TA08 "Conduct Pump Priming"
Belongs to phase P03 Execute
Summary: Release content on a targetted small scale, prior to general release, including releasing seed. Used for preparation before broader release, and as message honing. Used for preparation before broader release, and as message honing.
| TA08 Tasks | ||
| disarm_id | name | summary |
| TK0019 | anchor trust / credibility | anchor trust / credibility |
| TK0020 | insert themes | insert themes |
| TK0038 | OPSEC for TA08 | OPSEC for TA08 |
| TA08 Techniques | ||
| disarm_id | name | summary |
| T0020 | Trial content | Iteratively test incident performance (messages, content etc), e.g. A/B test headline/content enagagement metrics; website and/or funding campaign conversion rates |
| T0039 | Bait legitimate influencers | Credibility in a social media environment is often a function of the size of a user's network. "Influencers" are so-called because of their reach, typically understood as: 1) the size of their network (i.e. the number of followers, perhaps weighted by their own influence); and 2) The rate at which their comments are re-circulated (these two metrics are related). Add traditional media players at all levels of credibility and professionalism to this, and the number of potential influencial carriers available for unwitting amplification becomes substantial. By targeting high-influence people and organizations in all types of media with narratives and content engineered to appeal their emotional or ideological drivers, influence campaigns are able to add perceived credibility to their messaging via saturation and adoption by trusted agents such as celebrities, journalists and local leaders. |
| T0042 | Seed Kernel of truth | Wrap lies or altered context/facts around truths. Influence campaigns pursue a variety of objectives with respect to target audiences, prominent among them: 1. undermine a narrative commonly referenced in the target audience; or 2. promote a narrative less common in the target audience, but preferred by the attacker. In both cases, the attacker is presented with a heavy lift. They must change the relative importance of various narratives in the interpretation of events, despite contrary tendencies. When messaging makes use of factual reporting to promote these adjustments in the narrative space, they are less likely to be dismissed out of hand; when messaging can juxtapose a (factual) truth about current affairs with the (abstract) truth explicated in these narratives, propagandists can undermine or promote them selectively. Context matters. |
| T0044 | Seed distortions | Try a wide variety of messages in the early hours surrounding an incident or event, to give a misleading account or impression. |
| T0045 | Use fake experts | Use the fake experts that were set up during Establish Legitimacy. Pseudo-experts are disposable assets that often appear once and then disappear. Give "credility" to misinformation. Take advantage of credential bias |
| T0046 | Use Search Engine Optimization | Manipulate content engagement metrics (ie: Reddit & Twitter) to influence/impact news search results (e.g. Google), also elevates RT & Sputnik headline into Google news alert emails. aka "Black-hat SEO" |
| T0113 | Employ Commercial Analytic Firms | Commercial analytic firms collect data on target audience activities and evaluate the data to detect trends, such as content receiving high click-rates. An influence operation may employ commercial analytic firms to facilitate external collection on its target audience, complicating attribution efforts and better tailoring the content to audience preferences. |
| TA08 Counters | ||
| disarm_id | name | summary |
| C00100 | Hashtag jacking | Post large volumes of unrelated content on known misinformation hashtags |
| C00112 | "Prove they are not an op!" | Challenge misinformation creators to prove they're not an information operation. |
| C00113 | Debunk and defuse a fake expert / credentials. | Debunk fake experts, their credentials, and potentially also their audience quality |
| C00114 | Don't engage with payloads | Stop passing on misinformation |
| C00115 | Expose actor and intentions | Debunk misinformation creators and posters. |
| C00116 | Provide proof of involvement | Build and post information about groups etc's involvement in misinformation incidents. |
| C00117 | Downgrade / de-amplify so message is seen by fewer people | Label promote counter to disinformation |
| C00118 | Repurpose images with new text | Add countermessage text to iamges used in misinformation incidents. |
| C00119 | Engage payload and debunk. | debunk misinformation content. Provide link to facts. |
| C00120 | Open dialogue about design of platforms to produce different outcomes | Redesign platforms and algorithms to reduce the effectiveness of disinformation |
| C00121 | Tool transparency and literacy for channels people follow. | Make algorithms in platforms explainable, and visible to people using those platforms. |
| C00136 | Microtarget most likely targets then send them countermessages | Find communities likely to be targetted by misinformation campaigns, and send them countermessages or pointers to information sources. |
| C00154 | Ask media not to report false information | Train media to spot and respond to misinformation, and ask them not to post or transmit misinformation they've found. |
| C00184 | Media exposure | highlight misinformation activities and actors in media |
| C00188 | Newsroom/Journalist training to counter influence moves | Includes SEO influence. Includes promotion of a “higher standard of journalism”: journalism training “would be helpful, especially for the online community. Includes Strengthen local media: Improve effectiveness of local media outlets. |
| TA08 Detections | ||
| disarm_id | name | summary |
| F00044 | Forensic analysis | Can be used in all phases for all techniques. |
| F00045 | Forensic linguistic analysis | Can be used in all phases for all techniques. |
| F00046 | Pump priming analytics | |
| F00047 | trace involved parties | |
| F00048 | Trace known operations and connection | |
| F00049 | trace money | |
| F00050 | Web cache analytics | |