[Music]
hello everyone
thank you to be here today
and
i want to remember you that the current
session will be tlp wide
and to present the session named uh
diamond is analysis best brand
introducing the diamond model for
influence operation analysis
let me to introduce charity write from
record the future thank you
thank you so much
can you hear me okay
all right
i want to start with a quote that i
really like from dr ajit ma'an
she wrote a book on narrative warfare
and she says battles are one with
kinetics but wars are one with influence
and today we're going to talk about very
complex issue of disinformation
but i want to simplify the way we
analyze it
so first of all my name is charity
wright
i'm a threat intelligence analyst at
recorded future
in the past i worked at u.s army and
national security agency
i'm from dallas texas by the way so
sorry if i don't have enough of a texas
accent for you all but i'll throw in a
y'all once in a while
i currently analyze influence operations
geopolitical intelligence and strategic
intelligence for recorded future
so let's jump in
like i said disinformation is very
complex but in my opinion analyzing it
should not be
so today i'm going to tell you about the
diamond model for influence operations
and why we use this particular framework
and how to use it every day while you
are also analyzing complex psychosocial
threats
so brief
oh
slides yeah sides are important right
there we go
that's me
there's me on twitter if you want to
connect with me there i do a lot of
amplifying of the work that we're doing
and also just keeping everybody up to
date on
disinformation intelligence
so this is the agenda for today i'm
going to try to go through it rather
quickly we have a limited amount of time
and first i want to start off by
clarifying some terminology now in this
industry as we explore
disinformation campaigns sometimes that
word is used synonymously so i want to
clarify that misinformation mis
is false information
that is spread regardless of whether
there is intent to mislead
as opposed to disinformation which is
deliberately misleading or biased
information manipulated narrative or
facts and propaganda
now the the clarification there is
disinformation is usually done with a
malicious purpose
and then we all know about fake news
unfortunately throughout covet and
various political issues that we're
dealing with today uh we deal with
purposefully crafted sensational
emotionally charged misleading or
totally fabricated information that
mimics the form of mainstream news
now on that note
it can be pretty frustrating to see fake
news spread on social media and it's
even more frustrating to try to change
people's minds once they see that fake
news and the reason is
studies prove that people believe what
they see the most often
and what they see first
so in order to break that cycle and
disrupt malign influencers we must
understand how they work
so what is influence operations
this is basically an umbrella term for
many different types of information
warfare
so we're talking about disinformation
propaganda
mass manipulation etc
influence operations is an organized
attempt to achieve a specific effect
among a target audience
so keep that in mind we're talking about
influencers and audiences that will play
into our diamond model
and influence operations attempts to
affect the decision-making beliefs and
opinions of a target audience
now before we dig into the diamond model
i want to kind of go over
some of the ways that we've been doing
it in the years past and basically how i
looked through these things and
determined we need something better
malign influence operations are one of
the top threats we face today these
operations can start wars can disrupt
democracies
create and inflame extremism and destroy
companies actually so we've been working
hard on identifying collecting and
analyzing foreign and domestic influence
campaigns that pose a threat to various
organizations around the world both
private sector and public
and as we've been developing our
tradecraft around analyzing these
campaigns
we have found that the existing
frameworks are lacking in several areas
and in order to remedy this we've
developed a diamond model for influence
campaign analysis now previously as you
see on the side here only three parts of
an influence campaign were being
analyzed there was the content which is
the media that's being produced
there was also the voice which is the
accounts that are involved the tone that
they use the language and the wording
and even the narrative which is a story
and then third there's dissemination
and that's the technical ways in which
the information is spread across
platforms and media
now this is all a great starting point
as i mentioned is very complex when you
start digging in social media it's just
a mess so this was a great starting
point but we find this to be too
simplistic
and it doesn't address the relationships
between the narratives the threat actors
and the infrastructure
okay we'll start here
some existing frameworks correlate to
attack chains that we're probably
familiar with from cyber intrusions
now on the left side is a very simple
attack chain model
this one explains the process which
threat actors conduct
information warfare
the disinformation kill chain on the
right is created by mitre which many of
you are probably familiar with
and it also follows the process which
the threat actors take also starting
with a recon phase
now this is really important as we know
with kill chain models
it helps us identify certain
vulnerabilities in our own systems in
our own processes so we can disrupt the
adversary at certain phases
now while these kill chains help us
understand the threat actors process and
can help us identify
areas of vulnerabilities that need to be
remediated it lacks the nuance that we
need to address the psychosocial and
geopolitical aspects of influence and
information operations
this might look familiar if it looks
like the miter framework or miter ttps
you're you're right about that this is a
screenshot of the omit framework it's
spelled
a-m-i-t-t
emit is similar to the mitre framework
because it breaks out very specific ttps
used in i o campaigns as well as counter
measures
now these are just two samples of the
full list which can be found on their
github page actually
and it's very very helpful
for you to identify the exact tactics
techniques and procedures that the
influencer is using
now as we explored the full list i had
two thoughts one
breaking out specific tactics and
methods is helpful especially to layer
on top of kill chain or diamond model
frameworks
this model does address ttps in ways
that the other kill chain frameworks do
not
but
on the other hand
influence operators evolve very quickly
and new tactics are being developed and
used by threat actors every day
so the current emit framework doesn't
address
the use of some of the newer social
media platforms and mobile applications
that are being used by certain influence
actors as they pivot to avoid censorship
and de-platforming
however
this list can be updated accordingly and
used in conjunction with other
frameworks
so this framework although useful for
ttps doesn't really address the
operational process or the geopolitical
psychosocial aspects of these campaigns
so let's talk about that for a second
now before i show you the diamond model
i want to address a really important
element that sets influence operations
apart
narrative
the core element of every influence
operation is a story or narrative i want
to drive that home because that's very
important
narrative is vital to understanding and
identifying the influencers intentions
or objectives
humans are innately
predisposed to understand information
with assigned meaning and storytelling
really is the most effective way
uh to assign meaning to information
and the most successful influence
campaigns use narratives with components
of shared identity the us
the we aspect of the story
with identity and meaning
a story can change how people think and
behave
which is likely the end goal or
objective of an influence operation
now narrative warfare
is the
weaponization of a narrative
and the battle over that meaning
and identity of information
now this plays a central part in the
diamond model and it's part of the
reason we created the diamond models we
want to incorporate that aspect of
narrative which oftentimes gets lost
in our very very technical industry
where we're dealing with ttp's
capabilities infrastructure threat
actors this is a really important aspect
now the diamond model for influence
operations or i'm sorry the diamond
model for intrusion operations is a
framework ins uh is a framework that was
developed by three department of defense
analysts
in 2013. looks like my text got a little
messed up there
um and so we based the diamond model for
influence ops on the intrusion diamond
model
loosely because it was intended to be
very flexible and uh to be adaptable to
future threats
so of course the original diamond model
has four elements capabilities and
infrastructure on the technical axis
adversary and victim on the
socio-political axis
now taking into consideration the
differences between intrusion campaigns
and influence campaigns we made some
changes
this is the diamond model for influence
operations
the aim of this adapted diamond model
is to fuse together the essential
components of an influence campaign
with the focus on the core of the
diamond the narrative element that aims
to change the behaviors of the target
audience
now these elements tied together all of
the other elements of a campaign
and some labels were changed to more
accurately reflect the nuances of
influence campaigns
on the socio-political axis the term
adversary is replaced with influencer
and victim is replaced with audience
but the technical axis remains the same
it's unchanged with capabilities
addressing the ttps and infrastructure
addressing the various technical
and physical infrastructure used for
production and dissemination
of influence materials
the key change in this diamond model for
influence operations is the addition of
the core element of narrative which is
vital but often overlooked
socio-psychological aspect of successful
influence operations
so let's dig into this a little more
on the capability side
you could assess what kind of
capabilities this influence actor has
are they large scale or small do they
use bots do they use trolls or
automation
do they use deep fake videos and photos
forgeries
or
what is their budget that could even be
on the capability side
on the infrastructure side we're looking
at what kind of technical infrastructure
are they using
this could be similar to an intrusion
campaign you can tie infrastructure back
to ip addresses and domains
you can also look at what fringe news
websites are they setting up what social
media platforms and applications are
they using
what specific social media accounts do
they have
are they using news agencies
so there's all types of infrastructure
that influence campaigns happen on and
that's where that would go on the
diamond
i like to start at the bottom with the
audience because this is usually the
easiest to identify the audience could
be a global scale national scale it
could be local
maybe small groups maybe a political
party or constituency
it could also be consumers
let's talk about your company for a
second your company could be targeted in
a disinformation as a service campaign
it could be a competitor across the
world hiring
cyber criminals in the dark web to
conduct a disinformation campaign on
your company so it's important to
understand that your audience could also
be your consumers or your customers
and then of course at the top is the
influencer
now quite often you hear about nation
state influencers if one country
conducts a propaganda campaign against
another
it can also be criminal it could be
political
proxy companies are also used and they
would also go under the influencer side
let's say
if a nation state hires a proxy
marketing company or a pr company that
would go under the influencer part
now let's take a look
a little more in depth at the technical
axis here
let me get my
slides up here
the technical axis consists of
capabilities on the left side of the
diamond and infrastructure on the right
side
now by identifying the capabilities and
the infrastructure used by the
influencer
and potential methods of defense
decision makers are empowered to take
action against malign influence
operations
the capabilities and infrastructure
corners of the diamond can be some of
the most revealing intelligence gathered
on the influencer
so both of these elements are likely to
evolve over time especially
if target audiences
platform administrators or regulators
crack down on the activity resulting in
the influencer pivoting to new or
unregulated infrastructure and
undetected tactics
now well-resourced influencers will
usually stand out their capabilities are
are much better funded
and much more noticeable well-resourced
influencers will be persistent when they
encounter obstacles
much like intrusion campaigns too
and the smaller less resourced
influencers will be easier to identify
will make mistakes more often
and will take significantly longer to
overcome obstacles and set up new
infrastructure
so let's take a look at the
socio-political axis
influence operations are highly
psychological i bring that up because
that's an element that we don't often
confront in our industry we don't often
dig into the psychological and the
political aspects but influence
operations are highly psychological and
political
and i believe that the most important
aspect in understanding an influence
campaign is right here on the screen
the socio-political access allows you to
examine the relationship
between the influencer and the audience
there's always a relationship between
them and it's often the influencer is
trying to coerce the audience
sometimes convince them of something
maybe make the audience feel vulnerable
or scared
or over emotional
that's when they can effectively
influence the audience to take action
now whether that's voting a certain way
rioting starting a war or something as
simple as influencing what someone
purchases
the influencer wants control over the
audience
and they work to build trust with the
audience they appeal to their morals
beliefs and ethics
or lack thereof
so this is uh a couple of notes on how
the relationship between the influencer
and audience works
you can see here that
they range from overt agents to
outspoken politicians on the influencer
side sometimes they're just low quality
inauthentic accounts
and then the narrative notice the
narrative is right in between and it
creates a story it creates a bond
between the influencer and the audience
the audience is obviously the intended
target of the influence operations and
and they can range in various sites like
we
already discussed and
like i said the most resourced
influencers are often the most obvious
you'll see them either overtly or
covertly using pretty large
infrastructure
now let's dig into some examples i think
i have about 10 minutes left so
hopefully we'll have time for both this
one is actually a private sector example
let's use an example from a fictional
auto manufacturer called vera
now vera develops self-driving cars
and one day someone uploaded a video of
a vera car driving itself around when
suddenly it crashes into pedestrians
causing a horrific scene
now the video uploaded to a streaming
video application
instantly went viral racking up millions
of views around the world
social media accounts shared the video
and also made hundreds of comments
criticizing the vera company
the video was later determined to be a
deep fake video
created to make the vera automobile look
dangerous
reckless and unreliable
by the time the video was proven to be
fake though fringe news sites like not
mainstream news but all the little news
sites that look very suspicious
those ones had spread the news story
and they had picked up the story and ran
it in europe and the us
but by then
the company's stocks were tanked
causing grave damage to the company's
reputation
now millions of people
especially in u.s and europe believed
what they saw that self-driving cars
were
dangerous killing machines that cannot
be trusted
that was the narrative
during the investigation vera cti team
discovered the following
capabilities
there was the use of deep fake video and
photos
altered photos from the
supposed scene of the incident
they used inauthentic social media
profiles and they had fake news coverage
on the infrastructure side there was a
streaming media platform used mainstream
social media
fringe news websites hosted on foreign
ips and domains
that's the
technical infrastructure that the cti
team discovered
and so the audience was u.s and european
audiences where competitors
launched a new vehicle
adults ages 25 to 55 were targeted
and the influencer was determined to be
a criminal disinformation as a service
organization hired by a foreign
competitor
now this is a fictional scenario but
things like this happen every day
and so we see disinformation as a
service being sold in the dark web
recorded future my organization actually
did an experiment in 2016 where we hired
two criminal disinformation
organizations we hired one to conduct a
positive sentiment campaign and we hired
another to conduct a negative sentiment
campaign
we asked them prices we determined what
scope we wanted to do and they went to
work both
working towards either supporting or
degrading a fictional company that we
created
it was a phenomenal study and it really
showed us how they work how they operate
and what they're really capable of and
you know what their first thing was that
they went to was advertising on social
media
so it's a it's interesting how they work
interesting how you can break it out
into the diamond model here and in the
middle for the narrative
would be that narrative about
self-driving cars are reckless and
dangerous
so let's go to the next one i have a few
more minutes
this next one is a fictional
state-sponsored campaign
let me get my slides caught up here
now
for this fictional state nation state
we're going to call them country h so
you can follow along with me country h
is not fond of its neighbor country g
they often fight over territory and
scarce resources in their area
country h was discovered conducting
political influence operations targeting
a group of cultural minorities on the
border of country g
the cultural minority lives inside the
border of country g
so in this campaign they attempted to
convince the minority group that if they
didn't vote for the pro-country h
candidate in the next election
the people would face grave consequences
intimidation and coercion now country h
they hope that if the right candidate is
selected
that candidate will influence country
g's legislative body in a way that gives
up territory to country h
now when the threat intelligence
analysts discovered this campaign they
started digging in
on the capabilities side and notice that
i'm using the emit framework here to
list out the ttps that's an example of
how you can layer one framework on top
of the diamond model
these are three tactics that they
discovered country h using
they use trolls to amplify and
manipulate on social media they also
used a particular hashtag that appealed
to that cultural minority
and they organized rallies and events in
person
so keep this in mind that the
infrastructure and the capabilities are
not always technical sometimes they're
also physical
on the infrastructure side they used
inauthentic social media accounts
fringe social media that was used by the
target audience
so we're not talking about facebook
twitter all the big ones even in your
own country whatever the most popular
platform is we're talking about a very
specific fringe social media platform
that was used by that cultural minority
a safe space let's say that's where they
were targeted
and they also used a local town hall
building to stage protests and
demonstrations and to reach that target
audience
now we know that the audience was
country g's cultural minority
and we determined that the influencer
was
country h
and their intelligence agency as well as
their police department that worked on
the border
this right here is just an example a
fictional example of a political um
maybe politically motivated
nation-state-sponsored campaign but you
can think about a million scenarios in
your head about politics in your own
country or perhaps internationally how
nation-states are launching campaigns
against each other
of which
our organization has a lot of great
reports on our website if you ever want
to check that out now these are just two
examples of both private and public
sector and how you might be able to use
the diamond model to analyze influence
operations so as i wrap this up um just
wanted to
let's see here
uh give you a qr code to the full white
paper on the diamond model for influence
operations analysis i promise i'm not
fishing you
it'll take you straight to a free white
paper you don't have to enter any
information
also
my contact information is here and i
post quite often on twitter about new
disinformation campaigns and malign
influence that we discover
with that i want to say thank you for
your time thank you for being here
thank you again charity there is some
question for charity
i remember the microphone allocated one
in left and one right side
yeah look it like don't be shy
quiet group
very good awesome so i want to thank you
again very much
and applause for her please yes thank
you
so uh we have a 10 minute break right
now next session will become in 10
minutes thank you