The operational vocabulary used across ObscureIQ's analysis of high-velocity information environments. These terms describe how belief forms faster than verification, how adversaries exploit the gap, and how institutional response has to be calibrated to keep up. Each entry links to its fuller treatment in the underlying analysis.
The foundational frame of the entire taxonomy. These four terms describe what narrative warfare is, what it does to belief, and why response timing is the central variable.
The point at which a narrative frame hardens into belief that resists later correction, regardless of subsequent evidence. Once captured, audiences filter new information through the existing frame rather than assess it on neutral terms. Cognitive capture is the central mechanism that makes early response doctrine more effective than late correction.
The structured contest over the meaning of an event during the period before facts can be established and verified. Unlike disinformation, which focuses on the content of false claims, narrative warfare exploits the structure of belief formation itself. State adversaries seed initial frames; domestic newsbrokers, influencers, and partisan interpreters legitimize, localize, and scale them. The strategic objective is rarely to install a single replacement story; it is to proliferate enough plausible lanes that public certainty becomes structurally impossible to assemble.
Analytical shorthand for the cognitive capture threshold in a high-velocity crisis: the window during which narrative structure is set before institutions can verify basic facts. The competitive prize inside the window is first-frame control, the position of the explanation that audiences encounter before any other, which sets the interpretive defaults the rest of the cycle has to argue against. The number is not a literal stopwatch but a planning threshold derived from the observed gap between trigger event and first credible official statement. Any response posture that begins at 30 minutes is already operating inside an occupied information environment.
The divergence between the official clock (physical manhunt, scene secured, evidence collected, briefings prepared) and the adversary clock (belief formation, first frame, first false witness). The official clock runs in hours or days. The adversary clock runs in minutes. The central planning error in modern crisis response is treating these two clocks as one.
The conditions beneath narrative warfare. Where the framework's other sections describe contested events and adversary playbooks, this section names the steady-state environment those events take place inside: the algorithmic substrate, the inversion of memory formation, and the mythic structures that engagement systems now produce. Drawn primarily from the analysis underlying JFK's Arithmetic.
Mythic narratives generated through engagement systems rather than cultural transmission. Where traditional myths formed across generations through retelling and refinement, algorithmic myths form across days through ranking and replication. The lifecycle is compressed and the half-life is shorter, but the binding effect on belief is structurally similar.
The phenomenon in which the public remembers events that did not happen, or were not experienced by the rememberer, with the same confidence and emotional weight as lived recall. Distinct from misinformation because the question is not whether the claim is true but whether the memory of having known it is. The endpoint of cognitive capture as it metabolizes into long-term belief.
The non-human, system-level math of engagement, ranking, and attention allocation that decides what surfaces in public consciousness and what does not. Different from narrative warfare in that it is not a contested arena but a steady-state condition; adversaries exploit the arithmetic rather than create it. Names the substrate on which everything else in the framework operates.
The internal machinery of narrative capture. How frames imprint, how they get adopted, how they harden into resistance, and the supporting concepts that explain audience selection and adversary handoff.
The point at which a narrative frame becomes operationally dangerous because high-reach accounts, perceived insiders, or trusted domestic amplifiers begin repeating it. Adoption converts an interpretive frame into a repeatable one, whether or not it has been verified. Once adoption occurs, the cost of correction rises sharply.
A piece of content engineered to activate audiences across opposing ideological positions through the same underlying material with different captioning. A single video may circulate to left-leaning and right-leaning audiences with entirely different framing, producing identical adoption from opposing emotional starting points. Bridge narratives are the structural signature of pre-positioned influence operations.
The point in a crisis at which an interpretive frame becomes resistant to later correction. Not a fixed time stamp but a behavioral threshold, defined by the moment when an emotionally coherent narrative has been adopted by enough high-reach amplifiers to function as common sense. The threshold defines the operational window in which counter-narrative work has leverage.
The transition point at which adversary-seeded frames are picked up and amplified by domestic newsbrokers, influencers, and partisan interpreters in native language and native grievance. Once handoff occurs, foreign fingerprints become invisible because they are no longer needed. Absence of detectable adversary origin after handoff is not evidence the threat has passed; it is evidence the operation succeeded.
The initial stage in which a vivid, emotionally coherent frame is adopted because it is usable, not because it is verified. Audiences in shock are not searching for complete explanations, they are searching for intelligible ones. Imprint is the fastest-moving stage and the one where pre-bunking has the highest leverage.
The narrative arc through which a perpetrator is converted into a tragic hero, whistleblower, or symbolic casualty of the system. The pivot can be foreign-accelerated (the Prigozhin pattern) or fully domestic (the Charlie Kirk pattern). Once a martyr frame locks in, even verified evidence about motive or method is filtered through the existing emotional structure.
The divergence between physical closure of an event (suspect in custody, weapon recovered, motive established) and informational closure of it (audiences stop asking what happened). Physical resolution operates on investigative timelines and ends with arrest, indictment, or trial. Narrative resolution depends on whether the cognitive capture window was contested in time, and may not arrive at all. The 1963 Kennedy assassination is the canonical case: every physical question is answered, the narrative remains unresolved sixty years on. Most institutional crisis plans treat physical resolution as a stop condition for the information operation, when it is not.
The progressive cleaning of a frame's origin through layered amplification: foreign source feeds domestic outlet, domestic outlet feeds aggregator, aggregator feeds mainstream pickup, mainstream pickup creates the appearance of organic consensus. Adjacent to the domestic handoff concept but distinct: handoff describes the transition point, laundering describes the process by which fingerprints disappear.
A doctrinal concept originating in Soviet and now Russian military theory: shaping an adversary's perception of a situation in ways that lead them to make decisions favorable to the manipulator while believing those decisions are their own. Older than most contemporary information operations vocabulary and more analytically precise than "manipulation." Notably underused in Western practitioner circles relative to its explanatory power.
The stage at which later evidence is filtered through an already-adopted frame rather than assessed on neutral terms. Clarification may continue to matter for elites and investigators but no longer reliably changes belief at scale. Resistance is the long-tail state most institutional responses are calibrated to but arrive too late to prevent.
A process in which a false or unavailable perpetrator identity is converted into a symbolic target class, enabling retaliation against people or places with no connection to the triggering event. Where misidentification cases involving an individual generate retaliation against that individual, target substitution operates at category level: when the false identity attaches to a group attribute (religion, immigration status, ethnicity), violence becomes available against any symbolic target of that category. Documented in the Southport case (July 2024), where a false identity claim coding the attacker as Muslim and migrant selected a nearby mosque with no connection to the attack as the substitute target. The mechanism is more dangerous than individual misidentification because the target set is much larger and identification of the substitute target requires no investigative work, only category-coded availability.
A model of crisis information consumption describing how audiences select content along three dimensions: veracity, emotional appeal, and relevance. Under normal conditions, veracity dominates. Under crisis conditions, veracity is compressed by time pressure while emotional appeal and identity relevance surge. The VER model explains why false claims often outperform accurate ones during the period that matters most.
The categories of fabricated content and the actors who carry it. The distinction between deepfake and synthetic witness is a category distinction, not a degree one, and it changes the response calculus entirely.
The term used by major platforms to describe networks of accounts that misrepresent who is behind them and act together to manipulate public discourse. Distinct from bot activity in that CIB networks can be entirely human-operated; the inauthenticity is in the coordination and identity, not the automation. CIB is the platform-policy term for an activity that, in operational analysis, often appears as adversary first-wave injection or as the ground-level mechanism behind a bridge narrative.
The use of altered, AI-generated, or selectively framed visual content to install an interpretive frame rather than to prove a factual claim. Whether the imagery is fabricated, edited, or authentic footage paired with a dishonest interpretation is operationally secondary; the function is to give audiences a coherent picture they can reason from. Stand-down clips and synthetic eyewitness video are common DIP instruments. The category names the persuasive function visual deception serves, distinct from deepfake (which names the production technique) and synthetic witness (which names the actor carrying it).
The term of art used by US intelligence and law enforcement (including FBI, ODNI, and CISA) for foreign-origin information operations conducted with intent to harm rather than as ordinary public diplomacy or overt foreign messaging. The "malign" qualifier carries legal and policy weight: it distinguishes covert or deceptive activity from open foreign communications. FMI overlaps with narrative warfare but is narrower; it specifies origin and intent, where narrative warfare describes the contest regardless of who runs it.
A high-engagement influencer account, pseudonymous aggregator, or partisan interpreter that acts as the first layer of narrative authority during fast-moving crises. Newsbrokers package speculation, clips, and screenshots into shareable frames before traditional institutions can respond. They do not need to prove a theory. They need to name the moment first, give it emotional direction, and supply a frame others can repeat.
Fabricated or selectively framed visual content suggesting that security personnel allowed an attack to occur. Stand-down deepfakes are a recurring first-wave adversary content category because they compress explanation into accusation: no argument required, only a clip with red circles. The format is designed to bypass deliberative analysis and trigger immediate moral framing.
AI-generated bystander personas providing fabricated eyewitness testimony across platforms during a crisis. They are fully constructed accounts with profile histories, location metadata, and posting patterns. Deepfakes ask audiences to evaluate media; synthetic witnesses ask them to evaluate people, which is harder under stress and currently undetectable at platform scale.
Where narrative warfare crosses out of social platforms into pricing, risk, and physical-world systems. The actuarial battlefield is the layer most institutional analysts watch last and adversaries exploit first.
The layer of crisis spillover where narrative shock moves through risk and pricing infrastructure before public consensus has formed. Insurers, war-risk underwriters, P&I clubs, freight planners, and automated trading systems react to uncertainty rather than verified facts. The actuarial battlefield is where information warfare becomes economic disruption, often hours before the headline market move.
The response side of the framework. Pre-positioned posture, not reactive tactics. Each of these terms describes a discipline that has to exist before a trigger event, not after.
Alternative frames designed to compete with hostile ones in the same emotional, identity, and timing registers, rather than to refute them factually. Often confused with rebuttals, which contradict claims point by point and rarely change adoption at scale. Effective counter-narratives are pre-positioned, pre-tested, and engineered to occupy the same psychological space as the frames they displace, which is why their development belongs to operational doctrine rather than to communications response.
The discipline of identifying, triaging, and countering synthetic media during the active phase of a high-velocity event. Structurally different from forensic deepfake analysis, which operates on long timelines. Crisis response operates inside the cognitive capture window, where speed and visibility matter more than final certainty.
A pre-approved, short, accurate communication deployable within the first five minutes of a trigger event. Its function is not to explain the event but to establish visible institutional presence, signal awareness, and buy time without surrendering the field. Holding statements are pre-positioned, not improvised.
The psychological foundation of pre-bunking: exposing audiences to weakened forms of misleading arguments so they develop resistance to the full versions when they encounter them. Operates on the same principle as biological vaccination, with the immune system being cognitive rather than physical. Provides the underlying mechanism that makes pre-bunking doctrine actionable rather than aspirational.
A condition in which institutions are legally or procedurally constrained from releasing information, and adversarial actors exploit the resulting silence as evidence of concealment. Distinct from slow communication: the official clock is not late, it is bound. Documented in the Southport case (July 2024), where UK youth-justice anonymity protections (investigation-stage protections under section 44 of the Youth Justice and Criminal Evidence Act 1999, and court-imposed reporting restrictions under section 45 once proceedings began) prevented Merseyside Police and media from publicly naming a 17-year-old suspect, and the lawful information vacuum was filled by a false identity claim that selected a substitute physical target before the restrictions could be lifted. The Recorder of Liverpool subsequently declined to maintain anonymity at Liverpool Crown Court on August 1, 2024, citing the misinformation vacuum directly, in effect documenting the failure mode in the court record. Response doctrine for this mode requires institutions to be able to authoritatively negate false claims even when they cannot affirmatively replace them, and to coordinate with judicial actors on conditional restriction-lifting where misinformation is producing public-order risk.
A parallel monitoring discipline that watches whether crowd-sourced suspect identification is converging on the wrong person, regardless of whether institutions sanction the search. Crowd OSINT is dual-use by definition. The misidentification track is the protective counterpart to the investigative track and runs alongside it from minute one.
A standing institutional unit dedicated to monitoring the information environment and producing communications response during a high-velocity event, structurally separated from the investigative track. The point is sequencing: investigators cannot pause forensics to triage a deepfake, but the senior official cannot wait six hours for legal review while synthetic audio accrues 20 million views. The cell handles one job; the investigators handle the other. Like the OSINT crisis playbook, the cell has to exist pre-trigger; it cannot be assembled during the event.
A structured, pre-positioned set of procedures that converts open-source intelligence capacity into actionable response during a high-velocity event. Treats OSINT as dual-use by design. The distinguishing feature is sequencing: a working playbook is not a list of capabilities but a minute-by-minute decision structure built to outpace the cognitive capture window.
The practice of preparing audiences and institutional systems for likely narrative attacks before a trigger event occurs, rather than attempting to debunk false claims after they have spread. Pre-bunking is built on the recognition that correction loses leverage once cognitive capture sets in. It is a posture, not a tactic.
The first-hour assignment of dedicated analyst capacity to identify deepfake video, AI-generated audio, and synthetic witnesses moving around an event. The point is not only to debunk later. It is to identify which fabrications are beginning to imprint while that still matters operationally.
Real-world events that demonstrate the mechanisms above operating at scale. Each case is treated in fuller detail in the case studies series. Definitions here are reference markers; the analyses are where the mechanic is shown working.
Reference case for framework discussions of cross-spectrum narrative formation around high-profile corporate killings. In the hours following the December 2024 fatal shooting of UnitedHealthcare CEO Brian Thompson, the information environment displayed a sustained cross-spectrum narrative arc that formed through domestic amplification networks rather than foreign-adversary seeding. Treated alongside other contemporary cases in the firm's framework discussions of domestically-driven narrative dynamics.
The documented disinformation pattern that followed the April 2022 discovery of mass civilian killings in Bucha, Ukraine. Russian state media pushed denial and staged-scene counter-narratives within hours of satellite imagery reaching public platforms. Foundational reference point demonstrating that satellite and forensic evidence does not automatically defeat emotionally coherent denial.
Reference case for framework discussions of how cross-spectrum narrative dynamics can form following politically motivated killings. In the days following the September 2025 killing of Charlie Kirk, the information environment displayed a sustained cross-spectrum narrative arc that formed through domestic amplification networks without the detectable foreign-direction inputs typical of state-driven cases. Discussed alongside Brian Thompson and other contemporary cases as part of the firm's evidence that this class of narrative dynamics can operate on domestic inputs alone.
The rapid Russian state-media attribution of the March 2024 attack on a Moscow-area concert venue to Ukrainian intelligence, despite ISIS-K claiming responsibility almost immediately. Demonstrates that false-flag attribution machinery can be pre-positioned and deployed on trigger rather than assembled in response.
Social-before-personal memory
The inversion of memory formation in the attention age, in which public memory of an event precedes and shapes individual memory rather than the reverse. The social field already contains the memory before any single person processes the event, and the individual remembers having known it because the public has already remembered. Reverses a sequencing assumption embedded in most older theories of public belief.