TA10 "Drive Offline Activity"

Belongs to phase P03 Execute

Summary: Move incident/campaign from online to offline. Encouraging users to move from the platform on which they initially viewed operation content and engage in the physical information space or offline world. This may include operation-aligned rallies or protests, radio, newspaper, or billboards. An influence operation may drive to physical forums to diversify its information channels and facilitate spaces where the target audience can engage with both operation content and like-minded individuals offline.

TA10 Tasks
disarm_id	name	summary
TK0040	OPSEC for TA10	OPSEC for TA10

TA10 Techniques
disarm_id	name	summary
T0017	Conduct fundraising	Fundraising campaigns refer to an influence operation’s systematic effort to seek financial support for a charity, cause, or other enterprise using online activities that further promote operation information pathways while raising a profit. Many influence operations have engaged in crowdfunding services166 on platforms including Tipee, Patreon, and GoFundMe. An operation may use its previously prepared fundraising campaigns to promote operation messaging while raising money to support its activities.
T0017.001	Conduct Crowdfunding Campaigns	An influence operation may Conduct Crowdfunding Campaigns on platforms such as GoFundMe, GiveSendGo, Tipeee, Patreon, etc.
T0057	Organize Events	Coordinate and promote real-world events across media platforms, e.g. rallies, protests, gatherings in support of incident narratives.
T0057.001	Pay for Physical Action	Paying for physical action occurs when an influence operation pays individuals to act in the physical realm. An influence operation may pay for physical action to create specific situations and frame them in a way that supports operation narratives, for example, paying a group of people to burn a car to later post an image of the burning car and frame it as an act of protest.
T0057.002	Conduct Symbolic Action	Symbolic action refers to activities specifically intended to advance an operation’s narrative by signaling something to the audience, for example, a military parade supporting a state’s narrative of military superiority. An influence operation may use symbolic action to create falsified evidence supporting operation narratives in the physical information space.
T0061	Sell Merchandise	Sell mechandise refers to getting the message or narrative into physical space in the offline world while making money
T0126	Encourage Attendance at Events	Operation encourages attendance at existing real world event.
T0126.001	Call to action to attend	Call to action to attend an event
T0126.002	Facilitate logistics or support for attendance	Facilitate logistics or support for travel, food, housing, etc.
T0127	Physical Violence	Physical violence refers to the use of force to injure, abuse, damage, or destroy. An influence operation may conduct or encourage physical violence to discourage opponents from promoting conflicting content or draw attention to operation narratives using shock value.
T0127.001	Conduct Physical Violence	An influence operation may directly Conduct Physical Violence to achieve campaign goals.
T0127.002	Encourage Physical Violence	An influence operation may Encourage others to engage in Physical Violence to achieve campaign goals.

TA10 Counters
disarm_id	name	summary

TA10 Detections
disarm_id	name	summary
F00058	Deplatform (cancel culture)	*Deplatform People: This technique needs to be a bit more specific to distinguish it from "account removal" or DDOS and other techniques that get more specific when applied to content. For example, other ways of deplatforming people include attacking their sources of funds, their allies, their followers, etc.
F00059	Identify susceptible demographics	All techniques provide or are susceptible to being countered by, or leveraged for, knowledge about user demographics.
F00060	Identify susceptible influencers	I assume this was a transcript error. Otherwise, "Identify Susceptible Influences" as in the various methods of influences that may work against a victim could also be a technique. Nope, wasn't a transcript error: original note says influencers, as in find people of influence that might be targetted.
F00061	Microtargeting