T0025.md

Technique T0025: Leak altered documents

• Summary: Obtain documents (eg by theft or leak), then alter and release, possibly among factual documents/sources.

• Belongs to tactic stage: TA06

Incident	Descriptions given for this incident
I00015 ConcordDiscovery	Forge ('release' altered hacked documents), hack/leak/manipulate/distort
I00017 US presidential elections	hack/leak/manipulate/distort
I00022 #Macronleaks	hack/leak/manipulate/distort
I00051 Integrity Initiative	hack/leak/manipulate/distort

Counters	Response types
C00008 Create shared fact-checking database	D04
C00011 Media literacy. Games to identify fake news	D02
C00012 Platform regulation	D02
C00014 Real-time updates to fact-checking database	D04
C00016 Censorship	D02
C00073 Inoculate populations through media literacy training	D02
C00074 Identify and delete or rate limit identical content	D02
C00082 Ground truthing as automated response to pollution	D03
C00085 Mute content	D03
C00096 Strengthen institutions that are always truth tellers	D07
C00107 Content moderation	D02
C00117 Downgrade / de-amplify so message is seen by fewer people	D04
C00119 Engage payload and debunk.	D07
C00122 Content moderation	D02
C00165 Ensure integrity of official documents	D02
C00176 Improve Coordination amongst stakeholders: public and private	D07
C00190 open engagement with civil society	D03
C00195 Redirect searches away from disinformation or extremist content	D02
C00200 Respected figure (influencer) disavows misinfo	D03
C00202 Set data 'honeytraps'	D02
C00205 strong dialogue between the federal government and private sector to encourage better reporting	D03
C00211 Use humorous counter-narratives	D03
C00219 Add metadata to content that’s out of the control of disinformation creators	D04

DO NOT EDIT ABOVE THIS LINE - PLEASE ADD NOTES BELOW