F00001 Analyse aborted / failed campaigns
Tactic stage: TA01
Summary: Examine failed campaigns. How did they fail? Can we create useful activities that increase these failures? - Details
Detections
F00002 Analyse viral fizzle
Tactic stage: TA01
Summary: We have no idea what this means. Is it something to do with the way a viral story spreads? - Details
F00003 Exploit counter-intelligence vs bad actors
Tactic stage: TA01
Summary: - Details
F00004 Recruit like-minded converts "people who used to be in-group"
Tactic stage: TA01
Summary: - Details
F00005 SWOT Analysis of Cognition in Various Groups
Tactic stage: TA01
Summary: Strengths, Weaknesses, Opportunities, Threats analysis of groups and audience segments. - Details
F00006 SWOT analysis of tech platforms
Tactic stage: TA01
Summary: - Details
F00007 Monitor account level activity in social networks
Tactic stage: TA02
Summary: - Details
F00008 Detect abnormal amplification
Tactic stage: TA15
Summary: - Details
F00009 Detect abnormal events
Tactic stage: TA15
Summary: - Details
F00010 Detect abnormal groups
Tactic stage: TA15
Summary: - Details
F00011 Detect abnormal pages
Tactic stage: TA15
Summary: - Details
F00012 Detect abnormal profiles, e.g. prolific pages/ groups/ people
Tactic stage: TA15
Summary: - Details
F00013 Identify fake news sites
Tactic stage: TA15
Summary: - Details
F00014 Trace connections
Tactic stage: TA15
Summary: for e.g. fake news sites - Details
F00015 Detect anomalies in membership growth patterns
Tactic stage: TA15
Summary: I include Fake Experts as they may use funding campaigns such as Patreon to fund their operations and so these should be watched. - Details
F00016 Identify fence-sitters
Tactic stage: TA15
Summary: Note: In each case, depending on the platform there may be a way to identify a fence-sitter. For example, online polls may have a neutral option or a "somewhat this-or-that" option, and may reveal who voted for that to all visitors. This information could be of use to data analysts. In TA08-11, the engagement level of victims could be identified to detect and respond to increasing engagement. - Details
F00017 Measure emotional valence
Tactic stage: TA15
Summary: - Details
F00018 Follow the money
Tactic stage: TA15
Summary: track funding sources - Details
F00019 Activity resurgence detection (alarm when dormant accounts become activated)
Tactic stage: TA15
Summary: - Details
F00020 Detect anomalous activity
Tactic stage: TA15
Summary: - Details
F00021 AI/ML automated early detection of campaign planning
Tactic stage: TA15
Summary: - Details
F00022 Digital authority - regulating body (united states)
Tactic stage: TA15
Summary: - Details
F00023 Periodic verification (counter to hijack legitimate account)
Tactic stage: TA15
Summary: - Details
F00024 Teach civics to kids/ adults/ seniors
Tactic stage: TA15
Summary: - Details
F00025 Boots-on-the-ground early narrative detection
Tactic stage: TA05
Summary: - Details
F00026 Language anomoly detection
Tactic stage: TA05
Summary: - Details
F00027 Unlikely correlation of sentiment on same topics
Tactic stage: TA05
Summary: - Details
F00028 Associate a public key signature with government documents
Tactic stage: TA06
Summary: - Details
F00029 Detect proto narratives, i.e. RT, Sputnik
Tactic stage: TA06
Summary: - Details
F00030 Early detection and warning - reporting of suspect content
Tactic stage: TA06
Summary: - Details
F00031 Educate on how to identify information pollution
Tactic stage: TA06
Summary: Strategic planning included as innoculating population has strategic value. - Details
F00032 Educate on how to identify to pollution
Tactic stage: TA06
Summary: DUPLICATE - DELETE - Details
F00033 Fake websites: add transparency on business model
Tactic stage: TA06
Summary: - Details
F00034 Flag the information spaces so people know about active flooding effort
Tactic stage: TA06
Summary: - Details
F00035 Identify repeated narrative DNA
Tactic stage: TA06
Summary: - Details
F00036 Looking for AB testing in unregulated channels
Tactic stage: TA06
Summary: - Details
F00037 News content provenance certification.
Tactic stage: TA06
Summary: Original Comment: Shortcomings: intentional falsehood. Doesn't solve accuracy. Can't be mandatory. Technique should be in terms of "strategic innoculation", raising the standards of what people expect in terms of evidence when consuming news. - Details
F00038 Social capital as attack vector
Tactic stage: TA06
Summary: Unsure I understood the original intention or what it applied to. Therefore the techniques listed (10, 39, 43, 57, 61) are under my interpretation - which is that we want to track ignorant agents who fall into the enemy's trap and show a cost to financing/reposting/helping the adversary via public shaming or other means. - Details
F00039 standards to track image/ video deep fakes - industry
Tactic stage: TA06
Summary: - Details
F00040 Unalterable metadata signature on origins of image and provenance
Tactic stage: TA06
Summary: - Details
F00041 Bias detection
Tactic stage: TA07
Summary: Not technically left of boom - Details
F00042 Categorize polls by intent
Tactic stage: TA07
Summary: Use T00029, but against the creators - Details
F00043 Monitor for creation of fake known personas
Tactic stage: TA07
Summary: Platform companies and some information security companies (e.g. ZeroFox) do this. - Details
F00044 Forensic analysis
Tactic stage: TA08
Summary: Can be used in all phases for all techniques. - Details
F00045 Forensic linguistic analysis
Tactic stage: TA08
Summary: Can be used in all phases for all techniques. - Details
F00046 Pump priming analytics
Tactic stage: TA08
Summary: - Details
F00047 trace involved parties
Tactic stage: TA08
Summary: - Details
F00048 Trace known operations and connection
Tactic stage: TA08
Summary: - Details
F00049 trace money
Tactic stage: TA08
Summary: - Details
F00050 Web cache analytics
Tactic stage: TA08
Summary: - Details
F00051 Challenge expertise
Tactic stage: TA09
Summary: - Details
F00052 Discover sponsors
Tactic stage: TA09
Summary: Discovering the sponsors behind a campaign, narrative, bot, a set of accounts, or a social media comment, or anything else is useful. - Details
F00053 Government rumour control office (what can we learn?)
Tactic stage: TA09
Summary: - Details
F00054 Restrict people who can @ you on social networks
Tactic stage: TA09
Summary: - Details
F00055 Verify credentials
Tactic stage: TA09
Summary: - Details
F00056 Verify organisation legitimacy
Tactic stage: TA09
Summary: - Details
F00057 Verify personal credentials of experts
Tactic stage: TA09
Summary: - Details
F00058 Deplatform (cancel culture)
Tactic stage: TA10
Summary: *Deplatform People: This technique needs to be a bit more specific to distinguish it from "account removal" or DDOS and other techniques that get more specific when applied to content. For example, other ways of deplatforming people include attacking their sources of funds, their allies, their followers, etc. - Details
F00059 Identify susceptible demographics
Tactic stage: TA10
Summary: All techniques provide or are susceptible to being countered by, or leveraged for, knowledge about user demographics. - Details
F00060 Identify susceptible influencers
Tactic stage: TA10
Summary: I assume this was a transcript error. Otherwise, "Identify Susceptible Influences" as in the various methods of influences that may work against a victim could also be a technique. Nope, wasn't a transcript error: original note says influencers, as in find people of influence that might be targetted. - Details
F00061 Microtargeting
Tactic stage: TA10
Summary: - Details
F00062 Detect when Dormant account turns active
Tactic stage: TA11
Summary: - Details
F00063 Linguistic change analysis
Tactic stage: TA11
Summary: - Details
F00064 Monitor reports of account takeover
Tactic stage: TA11
Summary: - Details
F00065 Sentiment change analysis
Tactic stage: TA11
Summary: - Details
F00066 Use language errors, time to respond to account bans and lawsuits, to indicate capabilities
Tactic stage: TA11
Summary: - Details
F00067 Data forensics
Tactic stage:
Summary: - Details
F00068 Resonance analysis
Tactic stage:
Summary: a developing methodology for identifying statistical differences in how social groups use language and quantifying how common those statistical differences are within a larger population. In essence, it hypothesizes how much affinity might exist for a specific group within a general population, based on the language its members employ - Details
F00069 Track Russian media and develop analytic methods.
Tactic stage:
Summary: To effectively counter Russian propaganda, it will be critical to track Russian influence efforts. The information requirements are varied and include the following: • Identify fake-news stories and their sources. • Understand narrative themes and content that pervade various Russian media sources. • Understand the broader Russian strategy that underlies tactical propaganda messaging. - Details
F00070 Full spectrum analytics
Tactic stage: ALL
Summary: - Details
F00071 Network analysis Identify/cultivate/support influencers
Tactic stage:
Summary: Local influencers detected via Twitter networks are likely local influencers in other online and off-line channels as well. In addition, the content and themes gleaned from Russia and Russia-supporting populations, as well as anti-Russia activists, likely swirl in other online and off-line mediums as well. - Details
F00072 network analysis to identify central users in the pro-Russia activist community.
Tactic stage:
Summary: It is possible that some of these are bots or trolls and could be flagged for suspension for violating Twitter’s terms of service. - Details
F00073 collect intel/recon on black/covert content creators/manipulators
Tactic stage:
Summary: Players at the level of covert attribution, referred to as “black” in the grayscale of deniability, produce content on user-generated media, such as YouTube, but also add fear-mongering commentary to and amplify content produced by others and supply exploitable content to data dump websites. These activities are conducted by a network of trolls, bots, honeypots, and hackers. - Details
F00074 identify relevant fence-sitter communities
Tactic stage:
Summary: brand ambassador programs could be used with influencers across a variety of social media channels. It could also target other prominent experts, such as academics, business leaders, and other potentially prominent people. Authorities must ultimately take care in implementing such a program given the risk that contact with U.S. or NATO authorities might damage influencer reputations. Engagements must consequently be made with care, and, if possible, government interlocutors should work through local NGOs. - Details
F00075 leverage open-source information
Tactic stage:
Summary: significant amounts of quality open-source information are now available and should be leveraged to build products and analysis prior to problem prioritization in the areas of observation, attribution, and intent. Successfully distinguishing the gray zone campaign signal through the global noise requires action through the entirety of the national security community. Policy, process, and tools must all adapt and evolve to detect, discern, and act upon a new type of signal - Details
F00076 Monitor/collect audience engagement data connected to “useful idiots”
Tactic stage:
Summary: Target audience connected to "useful idiots rather than the specific profiles because - The active presence of such sources complicates targeting of Russian propaganda, given that it is often difficult to discriminate between authentic views and opinions on the internet and those disseminated by the Russian state. - Details
F00077 Model for bot account behavior
Tactic stage: TA15
Summary: Bot account: action based, people. Unsure which DISARM techniques. - Details
F00078 Monitor account level activity in social networks
Tactic stage: TA15
Summary: All techniques benefit from careful analysis and monitoring of activities on social network. - Details
F00079 Network anomaly detection
Tactic stage: TA05
Summary: - Details
F00080 Hack the polls/ content yourself
Tactic stage: TA07
Summary: Two wrongs don't make a right? But if you hack your own polls, you do learn how it could be done, and learn what to look for - Details
F00081 Need way for end user to report operations
Tactic stage: TA09
Summary: - Details
F00082 Control the US "slang" translation boards
Tactic stage: TA11
Summary: - Details
F00083 Build and own meme generator, then track and watermark contents
Tactic stage: TA11
Summary: - Details
F00084 Track individual bad actors
Tactic stage: TA15
Summary: - Details
F00085 detection of a weak signal through global noise
Tactic stage:
Summary: Gray zone threats are challenging given that warning requires detection of a weak signal through global noise and across threat vectors and regional boundaries.Three interconnected gray zone elements characterize the nature of the activity: Temporality: The nature of gray zone threats truly requires a “big picture view” over long timescales and across regions and functional topics. Attribution: requiring an “almost certain” or “nearly certain analytic assessment before acting costs time and analytic effort Intent: judgement of adversarial intent to conduct gray zone activity. Indeed, the purpose of countering gray zone threats is to deter adversaries from fulfilling their intent to act. While attribution is one piece of the puzzle, closing the space around intent often means synthesizing multiple relevant indicators and warnings, including the state’s geopolitical ambitions, military ties, trade and investment, level of corruption, and media landscape, among others. - Details
F00086 Outpace Competitor Intelligence Capabilities
Tactic stage: TA02
Summary: Develop an intelligence-based understanding of foreign actors’ motivations, psychologies, and societal and geopolitical contexts. Leverage artificial intelligence to identify patterns and infer competitors’ intent - Details
F00087 Improve Indications and Warning
Tactic stage:
Summary: United States has not adequately adapted its information indicators and thresholds for warning policymakers to account for gray zone tactics. Competitors have undertaken a marked shift to slow-burn, deceptive, non-military, and indirect challenges to U.S. interests. Relative to traditional security indicators and warnings, these are more numerous and harder to detect and make it difficult for analysts to infer intent. - Details
F00088 Revitalize an “active measures working group,”
Tactic stage:
Summary: Recognize campaigns from weak signals, including rivals’ intent, capability, impact, interactive effects, and impact on U.S. interests... focus on adversarial covert action aspects of campaigning. - Details
F00089 target/name/flag "grey zone" website content
Tactic stage: TA15
Summary: "Gray zone" is second level of content producers and circulators, composed of outlets with uncertain attribution. This category covers conspiracy websites, far-right or far-left websites, news aggregators, and data dump websites - Details
F00090 Match Punitive Tools with Third-Party Inducements
Tactic stage: TA01
Summary: Bring private sector and civil society into accord on U.S. interests - Details
F00091 Partner to develop analytic methods & tools
Tactic stage: TA01
Summary: This might include working with relevant technology firms to ensure that contracted analytic support is available. Contracted support is reportedly valuable because technology to monitor social media data is continually evolving, and such firms can provide the expertise to help identify and analyze trends, and they can more effectively stay abreast of the changing systems and develop new models as they are required - Details
F00092 daylight
Tactic stage: TA09
Summary: Warn social media companies about an ongoing campaign (e.g. antivax sites). Anyone with datasets or data summaries can help with this - Details
F00093 S4d detection and re-allocation approaches
Tactic stage: TA15
Summary: S4D is a way to separate out different speakers in text, audio. - Details
F00094 Registries alert when large batches of newsy URLs get registered together
Tactic stage: TA07
Summary: - Details
F00095 Fact checking
Tactic stage: TA09
Summary: Process suspicious artifacts, narratives, and incidents - Details