Disinformation
Disinformation is not simply false content. It is content deliberately designed and distributed to produce an effect: to devalue a company before a negotiation, to discredit a decision, to divert attention or to make a genuine document appear fabricated. Its strength lies in speed and in the asymmetry between publishing a claim and disproving it.
This area separates three questions that are usually confused: whether a claim is accurate, whether its distribution shows signs of coordination, and what actual damage it causes to the organisation. Each requires different evidence, and each supports a different response.
What the discipline covers
- Verification of specific content: origin, date, authorship, integrity of images, video and documents.
- Traceability of narratives: how a claim appears, where it is amplified and how it mutates as it spreads.
- Coordinated distribution patterns: inauthentic accounts, synchronised publication, recycled text and cross-platform relays.
- Manipulated and synthetic media, including altered documents and content generated or edited with automated tools.
- Reputational impact assessment: which audiences receive the claim and which decisions it can realistically influence.
Scope
Work is defensive and evidential. The objective is to give the organisation a documented basis for deciding whether to respond, how, and through which channel — never to run a counter-campaign.
- Verification dossier on a specific claim, image, video or document circulating publicly.
- Analysis of a narrative affecting the organisation, its executives, its sector or its regulator.
- Assessment of distribution: reach, audience, amplification pattern and signs of coordination.
- Explicit exclusions: no counter-messaging, no creation of accounts, no interaction with amplifiers, no attribution presented as proven.
Main risks and threats
- Coordinated reputational campaigns launched at the moment of maximum commercial or contractual sensitivity.
- Fabricated or manipulated documents presented as internal corporate material.
- Impersonation of executives or of the corporate account to issue false announcements to customers or investors.
- Genuine facts stripped of context and recombined into a misleading account that is hard to refute briefly.
- Corrosion of trust among staff, customers, partners or regulators before the organisation is even aware of the claim.
- Self-inflicted damage: an improvised or aggressive response that amplifies reach and legitimises the original claim.
Relevant indicators and warning signs
Signals of manipulated distribution are usually more measurable than the content itself: cadence, coincidence and account history say more than tone.
- Identical or near-identical wording appearing simultaneously across accounts with no coherent publication history.
- Sudden volume spikes with no corresponding coverage in traceable sources.
- Recently created accounts, or long-dormant accounts reactivated for a single topic.
- A claim that surfaces first in a marginal channel and is then cited as if already established.
- Documents circulating without provenance, with inconsistent metadata, formatting or internal chronology.
- Timing that coincides with a tender, a court date, a results announcement or a regulatory decision.
Application of OSINT
- Reverse tracing of images and video, and comparison with open satellite and street-level imagery for geolocation.
- Examination of file properties, formatting and internal chronology to test the plausibility of a document.
- Reconstruction of the diffusion timeline: earliest traceable appearance, relay points and inflection moments.
- Analysis of publicly available account metadata: creation date, publication cadence, textual repetition, cross-platform behaviour.
- Comparison with the organisation's own baseline of mentions, so ordinary criticism is not mistaken for a campaign.
Zero101OSINT methodology
- Three findings kept apart in every deliverable: accuracy of the content, characteristics of its distribution, and observed impact.
- Full evidence preservation, with archived copies, dates and hashes, so the dossier remains usable later.
- Authorship treated as a confidence level, never as a conclusion; commercial and ideological motives are considered in parallel.
- Impact measured against the audiences that matter to the organisation, not against raw view counts.
- Response options presented with their trade-offs, including the option of not responding at all.
- No engagement with the network under analysis, so that observation does not itself increase reach.
Open sources used
- Publicly accessible platform content and the account metadata the platforms themselves expose.
- Web archives and repositories that allow earlier versions of a page or claim to be recovered.
- Open satellite and street-level imagery for geolocation and for verification of visual material.
- Official statements, corporate registries, judicial decisions and regulatory publications used as reference evidence.
- Academic and institutional literature on information operations, together with press coverage that is always traced and rated.
Applications for companies, organisations and security decision-makers
- Establish, with documented evidence, whether a claim circulating about the organisation is accurate before reacting.
- Decide whether an episode is coordinated or ordinary criticism, which leads to very different responses.
- Provide legal teams with a preserved evidence file for takedown requests or judicial action.
- Support communications with a verified chronology instead of impressions built under time pressure.
- Prepare a protocol in advance, so the first hour of an episode is not improvised.
Products or analytical outputs Zero101OSINT can provide
- Verification dossier on a specific claim or document, with preserved evidence and reliability rating per element.
- Narrative report: origin, diffusion timeline, amplification pattern, audiences reached and observed impact.
- Impersonation review covering fake profiles, lookalike domains and false corporate announcements.
- Monitoring indicator set with thresholds, so the organisation can distinguish noise from a genuine change.
- Response protocol adapted to the organisation, including channels, owners and pre-agreed decision criteria.
Legal, ethical and reliability limitations
No accounts are created, no interaction with amplifiers takes place, no communities are infiltrated and no private communications are accessed. Verification relies on lawfully accessible published material and on evidence preserved without alteration.
Attribution of a coordinated campaign is inherently limited: coordination signals can be simulated, genuine communities can behave in ways that resemble automation, and platforms expose only part of the relevant data. Findings are issued with an explicit confidence level, an alternative explanation is always considered, and the analysis does not constitute a legal qualification of defamation, which requires legal advice.
Related articles
How a digital narrative about a company is built
Every organization has a digital narrative that is built with or without its participation. Analysis of how public information shapes corporate perception.
Read →Information dynamics on the internet: how public perception of a company evolves
A company's public perception on the internet is not static. Analysis of the mechanisms that transform corporate image in the digital environment.
Read →How to evaluate the reliability of public information in business environments
Analysis of criteria for evaluating the reliability of public information in business environments. Risks of unverified information and its impact on corporate decision-making.
Read →The illusion of transparency: why seeing information doesn't mean understanding it
Access to information doesn't guarantee its comprehension. Analysis of how the illusion of transparency generates false certainties in corporate decision-making.
Read →Confirmation bias in public information analysis
Confirmation bias distorts the interpretation of open data. Analysis of how cognitive biases compromise the quality of corporate intelligence.
Read →Online reputational risk: early warning signs that companies tend to ignore
When a reputational crisis becomes visible, the damage is already underway. Analysis of the early warning signs that allow anticipating and preventing corporate digital reputation deterioration.
Read →Related areas
Hybrid Threats
Grey zone, non-military coercion and combined campaigns below the conflict threshold.
Geopolitical Intelligence
Strategic reading of state scenarios, alliances and power balances with operational impact.
Cyber Intelligence
Digital exposure, attack surface and anticipation of information risks.
Need analysis in this area?
Describe the scope, the deadline and the decision the analysis has to support. You will receive the proposed approach, the limits of the assessment and the deliverable that can realistically be produced.
Get in touch