 - Distort facts
T0039 - Bait legitimate influencers
T0045 - Use fake experts
T0044 - Seed distortions
T0054 - Twitter bots amplify
T0053 - Twitter trolls amplify and manipulate
T0056 - Dedicated channels disseminate information pollution


id: C00093
name: Influencer code of conduct
metatechnique: M001 - resilience
how_found: 2019-11-workshop
tactic: TA03 Develop People
responsetype: D7 Deter
longname: C00093 - Influencer code of conduct
tactic_id: TA03
tactic_name: Develop People
metatechnique_id: M001
metatechnique_name: - resilience
summary:
Establish tailored code of conduct for individuals with many followers.  Can be platform code of conduct; can also be community code, e.g. the Pro-Truth Pledge. 

techniques:
TA07 - Channel Selection
T0010 - Cultivate ignorant agents
T0017 - Promote online funding
T0039 - Bait legitimate influencers
T0047 - Muzzle social media as a political force
T0048 - Cow online opinion leaders
T0053 - Twitter trolls amplify and manipulate


id: C00096
name: Strengthen institutions that are always truth tellers
metatechnique: M006 - scoring
how_found: 2019-11-workshop
tactic: TA01 Strategic Planning
responsetype: D7 Deter
longname: C00096 - Strengthen institutions that are always truth tellers
tactic_id: TA01
tactic_name: Strategic Planning
metatechnique_id: M006
metatechnique_name: - scoring
techniques:
T0022 - Conspiracy narratives
T0027 - Adapt existing narrativies
T0026 - Create fake research
T0024 - Create fake videos and images
T0023 - Distort facts
T0025 - Leak altered documents


id: C00097
name: Require use of verified identities to contribute to poll or comment
metatechnique: M004 - friction
actors: A031 - social media platform administrator
resources_needed: R004 - platform algorithms
how_found: 2019-11-workshop
tactic: TA07 Channel Selection
responsetype: D2 Deny
longname: C00097 - Require use of verified identities to contribute to poll or comment
tactic_id: TA07
tactic_name: Channel Selection
metatechnique_id: M004
metatechnique_name: - friction
techniques:
T0029 - Manipulate online polls
T0030 - Backstop personas
T0045 - Use fake experts
T0009 - Create fake experts
T0007 - Create fake Social Media Profiles / Pages / Groups
T0054 - Twitter bots amplify
T0053 - Twitter trolls amplify and manipulate


id: C00099
name: Strengthen verification methods
metatechnique: M004 - friction
actors: A031 - social media platform administrator
resources_needed: R004 - platform algorithms
how_found: 2019-11-workshop
tactic: TA07 Channel Selection
responsetype: D2 Deny
longname: C00099 - Strengthen verification methods
tactic_id: TA07
tactic_name: Channel Selection
metatechnique_id: M004
metatechnique_name: - friction
techniques:
T0030 - Backstop personas
T0045 - Use fake experts
T0009 - Create fake experts
T0008 - Create fake or imposter news sites
T0007 - Create fake Social Media Profiles / Pages / Groups


id: C00101
name: Create friction by rate-limiting engagement
metatechnique: M004 - friction
summary: Create participant friction. Includes Make repeat voting hard, and throttle number of forwards.
actors: A031 - social media platform administrator
resources_needed: R004 - platform algorithms
how_found: 2019-11-workshop
tactic: TA07 Channel Selection
responsetype: D4 Degrade
longname: C00101 - Create friction by rate-limiting engagement
tactic_id: TA07
tactic_name: Channel Selection
metatechnique_id: M004
metatechnique_name: - friction
techniques:
T0029 - Manipulate online polls
T0049 - Flooding 
T0053 - Twitter trolls amplify and manipulate
T0054 - Twitter bots amplify


id: C00103
name: Create a bot that engages / distract trolls
metatechnique: M002 - diversion
summary: This is reactive, not active measure (honeypots are active). It's a platform controlled measure.
actors: A024 - developer
how_found: 2019-11-workshop
tactic: TA07 Channel Selection
responsetype: D5 Deceive
longname: C00103 - Create a bot that engages / distract trolls
tactic_id: TA07
tactic_name: Channel Selection
metatechnique_id: M002
metatechnique_name: - diversion
techniques:
T0029 - Manipulate online polls
T0062 - Message Reach
T0063 - Social Media Engagement
T0053 - Twitter trolls amplify and manipulate


id: C00107
name: Content moderation
metatechnique: M006 - scoring, M005 - removal
summary: includes social media content take-downs, e.g. facebook or Twitter content take-downs
actors: A031 - social media platform administrator
how_found: 2019-11-workshop, 2019-11-search
incident_ids: I00005,I00009,I00056
tactic: TA06 Develop Content
responsetype: D2 Deny
longname: C00107 - Content moderation
tactic_id: TA06
tactic_name: Develop Content
metatechnique_id: M006
metatechnique_name: - scoring, M005 - removal
techniques:
T0009 - Create fake experts
T0008 - Create fake or imposter news sites
T0007 - Create fake Social Media Profiles / Pages / Groups
T0013 - Create fake websites
T0014 - Create funding campaign
T0015 - Create hashtag
T0016 - Clickbait 
T0017 - Promote online funding
T0018 - Paid targeted ads
T0021 - Memes 
T0025 - Leak altered documents
T0024 - Create fake videos and images
T0026 - Create fake research
T0045 - Use fake experts
T0055 - Use hashtag
T0057 - Organise remote rallies and events
T0001 - 5Ds (dismiss, distort, distract, dismay, divide)
T0022 - Conspiracy narratives
T0027 - Adapt existing narratives
T0061 - Sell merchandising


id: C00115
name: Expose actor and intentions
metatechnique: M003 - daylight
how_found: 2019-11-workshop
tactic: TA08 Pump Priming
responsetype: D2 Deny
longname: C00115 - Expose actor and intentions
tactic_id: TA08
tactic_name: Pump Priming
metatechnique_id: M003
metatechnique_name: - daylight
techniques:
T0041 - Deny involvement
T0048 - Cow online opinion leaders
T0052 - Tertiary sites amplify news
T0053 - Twitter trolls amplify and manipulate
T0056 - Dedicated channels disseminate information pollution


id: C00117
name: Downgrade / de-amplify so message is seen by fewer people
metatechnique: M010 - countermessaging
summary: Label promote counter to disinformation
how_found: 2019-11-workshop
tactic: TA08 Pump Priming
responsetype: D4 Degrade
longname: C00117 - Downgrade / de-amplify so message is seen by fewer people
tactic_id: TA08
tactic_name: Pump Priming
metatechnique_id: M010
metatechnique_name: - countermessaging
techniques:
T0046 - Search engine optimization
T0022 - Conspiracy narratives
T0021 - Memes 
T0025 - Leak altered documents
T0024 - Create fake videos and images
T0026 - Create fake research
T0045 - Use fake experts
T0044 - Seed distortions
T0060 - Continue to amplify


id: C00119
name: Engage payload and debunk. Provide link to facts.
metatechnique: M010 - countermessaging
summary: Might be okay.
how_found: 2019-11-workshop
tactic: TA08 Pump Priming
responsetype: D7 Deter
longname: C00119 - Engage payload and debunk. Provide link to facts.
tactic_id: TA08
tactic_name: Pump Priming
metatechnique_id: M010
metatechnique_name: - countermessaging
techniques:
T0022 - Conspiracy narratives
T0021 - Memes 
T0025 - Leak altered documents
T0024 - Create fake videos and images
T0026 - Create fake research
T0045 - Use fake experts
T0044 - Seed distortions
T0060 - Continue to amplify


id: C00120
name: Open dialogue about design of platforms to produce different outcomes
metatechnique: M007 - metatechnique
how_found: 2019-11-workshop
tactic: TA08 Pump Priming
responsetype: D7 Deter
longname: C00120 - Open dialogue about design of platforms to produce different outcomes
tactic_id: TA08
tactic_name: Pump Priming
metatechnique_id: M007
metatechnique_name: - metatechnique
techniques:
T0047 - Muzzle social media as a political force
T0052 - Tertiary sites amplify news
T0053 - Twitter trolls amplify and manipulate
T0054 - Twitter bots amplify
T0055 - Use hashtag
T0056 - Dedicated channels disseminate information pollution


id: C00122
name: Content moderation
metatechnique: M004 - friction
summary: Beware: content moderation misused becomes censorship.
actors: A031 - social media platform administrator
how_found: 2019-11-workshop
tactic: TA09 Exposure
responsetype: D2 Deny
longname: C00122 - Content moderation
tactic_id: TA09
tactic_name: Exposure
metatechnique_id: M004
metatechnique_name: - friction
techniques:
T0008 - Create fake or imposter news sites
T0007 - Create fake Social Media Profiles / Pages / Groups
T0014 - Create funding campaign
T0015 - Create hashtag
T0016 - Clickbait 
T0017 - Promote online funding
T0018 - Paid targeted ads
T0022 - Conspiracy narratives
T0021 - Memes 
T0025 - Leak altered documents
T0024 - Create fake videos and images
T0026 - Create fake research
T0045 - Use fake experts
T0044 - Seed distortions
T0049 - Flooding 
T0051 - Fabcricate social media comment
T0052 - Tertiary sites amplify news
T0053 - Twitter trolls amplify and manipulate
T0054 - Twitter bots amplify
T0055 - Use hashtag
T0056 - Dedicated channels disseminate information pollution
T0057 - Organise remote rallies and events
T0061 - Sell merchandising
T0060 - Continue to amplify


id: C00123
name: Remove or rate limit botnets
metatechnique: M004 - friction
how_found: 2019-11-workshop
tactic: TA09 Exposure
responsetype: D3 Disrupt
longname: C00123 - Remove or rate limit botnets
tactic_id: TA09
tactic_name: Exposure
metatechnique_id: M004
metatechnique_name: - friction
techniques:
T0029 - Manipulate online polls
T0049 - Flooding
T0054 - Twitter bots amplify
T0060 - Continue to amplify


id: C00124
name: Don't feed the trolls
metatechnique: M004 - friction
actors: A015 - general public,A021 - media organisation
how_found: 2019-11-workshop
tactic: TA09 Exposure
responsetype: D3 Disrupt
longname: C00124 - Don't feed the trolls
tactic_id: TA09
tactic_name: Exposure
metatechnique_id: M004
metatechnique_name: - friction
techniques:
TA08 - Pump Priming
TA09 – Exposure
T0053 - Twitter trolls amplify and manipulate
T0063 - Social media engagement


id: C00125
name: Prebunking
metatechnique: M001 - resilience
how_found: 2019-11-workshop
tactic: TA09 Exposure
responsetype: D3 Disrupt
longname: C00125 - Prebunking
tactic_id: TA09
tactic_name: Exposure
metatechnique_id: M001
metatechnique_name: - resilience
techniques:
T0056 - Dedicated channels disseminate information pollution
T0052 - Tertiary sites amplify news
T0054 - Twitter bots amplify
T0053 - Twitter trolls amplify and manipulate
T0055 - Use hashtag
T0045 - Use fake experts
T0022 - Conspiracy narratives
T0027 - Adapt existing narratives
T0002 - Facilitate State Propaganda
T0003 - Leverage existing narratives
T0004 - Competing narratives
T0010 - Cultivate ignorant agents


id: C00126
name: Social media amber alert
metatechnique: M003 - daylight
how_found: 2019-11-workshop
tactic: TA09 Exposure
responsetype: D3 Disrupt
longname: C00126 - Social media amber alert
tactic_id: TA09
tactic_name: Exposure
metatechnique_id: M003
metatechnique_name: - daylight
techniques:
T0056 - Dedicated channels disseminate information pollution
T0052 - Tertiary sites amplify news
T0054 - Twitter bots amplify
T0053 - Twitter trolls amplify and manipulate
T0055 - Use hashtag
T0045 - Use fake experts
T0022 - Conspiracy narratives
T0027 - Adapt existing narratives
T0002 - Facilitate State Propaganda
T0003 - Leverage existing narratives
T0004 - Competing narratives
T0010 - Cultivate ignorant agents
T0057 - Organise remote rallies and events


id: C00128
name: Create friction by marking content with ridicule or other "decelerants"
metatechnique: M009 - dilution
actors: A003 - trusted authority
how_found: 2019-11-workshop
tactic: TA09 Exposure
responsetype: D3 Disrupt
longname: C00128 - Create friction by marking content with ridicule or other "decelerants"
tactic_id: TA09
tactic_name: Exposure
metatechnique_id: M009
metatechnique_name: - dilution
techniques:
T0050 - Cheerleading domestic social media ops
T0056 - Dedicated channels disseminate information pollution
T0049 - Flooding 
T0052 - Tertiary sites amplify news
T0054 - Twitter bots amplify
T0053 - Twitter trolls amplify and manipulate
T0055 - Use hashtag
T0057 - Organise remote rallies and events
T0061 - Sell merchandising


id: C00129
name: Use banking to cut off access
metatechnique: M014 - reduce resources
summary: fiscal sanctions; parallel to counter terrorism
how_found: 2019-11-workshop
tactic: TA09 Exposure
responsetype: D2 Deny
longname: C00129 - Use banking to cut off access
tactic_id: TA09
tactic_name: Exposure
metatechnique_id: M014
metatechnique_name: - reduce resources
techniques:
T0057 - Organise remote rallies and events
T0061 - Sell merchandising
T0014 - Create funding campaign
T0017 - Promote online funding
T0018 - Paid targeted ads


id: C00133
name: Deplatform Account*
metatechnique: M005 - removal
summary: Note: Similar to Deplatform People but less generic. Perhaps both should be left.
actors: A031 - social media platform administrator
how_found: 2019-11-workshop
tactic: TA03 Develop People
responsetype: D3 Disrupt
longname: C00133 - Deplatform Account*
tactic_id: TA03
tactic_name: Develop People
metatechnique_id: M005
metatechnique_name: - removal
techniques:
TA07 - Channel Selection
TA09 - Exposure
TA10 - Go Physical
T0007 - Create fake Social Media Profiles / Pages / Groups
T0009 - Create fake experts
T0045 - Use fale experts
T0011 - Hijack legitimate account
T0045 - Use fake experts


id: C00135
name: Deplatform message groups and/or message boards
metatechnique: M005 - removal
summary: Merged two rows here.
actors: A031 - social media platform administrator
how_found: 2019-11-workshop
tactic: TA04 Develop Networks
responsetype: D3 Disrupt
longname: C00135 - Deplatform message groups and/or message boards
tactic_id: TA04
tactic_name: Develop Networks
metatechnique_id: M005
metatechnique_name: - removal
techniques:
TA07 - Channel Selection
TA09 - Exposure
TA10 - Go Physical
T0007 - Create fake Social Media Profiles / Pages / Groups
T0043 - Use SMS/ WhatsApp/ Chat apps


id: C00136
name: Microtarget most likely targets then send them countermessages
metatechnique: M010 - countermessaging
how_found: 2019-11-workshop
tactic: TA08 Pump Priming
responsetype: D3 Disrupt
longname: C00136 - Microtarget most likely targets then send them countermessages
tactic_id: TA08
tactic_name: Pump Priming
metatechnique_id: M010
metatechnique_name: - countermessaging
playbooks:
Playbook 1: Work with platform to identify active target audiences through finanical data and messaging.
Playbook 2: Use a platform's publicly available advertising/targeting capabilities to enumerate a list of possible microtargeted demographics. Compare these to known TAs of past/ongoing influence ops to identify the vulnerable demographics. 

techniques:
TA08 - Pump Priming
TA09 - Exposure
TA10 - Go Physical
T0010 - Cultivate ignorant agents
T0020 - Trial content
T0063 - Social media engagement


id: C00140
name: "Bomb" link shorteners with lots of calls
metatechnique: M008 - data pollution
how_found: 2019-11-workshop
tactic: TA12 Measure Effectiveness
responsetype: D3 Disrupt
techniques: TA05 - Microtargeting TA09 - Exposure* TA10 - Go Physical
longname: C00140 - "Bomb" link shorteners with lots of calls
tactic_id: TA12
tactic_name: Measure Effectiveness
metatechnique_id: M008
metatechnique_name: - data pollution
summary:
Applies to most of the content used by exposure techniques except "T0055 - Use hashtag”. Applies to analytics

playbooks:
Playbook 1: DDoS adversary link shorteners by spamming real links.
Playbook 2: Compromise service and reroute links to benign content or counter messaging.


id: C00142
name: Platform adds warning label and decision point when sharing content
metatechnique: M004 - friction
actors: A031 - social media platform administrator
resources_needed: R004 - platform algorithms
how_found: 2019-11-workshop
tactic: TA06 Develop Content
responsetype: D4 Degrade
techniques: TA05 - Microtargeting TA09 - Exposure TA10 - Go Physical TA11 - Persistence T0016 - Clickbait
longname: C00142 - Platform adds warning label and decision point when sharing content
tactic_id: TA06
tactic_name: Develop Content
metatechnique_id: M004
metatechnique_name: - friction
summary:
Includes “this has been disproved: do you want to forward it”. Includes “"Hey this story is old" popup when messaging with old URL” - this assumes that this technique is based on visits to an URL shortener or a captured news site that can publish a message of our choice.  Includes “mark clickbait visually”. 


id: C00148
name: Add random links to network graphs
metatechnique: M008 - data pollution
actors: A031 - social media platform administrator
resources_needed: R004 - platform algorithms
how_found: 2019-11-workshop
tactic: TA12 Measure Effectiveness
responsetype: D4 Degrade
techniques: T0062 - Message reach T0063 - Social media engagement
longname: C00148 - Add random links to network graphs
tactic_id: TA12
tactic_name: Measure Effectiveness
metatechnique_id: M008
metatechnique_name: - data pollution
summary:
If creators are using network analysis to determine how to attack networks, then adding random extra links to those networks might throw that analysis out enough to change attack outcomes. Unsure which AMITT techniques.

playbooks:
Playbook 1: Degrade TA engagement using bots; direct the adversary to engage insular bot communities-within-communities rather than the authentic target audience.
Playbook 2: Degrade MOEs/MOPs by faking inter-community sharing.


id: C00149
name: Poison the monitoring & evaluation data
metatechnique: M008 - data pollution
how_found: 2019-11-workshop
tactic: TA12 Measure Effectiveness
responsetype: D4 Degrade
longname: C00149 - Poison the monitoring & evaluation data
tactic_id: TA12
tactic_name: Measure Effectiveness
metatechnique_id: M008
metatechnique_name: - data pollution
summary:
Includes Pollute the AB-testing data feeds: Polluting A/B testing requires knowledge of MOEs and MOPs. A/B testing must be caught early when there is relatively little data available so infiltration of TAs and understanding of how content is migrated from testing to larger audiences is fundamental.

playbooks:
Playbook 1: Distort TA demographics by posting irrelevant content, misleading demogaphic data, etc.
Playbook 2: Work with the media platform to distort publicly available metrics. Can we work with Twitter to get crappy off-brand memes artificially bumped without needing to create fake accounts, etc.?
Playbook 3: Use adtech to promote content inconsistent with TA demographics. If the adversary is reverse engineering a groups demographics by analyzing ads placed on the platform/group, by spamming ads for out-group stuff it may distort analysis of the group.
Playbook 4: Distort Google Trends and other publicly available source of metrics using bots, cyborgs, adtech.
Playbook 5: Distort TA emotional response to content/narratives.
Playbook 6: Promote damp squibs. Within a known TA promote/inflate crappy off-brand memes which are unlikley to resonate.
Playbook 7: Detect early trending/engagement and undermine the content by responding with 5Ds, toxic community behaviour, satirical responses, etc.
Playbook 8: If adtech is used, fake clicks and engagements on the content.

techniques:
TA12 - Measure Effectiveness
T0020 - Trial content
T0046 - Search Engine Optimization
T0057 - Organise  remote rallies and events
T0063 - Social media engagement


id: C00153
name: Take pre-emptive action against actors' infrastructure
metatechnique: M013 - targeting
actors: A027 - information security
how_found: 2019-11-search
references: Dalton19
tactic: TA01 Strategic Planning
responsetype: D3 Disrupt
longname: C00153 - Take pre-emptive action against actors' infrastructure
tactic_id: TA01
tactic_name: Strategic Planning
metatechnique_id: M013
metatechnique_name: - targeting
summary:
Align offensive cyber action with information operations and counter disinformation approaches, where appropriate.

techniques:
T0008 - Create fake or imposter news sites
T0007 - Create fake Social Media Profiles / Pages / Groups
T0011 - Hijack legitimate account
T0013 - Create fake websites
T0014 - Create funding campaign
T0017 - Promote online funding
T0018 - Paid targeted ads
T0056 - Dedicated channels disseminate information pollution
T0049 - Flooding 
T0052 - Tertiary sites amplify news
T0054 - Twitter bots amplify
T0053 - Twitter trolls amplify and manipulate
T0058 - Legacy web content
T0057 - Organise remote rallies and events
T0061 - Sell merchandising


id: C00156
name: Better tell your country or organization story
metatechnique: M010 - countermessaging
actors: A018 - government,A019 - military
how_found: 2019-11-search
references: Rand2237
tactic: TA02 Objective Planning
responsetype: D3 Disrupt
longname: C00156 - Better tell your country or organization story
tactic_id: TA02
tactic_name: Objective Planning
metatechnique_id: M010
metatechnique_name: - countermessaging
summary:
Civil engagement activities conducted on the part of EFP forces. In Latvia, for example, U.S. soldiers have reportedly conducted numerous civil engagements with the local populations. In one example, soldiers cut firewood for local Russian-speaking Latvians. Locals were reportedly overheard saying, “A Russian soldier wouldn’t do that.” NATO should likewise provide support and training, where needed, to local public affairs and other communication personnel. Local government and military public affairs personnel can play their part in creating and disseminating entertaining and sharable content that supports the EFP mission. 

techniques:
T0022 - Conspiracy narratives
T0027 - Adapt existing narratives
T0002 - Facilitate State Propaganda
T0003 - Leverage existing narratives
T0004 - Competing narratives
T0010 - Cultivate ignorant agents


id: C00159
name: Have a disinformation response plan
metatechnique: M007 - metatechnique
how_found: 2019-11-search
references: Hicks19
tactic: TA01 Strategic Planning
responsetype: D3 Disrupt
longname: C00159 - Have a disinformation response plan
tactic_id: TA01
tactic_name: Strategic Planning
metatechnique_id: M007
metatechnique_name: - metatechnique
summary:
e.g. Create a campaign plan and toolkit for competition short of armed conflict (this used to be called “the grey zone”). The campaign plan should account for own vulnerabilities and strengths, and not over-rely on any one tool of statecraft or line of effort.  It will identify and employ a broad spectrum of national power to deter, compete, and counter (where necessary) other countries’ approaches, and will include understanding of own capabilities, capabilities of disinformation creators, and international standards of conduct to compete in, shrink the size, and ultimately deter use of competition short of armed conflict.


id: C00160
name: find and train influencers
metatechnique: M001 - resilience
actors: A001 - data scientist,A016 - influencer
how_found: 2019-11-search
references: Rand2237
tactic: TA03 Develop People
responsetype: D2 Deny
longname: C00160 - find and train influencers
tactic_id: TA03
tactic_name: Develop People
metatechnique_id: M001
metatechnique_name: - resilience
summary:
Identify key influencers (e.g. use network analysis), then reach out to identified users and offer support, through either training or resources.

techniques:
T0039 - Bait legitimate inffluencers
T0010 - Cultivate ignorant agents
T0048 - Cow online opinion leaders


id: C00161
name: Coalition Building with stakeholders and Third-Party Inducements
metatechnique: M007 - metatechnique
how_found: 2019-11-search
references: Dalton19
tactic: TA01 Strategic Planning
responsetype: D7 Deter
longname: C00161 - Coalition Building with stakeholders and Third-Party Inducements
tactic_id: TA01
tactic_name: Strategic Planning
metatechnique_id: M007
metatechnique_name: - metatechnique
summary:
Advance coalitions across borders and sectors, spanning public and private, as well as foreign and domestic, divides. Improve mechanisms to collaborate, share information, and develop coordinated approaches with the private sector at home and allies and partners abroad.

techniques:
T0022 - Conspiracy narratives
T0027 - Adapt existing narratives
T0002 - Facilitate State Propaganda
T0003 - Leverage existing narratives
T0004 - Competing narratives


id: C00162
name: Unravel/target the Potemkin villages
metatechnique: M013 - targeting
how_found: 2019-11-search
references: Rand2237
tactic: TA04 Develop Networks
responsetype: D3 Disrupt
longname: C00162 - Unravel/target the Potemkin villages
tactic_id: TA04
tactic_name: Develop Networks
metatechnique_id: M013
metatechnique_name: - targeting
summary:
Kremlin’s narrative spin extends through constellations of “civil society” organizations, political parties, churches, and other actors. Moscow leverages think tanks, human rights groups, election observers, Eurasianist integration groups, and orthodox groups. A collection of Russian civil society organizations, such as the Federal Agency for the Commonwealth of Independent States Affairs, Compatriots Living Abroad, and International Humanitarian Cooperation, together receive at least US$100 million per year, in addition to government-organized nongovernmental organizations (NGOs), at least 150 of which are funded by Russian presidential grants totaling US$70 million per year.

techniques:
T0010 - Cultivate ignorant agents
T0022 - Conspiracy narratives
T0027 - Adapt existing narratives
T0002 - Facilitate State Propaganda
T0003 - Leverage existing narratives
T0004 - Competing narratives
T0039 - Bait legitimate inffluencers
T0052 - Tertiary sites amplify news
T0056 - Dedicated channels disseminnate information pollution
T0050 - Cheerleading domemstic social media ops


id: C00164
name: compatriot policy
metatechnique: M013 - targeting
how_found: 2019-11-search
references: Rand2237
tactic: TA02 Objective Planning
responsetype: D3 Disrupt
longname: C00164 - compatriot policy
tactic_id: TA02
tactic_name: Objective Planning
metatechnique_id: M013
metatechnique_name: - targeting
summary:
protect the interests of this population and, more importantly, influence the population to support pro-Russia causes and effectively influence the politics of its neighbors

techniques:
T0022 - Conspiracy narratives
T0027 - Adapt existing narratives
T0002 - Facilitate State Propaganda
T0003 - Leverage existing narratives
T0004 - Competing narratives


id: C00169
name: develop a creative content hub
metatechnique: M010 - countermessaging
how_found: 2019-11-search
references: Rand2237
tactic: TA02 Objective Planning
responsetype: D3 Disrupt
longname: C00169 - develop a creative content hub
tactic_id: TA02
tactic_name: Objective Planning
metatechnique_id: M010
metatechnique_name: - countermessaging
summary:
international donors will donate to a basket fund that will pay a committee of local experts who will, in turn, manage and distribute the money to Russian-language producers and broadcasters that pitch various projects.

techniques:
T0010 - Cultivate ignorant agents
T0022 - Conspiracy narratives
T0027 - Adapt existing narratives
T0002 - Facilitate State Propaganda
T0003 - Leverage existing narratives
T0004 - Competing narratives
T0039 - Bait legitimate inffluencers


id: C00170
name: elevate information as a critical domain of statecraft
metatechnique: M007 - metatechnique
how_found: 2019-11-search
references: Dalton19
tactic: TA01 Strategic Planning
responsetype: D3 Disrupt
longname: C00170 - elevate information as a critical domain of statecraft
tactic_id: TA01
tactic_name: Strategic Planning
metatechnique_id: M007
metatechnique_name: - metatechnique
summary:
Shift from reactive to proactive response, with priority on sharing relevant information with the public and mobilizing private-sector engagement. Recent advances in data-driven technologies have elevated information as a source of power to influence the political and economic environment, to foster economic growth, to enable a decision-making advantage over competitors, and to communicate securely and quickly.


id: C00172
name: social media source removal
metatechnique: M005 - removal
summary: Removing accounts, pages, groups, e.g. facebook page removal
actors: A031 - social media platform administrator
how_found: 2019-11-search
incident_ids: I00035
tactic: TA04 Develop Networks
responsetype: D2 Deny
longname: C00172 - social media source removal
tactic_id: TA04
tactic_name: Develop Networks
metatechnique_id: M005
metatechnique_name: - removal
techniques:
T0008 - Create fake or imposter news sites
T0007 - Create fake Social Media Profiles / Pages / Groups
T0013 - Create fake websites


id: C00174
name: Create a healthier news environment
metatechnique: M007 - metatechnique, M002 - diversion
actors: A021 - media organisation
how_found: 2019-11-workshop, 2019-11-search
references: Hicks19, p143 of Corker18, Rand2237
tactic: TA01 Strategic Planning
responsetype: D2 Deny
longname: C00174 - Create a healthier news environment
tactic_id: TA01
tactic_name: Strategic Planning
metatechnique_id: M007
metatechnique_name: - metatechnique, M002 - diversion
summary:
Free and fair press: create bipartisan, patriotic commitment to press freedom.  Note difference between news and editorialising.  Build alternative news sources: create alternative local-language news sources to counter local-language propaganda outlets. Delegitimize the 24 hour news cycle.  includes Provide an alternative to disinformation content by expanding and improving local content: Develop content that can displace geopolitically-motivated narratives in the entire media environment, both new and old media alike.

playbooks:
Elected officials lead return to First Amendment norms that embrace free and fair media as central to democracy.

techniques:
T0001 - 5Ds (dismiss, distort, distract, dismay, divide)
T0045 - Use fake experts
T0010 - Cultivate ignorant agents
T0022 - Conspiracy narratives
T0027 - Adapt existing narratives
T0044 - Seed distortions


id: C00176
name: Improve Coordination amongst stakeholders: public and private
metatechnique: M007 - metatechnique
how_found: 2019-11-search
references: Dalton19
tactic: TA01 Strategic Planning
responsetype: D7 Deter
longname: C00176 - Improve Coordination amongst stakeholders: public and private
tactic_id: TA01
tactic_name: Strategic Planning
metatechnique_id: M007
metatechnique_name: - metatechnique
summary:
Coordinated disinformation challenges are increasingly multidisciplinary, there are few organizations within the national security structures that are equipped with the broad-spectrum capability to effectively counter large-scale conflict short of war tactics in real-time. Institutional hurdles currently impede diverse subject matter experts, hailing from outside of the traditional national security and foreign policy disciplines (e.g., physical science, engineering, media, legal, and economics fields), from contributing to the direct development of national security countermeasures to emerging conflict short of war threat vectors. A Cognitive Security Action Group (CSAG), akin to the Counterterrorism Security Group (CSG), could drive interagency alignment across equivalents of DHS, DoS, DoD, Intelligence Community, and other implementing agencies, in areas including strategic narrative, and the nexus of cyber and information operations. 

techniques:
T0009 - Create fake experts
T0008 - Create fake or imposter news sites
T0007 - Create fake Social Media Profiles / Pages / Groups
T0013 - Create fake websites
T0014 - Create funding campaign
T0015 - Create hashtag
T0016 - Clickbait 
T0017 - Promote online funding
T0018 - Paid targeted ads
T0021 - Memes 
T0025 - Leak altered documents
T0024 - Create fake videos and images
T0026 - Create fake research
T0045 - Use fake experts
T0043 - Use SMS/WhatsApp/ Chat apps
T0056 - Dedicated channels disseminate information pollution
T0051 - Fabricate social media comment
T0049 - Flooding 
T0052 - Tertiary sites amplify news
T0054 - Twitter bots amplify
T0053 - Twitter trolls amplify and manipulate
T0055 - Use hashtag
T0058 - Legacy web content
T0057 - Organise remote rallies and events
T0001 - 5Ds (dismiss, distort, distract, dismay, divide)
T0003 - Leverage existing narratives
T0010 - Cultivate ignorant agents
T0022 - Conspiracy narratives
T0027 - Adapt existing narratives
T0061 - Sell merchandising


id: C00178
name: Fill information voids with non-disinformation content
metatechnique: M009 - dilution, M008 - data pollution
how_found: 2019-11-workshop, 2019-11-search
references: Rand2237
tactic: TA05 Microtargeting
responsetype: D4 Degrade
techniques: T0016 - Clickbait T0017 - Promote online funding T0018 - Paid targeted ads T0020 - Trial content
longname: C00178 - Fill information voids with non-disinformation content
tactic_id: TA05
tactic_name: Microtargeting
metatechnique_id: M009
metatechnique_name: - dilution, M008 - data pollution
summary:
1) Pollute the data voids with wholesome content (Kittens! Babyshark!). 2) fill data voids with relevant information, e.g. increase Russian-language programming in areas subject to Russian disinformation.  Examples include using Current Time videos (viewed 40 million times online) to draw viewers away from Russian TV programming in RT and Sputnik. POtential content for this includes conventional entertainment programming (source: The conomist, “America’s Answer to Russian Propaganda TV,” 2017).


id: C00182
name: Redirection / malware detection/ remediation
metatechnique: M005 - removal
actors: A027 - information security
how_found: 2019-11-search
references: Rand2237
tactic: TA09 Exposure
responsetype: D2 Deny
techniques: T0011 - Hijack legitimate account T0054 - Twitter bots amplify
longname: C00182 - Redirection / malware detection/ remediation
tactic_id: TA09
tactic_name: Exposure
metatechnique_id: M005
metatechnique_name: - removal
summary:
Detect redirction or malware, then quarantine or delete.  Example: (2015) Trustwave reported that a Bedep Trojan malware kit had begun infecting machines and forcing them to browse certain sites, artificially inflating traffic to a set of pro-Russia


id: C00184
name: Media exposure
metatechnique: M003 - daylight
how_found: 2019-11-search
incident_ids: I00010,I00015,I00032,I00044
tactic: TA08 Pump Priming
responsetype: D4 Degrade
longname: C00184 - Media exposure
tactic_id: TA08
tactic_name: Pump Priming
metatechnique_id: M003
metatechnique_name: - daylight
techniques:
T0045 - Use fake experts
T0055 - Use hashtag
T0039 - Bait legitimate influencers
T0041 - Deny involvement
T0044 - Seed distortions
T0045 - Use fake experts
T0010 - Cultivate ignorant agents


id: C00188
name: Newsroom/Journalist training to counter influence moves
metatechnique: M001 - resilience
actors: A021 - media organisation,A006 - educator
how_found: 2019-11-search
references: Rand2237
tactic: TA08 Pump Priming
responsetype: D3 Disrupt
longname: C00188 - Newsroom/Journalist training to counter influence moves
tactic_id: TA08
tactic_name: Pump Priming
metatechnique_id: M001
metatechnique_name: - resilience
summary:
Includes SEO influence.  August 2014, Russian news agency Rossiya Segodnya commissioned a poll in France with poorly worded questions and a statistically insignificant subsample that RT used to back a story titled “15% of French people back ISIS [Islamic State of Iraq and Syria] militants, poll finds.” The story and summary infographic circulated on the internet, initially appearing primarily on French sites. After a week, the generally respectable digital U.S. news outlet Vox ran the story, now titled “One in Six French People Say They Support ISIS.” Although this effect has now worn off or been overwritten, for a time—despite a later story from The Washington Post debunking the claim—typing “ISIS France” into Google resulted in an autosuggestion of “ISIS France support” (Borthwick, 2015). Includes promotion of a “higher standard of journalism”: journalism training “would be helpful, especially for the online community.  Includes Strengthen local media: Improve effectiveness of local media outlets. Using eastern Latvia media outlets as an example, one expert noted that the media outlets are “very weak,” are often politically affiliated, or have “little local oligarchs that control them.”

playbooks:
TechCamp bringing together local journalists, with a several-day training program that includes a sponsored yearlong investigative project

techniques:
T0001 - 5Ds (dismiss, distort, distract, dismay, divide)
T0003 - Leverage existing narratives
T0022 - Conspiracy narratives
T0027 - Adapt existing narratives
T0045 - Use fake experts
T0008 - Create fake or imposter news sites
T0010 - Cultivate ignorant agents
T0039 - Bait legitimate influencers
T0046 - Search Engine Optimization


id: C00189
name: Ensure that platforms are taking down flagged accounts
metatechnique: M003 - daylight
how_found: 2019-11-search
references: Rand2237
tactic: TA03 Develop People
responsetype: D6 Destroy
longname: C00189 - Ensure that platforms are taking down flagged accounts
tactic_id: TA03
tactic_name: Develop People
metatechnique_id: M003
metatechnique_name: - daylight
summary:
Use ongoing analysis/monitoring of "flagged" profiles.  Confirm whether platforms are actively removing flagged accounts, and raise pressure via e.g. government organizations to encourage removal

techniques:
T0008 - Create fake or imposter news sites
T0007 - Create fake Social Media Profiles / Pages / Groups
T0011 - Hijack legitimate account
T0014 - Create funding campaign
T0009 - Create fake experts


id: C00190
name: open engagement with civil society
metatechnique: M001 - resilience
actors: A015 - general public
how_found: 2019-11-search
references: Dalton19, Hicks19
tactic: TA01 Strategic Planning
responsetype: D3 Disrupt
longname: C00190 - open engagement with civil society
tactic_id: TA01
tactic_name: Strategic Planning
metatechnique_id: M001
metatechnique_name: - resilience
summary:
Government open engagement with civil society as an independent check on government action and messaging. Government seeks to coordinate and synchronize narrative themes with allies and partners while calibrating action in cases where elements in these countries may have been co-opted by competitor nations. Includes “fight in the light”: Use leadership in the arts, entertainment, and media to highlight and build on fundamental tenets of democracy.

techniques:
T0001 - 5Ds (dismiss, distort, distract, dismay, divide)
T0003 - Leverage existing narratives
T0010 - Cultivate ignorant agents
T0022 - Conspiracy narratives
T0027 - Adapt existing narratives
T0025 - Leak altered documents


id: C00195
name: Redirect searches away from disinformation or extremist content
metatechnique: M002 - diversion
resources_needed: R002 - funding
how_found: 2019-11-workshop, 2019-11-search
references: Rand2237
tactic: TA07 Channel Selection
responsetype: D2 Deny
longname: C00195 - Redirect searches away from disinformation or extremist content
tactic_id: TA07
tactic_name: Channel Selection
metatechnique_id: M002
metatechnique_name: - diversion
summary:
Use Google AdWords to identify instances in which people search Google about particular fake-news stories or Russian propaganda themes. Taking advantage of the technology behind Google AdWords, this method identifies potential ISIS recruits through their Google searches and exposes them to curated YouTube videos debunking ISIS recruiting themes. Apply this method to Russian propaganda. Includes Monetize centrist SEO by subsidizing the difference in greater clicks towards extremist content. 

techniques:
T0010 - Cultivate ignorant agents
T0016 - Clickbait 
T0018 - Paid targeted ads
T0022 - Conspiracy narratives
T0027 - Adapt existing narratives
T0025 - Leak altered documents
T0024 - Create fake videos and images
T0026 - Create fake research
T0045 - Use fake experts
T0046 - Search engine optimization
T0055 - Use hashtag


id: C00197
name: remove suspicious accounts
metatechnique: M005 - removal
actors: A031 - social media platform administrator,A004 activist
resources_needed: R003 - money
how_found: 2019-11-search, 2019-11-workshop
incident_ids: I00022
tactic: TA03 Develop People
responsetype: D2 Deny
longname: C00197 - remove suspicious accounts
tactic_id: TA03
tactic_name: Develop People
metatechnique_id: M005
metatechnique_name: - removal
summary:
Standard reporting for false profiles (identity issues).  Includes detecting hijacked accounts and reallocating them - if possible, back to original owners. 

playbooks:
Playbook 1: Create a standard reporting format and method for social platforms for reporting false accounts. 
Playbook 2: 
- Is the account compromised? 
- Is it known to be associated with threat actors 
- common/random name 
- Names violate terms of service 
- Dormant account 
- Change of country IP
- Social network growth patterns (number of friends etc) 
- Evidence of linguistic artifacts (multiple fingerprints, terms/idiosyncrasies )
- Community vs. narrative vs. individuals 
Playbook 3: Report suspected bots. 
- Report ToS violations. 
-  In all playbooks the platform must force user verification, credential reset and enable MFA. Suspend the account if it cannot be verified.
Playbook 1: Use sites like https://haveibeenpwned.com to detect compromised and at risk user accounts. 
Playbook 2: Monitor for unusual account usage (use of VPN, new geographic location, unusual usage hours, etc). 
Playbook 3: Detect sudden deviation in user sentiment such as suddenly dropping hashtags linked to extremist content.
Playbook 4: Purchase "likes", "retweets" and other vehicles which identify a bot and/or hijacked account. Ban the account.
Playbook 5: Detect hijacked account and spam their posts. "OP is a known disinformation bot. http://link.to.proof[.]com"

techniques:
T0009 - Create fake experts
T0007 - Create fake Social Media Profiles / Pages / Groups
T0011 - Hijack accounts


id: C00200
name: Respected figure (influencer) disavows misinfo
metatechnique: M010 - countermessaging
summary: Has been done in e.g. India. FIXIT: standardize language used for influencer/ respected figure.
actors: A016 - influencer
how_found: 2019-11-search
incident_ids: I00044
tactic: TA09 Exposure
responsetype: D3 Disrupt
longname: C00200 - Respected figure (influencer) disavows misinfo
tactic_id: TA09
tactic_name: Exposure
metatechnique_id: M010
metatechnique_name: - countermessaging
techniques:
T0010 - Cultivate ignorant agents
T0027 - Adapt existing narratives
T0022 - Conspiracy narratives
T0045 - Use fake experts
T0025 - Leak altered documents


id: C00202
name: Set data 'honeytraps'
metatechnique: M002 - diversion
how_found: 2019-11-search
incident_ids: I00004,I00022
tactic: TA06 Develop Content
responsetype: D2 Deny
techniques: T0025 - leak altered documents
longname: C00202 - Set data 'honeytraps'
tactic_id: TA06
tactic_name: Develop Content
metatechnique_id: M002
metatechnique_name: - diversion
summary:
Set honeytraps in content likely to be accessed for disinformation.   NB Macron election team modified docs to spike a hack and leak. 


id: C00203
name: Stop offering press credentials to propaganda outlets
metatechnique: M004 - friction
actors: A018 - government
how_found: 2019-11-search
incident_ids: I00022
tactic: TA04 Develop Networks
responsetype: D3 Disrupt
longname: C00203 - Stop offering press credentials to propaganda outlets
tactic_id: TA04
tactic_name: Develop Networks
metatechnique_id: M004
metatechnique_name: - friction
techniques:
T0010 - Cultivate ignorant agents
T0027 - Adapt existing narratives
T0022 - Conspiracy narratives
T0028 - Create competing narratives
T0039 - Bait legitimate influencers
T0045 - Use fake experts
T0056 - Dedicated channels disseminate information pollution
T0052 - Tertiary sites amplify news


id: C00205
name: strong dialogue between the federal government and private sector to encourage better reporting
metatechnique: M007 - metatechnique
actors: A018 - government,A033 - social media platform owner,
how_found: 2019-11-search
references: Hicks19
tactic: TA01 Strategic Planning
responsetype: D3 Disrupt
tactic_id: TA01
tactic_name: Strategic Planning
metatechnique_id: M007
metatechnique_name: - metatechnique
summary:
Increase civic resilience by partnering with business community to combat gray zone threats and ensuring adequate reporting and enforcement mechanisms. 

techniques:
T0001 - 5Ds (dismiss, distort, distract, dismay, divide)
T0003 - Leverage existing narratives
T0022 - Conspiracy narratives
T0025 - Leak altered documents
T0027 - Adapt existing narratives

longname:
C00205 - strong dialogue between the federal government and private sector to encourage better reporting


id: C00211
name: Use humorous counter-narratives
metatechnique: M010 - countermessaging
how_found: 2019-11-search
incident_ids: I00004
tactic: TA09 Exposure
responsetype: D3 Disrupt
longname: C00211 - Use humorous counter-narratives
tactic_id: TA09
tactic_name: Exposure
metatechnique_id: M010
metatechnique_name: - countermessaging
summary:
Examples:
 
* Baltic Elves.
https://balkaninsight.com/2019/06/07/disinformation-nation-the-slovaks-fighting-in-defence-of-facts/ 
* Taiwan humor over rumor strategy.https://www.theguardian.com/commentisfree/2021/feb/17/humour-over-rumour-taiwan-fake-news 
*  Taiwan “humor over rumour" 
https://internews.org/story/using-comedy-and-social-media-educate-disinformation 

techniques:
T0027 - Adapt existing narratives
T0022 - Conspiracy narratives
T0028 - Create competing narratives
T0026 - Create fake research
T0021 - Memes 
T0020 - Trial content
T0025 - Leak altered documents
T0024 - Create fake videos and images
T0026 - Create fake research
T0045 - Use fake experts
T0055 - Use hashtag
T0057 - Organise remote rallies and events


id: C00212
name: build public resilience by making civil society more vibrant
metatechnique: M001 - resilience
summary: Increase public service experience, and support wider civics and history education.
actors: A006 - educator,A018 - government
how_found: 2019-11-search
references: Hicks19
tactic: TA01 Strategic Planning
responsetype: D3 Disrupt
longname: C00212 - build public resilience by making civil society more vibrant
tactic_id: TA01
tactic_name: Strategic Planning
metatechnique_id: M001
metatechnique_name: - resilience
techniques:
T0001 - 5Ds (dismiss, distort, distract, dismay, divide)
T0003 - Leverage existing narratives
T0010 - Cultivate ignorant agents
T0022 - Conspiracy narratives


id: C00216
name: Use advertiser controls to stem flow of funds to bad actors
metatechnique: M014 - reduce resources
summary: Prevent ad revenue going to disinformation domains
actors: A023 - adtech provider
how_found: 2019-11-workshop
tactic: TA05 Microtargeting
responsetype: D2 Deny
longname: C00216 - Use advertiser controls to stem flow of funds to bad actors
tactic_id: TA05
tactic_name: Microtargeting
metatechnique_id: M014
metatechnique_name: - reduce resources
techniques:
T0014 - Create funding campaign
T0016 - Clickbait 
T0017 - Promote online funding
T0061 - Sell merchandising
T0018 - Paid targeted ads
T0057 - Organise remote rallies and events


# df_detections

id: F00002
name: Analyse viral fizzle
playbooks: Develop a baseline virality per platform, monitor trends, trigger alert for anomalies.
how_found: 2019-11-workshop
tactic: TA01 Strategic Planning
responsetype: D1 Detect
longname: F00002 - Analyse viral fizzle
tactic_id: TA01
tactic_name: Strategic Planning
techniques:
T0049 - Flooding
T0052 - Tertiary sites amplify news
T0053 - Twitter trolls amplify and manipulate
T0054 - Twitter bots amplify
T0059 - Play the long game
T0060 - Continue to amplify


id: F00003
name: Exploit counter-intelligence vs bad actors
how_found: 2019-11-workshop
tactic: TA01 Strategic Planning
responsetype: D1 Detect
longname: F00003 - Exploit counter-intelligence vs bad actors
tactic_id: TA01
tactic_name: Strategic Planning
playbooks:
Playbook 1: 
Objective: Destroy Desire to Work for Propaganda Businesses
-Identify non-committed actors (ie. IRA 2$/h employees)
-Identify where they reside (ie. postal code level)
-Send a viral message that clarifies the risk of working in influence ops. 

Playbook 2:
-Hack personal accounts
-Send inflammatory messages on their behalf

techniques:
TA06 - Develop Content
TA08 - Pump Priming
TA09 - Exposure

T0019 - Generate information pollution
T0021 - Memes


id: F00004
name: Recruit like-minded converts "people who used to be in-group"
playbooks: Identify target and entice individual to reveal insider information
how_found: 2019-11-workshop
tactic: TA01 Strategic Planning
responsetype: D1 Detect
longname: F00004 - Recruit like-minded converts "people who used to be in-group"
tactic_id: TA01
tactic_name: Strategic Planning
techniques:
T0057 - Organise remote rallies and events
T0061 - Sell merchandising (ie. source of identification)

T0010 - Cultivate ignorant agents
T0039 - Bait legitimate influencers


id: F00005
name: SWOT Analysis of Cognition in Various Groups
how_found: 2019-11-workshop
tactic: TA01 Strategic Planning
responsetype: D1 Detect
techniques: All
longname: F00005 - SWOT Analysis of Cognition in Various Groups
tactic_id: TA01
tactic_name: Strategic Planning
playbooks:
-Model communities on the basis of behavior and identity, etc
-Model different online behaviors in terms of how these groups interact with propaganda
-Model how these group-based behaviors are affected by the tech platform they are using
-This research can feed into later-stage playbooks to adapt them to communities/platforms


id: F00006
name: SWOT analysis of tech platforms
how_found: 2019-11-workshop
tactic: TA01 Strategic Planning
responsetype: D1 Detect
longname: F00006 - SWOT analysis of tech platforms
tactic_id: TA01
tactic_name: Strategic Planning
playbooks:
-Model each major platform and determine:
a) Moderation Method (global, subcommunity level, none -ie. twitter, reddit, 8chan)
b) Access Model (friend request, open, real-life identity)
c) Communication Model (global, friends only, subcommunity, hybrid)
Determine how the combination of the above (and other characteristics) allow different technical methods to communicate and influence various audiences
This will allow to adapt playbooks to specific platforms

techniques:
TA05 - Microtargeting
TA07 - Channel Selection
TA08 - Pump Priming
TA09 - Exposure
TA10 - Go Physical
TA11 - Persistence

T0007 - Create fake Social Media Profiles / Pages / Groups
T0014 - Create funding campaigns
T0010 - Cultivate ignorant agents
T0019 - Generate information pollution
T0021 - Memes


id: F00008
name: Detect abnormal amplification
how_found: 2019-11-workshop
tactic: TA03 Develop People
responsetype: D1 Detect
longname: F00008 - Detect abnormal amplification
tactic_id: TA03
tactic_name: Develop People
techniques:
T0052 - Tertiary sites amplify news
T0053 - Twitter trolls amplify and manipulate
T0054 - Twitter bots amplify
T0060 - Continue to amplify


id: F00014
name: Trace connections
summary: for e.g. fake news sites
how_found: 2019-11-workshop
tactic: TA03 Develop People
responsetype: D1 Detect
techniques: T0008
longname: F00014 - Trace connections
tactic_id: TA03
tactic_name: Develop People
playbooks:
- Hashes
- Data voids
- User handles 
- Domains + link shortener
- TinEye For video (visual artifact)


id: F00015
name: Detect anomalies in membership growth patterns
how_found: 2019-11-workshop
tactic: TA03 Develop People
responsetype: D1 Detect
longname: F00015 - Detect anomalies in membership growth patterns
tactic_id: TA03
tactic_name: Develop People
summary:
I include Fake Experts as they may use funding campaigns such as Patreon to fund their operations and so these should be watched.

techniques:
TA07 - Channel Selection

T0007 - Create fake Social Media Profiles / Pages / Groups
T0009 - Create fake experts
T0015 - Create hashtag
T0045 - Use fake experts
T0057 - Organise remote rallies and events


id: F00016
name: Identify fence-sitters
how_found: 2019-11-workshop
tactic: TA03 Develop People
responsetype: D1 Detect
longname: F00016 - Identify fence-sitters
tactic_id: TA03
tactic_name: Develop People
summary:
Note: In each case, depending on the platform there may be a way to identify a fence-sitter. For example, online polls may have a neutral option or a "somewhat this-or-that" option, and may reveal who voted for that to all visitors. This information could be of use to data analysts.

In TA08-11, the engagement level of victims could be identified to detect and respond to increasing engagement.

techniques:
TA08 - Pump Priming
TA09 - Exposure
TA10 - Go Physical
TA11 - Persistence

T0010 - Cultivate ignorant agents
T0017 - Promote online funding
T0018 - Paid targeted ads
T0029 - Manipulate online polls
T0039 - Bait legitimate influencers
T0048 - Cow online opinion leaders


id: F00017
name: Measure emotional valence
playbooks: Create standard scoring for emptional content
how_found: 2019-11-workshop
tactic: TA03 Develop People
responsetype: D1 Detect
longname: F00017 - Measure emotional valence
tactic_id: TA03
tactic_name: Develop People
techniques:
T0001 - 5Ds (dismiss, distort, distract, dismay, divide)
T0039 - Bait legitimate influencers
T0053 - Twitter trolls amplify and manipulate


id: F00018
name: Follow the money
summary: track funding sources
how_found: 2019-11-workshop
tactic: TA03 Develop People
responsetype: D1 Detect
techniques: T0009
longname: F00018 - Follow the money
tactic_id: TA03
tactic_name: Develop People
playbooks:
Playbook 1: Ad tech 
- De-platform funding sites 
- Blockchain transaction 
- Sell items
- Identify manufacturers 
- Pay to play meetings 
Playbook 2: Identify ad tech on platforms 
- Selling merch? 
- Financial platform
- Bitcoin etc.. .
Playbook 3: Identify re-use of ads
- Ad trackers
- Tracking ids
- Tracking ads
- Re-use of as features (language, name, themes, plug-in, re-use/versions)
Playbook 4: track funding sources


id: F00021
name: AI/ML automated early detection of campaign planning
how_found: 2019-11-workshop
tactic: TA04 Develop Networks
responsetype: D1 Detect
notes: Automated Detection of Campaign
longname: F00021 - AI/ML automated early detection of campaign planning
tactic_id: TA04
tactic_name: Develop Networks
techniques:
TA03 - Develop People
TA04 - Develop Networks
TA05 - Microtargeting
TA06 - Develop Content
TA07 - Channel Selection
TA08 - Pump Priming
TA09 - Exposure
TA10 - Go Physical
TA11 - Persistence


id: F00029
name: Detect proto narratives, i.e. RT, Sputnik
how_found: 2019-11-workshop
tactic: TA06 Develop Content
responsetype: D1 Detect
longname: F00029 - Detect proto narratives, i.e. RT, Sputnik
tactic_id: TA06
tactic_name: Develop Content
techniques:
TA01 - Strategic Planning

T0006 - Create Master Narratives
T0019 - Generate information pollution
T0050 - Cheerleading domestic social media ops
T0056 - Dedicated channels disseminate information pollution


id: F00030
name: Early detection and warning - reporting of suspect content
how_found: 2019-11-workshop
tactic: TA06 Develop Content
responsetype: D1 Detect
longname: F00030 - Early detection and warning - reporting of suspect content
tactic_id: TA06
tactic_name: Develop Content
techniques:
TA03 - Develop People
TA04 - Develop Networks
TA05 - Microtargeting
TA06 - Develop Content
TA08 - Pump Priming
TA09 - Exposure
TA10 - Go Physical


id: F00031
name: Educate on how to identify information pollution
summary: Strategic planning included as innoculating population has strategic value.
how_found: 2019-11-workshop
tactic: TA06 Develop Content
responsetype: D1 Detect
longname: F00031 - Educate on how to identify information pollution
tactic_id: TA06
tactic_name: Develop Content
techniques:
TA01 - Strategic Planning

T0019 - Generate information pollution
T0056 - Dedicated channels disseminate information pollution


id: F00037
name: News content provenance certification.
how_found: 2019-11-workshop
tactic: TA06 Develop Content
responsetype: D1 Detect
techniques: TA01 - Strategic Planning* (non-existent technique)
longname: F00037 - News content provenance certification.
tactic_id: TA06
tactic_name: Develop Content
summary:
Original Comment: Shortcomings: intentional falsehood. Doesn't solve accuracy. Can't be mandatory. 

Technique should be in terms of "strategic innoculation", raising the standards of what people expect in terms of evidence when consuming news.


id: F00038
name: Social capital as attack vector
how_found: 2019-11-workshop
tactic: TA06 Develop Content
responsetype: D1 Detect
longname: F00038 - Social capital as attack vector
tactic_id: TA06
tactic_name: Develop Content
summary:
Unsure I understood the original intention or what it applied to. Therefore the techniques listed (10, 39, 43, 57, 61) are under my interpretation - which is that we want to track ignorant agents who fall into the enemy's trap and show a cost to financing/reposting/helping the adversary via public shaming or other means.

techniques:
T0010 - Cultivate ignorant agents
T0039 - Bait legitimate influencers
T0043 - Use SMS/ WhatsApp/ Chat apps
T0057 - Organise remote rallies and events
T0061 - Sell merchandising


id: F00052
name: Discover sponsors
how_found: 2019-11-workshop
tactic: TA09 Exposure
responsetype: D1 Detect
techniques: All
longname: F00052 - Discover sponsors
tactic_id: TA09
tactic_name: Exposure
summary:
Discovering the sponsors behind a campaign, narrative, bot, a set of accounts, or a social media comment, or anything else is useful.


id: F00058
name: Deplatform (cancel culture)
how_found: 2019-11-workshop
tactic: TA10 Go Physical
responsetype: D1 Detect
longname: F00058 - Deplatform (cancel culture)
tactic_id: TA10
tactic_name: Go Physical
summary:
*Deplatform People: This technique needs to be a bit more specific to distinguish it from "account removal" or DDOS and other techniques that get more specific when applied to content.

For example, other ways of deplatforming people include attacking their sources of funds, their allies, their followers, etc.

techniques:
TA07 - Channel Selection
TA09 - Exposure
TA10 - Go Physical

T0007 - Create fake Social Media Profiles / Pages / Groups
T0009 - Create fake experts
T0011 - Hijack legitimate account
T0014 - Create funding campaigns
T0017 - Promote online funding
T0018 - Paid targeted ads
T0045 - Use fake experts


id: F00059
name: Identify susceptible demographics
how_found: 2019-11-workshop
tactic: TA10 Go Physical
responsetype: D1 Detect
techniques: All
longname: F00059 - Identify susceptible demographics
tactic_id: TA10
tactic_name: Go Physical
summary:
All techniques provide or are susceptible to being countered by, or leveraged for, knowledge about user demographics.


id: F00060
name: Identify susceptible influencers
how_found: 2019-11-workshop
tactic: TA10 Go Physical
responsetype: D1 Detect
techniques: T0039 - Bait legitimate influencers
longname: F00060 - Identify susceptible influencers
tactic_id: TA10
tactic_name: Go Physical
summary:
I assume this was a transcript error. Otherwise, "Identify Susceptible Influences" as in the various methods of influences that may work against a victim could also be a technique. Nope, wasn't a transcript error: original note says influencers, as in find people of influence that might be targetted. 


id: F00062
name: Detect when Dormant account turns active
how_found: 2019-11-workshop
tactic: TA11 Persistence
responsetype: D1 Detect
longname: F00062 - Detect when Dormant account turns active
tactic_id: TA11
tactic_name: Persistence
techniques:
TA09 - Exposure

T0007 - Create fake Social Media Profiles / Pages / Groups
T0011 - Hijack legitimate account


id: F00066
name: Use language errors, time to respond to account bans and lawsuits, to indicate capabilities
how_found: 2019-11-workshop
tactic: TA11 Persistence
responsetype: D1 Detect
tactic_id: TA11
tactic_name: Persistence
longname:
F00066 - Use language errors, time to respond to account bans and lawsuits, to indicate capabilities


id: F00068
name: Resonance analysis
how_found: 2019-11-search
references: Rand2237
responsetype: D1 Detect
longname: F00068 - Resonance analysis
tactic_name: None
summary:
a developing methodology for identifying statistical differences in how social groups use language and quantifying how common those statistical differences are within a larger population. In essence, it hypothesizes how much affinity might exist for a specific group within a general population, based on the language its members employ


id: F00069
name: Track Russian media and develop analytic methods.
how_found: 2019-11-search
references: Rand2237
responsetype: D1 Detect
longname: F00069 - Track Russian media and develop analytic methods.
tactic_name: None
summary:
To effectively counter Russian propaganda, it will be critical to track Russian influence efforts. The information requirements are varied and include the following: • Identify fake-news stories and their sources. • Understand narrative themes and content that pervade various Russian media sources. • Understand the broader Russian strategy that underlies tactical propaganda messaging.


id: F00071
name: Network analysis Identify/cultivate/support influencers
actors: A001 - data scientist
how_found: 2019-11-search
references: Rand2237
responsetype: D1 Detect
longname: F00071 - Network analysis Identify/cultivate/support influencers
tactic_name: None
summary:
Local influencers detected via Twitter networks are likely local influencers in other online and off-line channels as well. In addition, the content and themes gleaned from Russia and Russia-supporting populations, as well as anti-Russia activists, likely swirl in other online and off-line mediums as well.


id: F00072
name: network analysis to identify central users in the pro-Russia activist community.
actors: A001 - data scientist
how_found: 2019-11-search
references: Rand2237
responsetype: D1 Detect
longname: F00072 - network analysis to identify central users in the pro-Russia activist community.
tactic_name: None
summary:
It is possible that some of these are bots or trolls and could be flagged for suspension for violating Twitter’s terms of service.


id: F00073
name: collect intel/recon on black/covert content creators/manipulators
how_found: 2019-11-search
references: Rand2237
responsetype: D1 Detect
longname: F00073 - collect intel/recon on black/covert content creators/manipulators
tactic_name: None
summary:
Players at the level of covert attribution, referred to as “black” in the grayscale of deniability, produce content on user-generated media, such as YouTube, but also add fear-mongering commentary to and amplify content produced by others and supply exploitable content to data dump websites. These activities are conducted by a network of trolls, bots, honeypots, and hackers. 


id: F00074
name: identify relevant fence-sitter communities
how_found: 2019-11-search
references: Rand2237
responsetype: D1 Detect
longname: F00074 - identify relevant fence-sitter communities
tactic_name: None
summary:
brand ambassador programs could be used with influencers across a variety of social media channels. It could also target other prominent experts, such as academics, business leaders, and other potentially prominent people. Authorities must ultimately take care in implementing such a program given the risk that contact with U.S. or NATO authorities might damage influencer reputations. Engagements must consequently be made with care, and, if possible, government interlocutors should work through local NGOs.


id: F00075
name: leverage open-source information
how_found: 2019-11-search
references: Dalton19
responsetype: D1 Detect
longname: F00075 - leverage open-source information
tactic_name: None
summary:
significant amounts of quality open-source information are now available and should be leveraged to build products and analysis prior to problem prioritization in the areas of observation, attribution, and intent. Successfully distinguishing the gray zone campaign signal through the global noise requires action through the entirety of the national security community. Policy, process, and tools must all adapt and evolve to detect, discern, and act upon a new type of signal


id: F00076
name: Monitor/collect audience engagement data connected to “useful idiots”
how_found: 2019-11-search
references: Rand2237
responsetype: D1 Detect
longname: F00076 - Monitor/collect audience engagement data connected to “useful idiots”
tactic_name: None
summary:
Target audience connected to "useful idiots rather than the specific profiles because - The active presence of such sources complicates targeting of Russian propaganda, given that it is often difficult to discriminate between authentic views and opinions on the internet and those disseminated by the Russian state.


id: F00077
name: Model for bot account behavior
summary: Bot account: action based, people. Unsure which AMITT techniques.
how_found: 2019-11-workshop
tactic: TA03 Develop People
responsetype: D1 Detect
longname: F00077 - Model for bot account behavior
tactic_id: TA03
tactic_name: Develop People
playbooks:
Playbook 1: Build and update a model bot behaviour. 
Playbook 2: Build network of companies that model / rate bots. Build standards around data sharing and exchange


id: F00079
name: Network anomaly detection
actors: A001 - data scientist
how_found: 2019-11-workshop
tactic: TA05 Microtargeting
responsetype: D1 Detect
longname: F00079 - Network anomaly detection
tactic_id: TA05
tactic_name: Microtargeting
techniques:
T0029 - Manipulate online polls
T0047 - Muzzle social media as a political force
T0049 - Flooding
T0054 - Twitter bots amplify
T0055 - Use hashtag
T0060 - Continue to amplify


id: F00080
name: Hack the polls/ content yourself
actors: A015 - general public
how_found: 2019-11-workshop
tactic: TA07 Channel Selection
responsetype: D1 Detect
techniques: T0029 - Manipulate online polls
longname: F00080 - Hack the polls/ content yourself
tactic_id: TA07
tactic_name: Channel Selection
summary:
Two wrongs don't make a right? But if you hack your own polls, you do learn how it could be done, and learn what to look for


id: F00085
name: detection of a weak signal through global noise
how_found: 2019-11-search
references: Dalton19
longname: F00085 - detection of a weak signal through global noise
tactic_name: None
summary:
Gray zone threats are challenging given that warning requires detection of a weak signal through global noise and across threat vectors and regional boundaries.Three interconnected gray zone elements characterize the nature of the activity: 
Temporality: The nature of gray zone threats truly requires a “big picture view” over long timescales and across regions and functional topics.
Attribution: requiring an “almost certain” or “nearly certain analytic assessment before acting costs time and analytic effort
Intent: judgement of adversarial intent to conduct gray zone activity. Indeed, the purpose of countering gray zone threats is to deter adversaries from fulfilling their intent to act. While attribution is one piece of the puzzle, closing the space around intent often means synthesizing multiple relevant indicators and warnings, including the state’s geopolitical ambitions, military ties, trade and investment, level of corruption, and media landscape, among others.


id: F00086
name: Outpace Competitor Intelligence Capabilities
how_found: 2019-11-search
references: Hicks19
tactic: TA02 Objective planning
responsetype: D1 Detect
longname: F00086 - Outpace Competitor Intelligence Capabilities
tactic_id: TA02
tactic_name: Objective planning
summary:
Develop an intelligence-based understanding of foreign actors’ motivations, psychologies, and societal and geopolitical contexts. Leverage artificial intelligence to identify patterns and infer competitors’ intent


id: F00087
name: Improve Indications and Warning
how_found: 2019-11-search
references: Hicks19
responsetype: D1 Detect
longname: F00087 - Improve Indications and Warning
tactic_name: None
summary:
United States has not adequately adapted its information indicators and thresholds for warning policymakers to account for gray zone tactics. Competitors have undertaken a marked shift to slow-burn, deceptive, non-military, and indirect challenges to U.S. interests. Relative to traditional security indicators and warnings, these are more numerous and harder to detect and make it difficult for analysts to infer intent.


id: F00088
name: Revitalize an “active measures working group,”
how_found: 2019-11-search
references: Dalton19
responsetype: D1 Detect
longname: F00088 - Revitalize an “active measures working group,”
tactic_name: None
summary:
Recognize campaigns from weak signals, including rivals’ intent, capability, impact, interactive effects, and impact on U.S. interests... focus on adversarial covert action aspects of campaigning.


id: F00089
name: target/name/flag "grey zone" website content
how_found: 2019-11-search
references: Rand2237
tactic: TA04 Develop Networks
responsetype: D1 Detect
longname: F00089 - target/name/flag "grey zone" website content
tactic_id: TA04
tactic_name: Develop Networks
summary:
"Gray zone" is second level of content producers and circulators, composed of outlets with uncertain attribution. This category covers conspiracy websites, far-right or far-left websites, news aggregators, and data dump websites


id: F00091
name: Partner to develop analytic methods & tools
actors: A001 data scientist,A024 developer
how_found: 2019-11-search
references: Rand2237
tactic: TA01 Strategic Planning
responsetype: D1 Detect
longname: F00091 - Partner to develop analytic methods & tools
tactic_id: TA01
tactic_name: Strategic Planning
summary:
This might include working with relevant technology firms to ensure that contracted analytic support is available. Contracted support is reportedly valuable because technology to monitor social media data is continually evolving, and such firms can provide the expertise to help identify and analyze trends, and they can more effectively stay abreast of the changing systems and develop new models as they are required


id: F00092
name: daylight
actors: A015 - general public
resources_needed: R006 - disinformation datasets
how_found: 2019-11-search
incidents: I00002
tactic: TA09 Exposure
responsetype: D1 Detect
longname: F00092 - daylight
tactic_id: TA09
tactic_name: Exposure
summary:
Warn social media companies about an ongoing campaign (e.g. antivax sites).  Anyone with datasets or data summaries can help with this

playbooks:
Build a reporting system for the public, so they can report disinformation artefacts and have them available to channels etc for action. 


# df_responsetypes

id: D2
name: Deny
longname: D2 - Deny
summary:
Prevent disinformation creators from accessing and using critical information, systems, and services. Deny is for an indefinite time period. 


id: D3
name: Disrupt
longname: D3 - Disrupt
summary:
Completely break or interrupt the flow of information, for a fixed amount of time. (Deny, for a limited time period).  Not allowing any efficacy, for a short amount of time. 


id: D4
name: Degrade
longname: D4 - Degrade
summary:
Reduce the effectiveness or efficiency of disinformation creators’ command and control or communications systems, and information collection efforts or means, either indefinitely, or for a limited time period. 


id: D5
name: Deceive
longname: D5 - Deceive
summary:
Cause a person to believe what is not true. military deception seeks to mislead adversary decision makers by manipulating their perception of reality.


id: D6
name: Destroy
longname: D6 - Destroy
summary:
Damage a system or entity so badly that it cannot perform any function or be restored to a usable condition without being entirely rebuilt. Destroy is permanent, e.g. you can rebuild a website, but it’s not the same website. 


# df_metatechniques

id: M001
name: resilience
longname: M001 - resilience
summary:
Increase the resilience to disinformation of the end subjects or other parts of the underlying system


id: M012
name: cleaning
longname: M012 - cleaning
summary:
Clean unneeded resources (accounts etc) from the underlying system so they can't be used in disinformation


# it

id: I00010T004
id_incident: I00010
name_incident: ParklandTeens
id_technique: T0010
name_technique: Cultivate ignorant agents
name:
cultivate, manipulate, exploit useful idiots (Alex Jones... drives conspiracy theories; false flags, crisis actors)


id: I00009T004
id_incident: I00009
name_incident: PhilippinesExpert
id_technique: T0052
name_technique: Tertiary sites amplify news
name:
News circulated/amplifed by tertiary sites (Russia Insider, The Duran, Geopolitica.ru, Mint Press News, Oriental Review, globalresearch.ca)


id: I00029T003
id_incident: I00029
name_incident: MH17 investigation
id_technique: T0001
name_technique: 5Ds (dismiss, distort, distract, dismay, divide)
name:
4 D's (dismiss, distort, distract, dismay...Official channels ie: Embassies & Defence Ministry; TASS


id: I00047T002
id_incident: I00047
name_incident: Sea of Azov
id_technique: T0001
name_technique: 5Ds (dismiss, distort, distract, dismay, divide)
name:
Russian FSB security service blamed Ukraine for sparking the clashes, saying their "irrefutable" evidence would "soon be made public


id: I00053T006
id_incident: I00053
name_incident: China Huawei CFO Arrest
id_technique: T0001
name_technique: 5Ds (dismiss, distort, distract, dismay, divide)
name:
Chinese ambassador Lu Shaye accused Canada of applying a double standard, and has decried what he sees as “Western egotism and white supremacy” in the treatment of detained Huawei executive Meng Wanzhou.” 


id: I00063T003
id_incident: I00063
name_incident: Olympic Doping Scandal
id_technique: T0001
name_technique: 5Ds (dismiss, distort, distract, dismay, divide)
name:
4 D's (dismiss, distort, distract, dismay...Official channels ie: Putin himself; Embassies & Sports Ministry; TASS


id: I00033T003
id_incident: I00033
name_incident: China 50cent Army
id_technique: T0050
name_technique: Cheerleading domestic social media ops
name:
domestic social media influence operations focus primarily on “cheerleading” or presenting or furthering a positive narrative about the Chinese state


id: I00034T001
id_incident: I00034
name_incident: DibaFacebookExpedition
id_technique: T0002
name_technique: Facilitate State Propaganda
name:
Netizens from one of the largest discussion forums in China, known as Diba, coordinated to overcome China’s Great Firewall


id: I00047T003
id_incident: I00047
name_incident: Sea of Azov
id_technique: T0023
name_technique: Distort facts
name:
(Distort) Kremlin-controlled RT cited Russian Minister of Foreign Affairs Sergei Lavrov suggesting that Ukraine deliberately provoked Russia in hopes of gaining additional support from the United States and Europe.


# df_tactics

id: TA01
name: Strategic Planning
phase_id: P01
rank: 1
longname: TA01 - Strategic Planning
technique_ids: ['T0001', 'T0002', 'T0003', 'T0004']
summary:
Define the desired end state, i.e. the set of required conditions that defines achievement of all objectives.

counter_ids:
['C00006', 'C00006', 'C00008', 'C00010', 'C00012', 'C00013', 'C00017', 'C00019', 'C00021', 'C00022', 'C00024', 'C00026', 'C00027', 'C00073', 'C00096', 'C00111', 'C00153', 'C00159', 'C00161', 'C00170', 'C00174', 'C00176', 'C00190', 'C00205', 'C00212', 'C00220', 'C00221', 'C00223']


id: TA02
name: Objective Planning
phase_id: P01
rank: 2
longname: TA02 - Objective Planning
technique_ids: ['T0005', 'T0006']
summary:
Set clearly defined, measurable, and achievable objectives. Achieving objectives ties execution of tactical tasks to reaching the desired end state. There are four primary considerations:
- Each desired effect should link directly to one or more objectives
- The effect should be measurable
- The objective statement should not specify the way and means of accomplishment
- The effect should be distinguishable from the objective it supports as a condition for success, not as another objective or task.

counter_ids:
['C00009', 'C00011', 'C00028', 'C00029', 'C00030', 'C00031', 'C00060', 'C00070', 'C00092', 'C00144', 'C00156', 'C00164', 'C00169', 'C00207', 'C00222']


id: TA03
name: Develop People
phase_id: P02
rank: 3
summary: Develop online and offline users and agents, including automated personas
longname: TA03 - Develop People
technique_ids: ['T0007', 'T0008', 'T0009']
counter_ids:
['C00034', 'C00036', 'C00040', 'C00042', 'C00044', 'C00046', 'C00048', 'C00051', 'C00058', 'C00067', 'C00077', 'C00093', 'C00133', 'C00155', 'C00160', 'C00189', 'C00197']


id: TA04
name: Develop Networks
phase_id: P02
rank: 4
longname: TA04 - Develop Networks
technique_ids: ['T0010', 'T0011', 'T0012', 'T0013', 'T0014', 'T0015']
summary:
Develop online and offline communities and transmission methods and cultivate assets and unwitting agents

counter_ids:
['C00047', 'C00052', 'C00053', 'C00056', 'C00059', 'C00062', 'C00135', 'C00162', 'C00172', 'C00203']


id: TA06
name: Develop Content
phase_id: P02
rank: 6
summary: Create and acquire content used in incident
longname: TA06 - Develop Content
technique_ids: ['T0019', 'T0020', 'T0021', 'T0022', 'T0023', 'T0024', 'T0025', 'T0026', 'T0027', 'T0028']
counter_ids:
['C00014', 'C00032', 'C00071', 'C00072', 'C00074', 'C00075', 'C00076', 'C00078', 'C00080', 'C00081', 'C00082', 'C00084', 'C00085', 'C00086', 'C00087', 'C00091', 'C00094', 'C00106', 'C00107', 'C00142', 'C00165', 'C00202', 'C00219']


id: TA07
name: Channel Selection
phase_id: P02
rank: 7
longname: TA07 - Channel Selection
technique_ids: ['T0029', 'T0030', 'T0031', 'T0032', 'T0033', 'T0034', 'T0035', 'T0036', 'T0037', 'T0038']
counter_ids: ['C00090', 'C00097', 'C00098', 'C00099', 'C00101', 'C00103', 'C00105', 'C00195']
summary:
Set up specific delivery, amplification and manipulation channels for incident, including channels to attack. Each channel serves as an atomic surface (test bed) location/site for adversary to hide/conceal the work/content that goes into setting up for this channel and/or other specific platforms. Contributes to building out a connected ecosystem where this channel can operate as part of a whole campaign/incident


id: TA08
name: Pump Priming
phase_id: P03
rank: 8
longname: TA08 - Pump Priming
technique_ids: ['T0039', 'T0040', 'T0041', 'T0042', 'T0043', 'T0044', 'T0045', 'T0046']
summary:
Release content on a targetted small scale, prior to general release, including releasing seed narratives

counter_ids:
['C00100', 'C00112', 'C00113', 'C00114', 'C00115', 'C00116', 'C00117', 'C00118', 'C00119', 'C00120', 'C00121', 'C00136', 'C00154', 'C00184', 'C00188']


id: TA09
name: Exposure
phase_id: P03
rank: 9
summary: Release content to general public or push to larger population
longname: TA09 - Exposure
technique_ids: ['T0047', 'T0048', 'T0049', 'T0050', 'T0051', 'T0052', 'T0053', 'T0054', 'T0055', 'T0056']
counter_ids:
['C00109', 'C00122', 'C00123', 'C00124', 'C00125', 'C00126', 'C00128', 'C00129', 'C00147', 'C00182', 'C00200', 'C00211']


