TA05 "Microtarget"
Belongs to phase P02 Prepare
Summary: Target very specific populations of people
| TA05 Tasks | ||
| disarm_id | name | summary |
| TK0035 | OPSEC for TA05 | OPSEC for TA05 |
| TA05 Techniques | ||
| disarm_id | name | summary |
| T0016 | Create Clickbait | Create attention grabbing headlines (outrage, doubt, humor) required to drive traffic & engagement. This is a key asset. |
| T0018 | Purchase Targeted Advertisements | Create or fund advertisements targeted at specific populations |
| T0101 | Create Localized Content | Localized content refers to content that appeals to a specific community of individuals, often in defined geographic areas. An operation may create localized content using local language and dialects to resonate with its target audience and blend in with other local news and social media. Localized content may help an operation increase legitimacy, avoid detection, and complicate external attribution. |
| T0102 | Leverage Echo Chambers/Filter Bubbles | An echo chamber refers to an internet subgroup, often along ideological lines, where individuals only engage with “others with which they are already in agreement.” A filter bubble refers to an algorithm's placement of an individual in content that they agree with or regularly engage with, possibly entrapping the user into a bubble of their own making. An operation may create these isolated areas of the internet by match existing groups, or aggregating individuals into a single target audience based on shared interests, politics, values, demographics, and other characteristics. Echo chambers and filter bubbles help to reinforce similar biases and content to the same target audience members. |
| T0102.001 | Use existing Echo Chambers/Filter Bubbles | Use existing Echo Chambers/Filter Bubbles |
| T0102.002 | Create Echo Chambers/Filter Bubbles | Create Echo Chambers/Filter Bubbles |
| T0102.003 | Exploit Data Voids | A data void refers to a word or phrase that results in little, manipulative, or low-quality search engine data. Data voids are hard to detect and relatively harmless until exploited by an entity aiming to quickly proliferate false or misleading information during a phenomenon that causes a high number of individuals to query the term or phrase. In the Plan phase, an influence operation may identify data voids for later exploitation in the operation. A 2019 report by Michael Golebiewski identifies five types of data voids. (1) “Breaking news” data voids occur when a keyword gains popularity during a short period of time, allowing an influence operation to publish false content before legitimate news outlets have an opportunity to publish relevant information. (2) An influence operation may create a “strategic new terms” data void by creating their own terms and publishing information online before promoting their keyword to the target audience. (3) An influence operation may publish content on “outdated terms” that have decreased in popularity, capitalizing on most search engines’ preferences for recency. (4) “Fragmented concepts” data voids separate connections between similar ideas, isolating segment queries to distinct search engine results. (5) An influence operation may use “problematic queries” that previously resulted in disturbing or inappropriate content to promote messaging until mainstream media recontextualizes the term. |
| TA05 Counters | ||
| disarm_id | name | summary |
| C00065 | Reduce political targeting | Includes “ban political micro targeting” and “ban political ads” |
| C00066 | Co-opt a hashtag and drown it out (hijack it back) | Flood a disinformation-related hashtag with other content. |
| C00130 | Mentorship: elders, youth, credit. Learn vicariously. | Train local influencers in countering misinformation. |
| C00178 | Fill information voids with non-disinformation content | 1) Pollute the data voids with wholesome content (Kittens! Babyshark!). 2) fill data voids with relevant information, e.g. increase Russian-language programming in areas subject to Russian disinformation. |
| C00216 | Use advertiser controls to stem flow of funds to bad actors | Prevent ad revenue going to disinformation domains |
| TA05 Detections | ||
| disarm_id | name | summary |
| F00025 | Boots-on-the-ground early narrative detection | |
| F00026 | Language anomoly detection | |
| F00027 | Unlikely correlation of sentiment on same topics | |
| F00079 | Network anomaly detection | |