What is cognitive warfare? How it differs from fake news, information manipulation and FIMI

The term 'fake news' is not enough to describe what is happening. The content may be entirely true, only selected and forwarded in concentrated waves. The accounts may never lie, yet use a coordinated rhythm to make a certain emotion appear widespread. This article sorts out the origins and differences of the related terms, and explains the methods, detection signals, defenses and Taiwan's regulations.

Definition: why cognitive warfare is not the same as 'fake news'

Under this definition, information content is a means, and what is being influenced is cognition itself; the definition also covers both influencing and protecting. To make this easier to grasp, this article uses three examples to illustrate what 'influencing cognition' might mean: which issues get seen, which frame is used to understand them, and which institutions are trusted. These three examples are this article's own interpretation, not the original text of that article.

Why is it not the same as fake news? In their 2017 report 'Information Disorder' for the Council of Europe, Wardle and Derakhshan point out that the term 'fake news' is ambiguous and inadequate for describing these phenomena. They divide information disorder into misinformation, disinformation and malinformation, based on whether the information is false and whether there is intent to harm. This article uses disinformation to mean false information spread deliberately. Cognitive warfare may use means beyond this, and may rely entirely on true information.

This distinction has practical consequences. Selective amplification, emotional mobilization and coordinated spreading do not necessarily contain a single claim that can be judged false. Fact-checking still has to examine the content and its context, but it also needs observation of accounts, networks and time series. Meta's 2020 CIB report likewise explains that action against coordinated inauthentic behavior is based on the deceptive nature of the behavior, not on the content itself.

Terminology table: misinformation, disinformation, information manipulation, FIMI, CIB and cognitive warfare

These terms overlap, but they differ in origin and analytical purpose. In the table, 'information manipulation' and 'influence operations' are working definitions adopted in this article, not quoted from a specific organization. When citing them, we recommend noting this.

This table can be read along four dimensions. Intent: misinformation and disinformation may have identical content, and the difference is whether the person knew it was false and intended to cause harm. Truth: true content can also be used to cause harm. Coordination: FIMI and CIB look at behavior patterns rather than whether content is true or false; FIMI also emphasizes foreign actors and their proxies, and the proxies themselves are not necessarily located abroad. Purpose: cognitive warfare focuses on changing cognition and behavior, and overlaps with the other concepts, but it is not a strict superordinate or subordinate relationship.

Two kinds of confusion should be avoided when reading. One is interpreting a platform's CIB takedown report as saying that these accounts spread fake news, when the action was based on behavior and the content is not necessarily false. The other is treating all misinformation as manipulation by someone, which overlooks forwarding done with good intentions. When writing reports or specifications, state the definitions and versions you adopt.

Methods: understanding an information manipulation operation by tactical stage

To describe methods, you can refer to the DISARM framework. It models disinformation incidents on the structure of MITRE ATT&CK from the security field, and one of its predecessors is the AMITT framework, created in 2019 under the MisinfoSec working group. It is divided into the Red framework (the manipulators' tactics, techniques and procedures, or TTPs, arranged by tactical stage) and the Blue framework (the countermeasures of responders).

This article borrows the idea of the Red framework's arrangement by tactical stage and groups methods into four stages. The stage names are our own summary and are not official DISARM tactic names or numbers.

Organizing clues by stage helps plan verification and response processes for different points in time, for example by watching for clusters of anomalous accounts or impersonating pages already in stage two.

Narrative framing

For example, the same equipment failure can be understood as a single incident, or framed as evidence that the system has long been failing. A frame does not necessarily contain false statements, but it may shape how audiences interpret later news.

Selective amplification

Picking out fragments that fit a preset narrative and reposting them intensively while ignoring contrary information. Even if an individual fragment is true, omitting context can still make it misleading.

Emotional mobilization

For example, sensational headlines, clipped videos and polarizing questions can drive reposting and provoke strong emotional reactions; sources and full context should still be checked before forwarding.

Impersonation

Imitating agency announcements, creating fan pages with similar names, or speaking as fictitious local residents; deepfake audio and video are an extension of this.

Coordinated account networks

A group of accounts reposting and commenting on each other at similar times with similar content can create the impression of majority opinion. What matters is whether their relationships and rhythm look natural.

Cross-platform relay

For example, content may move from groups into public social media and then flow to other platforms as screenshots, or it may flow in the opposite direction. The path must be reconstructed from case evidence, and any single platform shows only one segment of it.

How to identify it: four layers of signals (content, accounts, network, timing)

Identification should observe four layers and cross-check them.

The four layers should be read together: similar content alone may simply mean everyone reposted the same news story. When several signals appear at once, such as newly created accounts, mutual reposting and synchronized appearance, they can be listed as leads for further verification, while explanations such as normal community activity must still be ruled out. In practice, we recommend keeping verification records (screenshots, original links, capture times); for content involving identifiable individuals, confirm the basis and necessary scope for collecting, processing and using personal data. For the principles and limits of detection methods, see How AI detects fake news.

In the context of cybersecurity threat intelligence, the subject of analysis is cyber threats and risks to specific entities, which differs from information manipulation monitoring; the two can run in parallel. For details, see What is threat intelligence.

Defense and resilience: countermeasures, fact-checking and public sector communication

Responding to information manipulation usually involves collaboration among several parties. Platforms, fact-checking organizations and public sector bodies can each take part according to their own responsibilities: for example, platforms handle accounts and behavior under their policies, fact-checking organizations examine verifiable claims, and public sector bodies explain the facts of their own business. In practice, the parties' work may also overlap.

DISARM Blue: organizing countermeasures from the responder's perspective

The Blue framework organizes the countermeasures responders might take. Alongside the Red framework, it was originally intended to help think through intervention points against tactics at a specific stage, and to provide a shared vocabulary when exchanging analysis. Pay attention to its version and nature when using it: the DISARM Foundation has publicly stated that it will rebuild the Blue framework, in part because some items in the old set of countermeasures had been marked as not recommended and the labeling was inconsistent; the Foundation also states that the framework is informational only and does not recommend any action. The old list is therefore best treated as a historical reference rather than as a basis for current operations; cite the version when referring to it, and assess any countermeasure separately for legal basis, necessity, proportionality and freedom of expression.

Fact-checking ecosystem

Taiwan's fact-checking ecosystem includes professional fact-checking organizations and crowdsourced verification platforms, which offer different services such as fact-check reports, message lookup and user-collaborative responses, and whose scope and methods are not entirely the same. When readers come across a suspicious message, they can compare fact-check results from several sources and the original data those results cite; what the public sector can focus on is publishing verifiable original data so that the public knows where to look things up.

Public sector communication preparedness

Agencies can identify in advance the topics in their own work that are prone to misunderstanding, prepare original data and explanations that can be cited publicly, and agree beforehand on principles for judging when to respond: responding too early or too much may actually widen the reach of false content, while responding too late may let an incorrect account take hold first. For the general steps of public clarification, see Sentiment crisis management SOP.

Legal framework: current provisions in Taiwan addressing false information

The table below lists only three laws that address specific acts of spreading false information. It is not a complete list, whether an act is unlawful is decided case by case, and the provisions should be checked against the current version in the Laws and Regulations Database of the Republic of China.

These provisions regulate specific acts of spreading false information, and each has its own conditions of application, such as being sufficient to affect public peace or to harm the public or others. Whether they apply must be judged case by case. Two things should also be kept apart: whether content is false is judged by fact-checkers based on evidence, while whether it is unlawful is determined by the competent authority according to law. Being judged false does not mean it is unlawful.

This article does not constitute legal advice. For the operational priorities during an election period, see Election disinformation monitoring checklist.