Foreign Information Manipulation and Interference (Disinformation 2.0)

Foreign Information Manipulation and Interference (Disinformation 2.0)

Speakers: Unknown Speaker, Formerly of NATO

Conference: Black Hat USA

YouTube: https://www.youtube.com/watch?v=I5tZlIpWMWM

Overview

This talk delves into the evolving landscape of information warfare, specifically focusing on Foreign Information Manipulation and Interference (FIMI), often colloquially referred to as "Disinformation 2.0." Delivered by a speaker recently retired from NATO, the presentation provides a foundational understanding of disinformation, its historical roots, and its modern manifestations in the age of social media. The core objective is to equip attendees with a framework for identifying and analyzing FIMI campaigns, emphasizing the deliberate, manipulative, and often non-illegal nature of these activities.

The speaker highlights the critical distinction between general disinformation and FIMI, stressing that not all disinformation constitutes FIMI, and FIMI encompasses more than just disinformation. The talk is particularly pertinent in today's hyper-connected world, where information spreads rapidly and the lines between truth and falsehood are increasingly blurred. It underscores the societal impact, especially on younger demographics who predominantly rely on social media for news, making them particularly vulnerable to sophisticated manipulation tactics.

By outlining a structured methodology for detection and detailing the recurring "playbook" employed by malicious actors, the presentation offers valuable insights for cybersecurity professionals, policymakers, and the general public. It serves as a crucial reminder that information security extends beyond traditional technical vulnerabilities to encompass the integrity and reliability of the information ecosystem itself, calling for a more nuanced and comprehensive approach to defense against these insidious threats.

Background

▶ Watch: What is disinformation? KGB historical context. (0:00)

The concept of disinformation is not new; it has a rich and concerning history rooted in state-sponsored psychological operations. The speaker defines disinformation as "the deliberate distorted information that is secretly leaked into the communication process in order to deceive and manipulate," attributing this definition to a former KGB officer. To illustrate its historical depth, the talk references Operation Infection, a KGB operation from the 1980s that falsely claimed the Pentagon was the originator of the AIDS virus. This historical example highlights the long-standing practice of using fabricated narratives to sow discord and undermine trust. During this period, the KGB reportedly employed 15,000 officers in its disinformation team, with a significant 25% of their time dedicated to creating disinformation posts, underscoring the scale and strategic importance of these efforts even before the advent of the internet.

A critical distinction is drawn between disinformation and mere disagreement or opposing views. The speaker clarifies that simply disliking or disagreeing with information, or encountering a differing perspective, does not automatically qualify it as disinformation. This nuance is essential to prevent the weaponization of the term itself and maintain intellectual integrity in discussions about information validity.

The talk then introduces Foreign Information Manipulation and Interference (FIMI), a broader concept that encompasses disinformation but extends beyond it. FIMI refers to deliberate patterns of behavior that are manipulative, intentional, and coordinated, and whose content threatens or potentially impacts societal values, procedures, and political processes. A key characteristic of FIMI is its emphasis on "non-illegal activities." This distinction is crucial because it means that perpetrators often operate within legal boundaries, making them difficult to prosecute or fine through conventional legal channels. The speaker succinctly summarizes the relationship: "not all disinformation is FIMI and FIMI is not only disinformation," indicating that FIMI represents a more targeted, strategic, and often state-backed form of influence operation.

The advent of social media platforms over the last 15-20 years has dramatically reshaped the landscape of information dissemination. What began as a tool for sharing personal information, photos, and videos, has gradually been "used for different purposes and used for negative content and disinformation." This transformation presents a significant risk, particularly for the younger demographic who increasingly rely on these platforms as their primary source of news. Research indicates that on social media, it is hardest to discern truth from fake news, leaving younger individuals struggling to verify information with traditional news outlets. This lack of critical reflection makes them particularly susceptible to manipulative narratives, amplifying the potential impact of FIMI campaigns on public perception and political processes.

Key Findings

▶ Watch: Understanding FIMI: non-illegal, manipulative, coordinated behavior. (2:00)

The talk presents several key findings and frameworks for understanding and combating FIMI. Central to its methodology is the ABCDE model, developed by James Lund from a Swedish University, designed to detect and analyze disinformation campaigns. This model provides a structured approach to breaking down complex influence operations into manageable components:

1. Actors (A): This initial phase focuses on identifying who is behind the manipulation. Actors can range from nation states with geopolitical agendas, to various political groups seeking to influence domestic or international discourse, and even conspiracy theorists promoting fringe narratives. Understanding the actor's identity, motivations, and capabilities is fundamental to assessing the threat.

1. Behavior (B): Once actors are identified, the next step is to analyze their behavior. This involves observing the tactics they employ, such as creating fake personas or bot networks, generating and disseminating memes or videos designed for virality, or establishing shadow networks to amplify specific messages. Behavioral analysis helps in understanding the operational patterns of FIMI campaigns.

1. Content (C): This is often the first element discovered during research. The content refers to the actual information being pushed out. This can include hacked documents (or purportedly hacked documents to create an illusion of authenticity), or carefully crafted political narratives designed to sway public opinion. Analyzing the content's themes, language, and underlying messages is crucial for identifying the campaign's objectives.

1. Distribution (D): Recently added to the model, this element focuses on the mechanisms used to spread the content. While social media platforms are a primary channel, FIMI campaigns often leverage diverse distribution strategies, including traditional media outlets, encrypted messaging apps, or even direct outreach to "useful idiots" who unknowingly amplify the message. Understanding distribution helps map the reach and intended audience of a campaign.

1. Effect (E): The final, and most challenging, component is measuring the effect or impact of the FIMI campaign. The speaker notes that "effect is difficult to measure" and "it's not an exact science." Quantifying the true influence of a disinformation campaign on public opinion, policy, or societal cohesion remains a significant challenge, requiring sophisticated analytical tools and long-term observation.

The ABCDE model is presented as a holistic framework that can also be conceptualized as narrative intelligence, actor intelligence, threat intelligence, and impact intelligence. By examining the entire "environment" and "network," researchers can track how these actors behave over time, providing a dynamic understanding of FIMI operations.

Beyond the ABCDE model, the talk identifies a recurring playbook or methodology consistently used in FIMI campaigns over the last 10-20 years. This playbook outlines a five-step process:

1. Look for cracks: Malicious actors first identify existing divisions, grievances, or vulnerabilities within a society. These "cracks" provide fertile ground for planting divisive narratives and exploiting existing tensions.
2. Create a big lie: They then construct a significant falsehood, often one that initially seems unbelievable.
3. Wrap that lie around a kernel of truth: To make the "big lie" more plausible and harder to debunk, it is interwoven with an undeniable factual element. An example provided is a false claim about President Zelensky's wife buying expensive jewelry in France; the "kernel of truth" was that she was indeed in France at the time. This makes the overall narrative more convincing and difficult to dismiss outright.
4. Conceal their hand: The originators of the FIMI campaign rarely post directly. Instead, they use indirect methods, often leveraging "useful idiots"—individuals who unknowingly spread the disinformation, believing it to be true or simply sharing it without critical verification. This obfuscation makes attribution challenging.
5. Deny, distract, distort: If the campaign is exposed or caught, the standard response is to deny involvement, distract from the facts by shifting the narrative, or distort the original discussion to something new. This tactic aims to confuse the audience and prolong the life of the false narrative.

These findings collectively offer a robust analytical framework for understanding the sophisticated, multi-faceted nature of modern information manipulation.

Technical Deep Dive

▶ Watch: Explained: The ABCDE model for detecting disinformation. (2:40)

The technical depth of this talk lies not in specific software or network exploits, but in the systematic methodology for understanding and deconstructing sophisticated Foreign Information Manipulation and Interference (FIMI) campaigns. The ABCDE model by James Lund serves as the primary analytical tool, functioning as a form of intelligence framework for dissecting information operations.

From a technical perspective, each component of the ABCDE model requires distinct analytical techniques:

• Actors (A): Identifying actors involves attribution intelligence. This is a complex process that moves beyond simple user profiles to analyze digital footprints, linguistic patterns, operational hours, infrastructure usage (e.g., VPNs, specific hosting providers), and historical connections. Techniques might include social network analysis to identify clusters of coordinated accounts, open-source intelligence (OSINT) to link online personas to real-world entities, and potentially digital forensics if infrastructure is compromised. The goal is to move beyond superficial identities to unmask the underlying organizational structures, whether they are nation-state intelligence agencies, state-sponsored media, or politically motivated non-state actors.

• Behavior (B): Analyzing behavior is intrinsically linked to pattern recognition and anomaly detection. This involves monitoring how actors operate:
• Fake personas: Detecting these requires analyzing profile completeness, posting frequency, interaction patterns, and the use of deepfakes or AI-generated profiles. Tools for image forensics and natural language processing (NLP) can help identify inconsistencies.
• Memes and videos: This necessitates multimedia analysis, including content provenance verification (checking origin, modification history), metadata analysis, and visual forensics to detect manipulation or fabrication. The rapid spread of visual content makes this a challenging area.
• Coordinated amplification: Identifying deliberate synchronization in posting, sharing, and commenting across multiple accounts or platforms is key. This often involves graph database analysis to map relationships and identify influence operations.

• Content (C): Content analysis is where fact-checking and narrative intelligence converge.
• Hacked/Supposedly hacked documents: Authenticating documents involves cryptographic verification (if signed), metadata inspection for tampering, and cross-referencing information with reliable sources. The "supposedly hacked" aspect highlights the FIMI tactic of presenting fabricated documents as legitimate leaks to add a veneer of credibility.
• Political narratives: This requires semantic analysis and discourse analysis to identify recurring themes, loaded language, and specific ideological framings. Tracking the evolution of narratives over time provides insight into strategic messaging. The speaker's example of wrapping a "big lie" around a "kernel of truth" is a sophisticated content engineering technique designed to bypass immediate skepticism. For instance, the factual element (Zelensky's wife in France) grounds the fabricated narrative (buying jewelry), making it harder for casual observers to dismiss the entire story.

• Distribution (D): This aspect delves into network analysis and platform intelligence.
• Social media: Monitoring requires access to platform APIs, sophisticated crawlers, and network propagation models to track how content spreads, identifying key influencers (both legitimate and manipulated), and identifying botnets or coordinated inauthentic behavior.
• Other mechanisms: This extends to dark web forums, encrypted messaging apps (e.g., Telegram, WhatsApp), traditional news outlets (via planted stories), and even private communications. Tracking these diverse channels requires a multi-modal intelligence gathering approach.

• Effect (E): Measuring effect is the most abstract and least "technical" in a traditional sense, yet it is crucial for understanding the success of FIMI. It involves sociological impact assessment and public opinion analysis. This could include tracking changes in public sentiment (via polls, social listening), analyzing shifts in political discourse, or observing real-world actions (protests, voting patterns) that correlate with FIMI campaigns. The difficulty lies in isolating the specific impact of FIMI from myriad other influencing factors.

The "playbook" itself is a technical methodology from the perspective of an attacker. The steps—looking for cracks, creating a big lie, wrapping it in truth, concealing hand, and denying—represent a structured approach to social engineering at scale. Understanding this sequence allows defenders to anticipate tactics and develop countermeasures at each stage. For example, knowing that actors will seek "cracks" implies a need for societal resilience and media literacy programs. The use of "useful idiots" points to the importance of educating the general public about information verification. The "deny, distract, distort" phase highlights the need for rapid response and robust fact-checking mechanisms that can withstand sustained counter-narratives.

The speaker's emphasis on FIMI being "non-illegal" is a critical technical and legal point. It means that traditional cybersecurity defenses, which often focus on preventing unauthorized access or data breaches, are insufficient. FIMI operates by manipulating legitimate channels and human psychology, exploiting trust rather than technical vulnerabilities. This necessitates a shift towards cognitive security, information integrity frameworks, and AI-driven content analysis that can identify subtle manipulations, even when content does not overtly violate platform terms of service or legal statutes. The challenge is to detect sophisticated influence operations without infringing on legitimate free speech.

Demo / Proof of Concept

▶ Watch: Social media's impact on youth's news consumption. (4:18)

The provided transcript does not include details of any specific live demonstrations or proof-of-concept tools. The speaker mentions that examples would be shown "in a moment" several times throughout the repeated sections, suggesting that visual aids or case studies were an integral part of the live presentation to illustrate the abstract concepts of disinformation and FIMI. However, these specific examples or demonstrations are not transcribed. The recurring reference to "you will see in a moment some of the examples where this is clearly being depicted" indicates the talk was likely accompanied by slides or video clips showcasing real-world instances of the ABCDE model and the FIMI playbook in action, but these are not available in the text.

Defensive Implications

▶ Watch: The 5-step playbook for launching disinformation campaigns. (5:15)

Understanding the mechanisms of Foreign Information Manipulation and Interference (FIMI) provides a crucial foundation for developing robust defensive strategies. Given the "non-illegal" nature of many FIMI activities, traditional legal and technical cybersecurity measures alone are often insufficient. A multi-layered approach that integrates technical, educational, and policy responses is imperative.

Defenders should leverage the ABCDE model as a framework for proactive monitoring and reactive analysis:

• Actor Intelligence (A): Organizations must invest in threat intelligence capabilities focused on identifying and tracking state-sponsored actors, political groups, and other entities known to engage in FIMI. This involves monitoring geopolitical developments, analyzing past campaigns, and collaborating with international partners to build a comprehensive picture of potential adversaries and their motivations. Understanding who is behind the manipulation allows for better anticipation of their targets and narratives.

• Behavioral Analysis (B): Developing automated systems to detect coordinated inauthentic behavior on social media platforms is critical. This includes identifying networks of fake personas, bot accounts, and coordinated amplification efforts. Machine learning models can analyze posting patterns, linguistic styles, and network topology to flag suspicious activities. Platforms themselves bear a significant responsibility here to implement robust detection and enforcement mechanisms against such behaviors.

• Content Verification (C): Enhancing fact-checking capabilities and promoting media literacy are paramount. Defenders need tools and processes to quickly verify claims, authenticate documents (or identify fabricated ones), and debunk false narratives. This requires collaboration between cybersecurity experts, journalists, and academic researchers. For the public, education on critical thinking, source evaluation, and recognizing the "kernel of truth" tactic is vital. When a seemingly unbelievable claim is wrapped around a verifiable fact (e.g., Zelensky's wife being in France), individuals must be trained to scrutinize the entire narrative, not just the factual component.

• Distribution Monitoring (D): Comprehensive monitoring of information flow across diverse platforms, not just mainstream social media, is essential. This includes tracking narratives on encrypted messaging apps, niche forums, and alternative news sites where FIMI content might initially incubate before spreading. Understanding the propagation pathways allows for targeted interventions and informs strategies for disrupting distribution networks.

• Impact Assessment (E): While challenging, developing better metrics and methodologies for measuring the societal impact of FIMI is crucial. This helps prioritize defensive efforts and evaluate the effectiveness of countermeasures. Researchers can use sentiment analysis, public opinion surveys, and sociological studies to gauge shifts in attitudes and beliefs influenced by FIMI campaigns.

Beyond the ABCDE model, the identification of the FIMI "playbook" offers direct defensive implications:

• Societal Resilience: Recognizing that FIMI actors "look for cracks" in society emphasizes the importance of strengthening social cohesion, addressing legitimate grievances, and fostering open, fact-based public discourse. A resilient society with high civic trust is less susceptible to divisive narratives.
• Public Education: Educating the public about the FIMI playbook, particularly the use of "useful idiots" and the "deny, distract, distort" response, empowers individuals to become more discerning consumers and sharers of information. This includes teaching how to identify subtle manipulation and the importance of verifying information before amplifying it.
• Platform Accountability: Social media platforms must acknowledge their role as critical "information platforms" that are being exploited. They should be held accountable for implementing stronger content moderation policies, improving transparency regarding foreign influence operations, and collaborating with security researchers and governments to combat FIMI.
• Rapid Response Mechanisms: Given the speed at which disinformation spreads, organizations need agile rapid response teams capable of quickly identifying, analyzing, and debunking FIMI narratives. This involves pre-established communication channels, clear protocols for escalation, and partnerships with credible news organizations to disseminate accurate information.
• Legal and Policy Frameworks: While FIMI often operates in "non-illegal" grey areas, governments and international bodies must explore innovative legal and policy frameworks to deter and penalize actors engaged in systematic manipulation, while carefully balancing these efforts with protections for free speech. This might involve sanctions against state-sponsored entities or international agreements on responsible information conduct.

In summary, defending against FIMI requires a shift from purely technical defenses to a holistic approach that builds cognitive immunity within the population, fosters platform responsibility, and develops sophisticated intelligence capabilities to understand and counter the evolving tactics of information manipulators.

Key Takeaways

• Disinformation vs. FIMI: Disinformation is deliberately distorted information intended to deceive. Foreign Information Manipulation and Interference (FIMI) is a broader, strategic, and coordinated set of non-illegal activities that threaten societal values and political processes, not all disinformation is FIMI, and FIMI encompasses more than just disinformation.
• Historical Precedent: Information manipulation is a long-standing tactic, exemplified by historical operations like the KGB's Operation Infection in the 1980s, which employed thousands of officers dedicated to disinformation.
• The ABCDE Detection Model: James Lund's model provides a structured framework for analyzing FIMI campaigns, examining Actors, their Behavior, the Content they push, their Distribution mechanisms, and the resulting Effect.
• The FIMI Playbook: Malicious actors consistently follow a five-step methodology: exploit societal "cracks," create a "big lie," wrap it around a "kernel of truth," conceal their involvement (often through "useful idiots"), and if caught, deny, distract, and distort.
• Social Media Vulnerability: Social media platforms, once seen as tools for good, are now extensively used for FIMI. Younger demographics, relying heavily on these platforms for news, are particularly susceptible to manipulation due to difficulty in distinguishing truth from falsehood.
• Non-Illegal Nature Challenges Defense: FIMI's characteristic reliance on "non-illegal activities" means traditional legal and technical cybersecurity defenses are often insufficient, necessitating a broader approach focused on media literacy, societal resilience, and intelligence-driven countermeasures.

About the Speaker(s)

The speaker for "Foreign Information Manipulation and Interference (Disinformation 2.0)" is an individual who recently retired from NATO, specifically eight days prior to giving this talk at Black Hat USA. While their name was not provided in the transcript or metadata, their extensive experience within NATO suggests a deep background in international security, intelligence, and the strategic implications of information warfare. This background provides a credible foundation for their insights into sophisticated state-level disinformation and manipulation campaigns.