Author: Marianna Prysiazhniuk, FIMI Analyst at ISSP
“It is not the strongest of the species that survive,
nor the most intelligent, but the one most responsive to change.”
— Charles Darwin
In today’s increasingly complex, digitalized, and polarised world, analyzing Foreign Information and Manipulation campaigns requires an out-of-the-box approach. Foreign Information Manipulation and Interference (FIMI) are malicious campaigns and threatening behaviour reinforced from abroad. The DISARM framework provides a transparent methodology and detailed taxonomy of the Tactics, Techniques and Procedures (TTPs) used by malign actors.
The role of the DISARM Framework for disinformation analysis, risk assessment, strategic communication, projecting soft power via strategic communications and other means of influence operations can be compared, without any exaggeration, with Mendeleev’s periodic table of elements. As in chemistry, the DISARM framework allows us to consider different aspects of their interaction and predicting the development of the analyzed process—whether this is the risk or the disinformation campaign.
For example, Russia’s disinformation ecosystem follows identifiable TTPs, such as narrative laundering, fake fact-checking and coordinated amplification. One identifiable campaign, which can be called a short “denazification of Ukraine”, proved to be not only false but constructed to create proper conditions for aggressive politics, cyber-attacks and disinformation campaigns. These campaigns were systematically introduced across multiple incidents and narratives before they became a full-scale justification for war in 2022.
The DISARM Framework, was created in 2022 to help tackle the growing problem of Foreign Information Manipulation and Interference (FIMI). It was developed by experts from MITRE, Florida International University (FIU) and the Cognitive Security Collaborative (CogSec-Collab), who worked together to combine the best cybersecurity frameworks: AMITT and SP!CE.
AMITT stands for Adversarial Misinformation and Influence Tactics and Techniques. It came out of cross-disciplinary workshops organized by the MisinfoSec Working Group of the Credibility Coalition, and in 2019, it evolved into what became the DISARM Foundation. SP!CE, which stands for Structured Process for Information Campaign Enhancement, is a U.S. military-focused tool that helps describe the actions of both friendly and adversarial actors in influence campaigns. It includes an analytic framework, a knowledge base, and a scoring system and it is designed to work smoothly alongside DISARM.
The idea behind DISARM was to build a practical and unified method to respond to harmful information threats, especially those coming from foreign actors trying to interfere in public discourse. To do that, the teams from MITRE, FIU, and CogSec-Collab joined forces to merge AMITT and SP!CE into the DISARM Framework. The process was led by SJ, Pablo, Mark, and Jon Brewer who, as the team says, “keeps everyone organized.” Together, they officially launched the DISARM Foundation.
It is also worth noting that the SP!CE framework itself grew out of an earlier model called AMITT RED, which was adapted by MITRE and FIU, with leadership from Mark Finlayson at FIU.
Just as Mendeleev organised chemical elements based on their properties, DISARM structures different TTPs and actors involved in information manipulation. In this sense, DISARM helps analysts anticipate new disinformation techniques based on existing patterns, offering a systematic methodology for classification and analysis.
The DISARM Framework enables observers to monitor, collect and label incidents and campaigns within a common language, facilitating standardised knowledge dissemination and response design. It is based on the best cybersecurity and disinformation analysis – primarily STIX and AMITT. STIX, which stands for Structured Threat Information Expression, is an open-source format used to exchange cyber threat intelligence (CTI). It is free to use, allowing those interested to contribute and ask questions freely.
It aims to address information threats and represents a detailed taxonomy of FIMI manifestation in its tactics, techniques, procedures and countermeasures. The framework provides a common language for documenting influence operations, extending a grasp of a decades-long struggle for “hearts and minds” via propaganda, influence operations and information warfare, meaning via sharp power strategies.
The core approach of the methodology is rooted in AMITT disinformation understanding, which is represented by a triangle with several levels.
The lowest level is the artefacts (visible pieces of information). Artefacts are the messages, images, accounts, relationships and groups a disinformation actor uses to create narratives and incidents. They are building blocks visible in each incident, often in large volumes, and are the disinformation layer on which data scientists and other data specialists usually work.
The next level is the narrative, representing the story that usually directs beliefs. Narratives are the stories on which we base our beliefs: “identity narratives” about who we are, “in-group” and “out-group” narratives about the groups to which we do and don’t belong, and other narratives about what’s happening in the world around us. The aim of narrative is to create a belief system.
The next level is incidents. These are shorter-term sets of disinformation activity about a specific topic or event. An event might drive them, such as the opportunity to make money or other motives and the task of the incident to support and reflect this aim.
The top level is the campaign, which is the general strategy of communicating or physically arranging perspective, which is needed. It has longer-term objectives. All levels described above are logically connected to this top idea and represent the structure of how this organism of influence operation should function.
While the attacker (offensive) sees the whole pyramid from the top down, the defender (defensive) usually sees it from the bottom up, working back from artefacts to understand incidents and campaigns. The response for each FIMI manifestation aims to provide a detailed catalogue of the FIMI threats with a description of their peculiarities.
Therefore, the DISARM framework provides defensive and offensive blueprints for influence in international relations, ensuring that soft power strategies are resilient against adversarial sharp power threats. It consists of the “Blue Team” with the list of defensive TTPs and the “Red Team” with the models of attacks and malign interferences and open-source repositories of descriptions, mitigations and examples (AMITT Design Guide—version 1.0).
Russian influence operations in the 2016 U.S. elections and all subsequent countermeasures exemplify how offensive and defensive strategies were applied. The Russian Internet Research Agency (IRA) acted as a Red Team, using fake social media accounts, bots and targeted political ads to manipulate voter sentiment. The U.S. cybersecurity and intelligence community acted as a Blue Team, using forensic analysis and attribution tools to counter these attacks and expose the sources of interference.
In this context, the DISARM framework emerges as a promising tool for defence against such threats. It provides a structured approach to identifying, analysing, and mitigating the risks of disinformation and influence operations. The framework’s effectiveness lies in its comprehensive model for mapping the purpose, actions, results and techniques of influence campaigns.
Analysing different types of power projections from distinct perspectives allows one to address the gap between communication and behaviour in influence campaigns, offering a structured way to explore modern influence campaigns (The Importance of Risk Assessment in Management Control, 2024). The DISARM Framework bridges cybersecurity, information warfare and strategic communications, offering a structured framework for influencing operations analyses and designing countermeasures.