Disinformation at scale:detection & counter-operations.
A practitioner's framework for the synthetic-content era, when the adversary's production capacity exceeds the production capacity of major newsrooms and the window between narrative emergence and peak amplification has compressed from weeks to hours.
“Disinformation is no longer a messaging problem. It is a production system, an algorithmic surface, and a sovereign risk vector. The defense has to be engineered at the same scale as the offense — or the offense wins by default.”
25
Disinformation Techniques
13
CIB Detection Signals
29
Counter-Measure Techniques
6
Escalation Tiers
The threat has undergone a phase transition.
The threat model that defined the 2010s is no longer the dominant threat. The dominant threat is a high-velocity, low-marginal-cost, AI-augmented, multi-platform, persona-saturated, factory-model production environment.
1.5
The operating reality in numbers.
1.3
Six axes on which adversary tradecraft has evolved.
01 / 06
From message to system.
Disinformation is no longer a craft of crafting effective messages. It is a craft of building effective systems: persona networks, distribution channels, algorithmic positioning.
02 / 06
From static to adaptive.
Operations now include real-time performance feedback, A/B testing of narratives, rapid pivoting in response to defender response. The offense has acquired a learning loop.
03 / 06
From single-platform to cross-platform.
Operations seed narratives in one platform, amplify in a second, ground in a third, provide 'evidence' in a fourth. The narrative is distributed; takedown is per-platform.
04 / 06
From human to hybrid.
Operations use human operators for high-judgment steps (persona development, narrative crafting, target selection) and AI for high-volume steps. The ratio is moving toward AI-dominant.
05 / 06
From content to infrastructure.
Operations include infrastructure: front organizations, fake events, manufactured academic citations, 'evidence' sites. The infrastructure creates the appearance of organic support.
06 / 06
From target to target-of-targets.
Operations are no longer aimed at the end audience. They are aimed at algorithmic surfaces that shape what the end audience sees — recommendation systems, search, and LLM-mediated answers.
1.4
Three failed pillars, and the architectural response.
Reactive fact-checking.
FailedFact-checker requires hours; offense produces a thousand variants. Fact-checking remains necessary; no longer sufficient.
Platform takedown.
FailedTakedown lag, platform proliferation, mirror content across domains. Takedown is one tool in the kit; not a strategy.
Official spokesperson rebuttal.
FailedAudience fragmentation, distrust of institutions, 'debate' around rebuttals. Official rebuttal is necessary; not decisive.
Architectural defense at the layer of the offense.
RequiredDetection at the coordination graph, response at the persona network, measurement at the network effect. Engineering discipline, not communications.
“A defense built on these three pillars is fighting the last war.”
Five-phase response. Six-level ladder.
The framework treats disinformation defense as an engineering discipline, not a communications discipline. The unit of analysis is the system, not the message.
2.2
The five-phase response cycle — continuous, not sequential.
Detect & Identify
Surface candidate events via automated signals (anomaly detection, network analysis, content similarity) and human leads (HUMINT, partner intel, public reporting).
Verify
Confirm with source-reliability / information-credibility (Admiralty), multi-INT corroboration, ACH structured-analytic techniques.
Analyze
Network analysis, narrative analysis, target analysis, intent inference, structured techniques. Output: threat assessment.
Respond
Tiered response matched to scale, intent, threat to interests. From 6-level escalation ladder and 29-technique counter-measure catalog.
Evaluate
Perception delta, narrative share, recovery half-life. Output: post-action report updating threat-actor dossier, detection heuristics, response playbook.
2.4
The six-level response escalation ladder.
Level 1 is a default. Levels 2–6 are escalations that require authorization. Thresholds are documented, authorization is logged, rationale is auditable.
L1
Monitor
Low-confidence signal, low-impact target. Observe, log, no public action.
L2
Engage
Verified signal, low-impact, low-amplification. Direct response in low-cost channels.
L3
Counter
Verified, amplification rising. Counter-narrative, partner amplification, prebunking. Sub-hour.
L4
Escalate
Verified, multi-platform, target-of-targets. Coordinated multi-channel counter, third-party fact-checker mobilization.
L5
Sustain
Sustained operation, days-to-weeks. Persistent counter-program, audience inoculation, perception shaping.
L6
Strategic
Strategic threat, existential stakes, foreign-state attribution. Cross-government coordinated response.
2.5
Bot and CIB detection — 13 signals.
Cheap signals (metadata, timing) should be exhausted before expensive signals (content analysis, human review). A network scoring high on 4+ signals with a weighted ensemble is high-confidence CIB. 8+ is operationally certain.
Account age
Recently-created accounts (likely sockpuppets)
Posting cadence
Mechanical, non-human posting rhythms
Content similarity
Near-duplicate posts across personas (templated)
Profile similarity
Shared images, bios, structures
Network topology
Tightly clustered, low-clustering-coefficient networks
Engagement pattern
Coordinated likes, replies, retweets within seconds
Linguistic fingerprint
Stylometric similarity across personas (same author)
Behavioral fingerprint
Same operating hours, same application, same pattern
Temporal synchronization
Coordinated posting across personas in narrow windows
Cross-platform coordination
Same narrative launched in multiple platforms with mirrored timing
Hashtag hijacking
Coordinated use of trending hashtags for off-topic payload
Reply-targeting
Coordinated reply patterns to specific accounts or threads
Infrastructure
Same IP range, same registration data, same hosting provider, ASN
3.3
Three representative cases — anonymized, generic in geography.
Case 01
CIB network, 6 weeks pre-peak.
14-account cluster identified 6 weeks before peak. Engagement-pattern signal expanded via cross-platform coordination. Shared 11 of 13 signals. Tier 3 counter: multi-channel prebunking across 9 languages. Peak reach capped at 12% of projected. Perception delta: +4 points in target audience.
Case 02
Synthetic-voice impersonation, 11 hours containment.
Head-of-state audio on 2 messaging + 3 fringe sites. Vocal biometric anomaly on first platform; propagated to 2 more. Cross-INT corroboration: relevant currency moved 1.4% in 11 min. Tier 4 escalation. Containment within 11 hours. Perception delta within noise floor.
Case 03
Election-integrity operation, 11 languages.
Multi-vector operation identified across 11 languages, 47+ platforms. Used 9 of 25 disinformation techniques. Coordination graph: 4,200+ accounts. Tier 5 sustain for 8 weeks. At election day, narrative share in target audiences below 4%.
3.4
Five lessons learned.
01 / 05
The cost asymmetry is the design constraint.
Offense has fallen to near-zero marginal cost. The defense must minimize cost of detection (cheap signals first), minimize cost of false-positive response (tiered escalation with explicit thresholds), and maximize leverage of the defender's most expensive assets.
02 / 05
The defender's most underused asset is the audience.
Audience inoculation is the most efficient counter-measure. An audience pre-exposed to a weakened form of a manipulation technique develops psychological resistance that outlasts the specific operation. Inoculation is cheap per person, scales linearly, and is not operation-specific.
03 / 05
Attribution matters more than the public discourse suggests.
Public attribution is high-stakes, slow, diplomatically costly. Internal attribution is high-value, low-cost, fast. Most operations are not publicly attributable; almost all are internally attributable with sufficient collection.
04 / 05
The framework is more durable than the techniques.
The 25-technique taxonomy, the 13-signal model, the 29-technique counter-measure catalog are living documents. The framework — five-phase cycle, six-level ladder, tiered escalation, continuous feedback — is durable.
05 / 05
The limits of the framework are real.
Detection is not perfect. Some operations succeed despite the framework. The cost of false positives is real and must be paid. Counter-narrative operations can be counterproductive if poorly timed. The framework is a tool, not a guarantee.
Build the defense at the same layer as the offense.
A confidential briefing walks through the 5-phase response, 6-level ladder, 25-technique taxonomy, and 13-signal CIB detection model against your specific threat landscape.
- 60 minutes · response within 1 day
- Under your security protocols