DISARM Disinformation TTP Framework

1 card

1. 01

   An influence operation is analysed like an intrusion: not "is it false or true", but which tactic it pursues, with which techniques, through which accounts and channels — DISARM borrows ATT&CK's form so defenders name the same behaviour by the same name and can share it.

   DISARM Disinformation TTP Framework · 2024

   Analyse the behaviour (tactic, technique, account, channel), not the truth of the message; name it with an identifier.

   The framework began in 2019 (under the name AMITT) from the observation that defenders against disinformation had no shared vocabulary, while information security had had one for years. DISARM is explicitly "part of work on adapting information security practices to help track and counter disinformation" and is built "in the style of the MITRE ATT&CK framework": a "red" framework (the disinformation creator's tactics and techniques, by phase — planning, preparation, execution, assessment) and a "blue" one (countermeasures, listed by the earliest phase where they help). There are STIX templates too, so incidents travel between organisations on the same channels as threat indicators. What that changes in analysis: the question is no longer whether a message is false, but which behaviour carries it. "Creating inauthentic accounts", "coordinated amplification", "hijacking a hashtag", "laundering a narrative through a seemingly independent site" are techniques with identifiers; a campaign is a chain of such techniques, and the olivLaw detector (the lesson on narrative coordination) measures exactly one of them — coordination — and separates it from syndication. François's assessment grid (actors, behaviour, content) points the same way: behaviour is easier to prove than intent, and content alone is the weakest signal. The framework also carries a warning rare in technical documents: the set of "blue" countermeasures was derived in 2019 by volunteers and includes tactics seen in countries with different values (censorship, for instance), and the foundation urges caution and publishes a companion guide. For an analyst that is a lesson in method: a catalogue describes what is done, not what is legitimate to do.

   “DISARM is a framework designed for describing and understanding disinformation incidents.”

   Open the card →