What is cognitive warfare? How it differs from fake news, information manipulation and FIMI

The term 'fake news' is not enough to describe what is happening. The content may be entirely true, only selected and forwarded in concentrated waves. The accounts may never lie, yet use a coordinated rhythm to make a certain emotion appear widespread. This article sorts out the origins and differences of the related terms, and explains the methods, detection signals, defenses and Taiwan's regulations.

Definition: why cognitive warfare is not the same as 'fake news'

In NATO Allied Command Transformation's 2023 description, information content is only a means; what is affected is cognition itself: which issues are seen, which frame is used to understand them, and which institutions are trusted. The definition also covers both influencing and protecting.

Why is it not the same as fake news? In their 2017 report 'Information Disorder' for the Council of Europe, Wardle and Derakhshan point out that the term 'fake news' is ambiguous and inadequate for describing these phenomena. They divide information disorder into misinformation, disinformation and malinformation, based on whether the information is false and whether there is intent to harm. This article uses disinformation to mean false information spread deliberately. Cognitive warfare may use means beyond this, and may rely entirely on true information.

This distinction has practical consequences. Selective amplification, emotional mobilization and coordinated spreading do not necessarily contain a single claim that can be judged false. Fact-checking still has to examine the content and its context, but it also needs observation of accounts, networks and time series. Meta's 2020 CIB report likewise explains that action against coordinated inauthentic behavior is based on the deceptive nature of the behavior, not on the content itself.

Terminology table: misinformation, disinformation, information manipulation, FIMI, CIB and cognitive warfare

These terms overlap, but they differ in origin and analytical purpose. In the table, 'information manipulation' and 'influence operations' are working definitions adopted in this article, not quoted from a specific organization. When citing them, we recommend noting this.

This table can be read along four dimensions. Intent: misinformation and disinformation may have identical content, and the difference is whether the person knew it was false and intended to cause harm. Truth: true content can also be used to cause harm. Coordination: FIMI and CIB look at behavior patterns rather than whether content is true or false, and FIMI is further limited to foreign actors. Purpose: cognitive warfare focuses on changing cognition and behavior, and overlaps with the other concepts, but it is not a strict superordinate or subordinate relationship.

Two kinds of confusion should be avoided when reading. One is interpreting a platform's CIB takedown report as saying that these accounts spread fake news, when the action was based on behavior and the content is not necessarily false. The other is treating all misinformation as manipulation by someone, which overlooks forwarding done with good intentions. When writing reports or specifications, state the definitions and versions you adopt.

Methods: understanding an information manipulation operation by tactical stage

To describe methods, you can refer to the DISARM framework. It models disinformation incidents on the structure of MITRE ATT&CK from the security field, and originated in the MisinfoSec working group of the Credibility Coalition. It is divided into the Red framework (the manipulators' tactics, techniques and procedures, or TTPs, arranged by tactical stage) and the Blue framework (the countermeasures of responders).

This article borrows the idea of the Red framework's arrangement by tactical stage and groups methods into four stages. The stage names are our own summary and are not official DISARM tactic names or numbers.

Organizing clues by stage helps plan verification and response processes for different points in time, for example by watching for clusters of anomalous accounts or impersonating pages already in stage two.

Narrative framing

For example, the same equipment failure can be understood as a single incident, or framed as evidence that the system has long been failing. A frame does not necessarily contain false statements, but it may shape how audiences interpret later news.

Selective amplification

Picking out fragments that fit a preset narrative and reposting them intensively while ignoring contrary information. Even if an individual fragment is true, omitting context can still make it misleading.

Emotional mobilization

For example, sensational headlines, clipped videos and polarizing questions can drive reposting and provoke strong emotional reactions; sources and full context should still be checked before forwarding.

Impersonation

Imitating agency announcements, creating fan pages with similar names, or speaking as fictitious local residents; deepfake audio and video are an extension of this.

Coordinated account networks

A group of accounts reposting and commenting on each other at similar times with similar content can create the impression of majority opinion. What matters is whether their relationships and rhythm look natural.

Cross-platform relay

For example, content may move from groups into public social media and then flow to other platforms as screenshots, or it may flow in the opposite direction. The path must be reconstructed from case evidence, and any single platform shows only one segment of it.

How to identify it: four layers of signals (content, accounts, network, timing)

Identification should observe four layers and cross-check them.

The four layers should be read together: similar content alone may simply mean everyone reposted the same news story. When several signals appear at once, such as newly created accounts, mutual reposting and synchronized appearance, they can be listed as leads for further verification, while explanations such as normal community activity must still be ruled out. In practice, we recommend keeping verification records (screenshots, original links, capture times); for content involving identifiable individuals, confirm the basis and necessary scope for collecting, processing and using personal data. For the principles and limits of detection methods, see How AI detects fake news.

In the context of cybersecurity threat intelligence, the subject of analysis is cyber threats and risks to specific entities, which differs from information manipulation monitoring; the two can run in parallel. For details, see What is threat intelligence.

Defense and resilience: countermeasures, fact-checking and public sector communication

No single organization can handle information manipulation alone: platforms handle accounts and behavior, fact-checking organizations handle verifiable claims, and public sector bodies handle the facts and communication of their own business.

DISARM Blue: organizing countermeasures from the responder's perspective

The Blue framework organizes countermeasures from the responder's perspective. Alongside the Red framework, it helps plan intervention points against tactics at a specific stage, and gives different units a shared vocabulary when exchanging intelligence. Not every countermeasure the framework lists is appropriate; when adopting one, assess the legal basis, necessity, proportionality and freedom of expression.

Fact-checking ecosystem

Taiwan's fact-checking ecosystem includes Taiwan FactCheck Center, MyGoPen, and the crowdsourced verification platform Cofacts, which respectively offer different services such as fact-check reports, message lookup and user-collaborative responses. What the public sector can focus on is providing verifiable original data so that the public knows where to look things up.

Public sector early warning and communication

Agencies can write and rehearse early warning and communication processes in advance: which topics to watch, who interprets anomalies, at what point to clarify publicly, through which channel, and when to hold off responding to avoid widening reach. For the complete approach, see Fake News Detection and Cognitive Warfare Monitoring System, and for the steps of public clarification, see Sentiment crisis management SOP.

Legal framework: current provisions in Taiwan addressing false information

The table below lists only three laws that address specific acts of spreading false information. It is not a complete list, whether an act is unlawful is decided case by case, and the provisions should be checked against the current version in the Laws and Regulations Database of the Republic of China.

These provisions regulate specific acts of spreading false information, and each has its own conditions of application, such as being sufficient to affect public peace or to harm the public or others. Whether they apply must be judged case by case. Two things should also be kept apart: whether content is false is judged by fact-checkers based on evidence, while whether it is unlawful is determined by the competent authority according to law. Being judged false does not mean it is unlawful.

This article does not constitute legal advice. For the operational priorities during an election period, see Election disinformation monitoring checklist.