TA05 "Microtarget"

Belongs to phase P02 Prepare

Summary: Target very specific populations of people

TA05 Tasks
TK0035 OPSEC for TA05 OPSEC for TA05

TA05 Techniques
T0016 Create Clickbait Create attention grabbing headlines (outrage, doubt, humor) required to drive traffic & engagement. This is a key asset.
T0018 Purchase Targeted Advertisements Create or fund advertisements targeted at specific populations
T0101 Create Localized Content Localized content refers to content that appeals to a specific community of individuals, often in defined geographic areas. An operation may create localized content using local language and dialects to resonate with its target audience and blend in with other local news and social media. Localized content may help an operation increase legitimacy, avoid detection, and complicate external attribution.
T0102 Leverage Echo Chambers/Filter Bubbles An echo chamber refers to an internet subgroup, often along ideological lines, where individuals only engage with “others with which they are already in agreement.” A filter bubble refers to an algorithm's placement of an individual in content that they agree with or regularly engage with, possibly entrapping the user into a bubble of their own making. An operation may create these isolated areas of the internet by match existing groups, or aggregating individuals into a single target audience based on shared interests, politics, values, demographics, and other characteristics. Echo chambers and filter bubbles help to reinforce similar biases and content to the same target audience members.
T0102.001 Use existing Echo Chambers/Filter Bubbles Use existing Echo Chambers/Filter Bubbles
T0102.002 Create Echo Chambers/Filter Bubbles Create Echo Chambers/Filter Bubbles
T0102.003 Exploit Data Voids A data void refers to a word or phrase that results in little, manipulative, or low-quality search engine data. Data voids are hard to detect and relatively harmless until exploited by an entity aiming to quickly proliferate false or misleading information during a phenomenon that causes a high number of individuals to query the term or phrase. In the Plan phase, an influence operation may identify data voids for later exploitation in the operation. A 2019 report by Michael Golebiewski identifies five types of data voids. (1) “Breaking news” data voids occur when a keyword gains popularity during a short period of time, allowing an influence operation to publish false content before legitimate news outlets have an opportunity to publish relevant information. (2) An influence operation may create a “strategic new terms” data void by creating their own terms and publishing information online before promoting their keyword to the target audience. (3) An influence operation may publish content on “outdated terms” that have decreased in popularity, capitalizing on most search engines’ preferences for recency. (4) “Fragmented concepts” data voids separate connections between similar ideas, isolating segment queries to distinct search engine results. (5) An influence operation may use “problematic queries” that previously resulted in disturbing or inappropriate content to promote messaging until mainstream media recontextualizes the term.

TA05 Counters
C00065 Reduce political targeting Includes “ban political micro targeting” and “ban political ads”
C00066 Co-opt a hashtag and drown it out (hijack it back) Flood a disinformation-related hashtag with other content.
C00130 Mentorship: elders, youth, credit. Learn vicariously. Train local influencers in countering misinformation.
C00178 Fill information voids with non-disinformation content 1) Pollute the data voids with wholesome content (Kittens! Babyshark!). 2) fill data voids with relevant information, e.g. increase Russian-language programming in areas subject to Russian disinformation.
C00216 Use advertiser controls to stem flow of funds to bad actors Prevent ad revenue going to disinformation domains

TA05 Detections
F00025 Boots-on-the-ground early narrative detection
F00026 Language anomoly detection
F00027 Unlikely correlation of sentiment on same topics
F00079 Network anomaly detection