This document presents the methodological framework built through four case studies conducted as part of the project “Decoding the Disinformation Playbook of Populism in Europe“. This methodology was developed and applied by the Croatian fact-checking organization Faktograf, investigative journalists at the German newspaper Taz, and researchers at the International Press Institute (IPI) to identify the elements of disinformation campaigns that fuel attacks – both online and offline – against journalists, fact-checkers, and media outlets, all of whom are at the forefront of combatting disinformation.

This methodological framework is not one-size-fits-all as the approach to investigating disinformation campaigns will always need to be adapted to the context. However, in sharing our methodology, we hope to provide other investigators and researchers with a useful tool for identifying the TTPs of disinformation campaigns that weaponise online harassment and intimidation and smear tactics against media outlets with the goal of silencing critical journalism and eroding the audience’s trust in reliable, evidence-based news.

The methodological framework consists of four main areas that guided our research:

1. Context and Description of the Attack:

Objective: 

This first step serves to understand who is the target of the intimidation and smear campaign and what was the article, project, or investigation that has triggered the attack under the scope of the research. In this step, the political and social context in which the attack occurred is also assessed. The context is important because it helps assess the reputational, emotional and physical risk that the attack can potentially have on the journalist or media outlet. Additionally, the accumulation of case studies helps us evaluate which contexts are prone to the development of disinformation campaigns –such as in the case of elections or civil unrest–, which, in turn, derive into coordinated attacks against the media.

Research Questions & Methodology:

1. What are the key events related to the attacks on the journalist or news organization? It is common best practice to start with a long interview with the targeted journalist or news organization. It is also important to keep the target in the loop during the investigation to analyze the potential risks for their safety of publishing certain elements of the investigation.
2. Who were the main actors and instigators of the attacks?
   1. Interviews on the ground with local experts and journalists specialized in the alleged instigators of the attacks.
   2. Review of internal documents and databases that the news outlet has on well-known purveyors of disinformation or instances of online attacks. Fact-checking organisations or news outlets tend to have already documented either the actors have instigated previous attacks or instances of attacks.
   3. Review of official documents, transcripts of parliamentary speeches instigating or fueling the attack.
3. What is the social dynamic that makes these attacks continue?
   1. Content analysis of both mainstream and fringe media reports on the subject, public protests, and other relevant issues.

2. Description of the Attack

Objective: 

Establish the anatomy of the attack. The goals are, first, to identify the trigger that initiates the smear campaign; second, to understand how the campaign is coordinated and disseminated, and the elements used to deploy the intimidating and smear campaign (such as videos, memes, etc.).

Research Questions & Methodology:

1. Establish the origin of the disinformation campaign that is the subject of the research.
   1. Create a timeline of the attack by reviewing articles, official documents, and any other sources.
      • Challenge: The attacks and hate campaigns against the journalist may not be a singular event, but rather repeated acts of defamation and an ongoing process. Creating a timeline will be helpful to understand the pattern.
      • Challenge: In the case study in Croatia, Faktograf found out that most of the governmental decisions adopted during the pandemic (the context in which the case study is framed) were published in a format that is difficult to analyze: Scanned pdf; a large number of amendments to decisions, etc.
2. What are the elements and forms of attacks and harassment?
   1. Identify the platforms used to disseminate the extremist narratives: Social media platforms, traditional media channels such as TV or radio, and in-person rallies or demonstrations.
      • Challenge: Social media reactions scattered and partly deleted.
   2. Identify the abusive messages against the subject. Use OSINT (open-source intelligence) to obtain datasets from different platforms. Segment datasets to focus on the time period that is the subject of the research, e.g., Electoral periods, civic turmoils.
      • Challenges:
        • Not every single posting cited as evidence is in itself a clear threat. Many threats are disguised by innuendo.
        • Some of the messages are posted in the so-called “dark social,” and they are difficult to access.
   3. Establish a timeline and compare the distribution of the messages across the platforms.
   4. Identify other types of attacks such as SLAPPs, the threat of legal proceedings against the targeted journalist, hacking attempts to gain access to the target’s devices or cyberattacks against news outlets servers or websites. 
3. Review messages to identify common triggering vectors such as memes, hashtags, videos, or photography disseminated through the platforms.
4. Analyze propaganda sites (disguised as “news” sites) that echo both online and offline disinformation campaigns against the press.
   • General challenge: Research of these extremist channels, platforms, and messages can be mentally and emotionally demanding for journalists and researchers.

3. Actors: Who is behind the attack?

Objective: 

Identify the actors (both State and non-State) at the initial stages of the disinformation and intimidation campaign, and also the actors who perpetrate the attacks and disseminate the abusive messages both online and offline in the attack.

Research Questions & Methodology:

1. Who are the most prominent and influential actors instigating the attacks? 
   1. Actors can be identified using social network analysis to map the network of the extremist and populism movement. It’s important to disambiguate between the actors who trigger the disinformation campaign, who also create a conducive environment where these attacks can take place, than those who factually carry out the intimidating and smear campaign.
   2. Review internal records, and for each detected actor, search for their social media profile and/or website and check approximately how much of their content is devoted to the target and to what extent this content is disinformation or attack.
   3. Relevant actors: We only mapped those actors or institutions of power behind long-lasting campaigns or severe accusations with large followings on social networks or a strong degree of influence in large segments of population.
      • Challenges:

• • • • Some actors deleted the original posts, and can only be found in the form of screenshots or articles in fringe media.
      • Hate postings were sometimes made anonymously with pseudonyms, and identification for contact was difficult.
      • Sometimes there is not a centrally or hierarchically organized group or institution behind the attacks, which makes it more difficult to identify the whole structure of the network.

4. Disinformation narratives: Framing of the journalists

Objective: 

Identify the smearing narratives against the target –journalists and news outlets– as well as the associated narratives that the purveyors of disinformation are trying to impose instead of the information published by the targeted journalist / media organisation.

Research Questions & Methodology:

1. What are the narratives of the disinformation campaigns? Use content analysis and data-driven AI-based technology when available to identify main narratives, both those targeting the journalists and news outlets and the associated disinformation narratives to identify the patterns of the attacks: I.e. Climate change, Replacement Theory, immigration, gender, etc.
2. Fact-checking the statements made to support narratives against the target.
3. Pay special attention to gendered-driven disinformation campaigns.
4. Interview on the ground with experts, colleagues of the journalists.
5. Interview with the actors to confront them with the consequences of their intimidating and smear campaign.
   • Challenges
     • Since some of the actors have contact with the extremist groups, it is also important to keep the safety of the journalists and researchers in mind when establishing contact. 
     • Decipher different codes and identify their meaning as a narrative. Anti-Semitic narratives, for example, occur more subtly.
     • Translation of pieces of text or news reports from the original language, which might result in the loss of the exact wording. This is especially important when covering attacks carried out in another country or when the analytical software can only process data in English.

These guidelines are continuously updated to address the constant evolution of both conspiracy and extremist narratives and the tactics they use for dissemination.