-
Notifications
You must be signed in to change notification settings - Fork 259
/
disarm-techniques.json
4841 lines (4841 loc) · 215 KB
/
disarm-techniques.json
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
232
233
234
235
236
237
238
239
240
241
242
243
244
245
246
247
248
249
250
251
252
253
254
255
256
257
258
259
260
261
262
263
264
265
266
267
268
269
270
271
272
273
274
275
276
277
278
279
280
281
282
283
284
285
286
287
288
289
290
291
292
293
294
295
296
297
298
299
300
301
302
303
304
305
306
307
308
309
310
311
312
313
314
315
316
317
318
319
320
321
322
323
324
325
326
327
328
329
330
331
332
333
334
335
336
337
338
339
340
341
342
343
344
345
346
347
348
349
350
351
352
353
354
355
356
357
358
359
360
361
362
363
364
365
366
367
368
369
370
371
372
373
374
375
376
377
378
379
380
381
382
383
384
385
386
387
388
389
390
391
392
393
394
395
396
397
398
399
400
401
402
403
404
405
406
407
408
409
410
411
412
413
414
415
416
417
418
419
420
421
422
423
424
425
426
427
428
429
430
431
432
433
434
435
436
437
438
439
440
441
442
443
444
445
446
447
448
449
450
451
452
453
454
455
456
457
458
459
460
461
462
463
464
465
466
467
468
469
470
471
472
473
474
475
476
477
478
479
480
481
482
483
484
485
486
487
488
489
490
491
492
493
494
495
496
497
498
499
500
501
502
503
504
505
506
507
508
509
510
511
512
513
514
515
516
517
518
519
520
521
522
523
524
525
526
527
528
529
530
531
532
533
534
535
536
537
538
539
540
541
542
543
544
545
546
547
548
549
550
551
552
553
554
555
556
557
558
559
560
561
562
563
564
565
566
567
568
569
570
571
572
573
574
575
576
577
578
579
580
581
582
583
584
585
586
587
588
589
590
591
592
593
594
595
596
597
598
599
600
601
602
603
604
605
606
607
608
609
610
611
612
613
614
615
616
617
618
619
620
621
622
623
624
625
626
627
628
629
630
631
632
633
634
635
636
637
638
639
640
641
642
643
644
645
646
647
648
649
650
651
652
653
654
655
656
657
658
659
660
661
662
663
664
665
666
667
668
669
670
671
672
673
674
675
676
677
678
679
680
681
682
683
684
685
686
687
688
689
690
691
692
693
694
695
696
697
698
699
700
701
702
703
704
705
706
707
708
709
710
711
712
713
714
715
716
717
718
719
720
721
722
723
724
725
726
727
728
729
730
731
732
733
734
735
736
737
738
739
740
741
742
743
744
745
746
747
748
749
750
751
752
753
754
755
756
757
758
759
760
761
762
763
764
765
766
767
768
769
770
771
772
773
774
775
776
777
778
779
780
781
782
783
784
785
786
787
788
789
790
791
792
793
794
795
796
797
798
799
800
801
802
803
804
805
806
807
808
809
810
811
812
813
814
815
816
817
818
819
820
821
822
823
824
825
826
827
828
829
830
831
832
833
834
835
836
837
838
839
840
841
842
843
844
845
846
847
848
849
850
851
852
853
854
855
856
857
858
859
860
861
862
863
864
865
866
867
868
869
870
871
872
873
874
875
876
877
878
879
880
881
882
883
884
885
886
887
888
889
890
891
892
893
894
895
896
897
898
899
900
901
902
903
904
905
906
907
908
909
910
911
912
913
914
915
916
917
918
919
920
921
922
923
924
925
926
927
928
929
930
931
932
933
934
935
936
937
938
939
940
941
942
943
944
945
946
947
948
949
950
951
952
953
954
955
956
957
958
959
960
961
962
963
964
965
966
967
968
969
970
971
972
973
974
975
976
977
978
979
980
981
982
983
984
985
986
987
988
989
990
991
992
993
994
995
996
997
998
999
1000
{
"authors": [
"DISARM Project"
],
"category": "disarm",
"description": "DISARM is a framework designed for describing and understanding disinformation incidents.",
"name": "Techniques",
"source": "https://github.com/DISARMFoundation/DISARMframeworks",
"type": "disarm-techniques",
"uuid": "fb0e6978-2647-5a95-8324-7ebfd2f88b67",
"values": [
{
"description": "Organise citizens around pro-state messaging. Coordinate paid or volunteer groups to push state propaganda.",
"meta": {
"external_id": "T0002",
"kill_chain": [
"tactics:Plan Objectives"
],
"refs": [
"https://github.com/DISARMFoundation/DISARMframeworks/blob/main/generated_pages/techniques/T0002.md"
]
},
"related": [
{
"dest-uuid": "559c0ffb-5098-55bd-a173-fbd335bb4ba7",
"type": "blocked-by"
},
{
"dest-uuid": "eededb33-c7f5-5c1b-bacd-924af3b6e332",
"type": "blocked-by"
},
{
"dest-uuid": "e6e01a8f-bb6f-5b16-b77d-61f0abbc84a5",
"type": "blocked-by"
},
{
"dest-uuid": "5f6e9165-2d53-52af-883a-13fff2749308",
"type": "blocked-by"
},
{
"dest-uuid": "4fc5ef29-5af2-5630-b57a-4df9844932c1",
"type": "blocked-by"
}
],
"uuid": "782afafa-e997-571a-9b25-d04bb322480c",
"value": "Facilitate State Propaganda"
},
{
"description": "Use or adapt existing narrative themes, where narratives are the baseline stories of a target audience. Narratives form the bedrock of our worldviews. New information is understood through a process firmly grounded in this bedrock. If new information is not consitent with the prevailing narratives of an audience, it will be ignored. Effective campaigns will frame their misinformation in the context of these narratives. Highly effective campaigns will make extensive use of audience-appropriate archetypes and meta-narratives throughout their content creation and amplifiction practices.",
"meta": {
"external_id": "T0003",
"kill_chain": [
"tactics:Develop Narratives"
],
"refs": [
"https://github.com/DISARMFoundation/DISARMframeworks/blob/main/generated_pages/techniques/T0003.md"
]
},
"related": [
{
"dest-uuid": "a706cf86-2170-58ea-a6d4-79cc47f23e54",
"type": "blocked-by"
},
{
"dest-uuid": "c14e8f7d-3c10-5cb5-a654-9d23315d631c",
"type": "blocked-by"
}
],
"uuid": "689e65f1-d834-581a-adf2-4e8a96d32464",
"value": "Leverage Existing Narratives"
},
{
"description": "Advance competing narratives connected to same issue ie: on one hand deny incident while at same time expresses dismiss. Suppressing or discouraging narratives already spreading requires an alternative. The most simple set of narrative techniques in response would be the construction and promotion of contradictory alternatives centred on denial, deflection, dismissal, counter-charges, excessive standards of proof, bias in prohibition or enforcement, and so on. These competing narratives allow loyalists cover, but are less compelling to opponents and fence-sitters than campaigns built around existing narratives or highly explanatory master narratives. Competing narratives, as such, are especially useful in the \"firehose of misinformation\" approach.",
"meta": {
"external_id": "T0004",
"kill_chain": [
"tactics:Develop Narratives"
],
"refs": [
"https://github.com/DISARMFoundation/DISARMframeworks/blob/main/generated_pages/techniques/T0004.md"
]
},
"related": [
{
"dest-uuid": "d14b6626-052a-5d30-a0da-598e1490bdaa",
"type": "blocked-by"
}
],
"uuid": "73bfaf89-d10a-5515-83fb-bc5ba11f5a2a",
"value": "Develop Competing Narratives"
},
{
"description": "Create key social engineering assets needed to amplify content, manipulate algorithms, fool public and/or specific incident/campaign targets. Computational propaganda depends substantially on false perceptions of credibility and acceptance. By creating fake users and groups with a variety of interests and commitments, attackers can ensure that their messages both come from trusted sources and appear more widely adopted than they actually are.",
"meta": {
"external_id": "T0007",
"kill_chain": [
"tactics:Establish Assets"
],
"refs": [
"https://github.com/DISARMFoundation/DISARMframeworks/blob/main/generated_pages/techniques/T0007.md"
]
},
"related": [
{
"dest-uuid": "0aa00b22-361f-5e5b-ac46-901cf6d2dfcc",
"type": "blocked-by"
},
{
"dest-uuid": "a374c7de-23fd-5cae-805c-83817cb66d66",
"type": "blocked-by"
},
{
"dest-uuid": "42827d89-3a37-568e-9de3-8ebd379c3d8f",
"type": "detected-by"
},
{
"dest-uuid": "e39234ab-979c-51c8-8f34-5a9337bd030e",
"type": "detected-by"
},
{
"dest-uuid": "6fc10d9d-96a5-5ae1-a0f7-0136a9819a6e",
"type": "detected-by"
},
{
"dest-uuid": "345ea7b9-1504-57cf-9c8f-7b01613d89e6",
"type": "detected-by"
}
],
"uuid": "e3cbbc7a-da73-50fb-9893-4ce88edb211f",
"value": "Create Inauthentic Social Media Pages and Groups"
},
{
"description": "Stories planted or promoted in computational propaganda operations often make use of experts fabricated from whole cloth, sometimes specifically for the story itself.",
"meta": {
"external_id": "T0009",
"kill_chain": [
"tactics:Establish Legitimacy"
],
"refs": [
"https://github.com/DISARMFoundation/DISARMframeworks/blob/main/generated_pages/techniques/T0009.md"
]
},
"related": [
{
"dest-uuid": "486790ce-6083-5403-b971-d4c0b291b6a4",
"type": "blocked-by"
},
{
"dest-uuid": "e9cf452f-3ebc-5de8-9f21-dde3133c92c0",
"type": "blocked-by"
},
{
"dest-uuid": "fea19aab-9522-55bf-9608-addf7d6aaf8d",
"type": "blocked-by"
},
{
"dest-uuid": "2fe43d88-db8f-5156-98fb-4b9db0e5fff3",
"type": "blocked-by"
},
{
"dest-uuid": "25ca7eff-d789-5c36-a49d-34194b7246d4",
"type": "detected-by"
},
{
"dest-uuid": "bd602fee-4354-5b31-99f1-832053c1bba0",
"type": "detected-by"
}
],
"uuid": "29768133-b941-5974-ab10-c15bbb86e387",
"value": "Create Fake Experts"
},
{
"description": "Utilise Academic/Pseudoscientific Justifications",
"meta": {
"external_id": "T0009.001",
"kill_chain": [
"tactics:Establish Legitimacy"
],
"refs": [
"https://github.com/DISARMFoundation/DISARMframeworks/blob/main/generated_pages/techniques/T0009.001.md"
]
},
"related": [],
"uuid": "4c721f5a-101e-5b5e-b260-7b08b92eac83",
"value": "Utilise Academic/Pseudoscientific Justifications"
},
{
"description": "Cultivate propagandists for a cause, the goals of which are not fully comprehended, and who are used cynically by the leaders of the cause. Independent actors use social media and specialised web sites to strategically reinforce and spread messages compatible with their own. Their networks are infiltrated and used by state media disinformation organisations to amplify the state’s own disinformation strategies against target populations. Many are traffickers in conspiracy theories or hoaxes, unified by a suspicion of Western governments and mainstream media. Their narratives, which appeal to leftists hostile to globalism and military intervention and nationalists against immigration, are frequently infiltrated and shaped by state-controlled trolls and altered news items from agencies such as RT and Sputnik. Also know as \"useful idiots\" or \"unwitting agents\".",
"meta": {
"external_id": "T0010",
"kill_chain": [
"tactics:Establish Assets"
],
"refs": [
"https://github.com/DISARMFoundation/DISARMframeworks/blob/main/generated_pages/techniques/T0010.md"
]
},
"related": [
{
"dest-uuid": "60e783f2-4e22-5495-abdf-cb73e1a5a4c1",
"type": "blocked-by"
},
{
"dest-uuid": "e4a0a68e-dbf8-56b6-8029-2d670aad813c",
"type": "blocked-by"
},
{
"dest-uuid": "70fb13e3-1d1f-5064-bf27-c3644f0a2045",
"type": "blocked-by"
},
{
"dest-uuid": "943ccc85-a339-5e32-ade9-09bc4bf6b4fd",
"type": "blocked-by"
},
{
"dest-uuid": "686ccd43-c358-5d5d-bd42-3e2279151670",
"type": "blocked-by"
},
{
"dest-uuid": "f99b442a-7c34-5c66-b699-64c3da69374c",
"type": "blocked-by"
},
{
"dest-uuid": "efd2cf88-94ba-5fdc-8611-660baf44b2e9",
"type": "blocked-by"
},
{
"dest-uuid": "babb37b7-5b28-5ba4-8f08-5c7c271937c7",
"type": "blocked-by"
},
{
"dest-uuid": "d12e5fda-c5d3-5cc5-806b-69edb56aac61",
"type": "blocked-by"
},
{
"dest-uuid": "a479d596-6f66-53eb-ae24-d3a67536464f",
"type": "blocked-by"
},
{
"dest-uuid": "3055e156-f234-5293-9ab2-d9761a620060",
"type": "blocked-by"
},
{
"dest-uuid": "8c281e28-298e-5c1b-8e44-f768006d6c26",
"type": "detected-by"
}
],
"uuid": "39baec3d-f2ce-5fee-ba7d-3db7d6469946",
"value": "Cultivate Ignorant Agents"
},
{
"description": "Create media assets to support inauthentic organisations (e.g. think tank), people (e.g. experts) and/or serve as sites to distribute malware/launch phishing operations.",
"meta": {
"external_id": "T0013",
"kill_chain": [
"tactics:Establish Assets"
],
"refs": [
"https://github.com/DISARMFoundation/DISARMframeworks/blob/main/generated_pages/techniques/T0013.md"
]
},
"related": [
{
"dest-uuid": "594ec374-28b9-5191-8bb7-edd9196daf4e",
"type": "detected-by"
},
{
"dest-uuid": "f2adbe9e-7c80-504d-adc5-624e04eab4f1",
"type": "detected-by"
}
],
"uuid": "534951bc-8d1e-58be-b051-c9243eac96fb",
"value": "Create Inauthentic Websites"
},
{
"description": "Fundraising campaigns refer to an influence operation’s systematic effort to seek financial support for a charity, cause, or other enterprise using online activities that further promote operation information pathways while raising a profit. Many influence operations have engaged in crowdfunding services on platforms including Tipee, Patreon, and GoFundMe. An operation may use its previously prepared fundraising campaigns (see: Develop Information Pathways) to promote operation messaging while raising money to support its activities.",
"meta": {
"external_id": "T0014",
"kill_chain": [
"tactics:Establish Assets"
],
"refs": [
"https://github.com/DISARMFoundation/DISARMframeworks/blob/main/generated_pages/techniques/T0014.md"
]
},
"related": [
{
"dest-uuid": "c112eafc-0f31-5bd7-9083-20ef706c8d57",
"type": "blocked-by"
},
{
"dest-uuid": "5b5c3e04-acf2-50dd-9861-c44bcc8f2cc3",
"type": "blocked-by"
},
{
"dest-uuid": "bbb8b174-44b6-5f59-bcf0-eab169bc7be1",
"type": "blocked-by"
}
],
"uuid": "f0bb5056-fedb-5507-8554-c958ec8d9fdc",
"value": "Prepare Fundraising Campaigns"
},
{
"description": "Raising funds from malign actors may include contributions from foreign agents, cutouts or proxies, shell companies, dark money groups, etc.",
"meta": {
"external_id": "T0014.001",
"kill_chain": [
"tactics:Establish Assets"
],
"refs": [
"https://github.com/DISARMFoundation/DISARMframeworks/blob/main/generated_pages/techniques/T0014.001.md"
]
},
"related": [],
"uuid": "d23f9cc0-058e-5354-b2c6-90e7b6737922",
"value": "Raise Funds from Malign Actors"
},
{
"description": "Raising funds from ignorant agents may include scams, donations intended for one stated purpose but then used for another, etc.",
"meta": {
"external_id": "T0014.002",
"kill_chain": [
"tactics:Establish Assets"
],
"refs": [
"https://github.com/DISARMFoundation/DISARMframeworks/blob/main/generated_pages/techniques/T0014.002.md"
]
},
"related": [],
"uuid": "dc89eee0-bf5e-51f0-957d-0e9e8a2cceff",
"value": "Raise Funds from Ignorant Agents"
},
{
"description": "Create one or more hashtags and/or hashtag groups. Many incident-based campaigns will create hashtags to promote their fabricated event. Creating a hashtag for an incident can have two important effects: 1. Create a perception of reality around an event. Certainly only \"real\" events would be discussed in a hashtag. After all, the event has a name!, and 2. Publicise the story more widely through trending lists and search behaviour. Asset needed to direct/control/manage \"conversation\" connected to launching new incident/campaign with new hashtag for applicable social media sites).",
"meta": {
"external_id": "T0015",
"kill_chain": [
"tactics:Develop Content"
],
"refs": [
"https://github.com/DISARMFoundation/DISARMframeworks/blob/main/generated_pages/techniques/T0015.md"
]
},
"related": [
{
"dest-uuid": "677c9e22-42b6-5b78-985c-e72936ae1b3f",
"type": "blocked-by"
}
],
"uuid": "6d3c1c71-746e-5e9d-9960-4845d712c899",
"value": "Create Hashtags and Search Artefacts"
},
{
"description": "Create attention grabbing headlines (outrage, doubt, humour) required to drive traffic & engagement. This is a key asset.",
"meta": {
"external_id": "T0016",
"kill_chain": [
"tactics:Microtarget"
],
"refs": [
"https://github.com/DISARMFoundation/DISARMframeworks/blob/main/generated_pages/techniques/T0016.md"
]
},
"related": [
{
"dest-uuid": "c52274ce-09fe-5b50-b2f2-741be794da6e",
"type": "blocked-by"
},
{
"dest-uuid": "d8b22aa2-cbb6-5a97-b9ad-32eaf3514768",
"type": "blocked-by"
},
{
"dest-uuid": "4880efa6-1123-5703-9c44-9f0600670dd9",
"type": "blocked-by"
},
{
"dest-uuid": "d6182931-a76a-59e6-901e-f63b9f6d2301",
"type": "blocked-by"
},
{
"dest-uuid": "e9380fb8-fc55-5ac7-94ab-2af4c13b6361",
"type": "blocked-by"
}
],
"uuid": "9570ebf8-f69b-5064-a627-a19cb429d0f5",
"value": "Create Clickbait"
},
{
"description": "Fundraising campaigns refer to an influence operation’s systematic effort to seek financial support for a charity, cause, or other enterprise using online activities that further promote operation information pathways while raising a profit. Many influence operations have engaged in crowdfunding services166 on platforms including Tipee, Patreon, and GoFundMe. An operation may use its previously prepared fundraising campaigns to promote operation messaging while raising money to support its activities.",
"meta": {
"external_id": "T0017",
"kill_chain": [
"tactics:Drive Offline Activity"
],
"refs": [
"https://github.com/DISARMFoundation/DISARMframeworks/blob/main/generated_pages/techniques/T0017.md"
]
},
"related": [
{
"dest-uuid": "99575145-b81a-5c7d-8107-e2ad419b3e20",
"type": "blocked-by"
},
{
"dest-uuid": "f3cd91e7-b21a-529f-82bd-dd3aa3c3106b",
"type": "blocked-by"
}
],
"uuid": "7f21fe4b-d314-5511-a9b1-0b9fcfee8b5e",
"value": "Conduct Fundraising"
},
{
"description": "An influence operation may Conduct Crowdfunding Campaigns on platforms such as GoFundMe, GiveSendGo, Tipeee, Patreon, etc.",
"meta": {
"external_id": "T0017.001",
"kill_chain": [
"tactics:Drive Offline Activity"
],
"refs": [
"https://github.com/DISARMFoundation/DISARMframeworks/blob/main/generated_pages/techniques/T0017.001.md"
]
},
"related": [],
"uuid": "999145bb-914b-5f7e-b47e-8756af2f5484",
"value": "Conduct Crowdfunding Campaigns"
},
{
"description": "Create or fund advertisements targeted at specific populations",
"meta": {
"external_id": "T0018",
"kill_chain": [
"tactics:Microtarget"
],
"refs": [
"https://github.com/DISARMFoundation/DISARMframeworks/blob/main/generated_pages/techniques/T0018.md"
]
},
"related": [
{
"dest-uuid": "14dad601-4ddd-5cfd-a48d-9b53212769ce",
"type": "blocked-by"
}
],
"uuid": "87208979-6982-53d5-ad0f-49cef659555c",
"value": "Purchase Targeted Advertisements"
},
{
"description": "Iteratively test incident performance (messages, content etc), e.g. A/B test headline/content enagagement metrics; website and/or funding campaign conversion rates",
"meta": {
"external_id": "T0020",
"kill_chain": [
"tactics:Conduct Pump Priming"
],
"refs": [
"https://github.com/DISARMFoundation/DISARMframeworks/blob/main/generated_pages/techniques/T0020.md"
]
},
"related": [
{
"dest-uuid": "fd9e1e82-0c60-5bf6-a9a2-4f29ca6d39ba",
"type": "blocked-by"
},
{
"dest-uuid": "30be4903-350a-505c-9166-fa65b8894778",
"type": "detected-by"
}
],
"uuid": "635f5592-0e2a-5f06-b164-c5af2ec9ef5e",
"value": "Trial Content"
},
{
"description": "\"Conspiracy narratives\" appeal to the human desire for explanatory order, by invoking the participation of poweful (often sinister) actors in pursuit of their own political goals. These narratives are especially appealing when an audience is low-information, marginalised or otherwise inclined to reject the prevailing explanation. Conspiracy narratives are an important component of the \"firehose of falsehoods\" model.",
"meta": {
"external_id": "T0022",
"kill_chain": [
"tactics:Develop Narratives"
],
"refs": [
"https://github.com/DISARMFoundation/DISARMframeworks/blob/main/generated_pages/techniques/T0022.md"
]
},
"related": [
{
"dest-uuid": "90ec53d1-ed62-516d-b530-49cb3e9e851c",
"type": "blocked-by"
},
{
"dest-uuid": "cbba0c79-9287-5ead-a70a-34f740b4325f",
"type": "blocked-by"
},
{
"dest-uuid": "877c29b5-38ae-570a-93b3-9e4e70ec27ef",
"type": "blocked-by"
},
{
"dest-uuid": "047898ad-129f-5d18-9dea-985e7f68becd",
"type": "blocked-by"
},
{
"dest-uuid": "af04983d-8531-54df-a7c7-39e5ae6bb523",
"type": "blocked-by"
}
],
"uuid": "f1d52ce1-f431-5732-a071-215cb3306f3e",
"value": "Leverage Conspiracy Theory Narratives"
},
{
"description": "An influence operation may amplify an existing conspiracy theory narrative that aligns with its incident or campaign goals. By amplifying existing conspiracy theory narratives, operators can leverage the power of the existing communities that support and propagate those theories without needing to expend resources creating new narratives or building momentum and buy in around new narratives.",
"meta": {
"external_id": "T0022.001",
"kill_chain": [
"tactics:Develop Narratives"
],
"refs": [
"https://github.com/DISARMFoundation/DISARMframeworks/blob/main/generated_pages/techniques/T0022.001.md"
]
},
"related": [],
"uuid": "f3c7a9c8-9196-5b2f-8d10-46ca31380987",
"value": "Amplify Existing Conspiracy Theory Narratives"
},
{
"description": "While this requires more resources than amplifying existing conspiracy theory narratives, an influence operation may develop original conspiracy theory narratives in order to achieve greater control and alignment over the narrative and their campaign goals. Prominent examples include the USSR's Operation INFEKTION disinformation campaign run by the KGB in the 1980s to plant the idea that the United States had invented HIV/AIDS as part of a biological weapons research project at Fort Detrick, Maryland. More recently, Fort Detrick featured prominently in a new conspiracy theory narratives around the origins of the COVID-19 outbreak and pandemic.",
"meta": {
"external_id": "T0022.002",
"kill_chain": [
"tactics:Develop Narratives"
],
"refs": [
"https://github.com/DISARMFoundation/DISARMframeworks/blob/main/generated_pages/techniques/T0022.002.md"
]
},
"related": [],
"uuid": "b90838cb-7124-5f07-9fa6-94f0b5b21343",
"value": "Develop Original Conspiracy Theory Narratives"
},
{
"description": "Change, twist, or exaggerate existing facts to construct a narrative that differs from reality. Examples: images and ideas can be distorted by being placed in an improper content",
"meta": {
"external_id": "T0023",
"kill_chain": [
"tactics:Develop Content"
],
"refs": [
"https://github.com/DISARMFoundation/DISARMframeworks/blob/main/generated_pages/techniques/T0023.md"
]
},
"related": [],
"uuid": "1993a35d-d276-569b-ba66-66623f982dc4",
"value": "Distort Facts"
},
{
"description": "Reframing context refers to removing an event from its surrounding context to distort its intended meaning. Rather than deny that an event occurred, reframing context frames an event in a manner that may lead the target audience to draw a different conclusion about its intentions.",
"meta": {
"external_id": "T0023.001",
"kill_chain": [
"tactics:Develop Content"
],
"refs": [
"https://github.com/DISARMFoundation/DISARMframeworks/blob/main/generated_pages/techniques/T0023.001.md"
]
},
"related": [],
"uuid": "c887503d-e5f5-5f06-a92a-9e50ec908eb6",
"value": "Reframe Context"
},
{
"description": "An influence operation may edit open-source content, such as collaborative blogs or encyclopaedias, to promote its narratives on outlets with existing credibility and audiences. Editing open-source content may allow an operation to post content on platforms without dedicating resources to the creation and maintenance of its own assets.",
"meta": {
"external_id": "T0023.002",
"kill_chain": [
"tactics:Develop Content"
],
"refs": [
"https://github.com/DISARMFoundation/DISARMframeworks/blob/main/generated_pages/techniques/T0023.002.md"
]
},
"related": [],
"uuid": "b4984f13-619b-54a7-bf2c-acc5cdc01437",
"value": "Edit Open-Source Content"
},
{
"description": "Create fake online polls, or manipulate existing online polls. Data gathering tactic to target those who engage, and potentially their networks of friends/followers as well",
"meta": {
"external_id": "T0029",
"kill_chain": [
"tactics:Select Channels and Affordances"
],
"refs": [
"https://github.com/DISARMFoundation/DISARMframeworks/blob/main/generated_pages/techniques/T0029.md"
]
},
"related": [
{
"dest-uuid": "e23dbc10-0eca-5100-bf14-cf2db9db31b8",
"type": "blocked-by"
},
{
"dest-uuid": "01b3516b-b8b1-5a56-ae24-5300cceb70f8",
"type": "blocked-by"
},
{
"dest-uuid": "a64a6568-d047-55b9-a3ab-f77fb3c9ada3",
"type": "blocked-by"
},
{
"dest-uuid": "e21e17e9-3834-59de-bc31-9e43b73c8973",
"type": "blocked-by"
},
{
"dest-uuid": "0280f954-5654-5d23-8dcf-a1f5334f3e6a",
"type": "blocked-by"
},
{
"dest-uuid": "d3216499-77fd-528e-8b65-7c3bded9adda",
"type": "detected-by"
},
{
"dest-uuid": "61aa4bb6-218c-5a10-9f1c-1a494f6871e7",
"type": "detected-by"
}
],
"uuid": "1a8c4e8c-3543-5ab1-b4d0-939de9e7875f",
"value": "Online Polls"
},
{
"description": "Influencers are people on social media platforms who have large audiences. \n\nThreat Actors can try to trick Influencers such as celebrities, journalists, or local leaders who aren’t associated with their campaign into amplifying campaign content. This gives them access to the Influencer’s audience without having to go through the effort of building it themselves, and it helps legitimise their message by associating it with the Influencer, benefitting from their audience’s trust in them.",
"meta": {
"external_id": "T0039",
"kill_chain": [
"tactics:Maximise Exposure"
],
"refs": [
"https://github.com/DISARMFoundation/DISARMframeworks/blob/main/generated_pages/techniques/T0039.md"
]
},
"related": [
{
"dest-uuid": "47ad777e-029c-5afa-9c37-50c3d86f3d39",
"type": "blocked-by"
},
{
"dest-uuid": "1744386c-0d46-54a8-a5b8-cba1bd7dc369",
"type": "blocked-by"
},
{
"dest-uuid": "a1441814-0d69-5b19-9dae-64c61d7dfdbd",
"type": "blocked-by"
},
{
"dest-uuid": "590350b9-2614-572b-825b-b2498ebf4c17",
"type": "blocked-by"
},
{
"dest-uuid": "f29dff54-af05-55d1-a056-899007481493",
"type": "detected-by"
}
],
"uuid": "53e8c51b-c178-5429-8cee-022c6741cc91",
"value": "Bait Influencer"
},
{
"description": "Campaigns often leverage tactical and informational asymmetries on the threat surface, as seen in the Distort and Deny strategies, and the \"firehose of misinformation\". Specifically, conspiracy theorists can be repeatedly wrong, but advocates of the truth need to be perfect. By constantly escalating demands for proof, propagandists can effectively leverage this asymmetry while also priming its future use, often with an even greater asymmetric advantage. The conspiracist is offered freer rein for a broader range of \"questions\" while the truth teller is burdened with higher and higher standards of proof.",
"meta": {
"external_id": "T0040",
"kill_chain": [
"tactics:Develop Narratives"
],
"refs": [
"https://github.com/DISARMFoundation/DISARMframeworks/blob/main/generated_pages/techniques/T0040.md"
]
},
"related": [
{
"dest-uuid": "b942a92e-13d5-5726-92bd-4fb5531f381b",
"type": "blocked-by"
}
],
"uuid": "70218fb2-3d85-5714-b990-2d18e345e184",
"value": "Demand Insurmountable Proof"
},
{
"description": "Wrap lies or altered context/facts around truths. Influence campaigns pursue a variety of objectives with respect to target audiences, prominent among them: 1. undermine a narrative commonly referenced in the target audience; or 2. promote a narrative less common in the target audience, but preferred by the attacker. In both cases, the attacker is presented with a heavy lift. They must change the relative importance of various narratives in the interpretation of events, despite contrary tendencies. When messaging makes use of factual reporting to promote these adjustments in the narrative space, they are less likely to be dismissed out of hand; when messaging can juxtapose a (factual) truth about current affairs with the (abstract) truth explicated in these narratives, propagandists can undermine or promote them selectively. Context matters.",
"meta": {
"external_id": "T0042",
"kill_chain": [
"tactics:Conduct Pump Priming"
],
"refs": [
"https://github.com/DISARMFoundation/DISARMframeworks/blob/main/generated_pages/techniques/T0042.md"
]
},
"related": [],
"uuid": "ab4b4b44-5f15-5c92-934b-30cc73f67afc",
"value": "Seed Kernel of Truth"
},
{
"description": "Direct messaging via chat app is an increasing method of delivery. These messages are often automated and new delivery and storage methods make them anonymous, viral, and ephemeral. This is a difficult space to monitor, but also a difficult space to build acclaim or notoriety.",
"meta": {
"external_id": "T0043",
"kill_chain": [
"tactics:Select Channels and Affordances"
],
"refs": [
"https://github.com/DISARMFoundation/DISARMframeworks/blob/main/generated_pages/techniques/T0043.md"
]
},
"related": [
{
"dest-uuid": "b8b49628-4c3d-528c-90f1-2fee8722e2c5",
"type": "blocked-by"
}
],
"uuid": "ebd0aab4-013c-52fa-bae5-8fb3bd7704b8",
"value": "Chat Apps"
},
{
"description": "Examples include Signal, WhatsApp, Discord, Wire, etc.",
"meta": {
"external_id": "T0043.001",
"kill_chain": [
"tactics:Select Channels and Affordances"
],
"refs": [
"https://github.com/DISARMFoundation/DISARMframeworks/blob/main/generated_pages/techniques/T0043.001.md"
]
},
"related": [],
"uuid": "7308289b-5875-5015-bead-adf63a552c28",
"value": "Use Encrypted Chat Apps"
},
{
"description": "Examples include SMS, etc.",
"meta": {
"external_id": "T0043.002",
"kill_chain": [
"tactics:Select Channels and Affordances"
],
"refs": [
"https://github.com/DISARMFoundation/DISARMframeworks/blob/main/generated_pages/techniques/T0043.002.md"
]
},
"related": [],
"uuid": "211e93c2-463a-5271-9384-61a6b8ca4af6",
"value": "Use Unencrypted Chats Apps"
},
{
"description": "Try a wide variety of messages in the early hours surrounding an incident or event, to give a misleading account or impression.",
"meta": {
"external_id": "T0044",
"kill_chain": [
"tactics:Conduct Pump Priming"
],
"refs": [
"https://github.com/DISARMFoundation/DISARMframeworks/blob/main/generated_pages/techniques/T0044.md"
]
},
"related": [
{
"dest-uuid": "2ab07267-614d-538b-8fef-bc6ed250a483",
"type": "blocked-by"
},
{
"dest-uuid": "3ce6759d-b144-5277-9798-2df09ce9a6c9",
"type": "blocked-by"
}
],
"uuid": "0fd25b71-ea11-51a3-bb18-545d5e818583",
"value": "Seed Distortions"
},
{
"description": "Use the fake experts that were set up during Establish Legitimacy. Pseudo-experts are disposable assets that often appear once and then disappear. Give \"credility\" to misinformation. Take advantage of credential bias",
"meta": {
"external_id": "T0045",
"kill_chain": [
"tactics:Conduct Pump Priming"
],
"refs": [
"https://github.com/DISARMFoundation/DISARMframeworks/blob/main/generated_pages/techniques/T0045.md"
]
},
"related": [
{
"dest-uuid": "a44e7e6c-f6ca-5ea4-9fe8-6dc798b2d729",
"type": "blocked-by"
},
{
"dest-uuid": "2cd7227b-31be-5999-9f5f-927f9d8c3b6e",
"type": "blocked-by"
}
],
"uuid": "edc041f8-06ac-513a-a9f9-1353e38f3bcf",
"value": "Use Fake Experts"
},
{
"description": "Manipulate content engagement metrics (ie: Reddit & Twitter) to influence/impact news search results (e.g. Google), also elevates RT & Sputnik headline into Google news alert emails. aka \"Black-hat SEO\"",
"meta": {
"external_id": "T0046",
"kill_chain": [
"tactics:Conduct Pump Priming"
],
"refs": [
"https://github.com/DISARMFoundation/DISARMframeworks/blob/main/generated_pages/techniques/T0046.md"
]
},
"related": [
{
"dest-uuid": "5b9a74d0-bfa6-5bb9-9297-3938c067f783",
"type": "blocked-by"
}
],
"uuid": "68c3a917-fed7-539e-9cf6-091153658ef2",
"value": "Use Search Engine Optimisation"
},
{
"description": "Use political influence or the power of state to stop critical social media comments. Government requested/driven content take downs (see Google Transperancy reports).",
"meta": {
"external_id": "T0047",
"kill_chain": [
"tactics:Drive Online Harms"
],
"refs": [
"https://github.com/DISARMFoundation/DISARMframeworks/blob/main/generated_pages/techniques/T0047.md"
]
},
"related": [
{
"dest-uuid": "0eb2eaf4-0c53-527d-8744-70670f6a9736",
"type": "blocked-by"
}
],
"uuid": "deb56d12-fd4d-515a-9051-89a372d5d4bb",
"value": "Censor Social Media as a Political Force"
},
{
"description": "Threatening or harassing believers of opposing narratives refers to the use of intimidation techniques, including cyberbullying and doxing, to discourage opponents from voicing their dissent. An influence operation may threaten or harass believers of the opposing narratives to deter individuals from posting or proliferating conflicting content.",
"meta": {
"external_id": "T0048",
"kill_chain": [
"tactics:Drive Online Harms"
],
"refs": [
"https://github.com/DISARMFoundation/DISARMframeworks/blob/main/generated_pages/techniques/T0048.md"
]
},
"related": [],
"uuid": "cb33d6fe-0327-58c1-93ad-10684fe9e099",
"value": "Harass"
},
{
"description": "Cancel culture refers to the phenomenon in which individuals collectively refrain from supporting an individual, organisation, business, or other entity, usually following a real or falsified controversy. An influence operation may exploit cancel culture by emphasising an adversary’s problematic or disputed behaviour and presenting its own content as an alternative.",
"meta": {
"external_id": "T0048.001",
"kill_chain": [
"tactics:Drive Online Harms"
],
"refs": [
"https://github.com/DISARMFoundation/DISARMframeworks/blob/main/generated_pages/techniques/T0048.001.md"
]
},
"related": [],
"uuid": "65c98713-cae5-5ae4-ae17-5902d7d1cfc4",
"value": "Boycott/\"Cancel\" Opponents"
},
{
"description": "Examples include social identities like gender, sexuality, race, ethnicity, religion, ability, nationality, etc. as well as roles and occupations like journalist or activist.",
"meta": {
"external_id": "T0048.002",
"kill_chain": [
"tactics:Drive Online Harms"
],
"refs": [
"https://github.com/DISARMFoundation/DISARMframeworks/blob/main/generated_pages/techniques/T0048.002.md"
]
},
"related": [],
"uuid": "a40e4177-42f2-5be2-89cf-1dd4eadaad13",
"value": "Harass People Based on Identities"
},
{
"description": "Doxing refers to online harassment in which individuals publicly release private information about another individual, including names, addresses, employment information, pictures, family members, and other sensitive information. An influence operation may dox its opposition to encourage individuals aligned with operation narratives to harass the doxed individuals themselves or otherwise discourage the doxed individuals from posting or proliferating conflicting content.",
"meta": {
"external_id": "T0048.003",
"kill_chain": [
"tactics:Drive Online Harms"
],
"refs": [
"https://github.com/DISARMFoundation/DISARMframeworks/blob/main/generated_pages/techniques/T0048.003.md"
]
},
"related": [],
"uuid": "c1df0074-7e66-5b71-85cb-784b1be15c48",
"value": "Threaten to Dox"
},
{
"description": "Doxing refers to online harassment in which individuals publicly release private information about another individual, including names, addresses, employment information, pictures, family members, and other sensitive information. An influence operation may dox its opposition to encourage individuals aligned with operation narratives to harass the doxed individuals themselves or otherwise discourage the doxed individuals from posting or proliferating conflicting content.",
"meta": {
"external_id": "T0048.004",
"kill_chain": [
"tactics:Drive Online Harms"
],
"refs": [
"https://github.com/DISARMFoundation/DISARMframeworks/blob/main/generated_pages/techniques/T0048.004.md"
]
},
"related": [],
"uuid": "18e83c9c-8e16-55e2-a013-63e583e79e8e",
"value": "Dox"
},
{
"description": "Flooding sources of information (e.g. Social Media feeds) with a high volume of inauthentic content.\n\nThis can be done to control/shape online conversations, drown out opposing points of view, or make it harder to find legitimate information. \n\nBots and/or patriotic trolls are effective tools to achieve this effect.\n\nThis Technique previously used the name Flooding the Information Space.",
"meta": {
"external_id": "T0049",
"kill_chain": [
"tactics:Maximise Exposure"
],
"refs": [
"https://github.com/DISARMFoundation/DISARMframeworks/blob/main/generated_pages/techniques/T0049.md"
]
},
"related": [
{
"dest-uuid": "ae4b53ba-9dd6-53af-a624-d5929944117c",
"type": "blocked-by"
},
{
"dest-uuid": "1d6622ba-a713-5133-9017-8eef36469936",
"type": "detected-by"
},
{
"dest-uuid": "ea1d787b-61f7-5fd6-8c52-54a64006e260",
"type": "detected-by"
},
{
"dest-uuid": "8b20ca17-c2d9-5879-bbf1-26de876c8e02",
"type": "detected-by"
},
{
"dest-uuid": "568f9e72-ca8c-54dd-976f-f9469bf026c1",
"type": "detected-by"
}
],
"uuid": "ee7bc41a-9eb0-5732-924a-3885e1c3bee9",
"value": "Flood Information Space"
},
{
"description": "Use trolls to amplify narratives and/or manipulate narratives. Fake profiles/sockpuppets operating to support individuals/narratives from the entire political spectrum (left/right binary). Operating with increased emphasis on promoting local content and promoting real Twitter users generating their own, often divisive political content, as it's easier to amplify existing content than create new/original content. Trolls operate where ever there's a socially divisive issue (issues that can/are be politicized).",
"meta": {
"external_id": "T0049.001",
"kill_chain": [
"tactics:Maximise Exposure"
],
"refs": [
"https://github.com/DISARMFoundation/DISARMframeworks/blob/main/generated_pages/techniques/T0049.001.md"
]
},
"related": [],
"uuid": "b126047b-eafa-50aa-891a-31250d13f50e",
"value": "Trolls Amplify and Manipulate"
},
{
"description": "Hashtags can be used by communities to collate information they post about particular topics (such as their interests, or current events) and users can find communities to join by exploring hashtags they’re interested in. \n\nThreat actors can flood an existing hashtag to try to ruin hashtag functionality, posting content unrelated to the hashtag alongside it, making it a less reliable source of relevant information. They may also try to flood existing hashtags with campaign content, with the intent of maximising exposure to users.\n\nThis Technique covers cases where threat actors flood existing hashtags with campaign content.\n\nThis Technique covers behaviours previously documented by T0019.002: Hijack Hashtags, which has since been deprecated. This Technique was previously called Hijack Existing Hashtag.",
"meta": {
"external_id": "T0049.002",
"kill_chain": [
"tactics:Maximise Exposure"
],
"refs": [
"https://github.com/DISARMFoundation/DISARMframeworks/blob/main/generated_pages/techniques/T0049.002.md"
]
},
"related": [],
"uuid": "885e8687-3598-5378-b0bf-f09b67c1696e",
"value": "Flood Existing Hashtag"
},
{
"description": "Automated forwarding and reposting refer to the proliferation of operation content using automated means, such as artificial intelligence or social media bots. An influence operation may use automated activity to increase content exposure without dedicating the resources, including personnel and time, traditionally required to forward and repost content. Use bots to amplify narratives above algorithm thresholds. Bots are automated/programmed profiles designed to amplify content (ie: automatically retweet or like) and give appearance it's more \"popular\" than it is. They can operate as a network, to function in a coordinated/orchestrated manner. In some cases (more so now) they are an inexpensive/disposable assets used for minimal deployment as bot detection tools improve and platforms are more responsive.",
"meta": {
"external_id": "T0049.003",
"kill_chain": [
"tactics:Maximise Exposure"
],
"refs": [
"https://github.com/DISARMFoundation/DISARMframeworks/blob/main/generated_pages/techniques/T0049.003.md"
]
},
"related": [],
"uuid": "78bd9a95-4aa4-5595-90de-839c65ff6542",
"value": "Bots Amplify via Automated Forwarding and Reposting"
},
{
"description": "Spamoflauge refers to the practice of disguising spam messages as legitimate. Spam refers to the use of electronic messaging systems to send out unrequested or unwanted messages in bulk. Simple methods of spamoflauge include replacing letters with numbers to fool keyword-based email spam filters, for example, \"you've w0n our jackp0t!\". Spamoflauge may extend to more complex techniques such as modifying the grammar or word choice of the language, casting messages as images which spam detectors cannot automatically read, or encapsulating messages in password protected attachments, such as .pdf or .zip files. Influence operations may use spamoflauge to avoid spam filtering systems and increase the likelihood of the target audience receiving operation messaging.",
"meta": {
"external_id": "T0049.004",
"kill_chain": [
"tactics:Maximise Exposure"
],
"refs": [
"https://github.com/DISARMFoundation/DISARMframeworks/blob/main/generated_pages/techniques/T0049.004.md"