Fighting Fiction with Facts: Your Quick Guide to Narrative Attacks

False narratives have been around for centuries, once the mainstay of militaries seeking to trick their adversaries during war. But narrative attacks have exited the conventional battlefield, opening a new front on social and traditional media, online forums, and blogs, with actors such as influencers, biased or lazy journalists, disgruntled employees, and activists amplifying misinformation and disinformation during each attack. The aftermath of a narrative attack is littered with financial distress, poor press, internal and external distrust, and a destroyed brand reputation. The impacts of these attacks can last for decades.

But what exactly is a narrative attack, and how do they happen? In this guide, we’ll cover the basics around a narrative attack, the difference between misinformation and disinformation, when to respond to an attack, and a glossary of common terms.

What is a Narrative Attack?

We define narrative as ‘any assertion that shapes perception about a person, place or thing in the information ecosystem.’ An attack occurs when misinformation and disinformation tactics are used to manipulate public perception about organizations, events, groups of people, or individuals. 

The real risk arises when these attacks scale (or “go viral”). They will become dangerous, impacting corporations, governments, and other organizations, causing serious financial, reputational, and societal harm – which can last indefinitely. Narrative attacks are rapidly becoming a hot topic for executive teams (particularly Chief Communications Officers and Chief Information Security Officers) because of the sheer scale of the problem.

Consider this:

• $78B is lost each year to private firms due to disinformation
• 88% of investors consider disinformation attacks on corporations a serious issue
• 53% of US respondents: “CEOs & business leaders should do whatever they can to stop the spread of misinformation.”
• 25% of respondents thought business leaders were currently doing enough

Who is at risk? In our modern times, when public forums are democratized and there is a share-first, ask-questions-later mentality, just about any type of corporation, civic organization, governmental entity, or individual is at risk. Narrative attacks are industry agnostic, but governmental entities and corporations in the financial services, consumer brands, pharmaceutical/health, and entertainment verticals are at especially high risk.

The Unholy Trinity: Misinformation, Disinformation, and Malinformation

Misleading. Deception. Sabotage. 

Narrative attacks are fueled by three key manipulation types: misinformation, disinformation, and malinformation. While they might seem interchangeable, there are nuances in intent and motivation that can affect the type of response:

Misinformation is the unintentional sharing of false or misleading information. Examples include sharing outdated or debunked news articles and/or research on social media.

Disinformation is false information shared with the expressed goal of deliberately manipulating or deceiving audiences.

Malinformation is factual information taken out of context or otherwise used to inflict harm on a person, organization, or country.

A good rule of thumb: misinformation misleads, disinformation deceives, and malinformation sabotages. (Source: CISA)

How is Narrative Manipulated?

There is no single way to manipulate a narrative. Below is a flow of how narrative can be manipulated and blown up in an instant, damaging an organization’s reputation and bottom line:

The Trigger 

An event will trigger the attack. This might be a data breach, an investigation, an environmentally damaging event,  or a scandal around finances or an organization executive.

Actors 

From there, actors will join the fray and take to platforms to weaponize information (real or fake) and compound attention.
‍
Bots

For more sophisticated narrative attacks, bots play a critical role with the actors. These mechanized actors can amplify attacks on social media much faster then humans. 

The Narrative

Actors will use a variety of means shape the narrative. This can include outright fabrication and embellishment, cherry-picking evidence, using loaded language to shape perception (framing) and using biased imagery to manipulate emotions and opinions. 

The Platforms

Actors will amplify their message via traditional media, social media platforms, online forums (including social media groups), independent website and blogs, and via personal conversations, often with like-minded activists.

To Respond, or Not Respond – That is the Question

“Don’t feed the trolls” is a common Internet phrase, referring to not responding to or otherwise acknowledging posters who join discussions purely to sow discord. But knowing when to respond, when a response might be futile, or perhaps make things worse is key. This is where monitoring and tracking conversations is critical, and can determine when and how your organization responds to an attack.
‍
Quickly Respond When:

• An attack has strong traction If the attack is going viral and gaining momentum, it is best to formulate and execute a plan as quickly as possible.
• A major crisis occurs This can include a product recall or a data breach. Any response should be transparent and factual, with frequent updates. 
• Physical safety is a concern If the attack causes a violent response, immediately engage the authorities and publicly condemn the activity. Above all, your plan should prioritize safety.
• Silence might be considered guilt Ignoring concerns and questions can skew public opinion. If the attack raises legitimate points, engage in constructive conversation by explaining your organization’s actions and willingness to listen.

When Not to Respond (at least, not right away)

• When emotions are running high Outrage-based attacks can easily escalate. Monitor conversations and wait for emotions to dissipate. When the time is right, issue a response via official channels. 
• If the attack is isolated and lacks traction. If there is not much traction around an attack, a response might draw more attention than the attack. 
• Blatantly and demonstrably false attacks If traction grows, issuing a clear, factual response via official channels (website, social media, etc.) will more effectively disarm the attacker than direct engagement. 
• When legal issues are involved Before creating a plan, seek legal counsel to avoid making matters worse. 

Whether or not you respond, it is critical to stay calm, and have a focused, strategic mindset. We also strongly recommend going beyond social listening to fully monitor and track continuing narratives about your organization. 

‍The ABCs of a Narrative Attack: A Glossary

The attack surface expands and tools become more sophisticated, new terms continue to emerge. Below is a comprehensive guide to standard terms across the risk landscape:

Actor An individual or group of individuals (country, group, etc.) in a dataset that are propagating content.

Bot An autonomous program that propagates content on social media at a rate that far exceeds human capabilities.  

Deep Fakes A video of a person in which their face or body has been digitally altered so that they appear to be someone else, or doing/saying something they did not say or do.

Emergent Risk A new exposure to danger. Also referred to as a novel risk.

Influencer An individual that has a large online audience.

Information Ecosystem The spaces, actors, and networks that information flows to, from, through, and originates from.
‍
Information Warfare Information warfare is when controlling and manipulating the flow of information and the information itself is used to gain an advantage over an opponent.

Content Moderation A policy and system for removing illegal, obscene, harmful, etc. content from a public platform.

‍Narrative Generation The process through which one builds a narrative.

Risk Landscape The entirety of potential risks against a particular person, entity, industry, etc.Also referred to as a threat landscape. 

‍Risk Ops The collection of practices, processes, and tools that are designed to assist a company’s goals safely and effectively.

Viral Content Material, such as an article, an image, or a video that rapidly spreads online through website links and social sharing.

‍OSINT Open source intelligence. Intelligence gathered from publically available sources.

Summary and Key Takeaways

We’ve just covered the basics around narrative attacks, and the differences between misinformation, disinformation, and malinformation. We’ve also discussed when to respond (or not), the flow of an attack, and some of the most common terms used for the risk landscape.  Below are a few additional takeaways:

• A narrative attack is a growing, target-agnostic threat that has risen to the top of executive priorities, especially for Chief Communications Officers and Chief Information Security Officers.
• Attacks are fueled by misinformation, disinformation, and malinformation. Each of these is a distinct tactic, with different intents and motivations – which can impact the type of response. 
• Consider different factors when determining whether or not to respond. Attacks with no traction may escalate with a response; not immediately responding to a major event will fuel attacks. 
• Attacks can spread like wildfire across a wide surface. When attacks gain traction, they become dangerous and the impact can last indefinitely.