Deplatforming by Design

Tools and Tactics of Modern Influence Operations

May 27, 2025

Organizations like the Center for Countering Digital Hate (CCDH) and Reality Team/Acronym employ sophisticated digital toolsets and frameworks to identify, analyze, and deplatform individuals or groups they classify as spreading harmful content or disinformation across social media platforms.

The image below is from the Disinformation/Malign Influence Training presentation for the DISARM Foundation in 2022.

This article outlines how such a process is carried out, based on the toolset commonly used in the field of disinformation analysis and influence operations.

https://www.slideshare.net/slideshow/csw202201introductionpptxpdf/252713540

1. Data Gathering

Crowdtangle, TinEye/Yandex, Hypothes.is, Maltego, Profil3r, CheckUserNames, Hootsuite
These tools are used to identify, track, and monitor targets (individuals, hashtags, narratives, or communities) on social media.
- Crowdtangle & Hootsuite: Monitor trending topics, hashtags, and influential accounts.
- TinEye/Yandex: Reverse image search to trace meme or image origins.
- Maltego & Profil3r: Map social networks, gather open-source intelligence (OSINT) on targets.
- CheckUserNames: Find a target’s presence across multiple platforms.

2. Data Storage and Sharing

CSVs, STIX/TAXII, Archive.org
Collected data is organized, stored, and shared among group members.
- CSVs: Store lists of targets, accounts, or content.
- STIX/TAXII: Share threat intelligence in a structured format.
- Archive.org: Preserve evidence of posts or accounts before they are deleted.

3. Analysis

Jupyter Notebooks, Python Libraries (Pandas), Gephi, AMITT Navigator, inVid, BuiltWith
The group analyzes the data to identify vulnerabilities, amplify disinformation, or coordinate attacks.
- Pandas: Clean and analyze large datasets (e.g., tweet histories, follower lists).
- Gephi: Visualize and map networks of influence or bot clusters.
- AMITT Navigator: Plan and track disinformation tactics using the AMITT (Adversarial Misinformation and Influence Tactics and Techniques) framework, which is closely related to DISARM.
- inVid: Analyze and verify videos for manipulation or to create misleading content.
- BuiltWith: Gather intelligence on websites linked to targets.

4. Information Sharing

MISP, Ticketing System, Googledocs, Spreadsheets
The group coordinates actions and shares intelligence.
- MISP: Share threat intelligence (e.g., lists of accounts to report or target).
- Ticketing System: Assign tasks (e.g., mass reporting, spreading specific narratives).
- Googledocs/Spreadsheets: Share plans, scripts, or lists of targets.

5. Response (Action Phase)

Googledocs & Spreadsheets
The group executes coordinated actions:
- Mass reporting: Members use shared lists to report specific accounts or content, aiming to trigger platform moderation and deplatform the target.
- Amplification: Bots/trolls spread disinformation, coordinate hashtags, or flood replies to drown out opposing voices.
- Documentation: Track the progress and results of their campaigns.

DISARM Framework Integration

The DISARM framework (Disinformation Analysis and Risk Management) is a structured approach to understanding and countering disinformation. In this context, the group would use it to:

Map out the disinformation campaign (objectives, targets, tactics)
Assign roles and tasks (using ticketing systems and shared docs)
Monitor effectiveness (using analytics from Crowdtangle, Hootsuite, and data analysis tools)
Iterate and adapt tactics (based on platform responses and campaign success)

Example Workflow

Identify a Target
Using OSINT tools (Maltego, Profil3r), the group maps the target’s network and social media presence.
Monitor Activity
Crowdtangle and Hootsuite are used to track the target’s posts and engagement.
Plan Attack
Using the DISARM framework, the group develops a campaign:
- Spread false narratives about the target
- Coordinate mass reporting to get the target suspended
Coordinate Actions
Share instructions and reporting links via Googledocs, spreadsheets, and ticketing systems.
Execute and Monitor
Members carry out reporting and amplification, while analysts use Pandas and Gephi to track impact and adapt tactics.

By leveraging this structured toolset and workflow—often under the guidance of frameworks like DISARM—groups such as CCDH and Reality Team/Acronym are able to systematically identify, analyze, and take coordinated action against their chosen victims on social media. This approach enables them to influence platform moderation decisions and, in many cases, achieve the de-platforming of individuals or organizations they deem problematic.