TA08 "Conduct Pump Priming"

Belongs to phase P03 Execute

Summary: Release content on a targetted small scale, prior to general release, including releasing seed. Used for preparation before broader release, and as message honing. Used for preparation before broader release, and as message honing.

TA08 Tasks
TK0019 anchor trust / credibility anchor trust / credibility
TK0020 insert themes insert themes
TK0038 OPSEC for TA08 OPSEC for TA08

TA08 Techniques
T0020 Trial content Iteratively test incident performance (messages, content etc), e.g. A/B test headline/content enagagement metrics; website and/or funding campaign conversion rates
T0039 Bait legitimate influencers Credibility in a social media environment is often a function of the size of a user's network. "Influencers" are so-called because of their reach, typically understood as: 1) the size of their network (i.e. the number of followers, perhaps weighted by their own influence); and 2) The rate at which their comments are re-circulated (these two metrics are related). Add traditional media players at all levels of credibility and professionalism to this, and the number of potential influencial carriers available for unwitting amplification becomes substantial. By targeting high-influence people and organizations in all types of media with narratives and content engineered to appeal their emotional or ideological drivers, influence campaigns are able to add perceived credibility to their messaging via saturation and adoption by trusted agents such as celebrities, journalists and local leaders.
T0042 Seed Kernel of truth Wrap lies or altered context/facts around truths. Influence campaigns pursue a variety of objectives with respect to target audiences, prominent among them: 1. undermine a narrative commonly referenced in the target audience; or 2. promote a narrative less common in the target audience, but preferred by the attacker. In both cases, the attacker is presented with a heavy lift. They must change the relative importance of various narratives in the interpretation of events, despite contrary tendencies. When messaging makes use of factual reporting to promote these adjustments in the narrative space, they are less likely to be dismissed out of hand; when messaging can juxtapose a (factual) truth about current affairs with the (abstract) truth explicated in these narratives, propagandists can undermine or promote them selectively. Context matters.
T0044 Seed distortions Try a wide variety of messages in the early hours surrounding an incident or event, to give a misleading account or impression.
T0045 Use fake experts Use the fake experts that were set up during Establish Legitimacy. Pseudo-experts are disposable assets that often appear once and then disappear. Give "credility" to misinformation. Take advantage of credential bias
T0046 Use Search Engine Optimization Manipulate content engagement metrics (ie: Reddit & Twitter) to influence/impact news search results (e.g. Google), also elevates RT & Sputnik headline into Google news alert emails. aka "Black-hat SEO"
T0113 Employ Commercial Analytic Firms Commercial analytic firms collect data on target audience activities and evaluate the data to detect trends, such as content receiving high click-rates. An influence operation may employ commercial analytic firms to facilitate external collection on its target audience, complicating attribution efforts and better tailoring the content to audience preferences.

TA08 Counters
C00100 Hashtag jacking Post large volumes of unrelated content on known misinformation hashtags
C00112 "Prove they are not an op!" Challenge misinformation creators to prove they're not an information operation.
C00113 Debunk and defuse a fake expert / credentials. Debunk fake experts, their credentials, and potentially also their audience quality
C00114 Don't engage with payloads Stop passing on misinformation
C00115 Expose actor and intentions Debunk misinformation creators and posters.
C00116 Provide proof of involvement Build and post information about groups etc's involvement in misinformation incidents.
C00117 Downgrade / de-amplify so message is seen by fewer people Label promote counter to disinformation
C00118 Repurpose images with new text Add countermessage text to iamges used in misinformation incidents.
C00119 Engage payload and debunk. debunk misinformation content. Provide link to facts.
C00120 Open dialogue about design of platforms to produce different outcomes Redesign platforms and algorithms to reduce the effectiveness of disinformation
C00121 Tool transparency and literacy for channels people follow. Make algorithms in platforms explainable, and visible to people using those platforms.
C00136 Microtarget most likely targets then send them countermessages Find communities likely to be targetted by misinformation campaigns, and send them countermessages or pointers to information sources.
C00154 Ask media not to report false information Train media to spot and respond to misinformation, and ask them not to post or transmit misinformation they've found.
C00184 Media exposure highlight misinformation activities and actors in media
C00188 Newsroom/Journalist training to counter influence moves Includes SEO influence. Includes promotion of a “higher standard of journalism”: journalism training “would be helpful, especially for the online community. Includes Strengthen local media: Improve effectiveness of local media outlets.

TA08 Detections
F00044 Forensic analysis Can be used in all phases for all techniques.
F00045 Forensic linguistic analysis Can be used in all phases for all techniques.
F00046 Pump priming analytics
F00047 trace involved parties
F00048 Trace known operations and connection
F00049 trace money
F00050 Web cache analytics