The First
60 Minutes.

The first three pieces in this series describe what happens. This one describes what to do.

Narrative Warfare establishes the framework: pre-positioned adversaries, compressed timelines, two clocks running on different schedules. The Social Media Battle demonstrates how a foreign-seeded operation becomes a self-sustaining domestic ecosystem in days. The Analyst Addendum provides the technical reference base.

Each of those documents ends at the same point: the analyst, the comms lead, the executive protection officer, the GSOC director closes the file knowing what they are facing — and lacking a clean answer to the question that follows.

What do we do in the first hour?

This doctrine answers that question. It is built for institutions whose first sixty minutes will determine whether they shape the public record of a crisis or inherit one written by adversaries. It assumes the conclusions of the prior three documents are accurate. It does not re-argue them.

"Most institutional crisis response is designed for a media environment that no longer exists. By the time the institutional clock catches up, the public record has already been written by someone else. The institutions that survive the next decade of these events will be the ones that built distribution capability before they needed it, not after."

Colby Scullion CEO, ObscureIQ

Narrative Warfare introduced the two clocks as analysis. Doctrine treats them as constraint.

The institutional clock measures verification: confirmation of facts, legal review, executive sign-off, coordination with relevant authorities. It runs at the speed of accountability — which is to say, slowly.

The adversary clock measures distribution: pre-positioned content released, narrative scaffolding deployed, synthetic witnesses activated, cross-platform amplification engaged. It runs at the speed of automation — which is to say, instantly.

The institutional clock cannot be sped up to match the adversary clock. Doctrine does not attempt this. Doctrine instead requires that institutions operate on both clocks simultaneously: verification work proceeds at its own pace, while a parallel track operates against the distribution clock with pre-approved language, pre-staged channels, and pre-delegated authorities.

This is the central operational principle of the doctrine. Every appendix in this document derives from it. Every minute of the timeline that follows assumes it. Pre-positioning is not an enhancement to crisis response — it is the only mechanism by which institutional response can occur at all in the present environment.

Required Actions

• Activation decision (binary: yes / no)
• Authority confirmation — who has decision rights at this stage
• Channel readiness check — drafted statements retrieved, monitoring infrastructure stood up
• Initial monitoring categories engaged across platforms, signals, and named-actor watchlists

Activation Criteria — Any One Triggers

1. Event involves principal under protection
2. Event location overlaps known operational footprint
3. Event involves named entity in published threat watch list
4. Event triggers above 100k mentions across monitored platforms within 60 seconds
5. Manual escalation by named on-call decision-maker

What Does NOT Trigger Activation

• Confirmation of facts. Activation precedes confirmation.
• Confirmation of attribution. Most events will be misattributed initially.
• Confirmation of intent. Most events will be deliberately reframed within minutes.

Required Actions

• Holding statement deployment via pre-approved channel
• Misidentification watch active
• Synthetic media triage active
• Platform escalation contacts engaged
• Internal coordination call activated

What a Phase 2 Statement Is

• An acknowledgment of the event without confirmation of details
• A naming of the institution's role and intent
• An establishment of the institution as a source of forthcoming information

What a Phase 2 Statement Is Not

• A press release
• A complete account
• A correction of misinformation
• A response to specific actors

It does not confirm casualty counts, identities, or attribution. It does not contradict information not yet verified. It does not engage with specific narrative claims. Pre-approved templates by event category live in Appendix A.

This is not a phase. It is a deadline.

By minute 17, public belief about the event has begun to harden. The first frame to reach scale is now resistant to correction. By minute 23 — when most institutional first statements arrive — capture is complete, and statements function as inputs to existing narratives rather than as authoritative accounts.

If any of the items in the right-hand column remain in legal review at minute 17, the doctrine has failed for this event. Recovery is possible. Capture is not.

"This is not a tactical preference. It is a cognitive constraint. Once the brain commits to a frame for an emotionally salient and informationally ambiguous event, that frame is held against contradicting evidence rather than abandoned in light of it. Investigative experience shows the pattern at the human scale. Cognitive security research confirms it at the population scale. Doctrine that does not respect this constraint will fail under stress."

Dr. Matthew Canham Executive Director, Cognitive Security Institute & Former Supervisory Special Agent, FBI

Required Actions

• Synthetic media triage decisions executing against decision tree (Appendix B)
• Misidentification escalation as warranted by matrix (Appendix C)
• Platform contact ladder engaged for confirmed manipulation
• Influencer monitoring for narrative consolidation
• Second statement preparation underway

Counter-Narrative Posture

Counter-narrative does not contest the adversary frame on its own terms. Contesting on the adversary's terms accepts the frame. A direct rebuttal of a synthetic witness affirms the synthetic witness as the subject of debate. A direct denial of an attribution claim affirms attribution as the relevant axis.

Doctrine reframes. The institution does not refute that an attribution is wrong; it asserts what is being done to verify, and through what channel that information will arrive. The frame becomes the institution's process — not the adversary's claim.

Required Actions

• Belief consolidation indicators measured against thresholds
• Cross-platform narrative coherence mapped
• Actuarial signal monitoring activated through secondary specialist track
• Executive briefing prepared for delivery within 60-minute mark
• Second statement deployment window approaches

Consolidation Indicators

• Single dominant frame across two or more platform ecosystems
• Recurring lexical signatures in unrelated accounts
• Temporal clustering of independent-seeming corroborations (synthetic-witness signature)
• Stabilization of misidentification — wrong name appearing in 50% or more of platform-referenced accounts

Actuarial Signals — Early Indicators

• Specific equities or sectors with movement disproportionate to public information
• Insurance markets pricing scenarios consistent with one narrative branch
• Supply chain disruption signals correlated with attribution direction
• Sovereign signal traffic — bond movement, currency moves — consistent with named state-actor framing

This document does not cover sustained operations in detail. The first sixty minutes determine whether sustained operations are recovery or response.

Sustained operations begin from one of two conditions:

Most institutional crisis response operates from Condition B. This doctrine is designed to operate from Condition A. Sustained operations under either condition are addressed in a separate document.

These templates are framing models, not final language. Final language requires institution-specific review prior to inclusion in operational binders. The templates demonstrate structure and scope, not literal content.

Template 04 is the slowest by design. Attribution language requires the most legal review pre-approval, which means it must be the most carefully prepared in advance. Institutions that have not pre-approved attribution-class language will not deploy it within the first hour.

Tier Definitions

• Tier 1. Immediate platform escalation, named-outlet coordination, public response within 30 min.
• Tier 2. Platform escalation, monitored response.
• Tier 3. Documented for analysis, public response only on threshold breach.

Action Definitions

• Monitor. Track but do not engage.
• Coordinate. Contact subject, offer support, pre-position institutional response.
• Outreach. Direct contact with misidentified individual; offer institutional resources.
• Escalate. Platform-level escalation, pre-prepared correction, named-outlet coordination.
• Activate. Trigger separate misidentification response track.
• Full activation. All resources, coordinated across functions.
• Crisis posture. Misidentification is now the primary event, regardless of original event status.

This document does not list specific platform contacts. Contacts change. Escalation categories do not.

Standing Categories

• Trust & Safety. Synthetic media, account manipulation, coordinated behavior.
• Public Policy. Government affairs, regulatory coordination.
• Press. Public-facing platform communications.
• Engineering. Technical issues affecting institutional accounts or content.

Actuarial signals are early indicators of which narrative branch is consolidating. They appear before public consensus does, because actuarial markets price probabilities, and probability moves before belief.

Categories Monitored

• Sector equities correlated to specific narrative branches
• Insurance markets — credit default swaps, terrorism reinsurance pricing
• Currency moves on attribution-driven narrative branches
• Sovereign bond movement on state-actor attributions
• Supply chain signals — shipping, manufacturing, commodity

Indicator Interpretation

• Pre-public movement. High signal value. The market has information the discourse does not.
• Concurrent movement. Confirmatory. The market and the discourse are aligned.
• Lagging movement. Reactive. Low signal value relative to active monitoring.

Actuarial signal monitoring must operate on a separate track from public-narrative monitoring. The signals do not arrive on the same channels and are interpreted by different specialists. An institution attempting to read both through the same workflow will read neither well.

This doctrine is not a substitute for legal counsel. Specific statements, escalation actions, and platform engagements require institution-specific legal review.

This doctrine is not a substitute for organization-specific protocols. Each institution operates under unique reporting obligations, regulatory environments, and stakeholder relationships. This document provides framework, not protocol.

This doctrine is not a comprehensive crisis communications plan. It addresses the first sixty minutes specifically, in the specific context of modern narrative warfare. Other crisis types — physical security, regulatory action, internal misconduct — operate on different doctrines.

This doctrine is not a guarantee. The system described in Narrative Warfare is designed to defeat institutional response. This doctrine raises the cost of capture and improves the probability of institutional voice reaching the conversation in time. It does not produce certainty.

For security teams (GSOC, executive protection)

The phases map directly to operational tempo. Activation criteria are decision-tree-ready. Run as tabletop quarterly, more often during elevated threat windows.

For communications teams

Templates in Appendix A are starting points for institution-specific holding statements. Pre-approval is the operational priority — the templates themselves matter less than having pre-approved versions ready in operational binders.

For executive protection

Phase 3 — the 17-minute threshold — is the principal-relevant section. Every protection program should know what authority decides on holding language, where pre-approved language lives, and how it gets to market in under 17 minutes.

For executives and board members

The summary section is the operational read. The decisions visible to executives during a crisis are downstream of decisions made before it.

For tabletop and training

Each phase block is a discrete exercise scenario. Combined sequences (Phase 1 → 5) make a 90-minute exercise. Full doctrine plus appendices makes a half-day workshop.