---
date: '2019-09-10'
subtitle: 'Misinformation, but deliberate'
template: text.html
title: Disinformation demystified
url: disinfo
---

As with the disambiguation of any word, let's start with its etymology
and definiton. According to
[Wikipedia](https://en.wikipedia.org/wiki/Disinformation),
*disinformation* has been borrowed from the Russian word ---
*dezinformatisya* (дезинформа́ция), derived from the title of a KGB black
propaganda department.

> Disinformation is false information spread deliberately to deceive.

To fully understand disinformation, especially in the modern age, we
need to understand the key factors of any successful disinformation
operation:

-   creating disinformation (what)
-   the motivation behind the op, or its end goal (why)
-   the medium used to disperse the falsified information (how)
-   the actor (who)

At the end, we'll also look at how you can use disinformation techniques
to maintain OPSEC.

In order to break monotony, I will also be using the terms "information
operation", or the shortened forms---"info op" & "disinfo".

Creating disinformation
-----------------------

Crafting or creating disinformation is by no means a trivial task.
Often, the quality of any disinformation sample is a huge indicator of
the level of sophistication of the actor involved, i.e. is it a 12 year
old troll or a nation state?

Well crafted disinformation always has one primary characteristic ---
"plausibility". The disinfo must sound reasonable. It must induce the
notion it's *likely* true. To achieve this, the target --- be it an
individual, a specific demographic or an entire nation --- must be well
researched. A deep understanding of the target's culture, history,
geography and psychology is required. It also needs circumstantial and
situational awareness, of the target.

There are many forms of disinformation. A few common ones are staged
videos / photographs, recontextualized videos / photographs, blog posts,
news articles & most recently --- deepfakes.

Here's a tweet from [the grugq](https://twitter.com/thegrugq), showing a
case of recontextualized imagery:

```{=html}
<blockquote class="twitter-tweet" data-dnt="true" data-theme="dark" data-link-color="#00ffff">
```
```{=html}
<p lang="en" dir="ltr">
```
Disinformation. `<br>`{=html}`<br>`{=html} The content of the photo is
not fake. The reality of what it captured is fake. The context it's
placed in is fake. The picture itself is 100% authentic. Everything,
except the photo itself, is fake.
`<br>`{=html}`<br>`{=html}Recontextualisation as threat vector.
`<a href="https://t.co/Pko3f0xkXC">`{=html}pic.twitter.com/Pko3f0xkXC`</a>`{=html}
```{=html}
</p>
```
--- thaddeus e. grugq (@thegrugq)
`<a href="https://twitter.com/thegrugq/status/1142759819020890113?ref_src=twsrc%5Etfw">`{=html}June
23, 2019`</a>`{=html}
```{=html}
</blockquote>
```
```{=html}
<script async src="https://platform.twitter.com/widgets.js" charset="utf-8"></script>
```
Motivations behind an information operation
-------------------------------------------

I like to broadly categorize any info op as either proactive or
reactive. Proactively, disinformation is spread with the desire to
influence the target either before or during the occurence of an event.
This is especially observed during elections.[^1] In offensive
information operations, the target's psychological state can be affected
by spreading **fear, uncertainty & doubt**, or FUD for short.

Reactive disinformation is when the actor, usually a nation state in
this case, screws up and wants to cover their tracks. A fitting example
of this is the case of Malaysian Airlines Flight 17 (MH17), which was
shot down while flying over eastern Ukraine. This tragic incident has
been attributed to Russian-backed separatists.[^2] Russian media is
known to have desseminated a number of alternative & some even
conspiratorial theories[^3], in response. The number grew as the JIT's
(Dutch-lead Joint Investigation Team) investigations pointed towards the
separatists. The idea was to **muddle the information** space with these
theories, and as a result, potentially correct information takes a
credibility hit.

Another motive for an info op is to **control the narrative**. This is
often seen in use in totalitarian regimes; when the government decides
what the media portrays to the masses. The ongoing Hong Kong protests is
a good example.[^4] According to
[NPR](https://www.npr.org/2019/08/14/751039100/china-state-media-present-distorted-version-of-hong-kong-protests):

> Official state media pin the blame for protests on the "black hand" of
> foreign interference, namely from the United States, and what they
> have called criminal Hong Kong thugs. A popular conspiracy theory
> posits the CIA incited and funded the Hong Kong protesters, who are
> demanding an end to an extradition bill with China and the ability to
> elect their own leader. Fueling this theory, China Daily, a state
> newspaper geared toward a younger, more cosmopolitan audience, this
> week linked to a video purportedly showing Hong Kong protesters using
> American-made grenade launchers to combat police. ...

Media used to disperse disinfo
------------------------------

As seen in the above example of totalitarian governments, national TV
and newspaper agencies play a key role in influence ops en masse. It
guarantees outreach due to the channel/paper's popularity.

Twitter is another, obvious example. Due to the ease of creating
accounts and the ability to generate activity programmatically via the
API, Twitter bots are the go-to choice today for info ops. Essentially,
an actor attempts to create "discussions" amongst "users" (read: bots),
to push their narrative(s). Twitter also provides analytics for every
tweet, enabling actors to get realtime insights into what sticks and
what doesn't. The use of Twitter was seen during the previously
discussed MH17 case, where Russia employed its troll factory --- the
[Internet Research
Agency](https://en.wikipedia.org/wiki/Internet_Research_Agency) (IRA) to
create discussions about alternative theories.

In India, disinformation is often spread via YouTube, WhatsApp and
Facebook. Political parties actively invest in creating group chats to
spread political messages and memes. These parties have volunteers whose
sole job is to sit and forward messages. Apart from political
propaganda, WhatsApp finds itself as a medium of fake news. In most
cases, this is disinformation without a motive, or the motive is hard to
determine simply because the source is impossible to trace, lost in
forwards.[^5] This is a difficult problem to combat, especially given
the nature of the target audience.

The actors behind disinfo campaigns
-----------------------------------

I doubt this requires further elaboration, but in short:

-   nation states and their intelligence agencies
-   governments, political parties
-   other non/quasi-governmental groups
-   trolls

This essentially sums up the what, why, how and who of disinformation.

Personal OPSEC
--------------

This is a fun one. Now, it's common knowledge that **STFU is the best
policy**. But sometimes, this might not be possible, because afterall
inactivity leads to suspicion, and suspicion leads to scrutiny. Which
might lead to your OPSEC being compromised. So if you really have to,
you can feign activity using disinformation. For example, pick a place,
and throw in subtle details pertaining to the weather, local events or
regional politics of that place into your disinfo. Assuming this is
Twitter, you can tweet stuff like:

-   "Ugh, when will this hot streak end?!"
-   "Traffic wonky because of the Mardi Gras parade."
-   "Woah, XYZ place is nice! Especially the fountains by ABC street."

Of course, if you're a nobody on Twitter (like me), this is a non-issue
for you.

And please, don't do this:

![mcafee opsecfail](/static/img/mcafeetweet.png)

Conclusion
----------

The ability to influence someone's decisions/thought process in just one
tweet is scary. There is no simple way to combat disinformation. Social
media is hard to control. Just like anything else in cyber, this too is
an endless battle between social media corps and motivated actors.

A huge shoutout to Bellingcat for their extensive research in this
field, and for helping folks see the truth in a post-truth world.

[^1]: [This](https://www.vice.com/en_us/article/ev3zmk/an-expert-explains-the-many-ways-our-elections-can-be-hacked)
    episode of CYBER talks about election influence ops (features the
    grugq!).

[^2]: The [Bellingcat
    Podcast](https://www.bellingcat.com/category/resources/podcasts/)'s
    season one covers the MH17 investigation in detail.

[^3]: [Wikipedia section on MH17 conspiracy
    theories](https://en.wikipedia.org/wiki/Malaysia_Airlines_Flight_17#Conspiracy_theories)

[^4]: [Chinese newspaper spreading
    disinfo](https://twitter.com/gdead/status/1171032265629032450)

[^5]: Use an adblocker before clicking
    [this](https://www.news18.com/news/tech/fake-whatsapp-message-of-child-kidnaps-causing-mob-violence-in-madhya-pradesh-2252015.html).