The information environment includes many social platforms used to pollute information streams with emotionally laden appeals, propaganda and rumors, and distortions designed to polarize crowds and propagate social hysteria. Malicious campaigns to create, spread, and amplify civil discontent, instigate arguments and manipulate audience perspectives have the potential to jeopardize military mission execution and to threaten warfighter and civilian safety. Current models are poorly suited to measure and evaluate this content in online environments. The desired capabilities would enable analysis of this content designed to impact cyber-social dynamics in topic groups.

 

Technologies under this topic might include new models and tools for detection and evaluation of stochastic manipulation, including the detection and assessment of coordinated botnets and high impact “fake” accounts. The desired capabilities would evaluate the activities of suspected fakes and bots and measure their tendencies to apply stochastic and social engineering techniques to agitate, misinform, and shape the perceptions of target audiences. Social-cyber dynamics of botnets and other kinds of fakes often depend on the mechanics of the platform as much as the payload (the content) of the messages. These botnets and fakes use “likes”, “upvotes”, “replies”, ‘comments,’ and “quotes” to become insinuated into communities and back certain attitudes and opinions over others. Botnets and “fake” accounts (and fake groups) on many platforms are trained, coordinated, and developed using a number of stochastic (algorithmic) and social engineering methods, depending on the platform. These methods are designed to position these propaganda actors within vulnerable communities, with both supportive and validating messages (to position them as sympathetic members of the social community) as well as polarizing, manipulative messages that can be deployed at key moments to exploit crises and situations of high anxiety.

 

Humans cooperate these campaigns—sometimes knowingly, sometimes unknowingly—by simply accepting bot followers and bot help to get their messages out. “Cyborg” accounts where the human has created “vanity” botnets of retweeters are relatively easy for existing botnet detection capabilities to identify. Bots and fakes that target influencers and generate clouds of apparent support for agitation ideas over the voices of others in the discourse are harder to distinguish. The developed technology should be able to: (1) go beyond current botnet detection capabilities to create algorithms that can distinguish patterns of botnet driven and stochastic manipulation, particularly those that are highly charged; (2) identify associations among botnets and cyborg accounts; and (3) visualize these relationships (such as linkages among followerships), the existence of broker accounts that link multiple communities, bot -training messages that reveal relationships among early bot nets, and other patterns that can help to distinguish natural, “organic” audiences from inorganic interlopers.

 

PHASE I: Develop sophisticated new capabilities to detect “cyborg” accounts, sophisticated fake accounts, and systems of coordinated botnets using prototyped algorithms, models and tools. Determine the feasibility of detection of suspect dormant bots and of “weaponized botnets” – botnets currently operating that latch on to crisis situations and high-flowing trends to infiltrate and steer online conversations and initial assessment of their activities. Develop metrics and methods for detection and analysis of sophisticated botnets. Provide guidance for identification of especially impactful bots promoting social hysteria, violent content, or engaging in suspicious activities suitable for the creation of TTPs (Tactics, Techniques, and Procedures) for identification and evaluation. A working software prototype capability is desirable. Prepare a Phase II plan.

 

PHASE II: Develop a technology that military operators can use to identify and evaluate coordinated botnets before and during deployment of weaponized content (e.g., propaganda, social hysteria propagation content, disinformation, and polarizing information). Develop early detection and warning indicators of coordinated bot networks, capability to scan accounts for dormant bots, and a capability for tracking and monitoring the activities of coordinated bot networks. Ensure that model results are exportable to other tools in use by U.S. Navy, Marine Corps, or other military information operations tool kits (examples include Scraawl, Talkwalker, Dataminr).

Develop a user-friendly interface that is available for testing and evaluation. Insert desirable built-in help features and guidance capabilities. Additional requirements would be developed for Phase III through engagement with stakeholders and potential customers.

 

PHASE III DUAL USE APPLICATIONS: Make these technologies available on an existing cloud platform (e.g., Sunnet, Navy Tactical Cloud, Amazon Cloud) and enable them to ingest live data streams from social media analysis platforms or from the Application Programming Interfaces (APIs) of social media directly, guided by stakeholder requirements and needs. Create expansion and development of models and capabilities, including