diff --git a/clusters/disarm-actortypes.json b/clusters/disarm-actortypes.json new file mode 100644 index 0000000..fee7d19 --- /dev/null +++ b/clusters/disarm-actortypes.json @@ -0,0 +1,945 @@ +{ + "authors": [ + "DISARM Project" + ], + "category": "disarm", + "description": "DISARM is a framework designed for describing and understanding disinformation incidents.", + "name": "Actor Types", + "source": "https://github.com/DISARMFoundation/DISARMframeworks", + "type": "disarm-actortypes", + "uuid": "f1cb3e2f-f760-54a1-a3aa-a4f0fc342750", + "values": [ + { + "description": "Person who can wrangle data, implement machine learning algorithms etc", + "meta": { + "external_id": "A001", + "kill_chain": [ + "sectors:Nonprofit", + "sectors:Civil Society", + "sectors:Government", + "sectors:Academic", + "sectors:Activist", + "sectors:General Public", + "sectors:Social Media Company", + "sectors:Other Tech Company", + "sectors:Other Company", + "sectors:Media" + ], + "refs": [ + "https://github.com/DISARMFoundation/DISARMframeworks/blob/main/generated_pages/actortypes/A001.md" + ] + }, + "related": [ + { + "dest-uuid": "9167d3c2-1f91-58f1-9dc2-fbe948f6b31c", + "type": "affects" + }, + { + "dest-uuid": "590350b9-2614-572b-825b-b2498ebf4c17", + "type": "affects" + }, + { + "dest-uuid": "187285bb-a282-5a6a-833e-01d9744165c4", + "type": "detects" + }, + { + "dest-uuid": "d4f0dd4b-6818-52a4-b4ca-e1fef024c1a0", + "type": "detects" + }, + { + "dest-uuid": "5aca53f0-2c85-5298-9eeb-4ac8325abb6b", + "type": "detects" + }, + { + "dest-uuid": "d24431db-fc6e-5c62-b3d0-113a2219dbec", + "type": "detects" + }, + { + "dest-uuid": "745658e5-5437-5f92-b2c4-80569a3cb330", + "type": "detects" + }, + { + "dest-uuid": "d3216499-77fd-528e-8b65-7c3bded9adda", + "type": "detects" + }, + { + "dest-uuid": "1dc819ef-5eb6-51df-9614-bc9bf8218279", + "type": "detects" + } + ], + "uuid": "03aaf19c-42b9-5b8e-9d47-a6bb291f10fa", + "value": "data scientist" + }, + { + "description": "Person being targeted by disinformation campaign", + "meta": { + "external_id": "A002", + "kill_chain": [ + "sectors:Nonprofit", + "sectors:Civil Society", + "sectors:Government", + "sectors:Academic", + "sectors:Activist", + "sectors:General Public", + "sectors:Social Media Company", + "sectors:Other Tech Company", + "sectors:Other Company", + "sectors:Media" + ], + "refs": [ + "https://github.com/DISARMFoundation/DISARMframeworks/blob/main/generated_pages/actortypes/A002.md" + ] + }, + "related": [], + "uuid": "d202541b-34c0-573f-9e70-d6b0568194f6", + "value": "target" + }, + { + "description": "Influencer", + "meta": { + "external_id": "A003", + "kill_chain": [ + "sectors:Nonprofit", + "sectors:Civil Society", + "sectors:Government", + "sectors:Academic", + "sectors:Activist", + "sectors:General Public", + "sectors:Social Media Company", + "sectors:Other Tech Company", + "sectors:Other Company", + "sectors:Media" + ], + "refs": [ + "https://github.com/DISARMFoundation/DISARMframeworks/blob/main/generated_pages/actortypes/A003.md" + ] + }, + "related": [ + { + "dest-uuid": "67bab8b7-908b-5b0f-bf56-26502798d743", + "type": "affects" + } + ], + "uuid": "52f3153f-d7ab-5e42-9ee6-aea591856214", + "value": "trusted authority" + }, + { + "description": "", + "meta": { + "external_id": "A004", + "kill_chain": [ + "sectors:Civil Society" + ], + "refs": [ + "https://github.com/DISARMFoundation/DISARMframeworks/blob/main/generated_pages/actortypes/A004.md" + ] + }, + "related": [ + { + "dest-uuid": "d7895c21-5e79-58db-b055-1e065abf524b", + "type": "affects" + }, + { + "dest-uuid": "2fe43d88-db8f-5156-98fb-4b9db0e5fff3", + "type": "affects" + } + ], + "uuid": "d710c91e-a2f2-54ba-9477-fe51b9f31f76", + "value": "activist" + }, + { + "description": "", + "meta": { + "external_id": "A005", + "kill_chain": [ + "sectors:Civil Society" + ], + "refs": [ + "https://github.com/DISARMFoundation/DISARMframeworks/blob/main/generated_pages/actortypes/A005.md" + ] + }, + "related": [ + { + "dest-uuid": "c52274ce-09fe-5b50-b2f2-741be794da6e", + "type": "affects" + } + ], + "uuid": "09f16551-695e-5d72-b58f-6cd256f7cb68", + "value": "community group" + }, + { + "description": "", + "meta": { + "external_id": "A006", + "kill_chain": [ + "sectors:Civil Society" + ], + "refs": [ + "https://github.com/DISARMFoundation/DISARMframeworks/blob/main/generated_pages/actortypes/A006.md" + ] + }, + "related": [ + { + "dest-uuid": "60e783f2-4e22-5495-abdf-cb73e1a5a4c1", + "type": "affects" + }, + { + "dest-uuid": "523a0f1c-bb9e-5784-8838-ca7bc389688b", + "type": "affects" + }, + { + "dest-uuid": "943ccc85-a339-5e32-ade9-09bc4bf6b4fd", + "type": "affects" + }, + { + "dest-uuid": "c52274ce-09fe-5b50-b2f2-741be794da6e", + "type": "affects" + }, + { + "dest-uuid": "5c8fc207-b237-58cc-bedd-024fea386a7a", + "type": "affects" + }, + { + "dest-uuid": "d00320eb-5cc4-52e1-ae09-8b2d79affda2", + "type": "affects" + } + ], + "uuid": "a73d7508-4e4b-57d8-9dbf-15ac73b65a15", + "value": "educator" + }, + { + "description": "Someone with the skills to verify whether information posted is factual", + "meta": { + "external_id": "A007", + "kill_chain": [ + "sectors:Civil Society" + ], + "refs": [ + "https://github.com/DISARMFoundation/DISARMframeworks/blob/main/generated_pages/actortypes/A007.md" + ] + }, + "related": [ + { + "dest-uuid": "26781c01-b62d-5091-99f4-047e4a0e825e", + "type": "affects" + }, + { + "dest-uuid": "5036147d-f885-5d57-98ea-2e0c478611cc", + "type": "affects" + } + ], + "uuid": "997129f2-3afb-5d5e-9b67-d864c9721676", + "value": "factchecker" + }, + { + "description": "", + "meta": { + "external_id": "A008", + "kill_chain": [ + "sectors:Civil Society" + ], + "refs": [ + "https://github.com/DISARMFoundation/DISARMframeworks/blob/main/generated_pages/actortypes/A008.md" + ] + }, + "related": [ + { + "dest-uuid": "c52274ce-09fe-5b50-b2f2-741be794da6e", + "type": "affects" + } + ], + "uuid": "b2457b24-f997-573e-9c25-90eab4559f8e", + "value": "library" + }, + { + "description": "", + "meta": { + "external_id": "A009", + "kill_chain": [ + "sectors:Civil Society" + ], + "refs": [ + "https://github.com/DISARMFoundation/DISARMframeworks/blob/main/generated_pages/actortypes/A009.md" + ] + }, + "related": [ + { + "dest-uuid": "c52274ce-09fe-5b50-b2f2-741be794da6e", + "type": "affects" + } + ], + "uuid": "253aa4f0-d720-50b7-a462-70c85f5f5b9f", + "value": "NGO" + }, + { + "description": "", + "meta": { + "external_id": "A010", + "kill_chain": [ + "sectors:Civil Society" + ], + "refs": [ + "https://github.com/DISARMFoundation/DISARMframeworks/blob/main/generated_pages/actortypes/A010.md" + ] + }, + "related": [ + { + "dest-uuid": "c52274ce-09fe-5b50-b2f2-741be794da6e", + "type": "affects" + } + ], + "uuid": "c198d0db-7fea-523d-acc5-24b1e7d3f47c", + "value": "religious organisation" + }, + { + "description": "", + "meta": { + "external_id": "A011", + "kill_chain": [ + "sectors:Civil Society" + ], + "refs": [ + "https://github.com/DISARMFoundation/DISARMframeworks/blob/main/generated_pages/actortypes/A011.md" + ] + }, + "related": [], + "uuid": "f5b2ceb2-8f32-58f7-9225-c71a8242c932", + "value": "school" + }, + { + "description": "Anyone who owns an account online", + "meta": { + "external_id": "A012", + "kill_chain": [ + "sectors:General Public" + ], + "refs": [ + "https://github.com/DISARMFoundation/DISARMframeworks/blob/main/generated_pages/actortypes/A012.md" + ] + }, + "related": [ + { + "dest-uuid": "5481cc36-5af8-5ddf-bcb7-638d3be3f583", + "type": "affects" + } + ], + "uuid": "e2947637-eba1-526e-820d-7d9c0d27b6be", + "value": "account owner" + }, + { + "description": "", + "meta": { + "external_id": "A013", + "kill_chain": [ + "sectors:General Public" + ], + "refs": [ + "https://github.com/DISARMFoundation/DISARMframeworks/blob/main/generated_pages/actortypes/A013.md" + ] + }, + "related": [ + { + "dest-uuid": "686ccd43-c358-5d5d-bd42-3e2279151670", + "type": "affects" + } + ], + "uuid": "6330d1dc-258f-5631-95e2-66390937cec3", + "value": "content creator" + }, + { + "description": "", + "meta": { + "external_id": "A014", + "kill_chain": [ + "sectors:General Public" + ], + "refs": [ + "https://github.com/DISARMFoundation/DISARMframeworks/blob/main/generated_pages/actortypes/A014.md" + ] + }, + "related": [ + { + "dest-uuid": "7ef86cff-4401-518b-92fc-a0d88c23f280", + "type": "affects" + } + ], + "uuid": "019e73b3-c4be-5a28-a86b-4eb6d2df1217", + "value": "elves" + }, + { + "description": "", + "meta": { + "external_id": "A015", + "kill_chain": [ + "sectors:General Public" + ], + "refs": [ + "https://github.com/DISARMFoundation/DISARMframeworks/blob/main/generated_pages/actortypes/A015.md" + ] + }, + "related": [ + { + "dest-uuid": "1744386c-0d46-54a8-a5b8-cba1bd7dc369", + "type": "affects" + }, + { + "dest-uuid": "8cfe6ea3-7271-5578-b4f7-8eb3edbe43f5", + "type": "affects" + }, + { + "dest-uuid": "7ef86cff-4401-518b-92fc-a0d88c23f280", + "type": "affects" + }, + { + "dest-uuid": "11380b67-28d8-5034-a79b-fbb6150ad302", + "type": "affects" + }, + { + "dest-uuid": "187285bb-a282-5a6a-833e-01d9744165c4", + "type": "detects" + }, + { + "dest-uuid": "94d622e2-5909-5f88-aaaf-846907cbda1f", + "type": "detects" + }, + { + "dest-uuid": "61aa4bb6-218c-5a10-9f1c-1a494f6871e7", + "type": "detects" + }, + { + "dest-uuid": "7806c5d1-7c44-5ff5-a539-361c3381a67d", + "type": "detects" + } + ], + "uuid": "f6c98378-65be-5f14-af3e-326909d70d77", + "value": "general public" + }, + { + "description": "", + "meta": { + "external_id": "A016", + "kill_chain": [ + "sectors:General Public" + ], + "refs": [ + "https://github.com/DISARMFoundation/DISARMframeworks/blob/main/generated_pages/actortypes/A016.md" + ] + }, + "related": [ + { + "dest-uuid": "60e783f2-4e22-5495-abdf-cb73e1a5a4c1", + "type": "affects" + }, + { + "dest-uuid": "590350b9-2614-572b-825b-b2498ebf4c17", + "type": "affects" + }, + { + "dest-uuid": "a479d596-6f66-53eb-ae24-d3a67536464f", + "type": "affects" + } + ], + "uuid": "ebd92d67-1d68-5542-8b48-3cfc939db88a", + "value": "influencer" + }, + { + "description": "For example the DHS", + "meta": { + "external_id": "A017", + "kill_chain": [ + "sectors:Government" + ], + "refs": [ + "https://github.com/DISARMFoundation/DISARMframeworks/blob/main/generated_pages/actortypes/A017.md" + ] + }, + "related": [ + { + "dest-uuid": "c52274ce-09fe-5b50-b2f2-741be794da6e", + "type": "affects" + } + ], + "uuid": "91c80826-4428-5a58-8e54-337dfee99584", + "value": "coordinating body" + }, + { + "description": "Government agencies", + "meta": { + "external_id": "A018", + "kill_chain": [ + "sectors:Government" + ], + "refs": [ + "https://github.com/DISARMFoundation/DISARMframeworks/blob/main/generated_pages/actortypes/A018.md" + ] + }, + "related": [ + { + "dest-uuid": "27acb21d-afef-52b5-be75-886d2af18067", + "type": "affects" + }, + { + "dest-uuid": "877c29b5-38ae-570a-93b3-9e4e70ec27ef", + "type": "affects" + }, + { + "dest-uuid": "3055e156-f234-5293-9ab2-d9761a620060", + "type": "affects" + }, + { + "dest-uuid": "9133c9a6-500e-537d-aaa8-be8c5da12a93", + "type": "affects" + }, + { + "dest-uuid": "e81b12d2-491b-534a-88bb-221ab2cbf828", + "type": "affects" + }, + { + "dest-uuid": "d00320eb-5cc4-52e1-ae09-8b2d79affda2", + "type": "affects" + } + ], + "uuid": "1975d955-01ff-5cbb-8897-b08a0b235370", + "value": "government" + }, + { + "description": "", + "meta": { + "external_id": "A019", + "kill_chain": [ + "sectors:Government" + ], + "refs": [ + "https://github.com/DISARMFoundation/DISARMframeworks/blob/main/generated_pages/actortypes/A019.md" + ] + }, + "related": [ + { + "dest-uuid": "877c29b5-38ae-570a-93b3-9e4e70ec27ef", + "type": "affects" + } + ], + "uuid": "091f8344-0956-5d15-83c4-e967579c4391", + "value": "military" + }, + { + "description": "", + "meta": { + "external_id": "A020", + "kill_chain": [ + "sectors:Government" + ], + "refs": [ + "https://github.com/DISARMFoundation/DISARMframeworks/blob/main/generated_pages/actortypes/A020.md" + ] + }, + "related": [ + { + "dest-uuid": "57f70a3c-63a7-5873-a0ce-49a05d5f4eb7", + "type": "affects" + }, + { + "dest-uuid": "27acb21d-afef-52b5-be75-886d2af18067", + "type": "affects" + }, + { + "dest-uuid": "5682293b-d9d8-5db0-90df-4bb4cedc6882", + "type": "affects" + }, + { + "dest-uuid": "14dad601-4ddd-5cfd-a48d-9b53212769ce", + "type": "affects" + } + ], + "uuid": "53f1e7bd-7aa8-5e02-a0a8-3fd34ee638e1", + "value": "policy maker" + }, + { + "description": "", + "meta": { + "external_id": "A021", + "kill_chain": [ + "sectors:Media" + ], + "refs": [ + "https://github.com/DISARMFoundation/DISARMframeworks/blob/main/generated_pages/actortypes/A021.md" + ] + }, + "related": [ + { + "dest-uuid": "f5764785-ced5-5faa-8e11-e442d2d3f79d", + "type": "affects" + }, + { + "dest-uuid": "c52274ce-09fe-5b50-b2f2-741be794da6e", + "type": "affects" + }, + { + "dest-uuid": "686ccd43-c358-5d5d-bd42-3e2279151670", + "type": "affects" + }, + { + "dest-uuid": "8cfe6ea3-7271-5578-b4f7-8eb3edbe43f5", + "type": "affects" + }, + { + "dest-uuid": "a1441814-0d69-5b19-9dae-64c61d7dfdbd", + "type": "affects" + }, + { + "dest-uuid": "b666fbe1-04de-547c-abc5-27786c948e50", + "type": "affects" + }, + { + "dest-uuid": "5c8fc207-b237-58cc-bedd-024fea386a7a", + "type": "affects" + } + ], + "uuid": "bdcbbd5d-e282-5c55-a39e-212b10f75200", + "value": "media organisation" + }, + { + "description": "", + "meta": { + "external_id": "A022", + "kill_chain": [ + "sectors:Other Company" + ], + "refs": [ + "https://github.com/DISARMFoundation/DISARMframeworks/blob/main/generated_pages/actortypes/A022.md" + ] + }, + "related": [], + "uuid": "de0bdbac-82a8-547a-9117-fa660b55b3ea", + "value": "company" + }, + { + "description": "", + "meta": { + "external_id": "A023", + "kill_chain": [ + "sectors:Other Tech Company" + ], + "refs": [ + "https://github.com/DISARMFoundation/DISARMframeworks/blob/main/generated_pages/actortypes/A023.md" + ] + }, + "related": [ + { + "dest-uuid": "4880efa6-1123-5703-9c44-9f0600670dd9", + "type": "affects" + }, + { + "dest-uuid": "bbb8b174-44b6-5f59-bcf0-eab169bc7be1", + "type": "affects" + } + ], + "uuid": "6edba8b4-fe7a-5be0-84d0-6dee21d2a48e", + "value": "adtech provider" + }, + { + "description": "", + "meta": { + "external_id": "A024", + "kill_chain": [ + "sectors:Other Tech Company" + ], + "refs": [ + "https://github.com/DISARMFoundation/DISARMframeworks/blob/main/generated_pages/actortypes/A024.md" + ] + }, + "related": [ + { + "dest-uuid": "523a0f1c-bb9e-5784-8838-ca7bc389688b", + "type": "affects" + }, + { + "dest-uuid": "e21e17e9-3834-59de-bc31-9e43b73c8973", + "type": "affects" + }, + { + "dest-uuid": "1dc819ef-5eb6-51df-9614-bc9bf8218279", + "type": "detects" + } + ], + "uuid": "2057de14-930a-5199-8e8e-9969173d36bb", + "value": "developer" + }, + { + "description": "Funding site admin", + "meta": { + "external_id": "A025", + "kill_chain": [ + "sectors:Other Tech Company" + ], + "refs": [ + "https://github.com/DISARMFoundation/DISARMframeworks/blob/main/generated_pages/actortypes/A025.md" + ] + }, + "related": [ + { + "dest-uuid": "5b5c3e04-acf2-50dd-9861-c44bcc8f2cc3", + "type": "affects" + } + ], + "uuid": "a97e25d4-62cf-5040-8274-1a71104104b2", + "value": "funding_site_admin" + }, + { + "description": "", + "meta": { + "external_id": "A026", + "kill_chain": [ + "sectors:Other Tech Company" + ], + "refs": [ + "https://github.com/DISARMFoundation/DISARMframeworks/blob/main/generated_pages/actortypes/A026.md" + ] + }, + "related": [ + { + "dest-uuid": "523a0f1c-bb9e-5784-8838-ca7bc389688b", + "type": "affects" + } + ], + "uuid": "6ff00416-5f81-5cc5-a07e-dff63a8a09a5", + "value": "games designer" + }, + { + "description": "", + "meta": { + "external_id": "A027", + "kill_chain": [ + "sectors:Other Tech Company" + ], + "refs": [ + "https://github.com/DISARMFoundation/DISARMframeworks/blob/main/generated_pages/actortypes/A027.md" + ] + }, + "related": [ + { + "dest-uuid": "22e5b817-e45b-5f41-8806-8e0c66f181cc", + "type": "affects" + }, + { + "dest-uuid": "14b886aa-c023-5a84-9605-e4a9cb22e4f4", + "type": "affects" + } + ], + "uuid": "a0c301a5-5675-5d79-bd8c-2afde063697e", + "value": "information security" + }, + { + "description": "", + "meta": { + "external_id": "A028", + "kill_chain": [ + "sectors:Other Tech Company" + ], + "refs": [ + "https://github.com/DISARMFoundation/DISARMframeworks/blob/main/generated_pages/actortypes/A028.md" + ] + }, + "related": [ + { + "dest-uuid": "5481cc36-5af8-5ddf-bcb7-638d3be3f583", + "type": "affects" + }, + { + "dest-uuid": "dae93cbd-eb65-5fb0-9d4e-4571ff54b6ff", + "type": "affects" + }, + { + "dest-uuid": "e18bd403-00d9-5767-9e5c-b597f623821a", + "type": "detects" + }, + { + "dest-uuid": "f2adbe9e-7c80-504d-adc5-624e04eab4f1", + "type": "detects" + } + ], + "uuid": "f4dc44c5-e021-524b-9909-678f11a9f10d", + "value": "platform administrator" + }, + { + "description": "", + "meta": { + "external_id": "A029", + "kill_chain": [ + "sectors:Other Tech Company" + ], + "refs": [ + "https://github.com/DISARMFoundation/DISARMframeworks/blob/main/generated_pages/actortypes/A029.md" + ] + }, + "related": [ + { + "dest-uuid": "ae4b53ba-9dd6-53af-a624-d5929944117c", + "type": "affects" + } + ], + "uuid": "b7db36e3-3dbb-5f91-be61-076996a4c57b", + "value": "server admininistrator" + }, + { + "description": "", + "meta": { + "external_id": "A030", + "kill_chain": [ + "sectors:Social Media Company" + ], + "refs": [ + "https://github.com/DISARMFoundation/DISARMframeworks/blob/main/generated_pages/actortypes/A030.md" + ] + }, + "related": [], + "uuid": "2a1f51c4-ded0-530d-a54c-5834898d4c47", + "value": "platforms" + }, + { + "description": "Person with the authority to make changes to algorithms, take down content etc.", + "meta": { + "external_id": "A031", + "kill_chain": [ + "sectors:Social Media Company" + ], + "refs": [ + "https://github.com/DISARMFoundation/DISARMframeworks/blob/main/generated_pages/actortypes/A031.md" + ] + }, + "related": [ + { + "dest-uuid": "bb1f5f27-16da-59da-9972-32bb25568d02", + "type": "affects" + }, + { + "dest-uuid": "e23dbc10-0eca-5100-bf14-cf2db9db31b8", + "type": "affects" + }, + { + "dest-uuid": "5481cc36-5af8-5ddf-bcb7-638d3be3f583", + "type": "affects" + }, + { + "dest-uuid": "dae93cbd-eb65-5fb0-9d4e-4571ff54b6ff", + "type": "affects" + }, + { + "dest-uuid": "01b3516b-b8b1-5a56-ae24-5300cceb70f8", + "type": "affects" + }, + { + "dest-uuid": "eaef2d36-c5a8-59b9-9075-c6cdaa060e5d", + "type": "affects" + }, + { + "dest-uuid": "33d7f540-0adb-5ab5-ae09-1c7a20e125b1", + "type": "affects" + }, + { + "dest-uuid": "a64a6568-d047-55b9-a3ab-f77fb3c9ada3", + "type": "affects" + }, + { + "dest-uuid": "e9cf452f-3ebc-5de8-9f21-dde3133c92c0", + "type": "affects" + }, + { + "dest-uuid": "0b0f003a-4bb7-5f1e-8bc6-987c680cba39", + "type": "affects" + }, + { + "dest-uuid": "027421d5-7c11-5c13-aa91-5cf6a01b72ef", + "type": "affects" + }, + { + "dest-uuid": "f3edf130-0096-5a49-a3f1-d97974a70494", + "type": "affects" + }, + { + "dest-uuid": "0acbac2f-7bd4-51d1-aaac-e12cebcddb31", + "type": "affects" + }, + { + "dest-uuid": "49f92a32-bac9-56af-ac97-3b09f23b8fa6", + "type": "affects" + }, + { + "dest-uuid": "dcb94d22-45a2-5433-bc4c-634add96088b", + "type": "affects" + }, + { + "dest-uuid": "b20e5c17-f2dd-5057-9af2-a9586e72de9e", + "type": "affects" + }, + { + "dest-uuid": "2fe43d88-db8f-5156-98fb-4b9db0e5fff3", + "type": "affects" + }, + { + "dest-uuid": "187285bb-a282-5a6a-833e-01d9744165c4", + "type": "detects" + }, + { + "dest-uuid": "94d622e2-5909-5f88-aaaf-846907cbda1f", + "type": "detects" + } + ], + "uuid": "667967b8-b3f1-55ad-8f8a-8c43c1290e6e", + "value": "social media platform adminstrator" + }, + { + "description": "", + "meta": { + "external_id": "A032", + "kill_chain": [ + "sectors:Social Media Company" + ], + "refs": [ + "https://github.com/DISARMFoundation/DISARMframeworks/blob/main/generated_pages/actortypes/A032.md" + ] + }, + "related": [ + { + "dest-uuid": "c52274ce-09fe-5b50-b2f2-741be794da6e", + "type": "affects" + } + ], + "uuid": "75f1924e-e711-5d07-8336-865b277c30d0", + "value": "social media platform outreach" + }, + { + "description": "Person with authority to make changes to a social media company’s business model", + "meta": { + "external_id": "A033", + "kill_chain": [ + "sectors:Social Media Company" + ], + "refs": [ + "https://github.com/DISARMFoundation/DISARMframeworks/blob/main/generated_pages/actortypes/A033.md" + ] + }, + "related": [ + { + "dest-uuid": "0aa00b22-361f-5e5b-ac46-901cf6d2dfcc", + "type": "affects" + }, + { + "dest-uuid": "27acb21d-afef-52b5-be75-886d2af18067", + "type": "affects" + }, + { + "dest-uuid": "9133c9a6-500e-537d-aaa8-be8c5da12a93", + "type": "affects" + }, + { + "dest-uuid": "e81b12d2-491b-534a-88bb-221ab2cbf828", + "type": "affects" + } + ], + "uuid": "15428e72-df7e-5483-a59c-bf84bb46928f", + "value": "social media platform owner" + } + ], + "version": 1 +} diff --git a/clusters/disarm-countermeasures.json b/clusters/disarm-countermeasures.json new file mode 100644 index 0000000..6f04af8 --- /dev/null +++ b/clusters/disarm-countermeasures.json @@ -0,0 +1,3758 @@ +{ + "authors": [ + "DISARM Project" + ], + "category": "disarm", + "description": "DISARM is a framework designed for describing and understanding disinformation incidents.", + "name": "Countermeasures", + "source": "https://github.com/DISARMFoundation/DISARMframeworks", + "type": "disarm-countermeasures", + "uuid": "75e907ad-1b8d-5288-a9e9-1b18627b3265", + "values": [ + { + "description": "Include a paid-for privacy option, e.g. pay Facebook for an option of them not collecting your personal information. There are examples of this not working, e.g. most people don’t use proton mail etc.", + "meta": { + "external_id": "C00006", + "kill_chain": [ + "tactics:Plan Strategy", + "responsetypes:Deny", + "metatechniques:Friction" + ], + "refs": [ + "https://github.com/DISARMFoundation/DISARMframeworks/blob/main/generated_pages/counters/C00006.md" + ] + }, + "related": [ + { + "dest-uuid": "e3cbbc7a-da73-50fb-9893-4ce88edb211f", + "type": "blocks" + }, + { + "dest-uuid": "15428e72-df7e-5483-a59c-bf84bb46928f", + "type": "affected-by" + } + ], + "uuid": "0aa00b22-361f-5e5b-ac46-901cf6d2dfcc", + "value": "Charge for social media" + }, + { + "description": "Share fact-checking resources - tips, responses, countermessages, across respose groups.", + "meta": { + "external_id": "C00008", + "kill_chain": [ + "tactics:Plan Strategy", + "responsetypes:Degrade", + "metatechniques:Scoring" + ], + "refs": [ + "https://github.com/DISARMFoundation/DISARMframeworks/blob/main/generated_pages/counters/C00008.md" + ] + }, + "related": [ + { + "dest-uuid": "aaaef5e2-4d1b-5fb6-ba0b-f79f2d3f4a2a", + "type": "blocks" + }, + { + "dest-uuid": "997129f2-3afb-5d5e-9b67-d864c9721676", + "type": "affected-by" + } + ], + "uuid": "26781c01-b62d-5091-99f4-047e4a0e825e", + "value": "Create shared fact-checking database" + }, + { + "description": "Find online influencers. Provide training in the mechanisms of disinformation, how to spot campaigns, and/or how to contribute to responses by countermessaging, boosting information sites etc.", + "meta": { + "external_id": "C00009", + "kill_chain": [ + "tactics:Plan Objectives", + "responsetypes:Deny", + "metatechniques:Resilience" + ], + "refs": [ + "https://github.com/DISARMFoundation/DISARMframeworks/blob/main/generated_pages/counters/C00009.md" + ] + }, + "related": [ + { + "dest-uuid": "39baec3d-f2ce-5fee-ba7d-3db7d6469946", + "type": "blocks" + }, + { + "dest-uuid": "a73d7508-4e4b-57d8-9dbf-15ac73b65a15", + "type": "affected-by" + }, + { + "dest-uuid": "ebd92d67-1d68-5542-8b48-3cfc939db88a", + "type": "affected-by" + } + ], + "uuid": "60e783f2-4e22-5495-abdf-cb73e1a5a4c1", + "value": "Educate high profile influencers on best practices" + }, + { + "description": "Implement stronger privacy standards, to reduce the ability to microtarget community members.", + "meta": { + "external_id": "C00010", + "kill_chain": [ + "tactics:Plan Strategy", + "responsetypes:Deny", + "metatechniques:Friction" + ], + "refs": [ + "https://github.com/DISARMFoundation/DISARMframeworks/blob/main/generated_pages/counters/C00010.md" + ] + }, + "related": [ + { + "dest-uuid": "4f605821-9566-5a3c-b8c9-070e3b7f885d", + "type": "blocks" + }, + { + "dest-uuid": "53f1e7bd-7aa8-5e02-a0a8-3fd34ee638e1", + "type": "affected-by" + } + ], + "uuid": "57f70a3c-63a7-5873-a0ce-49a05d5f4eb7", + "value": "Enhanced privacy regulation for social media" + }, + { + "description": "Create and use games to show people the mechanics of disinformation, and how to counter them.", + "meta": { + "external_id": "C00011", + "kill_chain": [ + "tactics:Plan Objectives", + "responsetypes:Deny", + "metatechniques:Resilience" + ], + "refs": [ + "https://github.com/DISARMFoundation/DISARMframeworks/blob/main/generated_pages/counters/C00011.md" + ] + }, + "related": [ + { + "dest-uuid": "aaaef5e2-4d1b-5fb6-ba0b-f79f2d3f4a2a", + "type": "blocks" + }, + { + "dest-uuid": "a73d7508-4e4b-57d8-9dbf-15ac73b65a15", + "type": "affected-by" + }, + { + "dest-uuid": "2057de14-930a-5199-8e8e-9969173d36bb", + "type": "affected-by" + }, + { + "dest-uuid": "6ff00416-5f81-5cc5-a07e-dff63a8a09a5", + "type": "affected-by" + } + ], + "uuid": "523a0f1c-bb9e-5784-8838-ca7bc389688b", + "value": "Media literacy. Games to identify fake news" + }, + { + "description": "Empower existing regulators to govern social media. Also covers Destroy. Includes: Include the role of social media in the regulatory framework for media. The U.S. approach will need to be carefully crafted to protect First Amendment principles, create needed transparency, ensure liability, and impose costs for noncompliance. Includes Create policy that makes social media police disinformation. Includes: Use fraud legislation to clean up social media", + "meta": { + "external_id": "C00012", + "kill_chain": [ + "tactics:Plan Strategy", + "responsetypes:Deny", + "metatechniques:Metatechnique" + ], + "refs": [ + "https://github.com/DISARMFoundation/DISARMframeworks/blob/main/generated_pages/counters/C00012.md" + ] + }, + "related": [ + { + "dest-uuid": "aaaef5e2-4d1b-5fb6-ba0b-f79f2d3f4a2a", + "type": "blocks" + }, + { + "dest-uuid": "1975d955-01ff-5cbb-8897-b08a0b235370", + "type": "affected-by" + }, + { + "dest-uuid": "53f1e7bd-7aa8-5e02-a0a8-3fd34ee638e1", + "type": "affected-by" + }, + { + "dest-uuid": "15428e72-df7e-5483-a59c-bf84bb46928f", + "type": "affected-by" + } + ], + "uuid": "27acb21d-afef-52b5-be75-886d2af18067", + "value": "Platform regulation" + }, + { + "description": "This is \"strategic innoculation\", raising the standards of what people expect in terms of evidence when consuming news. Example: journalistic ethics, or journalistic licencing body. Include full transcripts, link source, add items.", + "meta": { + "external_id": "C00013", + "kill_chain": [ + "tactics:Plan Strategy", + "responsetypes:Deny", + "metatechniques:Scoring" + ], + "refs": [ + "https://github.com/DISARMFoundation/DISARMframeworks/blob/main/generated_pages/counters/C00013.md" + ] + }, + "related": [ + { + "dest-uuid": "aaaef5e2-4d1b-5fb6-ba0b-f79f2d3f4a2a", + "type": "blocks" + }, + { + "dest-uuid": "bd7a51b3-d00c-575f-a16e-6f51e5a67743", + "type": "affected-by" + } + ], + "uuid": "2fd47294-5af0-591d-8f6d-ca6db61f1ead", + "value": "Rating framework for news" + }, + { + "description": "Update fact-checking databases and resources in real time. Especially import for time-limited events like natural disasters.", + "meta": { + "external_id": "C00014", + "kill_chain": [ + "tactics:Develop Content", + "responsetypes:Degrade", + "metatechniques:Scoring" + ], + "refs": [ + "https://github.com/DISARMFoundation/DISARMframeworks/blob/main/generated_pages/counters/C00014.md" + ] + }, + "related": [ + { + "dest-uuid": "aaaef5e2-4d1b-5fb6-ba0b-f79f2d3f4a2a", + "type": "blocks" + }, + { + "dest-uuid": "997129f2-3afb-5d5e-9b67-d864c9721676", + "type": "affected-by" + } + ], + "uuid": "5036147d-f885-5d57-98ea-2e0c478611cc", + "value": "Real-time updates to fact-checking database" + }, + { + "description": "Alter and/or block the publication/dissemination of information controlled by disinformation creators. Not recommended.", + "meta": { + "external_id": "C00016", + "kill_chain": [ + "tactics:Plan Strategy", + "responsetypes:Deny", + "metatechniques:Removal" + ], + "refs": [ + "https://github.com/DISARMFoundation/DISARMframeworks/blob/main/generated_pages/counters/C00016.md" + ] + }, + "related": [ + { + "dest-uuid": "aaaef5e2-4d1b-5fb6-ba0b-f79f2d3f4a2a", + "type": "blocks" + }, + { + "dest-uuid": "667967b8-b3f1-55ad-8f8a-8c43c1290e6e", + "type": "affected-by" + } + ], + "uuid": "bb1f5f27-16da-59da-9972-32bb25568d02", + "value": "Censorship" + }, + { + "description": "For example, use a media campaign to promote in-group to out-group in person communication / activities . Technique could be in terms of forcing a reality-check by talking to people instead of reading about bogeymen.", + "meta": { + "external_id": "C00017", + "kill_chain": [ + "tactics:Plan Strategy", + "responsetypes:Disrupt", + "metatechniques:Countermessaging" + ], + "refs": [ + "https://github.com/DISARMFoundation/DISARMframeworks/blob/main/generated_pages/counters/C00017.md" + ] + }, + "related": [ + { + "dest-uuid": "aaaef5e2-4d1b-5fb6-ba0b-f79f2d3f4a2a", + "type": "blocks" + }, + { + "dest-uuid": "bdcbbd5d-e282-5c55-a39e-212b10f75200", + "type": "affected-by" + } + ], + "uuid": "f5764785-ced5-5faa-8e11-e442d2d3f79d", + "value": "Repair broken social connections" + }, + { + "description": "includes Promote constructive communication by shaming division-enablers, and Promote playbooks to call out division-enablers", + "meta": { + "external_id": "C00019", + "kill_chain": [ + "tactics:Plan Strategy", + "responsetypes:Disrupt", + "metatechniques:Daylight" + ], + "refs": [ + "https://github.com/DISARMFoundation/DISARMframeworks/blob/main/generated_pages/counters/C00019.md" + ] + }, + "related": [ + { + "dest-uuid": "aaaef5e2-4d1b-5fb6-ba0b-f79f2d3f4a2a", + "type": "blocks" + }, + { + "dest-uuid": "bd7a51b3-d00c-575f-a16e-6f51e5a67743", + "type": "affected-by" + } + ], + "uuid": "cad55f3b-3244-5b10-ab09-4ca0b0ff8675", + "value": "Reduce effect of division-enablers" + }, + { + "description": "Encourage offline communication", + "meta": { + "external_id": "C00021", + "kill_chain": [ + "tactics:Plan Strategy", + "responsetypes:Degrade", + "metatechniques:Resilience" + ], + "refs": [ + "https://github.com/DISARMFoundation/DISARMframeworks/blob/main/generated_pages/counters/C00021.md" + ] + }, + "related": [ + { + "dest-uuid": "aaaef5e2-4d1b-5fb6-ba0b-f79f2d3f4a2a", + "type": "blocks" + }, + { + "dest-uuid": "bd7a51b3-d00c-575f-a16e-6f51e5a67743", + "type": "affected-by" + } + ], + "uuid": "68dc4436-e658-523b-a2ef-a3cbc40a7c67", + "value": "Encourage in-person communication" + }, + { + "description": "Used to counter ability based and fear based attacks", + "meta": { + "external_id": "C00022", + "kill_chain": [ + "tactics:Plan Strategy", + "responsetypes:Degrade", + "metatechniques:Resilience" + ], + "refs": [ + "https://github.com/DISARMFoundation/DISARMframeworks/blob/main/generated_pages/counters/C00022.md" + ] + }, + "related": [ + { + "dest-uuid": "aaaef5e2-4d1b-5fb6-ba0b-f79f2d3f4a2a", + "type": "blocks" + }, + { + "dest-uuid": "bd7a51b3-d00c-575f-a16e-6f51e5a67743", + "type": "affected-by" + } + ], + "uuid": "f5322bd4-271e-5387-b725-5b19404227c9", + "value": "Innoculate. Positive campaign to promote feeling of safety" + }, + { + "description": "Includes promoting constructive narratives i.e. not polarising (e.g. pro-life, pro-choice, pro-USA). Includes promoting identity neutral narratives.", + "meta": { + "external_id": "C00024", + "kill_chain": [ + "tactics:Plan Strategy", + "responsetypes:Degrade", + "metatechniques:Resilience" + ], + "refs": [ + "https://github.com/DISARMFoundation/DISARMframeworks/blob/main/generated_pages/counters/C00024.md" + ] + }, + "related": [ + { + "dest-uuid": "aaaef5e2-4d1b-5fb6-ba0b-f79f2d3f4a2a", + "type": "blocks" + }, + { + "dest-uuid": "bd7a51b3-d00c-575f-a16e-6f51e5a67743", + "type": "affected-by" + } + ], + "uuid": "74f42c1b-7e24-5c78-b6a2-49c9c09922e2", + "value": "Promote healthy narratives" + }, + { + "description": "Messages about e.g. peace, freedom. And make it sexy. Includes Deploy Information and Narrative-Building in Service of Statecraft: Promote a narrative of transparency, truthfulness, liberal values, and democracy. Implement a compelling narrative via effective mechanisms of communication. Continually reassess messages, mechanisms, and audiences over time. Counteract efforts to manipulate media, undermine free markets, and suppress political freedoms via public diplomacy", + "meta": { + "external_id": "C00026", + "kill_chain": [ + "tactics:Plan Strategy", + "responsetypes:Degrade", + "metatechniques:Countermessaging" + ], + "refs": [ + "https://github.com/DISARMFoundation/DISARMframeworks/blob/main/generated_pages/counters/C00026.md" + ] + }, + "related": [ + { + "dest-uuid": "aaaef5e2-4d1b-5fb6-ba0b-f79f2d3f4a2a", + "type": "blocks" + }, + { + "dest-uuid": "bd7a51b3-d00c-575f-a16e-6f51e5a67743", + "type": "affected-by" + } + ], + "uuid": "713f0bb0-e9c4-5584-b923-a87365e39f3c", + "value": "Shore up democracy based messages" + }, + { + "description": "This is passive. Includes promoting civility as an identity that people will defend.", + "meta": { + "external_id": "C00027", + "kill_chain": [ + "tactics:Plan Strategy", + "responsetypes:Deter", + "metatechniques:Resilience" + ], + "refs": [ + "https://github.com/DISARMFoundation/DISARMframeworks/blob/main/generated_pages/counters/C00027.md" + ] + }, + "related": [ + { + "dest-uuid": "aaaef5e2-4d1b-5fb6-ba0b-f79f2d3f4a2a", + "type": "blocks" + }, + { + "dest-uuid": "bd7a51b3-d00c-575f-a16e-6f51e5a67743", + "type": "affected-by" + } + ], + "uuid": "5837bb64-0baf-53fa-8b73-3e9fb0d63a9b", + "value": "Create culture of civility" + }, + { + "description": "Blockchain audit log and validation with collaborative decryption to post comments. Use blockchain technology to require collaborative validation before posts or comments are submitted. This could be used to adjust upvote weight via a trust factor of people and organisations you trust, or other criteria.", + "meta": { + "external_id": "C00028", + "kill_chain": [ + "tactics:Plan Objectives", + "responsetypes:Disrupt", + "metatechniques:Verification" + ], + "refs": [ + "https://github.com/DISARMFoundation/DISARMframeworks/blob/main/generated_pages/counters/C00028.md" + ] + }, + "related": [ + { + "dest-uuid": "2d40a01e-41a9-513a-bf0b-694dc0a87f8e", + "type": "blocks" + }, + { + "dest-uuid": "bd7a51b3-d00c-575f-a16e-6f51e5a67743", + "type": "affected-by" + } + ], + "uuid": "dd7ad75d-dc4d-5408-ac00-1f1e3c52a632", + "value": "Make information provenance available" + }, + { + "description": "Create websites in disinformation voids - spaces where people are looking for known disinformation.", + "meta": { + "external_id": "C00029", + "kill_chain": [ + "tactics:Plan Objectives", + "responsetypes:Disrupt", + "metatechniques:Diversion" + ], + "refs": [ + "https://github.com/DISARMFoundation/DISARMframeworks/blob/main/generated_pages/counters/C00029.md" + ] + }, + "related": [ + { + "dest-uuid": "782afafa-e997-571a-9b25-d04bb322480c", + "type": "blocks" + }, + { + "dest-uuid": "bd7a51b3-d00c-575f-a16e-6f51e5a67743", + "type": "affected-by" + } + ], + "uuid": "559c0ffb-5098-55bd-a173-fbd335bb4ba7", + "value": "Create fake website to issue counter narrative and counter narrative through physical merchandise" + }, + { + "description": "", + "meta": { + "external_id": "C00030", + "kill_chain": [ + "tactics:Plan Objectives", + "responsetypes:Disrupt", + "metatechniques:Diversion" + ], + "refs": [ + "https://github.com/DISARMFoundation/DISARMframeworks/blob/main/generated_pages/counters/C00030.md" + ] + }, + "related": [ + { + "dest-uuid": "782afafa-e997-571a-9b25-d04bb322480c", + "type": "blocks" + }, + { + "dest-uuid": "bd7a51b3-d00c-575f-a16e-6f51e5a67743", + "type": "affected-by" + } + ], + "uuid": "eededb33-c7f5-5c1b-bacd-924af3b6e332", + "value": "Develop a compelling counter narrative (truth based)" + }, + { + "description": "Create competing narratives. Included \"Facilitate State Propaganda\" as diluting the narrative could have an effect on the pro-state narrative used by volunteers, or lower their involvement.", + "meta": { + "external_id": "C00031", + "kill_chain": [ + "tactics:Plan Objectives", + "responsetypes:Disrupt", + "metatechniques:Dilution" + ], + "refs": [ + "https://github.com/DISARMFoundation/DISARMframeworks/blob/main/generated_pages/counters/C00031.md" + ] + }, + "related": [ + { + "dest-uuid": "782afafa-e997-571a-9b25-d04bb322480c", + "type": "blocks" + }, + { + "dest-uuid": "bd7a51b3-d00c-575f-a16e-6f51e5a67743", + "type": "affected-by" + } + ], + "uuid": "e6e01a8f-bb6f-5b16-b77d-61f0abbc84a5", + "value": "Dilute the core narrative - create multiple permutations, target / amplify" + }, + { + "description": "Link to platform", + "meta": { + "external_id": "C00032", + "kill_chain": [ + "tactics:Develop Content", + "responsetypes:Disrupt", + "metatechniques:Diversion" + ], + "refs": [ + "https://github.com/DISARMFoundation/DISARMframeworks/blob/main/generated_pages/counters/C00032.md" + ] + }, + "related": [ + { + "dest-uuid": "9c50e797-400b-50f9-8052-e6f0e324c73e", + "type": "blocks" + }, + { + "dest-uuid": "bd7a51b3-d00c-575f-a16e-6f51e5a67743", + "type": "affected-by" + } + ], + "uuid": "0cb15351-72d8-5ffa-ab9a-1d71685881e1", + "value": "Hijack content and link to truth- based info" + }, + { + "description": "Counters fake account", + "meta": { + "external_id": "C00034", + "kill_chain": [ + "tactics:Establish Social Assets", + "responsetypes:Degrade", + "metatechniques:Friction" + ], + "refs": [ + "https://github.com/DISARMFoundation/DISARMframeworks/blob/main/generated_pages/counters/C00034.md" + ] + }, + "related": [ + { + "dest-uuid": "29768133-b941-5974-ab10-c15bbb86e387", + "type": "blocks" + }, + { + "dest-uuid": "bd7a51b3-d00c-575f-a16e-6f51e5a67743", + "type": "affected-by" + } + ], + "uuid": "486790ce-6083-5403-b971-d4c0b291b6a4", + "value": "Create more friction at account creation" + }, + { + "description": "All of these would be highly affected by infiltration or false-claims of infiltration.", + "meta": { + "external_id": "C00036", + "kill_chain": [ + "tactics:Establish Social Assets", + "responsetypes:Deny", + "metatechniques:Targeting" + ], + "refs": [ + "https://github.com/DISARMFoundation/DISARMframeworks/blob/main/generated_pages/counters/C00036.md" + ] + }, + "related": [ + { + "dest-uuid": "4f605821-9566-5a3c-b8c9-070e3b7f885d", + "type": "blocks" + }, + { + "dest-uuid": "bd7a51b3-d00c-575f-a16e-6f51e5a67743", + "type": "affected-by" + } + ], + "uuid": "2925512b-480b-52fb-a2b6-75ab3efbfef9", + "value": "Infiltrate the in-group to discredit leaders (divide)" + }, + { + "description": "counters fake experts", + "meta": { + "external_id": "C00040", + "kill_chain": [ + "tactics:Establish Social Assets", + "responsetypes:Deny", + "metatechniques:Verification" + ], + "refs": [ + "https://github.com/DISARMFoundation/DISARMframeworks/blob/main/generated_pages/counters/C00040.md" + ] + }, + "related": [ + { + "dest-uuid": "e3cbbc7a-da73-50fb-9893-4ce88edb211f", + "type": "blocks" + }, + { + "dest-uuid": "bd7a51b3-d00c-575f-a16e-6f51e5a67743", + "type": "affected-by" + } + ], + "uuid": "a374c7de-23fd-5cae-805c-83817cb66d66", + "value": "third party verification for people" + }, + { + "description": "Focus on and boost truths in misinformation narratives, removing misinformation from them.", + "meta": { + "external_id": "C00042", + "kill_chain": [ + "tactics:Establish Social Assets", + "responsetypes:Degrade", + "metatechniques:Countermessaging" + ], + "refs": [ + "https://github.com/DISARMFoundation/DISARMframeworks/blob/main/generated_pages/counters/C00042.md" + ] + }, + "related": [ + { + "dest-uuid": "73bfaf89-d10a-5515-83fb-bc5ba11f5a2a", + "type": "blocks" + }, + { + "dest-uuid": "bd7a51b3-d00c-575f-a16e-6f51e5a67743", + "type": "affected-by" + } + ], + "uuid": "d14b6626-052a-5d30-a0da-598e1490bdaa", + "value": "Address truth contained in narratives" + }, + { + "description": "Platforms can introduce friction to slow down activities, force a small delay between posts, or replies to posts.", + "meta": { + "external_id": "C00044", + "kill_chain": [ + "tactics:Establish Social Assets", + "responsetypes:Disrupt", + "metatechniques:Friction" + ], + "refs": [ + "https://github.com/DISARMFoundation/DISARMframeworks/blob/main/generated_pages/counters/C00044.md" + ] + }, + "related": [ + { + "dest-uuid": "1a8c4e8c-3543-5ab1-b4d0-939de9e7875f", + "type": "blocks" + }, + { + "dest-uuid": "667967b8-b3f1-55ad-8f8a-8c43c1290e6e", + "type": "affected-by" + } + ], + "uuid": "e23dbc10-0eca-5100-bf14-cf2db9db31b8", + "value": "Keep people from posting to social media immediately" + }, + { + "description": "Reduce the credibility of extremist groups posting misinformation.", + "meta": { + "external_id": "C00046", + "kill_chain": [ + "tactics:Establish Social Assets", + "responsetypes:Degrade", + "metatechniques:Targeting" + ], + "refs": [ + "https://github.com/DISARMFoundation/DISARMframeworks/blob/main/generated_pages/counters/C00046.md" + ] + }, + "related": [ + { + "dest-uuid": "39baec3d-f2ce-5fee-ba7d-3db7d6469946", + "type": "blocks" + }, + { + "dest-uuid": "bd7a51b3-d00c-575f-a16e-6f51e5a67743", + "type": "affected-by" + } + ], + "uuid": "e4a0a68e-dbf8-56b6-8029-2d670aad813c", + "value": "Marginalise and discredit extremist groups" + }, + { + "description": "Flood disinformation spaces with obviously fake content, to dilute core misinformation narratives in them.", + "meta": { + "external_id": "C00047", + "kill_chain": [ + "tactics:Establish Social Assets", + "responsetypes:Deceive", + "metatechniques:Data Pollution" + ], + "refs": [ + "https://github.com/DISARMFoundation/DISARMframeworks/blob/main/generated_pages/counters/C00047.md" + ] + }, + "related": [ + { + "dest-uuid": "6ae1614e-10c8-5c92-b369-e00c28584f65", + "type": "blocks" + }, + { + "dest-uuid": "bd7a51b3-d00c-575f-a16e-6f51e5a67743", + "type": "affected-by" + } + ], + "uuid": "71d1408a-5cb7-58a9-a9ff-0534141b78de", + "value": "Honeypot with coordinated inauthentics" + }, + { + "description": "Think about the different levels: individual vs state-sponsored account. Includes “call them out” and “name and shame”. Identify social media accounts as sources of propaganda—“calling them out”— might be helpful to prevent the spread of their message to audiences that otherwise would consider them factual. Identify, monitor, and, if necessary, target externally-based nonattributed social media accounts. Impact of and Dealing with Trolls - \"Chatham House has observed that trolls also sometimes function as decoys, as a way of “keeping the infantry busy” that “aims to wear down the other side” (Lough et al., 2014). Another type of troll involves “false accounts posing as authoritative information sources on social media”.", + "meta": { + "external_id": "C00048", + "kill_chain": [ + "tactics:Establish Social Assets", + "responsetypes:Deter", + "metatechniques:Daylight" + ], + "refs": [ + "https://github.com/DISARMFoundation/DISARMframeworks/blob/main/generated_pages/counters/C00048.md" + ] + }, + "related": [ + { + "dest-uuid": "39baec3d-f2ce-5fee-ba7d-3db7d6469946", + "type": "blocks" + }, + { + "dest-uuid": "bd7a51b3-d00c-575f-a16e-6f51e5a67743", + "type": "affected-by" + } + ], + "uuid": "70fb13e3-1d1f-5064-bf27-c3644f0a2045", + "value": "Name and Shame Influencers" + }, + { + "description": "Includes anti-elicitation training, phishing prevention education.", + "meta": { + "external_id": "C00051", + "kill_chain": [ + "tactics:Establish Social Assets", + "responsetypes:Deny", + "metatechniques:Resilience" + ], + "refs": [ + "https://github.com/DISARMFoundation/DISARMframeworks/blob/main/generated_pages/counters/C00051.md" + ] + }, + "related": [ + { + "dest-uuid": "39baec3d-f2ce-5fee-ba7d-3db7d6469946", + "type": "blocks" + }, + { + "dest-uuid": "a73d7508-4e4b-57d8-9dbf-15ac73b65a15", + "type": "affected-by" + } + ], + "uuid": "943ccc85-a339-5e32-ade9-09bc4bf6b4fd", + "value": "Counter social engineering training" + }, + { + "description": "Detect and degrade", + "meta": { + "external_id": "C00052", + "kill_chain": [ + "tactics:Establish Social Assets", + "responsetypes:Degrade", + "metatechniques:Targeting" + ], + "refs": [ + "https://github.com/DISARMFoundation/DISARMframeworks/blob/main/generated_pages/counters/C00052.md" + ] + }, + "related": [ + { + "dest-uuid": "80153803-52a6-501a-8e28-b143d85dc261", + "type": "blocks" + }, + { + "dest-uuid": "d710c91e-a2f2-54ba-9477-fe51b9f31f76", + "type": "affected-by" + } + ], + "uuid": "d7895c21-5e79-58db-b055-1e065abf524b", + "value": "Infiltrate platforms" + }, + { + "description": "remove or remove access to (e.g. stop the ability to update) old social media accounts, to reduce the pool of accounts available for takeover, botnets etc.", + "meta": { + "external_id": "C00053", + "kill_chain": [ + "tactics:Establish Social Assets", + "responsetypes:Degrade", + "metatechniques:Cleaning" + ], + "refs": [ + "https://github.com/DISARMFoundation/DISARMframeworks/blob/main/generated_pages/counters/C00053.md" + ] + }, + "related": [ + { + "dest-uuid": "d05396d6-9701-5ce3-a6cd-abff224310ae", + "type": "blocks" + }, + { + "dest-uuid": "e2947637-eba1-526e-820d-7d9c0d27b6be", + "type": "affected-by" + }, + { + "dest-uuid": "f4dc44c5-e021-524b-9909-678f11a9f10d", + "type": "affected-by" + }, + { + "dest-uuid": "667967b8-b3f1-55ad-8f8a-8c43c1290e6e", + "type": "affected-by" + } + ], + "uuid": "5481cc36-5af8-5ddf-bcb7-638d3be3f583", + "value": "Delete old accounts / Remove unused social media accounts" + }, + { + "description": "Encourage people to leave spcial media. We don't expect this to work", + "meta": { + "external_id": "C00056", + "kill_chain": [ + "tactics:Establish Social Assets", + "responsetypes:Deny", + "metatechniques:Friction" + ], + "refs": [ + "https://github.com/DISARMFoundation/DISARMframeworks/blob/main/generated_pages/counters/C00056.md" + ] + }, + "related": [ + { + "dest-uuid": "bd7a51b3-d00c-575f-a16e-6f51e5a67743", + "type": "blocks" + }, + { + "dest-uuid": "bd7a51b3-d00c-575f-a16e-6f51e5a67743", + "type": "affected-by" + } + ], + "uuid": "ea193641-bdc6-591e-80bb-18061f0f3220", + "value": "Encourage people to leave social media" + }, + { + "description": "counters crowdfunding. Includes ‘Expose online funding as fake”.", + "meta": { + "external_id": "C00058", + "kill_chain": [ + "tactics:Establish Social Assets", + "responsetypes:Deny", + "metatechniques:Removal" + ], + "refs": [ + "https://github.com/DISARMFoundation/DISARMframeworks/blob/main/generated_pages/counters/C00058.md" + ] + }, + "related": [ + { + "dest-uuid": "7f21fe4b-d314-5511-a9b1-0b9fcfee8b5e", + "type": "blocks" + }, + { + "dest-uuid": "bd7a51b3-d00c-575f-a16e-6f51e5a67743", + "type": "affected-by" + } + ], + "uuid": "99575145-b81a-5c7d-8107-e2ad419b3e20", + "value": "Report crowdfunder as violator" + }, + { + "description": "third-party verification of projects posting funding campaigns before those campaigns can be posted.", + "meta": { + "external_id": "C00059", + "kill_chain": [ + "tactics:Establish Social Assets", + "responsetypes:Deny", + "metatechniques:Verification" + ], + "refs": [ + "https://github.com/DISARMFoundation/DISARMframeworks/blob/main/generated_pages/counters/C00059.md" + ] + }, + "related": [ + { + "dest-uuid": "f0bb5056-fedb-5507-8554-c958ec8d9fdc", + "type": "blocks" + }, + { + "dest-uuid": "bd7a51b3-d00c-575f-a16e-6f51e5a67743", + "type": "affected-by" + } + ], + "uuid": "c112eafc-0f31-5bd7-9083-20ef706c8d57", + "value": "Verification of project before posting fund requests" + }, + { + "description": "Take legal action against for-profit \"factories\" creating misinformation.", + "meta": { + "external_id": "C00060", + "kill_chain": [ + "tactics:Plan Objectives", + "responsetypes:Disrupt", + "metatechniques:Targeting" + ], + "refs": [ + "https://github.com/DISARMFoundation/DISARMframeworks/blob/main/generated_pages/counters/C00060.md" + ] + }, + "related": [ + { + "dest-uuid": "2d40a01e-41a9-513a-bf0b-694dc0a87f8e", + "type": "blocks" + }, + { + "dest-uuid": "53f1e7bd-7aa8-5e02-a0a8-3fd34ee638e1", + "type": "affected-by" + } + ], + "uuid": "5682293b-d9d8-5db0-90df-4bb4cedc6882", + "value": "Legal action against for-profit engagement factories" + }, + { + "description": "Open-source libraries could be created that aid in some way for each technique. Even for Strategic Planning, some open-source frameworks such as DISARM can be created to counter the adversarial efforts.", + "meta": { + "external_id": "C00062", + "kill_chain": [ + "tactics:Establish Social Assets", + "responsetypes:Degrade", + "metatechniques:Countermessaging" + ], + "refs": [ + "https://github.com/DISARMFoundation/DISARMframeworks/blob/main/generated_pages/counters/C00062.md" + ] + }, + "related": [ + { + "dest-uuid": "b8aee2a9-a979-5cd7-9c69-af4ad4adffea", + "type": "blocks" + }, + { + "dest-uuid": "bd7a51b3-d00c-575f-a16e-6f51e5a67743", + "type": "affected-by" + } + ], + "uuid": "c34fec02-a908-5b61-8e98-5ae1b5453fee", + "value": "Free open library sources worldwide" + }, + { + "description": "Includes “ban political micro targeting” and “ban political ads”", + "meta": { + "external_id": "C00065", + "kill_chain": [ + "tactics:Microtarget", + "responsetypes:Disrupt", + "metatechniques:Removal" + ], + "refs": [ + "https://github.com/DISARMFoundation/DISARMframeworks/blob/main/generated_pages/counters/C00065.md" + ] + }, + "related": [ + { + "dest-uuid": "87208979-6982-53d5-ad0f-49cef659555c", + "type": "blocks" + }, + { + "dest-uuid": "53f1e7bd-7aa8-5e02-a0a8-3fd34ee638e1", + "type": "affected-by" + } + ], + "uuid": "14dad601-4ddd-5cfd-a48d-9b53212769ce", + "value": "Reduce political targeting" + }, + { + "description": "Flood a disinformation-related hashtag with other content.", + "meta": { + "external_id": "C00066", + "kill_chain": [ + "tactics:Microtarget", + "responsetypes:Disrupt", + "metatechniques:Dilution" + ], + "refs": [ + "https://github.com/DISARMFoundation/DISARMframeworks/blob/main/generated_pages/counters/C00066.md" + ] + }, + "related": [ + { + "dest-uuid": "6d3c1c71-746e-5e9d-9960-4845d712c899", + "type": "blocks" + }, + { + "dest-uuid": "bd7a51b3-d00c-575f-a16e-6f51e5a67743", + "type": "affected-by" + } + ], + "uuid": "677c9e22-42b6-5b78-985c-e72936ae1b3f", + "value": "Co-opt a hashtag and drown it out (hijack it back)" + }, + { + "description": "Reduce the credibility of groups behind misinformation-linked funding campaigns.", + "meta": { + "external_id": "C00067", + "kill_chain": [ + "tactics:Establish Social Assets", + "responsetypes:Disrupt", + "metatechniques:Targeting" + ], + "refs": [ + "https://github.com/DISARMFoundation/DISARMframeworks/blob/main/generated_pages/counters/C00067.md" + ] + }, + "related": [ + { + "dest-uuid": "7f21fe4b-d314-5511-a9b1-0b9fcfee8b5e", + "type": "blocks" + }, + { + "dest-uuid": "bd7a51b3-d00c-575f-a16e-6f51e5a67743", + "type": "affected-by" + } + ], + "uuid": "f3cd91e7-b21a-529f-82bd-dd3aa3c3106b", + "value": "Denigrate the recipient/ project (of online funding)" + }, + { + "description": "Resources = accounts, channels etc. Block access to platform. DDOS an attacker. TA02*: DDOS at the critical time, to deny an adversary's time-bound objective. T0008: A quick response to a proto-viral story will affect it's ability to spread and raise questions about their legitimacy. Hashtag: Against the platform, by drowning the hashtag. T0046 - Search Engine Optimisation: Sub-optimal website performance affect its search engine rank, which I interpret as \"blocking access to a platform\".", + "meta": { + "external_id": "C00070", + "kill_chain": [ + "tactics:Plan Objectives", + "responsetypes:Deny", + "metatechniques:Removal" + ], + "refs": [ + "https://github.com/DISARMFoundation/DISARMframeworks/blob/main/generated_pages/counters/C00070.md" + ] + }, + "related": [ + { + "dest-uuid": "56b88516-ae4c-5176-b6ed-6e9be91ce898", + "type": "blocks" + }, + { + "dest-uuid": "bd7a51b3-d00c-575f-a16e-6f51e5a67743", + "type": "affected-by" + } + ], + "uuid": "6da6cc36-cd42-5008-b3ea-bddf271f49df", + "value": "Block access to disinformation resources" + }, + { + "description": "Block websites, accounts, groups etc connected to misinformation and other information pollution.", + "meta": { + "external_id": "C00071", + "kill_chain": [ + "tactics:Develop Content", + "responsetypes:Deny", + "metatechniques:Removal" + ], + "refs": [ + "https://github.com/DISARMFoundation/DISARMframeworks/blob/main/generated_pages/counters/C00071.md" + ] + }, + "related": [ + { + "dest-uuid": "cb7d7a14-6e5c-503c-84b8-4a49e69b2627", + "type": "blocks" + }, + { + "dest-uuid": "bd7a51b3-d00c-575f-a16e-6f51e5a67743", + "type": "affected-by" + } + ], + "uuid": "731ffe0e-0225-583e-9ef0-f39851b725c7", + "value": "Block source of pollution" + }, + { + "description": "Check special-interest groups (e.g. medical, knitting) for unrelated and misinformation-linked content, and remove it.", + "meta": { + "external_id": "C00072", + "kill_chain": [ + "tactics:Develop Content", + "responsetypes:Deny", + "metatechniques:Removal" + ], + "refs": [ + "https://github.com/DISARMFoundation/DISARMframeworks/blob/main/generated_pages/counters/C00072.md" + ] + }, + "related": [ + { + "dest-uuid": "cb7d7a14-6e5c-503c-84b8-4a49e69b2627", + "type": "blocks" + }, + { + "dest-uuid": "bd7a51b3-d00c-575f-a16e-6f51e5a67743", + "type": "affected-by" + } + ], + "uuid": "fe5266c1-0af6-59f3-8a0a-f4e5b3f67513", + "value": "Remove non-relevant content from special interest groups - not recommended" + }, + { + "description": "Use training to build the resilience of at-risk populations. Educate on how to handle info pollution. Push out targeted education on why it's pollution. Build cultural resistance to false content, e.g. cultural resistance to bullshit. Influence literacy training, to inoculate against “cult” recruiting. Media literacy training: leverage librarians / library for media literacy training. Inoculate at language. Strategic planning included as inoculating population has strategic value. Concepts of media literacy to a mass audience that authorities launch a public information campaign that teaches the programme will take time to develop and establish impact, recommends curriculum-based training. Covers detect, deny, and degrade.", + "meta": { + "external_id": "C00073", + "kill_chain": [ + "tactics:Plan Strategy", + "responsetypes:Deny", + "metatechniques:Resilience" + ], + "refs": [ + "https://github.com/DISARMFoundation/DISARMframeworks/blob/main/generated_pages/counters/C00073.md" + ] + }, + "related": [ + { + "dest-uuid": "9570ebf8-f69b-5064-a627-a19cb429d0f5", + "type": "blocks" + }, + { + "dest-uuid": "09f16551-695e-5d72-b58f-6cd256f7cb68", + "type": "affected-by" + }, + { + "dest-uuid": "a73d7508-4e4b-57d8-9dbf-15ac73b65a15", + "type": "affected-by" + }, + { + "dest-uuid": "b2457b24-f997-573e-9c25-90eab4559f8e", + "type": "affected-by" + }, + { + "dest-uuid": "253aa4f0-d720-50b7-a462-70c85f5f5b9f", + "type": "affected-by" + }, + { + "dest-uuid": "c198d0db-7fea-523d-acc5-24b1e7d3f47c", + "type": "affected-by" + }, + { + "dest-uuid": "91c80826-4428-5a58-8e54-337dfee99584", + "type": "affected-by" + }, + { + "dest-uuid": "bdcbbd5d-e282-5c55-a39e-212b10f75200", + "type": "affected-by" + }, + { + "dest-uuid": "75f1924e-e711-5d07-8336-865b277c30d0", + "type": "affected-by" + } + ], + "uuid": "c52274ce-09fe-5b50-b2f2-741be794da6e", + "value": "Inoculate populations through media literacy training" + }, + { + "description": "C00000", + "meta": { + "external_id": "C00074", + "kill_chain": [ + "tactics:Develop Content", + "responsetypes:Deny", + "metatechniques:Cleaning" + ], + "refs": [ + "https://github.com/DISARMFoundation/DISARMframeworks/blob/main/generated_pages/counters/C00074.md" + ] + }, + "related": [ + { + "dest-uuid": "cb7d7a14-6e5c-503c-84b8-4a49e69b2627", + "type": "blocks" + }, + { + "dest-uuid": "f4dc44c5-e021-524b-9909-678f11a9f10d", + "type": "affected-by" + }, + { + "dest-uuid": "667967b8-b3f1-55ad-8f8a-8c43c1290e6e", + "type": "affected-by" + } + ], + "uuid": "dae93cbd-eb65-5fb0-9d4e-4571ff54b6ff", + "value": "Identify and delete or rate limit identical content" + }, + { + "description": "normalise the language around disinformation and misinformation; give people the words for artefact and effect types.", + "meta": { + "external_id": "C00075", + "kill_chain": [ + "tactics:Develop Content", + "responsetypes:Deny", + "metatechniques:Countermessaging" + ], + "refs": [ + "https://github.com/DISARMFoundation/DISARMframeworks/blob/main/generated_pages/counters/C00075.md" + ] + }, + "related": [ + { + "dest-uuid": "bd7a51b3-d00c-575f-a16e-6f51e5a67743", + "type": "blocks" + }, + { + "dest-uuid": "bd7a51b3-d00c-575f-a16e-6f51e5a67743", + "type": "affected-by" + } + ], + "uuid": "da3fffda-ef2a-5408-8bde-4726ac2da214", + "value": "normalise language" + }, + { + "description": "Make political discussion channels text-only.", + "meta": { + "external_id": "C00076", + "kill_chain": [ + "tactics:Develop Content", + "responsetypes:Deny", + "metatechniques:Removal" + ], + "refs": [ + "https://github.com/DISARMFoundation/DISARMframeworks/blob/main/generated_pages/counters/C00076.md" + ] + }, + "related": [ + { + "dest-uuid": "9570ebf8-f69b-5064-a627-a19cb429d0f5", + "type": "blocks" + }, + { + "dest-uuid": "bd7a51b3-d00c-575f-a16e-6f51e5a67743", + "type": "affected-by" + } + ], + "uuid": "d8b22aa2-cbb6-5a97-b9ad-32eaf3514768", + "value": "Prohibit images in political discourse channels" + }, + { + "description": "Develop networks of communities and influencers around counter-misinformation. Match them to misinformation creators", + "meta": { + "external_id": "C00077", + "kill_chain": [ + "tactics:Establish Social Assets", + "responsetypes:Disrupt", + "metatechniques:Targeting" + ], + "refs": [ + "https://github.com/DISARMFoundation/DISARMframeworks/blob/main/generated_pages/counters/C00077.md" + ] + }, + "related": [ + { + "dest-uuid": "bd7a51b3-d00c-575f-a16e-6f51e5a67743", + "type": "blocks" + }, + { + "dest-uuid": "bd7a51b3-d00c-575f-a16e-6f51e5a67743", + "type": "affected-by" + } + ], + "uuid": "bddf930a-5d96-5b58-88d1-3afd0b86c316", + "value": "Active defence: run TA15 \"develop people” - not recommended" + }, + { + "description": "Includes “change image search algorithms for hate groups and extremists” and “Change search algorithms for hate and extremist queries to show content sympathetic to opposite side”", + "meta": { + "external_id": "C00078", + "kill_chain": [ + "tactics:Develop Content", + "responsetypes:Disrupt", + "metatechniques:Diversion" + ], + "refs": [ + "https://github.com/DISARMFoundation/DISARMframeworks/blob/main/generated_pages/counters/C00078.md" + ] + }, + "related": [ + { + "dest-uuid": "2d40a01e-41a9-513a-bf0b-694dc0a87f8e", + "type": "blocks" + }, + { + "dest-uuid": "bd7a51b3-d00c-575f-a16e-6f51e5a67743", + "type": "affected-by" + } + ], + "uuid": "ccea6ead-1274-54b7-82fc-8b0774211658", + "value": "Change Search Algorithms for Disinformation Content" + }, + { + "description": "Create counternarratives, or narratives that compete in the same spaces as misinformation narratives. Could also be degrade", + "meta": { + "external_id": "C00080", + "kill_chain": [ + "tactics:Develop Content", + "responsetypes:Disrupt", + "metatechniques:Diversion" + ], + "refs": [ + "https://github.com/DISARMFoundation/DISARMframeworks/blob/main/generated_pages/counters/C00080.md" + ] + }, + "related": [ + { + "dest-uuid": "689e65f1-d834-581a-adf2-4e8a96d32464", + "type": "blocks" + }, + { + "dest-uuid": "bd7a51b3-d00c-575f-a16e-6f51e5a67743", + "type": "affected-by" + } + ], + "uuid": "a706cf86-2170-58ea-a6d4-79cc47f23e54", + "value": "Create competing narrative" + }, + { + "description": "Discredit by pointing out the \"noise\" and informing public that \"flooding\" is a technique of disinformation campaigns; point out intended objective of \"noise\"", + "meta": { + "external_id": "C00081", + "kill_chain": [ + "tactics:Develop Content", + "responsetypes:Disrupt", + "metatechniques:Daylight" + ], + "refs": [ + "https://github.com/DISARMFoundation/DISARMframeworks/blob/main/generated_pages/counters/C00081.md" + ] + }, + "related": [ + { + "dest-uuid": "689e65f1-d834-581a-adf2-4e8a96d32464", + "type": "blocks" + }, + { + "dest-uuid": "bd7a51b3-d00c-575f-a16e-6f51e5a67743", + "type": "affected-by" + } + ], + "uuid": "c14e8f7d-3c10-5cb5-a654-9d23315d631c", + "value": "Highlight flooding and noise, and explain motivations" + }, + { + "description": "Also inoculation.", + "meta": { + "external_id": "C00082", + "kill_chain": [ + "tactics:Develop Content", + "responsetypes:Disrupt", + "metatechniques:Countermessaging" + ], + "refs": [ + "https://github.com/DISARMFoundation/DISARMframeworks/blob/main/generated_pages/counters/C00082.md" + ] + }, + "related": [ + { + "dest-uuid": "782afafa-e997-571a-9b25-d04bb322480c", + "type": "blocks" + }, + { + "dest-uuid": "bd7a51b3-d00c-575f-a16e-6f51e5a67743", + "type": "affected-by" + } + ], + "uuid": "5f6e9165-2d53-52af-883a-13fff2749308", + "value": "Ground truthing as automated response to pollution" + }, + { + "description": "Includes “poison pill recasting of message” and “steal their truths”. Many techniques involve promotion which could be manipulated. For example, online fundings or rallies could be advertised, through compromised or fake channels, as being associated with \"far-up/down/left/right\" actors. \"Long Game\" narratives could be subjected in a similar way with negative connotations. Can also replay technique T0003.", + "meta": { + "external_id": "C00084", + "kill_chain": [ + "tactics:Develop Content", + "responsetypes:Disrupt", + "metatechniques:Diversion" + ], + "refs": [ + "https://github.com/DISARMFoundation/DISARMframeworks/blob/main/generated_pages/counters/C00084.md" + ] + }, + "related": [ + { + "dest-uuid": "782afafa-e997-571a-9b25-d04bb322480c", + "type": "blocks" + }, + { + "dest-uuid": "bd7a51b3-d00c-575f-a16e-6f51e5a67743", + "type": "affected-by" + } + ], + "uuid": "4fc5ef29-5af2-5630-b57a-4df9844932c1", + "value": "Modify disinformation narratives, and rebroadcast them" + }, + { + "description": "Rate-limit disinformation content. Reduces its effects, whilst not running afoul of censorship concerns. Online archives of content (archives of websites, social media profiles, media, copies of published advertisements; or archives of comments attributed to bad actors, as well as anonymized metadata about users who interacted with them and analysis of the effect) is useful for intelligence analysis and public transparency, but will need similar muting or tagging/ shaming as associated with bad actors.", + "meta": { + "external_id": "C00085", + "kill_chain": [ + "tactics:Develop Content", + "responsetypes:Disrupt", + "metatechniques:Daylight" + ], + "refs": [ + "https://github.com/DISARMFoundation/DISARMframeworks/blob/main/generated_pages/counters/C00085.md" + ] + }, + "related": [ + { + "dest-uuid": "56b88516-ae4c-5176-b6ed-6e9be91ce898", + "type": "blocks" + }, + { + "dest-uuid": "bd7a51b3-d00c-575f-a16e-6f51e5a67743", + "type": "affected-by" + } + ], + "uuid": "96e5e0dc-7cfd-5c3c-9bcd-40b14f2c7380", + "value": "Mute content" + }, + { + "description": "Example: Interject addictive links or contents into discussions of disinformation materials and measure a \"conversion rate\" of users who engage with your content and away from the social media channel's \"information bubble\" around the disinformation item. Use bots to amplify and upvote the addictive content.", + "meta": { + "external_id": "C00086", + "kill_chain": [ + "tactics:Develop Content", + "responsetypes:Degrade", + "metatechniques:Diversion" + ], + "refs": [ + "https://github.com/DISARMFoundation/DISARMframeworks/blob/main/generated_pages/counters/C00086.md" + ] + }, + "related": [ + { + "dest-uuid": "0fd25b71-ea11-51a3-bb18-545d5e818583", + "type": "blocks" + }, + { + "dest-uuid": "bd7a51b3-d00c-575f-a16e-6f51e5a67743", + "type": "affected-by" + } + ], + "uuid": "2ab07267-614d-538b-8fef-bc6ed250a483", + "value": "Distract from noise with addictive content" + }, + { + "description": "", + "meta": { + "external_id": "C00087", + "kill_chain": [ + "tactics:Develop Content", + "responsetypes:Degrade", + "metatechniques:Dilution" + ], + "refs": [ + "https://github.com/DISARMFoundation/DISARMframeworks/blob/main/generated_pages/counters/C00087.md" + ] + }, + "related": [ + { + "dest-uuid": "53e8c51b-c178-5429-8cee-022c6741cc91", + "type": "blocks" + }, + { + "dest-uuid": "bd7a51b3-d00c-575f-a16e-6f51e5a67743", + "type": "affected-by" + } + ], + "uuid": "47ad777e-029c-5afa-9c37-50c3d86f3d39", + "value": "Make more noise than the disinformation" + }, + { + "description": "Create honeypots for misinformation creators to engage with, and reduce the resources they have available for misinformation campaigns.", + "meta": { + "external_id": "C00090", + "kill_chain": [ + "tactics:Select Channels and Affordances", + "responsetypes:Deceive", + "metatechniques:Diversion" + ], + "refs": [ + "https://github.com/DISARMFoundation/DISARMframeworks/blob/main/generated_pages/counters/C00090.md" + ] + }, + "related": [ + { + "dest-uuid": "635f5592-0e2a-5f06-b164-c5af2ec9ef5e", + "type": "blocks" + }, + { + "dest-uuid": "bd7a51b3-d00c-575f-a16e-6f51e5a67743", + "type": "affected-by" + } + ], + "uuid": "fd9e1e82-0c60-5bf6-a9a2-4f29ca6d39ba", + "value": "Fake engagement system" + }, + { + "description": "Set honeypots, e.g. communities, in networks likely to be used for disinformation.", + "meta": { + "external_id": "C00091", + "kill_chain": [ + "tactics:Develop Content", + "responsetypes:Deceive", + "metatechniques:Diversion" + ], + "refs": [ + "https://github.com/DISARMFoundation/DISARMframeworks/blob/main/generated_pages/counters/C00091.md" + ] + }, + "related": [ + { + "dest-uuid": "cd0bc81f-afc1-506d-867d-6bf4c6ebd96b", + "type": "blocks" + }, + { + "dest-uuid": "bd7a51b3-d00c-575f-a16e-6f51e5a67743", + "type": "affected-by" + } + ], + "uuid": "d3dabb18-e543-5295-be8f-f61cac2a5d99", + "value": "Honeypot social community" + }, + { + "description": "Includes \"Establish a truth teller reputation score for influencers” and “Reputation scores for social media users”. Influencers are individuals or accounts with many followers.", + "meta": { + "external_id": "C00092", + "kill_chain": [ + "tactics:Plan Objectives", + "responsetypes:Deter", + "metatechniques:Scoring" + ], + "refs": [ + "https://github.com/DISARMFoundation/DISARMframeworks/blob/main/generated_pages/counters/C00092.md" + ] + }, + "related": [ + { + "dest-uuid": "2d40a01e-41a9-513a-bf0b-694dc0a87f8e", + "type": "blocks" + }, + { + "dest-uuid": "03aaf19c-42b9-5b8e-9d47-a6bb291f10fa", + "type": "affected-by" + } + ], + "uuid": "9167d3c2-1f91-58f1-9dc2-fbe948f6b31c", + "value": "Establish a truth teller reputation score for influencers" + }, + { + "description": "Establish tailored code of conduct for individuals with many followers. Can be platform code of conduct; can also be community code.", + "meta": { + "external_id": "C00093", + "kill_chain": [ + "tactics:Establish Social Assets", + "responsetypes:Deter", + "metatechniques:Resilience" + ], + "refs": [ + "https://github.com/DISARMFoundation/DISARMframeworks/blob/main/generated_pages/counters/C00093.md" + ] + }, + "related": [ + { + "dest-uuid": "2d40a01e-41a9-513a-bf0b-694dc0a87f8e", + "type": "blocks" + }, + { + "dest-uuid": "bd7a51b3-d00c-575f-a16e-6f51e5a67743", + "type": "affected-by" + } + ], + "uuid": "4a21e1e9-4601-5fd0-b713-747bfe498e76", + "value": "Influencer code of conduct" + }, + { + "description": "Accountability move: make sure research is published with its funding sources.", + "meta": { + "external_id": "C00094", + "kill_chain": [ + "tactics:Develop Content", + "responsetypes:Degrade", + "metatechniques:Daylight" + ], + "refs": [ + "https://github.com/DISARMFoundation/DISARMframeworks/blob/main/generated_pages/counters/C00094.md" + ] + }, + "related": [ + { + "dest-uuid": "4b869f95-535d-5c02-9ecf-cbdc1f5e0c32", + "type": "blocks" + }, + { + "dest-uuid": "bd7a51b3-d00c-575f-a16e-6f51e5a67743", + "type": "affected-by" + } + ], + "uuid": "25a7c801-c8e1-5977-8ac4-8795c30df5bc", + "value": "Force full disclosure on corporate sponsor of research" + }, + { + "description": "Increase credibility, visibility, and reach of positive influencers in the information space.", + "meta": { + "external_id": "C00096", + "kill_chain": [ + "tactics:Plan Strategy", + "responsetypes:Deter", + "metatechniques:Scoring" + ], + "refs": [ + "https://github.com/DISARMFoundation/DISARMframeworks/blob/main/generated_pages/counters/C00096.md" + ] + }, + "related": [ + { + "dest-uuid": "f1d52ce1-f431-5732-a071-215cb3306f3e", + "type": "blocks" + }, + { + "dest-uuid": "bd7a51b3-d00c-575f-a16e-6f51e5a67743", + "type": "affected-by" + } + ], + "uuid": "90ec53d1-ed62-516d-b530-49cb3e9e851c", + "value": "Strengthen institutions that are always truth tellers" + }, + { + "description": "Reduce poll flooding by online taking comments or poll entries from verified accounts.", + "meta": { + "external_id": "C00097", + "kill_chain": [ + "tactics:Select Channels and Affordances", + "responsetypes:Deny", + "metatechniques:Friction" + ], + "refs": [ + "https://github.com/DISARMFoundation/DISARMframeworks/blob/main/generated_pages/counters/C00097.md" + ] + }, + "related": [ + { + "dest-uuid": "1a8c4e8c-3543-5ab1-b4d0-939de9e7875f", + "type": "blocks" + }, + { + "dest-uuid": "667967b8-b3f1-55ad-8f8a-8c43c1290e6e", + "type": "affected-by" + } + ], + "uuid": "01b3516b-b8b1-5a56-ae24-5300cceb70f8", + "value": "Require use of verified identities to contribute to poll or comment" + }, + { + "description": "remove blue checkmarks etc from known misinformation accounts.", + "meta": { + "external_id": "C00098", + "kill_chain": [ + "tactics:Select Channels and Affordances", + "responsetypes:Deny", + "metatechniques:Friction" + ], + "refs": [ + "https://github.com/DISARMFoundation/DISARMframeworks/blob/main/generated_pages/counters/C00098.md" + ] + }, + "related": [ + { + "dest-uuid": "0a235a0a-367e-5d23-ab28-910ca6048277", + "type": "blocks" + }, + { + "dest-uuid": "667967b8-b3f1-55ad-8f8a-8c43c1290e6e", + "type": "affected-by" + } + ], + "uuid": "eaef2d36-c5a8-59b9-9075-c6cdaa060e5d", + "value": "Revocation of allowlisted or \"verified\" status" + }, + { + "description": "Improve content veerification methods available to groups, individuals etc.", + "meta": { + "external_id": "C00099", + "kill_chain": [ + "tactics:Select Channels and Affordances", + "responsetypes:Deny", + "metatechniques:Friction" + ], + "refs": [ + "https://github.com/DISARMFoundation/DISARMframeworks/blob/main/generated_pages/counters/C00099.md" + ] + }, + "related": [ + { + "dest-uuid": "79dbc845-7737-5cf6-9a14-ee5a0d00503e", + "type": "blocks" + }, + { + "dest-uuid": "667967b8-b3f1-55ad-8f8a-8c43c1290e6e", + "type": "affected-by" + } + ], + "uuid": "33d7f540-0adb-5ab5-ae09-1c7a20e125b1", + "value": "Strengthen verification methods" + }, + { + "description": "Post large volumes of unrelated content on known misinformation hashtags", + "meta": { + "external_id": "C00100", + "kill_chain": [ + "tactics:Conduct Pump Priming", + "responsetypes:Disrupt", + "metatechniques:Diversion" + ], + "refs": [ + "https://github.com/DISARMFoundation/DISARMframeworks/blob/main/generated_pages/counters/C00100.md" + ] + }, + "related": [ + { + "dest-uuid": "9c50e797-400b-50f9-8052-e6f0e324c73e", + "type": "blocks" + }, + { + "dest-uuid": "bd7a51b3-d00c-575f-a16e-6f51e5a67743", + "type": "affected-by" + } + ], + "uuid": "cb70bca8-f999-59cc-ac98-3868a695334a", + "value": "Hashtag jacking" + }, + { + "description": "Create participant friction. Includes Make repeat voting hard, and throttle number of forwards.", + "meta": { + "external_id": "C00101", + "kill_chain": [ + "tactics:Select Channels and Affordances", + "responsetypes:Degrade", + "metatechniques:Friction" + ], + "refs": [ + "https://github.com/DISARMFoundation/DISARMframeworks/blob/main/generated_pages/counters/C00101.md" + ] + }, + "related": [ + { + "dest-uuid": "1a8c4e8c-3543-5ab1-b4d0-939de9e7875f", + "type": "blocks" + }, + { + "dest-uuid": "667967b8-b3f1-55ad-8f8a-8c43c1290e6e", + "type": "affected-by" + } + ], + "uuid": "a64a6568-d047-55b9-a3ab-f77fb3c9ada3", + "value": "Create friction by rate-limiting engagement" + }, + { + "description": "This is reactive, not active measure (honeypots are active). It's a platform controlled measure.", + "meta": { + "external_id": "C00103", + "kill_chain": [ + "tactics:Select Channels and Affordances", + "responsetypes:Deceive", + "metatechniques:Diversion" + ], + "refs": [ + "https://github.com/DISARMFoundation/DISARMframeworks/blob/main/generated_pages/counters/C00103.md" + ] + }, + "related": [ + { + "dest-uuid": "1a8c4e8c-3543-5ab1-b4d0-939de9e7875f", + "type": "blocks" + }, + { + "dest-uuid": "2057de14-930a-5199-8e8e-9969173d36bb", + "type": "affected-by" + } + ], + "uuid": "e21e17e9-3834-59de-bc31-9e43b73c8973", + "value": "Create a bot that engages / distract trolls" + }, + { + "description": "Shift influence and algorithms by posting more adverts into spaces than misinformation creators.", + "meta": { + "external_id": "C00105", + "kill_chain": [ + "tactics:Select Channels and Affordances", + "responsetypes:Disrupt", + "metatechniques:Dilution" + ], + "refs": [ + "https://github.com/DISARMFoundation/DISARMframeworks/blob/main/generated_pages/counters/C00105.md" + ] + }, + "related": [ + { + "dest-uuid": "9570ebf8-f69b-5064-a627-a19cb429d0f5", + "type": "blocks" + }, + { + "dest-uuid": "6edba8b4-fe7a-5be0-84d0-6dee21d2a48e", + "type": "affected-by" + } + ], + "uuid": "4880efa6-1123-5703-9c44-9f0600670dd9", + "value": "Buy more advertising than misinformation creators" + }, + { + "description": "Create emotive centrist content that gets more clicks", + "meta": { + "external_id": "C00106", + "kill_chain": [ + "tactics:Develop Content", + "responsetypes:Disrupt", + "metatechniques:Diversion" + ], + "refs": [ + "https://github.com/DISARMFoundation/DISARMframeworks/blob/main/generated_pages/counters/C00106.md" + ] + }, + "related": [ + { + "dest-uuid": "9570ebf8-f69b-5064-a627-a19cb429d0f5", + "type": "blocks" + }, + { + "dest-uuid": "bd7a51b3-d00c-575f-a16e-6f51e5a67743", + "type": "affected-by" + } + ], + "uuid": "d6182931-a76a-59e6-901e-f63b9f6d2301", + "value": "Click-bait centrist content" + }, + { + "description": "includes social media content take-downs, e.g. facebook or Twitter content take-downs", + "meta": { + "external_id": "C00107", + "kill_chain": [ + "tactics:Develop Content", + "responsetypes:Deny", + "metatechniques:Scoring" + ], + "refs": [ + "https://github.com/DISARMFoundation/DISARMframeworks/blob/main/generated_pages/counters/C00107.md" + ] + }, + "related": [ + { + "dest-uuid": "29768133-b941-5974-ab10-c15bbb86e387", + "type": "blocks" + }, + { + "dest-uuid": "667967b8-b3f1-55ad-8f8a-8c43c1290e6e", + "type": "affected-by" + } + ], + "uuid": "e9cf452f-3ebc-5de8-9f21-dde3133c92c0", + "value": "Content moderation" + }, + { + "description": "Reduce emotional responses to misinformation through calming messages, etc.", + "meta": { + "external_id": "C00109", + "kill_chain": [ + "tactics:Deliver Content", + "responsetypes:Disrupt", + "metatechniques:Resilience" + ], + "refs": [ + "https://github.com/DISARMFoundation/DISARMframeworks/blob/main/generated_pages/counters/C00109.md" + ] + }, + "related": [ + { + "dest-uuid": "bd7a51b3-d00c-575f-a16e-6f51e5a67743", + "type": "blocks" + }, + { + "dest-uuid": "bd7a51b3-d00c-575f-a16e-6f51e5a67743", + "type": "affected-by" + } + ], + "uuid": "5e6e3272-9320-5c12-a618-f82282b62cb9", + "value": "Dampen Emotional Reaction" + }, + { + "description": "", + "meta": { + "external_id": "C00111", + "kill_chain": [ + "tactics:Plan Strategy", + "responsetypes:Degrade", + "metatechniques:Resilience" + ], + "refs": [ + "https://github.com/DISARMFoundation/DISARMframeworks/blob/main/generated_pages/counters/C00111.md" + ] + }, + "related": [ + { + "dest-uuid": "39baec3d-f2ce-5fee-ba7d-3db7d6469946", + "type": "blocks" + }, + { + "dest-uuid": "6330d1dc-258f-5631-95e2-66390937cec3", + "type": "affected-by" + }, + { + "dest-uuid": "bdcbbd5d-e282-5c55-a39e-212b10f75200", + "type": "affected-by" + } + ], + "uuid": "686ccd43-c358-5d5d-bd42-3e2279151670", + "value": "Reduce polarisation by connecting and presenting sympathetic renditions of opposite views" + }, + { + "description": "Challenge misinformation creators to prove they're not an information operation.", + "meta": { + "external_id": "C00112", + "kill_chain": [ + "tactics:Conduct Pump Priming", + "responsetypes:Deny", + "metatechniques:Friction" + ], + "refs": [ + "https://github.com/DISARMFoundation/DISARMframeworks/blob/main/generated_pages/counters/C00112.md" + ] + }, + "related": [ + { + "dest-uuid": "70218fb2-3d85-5714-b990-2d18e345e184", + "type": "blocks" + }, + { + "dest-uuid": "bd7a51b3-d00c-575f-a16e-6f51e5a67743", + "type": "affected-by" + } + ], + "uuid": "b942a92e-13d5-5726-92bd-4fb5531f381b", + "value": "\"Prove they are not an op!\"" + }, + { + "description": "Debunk fake experts, their credentials, and potentially also their audience quality", + "meta": { + "external_id": "C00113", + "kill_chain": [ + "tactics:Conduct Pump Priming", + "responsetypes:Deny", + "metatechniques:Daylight" + ], + "refs": [ + "https://github.com/DISARMFoundation/DISARMframeworks/blob/main/generated_pages/counters/C00113.md" + ] + }, + "related": [ + { + "dest-uuid": "edc041f8-06ac-513a-a9f9-1353e38f3bcf", + "type": "blocks" + }, + { + "dest-uuid": "bd7a51b3-d00c-575f-a16e-6f51e5a67743", + "type": "affected-by" + } + ], + "uuid": "a44e7e6c-f6ca-5ea4-9fe8-6dc798b2d729", + "value": "Debunk and defuse a fake expert / credentials." + }, + { + "description": "Stop passing on misinformation", + "meta": { + "external_id": "C00114", + "kill_chain": [ + "tactics:Conduct Pump Priming", + "responsetypes:Deny", + "metatechniques:Friction" + ], + "refs": [ + "https://github.com/DISARMFoundation/DISARMframeworks/blob/main/generated_pages/counters/C00114.md" + ] + }, + "related": [ + { + "dest-uuid": "53e8c51b-c178-5429-8cee-022c6741cc91", + "type": "blocks" + }, + { + "dest-uuid": "f6c98378-65be-5f14-af3e-326909d70d77", + "type": "affected-by" + } + ], + "uuid": "1744386c-0d46-54a8-a5b8-cba1bd7dc369", + "value": "Don't engage with payloads" + }, + { + "description": "Debunk misinformation creators and posters.", + "meta": { + "external_id": "C00115", + "kill_chain": [ + "tactics:Conduct Pump Priming", + "responsetypes:Deny", + "metatechniques:Daylight" + ], + "refs": [ + "https://github.com/DISARMFoundation/DISARMframeworks/blob/main/generated_pages/counters/C00115.md" + ] + }, + "related": [ + { + "dest-uuid": "d362a138-56e6-5b94-9653-e7c4dfacbfdb", + "type": "blocks" + }, + { + "dest-uuid": "bd7a51b3-d00c-575f-a16e-6f51e5a67743", + "type": "affected-by" + } + ], + "uuid": "51187e2c-cb58-59ac-900b-54b073dc4c1f", + "value": "Expose actor and intentions" + }, + { + "description": "Build and post information about groups etc's involvement in misinformation incidents.", + "meta": { + "external_id": "C00116", + "kill_chain": [ + "tactics:Conduct Pump Priming", + "responsetypes:Deny", + "metatechniques:Daylight" + ], + "refs": [ + "https://github.com/DISARMFoundation/DISARMframeworks/blob/main/generated_pages/counters/C00116.md" + ] + }, + "related": [ + { + "dest-uuid": "d362a138-56e6-5b94-9653-e7c4dfacbfdb", + "type": "blocks" + }, + { + "dest-uuid": "bd7a51b3-d00c-575f-a16e-6f51e5a67743", + "type": "affected-by" + } + ], + "uuid": "03816f11-e296-594b-8e7a-441629d9252c", + "value": "Provide proof of involvement" + }, + { + "description": "Label promote counter to disinformation", + "meta": { + "external_id": "C00117", + "kill_chain": [ + "tactics:Conduct Pump Priming", + "responsetypes:Degrade", + "metatechniques:Countermessaging" + ], + "refs": [ + "https://github.com/DISARMFoundation/DISARMframeworks/blob/main/generated_pages/counters/C00117.md" + ] + }, + "related": [ + { + "dest-uuid": "68c3a917-fed7-539e-9cf6-091153658ef2", + "type": "blocks" + }, + { + "dest-uuid": "bd7a51b3-d00c-575f-a16e-6f51e5a67743", + "type": "affected-by" + } + ], + "uuid": "5b9a74d0-bfa6-5bb9-9297-3938c067f783", + "value": "Downgrade / de-amplify so message is seen by fewer people" + }, + { + "description": "Add countermessage text to iamges used in misinformation incidents.", + "meta": { + "external_id": "C00118", + "kill_chain": [ + "tactics:Conduct Pump Priming", + "responsetypes:Degrade", + "metatechniques:Countermessaging" + ], + "refs": [ + "https://github.com/DISARMFoundation/DISARMframeworks/blob/main/generated_pages/counters/C00118.md" + ] + }, + "related": [ + { + "dest-uuid": "0fd25b71-ea11-51a3-bb18-545d5e818583", + "type": "blocks" + }, + { + "dest-uuid": "bd7a51b3-d00c-575f-a16e-6f51e5a67743", + "type": "affected-by" + } + ], + "uuid": "3ce6759d-b144-5277-9798-2df09ce9a6c9", + "value": "Repurpose images with new text" + }, + { + "description": "debunk misinformation content. Provide link to facts.", + "meta": { + "external_id": "C00119", + "kill_chain": [ + "tactics:Conduct Pump Priming", + "responsetypes:Deter", + "metatechniques:Countermessaging" + ], + "refs": [ + "https://github.com/DISARMFoundation/DISARMframeworks/blob/main/generated_pages/counters/C00119.md" + ] + }, + "related": [ + { + "dest-uuid": "f1d52ce1-f431-5732-a071-215cb3306f3e", + "type": "blocks" + }, + { + "dest-uuid": "bd7a51b3-d00c-575f-a16e-6f51e5a67743", + "type": "affected-by" + } + ], + "uuid": "cbba0c79-9287-5ead-a70a-34f740b4325f", + "value": "Engage payload and debunk." + }, + { + "description": "Redesign platforms and algorithms to reduce the effectiveness of disinformation", + "meta": { + "external_id": "C00120", + "kill_chain": [ + "tactics:Conduct Pump Priming", + "responsetypes:Deter", + "metatechniques:Metatechnique" + ], + "refs": [ + "https://github.com/DISARMFoundation/DISARMframeworks/blob/main/generated_pages/counters/C00120.md" + ] + }, + "related": [ + { + "dest-uuid": "deb56d12-fd4d-515a-9051-89a372d5d4bb", + "type": "blocks" + }, + { + "dest-uuid": "bd7a51b3-d00c-575f-a16e-6f51e5a67743", + "type": "affected-by" + } + ], + "uuid": "0eb2eaf4-0c53-527d-8744-70670f6a9736", + "value": "Open dialogue about design of platforms to produce different outcomes" + }, + { + "description": "Make algorithms in platforms explainable, and visible to people using those platforms.", + "meta": { + "external_id": "C00121", + "kill_chain": [ + "tactics:Conduct Pump Priming", + "responsetypes:Deter", + "metatechniques:Resilience" + ], + "refs": [ + "https://github.com/DISARMFoundation/DISARMframeworks/blob/main/generated_pages/counters/C00121.md" + ] + }, + "related": [ + { + "dest-uuid": "ebd0aab4-013c-52fa-bae5-8fb3bd7704b8", + "type": "blocks" + }, + { + "dest-uuid": "bd7a51b3-d00c-575f-a16e-6f51e5a67743", + "type": "affected-by" + } + ], + "uuid": "b8b49628-4c3d-528c-90f1-2fee8722e2c5", + "value": "Tool transparency and literacy for channels people follow." + }, + { + "description": "Beware: content moderation misused becomes censorship.", + "meta": { + "external_id": "C00122", + "kill_chain": [ + "tactics:Deliver Content", + "responsetypes:Deny", + "metatechniques:Friction" + ], + "refs": [ + "https://github.com/DISARMFoundation/DISARMframeworks/blob/main/generated_pages/counters/C00122.md" + ] + }, + "related": [ + { + "dest-uuid": "56b88516-ae4c-5176-b6ed-6e9be91ce898", + "type": "blocks" + }, + { + "dest-uuid": "667967b8-b3f1-55ad-8f8a-8c43c1290e6e", + "type": "affected-by" + } + ], + "uuid": "0b0f003a-4bb7-5f1e-8bc6-987c680cba39", + "value": "Content moderation" + }, + { + "description": "reduce the visibility of known botnets online.", + "meta": { + "external_id": "C00123", + "kill_chain": [ + "tactics:Deliver Content", + "responsetypes:Disrupt", + "metatechniques:Friction" + ], + "refs": [ + "https://github.com/DISARMFoundation/DISARMframeworks/blob/main/generated_pages/counters/C00123.md" + ] + }, + "related": [ + { + "dest-uuid": "1a8c4e8c-3543-5ab1-b4d0-939de9e7875f", + "type": "blocks" + }, + { + "dest-uuid": "bd7a51b3-d00c-575f-a16e-6f51e5a67743", + "type": "affected-by" + } + ], + "uuid": "0280f954-5654-5d23-8dcf-a1f5334f3e6a", + "value": "Remove or rate limit botnets" + }, + { + "description": "Don't engage with individuals relaying misinformation.", + "meta": { + "external_id": "C00124", + "kill_chain": [ + "tactics:Deliver Content", + "responsetypes:Disrupt", + "metatechniques:Friction" + ], + "refs": [ + "https://github.com/DISARMFoundation/DISARMframeworks/blob/main/generated_pages/counters/C00124.md" + ] + }, + "related": [ + { + "dest-uuid": "5662c61e-eb2b-5710-8148-61457483efcc", + "type": "blocks" + }, + { + "dest-uuid": "f6c98378-65be-5f14-af3e-326909d70d77", + "type": "affected-by" + }, + { + "dest-uuid": "bdcbbd5d-e282-5c55-a39e-212b10f75200", + "type": "affected-by" + } + ], + "uuid": "8cfe6ea3-7271-5578-b4f7-8eb3edbe43f5", + "value": "Don't feed the trolls" + }, + { + "description": "Produce material in advance of misinformation incidents, by anticipating the narratives used in them, and debunking them.", + "meta": { + "external_id": "C00125", + "kill_chain": [ + "tactics:Deliver Content", + "responsetypes:Disrupt", + "metatechniques:Resilience" + ], + "refs": [ + "https://github.com/DISARMFoundation/DISARMframeworks/blob/main/generated_pages/counters/C00125.md" + ] + }, + "related": [ + { + "dest-uuid": "a78ef283-34f0-58b0-97f1-1cbc72bfe028", + "type": "blocks" + }, + { + "dest-uuid": "bd7a51b3-d00c-575f-a16e-6f51e5a67743", + "type": "affected-by" + } + ], + "uuid": "3ddf6174-2801-591b-a7e7-6529e75bc10e", + "value": "Prebunking" + }, + { + "description": "Create an alert system around disinformation and misinformation artefacts, narratives, and incidents", + "meta": { + "external_id": "C00126", + "kill_chain": [ + "tactics:Deliver Content", + "responsetypes:Disrupt", + "metatechniques:Daylight" + ], + "refs": [ + "https://github.com/DISARMFoundation/DISARMframeworks/blob/main/generated_pages/counters/C00126.md" + ] + }, + "related": [ + { + "dest-uuid": "a78ef283-34f0-58b0-97f1-1cbc72bfe028", + "type": "blocks" + }, + { + "dest-uuid": "bd7a51b3-d00c-575f-a16e-6f51e5a67743", + "type": "affected-by" + } + ], + "uuid": "933609cf-6195-506f-9fb1-b1e5778d45f4", + "value": "Social media amber alert" + }, + { + "description": "Repost or comment on misinformation artefacts, using ridicule or other content to reduce the likelihood of reposting.", + "meta": { + "external_id": "C00128", + "kill_chain": [ + "tactics:Deliver Content", + "responsetypes:Disrupt", + "metatechniques:Dilution" + ], + "refs": [ + "https://github.com/DISARMFoundation/DISARMframeworks/blob/main/generated_pages/counters/C00128.md" + ] + }, + "related": [ + { + "dest-uuid": "5a882e51-8b7d-5e7e-bb7a-6738d49e3bc0", + "type": "blocks" + }, + { + "dest-uuid": "52f3153f-d7ab-5e42-9ee6-aea591856214", + "type": "affected-by" + } + ], + "uuid": "67bab8b7-908b-5b0f-bf56-26502798d743", + "value": "Create friction by marking content with ridicule or other \"decelerants\"" + }, + { + "description": "fiscal sanctions; parallel to counter terrorism", + "meta": { + "external_id": "C00129", + "kill_chain": [ + "tactics:Deliver Content", + "responsetypes:Deny", + "metatechniques:Reduce Resources" + ], + "refs": [ + "https://github.com/DISARMFoundation/DISARMframeworks/blob/main/generated_pages/counters/C00129.md" + ] + }, + "related": [ + { + "dest-uuid": "26c314bb-ed05-5dbe-b672-c16c2f0fff52", + "type": "blocks" + }, + { + "dest-uuid": "bd7a51b3-d00c-575f-a16e-6f51e5a67743", + "type": "affected-by" + } + ], + "uuid": "a6b2f9bc-47fd-5303-8df8-0bb4ae4f4cbd", + "value": "Use banking to cut off access" + }, + { + "description": "Train local influencers in countering misinformation.", + "meta": { + "external_id": "C00130", + "kill_chain": [ + "tactics:Microtarget", + "responsetypes:Deter", + "metatechniques:Resilience" + ], + "refs": [ + "https://github.com/DISARMFoundation/DISARMframeworks/blob/main/generated_pages/counters/C00130.md" + ] + }, + "related": [ + { + "dest-uuid": "39baec3d-f2ce-5fee-ba7d-3db7d6469946", + "type": "blocks" + }, + { + "dest-uuid": "bd7a51b3-d00c-575f-a16e-6f51e5a67743", + "type": "affected-by" + } + ], + "uuid": "f99b442a-7c34-5c66-b699-64c3da69374c", + "value": "Mentorship: elders, youth, credit. Learn vicariously." + }, + { + "description": "Take botnet servers offline by seizing them.", + "meta": { + "external_id": "C00131", + "kill_chain": [ + "tactics:Persist in the Information Environment", + "responsetypes:Deny", + "metatechniques:Removal" + ], + "refs": [ + "https://github.com/DISARMFoundation/DISARMframeworks/blob/main/generated_pages/counters/C00131.md" + ] + }, + "related": [ + { + "dest-uuid": "ee7bc41a-9eb0-5732-924a-3885e1c3bee9", + "type": "blocks" + }, + { + "dest-uuid": "b7db36e3-3dbb-5f91-be61-076996a4c57b", + "type": "affected-by" + } + ], + "uuid": "ae4b53ba-9dd6-53af-a624-d5929944117c", + "value": "Seize and analyse botnet servers" + }, + { + "description": "Note: Similar to Deplatform People but less generic. Perhaps both should be left.", + "meta": { + "external_id": "C00133", + "kill_chain": [ + "tactics:Establish Social Assets", + "responsetypes:Disrupt", + "metatechniques:Removal" + ], + "refs": [ + "https://github.com/DISARMFoundation/DISARMframeworks/blob/main/generated_pages/counters/C00133.md" + ] + }, + "related": [ + { + "dest-uuid": "2d40a01e-41a9-513a-bf0b-694dc0a87f8e", + "type": "blocks" + }, + { + "dest-uuid": "667967b8-b3f1-55ad-8f8a-8c43c1290e6e", + "type": "affected-by" + } + ], + "uuid": "027421d5-7c11-5c13-aa91-5cf6a01b72ef", + "value": "Deplatform Account*" + }, + { + "description": "Merged two rows here.", + "meta": { + "external_id": "C00135", + "kill_chain": [ + "tactics:Establish Social Assets", + "responsetypes:Disrupt", + "metatechniques:Removal" + ], + "refs": [ + "https://github.com/DISARMFoundation/DISARMframeworks/blob/main/generated_pages/counters/C00135.md" + ] + }, + "related": [ + { + "dest-uuid": "2d40a01e-41a9-513a-bf0b-694dc0a87f8e", + "type": "blocks" + }, + { + "dest-uuid": "667967b8-b3f1-55ad-8f8a-8c43c1290e6e", + "type": "affected-by" + } + ], + "uuid": "f3edf130-0096-5a49-a3f1-d97974a70494", + "value": "Deplatform message groups and/or message boards" + }, + { + "description": "Find communities likely to be targetted by misinformation campaigns, and send them countermessages or pointers to information sources.", + "meta": { + "external_id": "C00136", + "kill_chain": [ + "tactics:Conduct Pump Priming", + "responsetypes:Disrupt", + "metatechniques:Countermessaging" + ], + "refs": [ + "https://github.com/DISARMFoundation/DISARMframeworks/blob/main/generated_pages/counters/C00136.md" + ] + }, + "related": [ + { + "dest-uuid": "5662c61e-eb2b-5710-8148-61457483efcc", + "type": "blocks" + }, + { + "dest-uuid": "bd7a51b3-d00c-575f-a16e-6f51e5a67743", + "type": "affected-by" + } + ], + "uuid": "636bef6a-d120-5f5e-9bc1-4b8af99b8e45", + "value": "Microtarget most likely targets then send them countermessages" + }, + { + "description": "File multiple lawsuits against known misinformation creators and posters, to distract them from disinformation creation.", + "meta": { + "external_id": "C00138", + "kill_chain": [ + "tactics:Persist in the Information Environment", + "responsetypes:Disrupt", + "metatechniques:Reduce Resources" + ], + "refs": [ + "https://github.com/DISARMFoundation/DISARMframeworks/blob/main/generated_pages/counters/C00138.md" + ] + }, + "related": [ + { + "dest-uuid": "6eb04152-8342-563a-9b9c-1e73aae2cc24", + "type": "blocks" + }, + { + "dest-uuid": "bd7a51b3-d00c-575f-a16e-6f51e5a67743", + "type": "affected-by" + } + ], + "uuid": "80730d54-1dd1-5da6-baae-052553fbf27f", + "value": "Spam domestic actors with lawsuits" + }, + { + "description": "God knows what this is. Keeping temporarily in case we work it out.", + "meta": { + "external_id": "C00139", + "kill_chain": [ + "tactics:Persist in the Information Environment", + "responsetypes:Disrupt", + "metatechniques:Friction" + ], + "refs": [ + "https://github.com/DISARMFoundation/DISARMframeworks/blob/main/generated_pages/counters/C00139.md" + ] + }, + "related": [ + { + "dest-uuid": "bd7a51b3-d00c-575f-a16e-6f51e5a67743", + "type": "blocks" + }, + { + "dest-uuid": "bd7a51b3-d00c-575f-a16e-6f51e5a67743", + "type": "affected-by" + } + ], + "uuid": "93c6d14f-e6e3-535e-bc58-e2b95dd23b3c", + "value": "Weaponise youtube content matrices" + }, + { + "description": "Applies to most of the content used by exposure techniques except \"T0055 - Use hashtag”. Applies to analytics", + "meta": { + "external_id": "C00140", + "kill_chain": [ + "tactics:Assess Effectiveness", + "responsetypes:Disrupt", + "metatechniques:Data Pollution" + ], + "refs": [ + "https://github.com/DISARMFoundation/DISARMframeworks/blob/main/generated_pages/counters/C00140.md" + ] + }, + "related": [ + { + "dest-uuid": "0962328a-43c0-5604-b75e-44e4237f2b04", + "type": "blocks" + }, + { + "dest-uuid": "bd7a51b3-d00c-575f-a16e-6f51e5a67743", + "type": "affected-by" + } + ], + "uuid": "8274f8d0-0484-51cd-939d-4213ff7f8fca", + "value": "\"Bomb\" link shorteners with lots of calls" + }, + { + "description": "Includes “this has been disproved: do you want to forward it”. Includes “\"Hey this story is old\" popup when messaging with old URL” - this assumes that this technique is based on visits to an URL shortener or a captured news site that can publish a message of our choice. Includes “mark clickbait visually”.", + "meta": { + "external_id": "C00142", + "kill_chain": [ + "tactics:Develop Content", + "responsetypes:Degrade", + "metatechniques:Friction" + ], + "refs": [ + "https://github.com/DISARMFoundation/DISARMframeworks/blob/main/generated_pages/counters/C00142.md" + ] + }, + "related": [ + { + "dest-uuid": "0962328a-43c0-5604-b75e-44e4237f2b04", + "type": "blocks" + }, + { + "dest-uuid": "667967b8-b3f1-55ad-8f8a-8c43c1290e6e", + "type": "affected-by" + } + ], + "uuid": "0acbac2f-7bd4-51d1-aaac-e12cebcddb31", + "value": "Platform adds warning label and decision point when sharing content" + }, + { + "description": "Use copyright infringement claims to remove videos etc.", + "meta": { + "external_id": "C00143", + "kill_chain": [ + "tactics:Persist in the Information Environment", + "responsetypes:Degrade", + "metatechniques:Targeting" + ], + "refs": [ + "https://github.com/DISARMFoundation/DISARMframeworks/blob/main/generated_pages/counters/C00143.md" + ] + }, + "related": [ + { + "dest-uuid": "6eb04152-8342-563a-9b9c-1e73aae2cc24", + "type": "blocks" + }, + { + "dest-uuid": "019e73b3-c4be-5a28-a86b-4eb6d2df1217", + "type": "affected-by" + }, + { + "dest-uuid": "f6c98378-65be-5f14-af3e-326909d70d77", + "type": "affected-by" + } + ], + "uuid": "7ef86cff-4401-518b-92fc-a0d88c23f280", + "value": "(botnet) DMCA takedown requests to waste group time" + }, + { + "description": "Degrade the infrastructure. Could e.g. pay to not act for 30 days. Not recommended", + "meta": { + "external_id": "C00144", + "kill_chain": [ + "tactics:Plan Objectives", + "responsetypes:Degrade", + "metatechniques:Reduce Resources" + ], + "refs": [ + "https://github.com/DISARMFoundation/DISARMframeworks/blob/main/generated_pages/counters/C00144.md" + ] + }, + "related": [ + { + "dest-uuid": "845815a8-53de-5c4e-8ca2-8bf448fe8ea0", + "type": "blocks" + }, + { + "dest-uuid": "bd7a51b3-d00c-575f-a16e-6f51e5a67743", + "type": "affected-by" + } + ], + "uuid": "bf9c0530-8f8e-5809-a751-5ea8317fd434", + "value": "Buy out troll farm employees / offer them jobs" + }, + { + "description": "Stop new community activity (likes, comments) on old social media posts.", + "meta": { + "external_id": "C00147", + "kill_chain": [ + "tactics:Deliver Content", + "responsetypes:Disrupt", + "metatechniques:Friction" + ], + "refs": [ + "https://github.com/DISARMFoundation/DISARMframeworks/blob/main/generated_pages/counters/C00147.md" + ] + }, + "related": [ + { + "dest-uuid": "6eb04152-8342-563a-9b9c-1e73aae2cc24", + "type": "blocks" + }, + { + "dest-uuid": "667967b8-b3f1-55ad-8f8a-8c43c1290e6e", + "type": "affected-by" + } + ], + "uuid": "49f92a32-bac9-56af-ac97-3b09f23b8fa6", + "value": "Make amplification of social media posts expire (e.g. can't like/ retweet after n days)" + }, + { + "description": "If creators are using network analysis to determine how to attack networks, then adding random extra links to those networks might throw that analysis out enough to change attack outcomes. Unsure which DISARM techniques.", + "meta": { + "external_id": "C00148", + "kill_chain": [ + "tactics:Assess Effectiveness", + "responsetypes:Degrade", + "metatechniques:Data Pollution" + ], + "refs": [ + "https://github.com/DISARMFoundation/DISARMframeworks/blob/main/generated_pages/counters/C00148.md" + ] + }, + "related": [ + { + "dest-uuid": "cd0bc81f-afc1-506d-867d-6bf4c6ebd96b", + "type": "blocks" + }, + { + "dest-uuid": "667967b8-b3f1-55ad-8f8a-8c43c1290e6e", + "type": "affected-by" + } + ], + "uuid": "dcb94d22-45a2-5433-bc4c-634add96088b", + "value": "Add random links to network graphs" + }, + { + "description": "Includes Pollute the AB-testing data feeds: Polluting A/B testing requires knowledge of MOEs and MOPs. A/B testing must be caught early when there is relatively little data available so infiltration of TAs and understanding of how content is migrated from testing to larger audiences is fundamental.", + "meta": { + "external_id": "C00149", + "kill_chain": [ + "tactics:Assess Effectiveness", + "responsetypes:Degrade", + "metatechniques:Data Pollution" + ], + "refs": [ + "https://github.com/DISARMFoundation/DISARMframeworks/blob/main/generated_pages/counters/C00149.md" + ] + }, + "related": [ + { + "dest-uuid": "2dd9acb0-6122-5ada-b6ab-833b3582915a", + "type": "blocks" + }, + { + "dest-uuid": "bd7a51b3-d00c-575f-a16e-6f51e5a67743", + "type": "affected-by" + } + ], + "uuid": "864f56c1-d966-5b5a-8cc8-91bb4c57b518", + "value": "Poison the monitoring & evaluation data" + }, + { + "description": "Align offensive cyber action with information operations and counter disinformation approaches, where appropriate.", + "meta": { + "external_id": "C00153", + "kill_chain": [ + "tactics:Plan Strategy", + "responsetypes:Disrupt", + "metatechniques:Targeting" + ], + "refs": [ + "https://github.com/DISARMFoundation/DISARMframeworks/blob/main/generated_pages/counters/C00153.md" + ] + }, + "related": [ + { + "dest-uuid": "56b88516-ae4c-5176-b6ed-6e9be91ce898", + "type": "blocks" + }, + { + "dest-uuid": "a0c301a5-5675-5d79-bd8c-2afde063697e", + "type": "affected-by" + } + ], + "uuid": "22e5b817-e45b-5f41-8806-8e0c66f181cc", + "value": "Take pre-emptive action against actors' infrastructure" + }, + { + "description": "Train media to spot and respond to misinformation, and ask them not to post or transmit misinformation they've found.", + "meta": { + "external_id": "C00154", + "kill_chain": [ + "tactics:Conduct Pump Priming", + "responsetypes:Deny", + "metatechniques:Removal" + ], + "refs": [ + "https://github.com/DISARMFoundation/DISARMframeworks/blob/main/generated_pages/counters/C00154.md" + ] + }, + "related": [ + { + "dest-uuid": "53e8c51b-c178-5429-8cee-022c6741cc91", + "type": "blocks" + }, + { + "dest-uuid": "bdcbbd5d-e282-5c55-a39e-212b10f75200", + "type": "affected-by" + } + ], + "uuid": "a1441814-0d69-5b19-9dae-64c61d7dfdbd", + "value": "Ask media not to report false information" + }, + { + "description": "Ban misinformation creators and posters from funding sites", + "meta": { + "external_id": "C00155", + "kill_chain": [ + "tactics:Establish Social Assets", + "responsetypes:Deny", + "metatechniques:Removal" + ], + "refs": [ + "https://github.com/DISARMFoundation/DISARMframeworks/blob/main/generated_pages/counters/C00155.md" + ] + }, + "related": [ + { + "dest-uuid": "f0bb5056-fedb-5507-8554-c958ec8d9fdc", + "type": "blocks" + }, + { + "dest-uuid": "a97e25d4-62cf-5040-8274-1a71104104b2", + "type": "affected-by" + } + ], + "uuid": "5b5c3e04-acf2-50dd-9861-c44bcc8f2cc3", + "value": "Ban incident actors from funding sites" + }, + { + "description": "Civil engagement activities conducted on the part of EFP forces. NATO should likewise provide support and training, where needed, to local public affairs and other communication personnel. Local government and military public affairs personnel can play their part in creating and disseminating entertaining and sharable content that supports the EFP mission.", + "meta": { + "external_id": "C00156", + "kill_chain": [ + "tactics:Plan Objectives", + "responsetypes:Disrupt", + "metatechniques:Countermessaging" + ], + "refs": [ + "https://github.com/DISARMFoundation/DISARMframeworks/blob/main/generated_pages/counters/C00156.md" + ] + }, + "related": [ + { + "dest-uuid": "f1d52ce1-f431-5732-a071-215cb3306f3e", + "type": "blocks" + }, + { + "dest-uuid": "1975d955-01ff-5cbb-8897-b08a0b235370", + "type": "affected-by" + }, + { + "dest-uuid": "091f8344-0956-5d15-83c4-e967579c4391", + "type": "affected-by" + } + ], + "uuid": "877c29b5-38ae-570a-93b3-9e4e70ec27ef", + "value": "Better tell your country or organisation story" + }, + { + "description": "e.g. Create a campaign plan and toolkit for competition short of armed conflict (this used to be called “the grey zone”). The campaign plan should account for own vulnerabilities and strengths, and not over-rely on any one tool of statecraft or line of effort. It will identify and employ a broad spectrum of national power to deter, compete, and counter (where necessary) other countries’ approaches, and will include understanding of own capabilities, capabilities of disinformation creators, and international standards of conduct to compete in, shrink the size, and ultimately deter use of competition short of armed conflict.", + "meta": { + "external_id": "C00159", + "kill_chain": [ + "tactics:Plan Strategy", + "responsetypes:Disrupt", + "metatechniques:Metatechnique" + ], + "refs": [ + "https://github.com/DISARMFoundation/DISARMframeworks/blob/main/generated_pages/counters/C00159.md" + ] + }, + "related": [ + { + "dest-uuid": "bd7a51b3-d00c-575f-a16e-6f51e5a67743", + "type": "blocks" + }, + { + "dest-uuid": "bd7a51b3-d00c-575f-a16e-6f51e5a67743", + "type": "affected-by" + } + ], + "uuid": "595e5d8a-7e41-5597-9375-86c7d703de29", + "value": "Have a disinformation response plan" + }, + { + "description": "Identify key influencers (e.g. use network analysis), then reach out to identified users and offer support, through either training or resources.", + "meta": { + "external_id": "C00160", + "kill_chain": [ + "tactics:Establish Social Assets", + "responsetypes:Deny", + "metatechniques:Resilience" + ], + "refs": [ + "https://github.com/DISARMFoundation/DISARMframeworks/blob/main/generated_pages/counters/C00160.md" + ] + }, + "related": [ + { + "dest-uuid": "53e8c51b-c178-5429-8cee-022c6741cc91", + "type": "blocks" + }, + { + "dest-uuid": "03aaf19c-42b9-5b8e-9d47-a6bb291f10fa", + "type": "affected-by" + }, + { + "dest-uuid": "ebd92d67-1d68-5542-8b48-3cfc939db88a", + "type": "affected-by" + } + ], + "uuid": "590350b9-2614-572b-825b-b2498ebf4c17", + "value": "find and train influencers" + }, + { + "description": "Advance coalitions across borders and sectors, spanning public and private, as well as foreign and domestic, divides. Improve mechanisms to collaborate, share information, and develop coordinated approaches with the private sector at home and allies and partners abroad.", + "meta": { + "external_id": "C00161", + "kill_chain": [ + "tactics:Plan Strategy", + "responsetypes:Deter", + "metatechniques:Metatechnique" + ], + "refs": [ + "https://github.com/DISARMFoundation/DISARMframeworks/blob/main/generated_pages/counters/C00161.md" + ] + }, + "related": [ + { + "dest-uuid": "f1d52ce1-f431-5732-a071-215cb3306f3e", + "type": "blocks" + }, + { + "dest-uuid": "bd7a51b3-d00c-575f-a16e-6f51e5a67743", + "type": "affected-by" + } + ], + "uuid": "047898ad-129f-5d18-9dea-985e7f68becd", + "value": "Coalition Building with stakeholders and Third-Party Inducements" + }, + { + "description": "Kremlin’s narrative spin extends through constellations of “civil society” organisations, political parties, churches, and other actors. Moscow leverages think tanks, human rights groups, election observers, Eurasianist integration groups, and orthodox groups. A collection of Russian civil society organisations, such as the Federal Agency for the Commonwealth of Independent States Affairs, Compatriots Living Abroad, and International Humanitarian Cooperation, together receive at least US$100 million per year, in addition to government-organized nongovernmental organisations (NGOs), at least 150 of which are funded by Russian presidential grants totaling US$70 million per year.", + "meta": { + "external_id": "C00162", + "kill_chain": [ + "tactics:Establish Social Assets", + "responsetypes:Disrupt", + "metatechniques:Targeting" + ], + "refs": [ + "https://github.com/DISARMFoundation/DISARMframeworks/blob/main/generated_pages/counters/C00162.md" + ] + }, + "related": [ + { + "dest-uuid": "39baec3d-f2ce-5fee-ba7d-3db7d6469946", + "type": "blocks" + }, + { + "dest-uuid": "bd7a51b3-d00c-575f-a16e-6f51e5a67743", + "type": "affected-by" + } + ], + "uuid": "efd2cf88-94ba-5fdc-8611-660baf44b2e9", + "value": "Unravel/target the Potemkin villages" + }, + { + "description": "protect the interests of this population and, more importantly, influence the population to support pro-Russia causes and effectively influence the politics of its neighbours", + "meta": { + "external_id": "C00164", + "kill_chain": [ + "tactics:Plan Objectives", + "responsetypes:Disrupt", + "metatechniques:Targeting" + ], + "refs": [ + "https://github.com/DISARMFoundation/DISARMframeworks/blob/main/generated_pages/counters/C00164.md" + ] + }, + "related": [ + { + "dest-uuid": "f1d52ce1-f431-5732-a071-215cb3306f3e", + "type": "blocks" + }, + { + "dest-uuid": "bd7a51b3-d00c-575f-a16e-6f51e5a67743", + "type": "affected-by" + } + ], + "uuid": "af04983d-8531-54df-a7c7-39e5ae6bb523", + "value": "compatriot policy" + }, + { + "description": "e.g. for leaked legal documents, use court motions to limit future discovery actions", + "meta": { + "external_id": "C00165", + "kill_chain": [ + "tactics:Develop Content", + "responsetypes:Deny", + "metatechniques:Friction" + ], + "refs": [ + "https://github.com/DISARMFoundation/DISARMframeworks/blob/main/generated_pages/counters/C00165.md" + ] + }, + "related": [ + { + "dest-uuid": "16146867-6f52-5a3c-bc2a-139755044726", + "type": "blocks" + }, + { + "dest-uuid": "bd7a51b3-d00c-575f-a16e-6f51e5a67743", + "type": "affected-by" + } + ], + "uuid": "3ec1f2f8-fe7d-51bc-bdf1-9ec47cd1bb74", + "value": "Ensure integrity of official documents" + }, + { + "description": "international donors will donate to a basket fund that will pay a committee of local experts who will, in turn, manage and distribute the money to Russian-language producers and broadcasters that pitch various projects.", + "meta": { + "external_id": "C00169", + "kill_chain": [ + "tactics:Plan Objectives", + "responsetypes:Disrupt", + "metatechniques:Countermessaging" + ], + "refs": [ + "https://github.com/DISARMFoundation/DISARMframeworks/blob/main/generated_pages/counters/C00169.md" + ] + }, + "related": [ + { + "dest-uuid": "39baec3d-f2ce-5fee-ba7d-3db7d6469946", + "type": "blocks" + }, + { + "dest-uuid": "bd7a51b3-d00c-575f-a16e-6f51e5a67743", + "type": "affected-by" + } + ], + "uuid": "babb37b7-5b28-5ba4-8f08-5c7c271937c7", + "value": "develop a creative content hub" + }, + { + "description": "Shift from reactive to proactive response, with priority on sharing relevant information with the public and mobilising private-sector engagement. Recent advances in data-driven technologies have elevated information as a source of power to influence the political and economic environment, to foster economic growth, to enable a decision-making advantage over competitors, and to communicate securely and quickly.", + "meta": { + "external_id": "C00170", + "kill_chain": [ + "tactics:Plan Strategy", + "responsetypes:Disrupt", + "metatechniques:Metatechnique" + ], + "refs": [ + "https://github.com/DISARMFoundation/DISARMframeworks/blob/main/generated_pages/counters/C00170.md" + ] + }, + "related": [ + { + "dest-uuid": "bd7a51b3-d00c-575f-a16e-6f51e5a67743", + "type": "blocks" + }, + { + "dest-uuid": "bd7a51b3-d00c-575f-a16e-6f51e5a67743", + "type": "affected-by" + } + ], + "uuid": "a61e8719-f78b-58c0-8307-915bdfc5849a", + "value": "elevate information as a critical domain of statecraft" + }, + { + "description": "Removing accounts, pages, groups, e.g. facebook page removal", + "meta": { + "external_id": "C00172", + "kill_chain": [ + "tactics:Establish Social Assets", + "responsetypes:Deny", + "metatechniques:Removal" + ], + "refs": [ + "https://github.com/DISARMFoundation/DISARMframeworks/blob/main/generated_pages/counters/C00172.md" + ] + }, + "related": [ + { + "dest-uuid": "56b88516-ae4c-5176-b6ed-6e9be91ce898", + "type": "blocks" + }, + { + "dest-uuid": "667967b8-b3f1-55ad-8f8a-8c43c1290e6e", + "type": "affected-by" + } + ], + "uuid": "b20e5c17-f2dd-5057-9af2-a9586e72de9e", + "value": "social media source removal" + }, + { + "description": "Free and fair press: create bipartisan, patriotic commitment to press freedom. Note difference between news and editorialising. Build alternative news sources: create alternative local-language news sources to counter local-language propaganda outlets. Delegitimize the 24 hour news cycle. includes Provide an alternative to disinformation content by expanding and improving local content: Develop content that can displace geopolitically-motivated narratives in the entire media environment, both new and old media alike.", + "meta": { + "external_id": "C00174", + "kill_chain": [ + "tactics:Plan Strategy", + "responsetypes:Deny", + "metatechniques:Metatechnique" + ], + "refs": [ + "https://github.com/DISARMFoundation/DISARMframeworks/blob/main/generated_pages/counters/C00174.md" + ] + }, + "related": [ + { + "dest-uuid": "aaaef5e2-4d1b-5fb6-ba0b-f79f2d3f4a2a", + "type": "blocks" + }, + { + "dest-uuid": "bdcbbd5d-e282-5c55-a39e-212b10f75200", + "type": "affected-by" + } + ], + "uuid": "b666fbe1-04de-547c-abc5-27786c948e50", + "value": "Create a healthier news environment" + }, + { + "description": "Coordinated disinformation challenges are increasingly multidisciplinary, there are few organisations within the national security structures that are equipped with the broad-spectrum capability to effectively counter large-scale conflict short of war tactics in real-time. Institutional hurdles currently impede diverse subject matter experts, hailing from outside of the traditional national security and foreign policy disciplines (e.g., physical science, engineering, media, legal, and economics fields), from contributing to the direct development of national security countermeasures to emerging conflict short of war threat vectors. A Cognitive Security Action Group (CSAG), akin to the Counterterrorism Security Group (CSG), could drive interagency alignment across equivalents of DHS, DoS, DoD, Intelligence Community, and other implementing agencies, in areas including strategic narrative, and the nexus of cyber and information operations.", + "meta": { + "external_id": "C00176", + "kill_chain": [ + "tactics:Plan Strategy", + "responsetypes:Deter", + "metatechniques:Metatechnique" + ], + "refs": [ + "https://github.com/DISARMFoundation/DISARMframeworks/blob/main/generated_pages/counters/C00176.md" + ] + }, + "related": [ + { + "dest-uuid": "29768133-b941-5974-ab10-c15bbb86e387", + "type": "blocks" + }, + { + "dest-uuid": "bd7a51b3-d00c-575f-a16e-6f51e5a67743", + "type": "affected-by" + } + ], + "uuid": "fea19aab-9522-55bf-9608-addf7d6aaf8d", + "value": "Improve Coordination amongst stakeholders: public and private" + }, + { + "description": "1) Pollute the data voids with wholesome content (Kittens! Babyshark!). 2) fill data voids with relevant information, e.g. increase Russian-language programming in areas subject to Russian disinformation.", + "meta": { + "external_id": "C00178", + "kill_chain": [ + "tactics:Microtarget", + "responsetypes:Degrade", + "metatechniques:Dilution" + ], + "refs": [ + "https://github.com/DISARMFoundation/DISARMframeworks/blob/main/generated_pages/counters/C00178.md" + ] + }, + "related": [ + { + "dest-uuid": "9570ebf8-f69b-5064-a627-a19cb429d0f5", + "type": "blocks" + }, + { + "dest-uuid": "bd7a51b3-d00c-575f-a16e-6f51e5a67743", + "type": "affected-by" + } + ], + "uuid": "e9380fb8-fc55-5ac7-94ab-2af4c13b6361", + "value": "Fill information voids with non-disinformation content" + }, + { + "description": "Detect redirction or malware, then quarantine or delete.", + "meta": { + "external_id": "C00182", + "kill_chain": [ + "tactics:Deliver Content", + "responsetypes:Deny", + "metatechniques:Removal" + ], + "refs": [ + "https://github.com/DISARMFoundation/DISARMframeworks/blob/main/generated_pages/counters/C00182.md" + ] + }, + "related": [ + { + "dest-uuid": "d05396d6-9701-5ce3-a6cd-abff224310ae", + "type": "blocks" + }, + { + "dest-uuid": "a0c301a5-5675-5d79-bd8c-2afde063697e", + "type": "affected-by" + } + ], + "uuid": "14b886aa-c023-5a84-9605-e4a9cb22e4f4", + "value": "Redirection / malware detection/ remediation" + }, + { + "description": "highlight misinformation activities and actors in media", + "meta": { + "external_id": "C00184", + "kill_chain": [ + "tactics:Conduct Pump Priming", + "responsetypes:Degrade", + "metatechniques:Daylight" + ], + "refs": [ + "https://github.com/DISARMFoundation/DISARMframeworks/blob/main/generated_pages/counters/C00184.md" + ] + }, + "related": [ + { + "dest-uuid": "edc041f8-06ac-513a-a9f9-1353e38f3bcf", + "type": "blocks" + }, + { + "dest-uuid": "bd7a51b3-d00c-575f-a16e-6f51e5a67743", + "type": "affected-by" + } + ], + "uuid": "2cd7227b-31be-5999-9f5f-927f9d8c3b6e", + "value": "Media exposure" + }, + { + "description": "Includes SEO influence. Includes promotion of a “higher standard of journalism”: journalism training “would be helpful, especially for the online community. Includes Strengthen local media: Improve effectiveness of local media outlets.", + "meta": { + "external_id": "C00188", + "kill_chain": [ + "tactics:Conduct Pump Priming", + "responsetypes:Disrupt", + "metatechniques:Resilience" + ], + "refs": [ + "https://github.com/DISARMFoundation/DISARMframeworks/blob/main/generated_pages/counters/C00188.md" + ] + }, + "related": [ + { + "dest-uuid": "aaaef5e2-4d1b-5fb6-ba0b-f79f2d3f4a2a", + "type": "blocks" + }, + { + "dest-uuid": "a73d7508-4e4b-57d8-9dbf-15ac73b65a15", + "type": "affected-by" + }, + { + "dest-uuid": "bdcbbd5d-e282-5c55-a39e-212b10f75200", + "type": "affected-by" + } + ], + "uuid": "5c8fc207-b237-58cc-bedd-024fea386a7a", + "value": "Newsroom/Journalist training to counter influence moves" + }, + { + "description": "Use ongoing analysis/monitoring of \"flagged\" profiles. Confirm whether platforms are actively removing flagged accounts, and raise pressure via e.g. government organisations to encourage removal", + "meta": { + "external_id": "C00189", + "kill_chain": [ + "tactics:Establish Social Assets", + "responsetypes:Destroy", + "metatechniques:Daylight" + ], + "refs": [ + "https://github.com/DISARMFoundation/DISARMframeworks/blob/main/generated_pages/counters/C00189.md" + ] + }, + "related": [ + { + "dest-uuid": "56b88516-ae4c-5176-b6ed-6e9be91ce898", + "type": "blocks" + }, + { + "dest-uuid": "bd7a51b3-d00c-575f-a16e-6f51e5a67743", + "type": "affected-by" + } + ], + "uuid": "6151d77a-c3cf-5fc3-853d-dc96ddc34397", + "value": "Ensure that platforms are taking down flagged accounts" + }, + { + "description": "Government open engagement with civil society as an independent check on government action and messaging. Government seeks to coordinate and synchronise narrative themes with allies and partners while calibrating action in cases where elements in these countries may have been co-opted by competitor nations. Includes “fight in the light”: Use leadership in the arts, entertainment, and media to highlight and build on fundamental tenets of democracy.", + "meta": { + "external_id": "C00190", + "kill_chain": [ + "tactics:Plan Strategy", + "responsetypes:Disrupt", + "metatechniques:Resilience" + ], + "refs": [ + "https://github.com/DISARMFoundation/DISARMframeworks/blob/main/generated_pages/counters/C00190.md" + ] + }, + "related": [ + { + "dest-uuid": "aaaef5e2-4d1b-5fb6-ba0b-f79f2d3f4a2a", + "type": "blocks" + }, + { + "dest-uuid": "f6c98378-65be-5f14-af3e-326909d70d77", + "type": "affected-by" + } + ], + "uuid": "11380b67-28d8-5034-a79b-fbb6150ad302", + "value": "open engagement with civil society" + }, + { + "description": "Use Google AdWords to identify instances in which people search Google about particular fake-news stories or propaganda themes. Includes Monetize centrist SEO by subsidising the difference in greater clicks towards extremist content.", + "meta": { + "external_id": "C00195", + "kill_chain": [ + "tactics:Select Channels and Affordances", + "responsetypes:Deny", + "metatechniques:Diversion" + ], + "refs": [ + "https://github.com/DISARMFoundation/DISARMframeworks/blob/main/generated_pages/counters/C00195.md" + ] + }, + "related": [ + { + "dest-uuid": "39baec3d-f2ce-5fee-ba7d-3db7d6469946", + "type": "blocks" + }, + { + "dest-uuid": "bd7a51b3-d00c-575f-a16e-6f51e5a67743", + "type": "affected-by" + } + ], + "uuid": "d12e5fda-c5d3-5cc5-806b-69edb56aac61", + "value": "Redirect searches away from disinformation or extremist content" + }, + { + "description": "Standard reporting for false profiles (identity issues). Includes detecting hijacked accounts and reallocating them - if possible, back to original owners.", + "meta": { + "external_id": "C00197", + "kill_chain": [ + "tactics:Establish Social Assets", + "responsetypes:Deny", + "metatechniques:Removal" + ], + "refs": [ + "https://github.com/DISARMFoundation/DISARMframeworks/blob/main/generated_pages/counters/C00197.md" + ] + }, + "related": [ + { + "dest-uuid": "29768133-b941-5974-ab10-c15bbb86e387", + "type": "blocks" + }, + { + "dest-uuid": "d710c91e-a2f2-54ba-9477-fe51b9f31f76", + "type": "affected-by" + }, + { + "dest-uuid": "667967b8-b3f1-55ad-8f8a-8c43c1290e6e", + "type": "affected-by" + } + ], + "uuid": "2fe43d88-db8f-5156-98fb-4b9db0e5fff3", + "value": "remove suspicious accounts" + }, + { + "description": "FIXIT: standardise language used for influencer/ respected figure.", + "meta": { + "external_id": "C00200", + "kill_chain": [ + "tactics:Deliver Content", + "responsetypes:Disrupt", + "metatechniques:Countermessaging" + ], + "refs": [ + "https://github.com/DISARMFoundation/DISARMframeworks/blob/main/generated_pages/counters/C00200.md" + ] + }, + "related": [ + { + "dest-uuid": "39baec3d-f2ce-5fee-ba7d-3db7d6469946", + "type": "blocks" + }, + { + "dest-uuid": "ebd92d67-1d68-5542-8b48-3cfc939db88a", + "type": "affected-by" + } + ], + "uuid": "a479d596-6f66-53eb-ae24-d3a67536464f", + "value": "Respected figure (influencer) disavows misinfo" + }, + { + "description": "Set honeytraps in content likely to be accessed for disinformation.", + "meta": { + "external_id": "C00202", + "kill_chain": [ + "tactics:Develop Content", + "responsetypes:Deny", + "metatechniques:Diversion" + ], + "refs": [ + "https://github.com/DISARMFoundation/DISARMframeworks/blob/main/generated_pages/counters/C00202.md" + ] + }, + "related": [ + { + "dest-uuid": "16146867-6f52-5a3c-bc2a-139755044726", + "type": "blocks" + }, + { + "dest-uuid": "bd7a51b3-d00c-575f-a16e-6f51e5a67743", + "type": "affected-by" + } + ], + "uuid": "01c0791e-7aea-5949-80c4-d3164a914f39", + "value": "Set data 'honeytraps'" + }, + { + "description": "Remove access to official press events from known misinformation actors.", + "meta": { + "external_id": "C00203", + "kill_chain": [ + "tactics:Establish Social Assets", + "responsetypes:Disrupt", + "metatechniques:Friction" + ], + "refs": [ + "https://github.com/DISARMFoundation/DISARMframeworks/blob/main/generated_pages/counters/C00203.md" + ] + }, + "related": [ + { + "dest-uuid": "39baec3d-f2ce-5fee-ba7d-3db7d6469946", + "type": "blocks" + }, + { + "dest-uuid": "1975d955-01ff-5cbb-8897-b08a0b235370", + "type": "affected-by" + } + ], + "uuid": "3055e156-f234-5293-9ab2-d9761a620060", + "value": "Stop offering press credentials to propaganda outlets" + }, + { + "description": "Increase civic resilience by partnering with business community to combat grey zone threats and ensuring adequate reporting and enforcement mechanisms.", + "meta": { + "external_id": "C00205", + "kill_chain": [ + "tactics:Plan Strategy", + "responsetypes:Disrupt", + "metatechniques:Metatechnique" + ], + "refs": [ + "https://github.com/DISARMFoundation/DISARMframeworks/blob/main/generated_pages/counters/C00205.md" + ] + }, + "related": [ + { + "dest-uuid": "aaaef5e2-4d1b-5fb6-ba0b-f79f2d3f4a2a", + "type": "blocks" + }, + { + "dest-uuid": "bd7a51b3-d00c-575f-a16e-6f51e5a67743", + "type": "affected-by" + }, + { + "dest-uuid": "1975d955-01ff-5cbb-8897-b08a0b235370", + "type": "affected-by" + }, + { + "dest-uuid": "15428e72-df7e-5483-a59c-bf84bb46928f", + "type": "affected-by" + } + ], + "uuid": "9133c9a6-500e-537d-aaa8-be8c5da12a93", + "value": "strong dialogue between the federal government and private sector to encourage better reporting" + }, + { + "description": "", + "meta": { + "external_id": "C00207", + "kill_chain": [ + "tactics:Plan Objectives", + "responsetypes:Deter", + "metatechniques:Targeting" + ], + "refs": [ + "https://github.com/DISARMFoundation/DISARMframeworks/blob/main/generated_pages/counters/C00207.md" + ] + }, + "related": [ + { + "dest-uuid": "bd7a51b3-d00c-575f-a16e-6f51e5a67743", + "type": "blocks" + }, + { + "dest-uuid": "1975d955-01ff-5cbb-8897-b08a0b235370", + "type": "affected-by" + }, + { + "dest-uuid": "15428e72-df7e-5483-a59c-bf84bb46928f", + "type": "affected-by" + } + ], + "uuid": "e81b12d2-491b-534a-88bb-221ab2cbf828", + "value": "Run a competing disinformation campaign - not recommended" + }, + { + "description": "", + "meta": { + "external_id": "C00211", + "kill_chain": [ + "tactics:Deliver Content", + "responsetypes:Disrupt", + "metatechniques:Countermessaging" + ], + "refs": [ + "https://github.com/DISARMFoundation/DISARMframeworks/blob/main/generated_pages/counters/C00211.md" + ] + }, + "related": [ + { + "dest-uuid": "73e482d1-500b-560c-a828-61661d25220e", + "type": "blocks" + }, + { + "dest-uuid": "bd7a51b3-d00c-575f-a16e-6f51e5a67743", + "type": "affected-by" + } + ], + "uuid": "4005deeb-3c1f-55e7-bf15-c6377169a4b6", + "value": "Use humorous counter-narratives" + }, + { + "description": "Increase public service experience, and support wider civics and history education.", + "meta": { + "external_id": "C00212", + "kill_chain": [ + "tactics:Plan Strategy", + "responsetypes:Disrupt", + "metatechniques:Resilience" + ], + "refs": [ + "https://github.com/DISARMFoundation/DISARMframeworks/blob/main/generated_pages/counters/C00212.md" + ] + }, + "related": [ + { + "dest-uuid": "aaaef5e2-4d1b-5fb6-ba0b-f79f2d3f4a2a", + "type": "blocks" + }, + { + "dest-uuid": "a73d7508-4e4b-57d8-9dbf-15ac73b65a15", + "type": "affected-by" + }, + { + "dest-uuid": "1975d955-01ff-5cbb-8897-b08a0b235370", + "type": "affected-by" + } + ], + "uuid": "d00320eb-5cc4-52e1-ae09-8b2d79affda2", + "value": "build public resilience by making civil society more vibrant" + }, + { + "description": "Prevent ad revenue going to disinformation domains", + "meta": { + "external_id": "C00216", + "kill_chain": [ + "tactics:Microtarget", + "responsetypes:Deny", + "metatechniques:Reduce Resources" + ], + "refs": [ + "https://github.com/DISARMFoundation/DISARMframeworks/blob/main/generated_pages/counters/C00216.md" + ] + }, + "related": [ + { + "dest-uuid": "f0bb5056-fedb-5507-8554-c958ec8d9fdc", + "type": "blocks" + }, + { + "dest-uuid": "6edba8b4-fe7a-5be0-84d0-6dee21d2a48e", + "type": "affected-by" + } + ], + "uuid": "bbb8b174-44b6-5f59-bcf0-eab169bc7be1", + "value": "Use advertiser controls to stem flow of funds to bad actors" + }, + { + "description": "Steganography. Adding date, signatures etc to stop issue of photo relabelling etc.", + "meta": { + "external_id": "C00219", + "kill_chain": [ + "tactics:Develop Content", + "responsetypes:Degrade", + "metatechniques:Daylight" + ], + "refs": [ + "https://github.com/DISARMFoundation/DISARMframeworks/blob/main/generated_pages/counters/C00219.md" + ] + }, + "related": [ + { + "dest-uuid": "4bdf195b-123b-541e-8003-184ebb595066", + "type": "blocks" + }, + { + "dest-uuid": "bd7a51b3-d00c-575f-a16e-6f51e5a67743", + "type": "affected-by" + } + ], + "uuid": "e9f8066e-2148-5399-b1b6-741888755067", + "value": "Add metadata to content that’s out of the control of disinformation creators" + }, + { + "description": "Create a plan for misinformation and disinformation response, before it's needed. Include connections / contacts needed, expected counteremessages etc.", + "meta": { + "external_id": "C00220", + "kill_chain": [ + "tactics:Plan Strategy", + "responsetypes:Disrupt", + "metatechniques:Metatechnique" + ], + "refs": [ + "https://github.com/DISARMFoundation/DISARMframeworks/blob/main/generated_pages/counters/C00220.md" + ] + }, + "related": [ + { + "dest-uuid": "bd7a51b3-d00c-575f-a16e-6f51e5a67743", + "type": "blocks" + }, + { + "dest-uuid": "bd7a51b3-d00c-575f-a16e-6f51e5a67743", + "type": "affected-by" + } + ], + "uuid": "1a0acda9-1fd1-5e88-a39f-942c9427eb82", + "value": "Develop a monitoring and intelligence plan" + }, + { + "description": "Include PACE plans - Primary, Alternate, Contingency, Emergency", + "meta": { + "external_id": "C00221", + "kill_chain": [ + "tactics:Plan Strategy", + "responsetypes:Disrupt", + "metatechniques:Metatechnique" + ], + "refs": [ + "https://github.com/DISARMFoundation/DISARMframeworks/blob/main/generated_pages/counters/C00221.md" + ] + }, + "related": [ + { + "dest-uuid": "bd7a51b3-d00c-575f-a16e-6f51e5a67743", + "type": "blocks" + }, + { + "dest-uuid": "bd7a51b3-d00c-575f-a16e-6f51e5a67743", + "type": "affected-by" + } + ], + "uuid": "2d17ef98-4701-58c1-8352-e952b0d42954", + "value": "Run a disinformation red team, and design mitigation factors" + }, + { + "description": "Simulate misinformation and disinformation campaigns, and responses to them, before campaigns happen.", + "meta": { + "external_id": "C00222", + "kill_chain": [ + "tactics:Plan Objectives", + "responsetypes:Disrupt", + "metatechniques:Metatechnique" + ], + "refs": [ + "https://github.com/DISARMFoundation/DISARMframeworks/blob/main/generated_pages/counters/C00222.md" + ] + }, + "related": [ + { + "dest-uuid": "bd7a51b3-d00c-575f-a16e-6f51e5a67743", + "type": "blocks" + }, + { + "dest-uuid": "bd7a51b3-d00c-575f-a16e-6f51e5a67743", + "type": "affected-by" + } + ], + "uuid": "a40936f8-d8ff-5956-a7fc-98f9ee02698b", + "value": "Tabletop simulations" + }, + { + "description": "Improve trust in the misinformation responses from social media and other platforms. Examples include creating greater transparancy on their actions and algorithms.", + "meta": { + "external_id": "C00223", + "kill_chain": [ + "tactics:Plan Strategy", + "responsetypes:Disrupt", + "metatechniques:Resilience" + ], + "refs": [ + "https://github.com/DISARMFoundation/DISARMframeworks/blob/main/generated_pages/counters/C00223.md" + ] + }, + "related": [ + { + "dest-uuid": "bd7a51b3-d00c-575f-a16e-6f51e5a67743", + "type": "blocks" + }, + { + "dest-uuid": "bd7a51b3-d00c-575f-a16e-6f51e5a67743", + "type": "affected-by" + } + ], + "uuid": "b21af50f-96cb-5c88-a6cf-f726c392778c", + "value": "Strengthen Trust in social media platforms" + } + ], + "version": 1 +} diff --git a/clusters/disarm-detections.json b/clusters/disarm-detections.json new file mode 100644 index 0000000..52e6fad --- /dev/null +++ b/clusters/disarm-detections.json @@ -0,0 +1,2390 @@ +{ + "authors": [ + "DISARM Project" + ], + "category": "disarm", + "description": "DISARM is a framework designed for describing and understanding disinformation incidents.", + "name": "Detections", + "source": "https://github.com/DISARMFoundation/DISARMframeworks", + "type": "disarm-detections", + "uuid": "98e0cf8c-baee-5b01-aca3-dd94a894aee3", + "values": [ + { + "description": "Examine failed campaigns. How did they fail? Can we create useful activities that increase these failures?", + "meta": { + "external_id": "F00001", + "kill_chain": [ + "tactics:Plan Strategy", + "responsetypes:Detect" + ], + "refs": [ + "https://github.com/DISARMFoundation/DISARMframeworks/blob/main/generated_pages/detections/F00001.md" + ] + }, + "related": [ + { + "dest-uuid": "97ff79d9-55d2-550a-8a10-459cad7822fb", + "type": "detects" + }, + { + "dest-uuid": "bd7a51b3-d00c-575f-a16e-6f51e5a67743", + "type": "detected-by" + } + ], + "uuid": "75e69ae8-aa72-5649-9a7a-6c21caa81cc6", + "value": "Analyse aborted / failed campaigns" + }, + { + "description": "We have no idea what this means. Is it something to do with the way a viral story spreads?", + "meta": { + "external_id": "F00002", + "kill_chain": [ + "tactics:Plan Strategy", + "responsetypes:Detect" + ], + "refs": [ + "https://github.com/DISARMFoundation/DISARMframeworks/blob/main/generated_pages/detections/F00002.md" + ] + }, + "related": [ + { + "dest-uuid": "ee7bc41a-9eb0-5732-924a-3885e1c3bee9", + "type": "detects" + }, + { + "dest-uuid": "bd7a51b3-d00c-575f-a16e-6f51e5a67743", + "type": "detected-by" + } + ], + "uuid": "1d6622ba-a713-5133-9017-8eef36469936", + "value": "Analyse viral fizzle" + }, + { + "description": "", + "meta": { + "external_id": "F00003", + "kill_chain": [ + "tactics:Plan Strategy", + "responsetypes:Detect" + ], + "refs": [ + "https://github.com/DISARMFoundation/DISARMframeworks/blob/main/generated_pages/detections/F00003.md" + ] + }, + "related": [ + { + "dest-uuid": "7f6b7a65-046f-5f9e-b802-e5c772c5d9e5", + "type": "detects" + }, + { + "dest-uuid": "bd7a51b3-d00c-575f-a16e-6f51e5a67743", + "type": "detected-by" + } + ], + "uuid": "fc5cee09-da90-5abc-a72a-7791171e354f", + "value": "Exploit counter-intelligence vs bad actors" + }, + { + "description": "", + "meta": { + "external_id": "F00004", + "kill_chain": [ + "tactics:Plan Strategy", + "responsetypes:Detect" + ], + "refs": [ + "https://github.com/DISARMFoundation/DISARMframeworks/blob/main/generated_pages/detections/F00004.md" + ] + }, + "related": [ + { + "dest-uuid": "26c314bb-ed05-5dbe-b672-c16c2f0fff52", + "type": "detects" + }, + { + "dest-uuid": "bd7a51b3-d00c-575f-a16e-6f51e5a67743", + "type": "detected-by" + } + ], + "uuid": "8e0b3604-c03c-5772-bccc-3a381ea6300a", + "value": "Recruit like-minded converts \"people who used to be in-group\"" + }, + { + "description": "Strengths, Weaknesses, Opportunities, Threats analysis of groups and audience segments.", + "meta": { + "external_id": "F00005", + "kill_chain": [ + "tactics:Plan Strategy", + "responsetypes:Detect" + ], + "refs": [ + "https://github.com/DISARMFoundation/DISARMframeworks/blob/main/generated_pages/detections/F00005.md" + ] + }, + "related": [ + { + "dest-uuid": "97ff79d9-55d2-550a-8a10-459cad7822fb", + "type": "detects" + }, + { + "dest-uuid": "bd7a51b3-d00c-575f-a16e-6f51e5a67743", + "type": "detected-by" + } + ], + "uuid": "ed6b8d9b-7b00-5b8d-9644-137b70d8d198", + "value": "SWOT Analysis of Cognition in Various Groups" + }, + { + "description": "", + "meta": { + "external_id": "F00006", + "kill_chain": [ + "tactics:Plan Strategy", + "responsetypes:Detect" + ], + "refs": [ + "https://github.com/DISARMFoundation/DISARMframeworks/blob/main/generated_pages/detections/F00006.md" + ] + }, + "related": [ + { + "dest-uuid": "0962328a-43c0-5604-b75e-44e4237f2b04", + "type": "detects" + }, + { + "dest-uuid": "bd7a51b3-d00c-575f-a16e-6f51e5a67743", + "type": "detected-by" + } + ], + "uuid": "d11d48e6-b484-5da2-8ac5-1de1fa42e459", + "value": "SWOT analysis of tech platforms" + }, + { + "description": "", + "meta": { + "external_id": "F00007", + "kill_chain": [ + "tactics:Plan Objectives", + "responsetypes:Detect" + ], + "refs": [ + "https://github.com/DISARMFoundation/DISARMframeworks/blob/main/generated_pages/detections/F00007.md" + ] + }, + "related": [ + { + "dest-uuid": "97ff79d9-55d2-550a-8a10-459cad7822fb", + "type": "detects" + }, + { + "dest-uuid": "bd7a51b3-d00c-575f-a16e-6f51e5a67743", + "type": "detected-by" + } + ], + "uuid": "4dbdd122-0e9d-5f8c-82ae-cd319c769a7f", + "value": "Monitor account level activity in social networks" + }, + { + "description": "", + "meta": { + "external_id": "F00008", + "kill_chain": [ + "tactics:Establish Social Assets", + "responsetypes:Detect" + ], + "refs": [ + "https://github.com/DISARMFoundation/DISARMframeworks/blob/main/generated_pages/detections/F00008.md" + ] + }, + "related": [ + { + "dest-uuid": "757ea53c-68b7-52dd-88ed-a8a95fe52fdf", + "type": "detects" + }, + { + "dest-uuid": "bd7a51b3-d00c-575f-a16e-6f51e5a67743", + "type": "detected-by" + } + ], + "uuid": "78e3e29a-4ab7-5880-88f8-c85ff323e240", + "value": "Detect abnormal amplification" + }, + { + "description": "", + "meta": { + "external_id": "F00009", + "kill_chain": [ + "tactics:Establish Social Assets", + "responsetypes:Detect" + ], + "refs": [ + "https://github.com/DISARMFoundation/DISARMframeworks/blob/main/generated_pages/detections/F00009.md" + ] + }, + "related": [ + { + "dest-uuid": "e3cbbc7a-da73-50fb-9893-4ce88edb211f", + "type": "detects" + }, + { + "dest-uuid": "bd7a51b3-d00c-575f-a16e-6f51e5a67743", + "type": "detected-by" + } + ], + "uuid": "42827d89-3a37-568e-9de3-8ebd379c3d8f", + "value": "Detect abnormal events" + }, + { + "description": "", + "meta": { + "external_id": "F00010", + "kill_chain": [ + "tactics:Establish Social Assets", + "responsetypes:Detect" + ], + "refs": [ + "https://github.com/DISARMFoundation/DISARMframeworks/blob/main/generated_pages/detections/F00010.md" + ] + }, + "related": [ + { + "dest-uuid": "e3cbbc7a-da73-50fb-9893-4ce88edb211f", + "type": "detects" + }, + { + "dest-uuid": "bd7a51b3-d00c-575f-a16e-6f51e5a67743", + "type": "detected-by" + } + ], + "uuid": "e39234ab-979c-51c8-8f34-5a9337bd030e", + "value": "Detect abnormal groups" + }, + { + "description": "", + "meta": { + "external_id": "F00011", + "kill_chain": [ + "tactics:Establish Social Assets", + "responsetypes:Detect" + ], + "refs": [ + "https://github.com/DISARMFoundation/DISARMframeworks/blob/main/generated_pages/detections/F00011.md" + ] + }, + "related": [ + { + "dest-uuid": "e3cbbc7a-da73-50fb-9893-4ce88edb211f", + "type": "detects" + }, + { + "dest-uuid": "bd7a51b3-d00c-575f-a16e-6f51e5a67743", + "type": "detected-by" + } + ], + "uuid": "6fc10d9d-96a5-5ae1-a0f7-0136a9819a6e", + "value": "Detect abnormal pages" + }, + { + "description": "", + "meta": { + "external_id": "F00012", + "kill_chain": [ + "tactics:Establish Social Assets", + "responsetypes:Detect" + ], + "refs": [ + "https://github.com/DISARMFoundation/DISARMframeworks/blob/main/generated_pages/detections/F00012.md" + ] + }, + "related": [ + { + "dest-uuid": "e3cbbc7a-da73-50fb-9893-4ce88edb211f", + "type": "detects" + }, + { + "dest-uuid": "bd7a51b3-d00c-575f-a16e-6f51e5a67743", + "type": "detected-by" + } + ], + "uuid": "345ea7b9-1504-57cf-9c8f-7b01613d89e6", + "value": "Detect abnormal profiles, e.g. prolific pages/ groups/ people" + }, + { + "description": "", + "meta": { + "external_id": "F00013", + "kill_chain": [ + "tactics:Establish Social Assets", + "responsetypes:Detect" + ], + "refs": [ + "https://github.com/DISARMFoundation/DISARMframeworks/blob/main/generated_pages/detections/F00013.md" + ] + }, + "related": [ + { + "dest-uuid": "56b88516-ae4c-5176-b6ed-6e9be91ce898", + "type": "detects" + }, + { + "dest-uuid": "bd7a51b3-d00c-575f-a16e-6f51e5a67743", + "type": "detected-by" + } + ], + "uuid": "efa0a8ef-9167-5727-925e-fc347a5eaf43", + "value": "Identify fake news sites" + }, + { + "description": "for e.g. fake news sites", + "meta": { + "external_id": "F00014", + "kill_chain": [ + "tactics:Establish Social Assets", + "responsetypes:Detect" + ], + "refs": [ + "https://github.com/DISARMFoundation/DISARMframeworks/blob/main/generated_pages/detections/F00014.md" + ] + }, + "related": [ + { + "dest-uuid": "56b88516-ae4c-5176-b6ed-6e9be91ce898", + "type": "detects" + }, + { + "dest-uuid": "bd7a51b3-d00c-575f-a16e-6f51e5a67743", + "type": "detected-by" + } + ], + "uuid": "17929228-9855-58ee-877f-d887300be287", + "value": "Trace connections" + }, + { + "description": "I include Fake Experts as they may use funding campaigns such as Patreon to fund their operations and so these should be watched.", + "meta": { + "external_id": "F00015", + "kill_chain": [ + "tactics:Establish Social Assets", + "responsetypes:Detect" + ], + "refs": [ + "https://github.com/DISARMFoundation/DISARMframeworks/blob/main/generated_pages/detections/F00015.md" + ] + }, + "related": [ + { + "dest-uuid": "2d40a01e-41a9-513a-bf0b-694dc0a87f8e", + "type": "detects" + }, + { + "dest-uuid": "bd7a51b3-d00c-575f-a16e-6f51e5a67743", + "type": "detected-by" + } + ], + "uuid": "6c2a5bff-9b42-5dc2-8d0d-a782dc597eec", + "value": "Detect anomalies in membership growth patterns" + }, + { + "description": "Note: In each case, depending on the platform there may be a way to identify a fence-sitter. For example, online polls may have a neutral option or a \"somewhat this-or-that\" option, and may reveal who voted for that to all visitors. This information could be of use to data analysts. In TA08-11, the engagement level of victims could be identified to detect and respond to increasing engagement.", + "meta": { + "external_id": "F00016", + "kill_chain": [ + "tactics:Establish Social Assets", + "responsetypes:Detect" + ], + "refs": [ + "https://github.com/DISARMFoundation/DISARMframeworks/blob/main/generated_pages/detections/F00016.md" + ] + }, + "related": [ + { + "dest-uuid": "5662c61e-eb2b-5710-8148-61457483efcc", + "type": "detects" + }, + { + "dest-uuid": "bd7a51b3-d00c-575f-a16e-6f51e5a67743", + "type": "detected-by" + } + ], + "uuid": "e680c5ac-0f33-508f-aaf5-6af31e227b00", + "value": "Identify fence-sitters" + }, + { + "description": "", + "meta": { + "external_id": "F00017", + "kill_chain": [ + "tactics:Establish Social Assets", + "responsetypes:Detect" + ], + "refs": [ + "https://github.com/DISARMFoundation/DISARMframeworks/blob/main/generated_pages/detections/F00017.md" + ] + }, + "related": [ + { + "dest-uuid": "aaaef5e2-4d1b-5fb6-ba0b-f79f2d3f4a2a", + "type": "detects" + }, + { + "dest-uuid": "bd7a51b3-d00c-575f-a16e-6f51e5a67743", + "type": "detected-by" + } + ], + "uuid": "a99c9858-85f8-5344-a23f-3a5b44438e84", + "value": "Measure emotional valence" + }, + { + "description": "track funding sources", + "meta": { + "external_id": "F00018", + "kill_chain": [ + "tactics:Establish Social Assets", + "responsetypes:Detect" + ], + "refs": [ + "https://github.com/DISARMFoundation/DISARMframeworks/blob/main/generated_pages/detections/F00018.md" + ] + }, + "related": [ + { + "dest-uuid": "29768133-b941-5974-ab10-c15bbb86e387", + "type": "detects" + }, + { + "dest-uuid": "bd7a51b3-d00c-575f-a16e-6f51e5a67743", + "type": "detected-by" + } + ], + "uuid": "25ca7eff-d789-5c36-a49d-34194b7246d4", + "value": "Follow the money" + }, + { + "description": "", + "meta": { + "external_id": "F00019", + "kill_chain": [ + "tactics:Establish Social Assets", + "responsetypes:Detect" + ], + "refs": [ + "https://github.com/DISARMFoundation/DISARMframeworks/blob/main/generated_pages/detections/F00019.md" + ] + }, + "related": [ + { + "dest-uuid": "d05396d6-9701-5ce3-a6cd-abff224310ae", + "type": "detects" + }, + { + "dest-uuid": "bd7a51b3-d00c-575f-a16e-6f51e5a67743", + "type": "detected-by" + } + ], + "uuid": "f8cab1cc-c87e-5338-90bc-18d071a01601", + "value": "Activity resurgence detection (alarm when dormant accounts become activated)" + }, + { + "description": "", + "meta": { + "external_id": "F00020", + "kill_chain": [ + "tactics:Establish Social Assets", + "responsetypes:Detect" + ], + "refs": [ + "https://github.com/DISARMFoundation/DISARMframeworks/blob/main/generated_pages/detections/F00020.md" + ] + }, + "related": [ + { + "dest-uuid": "d05396d6-9701-5ce3-a6cd-abff224310ae", + "type": "detects" + }, + { + "dest-uuid": "03aaf19c-42b9-5b8e-9d47-a6bb291f10fa", + "type": "detected-by" + }, + { + "dest-uuid": "f6c98378-65be-5f14-af3e-326909d70d77", + "type": "detected-by" + }, + { + "dest-uuid": "667967b8-b3f1-55ad-8f8a-8c43c1290e6e", + "type": "detected-by" + } + ], + "uuid": "187285bb-a282-5a6a-833e-01d9744165c4", + "value": "Detect anomalous activity" + }, + { + "description": "", + "meta": { + "external_id": "F00021", + "kill_chain": [ + "tactics:Establish Social Assets", + "responsetypes:Detect" + ], + "refs": [ + "https://github.com/DISARMFoundation/DISARMframeworks/blob/main/generated_pages/detections/F00021.md" + ] + }, + "related": [ + { + "dest-uuid": "a4d157eb-c3be-5119-9d59-7f7421f47bbd", + "type": "detects" + }, + { + "dest-uuid": "bd7a51b3-d00c-575f-a16e-6f51e5a67743", + "type": "detected-by" + } + ], + "uuid": "517e09d2-b9ce-5840-ab94-b77d1a7ddf40", + "value": "AI/ML automated early detection of campaign planning" + }, + { + "description": "", + "meta": { + "external_id": "F00022", + "kill_chain": [ + "tactics:Establish Social Assets", + "responsetypes:Detect" + ], + "refs": [ + "https://github.com/DISARMFoundation/DISARMframeworks/blob/main/generated_pages/detections/F00022.md" + ] + }, + "related": [ + { + "dest-uuid": "bd7a51b3-d00c-575f-a16e-6f51e5a67743", + "type": "detects" + }, + { + "dest-uuid": "bd7a51b3-d00c-575f-a16e-6f51e5a67743", + "type": "detected-by" + } + ], + "uuid": "bc159c39-4d1c-5e94-8e5d-c14b4dfa40f3", + "value": "Digital authority - regulating body (united states)" + }, + { + "description": "", + "meta": { + "external_id": "F00023", + "kill_chain": [ + "tactics:Establish Social Assets", + "responsetypes:Detect" + ], + "refs": [ + "https://github.com/DISARMFoundation/DISARMframeworks/blob/main/generated_pages/detections/F00023.md" + ] + }, + "related": [ + { + "dest-uuid": "d05396d6-9701-5ce3-a6cd-abff224310ae", + "type": "detects" + }, + { + "dest-uuid": "bd7a51b3-d00c-575f-a16e-6f51e5a67743", + "type": "detected-by" + } + ], + "uuid": "5012f883-a0ae-5181-bc69-d74b55b44d38", + "value": "Periodic verification (counter to hijack legitimate account)" + }, + { + "description": "", + "meta": { + "external_id": "F00024", + "kill_chain": [ + "tactics:Establish Social Assets", + "responsetypes:Detect" + ], + "refs": [ + "https://github.com/DISARMFoundation/DISARMframeworks/blob/main/generated_pages/detections/F00024.md" + ] + }, + "related": [ + { + "dest-uuid": "bd7a51b3-d00c-575f-a16e-6f51e5a67743", + "type": "detects" + }, + { + "dest-uuid": "bd7a51b3-d00c-575f-a16e-6f51e5a67743", + "type": "detected-by" + } + ], + "uuid": "8d1ec719-9eec-516e-8abc-7dbb94137350", + "value": "Teach civics to kids/ adults/ seniors" + }, + { + "description": "", + "meta": { + "external_id": "F00025", + "kill_chain": [ + "tactics:Microtarget", + "responsetypes:Detect" + ], + "refs": [ + "https://github.com/DISARMFoundation/DISARMframeworks/blob/main/generated_pages/detections/F00025.md" + ] + }, + "related": [ + { + "dest-uuid": "b8aee2a9-a979-5cd7-9c69-af4ad4adffea", + "type": "detects" + }, + { + "dest-uuid": "bd7a51b3-d00c-575f-a16e-6f51e5a67743", + "type": "detected-by" + } + ], + "uuid": "d70d7b69-1a2d-5b50-bf4f-2e2bcb36742a", + "value": "Boots-on-the-ground early narrative detection" + }, + { + "description": "", + "meta": { + "external_id": "F00026", + "kill_chain": [ + "tactics:Microtarget", + "responsetypes:Detect" + ], + "refs": [ + "https://github.com/DISARMFoundation/DISARMframeworks/blob/main/generated_pages/detections/F00026.md" + ] + }, + "related": [ + { + "dest-uuid": "bd7a51b3-d00c-575f-a16e-6f51e5a67743", + "type": "detects" + }, + { + "dest-uuid": "bd7a51b3-d00c-575f-a16e-6f51e5a67743", + "type": "detected-by" + } + ], + "uuid": "41ac8307-9432-5d65-9b81-81585f164c1e", + "value": "Language anomoly detection" + }, + { + "description": "", + "meta": { + "external_id": "F00027", + "kill_chain": [ + "tactics:Microtarget", + "responsetypes:Detect" + ], + "refs": [ + "https://github.com/DISARMFoundation/DISARMframeworks/blob/main/generated_pages/detections/F00027.md" + ] + }, + "related": [ + { + "dest-uuid": "bd7a51b3-d00c-575f-a16e-6f51e5a67743", + "type": "detects" + }, + { + "dest-uuid": "bd7a51b3-d00c-575f-a16e-6f51e5a67743", + "type": "detected-by" + } + ], + "uuid": "7866585b-dcb2-564e-91f9-b7daa3ef9bf6", + "value": "Unlikely correlation of sentiment on same topics" + }, + { + "description": "", + "meta": { + "external_id": "F00028", + "kill_chain": [ + "tactics:Develop Content", + "responsetypes:Detect" + ], + "refs": [ + "https://github.com/DISARMFoundation/DISARMframeworks/blob/main/generated_pages/detections/F00028.md" + ] + }, + "related": [ + { + "dest-uuid": "16146867-6f52-5a3c-bc2a-139755044726", + "type": "detects" + }, + { + "dest-uuid": "bd7a51b3-d00c-575f-a16e-6f51e5a67743", + "type": "detected-by" + } + ], + "uuid": "3724243e-6335-5bd5-9e18-39103748b7e0", + "value": "Associate a public key signature with government documents" + }, + { + "description": "", + "meta": { + "external_id": "F00029", + "kill_chain": [ + "tactics:Develop Content", + "responsetypes:Detect" + ], + "refs": [ + "https://github.com/DISARMFoundation/DISARMframeworks/blob/main/generated_pages/detections/F00029.md" + ] + }, + "related": [ + { + "dest-uuid": "b8aee2a9-a979-5cd7-9c69-af4ad4adffea", + "type": "detects" + }, + { + "dest-uuid": "bd7a51b3-d00c-575f-a16e-6f51e5a67743", + "type": "detected-by" + } + ], + "uuid": "170353ca-dd6b-5328-b34d-9fbcf13123c3", + "value": "Detect proto narratives, i.e. RT, Sputnik" + }, + { + "description": "", + "meta": { + "external_id": "F00030", + "kill_chain": [ + "tactics:Develop Content", + "responsetypes:Detect" + ], + "refs": [ + "https://github.com/DISARMFoundation/DISARMframeworks/blob/main/generated_pages/detections/F00030.md" + ] + }, + "related": [ + { + "dest-uuid": "a4d157eb-c3be-5119-9d59-7f7421f47bbd", + "type": "detects" + }, + { + "dest-uuid": "bd7a51b3-d00c-575f-a16e-6f51e5a67743", + "type": "detected-by" + } + ], + "uuid": "b4558055-afb8-52af-9f34-209f461da93a", + "value": "Early detection and warning - reporting of suspect content" + }, + { + "description": "Strategic planning included as innoculating population has strategic value.", + "meta": { + "external_id": "F00031", + "kill_chain": [ + "tactics:Develop Content", + "responsetypes:Detect" + ], + "refs": [ + "https://github.com/DISARMFoundation/DISARMframeworks/blob/main/generated_pages/detections/F00031.md" + ] + }, + "related": [ + { + "dest-uuid": "b8aee2a9-a979-5cd7-9c69-af4ad4adffea", + "type": "detects" + }, + { + "dest-uuid": "bd7a51b3-d00c-575f-a16e-6f51e5a67743", + "type": "detected-by" + } + ], + "uuid": "654777aa-9c4d-5df0-961b-a04967f8b997", + "value": "Educate on how to identify information pollution" + }, + { + "description": "DUPLICATE - DELETE", + "meta": { + "external_id": "F00032", + "kill_chain": [ + "tactics:Develop Content", + "responsetypes:Detect" + ], + "refs": [ + "https://github.com/DISARMFoundation/DISARMframeworks/blob/main/generated_pages/detections/F00032.md" + ] + }, + "related": [ + { + "dest-uuid": "3dbf1a2c-e225-50e5-8b24-32acad74cd5a", + "type": "detects" + }, + { + "dest-uuid": "bd7a51b3-d00c-575f-a16e-6f51e5a67743", + "type": "detected-by" + } + ], + "uuid": "5ecd72f3-7085-599d-b8b2-fb9f98ee2529", + "value": "Educate on how to identify to pollution" + }, + { + "description": "", + "meta": { + "external_id": "F00033", + "kill_chain": [ + "tactics:Develop Content", + "responsetypes:Detect" + ], + "refs": [ + "https://github.com/DISARMFoundation/DISARMframeworks/blob/main/generated_pages/detections/F00033.md" + ] + }, + "related": [ + { + "dest-uuid": "534951bc-8d1e-58be-b051-c9243eac96fb", + "type": "detects" + }, + { + "dest-uuid": "bd7a51b3-d00c-575f-a16e-6f51e5a67743", + "type": "detected-by" + } + ], + "uuid": "594ec374-28b9-5191-8bb7-edd9196daf4e", + "value": "Fake websites: add transparency on business model" + }, + { + "description": "", + "meta": { + "external_id": "F00034", + "kill_chain": [ + "tactics:Develop Content", + "responsetypes:Detect" + ], + "refs": [ + "https://github.com/DISARMFoundation/DISARMframeworks/blob/main/generated_pages/detections/F00034.md" + ] + }, + "related": [ + { + "dest-uuid": "ee7bc41a-9eb0-5732-924a-3885e1c3bee9", + "type": "detects" + }, + { + "dest-uuid": "bd7a51b3-d00c-575f-a16e-6f51e5a67743", + "type": "detected-by" + } + ], + "uuid": "ea1d787b-61f7-5fd6-8c52-54a64006e260", + "value": "Flag the information spaces so people know about active flooding effort" + }, + { + "description": "", + "meta": { + "external_id": "F00035", + "kill_chain": [ + "tactics:Develop Content", + "responsetypes:Detect" + ], + "refs": [ + "https://github.com/DISARMFoundation/DISARMframeworks/blob/main/generated_pages/detections/F00035.md" + ] + }, + "related": [ + { + "dest-uuid": "b8aee2a9-a979-5cd7-9c69-af4ad4adffea", + "type": "detects" + }, + { + "dest-uuid": "bd7a51b3-d00c-575f-a16e-6f51e5a67743", + "type": "detected-by" + } + ], + "uuid": "822de3d6-7c85-56ff-ba4e-3e6b7b5a3a0c", + "value": "Identify repeated narrative DNA" + }, + { + "description": "", + "meta": { + "external_id": "F00036", + "kill_chain": [ + "tactics:Develop Content", + "responsetypes:Detect" + ], + "refs": [ + "https://github.com/DISARMFoundation/DISARMframeworks/blob/main/generated_pages/detections/F00036.md" + ] + }, + "related": [ + { + "dest-uuid": "635f5592-0e2a-5f06-b164-c5af2ec9ef5e", + "type": "detects" + }, + { + "dest-uuid": "bd7a51b3-d00c-575f-a16e-6f51e5a67743", + "type": "detected-by" + } + ], + "uuid": "30be4903-350a-505c-9166-fa65b8894778", + "value": "Looking for AB testing in unregulated channels" + }, + { + "description": "Original Comment: Shortcomings: intentional falsehood. Doesn't solve accuracy. Can't be mandatory. Technique should be in terms of \"strategic innoculation\", raising the standards of what people expect in terms of evidence when consuming news.", + "meta": { + "external_id": "F00037", + "kill_chain": [ + "tactics:Develop Content", + "responsetypes:Detect" + ], + "refs": [ + "https://github.com/DISARMFoundation/DISARMframeworks/blob/main/generated_pages/detections/F00037.md" + ] + }, + "related": [ + { + "dest-uuid": "b8aee2a9-a979-5cd7-9c69-af4ad4adffea", + "type": "detects" + }, + { + "dest-uuid": "bd7a51b3-d00c-575f-a16e-6f51e5a67743", + "type": "detected-by" + } + ], + "uuid": "b0bbccef-6728-51c8-a7e7-86c0f6526572", + "value": "News content provenance certification." + }, + { + "description": "Unsure I understood the original intention or what it applied to. Therefore the techniques listed (10, 39, 43, 57, 61) are under my interpretation - which is that we want to track ignorant agents who fall into the enemy's trap and show a cost to financing/reposting/helping the adversary via public shaming or other means.", + "meta": { + "external_id": "F00038", + "kill_chain": [ + "tactics:Develop Content", + "responsetypes:Detect" + ], + "refs": [ + "https://github.com/DISARMFoundation/DISARMframeworks/blob/main/generated_pages/detections/F00038.md" + ] + }, + "related": [ + { + "dest-uuid": "39baec3d-f2ce-5fee-ba7d-3db7d6469946", + "type": "detects" + }, + { + "dest-uuid": "bd7a51b3-d00c-575f-a16e-6f51e5a67743", + "type": "detected-by" + } + ], + "uuid": "8c281e28-298e-5c1b-8e44-f768006d6c26", + "value": "Social capital as attack vector" + }, + { + "description": "", + "meta": { + "external_id": "F00039", + "kill_chain": [ + "tactics:Develop Content", + "responsetypes:Detect" + ], + "refs": [ + "https://github.com/DISARMFoundation/DISARMframeworks/blob/main/generated_pages/detections/F00039.md" + ] + }, + "related": [ + { + "dest-uuid": "4bdf195b-123b-541e-8003-184ebb595066", + "type": "detects" + }, + { + "dest-uuid": "bd7a51b3-d00c-575f-a16e-6f51e5a67743", + "type": "detected-by" + } + ], + "uuid": "a1295bd6-ff4a-5cec-ac9a-54eac5aea88a", + "value": "standards to track image/ video deep fakes - industry" + }, + { + "description": "", + "meta": { + "external_id": "F00040", + "kill_chain": [ + "tactics:Develop Content", + "responsetypes:Detect" + ], + "refs": [ + "https://github.com/DISARMFoundation/DISARMframeworks/blob/main/generated_pages/detections/F00040.md" + ] + }, + "related": [ + { + "dest-uuid": "4bdf195b-123b-541e-8003-184ebb595066", + "type": "detects" + }, + { + "dest-uuid": "bd7a51b3-d00c-575f-a16e-6f51e5a67743", + "type": "detected-by" + } + ], + "uuid": "b0b46532-aa0f-5198-bae7-29ca673ec691", + "value": "Unalterable metadata signature on origins of image and provenance" + }, + { + "description": "Not technically left of boom", + "meta": { + "external_id": "F00041", + "kill_chain": [ + "tactics:Select Channels and Affordances", + "responsetypes:Detect" + ], + "refs": [ + "https://github.com/DISARMFoundation/DISARMframeworks/blob/main/generated_pages/detections/F00041.md" + ] + }, + "related": [ + { + "dest-uuid": "a40f1ed2-a79a-569d-98f2-4f837ee19fd2", + "type": "detects" + }, + { + "dest-uuid": "bd7a51b3-d00c-575f-a16e-6f51e5a67743", + "type": "detected-by" + } + ], + "uuid": "7cf74b30-8a9a-5d0c-a156-eaca03cfcc16", + "value": "Bias detection" + }, + { + "description": "Use T00029, but against the creators", + "meta": { + "external_id": "F00042", + "kill_chain": [ + "tactics:Select Channels and Affordances", + "responsetypes:Detect" + ], + "refs": [ + "https://github.com/DISARMFoundation/DISARMframeworks/blob/main/generated_pages/detections/F00042.md" + ] + }, + "related": [ + { + "dest-uuid": "a40f1ed2-a79a-569d-98f2-4f837ee19fd2", + "type": "detects" + }, + { + "dest-uuid": "bd7a51b3-d00c-575f-a16e-6f51e5a67743", + "type": "detected-by" + } + ], + "uuid": "4d467669-bece-51ed-afdf-d0dfb91bdbfc", + "value": "Categorise polls by intent" + }, + { + "description": "Platform companies and some information security companies (e.g. ZeroFox) do this.", + "meta": { + "external_id": "F00043", + "kill_chain": [ + "tactics:Select Channels and Affordances", + "responsetypes:Detect" + ], + "refs": [ + "https://github.com/DISARMFoundation/DISARMframeworks/blob/main/generated_pages/detections/F00043.md" + ] + }, + "related": [ + { + "dest-uuid": "6ffaa1a5-5d29-5b28-91fb-dca2df62769c", + "type": "detects" + }, + { + "dest-uuid": "f6c98378-65be-5f14-af3e-326909d70d77", + "type": "detected-by" + }, + { + "dest-uuid": "667967b8-b3f1-55ad-8f8a-8c43c1290e6e", + "type": "detected-by" + } + ], + "uuid": "94d622e2-5909-5f88-aaaf-846907cbda1f", + "value": "Monitor for creation of fake known personas" + }, + { + "description": "Can be used in all phases for all techniques.", + "meta": { + "external_id": "F00044", + "kill_chain": [ + "tactics:Conduct Pump Priming", + "responsetypes:Detect" + ], + "refs": [ + "https://github.com/DISARMFoundation/DISARMframeworks/blob/main/generated_pages/detections/F00044.md" + ] + }, + "related": [ + { + "dest-uuid": "97ff79d9-55d2-550a-8a10-459cad7822fb", + "type": "detects" + }, + { + "dest-uuid": "bd7a51b3-d00c-575f-a16e-6f51e5a67743", + "type": "detected-by" + } + ], + "uuid": "4b759b91-df67-5892-8ed4-c66b4dae49a7", + "value": "Forensic analysis" + }, + { + "description": "Can be used in all phases for all techniques.", + "meta": { + "external_id": "F00045", + "kill_chain": [ + "tactics:Conduct Pump Priming", + "responsetypes:Detect" + ], + "refs": [ + "https://github.com/DISARMFoundation/DISARMframeworks/blob/main/generated_pages/detections/F00045.md" + ] + }, + "related": [ + { + "dest-uuid": "97ff79d9-55d2-550a-8a10-459cad7822fb", + "type": "detects" + }, + { + "dest-uuid": "bd7a51b3-d00c-575f-a16e-6f51e5a67743", + "type": "detected-by" + } + ], + "uuid": "c8adc5de-1c61-5828-a9bb-e1ca665f69ad", + "value": "Forensic linguistic analysis" + }, + { + "description": "", + "meta": { + "external_id": "F00046", + "kill_chain": [ + "tactics:Conduct Pump Priming", + "responsetypes:Detect" + ], + "refs": [ + "https://github.com/DISARMFoundation/DISARMframeworks/blob/main/generated_pages/detections/F00046.md" + ] + }, + "related": [ + { + "dest-uuid": "5662c61e-eb2b-5710-8148-61457483efcc", + "type": "detects" + }, + { + "dest-uuid": "bd7a51b3-d00c-575f-a16e-6f51e5a67743", + "type": "detected-by" + } + ], + "uuid": "ff0b26c9-59c7-5fcf-818f-7a3fbdb50cd3", + "value": "Pump priming analytics" + }, + { + "description": "", + "meta": { + "external_id": "F00047", + "kill_chain": [ + "tactics:Conduct Pump Priming", + "responsetypes:Detect" + ], + "refs": [ + "https://github.com/DISARMFoundation/DISARMframeworks/blob/main/generated_pages/detections/F00047.md" + ] + }, + "related": [ + { + "dest-uuid": "bd7a51b3-d00c-575f-a16e-6f51e5a67743", + "type": "detects" + }, + { + "dest-uuid": "bd7a51b3-d00c-575f-a16e-6f51e5a67743", + "type": "detected-by" + } + ], + "uuid": "bf43738a-5adb-5cb2-953a-ca57e979c8c0", + "value": "trace involved parties" + }, + { + "description": "", + "meta": { + "external_id": "F00048", + "kill_chain": [ + "tactics:Conduct Pump Priming", + "responsetypes:Detect" + ], + "refs": [ + "https://github.com/DISARMFoundation/DISARMframeworks/blob/main/generated_pages/detections/F00048.md" + ] + }, + "related": [ + { + "dest-uuid": "bd7a51b3-d00c-575f-a16e-6f51e5a67743", + "type": "detects" + }, + { + "dest-uuid": "bd7a51b3-d00c-575f-a16e-6f51e5a67743", + "type": "detected-by" + } + ], + "uuid": "ea3a1738-319f-558c-97f4-e4cf8e6a6218", + "value": "Trace known operations and connection" + }, + { + "description": "", + "meta": { + "external_id": "F00049", + "kill_chain": [ + "tactics:Conduct Pump Priming", + "responsetypes:Detect" + ], + "refs": [ + "https://github.com/DISARMFoundation/DISARMframeworks/blob/main/generated_pages/detections/F00049.md" + ] + }, + "related": [ + { + "dest-uuid": "bd7a51b3-d00c-575f-a16e-6f51e5a67743", + "type": "detects" + }, + { + "dest-uuid": "bd7a51b3-d00c-575f-a16e-6f51e5a67743", + "type": "detected-by" + } + ], + "uuid": "706d5237-3e06-598d-9a95-27af1481c686", + "value": "trace money" + }, + { + "description": "", + "meta": { + "external_id": "F00050", + "kill_chain": [ + "tactics:Conduct Pump Priming", + "responsetypes:Detect" + ], + "refs": [ + "https://github.com/DISARMFoundation/DISARMframeworks/blob/main/generated_pages/detections/F00050.md" + ] + }, + "related": [ + { + "dest-uuid": "bd7a51b3-d00c-575f-a16e-6f51e5a67743", + "type": "detects" + }, + { + "dest-uuid": "bd7a51b3-d00c-575f-a16e-6f51e5a67743", + "type": "detected-by" + } + ], + "uuid": "71d9ceb8-b6e4-5825-9374-2658ac012ee9", + "value": "Web cache analytics" + }, + { + "description": "", + "meta": { + "external_id": "F00051", + "kill_chain": [ + "tactics:Deliver Content", + "responsetypes:Detect" + ], + "refs": [ + "https://github.com/DISARMFoundation/DISARMframeworks/blob/main/generated_pages/detections/F00051.md" + ] + }, + "related": [ + { + "dest-uuid": "29768133-b941-5974-ab10-c15bbb86e387", + "type": "detects" + }, + { + "dest-uuid": "bd7a51b3-d00c-575f-a16e-6f51e5a67743", + "type": "detected-by" + } + ], + "uuid": "bd602fee-4354-5b31-99f1-832053c1bba0", + "value": "Challenge expertise" + }, + { + "description": "Discovering the sponsors behind a campaign, narrative, bot, a set of accounts, or a social media comment, or anything else is useful.", + "meta": { + "external_id": "F00052", + "kill_chain": [ + "tactics:Deliver Content", + "responsetypes:Detect" + ], + "refs": [ + "https://github.com/DISARMFoundation/DISARMframeworks/blob/main/generated_pages/detections/F00052.md" + ] + }, + "related": [ + { + "dest-uuid": "97ff79d9-55d2-550a-8a10-459cad7822fb", + "type": "detects" + }, + { + "dest-uuid": "bd7a51b3-d00c-575f-a16e-6f51e5a67743", + "type": "detected-by" + } + ], + "uuid": "528787be-dd7e-51b6-ad12-f11abb67f76f", + "value": "Discover sponsors" + }, + { + "description": "", + "meta": { + "external_id": "F00053", + "kill_chain": [ + "tactics:Deliver Content", + "responsetypes:Detect" + ], + "refs": [ + "https://github.com/DISARMFoundation/DISARMframeworks/blob/main/generated_pages/detections/F00053.md" + ] + }, + "related": [ + { + "dest-uuid": "ee7bc41a-9eb0-5732-924a-3885e1c3bee9", + "type": "detects" + }, + { + "dest-uuid": "bd7a51b3-d00c-575f-a16e-6f51e5a67743", + "type": "detected-by" + } + ], + "uuid": "8b20ca17-c2d9-5879-bbf1-26de876c8e02", + "value": "Government rumour control office (what can we learn?)" + }, + { + "description": "", + "meta": { + "external_id": "F00054", + "kill_chain": [ + "tactics:Deliver Content", + "responsetypes:Detect" + ], + "refs": [ + "https://github.com/DISARMFoundation/DISARMframeworks/blob/main/generated_pages/detections/F00054.md" + ] + }, + "related": [ + { + "dest-uuid": "bd7a51b3-d00c-575f-a16e-6f51e5a67743", + "type": "detects" + }, + { + "dest-uuid": "bd7a51b3-d00c-575f-a16e-6f51e5a67743", + "type": "detected-by" + } + ], + "uuid": "66a481ae-0784-53f7-882a-4dc694645893", + "value": "Restrict people who can @ you on social networks" + }, + { + "description": "", + "meta": { + "external_id": "F00055", + "kill_chain": [ + "tactics:Deliver Content", + "responsetypes:Detect" + ], + "refs": [ + "https://github.com/DISARMFoundation/DISARMframeworks/blob/main/generated_pages/detections/F00055.md" + ] + }, + "related": [ + { + "dest-uuid": "bd7a51b3-d00c-575f-a16e-6f51e5a67743", + "type": "detects" + }, + { + "dest-uuid": "bd7a51b3-d00c-575f-a16e-6f51e5a67743", + "type": "detected-by" + } + ], + "uuid": "d8ca3a04-7e1b-5195-bc8c-e0823a3bcfb2", + "value": "Verify credentials" + }, + { + "description": "", + "meta": { + "external_id": "F00056", + "kill_chain": [ + "tactics:Deliver Content", + "responsetypes:Detect" + ], + "refs": [ + "https://github.com/DISARMFoundation/DISARMframeworks/blob/main/generated_pages/detections/F00056.md" + ] + }, + "related": [ + { + "dest-uuid": "bd7a51b3-d00c-575f-a16e-6f51e5a67743", + "type": "detects" + }, + { + "dest-uuid": "bd7a51b3-d00c-575f-a16e-6f51e5a67743", + "type": "detected-by" + } + ], + "uuid": "89269d38-c735-5e9d-b0f5-f6e040b02139", + "value": "Verify organisation legitimacy" + }, + { + "description": "", + "meta": { + "external_id": "F00057", + "kill_chain": [ + "tactics:Deliver Content", + "responsetypes:Detect" + ], + "refs": [ + "https://github.com/DISARMFoundation/DISARMframeworks/blob/main/generated_pages/detections/F00057.md" + ] + }, + "related": [ + { + "dest-uuid": "bd7a51b3-d00c-575f-a16e-6f51e5a67743", + "type": "detects" + }, + { + "dest-uuid": "bd7a51b3-d00c-575f-a16e-6f51e5a67743", + "type": "detected-by" + } + ], + "uuid": "f61f564f-4dc0-50fe-b848-8d7f5d624f9f", + "value": "Verify personal credentials of experts" + }, + { + "description": "*Deplatform People: This technique needs to be a bit more specific to distinguish it from \"account removal\" or DDOS and other techniques that get more specific when applied to content. For example, other ways of deplatforming people include attacking their sources of funds, their allies, their followers, etc.", + "meta": { + "external_id": "F00058", + "kill_chain": [ + "tactics:Drive Offline Activity", + "responsetypes:Detect" + ], + "refs": [ + "https://github.com/DISARMFoundation/DISARMframeworks/blob/main/generated_pages/detections/F00058.md" + ] + }, + "related": [ + { + "dest-uuid": "2d40a01e-41a9-513a-bf0b-694dc0a87f8e", + "type": "detects" + }, + { + "dest-uuid": "bd7a51b3-d00c-575f-a16e-6f51e5a67743", + "type": "detected-by" + } + ], + "uuid": "fc4964c6-85ce-59e5-b1c2-73d6335e33a2", + "value": "Deplatform (cancel culture)" + }, + { + "description": "All techniques provide or are susceptible to being countered by, or leveraged for, knowledge about user demographics.", + "meta": { + "external_id": "F00059", + "kill_chain": [ + "tactics:Drive Offline Activity", + "responsetypes:Detect" + ], + "refs": [ + "https://github.com/DISARMFoundation/DISARMframeworks/blob/main/generated_pages/detections/F00059.md" + ] + }, + "related": [ + { + "dest-uuid": "97ff79d9-55d2-550a-8a10-459cad7822fb", + "type": "detects" + }, + { + "dest-uuid": "bd7a51b3-d00c-575f-a16e-6f51e5a67743", + "type": "detected-by" + } + ], + "uuid": "41290a19-6427-593f-9d61-67be6a48f2b2", + "value": "Identify susceptible demographics" + }, + { + "description": "I assume this was a transcript error. Otherwise, \"Identify Susceptible Influences\" as in the various methods of influences that may work against a victim could also be a technique. Nope, wasn't a transcript error: original note says influencers, as in find people of influence that might be targetted.", + "meta": { + "external_id": "F00060", + "kill_chain": [ + "tactics:Drive Offline Activity", + "responsetypes:Detect" + ], + "refs": [ + "https://github.com/DISARMFoundation/DISARMframeworks/blob/main/generated_pages/detections/F00060.md" + ] + }, + "related": [ + { + "dest-uuid": "53e8c51b-c178-5429-8cee-022c6741cc91", + "type": "detects" + }, + { + "dest-uuid": "bd7a51b3-d00c-575f-a16e-6f51e5a67743", + "type": "detected-by" + } + ], + "uuid": "f29dff54-af05-55d1-a056-899007481493", + "value": "Identify susceptible influencers" + }, + { + "description": "", + "meta": { + "external_id": "F00061", + "kill_chain": [ + "tactics:Drive Offline Activity", + "responsetypes:Detect" + ], + "refs": [ + "https://github.com/DISARMFoundation/DISARMframeworks/blob/main/generated_pages/detections/F00061.md" + ] + }, + "related": [ + { + "dest-uuid": "97ff79d9-55d2-550a-8a10-459cad7822fb", + "type": "detects" + }, + { + "dest-uuid": "bd7a51b3-d00c-575f-a16e-6f51e5a67743", + "type": "detected-by" + } + ], + "uuid": "ec3270cb-ffe3-597d-a89b-ea58d1467963", + "value": "Microtargeting" + }, + { + "description": "", + "meta": { + "external_id": "F00062", + "kill_chain": [ + "tactics:Persist in the Information Environment", + "responsetypes:Detect" + ], + "refs": [ + "https://github.com/DISARMFoundation/DISARMframeworks/blob/main/generated_pages/detections/F00062.md" + ] + }, + "related": [ + { + "dest-uuid": "86fb0db5-4454-51d2-af95-4c037ae8c142", + "type": "detects" + }, + { + "dest-uuid": "bd7a51b3-d00c-575f-a16e-6f51e5a67743", + "type": "detected-by" + } + ], + "uuid": "e753055a-3af7-54f0-9be3-c119964e3e94", + "value": "Detect when Dormant account turns active" + }, + { + "description": "", + "meta": { + "external_id": "F00063", + "kill_chain": [ + "tactics:Persist in the Information Environment", + "responsetypes:Detect" + ], + "refs": [ + "https://github.com/DISARMFoundation/DISARMframeworks/blob/main/generated_pages/detections/F00063.md" + ] + }, + "related": [ + { + "dest-uuid": "bd7a51b3-d00c-575f-a16e-6f51e5a67743", + "type": "detects" + }, + { + "dest-uuid": "bd7a51b3-d00c-575f-a16e-6f51e5a67743", + "type": "detected-by" + } + ], + "uuid": "7636a2a0-40b9-5df6-b869-ddaf43e6434d", + "value": "Linguistic change analysis" + }, + { + "description": "", + "meta": { + "external_id": "F00064", + "kill_chain": [ + "tactics:Persist in the Information Environment", + "responsetypes:Detect" + ], + "refs": [ + "https://github.com/DISARMFoundation/DISARMframeworks/blob/main/generated_pages/detections/F00064.md" + ] + }, + "related": [ + { + "dest-uuid": "d05396d6-9701-5ce3-a6cd-abff224310ae", + "type": "detects" + }, + { + "dest-uuid": "bd7a51b3-d00c-575f-a16e-6f51e5a67743", + "type": "detected-by" + } + ], + "uuid": "65634c12-ec5f-5a3c-b329-94d3dd84b58e", + "value": "Monitor reports of account takeover" + }, + { + "description": "", + "meta": { + "external_id": "F00065", + "kill_chain": [ + "tactics:Persist in the Information Environment", + "responsetypes:Detect" + ], + "refs": [ + "https://github.com/DISARMFoundation/DISARMframeworks/blob/main/generated_pages/detections/F00065.md" + ] + }, + "related": [ + { + "dest-uuid": "bd7a51b3-d00c-575f-a16e-6f51e5a67743", + "type": "detects" + }, + { + "dest-uuid": "bd7a51b3-d00c-575f-a16e-6f51e5a67743", + "type": "detected-by" + } + ], + "uuid": "80cc8110-5b4e-5d7d-a55b-9daa061a8338", + "value": "Sentiment change analysis" + }, + { + "description": "", + "meta": { + "external_id": "F00066", + "kill_chain": [ + "tactics:Persist in the Information Environment", + "responsetypes:Detect" + ], + "refs": [ + "https://github.com/DISARMFoundation/DISARMframeworks/blob/main/generated_pages/detections/F00066.md" + ] + }, + "related": [ + { + "dest-uuid": "bd7a51b3-d00c-575f-a16e-6f51e5a67743", + "type": "detects" + }, + { + "dest-uuid": "bd7a51b3-d00c-575f-a16e-6f51e5a67743", + "type": "detected-by" + } + ], + "uuid": "2e11ee85-08d6-5a14-82a4-a11551911725", + "value": "Use language errors, time to respond to account bans and lawsuits, to indicate capabilities" + }, + { + "description": "", + "meta": { + "external_id": "F00067", + "kill_chain": [ + "responsetypes:Detect" + ], + "refs": [ + "https://github.com/DISARMFoundation/DISARMframeworks/blob/main/generated_pages/detections/F00067.md" + ] + }, + "related": [ + { + "dest-uuid": "bd7a51b3-d00c-575f-a16e-6f51e5a67743", + "type": "detects" + }, + { + "dest-uuid": "03aaf19c-42b9-5b8e-9d47-a6bb291f10fa", + "type": "detected-by" + } + ], + "uuid": "d4f0dd4b-6818-52a4-b4ca-e1fef024c1a0", + "value": "Data forensics" + }, + { + "description": "a developing methodology for identifying statistical differences in how social groups use language and quantifying how common those statistical differences are within a larger population. In essence, it hypothesises how much affinity might exist for a specific group within a general population, based on the language its members employ", + "meta": { + "external_id": "F00068", + "kill_chain": [ + "responsetypes:Detect" + ], + "refs": [ + "https://github.com/DISARMFoundation/DISARMframeworks/blob/main/generated_pages/detections/F00068.md" + ] + }, + "related": [ + { + "dest-uuid": "bd7a51b3-d00c-575f-a16e-6f51e5a67743", + "type": "detects" + }, + { + "dest-uuid": "bd7a51b3-d00c-575f-a16e-6f51e5a67743", + "type": "detected-by" + } + ], + "uuid": "0526c125-b71b-5b9a-ad09-9a7335512683", + "value": "Resonance analysis" + }, + { + "description": "To effectively counter Russian propaganda, it will be critical to track Russian influence efforts. The information requirements are varied and include the following: • Identify fake-news stories and their sources. • Understand narrative themes and content that pervade various Russian media sources. • Understand the broader Russian strategy that underlies tactical propaganda messaging.", + "meta": { + "external_id": "F00069", + "kill_chain": [ + "responsetypes:Detect" + ], + "refs": [ + "https://github.com/DISARMFoundation/DISARMframeworks/blob/main/generated_pages/detections/F00069.md" + ] + }, + "related": [ + { + "dest-uuid": "bd7a51b3-d00c-575f-a16e-6f51e5a67743", + "type": "detects" + }, + { + "dest-uuid": "bd7a51b3-d00c-575f-a16e-6f51e5a67743", + "type": "detected-by" + } + ], + "uuid": "5dc683fc-108e-5002-b310-0b140ad449aa", + "value": "Track Russian media and develop analytic methods." + }, + { + "description": "", + "meta": { + "external_id": "F00070", + "kill_chain": [ + "responsetypes:Detect" + ], + "refs": [ + "https://github.com/DISARMFoundation/DISARMframeworks/blob/main/generated_pages/detections/F00070.md" + ] + }, + "related": [ + { + "dest-uuid": "bd7a51b3-d00c-575f-a16e-6f51e5a67743", + "type": "detects" + }, + { + "dest-uuid": "03aaf19c-42b9-5b8e-9d47-a6bb291f10fa", + "type": "detected-by" + } + ], + "uuid": "5aca53f0-2c85-5298-9eeb-4ac8325abb6b", + "value": "Full spectrum analytics" + }, + { + "description": "Local influencers detected via Twitter networks are likely local influencers in other online and off-line channels as well. In addition, the content and themes gleaned from Russia and Russia-supporting populations, as well as anti-Russia activists, likely swirl in other online and off-line mediums as well.", + "meta": { + "external_id": "F00071", + "kill_chain": [ + "responsetypes:Detect" + ], + "refs": [ + "https://github.com/DISARMFoundation/DISARMframeworks/blob/main/generated_pages/detections/F00071.md" + ] + }, + "related": [ + { + "dest-uuid": "bd7a51b3-d00c-575f-a16e-6f51e5a67743", + "type": "detects" + }, + { + "dest-uuid": "03aaf19c-42b9-5b8e-9d47-a6bb291f10fa", + "type": "detected-by" + } + ], + "uuid": "d24431db-fc6e-5c62-b3d0-113a2219dbec", + "value": "Network analysis Identify/cultivate/support influencers" + }, + { + "description": "It is possible that some of these are bots or trolls and could be flagged for suspension for violating Twitter’s terms of service.", + "meta": { + "external_id": "F00072", + "kill_chain": [ + "responsetypes:Detect" + ], + "refs": [ + "https://github.com/DISARMFoundation/DISARMframeworks/blob/main/generated_pages/detections/F00072.md" + ] + }, + "related": [ + { + "dest-uuid": "bd7a51b3-d00c-575f-a16e-6f51e5a67743", + "type": "detects" + }, + { + "dest-uuid": "03aaf19c-42b9-5b8e-9d47-a6bb291f10fa", + "type": "detected-by" + } + ], + "uuid": "745658e5-5437-5f92-b2c4-80569a3cb330", + "value": "network analysis to identify central users in the pro-Russia activist community." + }, + { + "description": "Players at the level of covert attribution, referred to as “black” in the grayscale of deniability, produce content on user-generated media, such as YouTube, but also add fear-mongering commentary to and amplify content produced by others and supply exploitable content to data dump websites. These activities are conducted by a network of trolls, bots, honeypots, and hackers.", + "meta": { + "external_id": "F00073", + "kill_chain": [ + "responsetypes:Detect" + ], + "refs": [ + "https://github.com/DISARMFoundation/DISARMframeworks/blob/main/generated_pages/detections/F00073.md" + ] + }, + "related": [ + { + "dest-uuid": "bd7a51b3-d00c-575f-a16e-6f51e5a67743", + "type": "detects" + }, + { + "dest-uuid": "bd7a51b3-d00c-575f-a16e-6f51e5a67743", + "type": "detected-by" + } + ], + "uuid": "c49826e9-6226-5b17-96d8-bb80cee5d67f", + "value": "collect intel/recon on black/covert content creators/manipulators" + }, + { + "description": "brand ambassador programmes could be used with influencers across a variety of social media channels. It could also target other prominent experts, such as academics, business leaders, and other potentially prominent people. Authorities must ultimately take care in implementing such a programme given the risk that contact with U.S. or NATO authorities might damage influencer reputations. Engagements must consequently be made with care, and, if possible, government interlocutors should work through local NGOs.", + "meta": { + "external_id": "F00074", + "kill_chain": [ + "responsetypes:Detect" + ], + "refs": [ + "https://github.com/DISARMFoundation/DISARMframeworks/blob/main/generated_pages/detections/F00074.md" + ] + }, + "related": [ + { + "dest-uuid": "bd7a51b3-d00c-575f-a16e-6f51e5a67743", + "type": "detects" + }, + { + "dest-uuid": "bd7a51b3-d00c-575f-a16e-6f51e5a67743", + "type": "detected-by" + } + ], + "uuid": "75c0b177-d878-5840-b0c3-65f89966a83b", + "value": "identify relevant fence-sitter communities" + }, + { + "description": "significant amounts of quality open-source information are now available and should be leveraged to build products and analysis prior to problem prioritisation in the areas of observation, attribution, and intent. Successfully distinguishing the grey zone campaign signal through the global noise requires action through the entirety of the national security community. Policy, process, and tools must all adapt and evolve to detect, discern, and act upon a new type of signal", + "meta": { + "external_id": "F00075", + "kill_chain": [ + "responsetypes:Detect" + ], + "refs": [ + "https://github.com/DISARMFoundation/DISARMframeworks/blob/main/generated_pages/detections/F00075.md" + ] + }, + "related": [ + { + "dest-uuid": "bd7a51b3-d00c-575f-a16e-6f51e5a67743", + "type": "detects" + }, + { + "dest-uuid": "bd7a51b3-d00c-575f-a16e-6f51e5a67743", + "type": "detected-by" + } + ], + "uuid": "1fc5a146-3db1-5a91-bac5-aff732533527", + "value": "leverage open-source information" + }, + { + "description": "Target audience connected to \"useful idiots rather than the specific profiles because - The active presence of such sources complicates targeting of Russian propaganda, given that it is often difficult to discriminate between authentic views and opinions on the internet and those disseminated by the Russian state.", + "meta": { + "external_id": "F00076", + "kill_chain": [ + "responsetypes:Detect" + ], + "refs": [ + "https://github.com/DISARMFoundation/DISARMframeworks/blob/main/generated_pages/detections/F00076.md" + ] + }, + "related": [ + { + "dest-uuid": "bd7a51b3-d00c-575f-a16e-6f51e5a67743", + "type": "detects" + }, + { + "dest-uuid": "bd7a51b3-d00c-575f-a16e-6f51e5a67743", + "type": "detected-by" + } + ], + "uuid": "56aea194-6e78-5cc1-9f72-6b219e5e63fe", + "value": "Monitor/collect audience engagement data connected to “useful idiots”" + }, + { + "description": "Bot account: action based, people. Unsure which DISARM techniques.", + "meta": { + "external_id": "F00077", + "kill_chain": [ + "tactics:Establish Social Assets", + "responsetypes:Detect" + ], + "refs": [ + "https://github.com/DISARMFoundation/DISARMframeworks/blob/main/generated_pages/detections/F00077.md" + ] + }, + "related": [ + { + "dest-uuid": "bd7a51b3-d00c-575f-a16e-6f51e5a67743", + "type": "detects" + }, + { + "dest-uuid": "bd7a51b3-d00c-575f-a16e-6f51e5a67743", + "type": "detected-by" + } + ], + "uuid": "76efcfa4-6214-58b7-8557-60b77f36ef63", + "value": "Model for bot account behaviour" + }, + { + "description": "All techniques benefit from careful analysis and monitoring of activities on social network.", + "meta": { + "external_id": "F00078", + "kill_chain": [ + "tactics:Establish Social Assets", + "responsetypes:Detect" + ], + "refs": [ + "https://github.com/DISARMFoundation/DISARMframeworks/blob/main/generated_pages/detections/F00078.md" + ] + }, + "related": [ + { + "dest-uuid": "97ff79d9-55d2-550a-8a10-459cad7822fb", + "type": "detects" + }, + { + "dest-uuid": "bd7a51b3-d00c-575f-a16e-6f51e5a67743", + "type": "detected-by" + } + ], + "uuid": "2032a145-fc97-52f2-9f3a-15badd5df9da", + "value": "Monitor account level activity in social networks" + }, + { + "description": "", + "meta": { + "external_id": "F00079", + "kill_chain": [ + "tactics:Microtarget", + "responsetypes:Detect" + ], + "refs": [ + "https://github.com/DISARMFoundation/DISARMframeworks/blob/main/generated_pages/detections/F00079.md" + ] + }, + "related": [ + { + "dest-uuid": "1a8c4e8c-3543-5ab1-b4d0-939de9e7875f", + "type": "detects" + }, + { + "dest-uuid": "03aaf19c-42b9-5b8e-9d47-a6bb291f10fa", + "type": "detected-by" + } + ], + "uuid": "d3216499-77fd-528e-8b65-7c3bded9adda", + "value": "Network anomaly detection" + }, + { + "description": "Two wrongs don't make a right? But if you hack your own polls, you do learn how it could be done, and learn what to look for", + "meta": { + "external_id": "F00080", + "kill_chain": [ + "tactics:Select Channels and Affordances", + "responsetypes:Detect" + ], + "refs": [ + "https://github.com/DISARMFoundation/DISARMframeworks/blob/main/generated_pages/detections/F00080.md" + ] + }, + "related": [ + { + "dest-uuid": "1a8c4e8c-3543-5ab1-b4d0-939de9e7875f", + "type": "detects" + }, + { + "dest-uuid": "f6c98378-65be-5f14-af3e-326909d70d77", + "type": "detected-by" + } + ], + "uuid": "61aa4bb6-218c-5a10-9f1c-1a494f6871e7", + "value": "Hack the polls/ content yourself" + }, + { + "description": "", + "meta": { + "external_id": "F00081", + "kill_chain": [ + "tactics:Deliver Content", + "responsetypes:Detect" + ], + "refs": [ + "https://github.com/DISARMFoundation/DISARMframeworks/blob/main/generated_pages/detections/F00081.md" + ] + }, + "related": [ + { + "dest-uuid": "ee7bc41a-9eb0-5732-924a-3885e1c3bee9", + "type": "detects" + }, + { + "dest-uuid": "bd7a51b3-d00c-575f-a16e-6f51e5a67743", + "type": "detected-by" + } + ], + "uuid": "568f9e72-ca8c-54dd-976f-f9469bf026c1", + "value": "Need way for end user to report operations" + }, + { + "description": "", + "meta": { + "external_id": "F00082", + "kill_chain": [ + "tactics:Persist in the Information Environment", + "responsetypes:Disrupt" + ], + "refs": [ + "https://github.com/DISARMFoundation/DISARMframeworks/blob/main/generated_pages/detections/F00082.md" + ] + }, + "related": [ + { + "dest-uuid": "bd7a51b3-d00c-575f-a16e-6f51e5a67743", + "type": "detects" + }, + { + "dest-uuid": "f4dc44c5-e021-524b-9909-678f11a9f10d", + "type": "detected-by" + } + ], + "uuid": "e18bd403-00d9-5767-9e5c-b597f623821a", + "value": "Control the US \"slang\" translation boards" + }, + { + "description": "", + "meta": { + "external_id": "F00083", + "kill_chain": [ + "tactics:Persist in the Information Environment", + "responsetypes:Deceive" + ], + "refs": [ + "https://github.com/DISARMFoundation/DISARMframeworks/blob/main/generated_pages/detections/F00083.md" + ] + }, + "related": [ + { + "dest-uuid": "80153803-52a6-501a-8e28-b143d85dc261", + "type": "detects" + }, + { + "dest-uuid": "bd7a51b3-d00c-575f-a16e-6f51e5a67743", + "type": "detected-by" + } + ], + "uuid": "563f02b6-ddc9-5dac-9cf1-0c3fbb735856", + "value": "Build and own meme generator, then track and watermark contents" + }, + { + "description": "", + "meta": { + "external_id": "F00084", + "kill_chain": [ + "tactics:Establish Social Assets", + "responsetypes:Detect" + ], + "refs": [ + "https://github.com/DISARMFoundation/DISARMframeworks/blob/main/generated_pages/detections/F00084.md" + ] + }, + "related": [ + { + "dest-uuid": "bd7a51b3-d00c-575f-a16e-6f51e5a67743", + "type": "detects" + }, + { + "dest-uuid": "bd7a51b3-d00c-575f-a16e-6f51e5a67743", + "type": "detected-by" + } + ], + "uuid": "caa8d270-2ff3-5826-8383-94d32e006b47", + "value": "Track individual bad actors" + }, + { + "description": "Grey zone threats are challenging given that warning requires detection of a weak signal through global noise and across threat vectors and regional boundaries.Three interconnected grey zone elements characterise the nature of the activity: Temporality: The nature of grey zone threats truly requires a “big picture view” over long timescales and across regions and functional topics. Attribution: requiring an “almost certain” or “nearly certain analytic assessment before acting costs time and analytic effort Intent: judgement of adversarial intent to conduct grey zone activity. Indeed, the purpose of countering grey zone threats is to deter adversaries from fulfilling their intent to act. While attribution is one piece of the puzzle, closing the space around intent often means synthesising multiple relevant indicators and warnings, including the state’s geopolitical ambitions, military ties, trade and investment, level of corruption, and media landscape, among others.", + "meta": { + "external_id": "F00085", + "kill_chain": [], + "refs": [ + "https://github.com/DISARMFoundation/DISARMframeworks/blob/main/generated_pages/detections/F00085.md" + ] + }, + "related": [ + { + "dest-uuid": "bd7a51b3-d00c-575f-a16e-6f51e5a67743", + "type": "detects" + }, + { + "dest-uuid": "bd7a51b3-d00c-575f-a16e-6f51e5a67743", + "type": "detected-by" + } + ], + "uuid": "f2ad9fb7-75ad-5e75-a41b-278a150b8cba", + "value": "detection of a weak signal through global noise" + }, + { + "description": "Develop an intelligence-based understanding of foreign actors’ motivations, psychologies, and societal and geopolitical contexts. Leverage artificial intelligence to identify patterns and infer competitors’ intent", + "meta": { + "external_id": "F00086", + "kill_chain": [ + "tactics:Plan Objectives", + "responsetypes:Detect" + ], + "refs": [ + "https://github.com/DISARMFoundation/DISARMframeworks/blob/main/generated_pages/detections/F00086.md" + ] + }, + "related": [ + { + "dest-uuid": "bd7a51b3-d00c-575f-a16e-6f51e5a67743", + "type": "detects" + }, + { + "dest-uuid": "bd7a51b3-d00c-575f-a16e-6f51e5a67743", + "type": "detected-by" + } + ], + "uuid": "a489e954-268d-538d-9b26-3afeb771c782", + "value": "Outpace Competitor Intelligence Capabilities" + }, + { + "description": "United States has not adequately adapted its information indicators and thresholds for warning policymakers to account for grey zone tactics. Competitors have undertaken a marked shift to slow-burn, deceptive, non-military, and indirect challenges to U.S. interests. Relative to traditional security indicators and warnings, these are more numerous and harder to detect and make it difficult for analysts to infer intent.", + "meta": { + "external_id": "F00087", + "kill_chain": [ + "responsetypes:Detect" + ], + "refs": [ + "https://github.com/DISARMFoundation/DISARMframeworks/blob/main/generated_pages/detections/F00087.md" + ] + }, + "related": [ + { + "dest-uuid": "bd7a51b3-d00c-575f-a16e-6f51e5a67743", + "type": "detects" + }, + { + "dest-uuid": "bd7a51b3-d00c-575f-a16e-6f51e5a67743", + "type": "detected-by" + } + ], + "uuid": "0aad1ecc-e65d-5d28-b1c5-98b8a69daeb5", + "value": "Improve Indications and Warning" + }, + { + "description": "Recognise campaigns from weak signals, including rivals’ intent, capability, impact, interactive effects, and impact on U.S. interests... focus on adversarial covert action aspects of campaigning.", + "meta": { + "external_id": "F00088", + "kill_chain": [ + "responsetypes:Detect" + ], + "refs": [ + "https://github.com/DISARMFoundation/DISARMframeworks/blob/main/generated_pages/detections/F00088.md" + ] + }, + "related": [ + { + "dest-uuid": "bd7a51b3-d00c-575f-a16e-6f51e5a67743", + "type": "detects" + }, + { + "dest-uuid": "bd7a51b3-d00c-575f-a16e-6f51e5a67743", + "type": "detected-by" + } + ], + "uuid": "948dcfe0-a406-55fd-88c4-7e8e456e3ac6", + "value": "Revitalise an “active measures working group,”" + }, + { + "description": "\"Grey zone\" is second level of content producers and circulators, composed of outlets with uncertain attribution. This category covers conspiracy websites, far-right or far-left websites, news aggregators, and data dump websites", + "meta": { + "external_id": "F00089", + "kill_chain": [ + "tactics:Establish Social Assets", + "responsetypes:Detect" + ], + "refs": [ + "https://github.com/DISARMFoundation/DISARMframeworks/blob/main/generated_pages/detections/F00089.md" + ] + }, + "related": [ + { + "dest-uuid": "bd7a51b3-d00c-575f-a16e-6f51e5a67743", + "type": "detects" + }, + { + "dest-uuid": "bd7a51b3-d00c-575f-a16e-6f51e5a67743", + "type": "detected-by" + } + ], + "uuid": "1361d54a-54da-54d2-b2eb-93ed77e0a6c2", + "value": "target/name/flag \"grey zone\" website content" + }, + { + "description": "Bring private sector and civil society into accord on U.S. interests", + "meta": { + "external_id": "F00090", + "kill_chain": [ + "tactics:Plan Strategy", + "responsetypes:Detect" + ], + "refs": [ + "https://github.com/DISARMFoundation/DISARMframeworks/blob/main/generated_pages/detections/F00090.md" + ] + }, + "related": [ + { + "dest-uuid": "bd7a51b3-d00c-575f-a16e-6f51e5a67743", + "type": "detects" + }, + { + "dest-uuid": "bd7a51b3-d00c-575f-a16e-6f51e5a67743", + "type": "detected-by" + } + ], + "uuid": "d44529be-8da0-58ce-b3ef-1e0b18644e08", + "value": "Match Punitive Tools with Third-Party Inducements" + }, + { + "description": "This might include working with relevant technology firms to ensure that contracted analytic support is available. Contracted support is reportedly valuable because technology to monitor social media data is continually evolving, and such firms can provide the expertise to help identify and analyse trends, and they can more effectively stay abreast of the changing systems and develop new models as they are required", + "meta": { + "external_id": "F00091", + "kill_chain": [ + "tactics:Plan Strategy", + "responsetypes:Detect" + ], + "refs": [ + "https://github.com/DISARMFoundation/DISARMframeworks/blob/main/generated_pages/detections/F00091.md" + ] + }, + "related": [ + { + "dest-uuid": "bd7a51b3-d00c-575f-a16e-6f51e5a67743", + "type": "detects" + }, + { + "dest-uuid": "03aaf19c-42b9-5b8e-9d47-a6bb291f10fa", + "type": "detected-by" + }, + { + "dest-uuid": "2057de14-930a-5199-8e8e-9969173d36bb", + "type": "detected-by" + } + ], + "uuid": "1dc819ef-5eb6-51df-9614-bc9bf8218279", + "value": "Partner to develop analytic methods & tools" + }, + { + "description": "Warn social media companies about an ongoing campaign (e.g. antivax sites). Anyone with datasets or data summaries can help with this", + "meta": { + "external_id": "F00092", + "kill_chain": [ + "tactics:Deliver Content", + "responsetypes:Detect" + ], + "refs": [ + "https://github.com/DISARMFoundation/DISARMframeworks/blob/main/generated_pages/detections/F00092.md" + ] + }, + "related": [ + { + "dest-uuid": "bd7a51b3-d00c-575f-a16e-6f51e5a67743", + "type": "detects" + }, + { + "dest-uuid": "f6c98378-65be-5f14-af3e-326909d70d77", + "type": "detected-by" + } + ], + "uuid": "7806c5d1-7c44-5ff5-a539-361c3381a67d", + "value": "daylight" + }, + { + "description": "S4D is a way to separate out different speakers in text, audio.", + "meta": { + "external_id": "F00093", + "kill_chain": [ + "tactics:Establish Social Assets", + "responsetypes:Detect" + ], + "refs": [ + "https://github.com/DISARMFoundation/DISARMframeworks/blob/main/generated_pages/detections/F00093.md" + ] + }, + "related": [ + { + "dest-uuid": "d05396d6-9701-5ce3-a6cd-abff224310ae", + "type": "detects" + }, + { + "dest-uuid": "bd7a51b3-d00c-575f-a16e-6f51e5a67743", + "type": "detected-by" + } + ], + "uuid": "382e6c32-fb02-5c41-aba1-8161ed8a815e", + "value": "S4d detection and re-allocation approaches" + }, + { + "description": "", + "meta": { + "external_id": "F00094", + "kill_chain": [ + "tactics:Select Channels and Affordances", + "responsetypes:Detect" + ], + "refs": [ + "https://github.com/DISARMFoundation/DISARMframeworks/blob/main/generated_pages/detections/F00094.md" + ] + }, + "related": [ + { + "dest-uuid": "534951bc-8d1e-58be-b051-c9243eac96fb", + "type": "detects" + }, + { + "dest-uuid": "f4dc44c5-e021-524b-9909-678f11a9f10d", + "type": "detected-by" + } + ], + "uuid": "f2adbe9e-7c80-504d-adc5-624e04eab4f1", + "value": "Registries alert when large batches of newsy URLs get registered together" + }, + { + "description": "Process suspicious artefacts, narratives, and incidents", + "meta": { + "external_id": "F00095", + "kill_chain": [ + "tactics:Deliver Content", + "responsetypes:Detect" + ], + "refs": [ + "https://github.com/DISARMFoundation/DISARMframeworks/blob/main/generated_pages/detections/F00095.md" + ] + }, + "related": [ + { + "dest-uuid": "bd7a51b3-d00c-575f-a16e-6f51e5a67743", + "type": "detects" + }, + { + "dest-uuid": "bd7a51b3-d00c-575f-a16e-6f51e5a67743", + "type": "detected-by" + } + ], + "uuid": "b2316041-44b8-5163-9daf-b8ec8fe5c2e1", + "value": "Fact checking" + } + ], + "version": 1 +} diff --git a/clusters/disarm-techniques.json b/clusters/disarm-techniques.json new file mode 100644 index 0000000..3b943e0 --- /dev/null +++ b/clusters/disarm-techniques.json @@ -0,0 +1,4823 @@ +{ + "authors": [ + "DISARM Project" + ], + "category": "disarm", + "description": "DISARM is a framework designed for describing and understanding disinformation incidents.", + "name": "Techniques", + "source": "https://github.com/DISARMFoundation/DISARMframeworks", + "type": "disarm-techniques", + "uuid": "fb0e6978-2647-5a95-8324-7ebfd2f88b67", + "values": [ + { + "description": "Organise citizens around pro-state messaging. Coordinate paid or volunteer groups to push state propaganda.", + "meta": { + "external_id": "T0002", + "kill_chain": [ + "tactics:Plan Objectives" + ], + "refs": [ + "https://github.com/DISARMFoundation/DISARMframeworks/blob/main/generated_pages/techniques/T0002.md" + ] + }, + "related": [ + { + "dest-uuid": "559c0ffb-5098-55bd-a173-fbd335bb4ba7", + "type": "blocked-by" + }, + { + "dest-uuid": "eededb33-c7f5-5c1b-bacd-924af3b6e332", + "type": "blocked-by" + }, + { + "dest-uuid": "e6e01a8f-bb6f-5b16-b77d-61f0abbc84a5", + "type": "blocked-by" + }, + { + "dest-uuid": "5f6e9165-2d53-52af-883a-13fff2749308", + "type": "blocked-by" + }, + { + "dest-uuid": "4fc5ef29-5af2-5630-b57a-4df9844932c1", + "type": "blocked-by" + } + ], + "uuid": "782afafa-e997-571a-9b25-d04bb322480c", + "value": "Facilitate State Propaganda" + }, + { + "description": "Use or adapt existing narrative themes, where narratives are the baseline stories of a target audience. Narratives form the bedrock of our worldviews. New information is understood through a process firmly grounded in this bedrock. If new information is not consitent with the prevailing narratives of an audience, it will be ignored. Effective campaigns will frame their misinformation in the context of these narratives. Highly effective campaigns will make extensive use of audience-appropriate archetypes and meta-narratives throughout their content creation and amplifiction practices.", + "meta": { + "external_id": "T0003", + "kill_chain": [ + "tactics:Develop Narratives" + ], + "refs": [ + "https://github.com/DISARMFoundation/DISARMframeworks/blob/main/generated_pages/techniques/T0003.md" + ] + }, + "related": [ + { + "dest-uuid": "a706cf86-2170-58ea-a6d4-79cc47f23e54", + "type": "blocked-by" + }, + { + "dest-uuid": "c14e8f7d-3c10-5cb5-a654-9d23315d631c", + "type": "blocked-by" + } + ], + "uuid": "689e65f1-d834-581a-adf2-4e8a96d32464", + "value": "Leverage Existing Narratives" + }, + { + "description": "Advance competing narratives connected to same issue ie: on one hand deny incident while at same time expresses dismiss. Suppressing or discouraging narratives already spreading requires an alternative. The most simple set of narrative techniques in response would be the construction and promotion of contradictory alternatives centred on denial, deflection, dismissal, counter-charges, excessive standards of proof, bias in prohibition or enforcement, and so on. These competing narratives allow loyalists cover, but are less compelling to opponents and fence-sitters than campaigns built around existing narratives or highly explanatory master narratives. Competing narratives, as such, are especially useful in the \"firehose of misinformation\" approach.", + "meta": { + "external_id": "T0004", + "kill_chain": [ + "tactics:Develop Narratives" + ], + "refs": [ + "https://github.com/DISARMFoundation/DISARMframeworks/blob/main/generated_pages/techniques/T0004.md" + ] + }, + "related": [ + { + "dest-uuid": "d14b6626-052a-5d30-a0da-598e1490bdaa", + "type": "blocked-by" + } + ], + "uuid": "73bfaf89-d10a-5515-83fb-bc5ba11f5a2a", + "value": "Develop Competing Narratives" + }, + { + "description": "Create key social engineering assets needed to amplify content, manipulate algorithms, fool public and/or specific incident/campaign targets. Computational propaganda depends substantially on false perceptions of credibility and acceptance. By creating fake users and groups with a variety of interests and commitments, attackers can ensure that their messages both come from trusted sources and appear more widely adopted than they actually are.", + "meta": { + "external_id": "T0007", + "kill_chain": [ + "tactics:Establish Social Assets" + ], + "refs": [ + "https://github.com/DISARMFoundation/DISARMframeworks/blob/main/generated_pages/techniques/T0007.md" + ] + }, + "related": [ + { + "dest-uuid": "0aa00b22-361f-5e5b-ac46-901cf6d2dfcc", + "type": "blocked-by" + }, + { + "dest-uuid": "a374c7de-23fd-5cae-805c-83817cb66d66", + "type": "blocked-by" + }, + { + "dest-uuid": "42827d89-3a37-568e-9de3-8ebd379c3d8f", + "type": "detected-by" + }, + { + "dest-uuid": "e39234ab-979c-51c8-8f34-5a9337bd030e", + "type": "detected-by" + }, + { + "dest-uuid": "6fc10d9d-96a5-5ae1-a0f7-0136a9819a6e", + "type": "detected-by" + }, + { + "dest-uuid": "345ea7b9-1504-57cf-9c8f-7b01613d89e6", + "type": "detected-by" + } + ], + "uuid": "e3cbbc7a-da73-50fb-9893-4ce88edb211f", + "value": "Create Inauthentic Social Media Pages and Groups" + }, + { + "description": "Stories planted or promoted in computational propaganda operations often make use of experts fabricated from whole cloth, sometimes specifically for the story itself.", + "meta": { + "external_id": "T0009", + "kill_chain": [ + "tactics:Establish Legitimacy" + ], + "refs": [ + "https://github.com/DISARMFoundation/DISARMframeworks/blob/main/generated_pages/techniques/T0009.md" + ] + }, + "related": [ + { + "dest-uuid": "486790ce-6083-5403-b971-d4c0b291b6a4", + "type": "blocked-by" + }, + { + "dest-uuid": "e9cf452f-3ebc-5de8-9f21-dde3133c92c0", + "type": "blocked-by" + }, + { + "dest-uuid": "fea19aab-9522-55bf-9608-addf7d6aaf8d", + "type": "blocked-by" + }, + { + "dest-uuid": "2fe43d88-db8f-5156-98fb-4b9db0e5fff3", + "type": "blocked-by" + }, + { + "dest-uuid": "25ca7eff-d789-5c36-a49d-34194b7246d4", + "type": "detected-by" + }, + { + "dest-uuid": "bd602fee-4354-5b31-99f1-832053c1bba0", + "type": "detected-by" + } + ], + "uuid": "29768133-b941-5974-ab10-c15bbb86e387", + "value": "Create Fake Experts" + }, + { + "description": "Utilise Academic/Pseudoscientific Justifications", + "meta": { + "external_id": "T0009.001", + "kill_chain": [ + "tactics:Establish Legitimacy" + ], + "refs": [ + "https://github.com/DISARMFoundation/DISARMframeworks/blob/main/generated_pages/techniques/T0009.001.md" + ] + }, + "related": [], + "uuid": "4c721f5a-101e-5b5e-b260-7b08b92eac83", + "value": "Utilise Academic/Pseudoscientific Justifications" + }, + { + "description": "Cultivate propagandists for a cause, the goals of which are not fully comprehended, and who are used cynically by the leaders of the cause. Independent actors use social media and specialised web sites to strategically reinforce and spread messages compatible with their own. Their networks are infiltrated and used by state media disinformation organisations to amplify the state’s own disinformation strategies against target populations. Many are traffickers in conspiracy theories or hoaxes, unified by a suspicion of Western governments and mainstream media. Their narratives, which appeal to leftists hostile to globalism and military intervention and nationalists against immigration, are frequently infiltrated and shaped by state-controlled trolls and altered news items from agencies such as RT and Sputnik. Also know as \"useful idiots\" or \"unwitting agents\".", + "meta": { + "external_id": "T0010", + "kill_chain": [ + "tactics:Establish Social Assets" + ], + "refs": [ + "https://github.com/DISARMFoundation/DISARMframeworks/blob/main/generated_pages/techniques/T0010.md" + ] + }, + "related": [ + { + "dest-uuid": "60e783f2-4e22-5495-abdf-cb73e1a5a4c1", + "type": "blocked-by" + }, + { + "dest-uuid": "e4a0a68e-dbf8-56b6-8029-2d670aad813c", + "type": "blocked-by" + }, + { + "dest-uuid": "70fb13e3-1d1f-5064-bf27-c3644f0a2045", + "type": "blocked-by" + }, + { + "dest-uuid": "943ccc85-a339-5e32-ade9-09bc4bf6b4fd", + "type": "blocked-by" + }, + { + "dest-uuid": "686ccd43-c358-5d5d-bd42-3e2279151670", + "type": "blocked-by" + }, + { + "dest-uuid": "f99b442a-7c34-5c66-b699-64c3da69374c", + "type": "blocked-by" + }, + { + "dest-uuid": "efd2cf88-94ba-5fdc-8611-660baf44b2e9", + "type": "blocked-by" + }, + { + "dest-uuid": "babb37b7-5b28-5ba4-8f08-5c7c271937c7", + "type": "blocked-by" + }, + { + "dest-uuid": "d12e5fda-c5d3-5cc5-806b-69edb56aac61", + "type": "blocked-by" + }, + { + "dest-uuid": "a479d596-6f66-53eb-ae24-d3a67536464f", + "type": "blocked-by" + }, + { + "dest-uuid": "3055e156-f234-5293-9ab2-d9761a620060", + "type": "blocked-by" + }, + { + "dest-uuid": "8c281e28-298e-5c1b-8e44-f768006d6c26", + "type": "detected-by" + } + ], + "uuid": "39baec3d-f2ce-5fee-ba7d-3db7d6469946", + "value": "Cultivate Ignorant Agents" + }, + { + "description": "Hack or take over legimate accounts to distribute misinformation or damaging content.", + "meta": { + "external_id": "T0011", + "kill_chain": [ + "tactics:Establish Legitimacy" + ], + "refs": [ + "https://github.com/DISARMFoundation/DISARMframeworks/blob/main/generated_pages/techniques/T0011.md" + ] + }, + "related": [ + { + "dest-uuid": "5481cc36-5af8-5ddf-bcb7-638d3be3f583", + "type": "blocked-by" + }, + { + "dest-uuid": "14b886aa-c023-5a84-9605-e4a9cb22e4f4", + "type": "blocked-by" + }, + { + "dest-uuid": "f8cab1cc-c87e-5338-90bc-18d071a01601", + "type": "detected-by" + }, + { + "dest-uuid": "187285bb-a282-5a6a-833e-01d9744165c4", + "type": "detected-by" + }, + { + "dest-uuid": "5012f883-a0ae-5181-bc69-d74b55b44d38", + "type": "detected-by" + }, + { + "dest-uuid": "65634c12-ec5f-5a3c-b329-94d3dd84b58e", + "type": "detected-by" + }, + { + "dest-uuid": "382e6c32-fb02-5c41-aba1-8161ed8a815e", + "type": "detected-by" + } + ], + "uuid": "d05396d6-9701-5ce3-a6cd-abff224310ae", + "value": "Compromise Legitimate Accounts" + }, + { + "description": "Create media assets to support inauthentic organisations (e.g. think tank), people (e.g. experts) and/or serve as sites to distribute malware/launch phishing operations.", + "meta": { + "external_id": "T0013", + "kill_chain": [ + "tactics:Establish Social Assets" + ], + "refs": [ + "https://github.com/DISARMFoundation/DISARMframeworks/blob/main/generated_pages/techniques/T0013.md" + ] + }, + "related": [ + { + "dest-uuid": "594ec374-28b9-5191-8bb7-edd9196daf4e", + "type": "detected-by" + }, + { + "dest-uuid": "f2adbe9e-7c80-504d-adc5-624e04eab4f1", + "type": "detected-by" + } + ], + "uuid": "534951bc-8d1e-58be-b051-c9243eac96fb", + "value": "Create Inauthentic Websites" + }, + { + "description": "Fundraising campaigns refer to an influence operation’s systematic effort to seek financial support for a charity, cause, or other enterprise using online activities that further promote operation information pathways while raising a profit. Many influence operations have engaged in crowdfunding services on platforms including Tipee, Patreon, and GoFundMe. An operation may use its previously prepared fundraising campaigns (see: Develop Information Pathways) to promote operation messaging while raising money to support its activities.", + "meta": { + "external_id": "T0014", + "kill_chain": [ + "tactics:Establish Social Assets" + ], + "refs": [ + "https://github.com/DISARMFoundation/DISARMframeworks/blob/main/generated_pages/techniques/T0014.md" + ] + }, + "related": [ + { + "dest-uuid": "c112eafc-0f31-5bd7-9083-20ef706c8d57", + "type": "blocked-by" + }, + { + "dest-uuid": "5b5c3e04-acf2-50dd-9861-c44bcc8f2cc3", + "type": "blocked-by" + }, + { + "dest-uuid": "bbb8b174-44b6-5f59-bcf0-eab169bc7be1", + "type": "blocked-by" + } + ], + "uuid": "f0bb5056-fedb-5507-8554-c958ec8d9fdc", + "value": "Prepare Fundraising Campaigns" + }, + { + "description": "Raising funds from malign actors may include contributions from foreign agents, cutouts or proxies, shell companies, dark money groups, etc.", + "meta": { + "external_id": "T0014.001", + "kill_chain": [ + "tactics:Establish Social Assets" + ], + "refs": [ + "https://github.com/DISARMFoundation/DISARMframeworks/blob/main/generated_pages/techniques/T0014.001.md" + ] + }, + "related": [], + "uuid": "d23f9cc0-058e-5354-b2c6-90e7b6737922", + "value": "Raise Funds from Malign Actors" + }, + { + "description": "Raising funds from ignorant agents may include scams, donations intended for one stated purpose but then used for another, etc.", + "meta": { + "external_id": "T0014.002", + "kill_chain": [ + "tactics:Establish Social Assets" + ], + "refs": [ + "https://github.com/DISARMFoundation/DISARMframeworks/blob/main/generated_pages/techniques/T0014.002.md" + ] + }, + "related": [], + "uuid": "dc89eee0-bf5e-51f0-957d-0e9e8a2cceff", + "value": "Raise Funds from Ignorant Agents" + }, + { + "description": "Create one or more hashtags and/or hashtag groups. Many incident-based campaigns will create hashtags to promote their fabricated event. Creating a hashtag for an incident can have two important effects: 1. Create a perception of reality around an event. Certainly only \"real\" events would be discussed in a hashtag. After all, the event has a name!, and 2. Publicise the story more widely through trending lists and search behaviour. Asset needed to direct/control/manage \"conversation\" connected to launching new incident/campaign with new hashtag for applicable social media sites).", + "meta": { + "external_id": "T0015", + "kill_chain": [ + "tactics:Develop Content" + ], + "refs": [ + "https://github.com/DISARMFoundation/DISARMframeworks/blob/main/generated_pages/techniques/T0015.md" + ] + }, + "related": [ + { + "dest-uuid": "677c9e22-42b6-5b78-985c-e72936ae1b3f", + "type": "blocked-by" + } + ], + "uuid": "6d3c1c71-746e-5e9d-9960-4845d712c899", + "value": "Create Hashtags and Search Artefacts" + }, + { + "description": "Create attention grabbing headlines (outrage, doubt, humour) required to drive traffic & engagement. This is a key asset.", + "meta": { + "external_id": "T0016", + "kill_chain": [ + "tactics:Microtarget" + ], + "refs": [ + "https://github.com/DISARMFoundation/DISARMframeworks/blob/main/generated_pages/techniques/T0016.md" + ] + }, + "related": [ + { + "dest-uuid": "c52274ce-09fe-5b50-b2f2-741be794da6e", + "type": "blocked-by" + }, + { + "dest-uuid": "d8b22aa2-cbb6-5a97-b9ad-32eaf3514768", + "type": "blocked-by" + }, + { + "dest-uuid": "4880efa6-1123-5703-9c44-9f0600670dd9", + "type": "blocked-by" + }, + { + "dest-uuid": "d6182931-a76a-59e6-901e-f63b9f6d2301", + "type": "blocked-by" + }, + { + "dest-uuid": "e9380fb8-fc55-5ac7-94ab-2af4c13b6361", + "type": "blocked-by" + } + ], + "uuid": "9570ebf8-f69b-5064-a627-a19cb429d0f5", + "value": "Create Clickbait" + }, + { + "description": "Fundraising campaigns refer to an influence operation’s systematic effort to seek financial support for a charity, cause, or other enterprise using online activities that further promote operation information pathways while raising a profit. Many influence operations have engaged in crowdfunding services166 on platforms including Tipee, Patreon, and GoFundMe. An operation may use its previously prepared fundraising campaigns to promote operation messaging while raising money to support its activities.", + "meta": { + "external_id": "T0017", + "kill_chain": [ + "tactics:Drive Offline Activity" + ], + "refs": [ + "https://github.com/DISARMFoundation/DISARMframeworks/blob/main/generated_pages/techniques/T0017.md" + ] + }, + "related": [ + { + "dest-uuid": "99575145-b81a-5c7d-8107-e2ad419b3e20", + "type": "blocked-by" + }, + { + "dest-uuid": "f3cd91e7-b21a-529f-82bd-dd3aa3c3106b", + "type": "blocked-by" + } + ], + "uuid": "7f21fe4b-d314-5511-a9b1-0b9fcfee8b5e", + "value": "Conduct Fundraising" + }, + { + "description": "An influence operation may Conduct Crowdfunding Campaigns on platforms such as GoFundMe, GiveSendGo, Tipeee, Patreon, etc.", + "meta": { + "external_id": "T0017.001", + "kill_chain": [ + "tactics:Drive Offline Activity" + ], + "refs": [ + "https://github.com/DISARMFoundation/DISARMframeworks/blob/main/generated_pages/techniques/T0017.001.md" + ] + }, + "related": [], + "uuid": "999145bb-914b-5f7e-b47e-8756af2f5484", + "value": "Conduct Crowdfunding Campaigns" + }, + { + "description": "Create or fund advertisements targeted at specific populations", + "meta": { + "external_id": "T0018", + "kill_chain": [ + "tactics:Microtarget" + ], + "refs": [ + "https://github.com/DISARMFoundation/DISARMframeworks/blob/main/generated_pages/techniques/T0018.md" + ] + }, + "related": [ + { + "dest-uuid": "14dad601-4ddd-5cfd-a48d-9b53212769ce", + "type": "blocked-by" + } + ], + "uuid": "87208979-6982-53d5-ad0f-49cef659555c", + "value": "Purchase Targeted Advertisements" + }, + { + "description": "Flood social channels; drive traffic/engagement to all assets; create aura/sense/perception of pervasiveness/consensus (for or against or both simultaneously) of an issue or topic. \"Nothing is true, but everything is possible.\" Akin to astroturfing campaign.", + "meta": { + "external_id": "T0019", + "kill_chain": [ + "tactics:Develop Content" + ], + "refs": [ + "https://github.com/DISARMFoundation/DISARMframeworks/blob/main/generated_pages/techniques/T0019.md" + ] + }, + "related": [ + { + "dest-uuid": "731ffe0e-0225-583e-9ef0-f39851b725c7", + "type": "blocked-by" + }, + { + "dest-uuid": "fe5266c1-0af6-59f3-8a0a-f4e5b3f67513", + "type": "blocked-by" + }, + { + "dest-uuid": "dae93cbd-eb65-5fb0-9d4e-4571ff54b6ff", + "type": "blocked-by" + } + ], + "uuid": "cb7d7a14-6e5c-503c-84b8-4a49e69b2627", + "value": "Generate Information Pollution" + }, + { + "description": "Create fake academic research. Example: fake social science research is often aimed at hot-button social issues such as gender, race and sexuality. Fake science research can target Climate Science debate or pseudoscience like anti-vaxx", + "meta": { + "external_id": "T0019.001", + "kill_chain": [ + "tactics:Develop Content" + ], + "refs": [ + "https://github.com/DISARMFoundation/DISARMframeworks/blob/main/generated_pages/techniques/T0019.001.md" + ] + }, + "related": [], + "uuid": "b2d72f4b-fa1f-5798-b075-f3f31320ce4d", + "value": "Create Fake Research" + }, + { + "description": "Hashtag hijacking occurs when users “[use] a trending hashtag to promote topics that are substantially different from its recent context” (VanDam and Tan, 2016) or “to promote one’s own social media agenda” (Darius and Stephany, 2019).", + "meta": { + "external_id": "T0019.002", + "kill_chain": [ + "tactics:Develop Content" + ], + "refs": [ + "https://github.com/DISARMFoundation/DISARMframeworks/blob/main/generated_pages/techniques/T0019.002.md" + ] + }, + "related": [], + "uuid": "7452c88a-f6ed-52b6-8fe4-25273bb5bc69", + "value": "Hijack Hashtags" + }, + { + "description": "Iteratively test incident performance (messages, content etc), e.g. A/B test headline/content enagagement metrics; website and/or funding campaign conversion rates", + "meta": { + "external_id": "T0020", + "kill_chain": [ + "tactics:Conduct Pump Priming" + ], + "refs": [ + "https://github.com/DISARMFoundation/DISARMframeworks/blob/main/generated_pages/techniques/T0020.md" + ] + }, + "related": [ + { + "dest-uuid": "fd9e1e82-0c60-5bf6-a9a2-4f29ca6d39ba", + "type": "blocked-by" + }, + { + "dest-uuid": "30be4903-350a-505c-9166-fa65b8894778", + "type": "detected-by" + } + ], + "uuid": "635f5592-0e2a-5f06-b164-c5af2ec9ef5e", + "value": "Trial Content" + }, + { + "description": "\"Conspiracy narratives\" appeal to the human desire for explanatory order, by invoking the participation of poweful (often sinister) actors in pursuit of their own political goals. These narratives are especially appealing when an audience is low-information, marginalised or otherwise inclined to reject the prevailing explanation. Conspiracy narratives are an important component of the \"firehose of falsehoods\" model.", + "meta": { + "external_id": "T0022", + "kill_chain": [ + "tactics:Develop Narratives" + ], + "refs": [ + "https://github.com/DISARMFoundation/DISARMframeworks/blob/main/generated_pages/techniques/T0022.md" + ] + }, + "related": [ + { + "dest-uuid": "90ec53d1-ed62-516d-b530-49cb3e9e851c", + "type": "blocked-by" + }, + { + "dest-uuid": "cbba0c79-9287-5ead-a70a-34f740b4325f", + "type": "blocked-by" + }, + { + "dest-uuid": "877c29b5-38ae-570a-93b3-9e4e70ec27ef", + "type": "blocked-by" + }, + { + "dest-uuid": "047898ad-129f-5d18-9dea-985e7f68becd", + "type": "blocked-by" + }, + { + "dest-uuid": "af04983d-8531-54df-a7c7-39e5ae6bb523", + "type": "blocked-by" + } + ], + "uuid": "f1d52ce1-f431-5732-a071-215cb3306f3e", + "value": "Leverage Conspiracy Theory Narratives" + }, + { + "description": "An influence operation may amplify an existing conspiracy theory narrative that aligns with its incident or campaign goals. By amplifying existing conspiracy theory narratives, operators can leverage the power of the existing communities that support and propagate those theories without needing to expend resources creating new narratives or building momentum and buy in around new narratives.", + "meta": { + "external_id": "T0022.001", + "kill_chain": [ + "tactics:Develop Narratives" + ], + "refs": [ + "https://github.com/DISARMFoundation/DISARMframeworks/blob/main/generated_pages/techniques/T0022.001.md" + ] + }, + "related": [], + "uuid": "f3c7a9c8-9196-5b2f-8d10-46ca31380987", + "value": "Amplify Existing Conspiracy Theory Narratives" + }, + { + "description": "While this requires more resources than amplifying existing conspiracy theory narratives, an influence operation may develop original conspiracy theory narratives in order to achieve greater control and alignment over the narrative and their campaign goals. Prominent examples include the USSR's Operation INFEKTION disinformation campaign run by the KGB in the 1980s to plant the idea that the United States had invented HIV/AIDS as part of a biological weapons research project at Fort Detrick, Maryland. More recently, Fort Detrick featured prominently in a new conspiracy theory narratives around the origins of the COVID-19 outbreak and pandemic.", + "meta": { + "external_id": "T0022.002", + "kill_chain": [ + "tactics:Develop Narratives" + ], + "refs": [ + "https://github.com/DISARMFoundation/DISARMframeworks/blob/main/generated_pages/techniques/T0022.002.md" + ] + }, + "related": [], + "uuid": "b90838cb-7124-5f07-9fa6-94f0b5b21343", + "value": "Develop Original Conspiracy Theory Narratives" + }, + { + "description": "Change, twist, or exaggerate existing facts to construct a narrative that differs from reality. Examples: images and ideas can be distorted by being placed in an improper content", + "meta": { + "external_id": "T0023", + "kill_chain": [ + "tactics:Develop Content" + ], + "refs": [ + "https://github.com/DISARMFoundation/DISARMframeworks/blob/main/generated_pages/techniques/T0023.md" + ] + }, + "related": [], + "uuid": "1993a35d-d276-569b-ba66-66623f982dc4", + "value": "Distort Facts" + }, + { + "description": "Reframing context refers to removing an event from its surrounding context to distort its intended meaning. Rather than deny that an event occurred, reframing context frames an event in a manner that may lead the target audience to draw a different conclusion about its intentions.", + "meta": { + "external_id": "T0023.001", + "kill_chain": [ + "tactics:Develop Content" + ], + "refs": [ + "https://github.com/DISARMFoundation/DISARMframeworks/blob/main/generated_pages/techniques/T0023.001.md" + ] + }, + "related": [], + "uuid": "c887503d-e5f5-5f06-a92a-9e50ec908eb6", + "value": "Reframe Context" + }, + { + "description": "An influence operation may edit open-source content, such as collaborative blogs or encyclopaedias, to promote its narratives on outlets with existing credibility and audiences. Editing open-source content may allow an operation to post content on platforms without dedicating resources to the creation and maintenance of its own assets.", + "meta": { + "external_id": "T0023.002", + "kill_chain": [ + "tactics:Develop Content" + ], + "refs": [ + "https://github.com/DISARMFoundation/DISARMframeworks/blob/main/generated_pages/techniques/T0023.002.md" + ] + }, + "related": [], + "uuid": "b4984f13-619b-54a7-bf2c-acc5cdc01437", + "value": "Edit Open-Source Content" + }, + { + "description": "Create fake online polls, or manipulate existing online polls. Data gathering tactic to target those who engage, and potentially their networks of friends/followers as well", + "meta": { + "external_id": "T0029", + "kill_chain": [ + "tactics:Select Channels and Affordances" + ], + "refs": [ + "https://github.com/DISARMFoundation/DISARMframeworks/blob/main/generated_pages/techniques/T0029.md" + ] + }, + "related": [ + { + "dest-uuid": "e23dbc10-0eca-5100-bf14-cf2db9db31b8", + "type": "blocked-by" + }, + { + "dest-uuid": "01b3516b-b8b1-5a56-ae24-5300cceb70f8", + "type": "blocked-by" + }, + { + "dest-uuid": "a64a6568-d047-55b9-a3ab-f77fb3c9ada3", + "type": "blocked-by" + }, + { + "dest-uuid": "e21e17e9-3834-59de-bc31-9e43b73c8973", + "type": "blocked-by" + }, + { + "dest-uuid": "0280f954-5654-5d23-8dcf-a1f5334f3e6a", + "type": "blocked-by" + }, + { + "dest-uuid": "d3216499-77fd-528e-8b65-7c3bded9adda", + "type": "detected-by" + }, + { + "dest-uuid": "61aa4bb6-218c-5a10-9f1c-1a494f6871e7", + "type": "detected-by" + } + ], + "uuid": "1a8c4e8c-3543-5ab1-b4d0-939de9e7875f", + "value": "Online Polls" + }, + { + "description": "Credibility in a social media environment is often a function of the size of a user's network. \"Influencers\" are so-called because of their reach, typically understood as: 1) the size of their network (i.e. the number of followers, perhaps weighted by their own influence); and 2) The rate at which their comments are re-circulated (these two metrics are related). Add traditional media players at all levels of credibility and professionalism to this, and the number of potential influencial carriers available for unwitting amplification becomes substantial. By targeting high-influence people and organisations in all types of media with narratives and content engineered to appeal their emotional or ideological drivers, influence campaigns are able to add perceived credibility to their messaging via saturation and adoption by trusted agents such as celebrities, journalists and local leaders.", + "meta": { + "external_id": "T0039", + "kill_chain": [ + "tactics:Conduct Pump Priming" + ], + "refs": [ + "https://github.com/DISARMFoundation/DISARMframeworks/blob/main/generated_pages/techniques/T0039.md" + ] + }, + "related": [ + { + "dest-uuid": "47ad777e-029c-5afa-9c37-50c3d86f3d39", + "type": "blocked-by" + }, + { + "dest-uuid": "1744386c-0d46-54a8-a5b8-cba1bd7dc369", + "type": "blocked-by" + }, + { + "dest-uuid": "a1441814-0d69-5b19-9dae-64c61d7dfdbd", + "type": "blocked-by" + }, + { + "dest-uuid": "590350b9-2614-572b-825b-b2498ebf4c17", + "type": "blocked-by" + }, + { + "dest-uuid": "f29dff54-af05-55d1-a056-899007481493", + "type": "detected-by" + } + ], + "uuid": "53e8c51b-c178-5429-8cee-022c6741cc91", + "value": "Bait Legitimate Influencers" + }, + { + "description": "Campaigns often leverage tactical and informational asymmetries on the threat surface, as seen in the Distort and Deny strategies, and the \"firehose of misinformation\". Specifically, conspiracy theorists can be repeatedly wrong, but advocates of the truth need to be perfect. By constantly escalating demands for proof, propagandists can effectively leverage this asymmetry while also priming its future use, often with an even greater asymmetric advantage. The conspiracist is offered freer rein for a broader range of \"questions\" while the truth teller is burdened with higher and higher standards of proof.", + "meta": { + "external_id": "T0040", + "kill_chain": [ + "tactics:Develop Narratives" + ], + "refs": [ + "https://github.com/DISARMFoundation/DISARMframeworks/blob/main/generated_pages/techniques/T0040.md" + ] + }, + "related": [ + { + "dest-uuid": "b942a92e-13d5-5726-92bd-4fb5531f381b", + "type": "blocked-by" + } + ], + "uuid": "70218fb2-3d85-5714-b990-2d18e345e184", + "value": "Demand Insurmountable Proof" + }, + { + "description": "Wrap lies or altered context/facts around truths. Influence campaigns pursue a variety of objectives with respect to target audiences, prominent among them: 1. undermine a narrative commonly referenced in the target audience; or 2. promote a narrative less common in the target audience, but preferred by the attacker. In both cases, the attacker is presented with a heavy lift. They must change the relative importance of various narratives in the interpretation of events, despite contrary tendencies. When messaging makes use of factual reporting to promote these adjustments in the narrative space, they are less likely to be dismissed out of hand; when messaging can juxtapose a (factual) truth about current affairs with the (abstract) truth explicated in these narratives, propagandists can undermine or promote them selectively. Context matters.", + "meta": { + "external_id": "T0042", + "kill_chain": [ + "tactics:Conduct Pump Priming" + ], + "refs": [ + "https://github.com/DISARMFoundation/DISARMframeworks/blob/main/generated_pages/techniques/T0042.md" + ] + }, + "related": [], + "uuid": "ab4b4b44-5f15-5c92-934b-30cc73f67afc", + "value": "Seed Kernel of Truth" + }, + { + "description": "Direct messaging via chat app is an increasing method of delivery. These messages are often automated and new delivery and storage methods make them anonymous, viral, and ephemeral. This is a difficult space to monitor, but also a difficult space to build acclaim or notoriety.", + "meta": { + "external_id": "T0043", + "kill_chain": [ + "tactics:Select Channels and Affordances" + ], + "refs": [ + "https://github.com/DISARMFoundation/DISARMframeworks/blob/main/generated_pages/techniques/T0043.md" + ] + }, + "related": [ + { + "dest-uuid": "b8b49628-4c3d-528c-90f1-2fee8722e2c5", + "type": "blocked-by" + } + ], + "uuid": "ebd0aab4-013c-52fa-bae5-8fb3bd7704b8", + "value": "Chat Apps" + }, + { + "description": "Examples include Signal, WhatsApp, Discord, Wire, etc.", + "meta": { + "external_id": "T0043.001", + "kill_chain": [ + "tactics:Select Channels and Affordances" + ], + "refs": [ + "https://github.com/DISARMFoundation/DISARMframeworks/blob/main/generated_pages/techniques/T0043.001.md" + ] + }, + "related": [], + "uuid": "7308289b-5875-5015-bead-adf63a552c28", + "value": "Use Encrypted Chat Apps" + }, + { + "description": "Examples include SMS, etc.", + "meta": { + "external_id": "T0043.002", + "kill_chain": [ + "tactics:Select Channels and Affordances" + ], + "refs": [ + "https://github.com/DISARMFoundation/DISARMframeworks/blob/main/generated_pages/techniques/T0043.002.md" + ] + }, + "related": [], + "uuid": "211e93c2-463a-5271-9384-61a6b8ca4af6", + "value": "Use Unencrypted Chats Apps" + }, + { + "description": "Try a wide variety of messages in the early hours surrounding an incident or event, to give a misleading account or impression.", + "meta": { + "external_id": "T0044", + "kill_chain": [ + "tactics:Conduct Pump Priming" + ], + "refs": [ + "https://github.com/DISARMFoundation/DISARMframeworks/blob/main/generated_pages/techniques/T0044.md" + ] + }, + "related": [ + { + "dest-uuid": "2ab07267-614d-538b-8fef-bc6ed250a483", + "type": "blocked-by" + }, + { + "dest-uuid": "3ce6759d-b144-5277-9798-2df09ce9a6c9", + "type": "blocked-by" + } + ], + "uuid": "0fd25b71-ea11-51a3-bb18-545d5e818583", + "value": "Seed Distortions" + }, + { + "description": "Use the fake experts that were set up during Establish Legitimacy. Pseudo-experts are disposable assets that often appear once and then disappear. Give \"credility\" to misinformation. Take advantage of credential bias", + "meta": { + "external_id": "T0045", + "kill_chain": [ + "tactics:Conduct Pump Priming" + ], + "refs": [ + "https://github.com/DISARMFoundation/DISARMframeworks/blob/main/generated_pages/techniques/T0045.md" + ] + }, + "related": [ + { + "dest-uuid": "a44e7e6c-f6ca-5ea4-9fe8-6dc798b2d729", + "type": "blocked-by" + }, + { + "dest-uuid": "2cd7227b-31be-5999-9f5f-927f9d8c3b6e", + "type": "blocked-by" + } + ], + "uuid": "edc041f8-06ac-513a-a9f9-1353e38f3bcf", + "value": "Use Fake Experts" + }, + { + "description": "Manipulate content engagement metrics (ie: Reddit & Twitter) to influence/impact news search results (e.g. Google), also elevates RT & Sputnik headline into Google news alert emails. aka \"Black-hat SEO\"", + "meta": { + "external_id": "T0046", + "kill_chain": [ + "tactics:Conduct Pump Priming" + ], + "refs": [ + "https://github.com/DISARMFoundation/DISARMframeworks/blob/main/generated_pages/techniques/T0046.md" + ] + }, + "related": [ + { + "dest-uuid": "5b9a74d0-bfa6-5bb9-9297-3938c067f783", + "type": "blocked-by" + } + ], + "uuid": "68c3a917-fed7-539e-9cf6-091153658ef2", + "value": "Use Search Engine Optimisation" + }, + { + "description": "Use political influence or the power of state to stop critical social media comments. Government requested/driven content take downs (see Google Transperancy reports).", + "meta": { + "external_id": "T0047", + "kill_chain": [ + "tactics:Drive Online Harms" + ], + "refs": [ + "https://github.com/DISARMFoundation/DISARMframeworks/blob/main/generated_pages/techniques/T0047.md" + ] + }, + "related": [ + { + "dest-uuid": "0eb2eaf4-0c53-527d-8744-70670f6a9736", + "type": "blocked-by" + } + ], + "uuid": "deb56d12-fd4d-515a-9051-89a372d5d4bb", + "value": "Censor Social Media as a Political Force" + }, + { + "description": "Threatening or harassing believers of opposing narratives refers to the use of intimidation techniques, including cyberbullying and doxing, to discourage opponents from voicing their dissent. An influence operation may threaten or harass believers of the opposing narratives to deter individuals from posting or proliferating conflicting content.", + "meta": { + "external_id": "T0048", + "kill_chain": [ + "tactics:Drive Online Harms" + ], + "refs": [ + "https://github.com/DISARMFoundation/DISARMframeworks/blob/main/generated_pages/techniques/T0048.md" + ] + }, + "related": [], + "uuid": "cb33d6fe-0327-58c1-93ad-10684fe9e099", + "value": "Harass" + }, + { + "description": "Cancel culture refers to the phenomenon in which individuals collectively refrain from supporting an individual, organisation, business, or other entity, usually following a real or falsified controversy. An influence operation may exploit cancel culture by emphasising an adversary’s problematic or disputed behaviour and presenting its own content as an alternative.", + "meta": { + "external_id": "T0048.001", + "kill_chain": [ + "tactics:Drive Online Harms" + ], + "refs": [ + "https://github.com/DISARMFoundation/DISARMframeworks/blob/main/generated_pages/techniques/T0048.001.md" + ] + }, + "related": [], + "uuid": "65c98713-cae5-5ae4-ae17-5902d7d1cfc4", + "value": "Boycott/\"Cancel\" Opponents" + }, + { + "description": "Examples include social identities like gender, sexuality, race, ethnicity, religion, ability, nationality, etc. as well as roles and occupations like journalist or activist.", + "meta": { + "external_id": "T0048.002", + "kill_chain": [ + "tactics:Drive Online Harms" + ], + "refs": [ + "https://github.com/DISARMFoundation/DISARMframeworks/blob/main/generated_pages/techniques/T0048.002.md" + ] + }, + "related": [], + "uuid": "a40e4177-42f2-5be2-89cf-1dd4eadaad13", + "value": "Harass People Based on Identities" + }, + { + "description": "Doxing refers to online harassment in which individuals publicly release private information about another individual, including names, addresses, employment information, pictures, family members, and other sensitive information. An influence operation may dox its opposition to encourage individuals aligned with operation narratives to harass the doxed individuals themselves or otherwise discourage the doxed individuals from posting or proliferating conflicting content.", + "meta": { + "external_id": "T0048.003", + "kill_chain": [ + "tactics:Drive Online Harms" + ], + "refs": [ + "https://github.com/DISARMFoundation/DISARMframeworks/blob/main/generated_pages/techniques/T0048.003.md" + ] + }, + "related": [], + "uuid": "c1df0074-7e66-5b71-85cb-784b1be15c48", + "value": "Threaten to Dox" + }, + { + "description": "Doxing refers to online harassment in which individuals publicly release private information about another individual, including names, addresses, employment information, pictures, family members, and other sensitive information. An influence operation may dox its opposition to encourage individuals aligned with operation narratives to harass the doxed individuals themselves or otherwise discourage the doxed individuals from posting or proliferating conflicting content.", + "meta": { + "external_id": "T0048.004", + "kill_chain": [ + "tactics:Drive Online Harms" + ], + "refs": [ + "https://github.com/DISARMFoundation/DISARMframeworks/blob/main/generated_pages/techniques/T0048.004.md" + ] + }, + "related": [], + "uuid": "18e83c9c-8e16-55e2-a013-63e583e79e8e", + "value": "Dox" + }, + { + "description": "Flooding and/or mobbing social media channels feeds and/or hashtag with excessive volume of content to control/shape online conversations and/or drown out opposing points of view. Bots and/or patriotic trolls are effective tools to acheive this effect.", + "meta": { + "external_id": "T0049", + "kill_chain": [ + "tactics:Maximise Exposure" + ], + "refs": [ + "https://github.com/DISARMFoundation/DISARMframeworks/blob/main/generated_pages/techniques/T0049.md" + ] + }, + "related": [ + { + "dest-uuid": "ae4b53ba-9dd6-53af-a624-d5929944117c", + "type": "blocked-by" + }, + { + "dest-uuid": "1d6622ba-a713-5133-9017-8eef36469936", + "type": "detected-by" + }, + { + "dest-uuid": "ea1d787b-61f7-5fd6-8c52-54a64006e260", + "type": "detected-by" + }, + { + "dest-uuid": "8b20ca17-c2d9-5879-bbf1-26de876c8e02", + "type": "detected-by" + }, + { + "dest-uuid": "568f9e72-ca8c-54dd-976f-f9469bf026c1", + "type": "detected-by" + } + ], + "uuid": "ee7bc41a-9eb0-5732-924a-3885e1c3bee9", + "value": "Flooding the Information Space" + }, + { + "description": "Use trolls to amplify narratives and/or manipulate narratives. Fake profiles/sockpuppets operating to support individuals/narratives from the entire political spectrum (left/right binary). Operating with increased emphasis on promoting local content and promoting real Twitter users generating their own, often divisive political content, as it's easier to amplify existing content than create new/original content. Trolls operate where ever there's a socially divisive issue (issues that can/are be politicized).", + "meta": { + "external_id": "T0049.001", + "kill_chain": [ + "tactics:Maximise Exposure" + ], + "refs": [ + "https://github.com/DISARMFoundation/DISARMframeworks/blob/main/generated_pages/techniques/T0049.001.md" + ] + }, + "related": [], + "uuid": "b126047b-eafa-50aa-891a-31250d13f50e", + "value": "Trolls Amplify and Manipulate" + }, + { + "description": "Take over an existing hashtag to drive exposure.", + "meta": { + "external_id": "T0049.002", + "kill_chain": [ + "tactics:Maximise Exposure" + ], + "refs": [ + "https://github.com/DISARMFoundation/DISARMframeworks/blob/main/generated_pages/techniques/T0049.002.md" + ] + }, + "related": [], + "uuid": "885e8687-3598-5378-b0bf-f09b67c1696e", + "value": "Hijack Existing Hashtag" + }, + { + "description": "Automated forwarding and reposting refer to the proliferation of operation content using automated means, such as artificial intelligence or social media bots. An influence operation may use automated activity to increase content exposure without dedicating the resources, including personnel and time, traditionally required to forward and repost content. Use bots to amplify narratives above algorithm thresholds. Bots are automated/programmed profiles designed to amplify content (ie: automatically retweet or like) and give appearance it's more \"popular\" than it is. They can operate as a network, to function in a coordinated/orchestrated manner. In some cases (more so now) they are an inexpensive/disposable assets used for minimal deployment as bot detection tools improve and platforms are more responsive.", + "meta": { + "external_id": "T0049.003", + "kill_chain": [ + "tactics:Maximise Exposure" + ], + "refs": [ + "https://github.com/DISARMFoundation/DISARMframeworks/blob/main/generated_pages/techniques/T0049.003.md" + ] + }, + "related": [], + "uuid": "78bd9a95-4aa4-5595-90de-839c65ff6542", + "value": "Bots Amplify via Automated Forwarding and Reposting" + }, + { + "description": "Spamoflauge refers to the practice of disguising spam messages as legitimate. Spam refers to the use of electronic messaging systems to send out unrequested or unwanted messages in bulk. Simple methods of spamoflauge include replacing letters with numbers to fool keyword-based email spam filters, for example, \"you've w0n our jackp0t!\". Spamoflauge may extend to more complex techniques such as modifying the grammar or word choice of the language, casting messages as images which spam detectors cannot automatically read, or encapsulating messages in password protected attachments, such as .pdf or .zip files. Influence operations may use spamoflauge to avoid spam filtering systems and increase the likelihood of the target audience receiving operation messaging.", + "meta": { + "external_id": "T0049.004", + "kill_chain": [ + "tactics:Maximise Exposure" + ], + "refs": [ + "https://github.com/DISARMFoundation/DISARMframeworks/blob/main/generated_pages/techniques/T0049.004.md" + ] + }, + "related": [], + "uuid": "36635199-0794-5cba-b494-5b54ebd0ca73", + "value": "Utilise Spamoflauge" + }, + { + "description": "Swarming refers to the coordinated use of accounts to overwhelm the information space with operation content. Unlike information flooding, swarming centres exclusively around a specific event or actor rather than a general narrative. Swarming relies on “horizontal communication” between information assets rather than a top-down, vertical command-and-control approach.", + "meta": { + "external_id": "T0049.005", + "kill_chain": [ + "tactics:Maximise Exposure" + ], + "refs": [ + "https://github.com/DISARMFoundation/DISARMframeworks/blob/main/generated_pages/techniques/T0049.005.md" + ] + }, + "related": [], + "uuid": "b25835fd-4936-580f-9e40-03728f38badf", + "value": "Conduct Swarming" + }, + { + "description": "Keyword squatting refers to the creation of online content, such as websites, articles, or social media accounts, around a specific search engine-optimized term to overwhelm the search results of that term. An influence may keyword squat to increase content exposure to target audience members who query the exploited term in a search engine and manipulate the narrative around the term.", + "meta": { + "external_id": "T0049.006", + "kill_chain": [ + "tactics:Maximise Exposure" + ], + "refs": [ + "https://github.com/DISARMFoundation/DISARMframeworks/blob/main/generated_pages/techniques/T0049.006.md" + ] + }, + "related": [], + "uuid": "864a3b1d-6a1f-50b0-adef-e46cc4a88933", + "value": "Conduct Keyword Squatting" + }, + { + "description": "Inauthentic sites circulate cross-post stories and amplify narratives. Often these sites have no masthead, bylines or attribution.", + "meta": { + "external_id": "T0049.007", + "kill_chain": [ + "tactics:Maximise Exposure" + ], + "refs": [ + "https://github.com/DISARMFoundation/DISARMframeworks/blob/main/generated_pages/techniques/T0049.007.md" + ] + }, + "related": [], + "uuid": "d8a87575-9e25-5e93-8bf6-8489fe70b864", + "value": "Inauthentic Sites Amplify News and Narratives" + }, + { + "description": "Coordinate and promote real-world events across media platforms, e.g. rallies, protests, gatherings in support of incident narratives.", + "meta": { + "external_id": "T0057", + "kill_chain": [ + "tactics:Drive Offline Activity" + ], + "refs": [ + "https://github.com/DISARMFoundation/DISARMframeworks/blob/main/generated_pages/techniques/T0057.md" + ] + }, + "related": [ + { + "dest-uuid": "a6b2f9bc-47fd-5303-8df8-0bb4ae4f4cbd", + "type": "blocked-by" + }, + { + "dest-uuid": "8e0b3604-c03c-5772-bccc-3a381ea6300a", + "type": "detected-by" + } + ], + "uuid": "26c314bb-ed05-5dbe-b672-c16c2f0fff52", + "value": "Organise Events" + }, + { + "description": "Paying for physical action occurs when an influence operation pays individuals to act in the physical realm. An influence operation may pay for physical action to create specific situations and frame them in a way that supports operation narratives, for example, paying a group of people to burn a car to later post an image of the burning car and frame it as an act of protest.", + "meta": { + "external_id": "T0057.001", + "kill_chain": [ + "tactics:Drive Offline Activity" + ], + "refs": [ + "https://github.com/DISARMFoundation/DISARMframeworks/blob/main/generated_pages/techniques/T0057.001.md" + ] + }, + "related": [], + "uuid": "c4f3903c-0a5f-5764-ab76-a7d3a4ee0afb", + "value": "Pay for Physical Action" + }, + { + "description": "Symbolic action refers to activities specifically intended to advance an operation’s narrative by signalling something to the audience, for example, a military parade supporting a state’s narrative of military superiority. An influence operation may use symbolic action to create falsified evidence supporting operation narratives in the physical information space.", + "meta": { + "external_id": "T0057.002", + "kill_chain": [ + "tactics:Drive Offline Activity" + ], + "refs": [ + "https://github.com/DISARMFoundation/DISARMframeworks/blob/main/generated_pages/techniques/T0057.002.md" + ] + }, + "related": [], + "uuid": "055b66cb-0745-5f85-83c9-d9fb8e1684a2", + "value": "Conduct Symbolic Action" + }, + { + "description": "Play the long game refers to two phenomena: 1. To plan messaging and allow it to grow organically without conducting your own amplification. This is methodical and slow and requires years for the message to take hold 2. To develop a series of seemingly disconnected messaging narratives that eventually combine into a new narrative.", + "meta": { + "external_id": "T0059", + "kill_chain": [ + "tactics:Persist in the Information Environment" + ], + "refs": [ + "https://github.com/DISARMFoundation/DISARMframeworks/blob/main/generated_pages/techniques/T0059.md" + ] + }, + "related": [], + "uuid": "2a8e8fa2-6ac4-5e0b-b1fb-818362987687", + "value": "Play the Long Game" + }, + { + "description": "continue narrative or message amplification after the main incident work has finished", + "meta": { + "external_id": "T0060", + "kill_chain": [ + "tactics:Persist in the Information Environment" + ], + "refs": [ + "https://github.com/DISARMFoundation/DISARMframeworks/blob/main/generated_pages/techniques/T0060.md" + ] + }, + "related": [ + { + "dest-uuid": "80730d54-1dd1-5da6-baae-052553fbf27f", + "type": "blocked-by" + }, + { + "dest-uuid": "7ef86cff-4401-518b-92fc-a0d88c23f280", + "type": "blocked-by" + }, + { + "dest-uuid": "49f92a32-bac9-56af-ac97-3b09f23b8fa6", + "type": "blocked-by" + } + ], + "uuid": "6eb04152-8342-563a-9b9c-1e73aae2cc24", + "value": "Continue to Amplify" + }, + { + "description": "Sell mechandise refers to getting the message or narrative into physical space in the offline world while making money", + "meta": { + "external_id": "T0061", + "kill_chain": [ + "tactics:Drive Offline Activity" + ], + "refs": [ + "https://github.com/DISARMFoundation/DISARMframeworks/blob/main/generated_pages/techniques/T0061.md" + ] + }, + "related": [], + "uuid": "e9208787-0c74-5517-bdd5-add8476beb6a", + "value": "Sell Merchandise" + }, + { + "description": "Create or coopt broadcast capabilities (e.g. TV, radio etc).", + "meta": { + "external_id": "T0065", + "kill_chain": [ + "tactics:Establish Social Assets" + ], + "refs": [ + "https://github.com/DISARMFoundation/DISARMframeworks/blob/main/generated_pages/techniques/T0065.md" + ] + }, + "related": [], + "uuid": "8c763ea9-83ee-5ea6-91bb-5ab0dd981006", + "value": "Prepare Physical Broadcast Capabilities" + }, + { + "description": "Plan to degrade an adversary’s image or ability to act. This could include preparation and use of harmful information about the adversary’s actions or reputation.", + "meta": { + "external_id": "T0066", + "kill_chain": [ + "tactics:Plan Objectives" + ], + "refs": [ + "https://github.com/DISARMFoundation/DISARMframeworks/blob/main/generated_pages/techniques/T0066.md" + ] + }, + "related": [], + "uuid": "30e32d3b-ece9-545b-b74f-82861e22c133", + "value": "Degrade Adversary" + }, + { + "description": "Media attention on a story or event is heightened during a breaking news event, where unclear facts and incomplete information increase speculation, rumours, and conspiracy theories, which are all vulnerable to manipulation.", + "meta": { + "external_id": "T0068", + "kill_chain": [ + "tactics:Develop Narratives" + ], + "refs": [ + "https://github.com/DISARMFoundation/DISARMframeworks/blob/main/generated_pages/techniques/T0068.md" + ] + }, + "related": [], + "uuid": "df8d3fc5-efd3-54bf-baef-eaa6ec375f0f", + "value": "Respond to Breaking News Event or Active Crisis" + }, + { + "description": "Create audience segmentations by features of interest to the influence campaign, including political affiliation, geographic location, income, demographics, and psychographics.", + "meta": { + "external_id": "T0072", + "kill_chain": [ + "tactics:Target Audience Analysis" + ], + "refs": [ + "https://github.com/DISARMFoundation/DISARMframeworks/blob/main/generated_pages/techniques/T0072.md" + ] + }, + "related": [], + "uuid": "d9bbfde8-dda3-5f20-a9ed-fbf021ecd8c1", + "value": "Segment Audiences" + }, + { + "description": "An influence operation may target populations in a specific geographic location, such as a region, state, or city. An influence operation may use geographic segmentation to Create Localised Content (see: Establish Legitimacy).", + "meta": { + "external_id": "T0072.001", + "kill_chain": [ + "tactics:Target Audience Analysis" + ], + "refs": [ + "https://github.com/DISARMFoundation/DISARMframeworks/blob/main/generated_pages/techniques/T0072.001.md" + ] + }, + "related": [], + "uuid": "3c3edffe-de30-5b0c-8005-8916dd92eb1e", + "value": "Geographic Segmentation" + }, + { + "description": "An influence operation may target populations based on demographic segmentation, including age, gender, and income. Demographic segmentation may be useful for influence operations aiming to change state policies that affect a specific population sector. For example, an influence operation attempting to influence Medicare funding in the United States would likely target U.S. voters over 65 years of age.", + "meta": { + "external_id": "T0072.002", + "kill_chain": [ + "tactics:Target Audience Analysis" + ], + "refs": [ + "https://github.com/DISARMFoundation/DISARMframeworks/blob/main/generated_pages/techniques/T0072.002.md" + ] + }, + "related": [], + "uuid": "d19a9243-0fa0-5140-81c9-57442e8f7e25", + "value": "Demographic Segmentation" + }, + { + "description": "An influence operation may target populations based on their income bracket, wealth, or other financial or economic division.", + "meta": { + "external_id": "T0072.003", + "kill_chain": [ + "tactics:Target Audience Analysis" + ], + "refs": [ + "https://github.com/DISARMFoundation/DISARMframeworks/blob/main/generated_pages/techniques/T0072.003.md" + ] + }, + "related": [], + "uuid": "163b9226-7923-527f-802f-8865450db2f5", + "value": "Economic Segmentation" + }, + { + "description": "An influence operation may target populations based on psychographic segmentation, which uses audience values and decision-making processes. An operation may individually gather psychographic data with its own surveys or collection tools or externally purchase data from social media companies or online surveys, such as personality quizzes.", + "meta": { + "external_id": "T0072.004", + "kill_chain": [ + "tactics:Target Audience Analysis" + ], + "refs": [ + "https://github.com/DISARMFoundation/DISARMframeworks/blob/main/generated_pages/techniques/T0072.004.md" + ] + }, + "related": [], + "uuid": "474e292b-e866-5871-9ab6-395cc5aaa097", + "value": "Psychographic Segmentation" + }, + { + "description": "An influence operation may target populations based on their political affiliations, especially when aiming to manipulate voting or change policy.", + "meta": { + "external_id": "T0072.005", + "kill_chain": [ + "tactics:Target Audience Analysis" + ], + "refs": [ + "https://github.com/DISARMFoundation/DISARMframeworks/blob/main/generated_pages/techniques/T0072.005.md" + ] + }, + "related": [], + "uuid": "77ab671a-d532-50b7-ac02-2008d331164f", + "value": "Political Segmentation" + }, + { + "description": "Determining the target audiences (segments of the population) who will receive campaign narratives and artefacts intended to achieve the strategic ends.", + "meta": { + "external_id": "T0073", + "kill_chain": [ + "tactics:Plan Strategy" + ], + "refs": [ + "https://github.com/DISARMFoundation/DISARMframeworks/blob/main/generated_pages/techniques/T0073.md" + ] + }, + "related": [], + "uuid": "872a110b-66ad-5854-aae5-a9725d227a5c", + "value": "Determine Target Audiences" + }, + { + "description": "These are the long-term end-states the campaign aims to bring about. They typically involve an advantageous position vis-a-vis competitors in terms of power or influence. The strategic goal may be to improve or simply to hold one’s position. Competition occurs in the public sphere in the domains of war, diplomacy, politics, economics, and ideology, and can play out between armed groups, nation-states, political parties, corporations, interest groups, or individuals. ", + "meta": { + "external_id": "T0074", + "kill_chain": [ + "tactics:Plan Strategy" + ], + "refs": [ + "https://github.com/DISARMFoundation/DISARMframeworks/blob/main/generated_pages/techniques/T0074.md" + ] + }, + "related": [], + "uuid": "d88805d4-273a-50fb-a24a-63df92592e20", + "value": "Determine Strategic Ends" + }, + { + "description": "Favourable position on the international stage in terms of great power politics or regional rivalry. Geopolitics plays out in the realms of foreign policy, national security, diplomacy, and intelligence. It involves nation-state governments, heads of state, foreign ministers, intergovernmental organisations, and regional security alliances.", + "meta": { + "external_id": "T0074.001", + "kill_chain": [ + "tactics:Plan Strategy" + ], + "refs": [ + "https://github.com/DISARMFoundation/DISARMframeworks/blob/main/generated_pages/techniques/T0074.001.md" + ] + }, + "related": [], + "uuid": "3c362b89-6b61-5ea9-ba32-4873594ee92d", + "value": "Geopolitical Advantage" + }, + { + "description": "Favourable position vis-à-vis national or sub-national political opponents such as political parties, interest groups, politicians, candidates. ", + "meta": { + "external_id": "T0074.002", + "kill_chain": [ + "tactics:Plan Strategy" + ], + "refs": [ + "https://github.com/DISARMFoundation/DISARMframeworks/blob/main/generated_pages/techniques/T0074.002.md" + ] + }, + "related": [], + "uuid": "a3ba0d23-3e22-5fb3-a4fd-074ab5bdc05a", + "value": "Domestic Political Advantage" + }, + { + "description": "Favourable position domestically or internationally in the realms of commerce, trade, finance, industry. Economics involves nation-states, corporations, banks, trade blocs, industry associations, cartels. ", + "meta": { + "external_id": "T0074.003", + "kill_chain": [ + "tactics:Plan Strategy" + ], + "refs": [ + "https://github.com/DISARMFoundation/DISARMframeworks/blob/main/generated_pages/techniques/T0074.003.md" + ] + }, + "related": [], + "uuid": "9fc9578f-db6c-5505-ac66-dbdb6e887c6f", + "value": "Economic Advantage" + }, + { + "description": "Favourable position domestically or internationally in the market for ideas, beliefs, and world views. Competition plays out among faith systems, political systems, and value systems. It can involve sub-national, national or supra-national movements. ", + "meta": { + "external_id": "T0074.004", + "kill_chain": [ + "tactics:Plan Strategy" + ], + "refs": [ + "https://github.com/DISARMFoundation/DISARMframeworks/blob/main/generated_pages/techniques/T0074.004.md" + ] + }, + "related": [], + "uuid": "c3156aaf-caf1-5188-836c-d5742cfc89fa", + "value": "Ideological Advantage" + }, + { + "description": "Push back against criticism by dismissing your critics. This might be arguing that the critics use a different standard for you than with other actors or themselves; or arguing that their criticism is biassed.", + "meta": { + "external_id": "T0075", + "kill_chain": [ + "tactics:Plan Objectives" + ], + "refs": [ + "https://github.com/DISARMFoundation/DISARMframeworks/blob/main/generated_pages/techniques/T0075.md" + ] + }, + "related": [], + "uuid": "3c33a91e-af4c-545d-bf54-a15fab753a11", + "value": "Dismiss" + }, + { + "description": "Plan to delegitimize the media landscape and degrade public trust in reporting, by discrediting credible sources. This makes it easier to promote influence operation content.", + "meta": { + "external_id": "T0075.001", + "kill_chain": [ + "tactics:Plan Objectives" + ], + "refs": [ + "https://github.com/DISARMFoundation/DISARMframeworks/blob/main/generated_pages/techniques/T0075.001.md" + ] + }, + "related": [], + "uuid": "be2a0989-a95f-5961-ba7d-0597078dca96", + "value": "Discredit Credible Sources" + }, + { + "description": "Twist the narrative. Take information, or artefacts like images, and change the framing around them.", + "meta": { + "external_id": "T0076", + "kill_chain": [ + "tactics:Plan Objectives" + ], + "refs": [ + "https://github.com/DISARMFoundation/DISARMframeworks/blob/main/generated_pages/techniques/T0076.md" + ] + }, + "related": [], + "uuid": "bd75892f-b84d-5b36-b2d9-34832832296b", + "value": "Distort" + }, + { + "description": "Shift attention to a different narrative or actor, for instance by accusing critics of the same activity that they’ve accused you of (e.g. police brutality).", + "meta": { + "external_id": "T0077", + "kill_chain": [ + "tactics:Plan Objectives" + ], + "refs": [ + "https://github.com/DISARMFoundation/DISARMframeworks/blob/main/generated_pages/techniques/T0077.md" + ] + }, + "related": [], + "uuid": "8c807754-1267-5662-99f4-02461410cb3d", + "value": "Distract" + }, + { + "description": "Threaten the critic or narrator of events. For instance, threaten journalists or news outlets reporting on a story.", + "meta": { + "external_id": "T0078", + "kill_chain": [ + "tactics:Plan Objectives" + ], + "refs": [ + "https://github.com/DISARMFoundation/DISARMframeworks/blob/main/generated_pages/techniques/T0078.md" + ] + }, + "related": [], + "uuid": "28400a1a-58f1-51ee-9e96-2c763279b990", + "value": "Dismay" + }, + { + "description": "Create conflict between subgroups, to widen divisions in a community", + "meta": { + "external_id": "T0079", + "kill_chain": [ + "tactics:Plan Objectives" + ], + "refs": [ + "https://github.com/DISARMFoundation/DISARMframeworks/blob/main/generated_pages/techniques/T0079.md" + ] + }, + "related": [], + "uuid": "45926a30-7c89-5c14-bf7b-86f8c9597d15", + "value": "Divide" + }, + { + "description": "Mapping the target audience information environment analyses the information space itself, including social media analytics, web traffic, and media surveys. Mapping the information environment may help the influence operation determine the most realistic and popular information channels to reach its target audience. Mapping the target audience information environment aids influence operations in determining the most vulnerable areas of the information space to target with messaging.", + "meta": { + "external_id": "T0080", + "kill_chain": [ + "tactics:Target Audience Analysis" + ], + "refs": [ + "https://github.com/DISARMFoundation/DISARMframeworks/blob/main/generated_pages/techniques/T0080.md" + ] + }, + "related": [], + "uuid": "649af4be-031b-55db-ab45-d82b3cec27c2", + "value": "Map Target Audience Information Environment" + }, + { + "description": "An influence operation may use social media analytics to determine which factors will increase the operation content’s exposure to its target audience on social media platforms, including views, interactions, and sentiment relating to topics and content types. The social media platform itself or a third-party tool may collect the metrics.", + "meta": { + "external_id": "T0080.001", + "kill_chain": [ + "tactics:Target Audience Analysis" + ], + "refs": [ + "https://github.com/DISARMFoundation/DISARMframeworks/blob/main/generated_pages/techniques/T0080.001.md" + ] + }, + "related": [], + "uuid": "a20c76bd-0b45-53f6-8cc5-6bc8a17289cf", + "value": "Monitor Social Media Analytics" + }, + { + "description": "An influence operation may evaluate its own or third-party media surveys to determine what type of content appeals to its target audience. Media surveys may provide insight into an audience’s political views, social class, general interests, or other indicators used to tailor operation messaging to its target audience.", + "meta": { + "external_id": "T0080.002", + "kill_chain": [ + "tactics:Target Audience Analysis" + ], + "refs": [ + "https://github.com/DISARMFoundation/DISARMframeworks/blob/main/generated_pages/techniques/T0080.002.md" + ] + }, + "related": [], + "uuid": "af0acad2-7020-56cb-9775-56f03bad5bcf", + "value": "Evaluate Media Surveys" + }, + { + "description": "An influence operation may identify trending hashtags on social media platforms for later use in boosting operation content. A hashtag40 refers to a word or phrase preceded by the hash symbol (#) on social media used to identify messages and posts relating to a specific topic. All public posts that use the same hashtag are aggregated onto a centralised page dedicated to the word or phrase and sorted either chronologically or by popularity.", + "meta": { + "external_id": "T0080.003", + "kill_chain": [ + "tactics:Target Audience Analysis" + ], + "refs": [ + "https://github.com/DISARMFoundation/DISARMframeworks/blob/main/generated_pages/techniques/T0080.003.md" + ] + }, + "related": [], + "uuid": "269f9f9a-c8a4-5b68-8bf7-f09dd1dbd393", + "value": "Identify Trending Topics/Hashtags" + }, + { + "description": "An influence operation may conduct web traffic analysis to determine which search engines, keywords, websites, and advertisements gain the most traction with its target audience.", + "meta": { + "external_id": "T0080.004", + "kill_chain": [ + "tactics:Target Audience Analysis" + ], + "refs": [ + "https://github.com/DISARMFoundation/DISARMframeworks/blob/main/generated_pages/techniques/T0080.004.md" + ] + }, + "related": [], + "uuid": "8be163d6-9e22-5749-a11c-e1184ec64d33", + "value": "Conduct Web Traffic Analysis" + }, + { + "description": "An influence operation may survey a target audience’s Internet availability and degree of media freedom to determine which target audience members will have access to operation content and on which platforms. An operation may face more difficulty targeting an information environment with heavy restrictions and media control than an environment with independent media, freedom of speech and of the press, and individual liberties.", + "meta": { + "external_id": "T0080.005", + "kill_chain": [ + "tactics:Target Audience Analysis" + ], + "refs": [ + "https://github.com/DISARMFoundation/DISARMframeworks/blob/main/generated_pages/techniques/T0080.005.md" + ] + }, + "related": [], + "uuid": "e5b33222-ed53-5da5-9d12-778741c209e2", + "value": "Assess Degree/Type of Media Access" + }, + { + "description": "Identifying social and technical vulnerabilities determines weaknesses within the target audience information environment for later exploitation. Vulnerabilities include decisive political issues, weak cybersecurity infrastructure, search engine data voids, and other technical and non technical weaknesses in the target information environment. Identifying social and technical vulnerabilities facilitates the later exploitation of the identified weaknesses to advance operation objectives.", + "meta": { + "external_id": "T0081", + "kill_chain": [ + "tactics:Target Audience Analysis" + ], + "refs": [ + "https://github.com/DISARMFoundation/DISARMframeworks/blob/main/generated_pages/techniques/T0081.md" + ] + }, + "related": [], + "uuid": "6870e08f-8a82-592a-91be-71f732281a29", + "value": "Identify Social and Technical Vulnerabilities" + }, + { + "description": "Find or plan to create areas (social media groups, search term groups, hashtag groups etc) where individuals only engage with people they agree with.", + "meta": { + "external_id": "T0081.001", + "kill_chain": [ + "tactics:Target Audience Analysis" + ], + "refs": [ + "https://github.com/DISARMFoundation/DISARMframeworks/blob/main/generated_pages/techniques/T0081.001.md" + ] + }, + "related": [], + "uuid": "b6698222-4827-5b48-b0f4-b6d160cca97a", + "value": "Find Echo Chambers" + }, + { + "description": "A data void refers to a word or phrase that results in little, manipulative, or low-quality search engine data. Data voids are hard to detect and relatively harmless until exploited by an entity aiming to quickly proliferate false or misleading information during a phenomenon that causes a high number of individuals to query the term or phrase. In the Plan phase, an influence operation may identify data voids for later exploitation in the operation. A 2019 report by Michael Golebiewski identifies five types of data voids. (1) “Breaking news” data voids occur when a keyword gains popularity during a short period of time, allowing an influence operation to publish false content before legitimate news outlets have an opportunity to publish relevant information. (2) An influence operation may create a “strategic new terms” data void by creating their own terms and publishing information online before promoting their keyword to the target audience. (3) An influence operation may publish content on “outdated terms” that have decreased in popularity, capitalising on most search engines’ preferences for recency. (4) “Fragmented concepts” data voids separate connections between similar ideas, isolating segment queries to distinct search engine results. (5) An influence operation may use “problematic queries” that previously resulted in disturbing or inappropriate content to promote messaging until mainstream media recontextualizes the term.", + "meta": { + "external_id": "T0081.002", + "kill_chain": [ + "tactics:Target Audience Analysis" + ], + "refs": [ + "https://github.com/DISARMFoundation/DISARMframeworks/blob/main/generated_pages/techniques/T0081.002.md" + ] + }, + "related": [], + "uuid": "ab5b0e25-01fa-5a41-9ad8-7445034cf952", + "value": "Identify Data Voids" + }, + { + "description": "An influence operation may exploit existing racial, religious, demographic, or social prejudices to further polarise its target audience from the rest of the public.", + "meta": { + "external_id": "T0081.003", + "kill_chain": [ + "tactics:Target Audience Analysis" + ], + "refs": [ + "https://github.com/DISARMFoundation/DISARMframeworks/blob/main/generated_pages/techniques/T0081.003.md" + ] + }, + "related": [], + "uuid": "0eefce18-09c4-513b-85a7-4441aa5df105", + "value": "Identify Existing Prejudices" + }, + { + "description": "An influence operation may identify existing fissures to pit target populations against one another or facilitate a “divide-and-conquer\" approach to tailor operation narratives along the divides.", + "meta": { + "external_id": "T0081.004", + "kill_chain": [ + "tactics:Target Audience Analysis" + ], + "refs": [ + "https://github.com/DISARMFoundation/DISARMframeworks/blob/main/generated_pages/techniques/T0081.004.md" + ] + }, + "related": [], + "uuid": "b3e586f5-98e3-556c-8d00-2d5be1482438", + "value": "Identify Existing Fissures" + }, + { + "description": "An influence operation may assess preexisting conspiracy theories or suspicions in a population to identify existing narratives that support operational objectives.", + "meta": { + "external_id": "T0081.005", + "kill_chain": [ + "tactics:Target Audience Analysis" + ], + "refs": [ + "https://github.com/DISARMFoundation/DISARMframeworks/blob/main/generated_pages/techniques/T0081.005.md" + ] + }, + "related": [], + "uuid": "eb4cc97e-5620-5bf9-9b8b-1d6f5e00f81d", + "value": "Identify Existing Conspiracy Narratives/Suspicions" + }, + { + "description": "A wedge issue is a divisive political issue, usually concerning a social phenomenon, that divides individuals along a defined line. An influence operation may exploit wedge issues by intentionally polarising the public along the wedge issue line and encouraging opposition between factions.", + "meta": { + "external_id": "T0081.006", + "kill_chain": [ + "tactics:Target Audience Analysis" + ], + "refs": [ + "https://github.com/DISARMFoundation/DISARMframeworks/blob/main/generated_pages/techniques/T0081.006.md" + ] + }, + "related": [], + "uuid": "ac3f406b-c1dc-561a-ad27-c65c22a3a321", + "value": "Identify Wedge Issues" + }, + { + "description": "An influence operation may identify or create a real or imaginary adversary to centre operation narratives against. A real adversary may include certain politicians or political parties while imaginary adversaries may include falsified “deep state”62 actors that, according to conspiracies, run the state behind public view.", + "meta": { + "external_id": "T0081.007", + "kill_chain": [ + "tactics:Target Audience Analysis" + ], + "refs": [ + "https://github.com/DISARMFoundation/DISARMframeworks/blob/main/generated_pages/techniques/T0081.007.md" + ] + }, + "related": [], + "uuid": "302d5e0a-375a-5fc6-a1da-0b33c9268af6", + "value": "Identify Target Audience Adversaries" + }, + { + "description": "An influence operation may exploit existing weaknesses in a target’s media system. These weaknesses may include existing biases among media agencies, vulnerability to false news agencies on social media, or existing distrust of traditional media sources. An existing distrust among the public in the media system’s credibility holds high potential for exploitation by an influence operation when establishing alternative news agencies to spread operation content.", + "meta": { + "external_id": "T0081.008", + "kill_chain": [ + "tactics:Target Audience Analysis" + ], + "refs": [ + "https://github.com/DISARMFoundation/DISARMframeworks/blob/main/generated_pages/techniques/T0081.008.md" + ] + }, + "related": [], + "uuid": "662f0d37-b90a-559f-8685-fa06a69be1cb", + "value": "Identify Media System Vulnerabilities" + }, + { + "description": "Actors may develop new narratives to further strategic or tactical goals, especially when existing narratives adequately align with the campaign goals. New narratives provide more control in terms of crafting the message to achieve specific goals. However, new narratives may require more effort to disseminate than adapting or adopting existing narratives.", + "meta": { + "external_id": "T0082", + "kill_chain": [ + "tactics:Develop Narratives" + ], + "refs": [ + "https://github.com/DISARMFoundation/DISARMframeworks/blob/main/generated_pages/techniques/T0082.md" + ] + }, + "related": [], + "uuid": "4896a448-be51-5423-89cd-efb6444b1c75", + "value": "Develop New Narratives" + }, + { + "description": "An influence operation may seek to exploit the preexisting weaknesses, fears, and enemies of the target audience for integration into the operation’s narratives and overall strategy. Integrating existing vulnerabilities into the operational approach conserves resources by exploiting already weak areas of the target information environment instead of forcing the operation to create new vulnerabilities in the environment.", + "meta": { + "external_id": "T0083", + "kill_chain": [ + "tactics:Develop Narratives" + ], + "refs": [ + "https://github.com/DISARMFoundation/DISARMframeworks/blob/main/generated_pages/techniques/T0083.md" + ] + }, + "related": [], + "uuid": "f78a066b-d01b-5f14-8327-4e2856a187d2", + "value": "Integrate Target Audience Vulnerabilities into Narrative" + }, + { + "description": "When an operation recycles content from its own previous operations or plagiarises from external operations. An operation may launder information to conserve resources that would have otherwise been utilised to develop new content.", + "meta": { + "external_id": "T0084", + "kill_chain": [ + "tactics:Develop Content" + ], + "refs": [ + "https://github.com/DISARMFoundation/DISARMframeworks/blob/main/generated_pages/techniques/T0084.md" + ] + }, + "related": [], + "uuid": "7828596a-f1b5-563c-bd40-4a876b5cec58", + "value": "Reuse Existing Content" + }, + { + "description": "Copypasta refers to a piece of text that has been copied and pasted multiple times across various online platforms. A copypasta’s final form may differ from its original source text as users add, delete, or otherwise edit the content as they repost the text.", + "meta": { + "external_id": "T0084.001", + "kill_chain": [ + "tactics:Develop Content" + ], + "refs": [ + "https://github.com/DISARMFoundation/DISARMframeworks/blob/main/generated_pages/techniques/T0084.001.md" + ] + }, + "related": [], + "uuid": "dba75e23-c7f8-504d-83a7-5771148e5951", + "value": "Use Copypasta" + }, + { + "description": "An influence operation may take content from other sources without proper attribution. This content may be either misinformation content shared by others without malicious intent but now leveraged by the campaign as disinformation or disinformation content from other sources.", + "meta": { + "external_id": "T0084.002", + "kill_chain": [ + "tactics:Develop Content" + ], + "refs": [ + "https://github.com/DISARMFoundation/DISARMframeworks/blob/main/generated_pages/techniques/T0084.002.md" + ] + }, + "related": [], + "uuid": "33787c2e-55c8-54a4-9d2d-541a35b5932e", + "value": "Plagiarise Content" + }, + { + "description": "An influence operation may take authentic content from other sources and add deceptive labels or deceptively translate the content into other langauges.", + "meta": { + "external_id": "T0084.003", + "kill_chain": [ + "tactics:Develop Content" + ], + "refs": [ + "https://github.com/DISARMFoundation/DISARMframeworks/blob/main/generated_pages/techniques/T0084.003.md" + ] + }, + "related": [], + "uuid": "a1f69093-a97c-561e-80ec-da8c93004205", + "value": "Deceptively Labelled or Translated" + }, + { + "description": "An influence operation may take content from other sources with proper attribution. This content may be either misinformation content shared by others without malicious intent but now leveraged by the campaign as disinformation or disinformation content from other sources. Examples include the appropriation of content from one inauthentic news site to another inauthentic news site or network in ways that align with the originators licencing or terms of service.", + "meta": { + "external_id": "T0084.004", + "kill_chain": [ + "tactics:Develop Content" + ], + "refs": [ + "https://github.com/DISARMFoundation/DISARMframeworks/blob/main/generated_pages/techniques/T0084.004.md" + ] + }, + "related": [], + "uuid": "f941e002-c556-5621-a80e-c52a38c54bc9", + "value": "Appropriate Content" + }, + { + "description": "Creating and editing false or misleading text-based artefacts, often aligned with one or more specific narratives, for use in a disinformation campaign.", + "meta": { + "external_id": "T0085", + "kill_chain": [ + "tactics:Develop Content" + ], + "refs": [ + "https://github.com/DISARMFoundation/DISARMframeworks/blob/main/generated_pages/techniques/T0085.md" + ] + }, + "related": [], + "uuid": "bff9c590-c655-5c15-ae4d-13d353a0d9a4", + "value": "Develop Text-Based Content" + }, + { + "description": "AI-generated texts refers to synthetic text composed by computers using text-generating AI technology. Autonomous generation refers to content created by a bot without human input, also known as bot-created content generation. Autonomous generation represents the next step in automation after language generation and may lead to automated journalism. An influence operation may use read fakes or autonomous generation to quickly develop and distribute content to the target audience.", + "meta": { + "external_id": "T0085.001", + "kill_chain": [ + "tactics:Develop Content" + ], + "refs": [ + "https://github.com/DISARMFoundation/DISARMframeworks/blob/main/generated_pages/techniques/T0085.001.md" + ] + }, + "related": [], + "uuid": "ed3754e6-bc15-5cf0-8a4b-8737b3814225", + "value": "Develop AI-Generated Text" + }, + { + "description": "Develop False or Altered Documents", + "meta": { + "external_id": "T0085.002", + "kill_chain": [ + "tactics:Develop Content" + ], + "refs": [ + "https://github.com/DISARMFoundation/DISARMframeworks/blob/main/generated_pages/techniques/T0085.002.md" + ] + }, + "related": [], + "uuid": "5b0d1b23-0b48-5f67-8fb4-fe4430f30990", + "value": "Develop False or Altered Documents" + }, + { + "description": "An influence operation may develop false or misleading news articles aligned to their campaign goals or narratives.", + "meta": { + "external_id": "T0085.003", + "kill_chain": [ + "tactics:Develop Content" + ], + "refs": [ + "https://github.com/DISARMFoundation/DISARMframeworks/blob/main/generated_pages/techniques/T0085.003.md" + ] + }, + "related": [], + "uuid": "7bbdfe14-8294-54f7-9842-449f2db17a90", + "value": "Develop Inauthentic News Articles" + }, + { + "description": "Creating and editing false or misleading visual artefacts, often aligned with one or more specific narratives, for use in a disinformation campaign. This may include photographing staged real-life situations, repurposing existing digital images, or using image creation and editing technologies.", + "meta": { + "external_id": "T0086", + "kill_chain": [ + "tactics:Develop Content" + ], + "refs": [ + "https://github.com/DISARMFoundation/DISARMframeworks/blob/main/generated_pages/techniques/T0086.md" + ] + }, + "related": [], + "uuid": "9039269a-4975-52f8-92a8-f142978ffcef", + "value": "Develop Image-Based Content" + }, + { + "description": "Memes are one of the most important single artefact types in all of computational propaganda. Memes in this framework denotes the narrow image-based definition. But that naming is no accident, as these items have most of the important properties of Dawkins' original conception as a self-replicating unit of culture. Memes pull together reference and commentary; image and narrative; emotion and message. Memes are a powerful tool and the heart of modern influence campaigns.", + "meta": { + "external_id": "T0086.001", + "kill_chain": [ + "tactics:Develop Content" + ], + "refs": [ + "https://github.com/DISARMFoundation/DISARMframeworks/blob/main/generated_pages/techniques/T0086.001.md" + ] + }, + "related": [], + "uuid": "8c65e301-7dc0-5727-879b-288a643a992b", + "value": "Develop Memes" + }, + { + "description": "Deepfakes refer to AI-generated falsified photos, videos, or soundbites. An influence operation may use deepfakes to depict an inauthentic situation by synthetically recreating an individual’s face, body, voice, and physical gestures.", + "meta": { + "external_id": "T0086.002", + "kill_chain": [ + "tactics:Develop Content" + ], + "refs": [ + "https://github.com/DISARMFoundation/DISARMframeworks/blob/main/generated_pages/techniques/T0086.002.md" + ] + }, + "related": [], + "uuid": "0fa4f572-63c0-5a60-9e5e-2234e94f0ee6", + "value": "Develop AI-Generated Images (Deepfakes)" + }, + { + "description": "Cheap fakes utilise less sophisticated measures of altering an image, video, or audio for example, slowing, speeding, or cutting footage to create a false context surrounding an image or event.", + "meta": { + "external_id": "T0086.003", + "kill_chain": [ + "tactics:Develop Content" + ], + "refs": [ + "https://github.com/DISARMFoundation/DISARMframeworks/blob/main/generated_pages/techniques/T0086.003.md" + ] + }, + "related": [], + "uuid": "69161c7b-a90f-5d96-a429-24a0d40d9973", + "value": "Deceptively Edit Images (Cheap Fakes)" + }, + { + "description": "Image files that aggregate positive evidence (Joan Donovan)", + "meta": { + "external_id": "T0086.004", + "kill_chain": [ + "tactics:Develop Content" + ], + "refs": [ + "https://github.com/DISARMFoundation/DISARMframeworks/blob/main/generated_pages/techniques/T0086.004.md" + ] + }, + "related": [], + "uuid": "b8a00aa5-9527-5128-a447-210d43bf11e2", + "value": "Aggregate Information into Evidence Collages" + }, + { + "description": "Creating and editing false or misleading video artefacts, often aligned with one or more specific narratives, for use in a disinformation campaign. This may include staging videos of purportedly real situations, repurposing existing video artefacts, or using AI-generated video creation and editing technologies (including deepfakes).", + "meta": { + "external_id": "T0087", + "kill_chain": [ + "tactics:Develop Content" + ], + "refs": [ + "https://github.com/DISARMFoundation/DISARMframeworks/blob/main/generated_pages/techniques/T0087.md" + ] + }, + "related": [], + "uuid": "97ef881f-9056-5390-8968-2b3d34d2cff8", + "value": "Develop Video-Based Content" + }, + { + "description": "Deepfakes refer to AI-generated falsified photos, videos, or soundbites. An influence operation may use deepfakes to depict an inauthentic situation by synthetically recreating an individual’s face, body, voice, and physical gestures.", + "meta": { + "external_id": "T0087.001", + "kill_chain": [ + "tactics:Develop Content" + ], + "refs": [ + "https://github.com/DISARMFoundation/DISARMframeworks/blob/main/generated_pages/techniques/T0087.001.md" + ] + }, + "related": [], + "uuid": "7a3328b8-0998-5bcd-9646-1e0f593802eb", + "value": "Develop AI-Generated Videos (Deepfakes)" + }, + { + "description": "Cheap fakes utilise less sophisticated measures of altering an image, video, or audio for example, slowing, speeding, or cutting footage to create a false context surrounding an image or event.", + "meta": { + "external_id": "T0087.002", + "kill_chain": [ + "tactics:Develop Content" + ], + "refs": [ + "https://github.com/DISARMFoundation/DISARMframeworks/blob/main/generated_pages/techniques/T0087.002.md" + ] + }, + "related": [], + "uuid": "044465ed-375a-59b8-aece-347c73974cfb", + "value": "Deceptively Edit Video (Cheap Fakes)" + }, + { + "description": "Creating and editing false or misleading audio artefacts, often aligned with one or more specific narratives, for use in a disinformation campaign. This may include creating completely new audio content, repurposing existing audio artefacts (including cheap fakes), or using AI-generated audio creation and editing technologies (including deepfakes).", + "meta": { + "external_id": "T0088", + "kill_chain": [ + "tactics:Develop Content" + ], + "refs": [ + "https://github.com/DISARMFoundation/DISARMframeworks/blob/main/generated_pages/techniques/T0088.md" + ] + }, + "related": [], + "uuid": "32f31f65-b210-57f8-a4e6-396d6f9676f0", + "value": "Develop Audio-Based Content" + }, + { + "description": "Deepfakes refer to AI-generated falsified photos, videos, or soundbites. An influence operation may use deepfakes to depict an inauthentic situation by synthetically recreating an individual’s face, body, voice, and physical gestures.", + "meta": { + "external_id": "T0088.001", + "kill_chain": [ + "tactics:Develop Content" + ], + "refs": [ + "https://github.com/DISARMFoundation/DISARMframeworks/blob/main/generated_pages/techniques/T0088.001.md" + ] + }, + "related": [], + "uuid": "96c96c0a-1e24-5b80-a7c2-2f31767c5fc3", + "value": "Develop AI-Generated Audio (Deepfakes)" + }, + { + "description": "Cheap fakes utilise less sophisticated measures of altering an image, video, or audio for example, slowing, speeding, or cutting footage to create a false context surrounding an image or event.", + "meta": { + "external_id": "T0088.002", + "kill_chain": [ + "tactics:Develop Content" + ], + "refs": [ + "https://github.com/DISARMFoundation/DISARMframeworks/blob/main/generated_pages/techniques/T0088.002.md" + ] + }, + "related": [], + "uuid": "482af0a0-50e3-57d6-99af-b8de290d1d00", + "value": "Deceptively Edit Audio (Cheap Fakes)" + }, + { + "description": "Procuring documents that are not publicly available, by whatever means -- whether legal or illegal, highly-resourced or less so. These documents can include authentic non-public documents, authentic non-public documents have been altered, or inauthentic documents intended to appear as if they are authentic non-public documents. All of these types of documents can be \"leaked\" during later stages in the operation.", + "meta": { + "external_id": "T0089", + "kill_chain": [ + "tactics:Develop Content" + ], + "refs": [ + "https://github.com/DISARMFoundation/DISARMframeworks/blob/main/generated_pages/techniques/T0089.md" + ] + }, + "related": [], + "uuid": "31254ebe-90c8-5dc6-8ee2-2f27ceb732c3", + "value": "Obtain Private Documents" + }, + { + "description": "Procure authentic documents that are not publicly available, by whatever means -- whether legal or illegal, highly-resourced or less so. These documents can be \"leaked\" during later stages in the operation.", + "meta": { + "external_id": "T0089.001", + "kill_chain": [ + "tactics:Develop Content" + ], + "refs": [ + "https://github.com/DISARMFoundation/DISARMframeworks/blob/main/generated_pages/techniques/T0089.001.md" + ] + }, + "related": [], + "uuid": "0ac164e0-f9ea-55a6-ab2b-8d8710f30b1c", + "value": "Obtain Authentic Documents" + }, + { + "description": "Create inauthentic documents intended to appear as if they are authentic non-public documents. These documents can be \"leaked\" during later stages in the operation.", + "meta": { + "external_id": "T0089.002", + "kill_chain": [ + "tactics:Develop Content" + ], + "refs": [ + "https://github.com/DISARMFoundation/DISARMframeworks/blob/main/generated_pages/techniques/T0089.002.md" + ] + }, + "related": [], + "uuid": "da4180d9-4829-5e8d-a0d0-c33bbd22fbc0", + "value": "Create Inauthentic Documents" + }, + { + "description": "Alter authentic documents (public or non-public) to achieve campaign goals. The altered documents are intended to appear as if they are authentic can be \"leaked\" during later stages in the operation.", + "meta": { + "external_id": "T0089.003", + "kill_chain": [ + "tactics:Develop Content" + ], + "refs": [ + "https://github.com/DISARMFoundation/DISARMframeworks/blob/main/generated_pages/techniques/T0089.003.md" + ] + }, + "related": [], + "uuid": "8214610e-69c5-509d-9b04-a393cdc586ec", + "value": "Alter Authentic Documents" + }, + { + "description": "Inauthentic accounts include bot accounts, cyborg accounts, sockpuppet accounts, and anonymous accounts.", + "meta": { + "external_id": "T0090", + "kill_chain": [ + "tactics:Establish Social Assets" + ], + "refs": [ + "https://github.com/DISARMFoundation/DISARMframeworks/blob/main/generated_pages/techniques/T0090.md" + ] + }, + "related": [], + "uuid": "fef2cb67-00a3-5141-88df-c3e6a2ae6d56", + "value": "Create Inauthentic Accounts" + }, + { + "description": "Anonymous accounts or anonymous users refer to users that access network resources without providing a username or password. An influence operation may use anonymous accounts to spread content without direct attribution to the operation.", + "meta": { + "external_id": "T0090.001", + "kill_chain": [ + "tactics:Establish Social Assets" + ], + "refs": [ + "https://github.com/DISARMFoundation/DISARMframeworks/blob/main/generated_pages/techniques/T0090.001.md" + ] + }, + "related": [], + "uuid": "f3927312-d6d3-5124-b831-5446c1fb5e6e", + "value": "Create Anonymous Accounts" + }, + { + "description": "Cyborg accounts refer to partly manned, partly automated social media accounts. Cyborg accounts primarily act as bots, but a human operator periodically takes control of the account to engage with real social media users by responding to comments and posting original content. Influence operations may use cyborg accounts to reduce the amount of direct human input required to maintain a regular account but increase the apparent legitimacy of the cyborg account by occasionally breaking its bot-like behaviour with human interaction.", + "meta": { + "external_id": "T0090.002", + "kill_chain": [ + "tactics:Establish Social Assets" + ], + "refs": [ + "https://github.com/DISARMFoundation/DISARMframeworks/blob/main/generated_pages/techniques/T0090.002.md" + ] + }, + "related": [], + "uuid": "8fa7973f-e10d-5367-af06-76f9e0fc7fc7", + "value": "Create Cyborg Accounts" + }, + { + "description": "Bots refer to autonomous internet users that interact with systems or other users while imitating traditional human behaviour. Bots use a variety of tools to stay active without direct human operation, including artificial intelligence and big data analytics. For example, an individual may programme a Twitter bot to retweet a tweet every time it contains a certain keyword or hashtag. An influence operation may use bots to increase its exposure and artificially promote its content across the internet without dedicating additional time or human resources. Amplifier bots promote operation content through reposts, shares, and likes to increase the content’s online popularity. Hacker bots are traditionally covert bots running on computer scripts that rarely engage with users and work primarily as agents of larger cyberattacks, such as a Distributed Denial of Service attacks. Spammer bots are programmed to post content on social media or in comment sections, usually as a supplementary tool. Impersonator bots102 pose as real people by mimicking human behaviour, complicating their detection.", + "meta": { + "external_id": "T0090.003", + "kill_chain": [ + "tactics:Establish Social Assets" + ], + "refs": [ + "https://github.com/DISARMFoundation/DISARMframeworks/blob/main/generated_pages/techniques/T0090.003.md" + ] + }, + "related": [], + "uuid": "16b41179-d9f3-50ea-aedb-ed9e667d6249", + "value": "Create Bot Accounts" + }, + { + "description": "Sockpuppet accounts refer to falsified accounts that either promote the influence operation’s own material or attack critics of the material online. Individuals who control sockpuppet accounts also man at least one other user account.67 Sockpuppet accounts help legitimise operation narratives by providing an appearance of external support for the material and discrediting opponents of the operation.", + "meta": { + "external_id": "T0090.004", + "kill_chain": [ + "tactics:Establish Social Assets" + ], + "refs": [ + "https://github.com/DISARMFoundation/DISARMframeworks/blob/main/generated_pages/techniques/T0090.004.md" + ] + }, + "related": [], + "uuid": "0e5ca353-ba01-5dec-95a4-19ca45cb7717", + "value": "Create Sockpuppet Accounts" + }, + { + "description": "Operators recruit bad actors paying recruiting, or exerting control over individuals includes trolls, partisans, and contractors.", + "meta": { + "external_id": "T0091", + "kill_chain": [ + "tactics:Establish Social Assets" + ], + "refs": [ + "https://github.com/DISARMFoundation/DISARMframeworks/blob/main/generated_pages/techniques/T0091.md" + ] + }, + "related": [], + "uuid": "981baf1f-f9ae-523b-a135-06b2b940e1ea", + "value": "Recruit Malign Actors" + }, + { + "description": "Operators recruit paid contractor to support the campaign.", + "meta": { + "external_id": "T0091.001", + "kill_chain": [ + "tactics:Establish Social Assets" + ], + "refs": [ + "https://github.com/DISARMFoundation/DISARMframeworks/blob/main/generated_pages/techniques/T0091.001.md" + ] + }, + "related": [], + "uuid": "8278b8d9-e056-5d6d-827d-4752bb2d7833", + "value": "Recruit Contractors" + }, + { + "description": "Operators recruit partisans (ideologically-aligned individuals) to support the campaign.", + "meta": { + "external_id": "T0091.002", + "kill_chain": [ + "tactics:Establish Social Assets" + ], + "refs": [ + "https://github.com/DISARMFoundation/DISARMframeworks/blob/main/generated_pages/techniques/T0091.002.md" + ] + }, + "related": [], + "uuid": "6c3ac844-a6fc-545d-9957-a1513949f639", + "value": "Recruit Partisans" + }, + { + "description": "An influence operation may hire trolls, or human operators of fake accounts that aim to provoke others by posting and amplifying content about controversial issues. Trolls can serve to discredit an influence operation’s opposition or bring attention to the operation’s cause through debate. Classic trolls refer to regular people who troll for personal reasons, such as attention-seeking or boredom. Classic trolls may advance operation narratives by coincidence but are not directly affiliated with any larger operation. Conversely, hybrid trolls act on behalf of another institution, such as a state or financial organisation, and post content with a specific ideological goal. Hybrid trolls may be highly advanced and institutionalised or less organised and work for a single individual.", + "meta": { + "external_id": "T0091.003", + "kill_chain": [ + "tactics:Establish Social Assets" + ], + "refs": [ + "https://github.com/DISARMFoundation/DISARMframeworks/blob/main/generated_pages/techniques/T0091.003.md" + ] + }, + "related": [], + "uuid": "0ac30e0e-434d-510a-a2f8-1b330338134d", + "value": "Enlist Troll Accounts" + }, + { + "description": "Operators build their own network, creating links between accounts -- whether authentic or inauthentic -- in order amplify and promote narratives and artefacts, and encourage further growth of ther network, as well as the ongoing sharing and engagement with operational content.", + "meta": { + "external_id": "T0092", + "kill_chain": [ + "tactics:Establish Social Assets" + ], + "refs": [ + "https://github.com/DISARMFoundation/DISARMframeworks/blob/main/generated_pages/techniques/T0092.md" + ] + }, + "related": [], + "uuid": "ef0c7e64-7702-5624-8318-d6f2d592433b", + "value": "Build Network" + }, + { + "description": "Influence operations may establish organisations with legitimate or falsified hierarchies, staff, and content to structure operation assets, provide a sense of legitimacy to the operation, or provide institutional backing to operation activities.", + "meta": { + "external_id": "T0092.001", + "kill_chain": [ + "tactics:Establish Social Assets" + ], + "refs": [ + "https://github.com/DISARMFoundation/DISARMframeworks/blob/main/generated_pages/techniques/T0092.001.md" + ] + }, + "related": [], + "uuid": "bc78ce0a-1a9a-56b2-9e2d-77df7d14cf82", + "value": "Create Organisations" + }, + { + "description": "A follow train is a group of people who follow each other on a social media platform, often as a way for an individual or campaign to grow its social media following. Follow trains may be a violation of platform Terms of Service. They are also known as follow-for-follow groups.", + "meta": { + "external_id": "T0092.002", + "kill_chain": [ + "tactics:Establish Social Assets" + ], + "refs": [ + "https://github.com/DISARMFoundation/DISARMframeworks/blob/main/generated_pages/techniques/T0092.002.md" + ] + }, + "related": [], + "uuid": "3d9be546-6fd4-5171-b418-f7dc7557f347", + "value": "Use Follow Trains" + }, + { + "description": "When there is not an existing community or sub-group that meets a campaign's goals, an influence operation may seek to create a community or sub-group.", + "meta": { + "external_id": "T0092.003", + "kill_chain": [ + "tactics:Establish Social Assets" + ], + "refs": [ + "https://github.com/DISARMFoundation/DISARMframeworks/blob/main/generated_pages/techniques/T0092.003.md" + ] + }, + "related": [], + "uuid": "0462781b-c754-5d6a-8742-91cb02d81034", + "value": "Create Community or Sub-Group" + }, + { + "description": "Operators acquire an existing network by paying, recruiting, or exerting control over the leaders of the existing network.", + "meta": { + "external_id": "T0093", + "kill_chain": [ + "tactics:Establish Social Assets" + ], + "refs": [ + "https://github.com/DISARMFoundation/DISARMframeworks/blob/main/generated_pages/techniques/T0093.md" + ] + }, + "related": [], + "uuid": "c1512f4a-9f4a-5b67-9f20-dbc40942d136", + "value": "Acquire/Recruit Network" + }, + { + "description": "An influence operation may fund proxies, or external entities that work for the operation. An operation may recruit/train users with existing sympathies towards the operation’s narratives and/or goals as proxies. Funding proxies serves various purposes including: - Diversifying operation locations to complicate attribution - Reducing the workload for direct operation assets", + "meta": { + "external_id": "T0093.001", + "kill_chain": [ + "tactics:Establish Social Assets" + ], + "refs": [ + "https://github.com/DISARMFoundation/DISARMframeworks/blob/main/generated_pages/techniques/T0093.001.md" + ] + }, + "related": [], + "uuid": "fb44dd38-07ef-5274-b3c9-c5e59afa1750", + "value": "Fund Proxies" + }, + { + "description": "A botnet is a group of bots that can function in coordination with each other.", + "meta": { + "external_id": "T0093.002", + "kill_chain": [ + "tactics:Establish Social Assets" + ], + "refs": [ + "https://github.com/DISARMFoundation/DISARMframeworks/blob/main/generated_pages/techniques/T0093.002.md" + ] + }, + "related": [], + "uuid": "750ed343-1ad9-5eb3-bbb4-08d680d47f53", + "value": "Acquire Botnets" + }, + { + "description": "Operators deceptively insert social assets into existing networks as group members in order to influence the members of the network and the wider information environment that the network impacts.", + "meta": { + "external_id": "T0094", + "kill_chain": [ + "tactics:Establish Social Assets" + ], + "refs": [ + "https://github.com/DISARMFoundation/DISARMframeworks/blob/main/generated_pages/techniques/T0094.md" + ] + }, + "related": [], + "uuid": "bb12e908-0783-53cb-9b29-de4bc8786604", + "value": "Infiltrate Existing Networks" + }, + { + "description": "When seeking to infiltrate an existing network, an influence operation may identify individuals and groups that might be susceptible to being co-opted or influenced.", + "meta": { + "external_id": "T0094.001", + "kill_chain": [ + "tactics:Establish Social Assets" + ], + "refs": [ + "https://github.com/DISARMFoundation/DISARMframeworks/blob/main/generated_pages/techniques/T0094.001.md" + ] + }, + "related": [], + "uuid": "16aa2680-49bf-531c-a654-2e06dd852ac8", + "value": "Identify Susceptible Targets in Networks" + }, + { + "description": "Butterfly attacks occur when operators pretend to be members of a certain social group, usually a group that struggles for representation. An influence operation may mimic a group to insert controversial statements into the discourse, encourage the spread of operation content, or promote harassment among group members. Unlike astroturfing, butterfly attacks aim to infiltrate and discredit existing grassroots movements, organisations, and media campaigns.", + "meta": { + "external_id": "T0094.002", + "kill_chain": [ + "tactics:Establish Social Assets" + ], + "refs": [ + "https://github.com/DISARMFoundation/DISARMframeworks/blob/main/generated_pages/techniques/T0094.002.md" + ] + }, + "related": [], + "uuid": "9748df5d-c55d-5f30-80c9-670bdf312ecd", + "value": "Utilise Butterfly Attacks" + }, + { + "description": "An owned media asset refers to an agency or organisation through which an influence operation may create, develop, and host content and narratives. Owned media assets include websites, blogs, social media pages, forums, and other platforms that facilitate the creation and organisation of content.", + "meta": { + "external_id": "T0095", + "kill_chain": [ + "tactics:Establish Social Assets" + ], + "refs": [ + "https://github.com/DISARMFoundation/DISARMframeworks/blob/main/generated_pages/techniques/T0095.md" + ] + }, + "related": [], + "uuid": "9aff2d75-3898-56bc-b5ae-2d3566ab8de2", + "value": "Develop Owned Media Assets" + }, + { + "description": "Using the services of large-scale content providers for creating and amplifying campaign artefacts at scale.", + "meta": { + "external_id": "T0096", + "kill_chain": [ + "tactics:Establish Social Assets" + ], + "refs": [ + "https://github.com/DISARMFoundation/DISARMframeworks/blob/main/generated_pages/techniques/T0096.md" + ] + }, + "related": [], + "uuid": "845f886a-80e7-587a-a8c2-1473488d290e", + "value": "Leverage Content Farms" + }, + { + "description": "An influence operation may create an organisation for creating and amplifying campaign artefacts at scale.", + "meta": { + "external_id": "T0096.001", + "kill_chain": [ + "tactics:Establish Social Assets" + ], + "refs": [ + "https://github.com/DISARMFoundation/DISARMframeworks/blob/main/generated_pages/techniques/T0096.001.md" + ] + }, + "related": [], + "uuid": "c07d2615-36a0-52cc-8cbb-84442420df07", + "value": "Create Content Farms" + }, + { + "description": "An influence operation may outsource content creation to external companies to avoid attribution, increase the rate of content creation, or improve content quality, i.e., by employing an organisation that can create content in the target audience’s native language. Employed organisations may include marketing companies for tailored advertisements or external content farms for high volumes of targeted media.", + "meta": { + "external_id": "T0096.002", + "kill_chain": [ + "tactics:Establish Social Assets" + ], + "refs": [ + "https://github.com/DISARMFoundation/DISARMframeworks/blob/main/generated_pages/techniques/T0096.002.md" + ] + }, + "related": [], + "uuid": "ccbc4898-76ec-5bc3-a0d2-39473fb20c2f", + "value": "Outsource Content Creation to External Organisations" + }, + { + "description": "Creating fake people, often with accounts across multiple platforms. These personas can be as simple as a name, can contain slightly more background like location, profile pictures, backstory, or can be effectively backstopped with indicators like fake identity documents.", + "meta": { + "external_id": "T0097", + "kill_chain": [ + "tactics:Establish Legitimacy" + ], + "refs": [ + "https://github.com/DISARMFoundation/DISARMframeworks/blob/main/generated_pages/techniques/T0097.md" + ] + }, + "related": [], + "uuid": "7f984091-41b3-5e8f-b723-1d5eb9150d1d", + "value": "Create Personas" + }, + { + "description": "Create other assets/dossier/cover/fake relationships and/or connections or documents, sites, bylines, attributions, to establish/augment/inflate crediblity/believability", + "meta": { + "external_id": "T0097.001", + "kill_chain": [ + "tactics:Establish Legitimacy" + ], + "refs": [ + "https://github.com/DISARMFoundation/DISARMframeworks/blob/main/generated_pages/techniques/T0097.001.md" + ] + }, + "related": [], + "uuid": "2341584c-3ca5-5d2e-85f8-2b9c4da81268", + "value": "Backstop Personas" + }, + { + "description": "Modern computational propaganda makes use of a cadre of imposter news sites spreading globally. These sites, sometimes motivated by concerns other than propaganda--for instance, click-based revenue--often have some superficial markers of authenticity, such as naming and site-design. But many can be quickly exposed with reference to their owenership, reporting history and adverstising details.", + "meta": { + "external_id": "T0098", + "kill_chain": [ + "tactics:Establish Legitimacy" + ], + "refs": [ + "https://github.com/DISARMFoundation/DISARMframeworks/blob/main/generated_pages/techniques/T0098.md" + ] + }, + "related": [], + "uuid": "abaff1d4-e7b1-597b-bb22-556f54a9602c", + "value": "Establish Inauthentic News Sites" + }, + { + "description": "Create Inauthentic News Sites", + "meta": { + "external_id": "T0098.001", + "kill_chain": [ + "tactics:Establish Legitimacy" + ], + "refs": [ + "https://github.com/DISARMFoundation/DISARMframeworks/blob/main/generated_pages/techniques/T0098.001.md" + ] + }, + "related": [], + "uuid": "b9dceeab-f5d8-50ae-ad8a-365d77fc4a3d", + "value": "Create Inauthentic News Sites" + }, + { + "description": "Leverage Existing Inauthentic News Sites", + "meta": { + "external_id": "T0098.002", + "kill_chain": [ + "tactics:Establish Legitimacy" + ], + "refs": [ + "https://github.com/DISARMFoundation/DISARMframeworks/blob/main/generated_pages/techniques/T0098.002.md" + ] + }, + "related": [], + "uuid": "51648b8d-6019-5545-a67b-e2e1e4b901a2", + "value": "Leverage Existing Inauthentic News Sites" + }, + { + "description": "An influence operation may prepare assets impersonating legitimate entities to further conceal its network identity and add a layer of legitimacy to its operation content. Users will more likely believe and less likely fact-check news from recognisable sources rather than unknown sites. Legitimate entities may include authentic news outlets, public figures, organisations, or state entities. An influence operation may use a wide variety of cyber techniques to impersonate a legitimate entity’s website or social media account. Typosquatting87 is the international registration of a domain name with purposeful variations of the impersonated domain name through intentional typos, top-level domain (TLD) manipulation, or punycode. Typosquatting facilitates the creation of falsified websites by creating similar domain names in the URL box, leaving it to the user to confirm that the URL is correct.", + "meta": { + "external_id": "T0099", + "kill_chain": [ + "tactics:Establish Legitimacy" + ], + "refs": [ + "https://github.com/DISARMFoundation/DISARMframeworks/blob/main/generated_pages/techniques/T0099.md" + ] + }, + "related": [], + "uuid": "9758be4b-0f4d-5438-bc2a-567bffb8cd57", + "value": "Prepare Assets Impersonating Legitimate Entities" + }, + { + "description": "Astroturfing occurs when an influence operation disguises itself as grassroots movement or organisation that supports operation narratives. Unlike butterfly attacks, astroturfing aims to increase the appearance of popular support for the operation cause and does not infiltrate existing groups to discredit their objectives.", + "meta": { + "external_id": "T0099.001", + "kill_chain": [ + "tactics:Establish Legitimacy" + ], + "refs": [ + "https://github.com/DISARMFoundation/DISARMframeworks/blob/main/generated_pages/techniques/T0099.001.md" + ] + }, + "related": [], + "uuid": "2710c060-376c-5008-b7e8-791086382a2b", + "value": "Astroturfing" + }, + { + "description": "An influence operation may prepare assets impersonating legitimate entities to further conceal its network identity and add a layer of legitimacy to its operation content. Users will more likely believe and less likely fact-check news from recognisable sources rather than unknown sites. Legitimate entities may include authentic news outlets, public figures, organisations, or state entities.", + "meta": { + "external_id": "T0099.002", + "kill_chain": [ + "tactics:Establish Legitimacy" + ], + "refs": [ + "https://github.com/DISARMFoundation/DISARMframeworks/blob/main/generated_pages/techniques/T0099.002.md" + ] + }, + "related": [], + "uuid": "8eab0457-f145-56f7-aac6-d46ec8225570", + "value": "Spoof/Parody Account/Site" + }, + { + "description": "An influence operation may co-opt trusted sources by infiltrating or repurposing a source to reach a target audience through existing, previously reliable networks. Co-opted trusted sources may include: - National or local new outlets - Research or academic publications - Online blogs or websites", + "meta": { + "external_id": "T0100", + "kill_chain": [ + "tactics:Establish Legitimacy" + ], + "refs": [ + "https://github.com/DISARMFoundation/DISARMframeworks/blob/main/generated_pages/techniques/T0100.md" + ] + }, + "related": [], + "uuid": "052ea05b-d892-5987-8017-0efad3d88a27", + "value": "Co-Opt Trusted Sources" + }, + { + "description": "Co-Opt Trusted Individuals", + "meta": { + "external_id": "T0100.001", + "kill_chain": [ + "tactics:Establish Legitimacy" + ], + "refs": [ + "https://github.com/DISARMFoundation/DISARMframeworks/blob/main/generated_pages/techniques/T0100.001.md" + ] + }, + "related": [], + "uuid": "8592f95a-a576-5c9f-8f62-66089345255a", + "value": "Co-Opt Trusted Individuals" + }, + { + "description": "Co-Opt Grassroots Groups", + "meta": { + "external_id": "T0100.002", + "kill_chain": [ + "tactics:Establish Legitimacy" + ], + "refs": [ + "https://github.com/DISARMFoundation/DISARMframeworks/blob/main/generated_pages/techniques/T0100.002.md" + ] + }, + "related": [], + "uuid": "8b9308aa-c65d-5e00-bb60-f93873611283", + "value": "Co-Opt Grassroots Groups" + }, + { + "description": "Co-opt Influencers", + "meta": { + "external_id": "T0100.003", + "kill_chain": [ + "tactics:Establish Legitimacy" + ], + "refs": [ + "https://github.com/DISARMFoundation/DISARMframeworks/blob/main/generated_pages/techniques/T0100.003.md" + ] + }, + "related": [], + "uuid": "7e763150-56e9-50e0-a180-3faf14734574", + "value": "Co-Opt Influencers" + }, + { + "description": "Localised content refers to content that appeals to a specific community of individuals, often in defined geographic areas. An operation may create localised content using local language and dialects to resonate with its target audience and blend in with other local news and social media. Localised content may help an operation increase legitimacy, avoid detection, and complicate external attribution.", + "meta": { + "external_id": "T0101", + "kill_chain": [ + "tactics:Microtarget" + ], + "refs": [ + "https://github.com/DISARMFoundation/DISARMframeworks/blob/main/generated_pages/techniques/T0101.md" + ] + }, + "related": [], + "uuid": "a2355290-e41e-5210-b03c-6ef88d4b61c2", + "value": "Create Localised Content" + }, + { + "description": "An echo chamber refers to an internet subgroup, often along ideological lines, where individuals only engage with “others with which they are already in agreement.” A filter bubble refers to an algorithm's placement of an individual in content that they agree with or regularly engage with, possibly entrapping the user into a bubble of their own making. An operation may create these isolated areas of the internet by match existing groups, or aggregating individuals into a single target audience based on shared interests, politics, values, demographics, and other characteristics. Echo chambers and filter bubbles help to reinforce similar biases and content to the same target audience members.", + "meta": { + "external_id": "T0102", + "kill_chain": [ + "tactics:Microtarget" + ], + "refs": [ + "https://github.com/DISARMFoundation/DISARMframeworks/blob/main/generated_pages/techniques/T0102.md" + ] + }, + "related": [], + "uuid": "d4e6d8d6-125c-58cf-924f-960e17a795bf", + "value": "Leverage Echo Chambers/Filter Bubbles" + }, + { + "description": "Use existing Echo Chambers/Filter Bubbles", + "meta": { + "external_id": "T0102.001", + "kill_chain": [ + "tactics:Microtarget" + ], + "refs": [ + "https://github.com/DISARMFoundation/DISARMframeworks/blob/main/generated_pages/techniques/T0102.001.md" + ] + }, + "related": [], + "uuid": "bfa744ce-4cbb-5cc3-9cb5-406783d5d5d9", + "value": "Use Existing Echo Chambers/Filter Bubbles" + }, + { + "description": "Create Echo Chambers/Filter Bubbles", + "meta": { + "external_id": "T0102.002", + "kill_chain": [ + "tactics:Microtarget" + ], + "refs": [ + "https://github.com/DISARMFoundation/DISARMframeworks/blob/main/generated_pages/techniques/T0102.002.md" + ] + }, + "related": [], + "uuid": "1a8c5e95-d053-5cf1-98c9-7e33b04708ab", + "value": "Create Echo Chambers/Filter Bubbles" + }, + { + "description": "A data void refers to a word or phrase that results in little, manipulative, or low-quality search engine data. Data voids are hard to detect and relatively harmless until exploited by an entity aiming to quickly proliferate false or misleading information during a phenomenon that causes a high number of individuals to query the term or phrase. In the Plan phase, an influence operation may identify data voids for later exploitation in the operation. A 2019 report by Michael Golebiewski identifies five types of data voids. (1) “Breaking news” data voids occur when a keyword gains popularity during a short period of time, allowing an influence operation to publish false content before legitimate news outlets have an opportunity to publish relevant information. (2) An influence operation may create a “strategic new terms” data void by creating their own terms and publishing information online before promoting their keyword to the target audience. (3) An influence operation may publish content on “outdated terms” that have decreased in popularity, capitalising on most search engines’ preferences for recency. (4) “Fragmented concepts” data voids separate connections between similar ideas, isolating segment queries to distinct search engine results. (5) An influence operation may use “problematic queries” that previously resulted in disturbing or inappropriate content to promote messaging until mainstream media recontextualizes the term.", + "meta": { + "external_id": "T0102.003", + "kill_chain": [ + "tactics:Microtarget" + ], + "refs": [ + "https://github.com/DISARMFoundation/DISARMframeworks/blob/main/generated_pages/techniques/T0102.003.md" + ] + }, + "related": [], + "uuid": "62a656a7-9e5f-58e3-b563-9396006fadc3", + "value": "Exploit Data Voids" + }, + { + "description": "A livestream refers to an online broadcast capability that allows for real-time communication to closed or open networks.", + "meta": { + "external_id": "T0103", + "kill_chain": [ + "tactics:Select Channels and Affordances" + ], + "refs": [ + "https://github.com/DISARMFoundation/DISARMframeworks/blob/main/generated_pages/techniques/T0103.md" + ] + }, + "related": [], + "uuid": "aead2978-a869-5fc7-96f6-f9c55baf2e09", + "value": "Livestream" + }, + { + "description": "A video livestream refers to an online video broadcast capability that allows for real-time communication to closed or open networks.", + "meta": { + "external_id": "T0103.001", + "kill_chain": [ + "tactics:Select Channels and Affordances" + ], + "refs": [ + "https://github.com/DISARMFoundation/DISARMframeworks/blob/main/generated_pages/techniques/T0103.001.md" + ] + }, + "related": [], + "uuid": "b8200b83-54c4-5448-86a8-08fa1223b470", + "value": "Video Livestream" + }, + { + "description": "An audio livestream refers to an online audio broadcast capability that allows for real-time communication to closed or open networks.", + "meta": { + "external_id": "T0103.002", + "kill_chain": [ + "tactics:Select Channels and Affordances" + ], + "refs": [ + "https://github.com/DISARMFoundation/DISARMframeworks/blob/main/generated_pages/techniques/T0103.002.md" + ] + }, + "related": [], + "uuid": "880869e4-2576-5a33-bea0-f35bb71fcdc0", + "value": "Audio Livestream" + }, + { + "description": "Social media are interactive digital channels that facilitate the creation and sharing of information, ideas, interests, and other forms of expression through virtual communities and networks.", + "meta": { + "external_id": "T0104", + "kill_chain": [ + "tactics:Select Channels and Affordances" + ], + "refs": [ + "https://github.com/DISARMFoundation/DISARMframeworks/blob/main/generated_pages/techniques/T0104.md" + ] + }, + "related": [], + "uuid": "012be2cf-7aed-5ac4-8fb5-ad7ffff73ea0", + "value": "Social Networks" + }, + { + "description": "Examples include Facebook, Twitter, LinkedIn, etc.", + "meta": { + "external_id": "T0104.001", + "kill_chain": [ + "tactics:Select Channels and Affordances" + ], + "refs": [ + "https://github.com/DISARMFoundation/DISARMframeworks/blob/main/generated_pages/techniques/T0104.001.md" + ] + }, + "related": [], + "uuid": "79364323-1d9e-5e29-8bd8-d0bc7bf32f30", + "value": "Mainstream Social Networks" + }, + { + "description": "Dating Apps", + "meta": { + "external_id": "T0104.002", + "kill_chain": [ + "tactics:Select Channels and Affordances" + ], + "refs": [ + "https://github.com/DISARMFoundation/DISARMframeworks/blob/main/generated_pages/techniques/T0104.002.md" + ] + }, + "related": [], + "uuid": "96b1a88b-ea2d-51ad-a473-1669e956d387", + "value": "Dating Apps" + }, + { + "description": "Social networks that are not open to people outside of family, friends, neighbours, or co-workers. Non-work-related examples include Couple, FamilyWall, 23snaps, and Nextdoor. Some of the larger social network platforms enable closed communities: examples are Instagram Close Friends and Twitter (X) Circle. Work-related examples of private social networks include LinkedIn, Facebook Workplace, and enterprise communication platforms such as Slack or Microsoft Teams.", + "meta": { + "external_id": "T0104.003", + "kill_chain": [ + "tactics:Select Channels and Affordances" + ], + "refs": [ + "https://github.com/DISARMFoundation/DISARMframeworks/blob/main/generated_pages/techniques/T0104.003.md" + ] + }, + "related": [], + "uuid": "ebcad87c-1217-5d90-8f6f-43d078a3d461", + "value": "Private/Closed Social Networks" + }, + { + "description": "Examples include smaller and niche networks including Gettr, Truth Social, Parler, etc.", + "meta": { + "external_id": "T0104.004", + "kill_chain": [ + "tactics:Select Channels and Affordances" + ], + "refs": [ + "https://github.com/DISARMFoundation/DISARMframeworks/blob/main/generated_pages/techniques/T0104.004.md" + ] + }, + "related": [], + "uuid": "7f80d0ec-c3d9-501f-9688-780ed4fa3720", + "value": "Interest-Based Networks" + }, + { + "description": "Use a dedicated, existing hashtag for the campaign/incident.", + "meta": { + "external_id": "T0104.005", + "kill_chain": [ + "tactics:Select Channels and Affordances" + ], + "refs": [ + "https://github.com/DISARMFoundation/DISARMframeworks/blob/main/generated_pages/techniques/T0104.005.md" + ] + }, + "related": [], + "uuid": "6e852d19-6582-5713-bdf0-18a68ee50bd8", + "value": "Use Hashtags" + }, + { + "description": "Create a campaign/incident specific hashtag.", + "meta": { + "external_id": "T0104.006", + "kill_chain": [ + "tactics:Select Channels and Affordances" + ], + "refs": [ + "https://github.com/DISARMFoundation/DISARMframeworks/blob/main/generated_pages/techniques/T0104.006.md" + ] + }, + "related": [], + "uuid": "732d47a6-ba6a-56d4-828c-6e6612d9c95d", + "value": "Create Dedicated Hashtag" + }, + { + "description": "Media sharing networks refer to services whose primary function is the hosting and sharing of specific forms of media. Examples include Instagram, Snapchat, TikTok, Youtube, SoundCloud.", + "meta": { + "external_id": "T0105", + "kill_chain": [ + "tactics:Select Channels and Affordances" + ], + "refs": [ + "https://github.com/DISARMFoundation/DISARMframeworks/blob/main/generated_pages/techniques/T0105.md" + ] + }, + "related": [], + "uuid": "d201dc16-622a-5da2-b82a-9924607f2e24", + "value": "Media Sharing Networks" + }, + { + "description": "Examples include Instagram, Snapchat, Flickr, etc", + "meta": { + "external_id": "T0105.001", + "kill_chain": [ + "tactics:Select Channels and Affordances" + ], + "refs": [ + "https://github.com/DISARMFoundation/DISARMframeworks/blob/main/generated_pages/techniques/T0105.001.md" + ] + }, + "related": [], + "uuid": "727b8c48-8a62-5804-a1af-fd0b6ec71699", + "value": "Photo Sharing" + }, + { + "description": "Examples include Youtube, TikTok, ShareChat, Rumble, etc", + "meta": { + "external_id": "T0105.002", + "kill_chain": [ + "tactics:Select Channels and Affordances" + ], + "refs": [ + "https://github.com/DISARMFoundation/DISARMframeworks/blob/main/generated_pages/techniques/T0105.002.md" + ] + }, + "related": [], + "uuid": "84e96b27-ea09-5a88-9ad7-d6420cc06ee8", + "value": "Video Sharing" + }, + { + "description": "Examples include podcasting apps, Soundcloud, etc.", + "meta": { + "external_id": "T0105.003", + "kill_chain": [ + "tactics:Select Channels and Affordances" + ], + "refs": [ + "https://github.com/DISARMFoundation/DISARMframeworks/blob/main/generated_pages/techniques/T0105.003.md" + ] + }, + "related": [], + "uuid": "0f5bce10-d1d9-5270-9b54-0214e2353724", + "value": "Audio Sharing" + }, + { + "description": "Platforms for finding, discussing, and sharing information and opinions. Examples include Reddit, Quora, Digg, message boards, interest-based discussion forums, etc.", + "meta": { + "external_id": "T0106", + "kill_chain": [ + "tactics:Select Channels and Affordances" + ], + "refs": [ + "https://github.com/DISARMFoundation/DISARMframeworks/blob/main/generated_pages/techniques/T0106.md" + ] + }, + "related": [], + "uuid": "1f4ef9c4-e3f3-5981-a4c9-9aed559323d0", + "value": "Discussion Forums" + }, + { + "description": "Examples include the Chans", + "meta": { + "external_id": "T0106.001", + "kill_chain": [ + "tactics:Select Channels and Affordances" + ], + "refs": [ + "https://github.com/DISARMFoundation/DISARMframeworks/blob/main/generated_pages/techniques/T0106.001.md" + ] + }, + "related": [], + "uuid": "12fb075d-f148-5eab-ae24-94799f055750", + "value": "Anonymous Message Boards" + }, + { + "description": "Platforms for searching, sharing, and curating content and media. Examples include Pinterest, Flipboard, etc.", + "meta": { + "external_id": "T0107", + "kill_chain": [ + "tactics:Select Channels and Affordances" + ], + "refs": [ + "https://github.com/DISARMFoundation/DISARMframeworks/blob/main/generated_pages/techniques/T0107.md" + ] + }, + "related": [], + "uuid": "cc4df2aa-7a91-53a3-816f-c1d9340801ea", + "value": "Bookmarking and Content Curation" + }, + { + "description": "Examples include WordPress, Blogger, Weebly, Tumblr, Medium, etc.", + "meta": { + "external_id": "T0108", + "kill_chain": [ + "tactics:Select Channels and Affordances" + ], + "refs": [ + "https://github.com/DISARMFoundation/DISARMframeworks/blob/main/generated_pages/techniques/T0108.md" + ] + }, + "related": [], + "uuid": "274821cc-3f7a-5785-8712-0f46a5e2903b", + "value": "Blogging and Publishing Networks" + }, + { + "description": "Platforms for finding, reviewing, and sharing information about brands, products, services, restaurants, travel destinations, etc. Examples include Yelp, TripAdvisor, etc.", + "meta": { + "external_id": "T0109", + "kill_chain": [ + "tactics:Select Channels and Affordances" + ], + "refs": [ + "https://github.com/DISARMFoundation/DISARMframeworks/blob/main/generated_pages/techniques/T0109.md" + ] + }, + "related": [], + "uuid": "64d83292-f532-5aca-b76e-69e4741d4a6e", + "value": "Consumer Review Networks" + }, + { + "description": "Leveraging formal, traditional, diplomatic channels to communicate with foreign governments (written documents, meetings, summits, diplomatic visits, etc). This type of diplomacy is conducted by diplomats of one nation with diplomats and other officials of another nation or international organisation.", + "meta": { + "external_id": "T0110", + "kill_chain": [ + "tactics:Select Channels and Affordances" + ], + "refs": [ + "https://github.com/DISARMFoundation/DISARMframeworks/blob/main/generated_pages/techniques/T0110.md" + ] + }, + "related": [], + "uuid": "46aedae0-4850-5af6-8db4-ad5665ecd2a4", + "value": "Formal Diplomatic Channels" + }, + { + "description": "Examples include TV, Newspaper, Radio, etc.", + "meta": { + "external_id": "T0111", + "kill_chain": [ + "tactics:Select Channels and Affordances" + ], + "refs": [ + "https://github.com/DISARMFoundation/DISARMframeworks/blob/main/generated_pages/techniques/T0111.md" + ] + }, + "related": [], + "uuid": "5cb9a5f0-e6a6-57e8-9cc4-262c807281fa", + "value": "Traditional Media" + }, + { + "description": "TV", + "meta": { + "external_id": "T0111.001", + "kill_chain": [ + "tactics:Select Channels and Affordances" + ], + "refs": [ + "https://github.com/DISARMFoundation/DISARMframeworks/blob/main/generated_pages/techniques/T0111.001.md" + ] + }, + "related": [], + "uuid": "7c5bb87d-d038-5a46-9069-6cb8d01a19e7", + "value": "TV" + }, + { + "description": "Newspaper", + "meta": { + "external_id": "T0111.002", + "kill_chain": [ + "tactics:Select Channels and Affordances" + ], + "refs": [ + "https://github.com/DISARMFoundation/DISARMframeworks/blob/main/generated_pages/techniques/T0111.002.md" + ] + }, + "related": [], + "uuid": "21fa5ba1-9782-5cad-8903-7abb955ed9b1", + "value": "Newspaper" + }, + { + "description": "Radio", + "meta": { + "external_id": "T0111.003", + "kill_chain": [ + "tactics:Select Channels and Affordances" + ], + "refs": [ + "https://github.com/DISARMFoundation/DISARMframeworks/blob/main/generated_pages/techniques/T0111.003.md" + ] + }, + "related": [], + "uuid": "6d83b061-da10-5693-837c-960285176c0b", + "value": "Radio" + }, + { + "description": "Delivering content and narratives via email. This can include using list management or high-value individually targeted messaging.", + "meta": { + "external_id": "T0112", + "kill_chain": [ + "tactics:Select Channels and Affordances" + ], + "refs": [ + "https://github.com/DISARMFoundation/DISARMframeworks/blob/main/generated_pages/techniques/T0112.md" + ] + }, + "related": [], + "uuid": "32ec2894-3a89-5b14-be34-77289f1106ca", + "value": "Email" + }, + { + "description": "Commercial analytic firms collect data on target audience activities and evaluate the data to detect trends, such as content receiving high click-rates. An influence operation may employ commercial analytic firms to facilitate external collection on its target audience, complicating attribution efforts and better tailoring the content to audience preferences.", + "meta": { + "external_id": "T0113", + "kill_chain": [ + "tactics:Conduct Pump Priming" + ], + "refs": [ + "https://github.com/DISARMFoundation/DISARMframeworks/blob/main/generated_pages/techniques/T0113.md" + ] + }, + "related": [], + "uuid": "d6a72ed4-28f9-5736-b8a6-459679026513", + "value": "Employ Commercial Analytic Firms" + }, + { + "description": "Delivering content via any form of paid media or advertising.", + "meta": { + "external_id": "T0114", + "kill_chain": [ + "tactics:Deliver Content" + ], + "refs": [ + "https://github.com/DISARMFoundation/DISARMframeworks/blob/main/generated_pages/techniques/T0114.md" + ] + }, + "related": [], + "uuid": "51639828-5e65-5f32-9858-7020166d26dd", + "value": "Deliver Ads" + }, + { + "description": "Social Media", + "meta": { + "external_id": "T0114.001", + "kill_chain": [ + "tactics:Deliver Content" + ], + "refs": [ + "https://github.com/DISARMFoundation/DISARMframeworks/blob/main/generated_pages/techniques/T0114.001.md" + ] + }, + "related": [], + "uuid": "9c655aa6-1474-5ab9-8eff-519df00fe41b", + "value": "Social Media" + }, + { + "description": "Examples include TV, Radio, Newspaper, billboards", + "meta": { + "external_id": "T0114.002", + "kill_chain": [ + "tactics:Deliver Content" + ], + "refs": [ + "https://github.com/DISARMFoundation/DISARMframeworks/blob/main/generated_pages/techniques/T0114.002.md" + ] + }, + "related": [], + "uuid": "29640d07-bfc9-5d0a-a7ac-34dbd8141410", + "value": "Traditional Media" + }, + { + "description": "Delivering content by posting via owned media (assets that the operator controls).", + "meta": { + "external_id": "T0115", + "kill_chain": [ + "tactics:Deliver Content" + ], + "refs": [ + "https://github.com/DISARMFoundation/DISARMframeworks/blob/main/generated_pages/techniques/T0115.md" + ] + }, + "related": [], + "uuid": "e41d7f0f-d913-5973-b8a3-385b39e78ebd", + "value": "Post Content" + }, + { + "description": "Memes are one of the most important single artefact types in all of computational propaganda. Memes in this framework denotes the narrow image-based definition. But that naming is no accident, as these items have most of the important properties of Dawkins' original conception as a self-replicating unit of culture. Memes pull together reference and commentary; image and narrative; emotion and message. Memes are a powerful tool and the heart of modern influence campaigns.", + "meta": { + "external_id": "T0115.001", + "kill_chain": [ + "tactics:Deliver Content" + ], + "refs": [ + "https://github.com/DISARMFoundation/DISARMframeworks/blob/main/generated_pages/techniques/T0115.001.md" + ] + }, + "related": [], + "uuid": "986815f4-a31d-57bd-8782-9039044af3af", + "value": "Share Memes" + }, + { + "description": "Post Violative Content to Provoke Takedown and Backlash.", + "meta": { + "external_id": "T0115.002", + "kill_chain": [ + "tactics:Deliver Content" + ], + "refs": [ + "https://github.com/DISARMFoundation/DISARMframeworks/blob/main/generated_pages/techniques/T0115.002.md" + ] + }, + "related": [], + "uuid": "70a3dd8d-c492-5b80-a77c-21f05a72a8c4", + "value": "Post Violative Content to Provoke Takedown and Backlash" + }, + { + "description": "Direct posting refers to a method of posting content via a one-way messaging service, where the recipient cannot directly respond to the poster’s messaging. An influence operation may post directly to promote operation narratives to the target audience without allowing opportunities for fact-checking or disagreement, creating a false sense of support for the narrative.", + "meta": { + "external_id": "T0115.003", + "kill_chain": [ + "tactics:Deliver Content" + ], + "refs": [ + "https://github.com/DISARMFoundation/DISARMframeworks/blob/main/generated_pages/techniques/T0115.003.md" + ] + }, + "related": [], + "uuid": "344ef4f6-8020-5493-871e-b7015d53bfae", + "value": "One-Way Direct Posting" + }, + { + "description": "Delivering content by replying or commenting via owned media (assets that the operator controls).", + "meta": { + "external_id": "T0116", + "kill_chain": [ + "tactics:Deliver Content" + ], + "refs": [ + "https://github.com/DISARMFoundation/DISARMframeworks/blob/main/generated_pages/techniques/T0116.md" + ] + }, + "related": [], + "uuid": "df724dcc-0d26-5c3b-aec1-b3c82f509f07", + "value": "Comment or Reply on Content" + }, + { + "description": "Use government-paid social media commenters, astroturfers, chat bots (programmed to reply to specific key words/hashtags) influence online conversations, product reviews, web-site comment forums.", + "meta": { + "external_id": "T0116.001", + "kill_chain": [ + "tactics:Deliver Content" + ], + "refs": [ + "https://github.com/DISARMFoundation/DISARMframeworks/blob/main/generated_pages/techniques/T0116.001.md" + ] + }, + "related": [], + "uuid": "c5d17eaa-9f30-5b38-a54a-ddc853981e53", + "value": "Post Inauthentic Social Media Comment" + }, + { + "description": "Deliver content by attracting the attention of traditional media (earned media).", + "meta": { + "external_id": "T0117", + "kill_chain": [ + "tactics:Deliver Content" + ], + "refs": [ + "https://github.com/DISARMFoundation/DISARMframeworks/blob/main/generated_pages/techniques/T0117.md" + ] + }, + "related": [], + "uuid": "40c341c1-873c-5cbe-bac6-eaeed322d74e", + "value": "Attract Traditional Media" + }, + { + "description": "An influence operation may amplify existing narratives that align with its narratives to support operation objectives.", + "meta": { + "external_id": "T0118", + "kill_chain": [ + "tactics:Maximise Exposure" + ], + "refs": [ + "https://github.com/DISARMFoundation/DISARMframeworks/blob/main/generated_pages/techniques/T0118.md" + ] + }, + "related": [], + "uuid": "69fe11a4-89b8-5c78-8872-7f7bc7a870f1", + "value": "Amplify Existing Narrative" + }, + { + "description": "Cross-posting refers to posting the same message to multiple internet discussions, social media platforms or accounts, or news groups at one time. An influence operation may post content online in multiple communities and platforms to increase the chances of content exposure to the target audience.", + "meta": { + "external_id": "T0119", + "kill_chain": [ + "tactics:Maximise Exposure" + ], + "refs": [ + "https://github.com/DISARMFoundation/DISARMframeworks/blob/main/generated_pages/techniques/T0119.md" + ] + }, + "related": [], + "uuid": "324248a7-3a0c-5689-8f0e-770d6d6f2dd7", + "value": "Cross-Posting" + }, + { + "description": "An influence operation may post content across groups to spread narratives and content to new communities within the target audiences or to new target audiences.", + "meta": { + "external_id": "T0119.001", + "kill_chain": [ + "tactics:Maximise Exposure" + ], + "refs": [ + "https://github.com/DISARMFoundation/DISARMframeworks/blob/main/generated_pages/techniques/T0119.001.md" + ] + }, + "related": [], + "uuid": "d6cb6d4e-f75a-50af-b629-bea934659403", + "value": "Post across Groups" + }, + { + "description": "An influence operation may post content across platforms to spread narratives and content to new communities within the target audiences or to new target audiences. Posting across platforms can also remove opposition and context, helping the narrative spread with less opposition on the cross-posted platform.", + "meta": { + "external_id": "T0119.002", + "kill_chain": [ + "tactics:Maximise Exposure" + ], + "refs": [ + "https://github.com/DISARMFoundation/DISARMframeworks/blob/main/generated_pages/techniques/T0119.002.md" + ] + }, + "related": [], + "uuid": "7dfb83d1-507f-517e-912f-6deefee4ce3f", + "value": "Post across Platform" + }, + { + "description": "Post Across Disciplines", + "meta": { + "external_id": "T0119.003", + "kill_chain": [ + "tactics:Maximise Exposure" + ], + "refs": [ + "https://github.com/DISARMFoundation/DISARMframeworks/blob/main/generated_pages/techniques/T0119.003.md" + ] + }, + "related": [], + "uuid": "32ad368e-ac64-59bb-921a-80fdff8eed09", + "value": "Post across Disciplines" + }, + { + "description": "Incentivizing content sharing refers to actions that encourage users to share content themselves, reducing the need for the operation itself to post and promote its own content.", + "meta": { + "external_id": "T0120", + "kill_chain": [ + "tactics:Maximise Exposure" + ], + "refs": [ + "https://github.com/DISARMFoundation/DISARMframeworks/blob/main/generated_pages/techniques/T0120.md" + ] + }, + "related": [], + "uuid": "e8a91999-4d28-5d96-a427-d67c23a9c661", + "value": "Incentivize Sharing" + }, + { + "description": "Use Affiliate Marketing Programmes", + "meta": { + "external_id": "T0120.001", + "kill_chain": [ + "tactics:Maximise Exposure" + ], + "refs": [ + "https://github.com/DISARMFoundation/DISARMframeworks/blob/main/generated_pages/techniques/T0120.001.md" + ] + }, + "related": [], + "uuid": "cd41b90c-5c59-5c1f-9824-515e9394d546", + "value": "Use Affiliate Marketing Programmes" + }, + { + "description": "Use Contests and Prizes", + "meta": { + "external_id": "T0120.002", + "kill_chain": [ + "tactics:Maximise Exposure" + ], + "refs": [ + "https://github.com/DISARMFoundation/DISARMframeworks/blob/main/generated_pages/techniques/T0120.002.md" + ] + }, + "related": [], + "uuid": "7fcb8b90-f534-5a4e-8321-d1610916eaa0", + "value": "Use Contests and Prizes" + }, + { + "description": "Manipulating a platform algorithm refers to conducting activity on a platform in a way that intentionally targets its underlying algorithm. After analysing a platform’s algorithm (see: Select Platforms), an influence operation may use a platform in a way that increases its content exposure, avoids content removal, or otherwise benefits the operation’s strategy. For example, an influence operation may use bots to amplify its posts so that the platform’s algorithm recognises engagement with operation content and further promotes the content on user timelines.", + "meta": { + "external_id": "T0121", + "kill_chain": [ + "tactics:Maximise Exposure" + ], + "refs": [ + "https://github.com/DISARMFoundation/DISARMframeworks/blob/main/generated_pages/techniques/T0121.md" + ] + }, + "related": [], + "uuid": "0f36a79a-aa9a-5792-9a5e-5587fd626ee3", + "value": "Manipulate Platform Algorithm" + }, + { + "description": "Bypassing content blocking refers to actions taken to circumvent network security measures that prevent users from accessing certain servers, resources, or other online spheres. An influence operation may bypass content blocking to proliferate its content on restricted areas of the internet. Common strategies for bypassing content blocking include: - Altering IP addresses to avoid IP filtering - Using a Virtual Private Network (VPN) to avoid IP filtering - Using a Content Delivery Network (CDN) to avoid IP filtering - Enabling encryption to bypass packet inspection blocking - Manipulating text to avoid filtering by keywords - Posting content on multiple platforms to avoid platform-specific removals - Using local facilities or modified DNS servers to avoid DNS filtering", + "meta": { + "external_id": "T0121.001", + "kill_chain": [ + "tactics:Maximise Exposure" + ], + "refs": [ + "https://github.com/DISARMFoundation/DISARMframeworks/blob/main/generated_pages/techniques/T0121.001.md" + ] + }, + "related": [], + "uuid": "df60a404-a336-5fe0-8194-4c7605b0504c", + "value": "Bypass Content Blocking" + }, + { + "description": "Direct users to alternative platforms refers to encouraging users to move from the platform on which they initially viewed operation content and engage with content on alternate information channels, including separate social media channels and inauthentic websites. An operation may drive users to alternative platforms to diversify its information channels and ensure the target audience knows where to access operation content if the initial platform suspends, flags, or otherwise removes original operation assets and content.", + "meta": { + "external_id": "T0122", + "kill_chain": [ + "tactics:Maximise Exposure" + ], + "refs": [ + "https://github.com/DISARMFoundation/DISARMframeworks/blob/main/generated_pages/techniques/T0122.md" + ] + }, + "related": [], + "uuid": "18930995-fc3c-530b-8e6c-ae8fef68a4df", + "value": "Direct Users to Alternative Platforms" + }, + { + "description": "Controlling the information environment through offensive cyberspace operations uses cyber tools and techniques to alter the trajectory of content in the information space to either prioritise operation messaging or block opposition messaging.", + "meta": { + "external_id": "T0123", + "kill_chain": [ + "tactics:Drive Online Harms" + ], + "refs": [ + "https://github.com/DISARMFoundation/DISARMframeworks/blob/main/generated_pages/techniques/T0123.md" + ] + }, + "related": [], + "uuid": "8264209e-287a-535e-b502-a0c59483a667", + "value": "Control Information Environment through Offensive Cyberspace Operations" + }, + { + "description": "Deleting opposing content refers to the removal of content that conflicts with operational narratives from selected platforms. An influence operation may delete opposing content to censor contradictory information from the target audience, allowing operation narratives to take priority in the information space.", + "meta": { + "external_id": "T0123.001", + "kill_chain": [ + "tactics:Drive Online Harms" + ], + "refs": [ + "https://github.com/DISARMFoundation/DISARMframeworks/blob/main/generated_pages/techniques/T0123.001.md" + ] + }, + "related": [], + "uuid": "e65250eb-08b4-5bc5-b3b5-d0f426470755", + "value": "Delete Opposing Content" + }, + { + "description": "Content blocking refers to actions taken to restrict internet access or render certain areas of the internet inaccessible. An influence operation may restrict content based on both network and content attributes.", + "meta": { + "external_id": "T0123.002", + "kill_chain": [ + "tactics:Drive Online Harms" + ], + "refs": [ + "https://github.com/DISARMFoundation/DISARMframeworks/blob/main/generated_pages/techniques/T0123.002.md" + ] + }, + "related": [], + "uuid": "8afe697e-f8f5-5b71-81e3-1d81d89b754b", + "value": "Block Content" + }, + { + "description": "Destroying information generation capabilities refers to actions taken to limit, degrade, or otherwise incapacitate an actor’s ability to generate conflicting information. An influence operation may destroy an actor’s information generation capabilities by physically dismantling the information infrastructure, disconnecting resources needed for information generation, or redirecting information generation personnel. An operation may destroy an adversary’s information generation capabilities to limit conflicting content exposure to the target audience and crowd the information space with its own narratives.", + "meta": { + "external_id": "T0123.003", + "kill_chain": [ + "tactics:Drive Online Harms" + ], + "refs": [ + "https://github.com/DISARMFoundation/DISARMframeworks/blob/main/generated_pages/techniques/T0123.003.md" + ] + }, + "related": [], + "uuid": "55d0c38e-4e38-56c9-b864-962c976b2a62", + "value": "Destroy Information Generation Capabilities" + }, + { + "description": "A server redirect, also known as a URL redirect, occurs when a server automatically forwards a user from one URL to another using server-side or client-side scripting languages. An influence operation may conduct a server redirect to divert target audience members from one website to another without their knowledge. The redirected website may pose as a legitimate source, host malware, or otherwise aid operation objectives.", + "meta": { + "external_id": "T0123.004", + "kill_chain": [ + "tactics:Drive Online Harms" + ], + "refs": [ + "https://github.com/DISARMFoundation/DISARMframeworks/blob/main/generated_pages/techniques/T0123.004.md" + ] + }, + "related": [], + "uuid": "27fe7183-604f-5b93-a55f-0e9b6a10dd8c", + "value": "Conduct Server Redirect" + }, + { + "description": "Operators can suppress the opposition by exploiting platform content moderation tools and processes like reporting non-violative content to platforms for takedown and goading opposition actors into taking actions that result in platform action or target audience disapproval.", + "meta": { + "external_id": "T0124", + "kill_chain": [ + "tactics:Drive Online Harms" + ], + "refs": [ + "https://github.com/DISARMFoundation/DISARMframeworks/blob/main/generated_pages/techniques/T0124.md" + ] + }, + "related": [], + "uuid": "57788034-088b-5c4d-b0b3-25dcea8f2973", + "value": "Suppress Opposition" + }, + { + "description": "Reporting opposing content refers to notifying and providing an instance of a violation of a platform’s guidelines and policies for conduct on the platform. In addition to simply reporting the content, an operation may leverage copyright regulations to trick social media and web platforms into removing opposing content by manipulating the content to appear in violation of copyright laws. Reporting opposing content facilitates the suppression of contradictory information and allows operation narratives to take priority in the information space.", + "meta": { + "external_id": "T0124.001", + "kill_chain": [ + "tactics:Drive Online Harms" + ], + "refs": [ + "https://github.com/DISARMFoundation/DISARMframeworks/blob/main/generated_pages/techniques/T0124.001.md" + ] + }, + "related": [], + "uuid": "de589f8f-a86c-5cc4-bd1b-fb522555b718", + "value": "Report Non-Violative Opposing Content" + }, + { + "description": "Goad people into actions that violate terms of service or will lead to having their content or accounts taken down.", + "meta": { + "external_id": "T0124.002", + "kill_chain": [ + "tactics:Drive Online Harms" + ], + "refs": [ + "https://github.com/DISARMFoundation/DISARMframeworks/blob/main/generated_pages/techniques/T0124.002.md" + ] + }, + "related": [], + "uuid": "5ebcb2f6-22b0-5c8a-9b40-d764b736210f", + "value": "Goad People into Harmful Action (Stop Hitting Yourself)" + }, + { + "description": "Exploit Platform TOS/Content Moderation", + "meta": { + "external_id": "T0124.003", + "kill_chain": [ + "tactics:Drive Online Harms" + ], + "refs": [ + "https://github.com/DISARMFoundation/DISARMframeworks/blob/main/generated_pages/techniques/T0124.003.md" + ] + }, + "related": [], + "uuid": "393644ea-39c6-59c4-976f-7c2088167f14", + "value": "Exploit Platform TOS/Content Moderation" + }, + { + "description": "Platform filtering refers to the decontextualization of information as claims cross platforms (from Joan Donovan https://www.hks.harvard.edu/publications/disinformation-design-use-evidence-collages-and-platform-filtering-media-manipulation)", + "meta": { + "external_id": "T0125", + "kill_chain": [ + "tactics:Drive Online Harms" + ], + "refs": [ + "https://github.com/DISARMFoundation/DISARMframeworks/blob/main/generated_pages/techniques/T0125.md" + ] + }, + "related": [], + "uuid": "c56168d8-5f79-57d4-8cf2-a3575bd7e598", + "value": "Platform Filtering" + }, + { + "description": "Operation encourages attendance at existing real world event.", + "meta": { + "external_id": "T0126", + "kill_chain": [ + "tactics:Drive Offline Activity" + ], + "refs": [ + "https://github.com/DISARMFoundation/DISARMframeworks/blob/main/generated_pages/techniques/T0126.md" + ] + }, + "related": [], + "uuid": "cf67a0f0-ae79-59bb-afe2-1eda9f99e8e4", + "value": "Encourage Attendance at Events" + }, + { + "description": "Call to action to attend an event", + "meta": { + "external_id": "T0126.001", + "kill_chain": [ + "tactics:Drive Offline Activity" + ], + "refs": [ + "https://github.com/DISARMFoundation/DISARMframeworks/blob/main/generated_pages/techniques/T0126.001.md" + ] + }, + "related": [], + "uuid": "e52a27b8-48f8-527d-9859-84b198d61864", + "value": "Call to Action to Attend" + }, + { + "description": "Facilitate logistics or support for travel, food, housing, etc.", + "meta": { + "external_id": "T0126.002", + "kill_chain": [ + "tactics:Drive Offline Activity" + ], + "refs": [ + "https://github.com/DISARMFoundation/DISARMframeworks/blob/main/generated_pages/techniques/T0126.002.md" + ] + }, + "related": [], + "uuid": "829b1f45-d835-53c8-94e5-4ff3c87fc39c", + "value": "Facilitate Logistics or Support for Attendance" + }, + { + "description": "Physical violence refers to the use of force to injure, abuse, damage, or destroy. An influence operation may conduct or encourage physical violence to discourage opponents from promoting conflicting content or draw attention to operation narratives using shock value.", + "meta": { + "external_id": "T0127", + "kill_chain": [ + "tactics:Drive Offline Activity" + ], + "refs": [ + "https://github.com/DISARMFoundation/DISARMframeworks/blob/main/generated_pages/techniques/T0127.md" + ] + }, + "related": [], + "uuid": "db32bcd3-a2ee-58ac-bc71-33f1af810a98", + "value": "Physical Violence" + }, + { + "description": "An influence operation may directly Conduct Physical Violence to achieve campaign goals.", + "meta": { + "external_id": "T0127.001", + "kill_chain": [ + "tactics:Drive Offline Activity" + ], + "refs": [ + "https://github.com/DISARMFoundation/DISARMframeworks/blob/main/generated_pages/techniques/T0127.001.md" + ] + }, + "related": [], + "uuid": "4c7437f5-1759-527a-b7e1-53de1a65abb2", + "value": "Conduct Physical Violence" + }, + { + "description": "An influence operation may Encourage others to engage in Physical Violence to achieve campaign goals.", + "meta": { + "external_id": "T0127.002", + "kill_chain": [ + "tactics:Drive Offline Activity" + ], + "refs": [ + "https://github.com/DISARMFoundation/DISARMframeworks/blob/main/generated_pages/techniques/T0127.002.md" + ] + }, + "related": [], + "uuid": "7dc74bbe-4d75-55f7-951c-bdd766e2efa6", + "value": "Encourage Physical Violence" + }, + { + "description": "Conceal the identity or provenance of campaign information assets such as accounts, channels, pages etc. to avoid takedown and attribution.", + "meta": { + "external_id": "T0128", + "kill_chain": [ + "tactics:Persist in the Information Environment" + ], + "refs": [ + "https://github.com/DISARMFoundation/DISARMframeworks/blob/main/generated_pages/techniques/T0128.md" + ] + }, + "related": [], + "uuid": "e9efb6c7-93bf-5bce-a6c7-f01bb8d8a3f8", + "value": "Conceal Information Assets" + }, + { + "description": "An operation may use pseudonyms, or fake names, to mask the identity of operational accounts, channels, pages etc., publish anonymous content, or otherwise use falsified personas to conceal the identity of the operation. An operation may coordinate pseudonyms across multiple platforms, for example, by writing an article under a pseudonym and then posting a link to the article on social media on an account, channel, or page with the same falsified name.", + "meta": { + "external_id": "T0128.001", + "kill_chain": [ + "tactics:Persist in the Information Environment" + ], + "refs": [ + "https://github.com/DISARMFoundation/DISARMframeworks/blob/main/generated_pages/techniques/T0128.001.md" + ] + }, + "related": [], + "uuid": "4e7db4e0-23e4-5931-bf81-2c60081bb44f", + "value": "Use Pseudonyms" + }, + { + "description": "Concealing network identity aims to hide the existence an influence operation’s network completely. Unlike concealing sponsorship, concealing network identity denies the existence of any sort of organisation.", + "meta": { + "external_id": "T0128.002", + "kill_chain": [ + "tactics:Persist in the Information Environment" + ], + "refs": [ + "https://github.com/DISARMFoundation/DISARMframeworks/blob/main/generated_pages/techniques/T0128.002.md" + ] + }, + "related": [], + "uuid": "caa69e11-fc2b-580d-a6cb-a9bf28308b71", + "value": "Conceal Network Identity" + }, + { + "description": "Distancing reputable individuals from the operation occurs when enlisted individuals, such as celebrities or subject matter experts, actively disengage themselves from operation activities and messaging. Individuals may distance themselves from the operation by deleting old posts or statements, unfollowing operation information assets, or otherwise detaching themselves from the operation’s timeline. An influence operation may want reputable individuals to distance themselves from the operation to reduce operation exposure, particularly if the operation aims to remove all evidence.", + "meta": { + "external_id": "T0128.003", + "kill_chain": [ + "tactics:Persist in the Information Environment" + ], + "refs": [ + "https://github.com/DISARMFoundation/DISARMframeworks/blob/main/generated_pages/techniques/T0128.003.md" + ] + }, + "related": [], + "uuid": "ef1633ed-1970-54e9-9fcc-60693beb0500", + "value": "Distance Reputable Individuals from Operation" + }, + { + "description": "Laundering occurs when an influence operation acquires control of previously legitimate information assets such as accounts, channels, pages etc. from third parties through sale or exchange and often in contravention of terms of use. Influence operations use laundered assets to reach target audience members from within an existing information community and to complicate attribution.", + "meta": { + "external_id": "T0128.004", + "kill_chain": [ + "tactics:Persist in the Information Environment" + ], + "refs": [ + "https://github.com/DISARMFoundation/DISARMframeworks/blob/main/generated_pages/techniques/T0128.004.md" + ] + }, + "related": [], + "uuid": "8f9b7ca8-e697-520e-a477-f0ba0509bfcd", + "value": "Launder Information Assets" + }, + { + "description": "Changing names or brand names of information assets such as accounts, channels, pages etc. An operation may change the names or brand names of its assets throughout an operation to avoid detection or alter the names of newly acquired or repurposed assets to fit operational narratives.", + "meta": { + "external_id": "T0128.005", + "kill_chain": [ + "tactics:Persist in the Information Environment" + ], + "refs": [ + "https://github.com/DISARMFoundation/DISARMframeworks/blob/main/generated_pages/techniques/T0128.005.md" + ] + }, + "related": [], + "uuid": "234c3805-31b1-585b-8c39-94c35315860d", + "value": "Change Names of Information Assets" + }, + { + "description": "Conceal the campaign's operational activity to avoid takedown and attribution.", + "meta": { + "external_id": "T0129", + "kill_chain": [ + "tactics:Persist in the Information Environment" + ], + "refs": [ + "https://github.com/DISARMFoundation/DISARMframeworks/blob/main/generated_pages/techniques/T0129.md" + ] + }, + "related": [], + "uuid": "7c57a7c5-28eb-550d-bdf5-12be2396acb7", + "value": "Conceal Operational Activity" + }, + { + "description": "Concealing network identity aims to hide the existence an influence operation’s network completely. Unlike concealing sponsorship, concealing network identity denies the existence of any sort of organisation.", + "meta": { + "external_id": "T0129.001", + "kill_chain": [ + "tactics:Persist in the Information Environment" + ], + "refs": [ + "https://github.com/DISARMFoundation/DISARMframeworks/blob/main/generated_pages/techniques/T0129.001.md" + ] + }, + "related": [], + "uuid": "dab70ef3-f926-5288-b165-384fad15336d", + "value": "Conceal Network Identity" + }, + { + "description": "An influence operation may mix its own operation content with legitimate news or external unrelated content to disguise operational objectives, narratives, or existence. For example, an operation may generate \"lifestyle\" or \"cuisine\" content alongside regular operation content.", + "meta": { + "external_id": "T0129.002", + "kill_chain": [ + "tactics:Persist in the Information Environment" + ], + "refs": [ + "https://github.com/DISARMFoundation/DISARMframeworks/blob/main/generated_pages/techniques/T0129.002.md" + ] + }, + "related": [], + "uuid": "b7751384-967b-5260-89c8-0301868810f5", + "value": "Generate Content Unrelated to Narrative" + }, + { + "description": "Breaking association with content occurs when an influence operation actively separates itself from its own content. An influence operation may break association with content by unfollowing, unliking, or unsharing its content, removing attribution from its content, or otherwise taking actions that distance the operation from its messaging. An influence operation may break association with its content to complicate attribution or regain credibility for a new operation.", + "meta": { + "external_id": "T0129.003", + "kill_chain": [ + "tactics:Persist in the Information Environment" + ], + "refs": [ + "https://github.com/DISARMFoundation/DISARMframeworks/blob/main/generated_pages/techniques/T0129.003.md" + ] + }, + "related": [], + "uuid": "3cf39d60-3b40-5739-b7e7-c6cd3474a9ee", + "value": "Break Association with Content" + }, + { + "description": "URL deletion occurs when an influence operation completely removes its website registration, rendering the URL inaccessible. An influence operation may delete its URLs to complicate attribution or remove online documentation that the operation ever occurred.", + "meta": { + "external_id": "T0129.004", + "kill_chain": [ + "tactics:Persist in the Information Environment" + ], + "refs": [ + "https://github.com/DISARMFoundation/DISARMframeworks/blob/main/generated_pages/techniques/T0129.004.md" + ] + }, + "related": [], + "uuid": "4f4ae59d-332d-52d5-8c18-cfd6bfc9da97", + "value": "Delete URLs" + }, + { + "description": "Coordinate on encrypted/ closed networks", + "meta": { + "external_id": "T0129.005", + "kill_chain": [ + "tactics:Persist in the Information Environment" + ], + "refs": [ + "https://github.com/DISARMFoundation/DISARMframeworks/blob/main/generated_pages/techniques/T0129.005.md" + ] + }, + "related": [], + "uuid": "6f546799-5edd-5356-a976-a1df70f5ca32", + "value": "Coordinate on Encrypted/Closed Networks" + }, + { + "description": "Without \"smoking gun\" proof (and even with proof), incident creator can or will deny involvement. This technique also leverages the attacker advantages outlined in \"Demand insurmountable proof\", specifically the asymmetric disadvantage for truth-tellers in a \"firehose of misinformation\" environment.", + "meta": { + "external_id": "T0129.006", + "kill_chain": [ + "tactics:Persist in the Information Environment" + ], + "refs": [ + "https://github.com/DISARMFoundation/DISARMframeworks/blob/main/generated_pages/techniques/T0129.006.md" + ] + }, + "related": [], + "uuid": "1646a166-55f0-54c8-a5cc-9e0ca4779974", + "value": "Deny Involvement" + }, + { + "description": "Deleting accounts and account activity occurs when an influence operation removes its online social media assets, including social media accounts, posts, likes, comments, and other online artefacts. An influence operation may delete its accounts and account activity to complicate attribution or remove online documentation that the operation ever occurred.", + "meta": { + "external_id": "T0129.007", + "kill_chain": [ + "tactics:Persist in the Information Environment" + ], + "refs": [ + "https://github.com/DISARMFoundation/DISARMframeworks/blob/main/generated_pages/techniques/T0129.007.md" + ] + }, + "related": [], + "uuid": "abf940cd-1f31-5ca7-a2ef-2714c54a3c2a", + "value": "Delete Accounts/Account Activity" + }, + { + "description": "An influence operation may redirect its falsified or typosquatted URLs to legitimate websites to increase the operation's appearance of legitimacy, complicate attribution, and avoid detection.", + "meta": { + "external_id": "T0129.008", + "kill_chain": [ + "tactics:Persist in the Information Environment" + ], + "refs": [ + "https://github.com/DISARMFoundation/DISARMframeworks/blob/main/generated_pages/techniques/T0129.008.md" + ] + }, + "related": [], + "uuid": "4c7aca7d-c1d2-5262-b374-d28675ddd402", + "value": "Redirect URLs" + }, + { + "description": "Removing post origins refers to the elimination of evidence that indicates the initial source of operation content, often to complicate attribution. An influence operation may remove post origins by deleting watermarks, renaming files, or removing embedded links in its content.", + "meta": { + "external_id": "T0129.009", + "kill_chain": [ + "tactics:Persist in the Information Environment" + ], + "refs": [ + "https://github.com/DISARMFoundation/DISARMframeworks/blob/main/generated_pages/techniques/T0129.009.md" + ] + }, + "related": [], + "uuid": "1192d06d-4766-599f-987f-f6eb292f1b5c", + "value": "Remove Post Origins" + }, + { + "description": "Misattributed activity refers to incorrectly attributed operation activity. For example, a state sponsored influence operation may conduct operation activity in a way that mimics another state so that external entities misattribute activity to the incorrect state. An operation may misattribute their activities to complicate attribution, avoid detection, or frame an adversary for negative behaviour.", + "meta": { + "external_id": "T0129.010", + "kill_chain": [ + "tactics:Persist in the Information Environment" + ], + "refs": [ + "https://github.com/DISARMFoundation/DISARMframeworks/blob/main/generated_pages/techniques/T0129.010.md" + ] + }, + "related": [], + "uuid": "5b9fee14-a5d4-56e3-a8b1-7031ef414e78", + "value": "Misattribute Activity" + }, + { + "description": "Conceal the campaign's infrastructure to avoid takedown and attribution.", + "meta": { + "external_id": "T0130", + "kill_chain": [ + "tactics:Persist in the Information Environment" + ], + "refs": [ + "https://github.com/DISARMFoundation/DISARMframeworks/blob/main/generated_pages/techniques/T0130.md" + ] + }, + "related": [], + "uuid": "e19140c7-5296-574a-8350-5b1d5be04630", + "value": "Conceal Infrastructure" + }, + { + "description": "Concealing sponsorship aims to mislead or obscure the identity of the hidden sponsor behind an operation rather than entity publicly running the operation. Operations that conceal sponsorship may maintain visible falsified groups, news outlets, non-profits, or other organisations, but seek to mislead or obscure the identity sponsoring, funding, or otherwise supporting these entities. Influence operations may use a variety of techniques to mask the location of their social media accounts to complicate attribution and conceal evidence of foreign interference. Operation accounts may set their location to a false place, often the location of the operation’s target audience, and post in the region’s language", + "meta": { + "external_id": "T0130.001", + "kill_chain": [ + "tactics:Persist in the Information Environment" + ], + "refs": [ + "https://github.com/DISARMFoundation/DISARMframeworks/blob/main/generated_pages/techniques/T0130.001.md" + ] + }, + "related": [], + "uuid": "bd222921-2ce7-5198-aebe-794cbc81b5db", + "value": "Conceal Sponsorship" + }, + { + "description": "Hosting refers to services through which storage and computing resources are provided to an individual or organisation for the accommodation and maintenance of one or more websites and related services. Services may include web hosting, file sharing, and email distribution. Bulletproof hosting refers to services provided by an entity, such as a domain hosting or web hosting firm, that allows its customer considerable leniency in use of the service. An influence operation may utilise bulletproof hosting to maintain continuity of service for suspicious, illegal, or disruptive operation activities that stricter hosting services would limit, report, or suspend.", + "meta": { + "external_id": "T0130.002", + "kill_chain": [ + "tactics:Persist in the Information Environment" + ], + "refs": [ + "https://github.com/DISARMFoundation/DISARMframeworks/blob/main/generated_pages/techniques/T0130.002.md" + ] + }, + "related": [], + "uuid": "64cfd678-c279-59af-89ef-fce2be1f6b26", + "value": "Utilise Bulletproof Hosting" + }, + { + "description": "Use Shell Organisations to conceal sponsorship.", + "meta": { + "external_id": "T0130.003", + "kill_chain": [ + "tactics:Persist in the Information Environment" + ], + "refs": [ + "https://github.com/DISARMFoundation/DISARMframeworks/blob/main/generated_pages/techniques/T0130.003.md" + ] + }, + "related": [], + "uuid": "e33a8453-d3c1-53a7-9568-8fb65ffe8a47", + "value": "Use Shell Organisations" + }, + { + "description": "Use Cryptocurrency to conceal sponsorship. Examples include Bitcoin, Monero, and Etherium.", + "meta": { + "external_id": "T0130.004", + "kill_chain": [ + "tactics:Persist in the Information Environment" + ], + "refs": [ + "https://github.com/DISARMFoundation/DISARMframeworks/blob/main/generated_pages/techniques/T0130.004.md" + ] + }, + "related": [], + "uuid": "6d422b33-be0a-5d5e-8556-f6db54f506d9", + "value": "Use Cryptocurrency" + }, + { + "description": "Obfuscate Payment", + "meta": { + "external_id": "T0130.005", + "kill_chain": [ + "tactics:Persist in the Information Environment" + ], + "refs": [ + "https://github.com/DISARMFoundation/DISARMframeworks/blob/main/generated_pages/techniques/T0130.005.md" + ] + }, + "related": [], + "uuid": "97c3035f-9c01-51a9-8f00-0b28b12d89bd", + "value": "Obfuscate Payment" + }, + { + "description": "Exploiting weaknesses in platforms' terms of service and content moderation policies to avoid takedowns and platform actions.", + "meta": { + "external_id": "T0131", + "kill_chain": [ + "tactics:Persist in the Information Environment" + ], + "refs": [ + "https://github.com/DISARMFoundation/DISARMframeworks/blob/main/generated_pages/techniques/T0131.md" + ] + }, + "related": [], + "uuid": "636c3c7c-c98a-50dd-9b98-607d163a3a94", + "value": "Exploit TOS/Content Moderation" + }, + { + "description": "Make incident content visible for a long time, e.g. by exploiting platform terms of service, or placing it where it's hard to remove or unlikely to be removed.", + "meta": { + "external_id": "T0131.001", + "kill_chain": [ + "tactics:Persist in the Information Environment" + ], + "refs": [ + "https://github.com/DISARMFoundation/DISARMframeworks/blob/main/generated_pages/techniques/T0131.001.md" + ] + }, + "related": [], + "uuid": "7897332f-fb75-509f-8cf5-005da7bd14cf", + "value": "Legacy Web Content" + }, + { + "description": "Post Borderline Content", + "meta": { + "external_id": "T0131.002", + "kill_chain": [ + "tactics:Persist in the Information Environment" + ], + "refs": [ + "https://github.com/DISARMFoundation/DISARMframeworks/blob/main/generated_pages/techniques/T0131.002.md" + ] + }, + "related": [], + "uuid": "98cdfd25-6d66-5dfe-8303-a97d2f6d44dd", + "value": "Post Borderline Content" + }, + { + "description": "A metric used to determine the accomplishment of actions. “Are the actions being executed as planned?”", + "meta": { + "external_id": "T0132", + "kill_chain": [ + "tactics:Assess Effectiveness" + ], + "refs": [ + "https://github.com/DISARMFoundation/DISARMframeworks/blob/main/generated_pages/techniques/T0132.md" + ] + }, + "related": [], + "uuid": "68f1e82e-f3ae-5975-aec8-a396c204ed39", + "value": "Measure Performance" + }, + { + "description": "Measure the performance individuals in achieving campaign goals", + "meta": { + "external_id": "T0132.001", + "kill_chain": [ + "tactics:Assess Effectiveness" + ], + "refs": [ + "https://github.com/DISARMFoundation/DISARMframeworks/blob/main/generated_pages/techniques/T0132.001.md" + ] + }, + "related": [], + "uuid": "7e712446-36ee-584f-a832-c98f8fa6d912", + "value": "People Focused" + }, + { + "description": "Measure the performance of campaign content", + "meta": { + "external_id": "T0132.002", + "kill_chain": [ + "tactics:Assess Effectiveness" + ], + "refs": [ + "https://github.com/DISARMFoundation/DISARMframeworks/blob/main/generated_pages/techniques/T0132.002.md" + ] + }, + "related": [], + "uuid": "145dc4d2-ab1f-5128-a7bf-d7d835b0a8fa", + "value": "Content Focused" + }, + { + "description": "View Focused", + "meta": { + "external_id": "T0132.003", + "kill_chain": [ + "tactics:Assess Effectiveness" + ], + "refs": [ + "https://github.com/DISARMFoundation/DISARMframeworks/blob/main/generated_pages/techniques/T0132.003.md" + ] + }, + "related": [], + "uuid": "79368272-a235-5d84-aeb3-70d337dcfffb", + "value": "View Focused" + }, + { + "description": "A metric used to measure a current system state. “Are we on track to achieve the intended new system state within the planned timescale?”", + "meta": { + "external_id": "T0133", + "kill_chain": [ + "tactics:Assess Effectiveness" + ], + "refs": [ + "https://github.com/DISARMFoundation/DISARMframeworks/blob/main/generated_pages/techniques/T0133.md" + ] + }, + "related": [], + "uuid": "26789434-54f0-5a93-a769-4810af285679", + "value": "Measure Effectiveness" + }, + { + "description": "Monitor and evaluate behaviour changes from misinformation incidents.", + "meta": { + "external_id": "T0133.001", + "kill_chain": [ + "tactics:Assess Effectiveness" + ], + "refs": [ + "https://github.com/DISARMFoundation/DISARMframeworks/blob/main/generated_pages/techniques/T0133.001.md" + ] + }, + "related": [], + "uuid": "3cf4d2ba-2ba4-58c0-915d-c9781f4b4979", + "value": "Behaviour Changes" + }, + { + "description": "Measure current system state with respect to the effectiveness of campaign content.", + "meta": { + "external_id": "T0133.002", + "kill_chain": [ + "tactics:Assess Effectiveness" + ], + "refs": [ + "https://github.com/DISARMFoundation/DISARMframeworks/blob/main/generated_pages/techniques/T0133.002.md" + ] + }, + "related": [], + "uuid": "90ed2d0b-1260-50ed-8a3d-8a71fbda4c8e", + "value": "Content" + }, + { + "description": "Measure current system state with respect to the effectiveness of influencing awareness.", + "meta": { + "external_id": "T0133.003", + "kill_chain": [ + "tactics:Assess Effectiveness" + ], + "refs": [ + "https://github.com/DISARMFoundation/DISARMframeworks/blob/main/generated_pages/techniques/T0133.003.md" + ] + }, + "related": [], + "uuid": "2a5f3d2c-9b1e-5aa5-a817-f9af6adf454d", + "value": "Awareness" + }, + { + "description": "Measure current system state with respect to the effectiveness of influencing knowledge.", + "meta": { + "external_id": "T0133.004", + "kill_chain": [ + "tactics:Assess Effectiveness" + ], + "refs": [ + "https://github.com/DISARMFoundation/DISARMframeworks/blob/main/generated_pages/techniques/T0133.004.md" + ] + }, + "related": [], + "uuid": "df8b6793-cb28-5445-bbdb-c72bf5ff73fa", + "value": "Knowledge" + }, + { + "description": "Measure current system state with respect to the effectiveness of influencing action/attitude.", + "meta": { + "external_id": "T0133.005", + "kill_chain": [ + "tactics:Assess Effectiveness" + ], + "refs": [ + "https://github.com/DISARMFoundation/DISARMframeworks/blob/main/generated_pages/techniques/T0133.005.md" + ] + }, + "related": [], + "uuid": "f9ae2f58-1c32-5e54-9bfd-27b3618a60e6", + "value": "Action/Attitude" + }, + { + "description": "Ensuring that Key Performance Indicators are identified and tracked, so that the performance and effectiveness of campaigns, and elements of campaigns, can be measured, during and after their execution.", + "meta": { + "external_id": "T0134", + "kill_chain": [ + "tactics:Assess Effectiveness" + ], + "refs": [ + "https://github.com/DISARMFoundation/DISARMframeworks/blob/main/generated_pages/techniques/T0134.md" + ] + }, + "related": [], + "uuid": "e13d8a29-e9ef-5bf5-bcbc-372edc418d5d", + "value": "Measure Effectiveness Indicators (or KPIs)" + }, + { + "description": "Monitor and evaluate message reach in misinformation incidents.", + "meta": { + "external_id": "T0134.001", + "kill_chain": [ + "tactics:Assess Effectiveness" + ], + "refs": [ + "https://github.com/DISARMFoundation/DISARMframeworks/blob/main/generated_pages/techniques/T0134.001.md" + ] + }, + "related": [], + "uuid": "22e518b6-db32-50db-bf96-5a19b6604b8c", + "value": "Message Reach" + }, + { + "description": "Monitor and evaluate social media engagement in misinformation incidents.", + "meta": { + "external_id": "T0134.002", + "kill_chain": [ + "tactics:Assess Effectiveness" + ], + "refs": [ + "https://github.com/DISARMFoundation/DISARMframeworks/blob/main/generated_pages/techniques/T0134.002.md" + ] + }, + "related": [], + "uuid": "e9ff0ba4-19ba-5ae7-9fd4-49ac50a8a7b2", + "value": "Social Media Engagement" + }, + { + "description": "Weaken, debilitate, or subvert a target or their actions. An influence operation may be designed to disparage an opponent; sabotage an opponent’s systems or processes; compromise an opponent’s relationships or support system; impair an opponent’s capability; or thwart an opponent’s initiative. ", + "meta": { + "external_id": "T0135", + "kill_chain": [ + "tactics:Plan Objectives" + ], + "refs": [ + "https://github.com/DISARMFoundation/DISARMframeworks/blob/main/generated_pages/techniques/T0135.md" + ] + }, + "related": [], + "uuid": "0141e703-9b91-55b5-b262-506eb215f6e8", + "value": "Undermine" + }, + { + "description": "Denigrate, disparage, or discredit an opponent. This is a common tactical objective in political campaigns with a larger strategic goal. It differs from efforts to harm a target through defamation. If there is no ulterior motive and the sole aim is to cause harm to the target, then choose sub-technique “Defame” of technique “Cause Harm” instead.", + "meta": { + "external_id": "T0135.001", + "kill_chain": [ + "tactics:Plan Objectives" + ], + "refs": [ + "https://github.com/DISARMFoundation/DISARMframeworks/blob/main/generated_pages/techniques/T0135.001.md" + ] + }, + "related": [], + "uuid": "a1a4b880-fd5a-5f6e-a649-3caf0e1395fc", + "value": "Smear" + }, + { + "description": "Prevent the successful outcome of a policy, operation, or initiative. Actors conduct influence operations to stymie or foil proposals, plans, or courses of action which are not in their interest. ", + "meta": { + "external_id": "T0135.002", + "kill_chain": [ + "tactics:Plan Objectives" + ], + "refs": [ + "https://github.com/DISARMFoundation/DISARMframeworks/blob/main/generated_pages/techniques/T0135.002.md" + ] + }, + "related": [], + "uuid": "13212ee6-9714-5a65-a1e2-6fa5e30b5f73", + "value": "Thwart" + }, + { + "description": "Sabotage, destroy, or damage a system, process, or relationship. The classic example is the Soviet strategy of “active measures” involving deniable covert activities such as political influence, the use of front organisations, the orchestration of domestic unrest, and the spread of disinformation. ", + "meta": { + "external_id": "T0135.003", + "kill_chain": [ + "tactics:Plan Objectives" + ], + "refs": [ + "https://github.com/DISARMFoundation/DISARMframeworks/blob/main/generated_pages/techniques/T0135.003.md" + ] + }, + "related": [], + "uuid": "0b45e223-773a-533f-83f0-fbc928fe8e77", + "value": "Subvert" + }, + { + "description": "To cause a target audience to divide into two completely opposing groups. This is a special case of subversion. To divide and conquer is an age-old approach to subverting and overcoming an enemy.", + "meta": { + "external_id": "T0135.004", + "kill_chain": [ + "tactics:Plan Objectives" + ], + "refs": [ + "https://github.com/DISARMFoundation/DISARMframeworks/blob/main/generated_pages/techniques/T0135.004.md" + ] + }, + "related": [], + "uuid": "674d2dbc-d75f-5c3e-964a-e4fd3010dd4f", + "value": "Polarise" + }, + { + "description": "Grow or maintain the base of support for the actor, ally, or action. This includes hard core recruitment, managing alliances, and generating or maintaining sympathy among a wider audience, including reputation management and public relations. Sub-techniques assume support for actor (self) unless otherwise specified. ", + "meta": { + "external_id": "T0136", + "kill_chain": [ + "tactics:Plan Objectives" + ], + "refs": [ + "https://github.com/DISARMFoundation/DISARMframeworks/blob/main/generated_pages/techniques/T0136.md" + ] + }, + "related": [], + "uuid": "92f8589a-028b-5504-8b71-bb847c45155b", + "value": "Cultivate Support" + }, + { + "description": "Preserve a positive perception in the public’s mind following an accusation or adverse event. When accused of a wrongful act, an actor may engage in denial, counter accusations, whataboutism, or conspiracy theories to distract public attention and attempt to maintain a positive image. ", + "meta": { + "external_id": "T0136.001", + "kill_chain": [ + "tactics:Plan Objectives" + ], + "refs": [ + "https://github.com/DISARMFoundation/DISARMframeworks/blob/main/generated_pages/techniques/T0136.001.md" + ] + }, + "related": [], + "uuid": "0846475e-2669-52e3-b1a0-9da43455379e", + "value": "Defend Reputaton" + }, + { + "description": "To convince others to exonerate you of a perceived wrongdoing. When an actor finds it untenable to deny doing something, they may attempt to exonerate themselves with disinformation which claims the action was reasonable. This is a special case of “Defend Reputation”. ", + "meta": { + "external_id": "T0136.002", + "kill_chain": [ + "tactics:Plan Objectives" + ], + "refs": [ + "https://github.com/DISARMFoundation/DISARMframeworks/blob/main/generated_pages/techniques/T0136.002.md" + ] + }, + "related": [], + "uuid": "eb9eddd7-ec69-57cf-9858-7699328de606", + "value": "Justify Action" + }, + { + "description": "Raise the morale of those who support the organisation or group. Invigorate constituents with zeal for the mission or activity. Terrorist groups, political movements, and cults may indoctrinate their supporters with ideologies that are based on warped versions of religion or cause harm to others. ", + "meta": { + "external_id": "T0136.003", + "kill_chain": [ + "tactics:Plan Objectives" + ], + "refs": [ + "https://github.com/DISARMFoundation/DISARMframeworks/blob/main/generated_pages/techniques/T0136.003.md" + ] + }, + "related": [], + "uuid": "367a49af-493d-5f32-af61-94ac25f12ef4", + "value": "Energise Supporters" + }, + { + "description": "Elevate the estimation of the actor in the public’s mind. Improve their image or standing. Public relations professionals use persuasive overt communications to achieve this goal; manipulators use covert disinformation. ", + "meta": { + "external_id": "T0136.004", + "kill_chain": [ + "tactics:Plan Objectives" + ], + "refs": [ + "https://github.com/DISARMFoundation/DISARMframeworks/blob/main/generated_pages/techniques/T0136.004.md" + ] + }, + "related": [], + "uuid": "53f0923a-2e3d-5d42-b520-1218f962dc68", + "value": "Boost Reputation" + }, + { + "description": "Elevate or fortify the public backing for a policy, operation, or idea. Domestic and foreign actors can use artificial means to fabricate or amplify public support for a proposal or action. ", + "meta": { + "external_id": "T0136.005", + "kill_chain": [ + "tactics:Plan Objectives" + ], + "refs": [ + "https://github.com/DISARMFoundation/DISARMframeworks/blob/main/generated_pages/techniques/T0136.005.md" + ] + }, + "related": [], + "uuid": "7da024d9-24d2-595a-becb-4a792e885b80", + "value": "Cultvate Support for Initiative" + }, + { + "description": "Elevate or fortify the public backing for a partner. Governments may interfere in other countries’ elections by covertly favouring a party or candidate aligned with their interests. They may also mount an influence operation to bolster the reputation of an ally under attack. ", + "meta": { + "external_id": "T0136.006", + "kill_chain": [ + "tactics:Plan Objectives" + ], + "refs": [ + "https://github.com/DISARMFoundation/DISARMframeworks/blob/main/generated_pages/techniques/T0136.006.md" + ] + }, + "related": [], + "uuid": "06bed5fe-853f-57ce-a6de-4174b6ab58d2", + "value": "Cultivate Support for Ally" + }, + { + "description": "Motivate followers to join or subscribe as members of the team. Organisations may mount recruitment drives that use propaganda to entice sympathisers to sign up. ", + "meta": { + "external_id": "T0136.007", + "kill_chain": [ + "tactics:Plan Objectives" + ], + "refs": [ + "https://github.com/DISARMFoundation/DISARMframeworks/blob/main/generated_pages/techniques/T0136.007.md" + ] + }, + "related": [], + "uuid": "78cd1801-a560-5417-abf2-dc5c617950e2", + "value": "Recruit Members" + }, + { + "description": "Improve personal standing within a community. Gain fame, approbation, or notoriety. Conspiracy theorists, those with special access, and ideologues can gain prominence in a community by propagating disinformation, leaking confidential documents, or spreading hate. ", + "meta": { + "external_id": "T0136.008", + "kill_chain": [ + "tactics:Plan Objectives" + ], + "refs": [ + "https://github.com/DISARMFoundation/DISARMframeworks/blob/main/generated_pages/techniques/T0136.008.md" + ] + }, + "related": [], + "uuid": "7f0f4d69-8634-52b4-aad8-61d8445acdb7", + "value": "Increase Prestige" + }, + { + "description": "Profit from disinformation, conspiracy theories, or online harm. In some cases, the sole objective is financial gain, in other cases the objective is both financial and political. Making money may also be a way to sustain a political campaign. ", + "meta": { + "external_id": "T0137", + "kill_chain": [ + "tactics:Plan Objectives" + ], + "refs": [ + "https://github.com/DISARMFoundation/DISARMframeworks/blob/main/generated_pages/techniques/T0137.md" + ] + }, + "related": [], + "uuid": "a9da70ec-419b-5fee-a66e-b55f0d5f483b", + "value": "Make Money" + }, + { + "description": "Earn income from digital advertisements published alongside inauthentic content. Conspiratorial, false, or provocative content drives internet traffic. Content owners earn money from impressions of, or clicks on, or conversions of ads published on their websites, social media profiles, or streaming services, or ads published when their content appears in search engine results. Fraudsters simulate impressions, clicks, and conversions, or they spin up inauthentic sites or social media profiles just to generate ad revenue. Conspiracy theorists and political operators generate ad revenue as a byproduct of their operation or as a means of sustaining their campaign. ", + "meta": { + "external_id": "T0137.001", + "kill_chain": [ + "tactics:Plan Objectives" + ], + "refs": [ + "https://github.com/DISARMFoundation/DISARMframeworks/blob/main/generated_pages/techniques/T0137.001.md" + ] + }, + "related": [], + "uuid": "a25ebac4-85ff-5106-926b-b3c9ca1dfc86", + "value": "Generate Ad Revenue" + }, + { + "description": "Defraud a target or trick a target into doing something that benefits the attacker. A typical scam is where a fraudster convinces a target to pay for something without the intention of ever delivering anything in return. Alternatively, the fraudster may promise benefits which never materialise, such as a fake cure. Criminals often exploit a fear or crisis or generate a sense of urgency. They may use deepfakes to impersonate authority figures or individuals in distress. ", + "meta": { + "external_id": "T0137.002", + "kill_chain": [ + "tactics:Plan Objectives" + ], + "refs": [ + "https://github.com/DISARMFoundation/DISARMframeworks/blob/main/generated_pages/techniques/T0137.002.md" + ] + }, + "related": [], + "uuid": "ef11bcd5-f638-55cb-a6e7-599fbbecdc80", + "value": "Scam" + }, + { + "description": "Solicit donations for a cause. Popular conspiracy theorists can attract financial contributions from their followers. Fighting back against the establishment is a popular crowdfunding narrative. ", + "meta": { + "external_id": "T0137.003", + "kill_chain": [ + "tactics:Plan Objectives" + ], + "refs": [ + "https://github.com/DISARMFoundation/DISARMframeworks/blob/main/generated_pages/techniques/T0137.003.md" + ] + }, + "related": [], + "uuid": "8c512fc6-92a0-5d2f-8b9b-d5e21283f365", + "value": "Raise Funds" + }, + { + "description": "Offer products for sale under false pretences. Campaigns may hijack or create causes built on disinformation to sell promotional merchandise. Or charlatans may amplify victims’ unfounded fears to sell them items of questionable utility such as supplements or survival gear. ", + "meta": { + "external_id": "T0137.004", + "kill_chain": [ + "tactics:Plan Objectives" + ], + "refs": [ + "https://github.com/DISARMFoundation/DISARMframeworks/blob/main/generated_pages/techniques/T0137.004.md" + ] + }, + "related": [], + "uuid": "b502d30b-0ad0-5abe-bba6-04298b660e26", + "value": "Sell Items under False Pretences" + }, + { + "description": "Coerce money or favours from a target by threatening to expose or corrupt information. Ransomware criminals typically demand money. Intelligence agencies demand national secrets. Sexual predators demand favours. The leverage may be critical, sensitive, or embarrassing information. ", + "meta": { + "external_id": "T0137.005", + "kill_chain": [ + "tactics:Plan Objectives" + ], + "refs": [ + "https://github.com/DISARMFoundation/DISARMframeworks/blob/main/generated_pages/techniques/T0137.005.md" + ] + }, + "related": [], + "uuid": "d174f433-fcf2-5ad7-be1c-098b373849c1", + "value": "Extort" + }, + { + "description": "Artificially inflate or deflate the price of stocks or other financial instruments and then trade on these to make profit. The most common securities fraud schemes are called “pump and dump” and “poop and scoop”. ", + "meta": { + "external_id": "T0137.006", + "kill_chain": [ + "tactics:Plan Objectives" + ], + "refs": [ + "https://github.com/DISARMFoundation/DISARMframeworks/blob/main/generated_pages/techniques/T0137.006.md" + ] + }, + "related": [], + "uuid": "bc85e12f-6663-567c-a422-180252963838", + "value": "Manipulate Stocks" + }, + { + "description": "Persuade, impel, or provoke the target to behave in a specific manner favourable to the attacker. Some common behaviours are joining, subscribing, voting, buying, demonstrating, fighting, retreating, resigning, boycotting.", + "meta": { + "external_id": "T0138", + "kill_chain": [ + "tactics:Plan Objectives" + ], + "refs": [ + "https://github.com/DISARMFoundation/DISARMframeworks/blob/main/generated_pages/techniques/T0138.md" + ] + }, + "related": [], + "uuid": "b0b363b2-8dc8-5be1-86f3-6da1b08427ae", + "value": "Motivate to Act" + }, + { + "description": "Inspire, animate, or exhort a target to act. An actor can use propaganda, disinformation, or conspiracy theories to stimulate a target to act in its interest. ", + "meta": { + "external_id": "T0138.001", + "kill_chain": [ + "tactics:Plan Objectives" + ], + "refs": [ + "https://github.com/DISARMFoundation/DISARMframeworks/blob/main/generated_pages/techniques/T0138.001.md" + ] + }, + "related": [], + "uuid": "7e4979e2-a6ce-5c9c-a153-2c0cdcefee24", + "value": "Encourage" + }, + { + "description": "Instigate, incite, or arouse a target to act. Social media manipulators exploit moral outrage to propel targets to spread hate, take to the streets to protest, or engage in acts of violence. ", + "meta": { + "external_id": "T0138.002", + "kill_chain": [ + "tactics:Plan Objectives" + ], + "refs": [ + "https://github.com/DISARMFoundation/DISARMframeworks/blob/main/generated_pages/techniques/T0138.002.md" + ] + }, + "related": [], + "uuid": "ce2c3d20-781c-5f85-a329-633bfd0b735d", + "value": "Provoke" + }, + { + "description": "Force target to take an action or to stop taking an action it has already started. Actors can use the threat of reputational damage alongside military or economic threats to compel a target.", + "meta": { + "external_id": "T0138.003", + "kill_chain": [ + "tactics:Plan Objectives" + ], + "refs": [ + "https://github.com/DISARMFoundation/DISARMframeworks/blob/main/generated_pages/techniques/T0138.003.md" + ] + }, + "related": [], + "uuid": "df4308e1-d324-57dc-b2e5-63dd8c4f884b", + "value": "Compel" + }, + { + "description": "Discourage, deter, or inhibit the target from actions which would be unfavourable to the attacker. The actor may want the target to refrain from voting, buying, fighting, or supplying. ", + "meta": { + "external_id": "T0139", + "kill_chain": [ + "tactics:Plan Objectives" + ], + "refs": [ + "https://github.com/DISARMFoundation/DISARMframeworks/blob/main/generated_pages/techniques/T0139.md" + ] + }, + "related": [], + "uuid": "854d0c3d-ea59-5e49-bc38-bee72958a0fb", + "value": "Dissuade from Acting" + }, + { + "description": "To make a target disinclined or reluctant to act. Manipulators use disinformation to cause targets to question the utility, legality, or morality of taking an action. ", + "meta": { + "external_id": "T0139.001", + "kill_chain": [ + "tactics:Plan Objectives" + ], + "refs": [ + "https://github.com/DISARMFoundation/DISARMframeworks/blob/main/generated_pages/techniques/T0139.001.md" + ] + }, + "related": [], + "uuid": "841f2f99-397b-5834-87a0-69e1d62cc68f", + "value": "Discourage" + }, + { + "description": "Intimidate or incentivise target into remaining silent or prevent target from speaking out. A threat actor may cow a target into silence as a special case of deterrence. Or they may buy the target’s silence. Or they may repress or restrict the target’s speech. ", + "meta": { + "external_id": "T0139.002", + "kill_chain": [ + "tactics:Plan Objectives" + ], + "refs": [ + "https://github.com/DISARMFoundation/DISARMframeworks/blob/main/generated_pages/techniques/T0139.002.md" + ] + }, + "related": [], + "uuid": "403d3951-1a59-5c34-b0da-08f6781b9562", + "value": "Silence" + }, + { + "description": "Prevent target from taking an action for fear of the consequences. Deterrence occurs in the mind of the target, who fears they will be worse off if they take an action than if they don’t. When making threats, aggressors may bluff, feign irrationality, or engage in brinksmanship.", + "meta": { + "external_id": "T0139.003", + "kill_chain": [ + "tactics:Plan Objectives" + ], + "refs": [ + "https://github.com/DISARMFoundation/DISARMframeworks/blob/main/generated_pages/techniques/T0139.003.md" + ] + }, + "related": [], + "uuid": "29b445b6-6d90-5b67-af56-3d78a0cd1343", + "value": "Deter" + }, + { + "description": "Persecute, malign, or inflict pain upon a target. The objective of a campaign may be to cause fear or emotional distress in a target. In some cases, harm is instrumental to achieving a primary objective, as in coercion, repression, or intimidation. In other cases, harm may be inflicted for the satisfaction of the perpetrator, as in revenge or sadistic cruelty. ", + "meta": { + "external_id": "T0140", + "kill_chain": [ + "tactics:Plan Objectives" + ], + "refs": [ + "https://github.com/DISARMFoundation/DISARMframeworks/blob/main/generated_pages/techniques/T0140.md" + ] + }, + "related": [], + "uuid": "0f9fbfeb-5b2f-5aa1-91fa-133841b458c7", + "value": "Cause Harm" + }, + { + "description": "Attempt to damage the target’s personal reputation by impugning their character. This can range from subtle attempts to misrepresent or insinuate, to obvious attempts to denigrate or disparage, to blatant attempts to malign or vilify. Slander applies to oral expression. Libel applies to written or pictorial material. Defamation is often carried out by online trolls. The sole aim here is to cause harm to the target. If the threat actor uses defamation as a means of undermining the target, then choose sub-technique “Smear” of technique “Undermine” instead. ", + "meta": { + "external_id": "T0140.001", + "kill_chain": [ + "tactics:Plan Objectives" + ], + "refs": [ + "https://github.com/DISARMFoundation/DISARMframeworks/blob/main/generated_pages/techniques/T0140.001.md" + ] + }, + "related": [], + "uuid": "79dd50a8-0b49-59f1-a820-1c76656cd836", + "value": "Defame" + }, + { + "description": "Coerce, bully, or frighten the target. An influence operation may use intimidation to compel the target to act against their will. Or the goal may be to frighten or even terrify the target into silence or submission. In some cases, the goal is simply to make the victim suffer. ", + "meta": { + "external_id": "T0140.002", + "kill_chain": [ + "tactics:Plan Objectives" + ], + "refs": [ + "https://github.com/DISARMFoundation/DISARMframeworks/blob/main/generated_pages/techniques/T0140.002.md" + ] + }, + "related": [], + "uuid": "3d2bdd06-fdcc-5c08-b71e-6aec4315cc2b", + "value": "Intimidate" + }, + { + "description": "Publish and/or propagate demeaning, derisive, or humiliating content targeting an individual or group of individuals with the intent to cause emotional, psychological, or physical distress. Hate speech can cause harm directly or incite others to harm the target. It often aims to stigmatise the target by singling out immutable characteristics such as colour, race, religion, national or ethnic origin, gender, gender identity, sexual orientation, age, disease, or mental or physical disability. Thus, promoting hatred online may involve racism, antisemitism, Islamophobia, xenophobia, sexism, misogyny, homophobia, transphobia, ageism, ableism, or any combination thereof. Motivations for hate speech range from group preservation to ideological superiority to the unbridled infliction of suffering. ", + "meta": { + "external_id": "T0140.003", + "kill_chain": [ + "tactics:Plan Objectives" + ], + "refs": [ + "https://github.com/DISARMFoundation/DISARMframeworks/blob/main/generated_pages/techniques/T0140.003.md" + ] + }, + "related": [], + "uuid": "823c3b54-8eac-5772-8e1c-b7fd55bbe518", + "value": "Spread Hate" + } + ], + "version": 1 +} diff --git a/galaxies/disarm-actortypes.json b/galaxies/disarm-actortypes.json new file mode 100644 index 0000000..1803bda --- /dev/null +++ b/galaxies/disarm-actortypes.json @@ -0,0 +1,24 @@ +{ + "description": "DISARM is a framework designed for describing and understanding disinformation incidents.", + "icon": "user-secret", + "kill_chain_order": { + "sectors": [ + "Nonprofit", + "Civil Society", + "Government", + "Academic", + "Activist", + "General Public", + "Social Media Company", + "Other Tech Company", + "Other Company", + "Media", + "" + ] + }, + "name": "Actor Types", + "namespace": "disarm", + "type": "disarm-actortypes", + "uuid": "1658af88-b847-532d-adc9-efaea8604f14", + "version": 1 +} diff --git a/galaxies/disarm-countermeasures.json b/galaxies/disarm-countermeasures.json new file mode 100644 index 0000000..0da3941 --- /dev/null +++ b/galaxies/disarm-countermeasures.json @@ -0,0 +1,54 @@ +{ + "description": "DISARM is a framework designed for describing and understanding disinformation incidents.", + "icon": "shield-alt", + "kill_chain_order": { + "metatechniques": [ + "Resilience", + "Diversion", + "Daylight", + "Friction", + "Removal", + "Scoring", + "Metatechnique", + "Data Pollution", + "Dilution", + "Countermessaging", + "Verification", + "Cleaning", + "Targeting", + "Reduce Resources" + ], + "responsetypes": [ + "Detect", + "Deny", + "Disrupt", + "Degrade", + "Deceive", + "Destroy", + "Deter" + ], + "tactics": [ + "Plan Strategy", + "Plan Objectives", + "Microtarget", + "Develop Content", + "Select Channels and Affordances", + "Conduct Pump Priming", + "Deliver Content", + "Drive Offline Activity", + "Persist in the Information Environment", + "Assess Effectiveness", + "Target Audience Analysis", + "Develop Narratives", + "Establish Social Assets", + "Establish Legitimacy", + "Maximise Exposure", + "Drive Online Harms" + ] + }, + "name": "Countermeasures", + "namespace": "disarm", + "type": "disarm-countermeasures", + "uuid": "9a3ac024-7c65-5ac0-87c4-eaed2238eec8", + "version": 1 +} diff --git a/galaxies/disarm-detections.json b/galaxies/disarm-detections.json new file mode 100644 index 0000000..772f830 --- /dev/null +++ b/galaxies/disarm-detections.json @@ -0,0 +1,38 @@ +{ + "description": "DISARM is a framework designed for describing and understanding disinformation incidents.", + "icon": "bell", + "kill_chain_order": { + "responsetypes": [ + "Detect", + "Deny", + "Disrupt", + "Degrade", + "Deceive", + "Destroy", + "Deter" + ], + "tactics": [ + "Plan Strategy", + "Plan Objectives", + "Microtarget", + "Develop Content", + "Select Channels and Affordances", + "Conduct Pump Priming", + "Deliver Content", + "Drive Offline Activity", + "Persist in the Information Environment", + "Assess Effectiveness", + "Target Audience Analysis", + "Develop Narratives", + "Establish Social Assets", + "Establish Legitimacy", + "Maximise Exposure", + "Drive Online Harms" + ] + }, + "name": "Detections", + "namespace": "disarm", + "type": "disarm-detections", + "uuid": "bb61e6f3-b2bd-5c7d-929c-b6f292ccc56a", + "version": 1 +} diff --git a/galaxies/disarm-techniques.json b/galaxies/disarm-techniques.json index e20971c..e40173a 100644 --- a/galaxies/disarm-techniques.json +++ b/galaxies/disarm-techniques.json @@ -2,7 +2,7 @@ "description": "DISARM is a framework designed for describing and understanding disinformation incidents.", "icon": "map", "kill_chain_order": { - "disarm-tactics": [ + "tactics": [ "Plan Strategy", "Plan Objectives", "Microtarget", @@ -21,9 +21,9 @@ "Drive Online Harms" ] }, - "name": "DISARM Techniques", + "name": "Techniques", "namespace": "disarm", - "type": "disarm", - "uuid": "a9532e45-d438-502a-a469-892007ba0e4b", + "type": "disarm-techniques", + "uuid": "a90f2bb6-11e1-58a7-9962-ba37886720ec", "version": 1 }