The Glossary

The point at which a narrative frame hardens into belief that resists later correction, regardless of subsequent evidence. Once captured, audiences filter new information through the existing frame rather than assess it on neutral terms. Cognitive capture is the central mechanism that makes early response doctrine more effective than late correction.

The structured contest over the meaning of an event during the period before facts can be established and verified. Unlike disinformation, which focuses on the content of false claims, narrative warfare exploits the structure of belief formation itself. State adversaries seed initial frames; domestic newsbrokers, influencers, and partisan interpreters legitimize, localize, and scale them. The strategic objective is rarely to install a single replacement story; it is to proliferate enough plausible lanes that public certainty becomes structurally impossible to assemble.

Analytical shorthand for the cognitive capture threshold in a high-velocity crisis: the window during which narrative structure is set before institutions can verify basic facts. The competitive prize inside the window is first-frame control, the position of the explanation that audiences encounter before any other, which sets the interpretive defaults the rest of the cycle has to argue against. The number is not a literal stopwatch but a planning threshold derived from the observed gap between trigger event and first credible official statement. Any response posture that begins at 30 minutes is already operating inside an occupied information environment.

The divergence between the official clock (physical manhunt, scene secured, evidence collected, briefings prepared) and the adversary clock (belief formation, first frame, first false witness). The official clock runs in hours or days. The adversary clock runs in minutes. The central planning error in modern crisis response is treating these two clocks as one.

Mythic narratives generated through engagement systems rather than cultural transmission. Where traditional myths formed across generations through retelling and refinement, algorithmic myths form across days through ranking and replication. The lifecycle is compressed and the half-life is shorter, but the binding effect on belief is structurally similar.

The phenomenon in which the public remembers events that did not happen, or were not experienced by the rememberer, with the same confidence and emotional weight as lived recall. Distinct from misinformation because the question is not whether the claim is true but whether the memory of having known it is. The endpoint of cognitive capture as it metabolizes into long-term belief.

The inversion of memory formation in the attention age, in which public memory of an event precedes and shapes individual memory rather than the reverse. The social field already contains the memory before any single person processes the event, and the individual remembers having known it because the public has already remembered. Reverses a sequencing assumption embedded in most older theories of public belief.

The non-human, system-level math of engagement, ranking, and attention allocation that decides what surfaces in public consciousness and what does not. Different from narrative warfare in that it is not a contested arena but a steady-state condition; adversaries exploit the arithmetic rather than create it. Names the substrate on which everything else in the framework operates.

The point at which a narrative frame becomes operationally dangerous because high-reach accounts, perceived insiders, or trusted domestic amplifiers begin repeating it. Adoption converts an interpretive frame into a repeatable one, whether or not it has been verified. Once adoption occurs, the cost of correction rises sharply.

A piece of content engineered to activate audiences across opposing ideological positions through the same underlying material with different captioning. A single video may circulate to left-leaning and right-leaning audiences with entirely different framing, producing identical adoption from opposing emotional starting points. Bridge narratives are the structural signature of pre-positioned influence operations.

The point in a crisis at which an interpretive frame becomes resistant to later correction. Not a fixed time stamp but a behavioral threshold, defined by the moment when an emotionally coherent narrative has been adopted by enough high-reach amplifiers to function as common sense. The threshold defines the operational window in which counter-narrative work has leverage.

The transition point at which adversary-seeded frames are picked up and amplified by domestic newsbrokers, influencers, and partisan interpreters in native language and native grievance. Once handoff occurs, foreign fingerprints become invisible because they are no longer needed. Absence of detectable adversary origin after handoff is not evidence the threat has passed; it is evidence the operation succeeded.

The initial stage in which a vivid, emotionally coherent frame is adopted because it is usable, not because it is verified. Audiences in shock are not searching for complete explanations, they are searching for intelligible ones. Imprint is the fastest-moving stage and the one where pre-bunking has the highest leverage.

The narrative arc through which a perpetrator is converted into a tragic hero, whistleblower, or symbolic casualty of the system. The pivot can be foreign-accelerated (the Prigozhin pattern) or fully domestic (the Charlie Kirk pattern). Once a martyr frame locks in, even verified evidence about motive or method is filtered through the existing emotional structure.

The divergence between physical closure of an event (suspect in custody, weapon recovered, motive established) and informational closure of it (audiences stop asking what happened). Physical resolution operates on investigative timelines and ends with arrest, indictment, or trial. Narrative resolution depends on whether the cognitive capture window was contested in time, and may not arrive at all. The 1963 Kennedy assassination is the canonical case: every physical question is answered, the narrative remains unresolved sixty years on. Most institutional crisis plans treat physical resolution as a stop condition for the information operation, when it is not. See also: closure function in Narrative Mass Framework.

The progressive cleaning of a frame's origin through layered amplification: foreign source feeds domestic outlet, domestic outlet feeds aggregator, aggregator feeds mainstream pickup, mainstream pickup creates the appearance of organic consensus. Adjacent to the domestic handoff concept but distinct: handoff describes the transition point, laundering describes the process by which fingerprints disappear.

A doctrinal concept originating in Soviet and now Russian military theory: shaping an adversary's perception of a situation in ways that lead them to make decisions favorable to the manipulator while believing those decisions are their own. Older than most contemporary information operations vocabulary and more analytically precise than "manipulation." Notably underused in Western practitioner circles relative to its explanatory power.

The stage at which later evidence is filtered through an already-adopted frame rather than assessed on neutral terms. Clarification may continue to matter for elites and investigators but no longer reliably changes belief at scale. Resistance is the long-tail state most institutional responses are calibrated to but arrive too late to prevent.

A process in which a false or unavailable perpetrator identity is converted into a symbolic target class, enabling retaliation against people or places with no connection to the triggering event. Where misidentification cases involving an individual generate retaliation against that individual, target substitution operates at category level: when the false identity attaches to a group attribute (religion, immigration status, ethnicity), violence becomes available against any symbolic target of that category. Documented in the Southport case (July 2024), where a false identity claim coding the attacker as Muslim and migrant selected a nearby mosque with no connection to the attack as the substitute target. The mechanism is more dangerous than individual misidentification because the target set is much larger and identification of the substitute target requires no investigative work, only category-coded availability.

A model of crisis information consumption describing how audiences select content along three dimensions: veracity, emotional appeal, and relevance. Under normal conditions, veracity dominates. Under crisis conditions, veracity is compressed by time pressure while emotional appeal and identity relevance surge. The VER model explains why false claims often outperform accurate ones during the period that matters most.

The term used by major platforms to describe networks of accounts that misrepresent who is behind them and act together to manipulate public discourse. Distinct from bot activity in that CIB networks can be entirely human-operated; the inauthenticity is in the coordination and identity, not the automation. CIB is the platform-policy term for an activity that, in operational analysis, often appears as adversary first-wave injection or as the ground-level mechanism behind a bridge narrative.

The use of altered, AI-generated, or selectively framed visual content to install an interpretive frame rather than to prove a factual claim. Whether the imagery is fabricated, edited, or authentic footage paired with a dishonest interpretation is operationally secondary; the function is to give audiences a coherent picture they can reason from. Stand-down clips and synthetic eyewitness video are common DIP instruments. The category names the persuasive function visual deception serves, distinct from deepfake (which names the production technique) and synthetic witness (which names the actor carrying it).

The term of art used by US intelligence and law enforcement (including FBI, ODNI, and CISA) for foreign-origin information operations conducted with intent to harm rather than as ordinary public diplomacy or overt foreign messaging. The "malign" qualifier carries legal and policy weight: it distinguishes covert or deceptive activity from open foreign communications. FMI overlaps with narrative warfare but is narrower; it specifies origin and intent, where narrative warfare describes the contest regardless of who runs it.

A high-engagement influencer account, pseudonymous aggregator, or partisan interpreter that acts as the first layer of narrative authority during fast-moving crises. Newsbrokers package speculation, clips, and screenshots into shareable frames before traditional institutions can respond. They do not need to prove a theory. They need to name the moment first, give it emotional direction, and supply a frame others can repeat.

Fabricated or selectively framed visual content suggesting that security personnel allowed an attack to occur. Stand-down deepfakes are a recurring first-wave adversary content category because they compress explanation into accusation: no argument required, only a clip with red circles. The format is designed to bypass deliberative analysis and trigger immediate moral framing.

AI-generated bystander personas providing fabricated eyewitness testimony across platforms during a crisis. They are fully constructed accounts with profile histories, location metadata, and posting patterns. Deepfakes ask audiences to evaluate media; synthetic witnesses ask them to evaluate people, which is harder under stress and currently undetectable at platform scale.

The layer of crisis spillover where narrative shock moves through risk and pricing infrastructure before public consensus has formed. Insurers, war-risk underwriters, P&I clubs, freight planners, and automated trading systems react to uncertainty rather than verified facts. The actuarial battlefield is where information warfare becomes economic disruption, often hours before the headline market move.

Alternative frames designed to compete with hostile ones in the same emotional, identity, and timing registers, rather than to refute them factually. Often confused with rebuttals, which contradict claims point by point and rarely change adoption at scale. Effective counter-narratives are pre-positioned, pre-tested, and engineered to occupy the same psychological space as the frames they displace, which is why their development belongs to operational doctrine rather than to communications response.

The discipline of identifying, triaging, and countering synthetic media during the active phase of a high-velocity event. Structurally different from forensic deepfake analysis, which operates on long timelines. Crisis response operates inside the cognitive capture window, where speed and visibility matter more than final certainty.

A pre-approved, short, accurate communication deployable within the first five minutes of a trigger event. Its function is not to explain the event but to establish visible institutional presence, signal awareness, and buy time without surrendering the field. Holding statements are pre-positioned, not improvised.

The psychological foundation of pre-bunking: exposing audiences to weakened forms of misleading arguments so they develop resistance to the full versions when they encounter them. Operates on the same principle as biological vaccination, with the immune system being cognitive rather than physical. Provides the underlying mechanism that makes pre-bunking doctrine actionable rather than aspirational.

A condition in which institutions are legally or procedurally constrained from releasing information, and adversarial actors exploit the resulting silence as evidence of concealment. Distinct from slow communication: the official clock is not late, it is bound. Documented in the Southport case (July 2024), where UK youth-justice anonymity protections (investigation-stage protections under section 44 of the Youth Justice and Criminal Evidence Act 1999, and court-imposed reporting restrictions under section 45 once proceedings began) prevented Merseyside Police and media from publicly naming a 17-year-old suspect, and the lawful information vacuum was filled by a false identity claim that selected a substitute physical target before the restrictions could be lifted. The Recorder of Liverpool subsequently declined to maintain anonymity at Liverpool Crown Court on August 1, 2024, citing the misinformation vacuum directly, in effect documenting the failure mode in the court record. Response doctrine for this mode requires institutions to be able to authoritatively negate false claims even when they cannot affirmatively replace them, and to coordinate with judicial actors on conditional restriction-lifting where misinformation is producing public-order risk.

A parallel monitoring discipline that watches whether crowd-sourced suspect identification is converging on the wrong person, regardless of whether institutions sanction the search. Crowd OSINT is dual-use by definition. The misidentification track is the protective counterpart to the investigative track and runs alongside it from minute one.

A standing institutional unit dedicated to monitoring the information environment and producing communications response during a high-velocity event, structurally separated from the investigative track. The point is sequencing: investigators cannot pause forensics to triage a deepfake, but the senior official cannot wait six hours for legal review while synthetic audio accrues 20 million views. The cell handles one job; the investigators handle the other. Like the OSINT crisis playbook, the cell has to exist pre-trigger; it cannot be assembled during the event.

A structured, pre-positioned set of procedures that converts open-source intelligence capacity into actionable response during a high-velocity event. Treats OSINT as dual-use by design. The distinguishing feature is sequencing: a working playbook is not a list of capabilities but a minute-by-minute decision structure built to outpace the cognitive capture window.

The practice of preparing audiences and institutional systems for likely narrative attacks before a trigger event occurs, rather than attempting to debunk false claims after they have spread. Pre-bunking is built on the recognition that correction loses leverage once cognitive capture sets in. It is a posture, not a tactic.

The first-hour assignment of dedicated analyst capacity to identify deepfake video, AI-generated audio, and synthetic witnesses moving around an event. The point is not only to debunk later. It is to identify which fabrications are beginning to imprint while that still matters operationally.

Reference case for framework discussions of cross-spectrum narrative formation around high-profile corporate killings. In the hours following the December 2024 fatal shooting of UnitedHealthcare CEO Brian Thompson, the information environment displayed a sustained cross-spectrum narrative arc that formed through domestic amplification networks rather than foreign-adversary seeding. Treated alongside other contemporary cases in the firm's framework discussions of domestically-driven narrative dynamics.

The documented disinformation pattern that followed the April 2022 discovery of mass civilian killings in Bucha, Ukraine. Russian state media pushed denial and staged-scene counter-narratives within hours of satellite imagery reaching public platforms. Foundational reference point demonstrating that satellite and forensic evidence does not automatically defeat emotionally coherent denial.

Reference case for framework discussions of how cross-spectrum narrative dynamics can form following politically motivated killings. In the days following the September 2025 killing of Charlie Kirk, the information environment displayed a sustained cross-spectrum narrative arc that formed through domestic amplification networks without the detectable foreign-direction inputs typical of state-driven cases. Discussed alongside Brian Thompson and other contemporary cases as part of the firm's evidence that this class of narrative dynamics can operate on domestic inputs alone.

The rapid Russian state-media attribution of the March 2024 attack on a Moscow-area concert venue to Ukrainian intelligence, despite ISIS-K claiming responsibility almost immediately. Demonstrates that false-flag attribution machinery can be pre-positioned and deployed on trigger rather than assembled in response.

The accumulated weight of unresolved interpretation around a single event. Distinct from volume of coverage or ongoing relevance: mass requires four conjunctive components, namely substantial volume, diverse interpretation, sustained persistence, and unresolvable contradiction. Most events lack at least one and decay normally. The few that exhibit all four accumulate rather than fade, with the record growing denser over time, not thinner. The Kennedy assassination, the Epstein case, the September 11 attacks, the Diana case, and the question of COVID-19's origins are the canonical examples.

The pull a high-mass event exerts on adjacent attention. Explains why certain events generate new books, films, podcasts, and discourse decades after they occurred, disproportionate to any change in their underlying relevance. Each generation gets recruited into the field, contributes to it, and increases the mass. The mechanism predates the modern information environment; what AI and algorithmic distribution provide is throughput, not the pull itself.

The threshold past which the system can no longer compress an event into a stable record. Not a number but a condition: criticality is crossed when the rate of new variant generation exceeds the rate at which any available closure process can absorb them. Past the threshold, the event is no longer being remembered in any ordinary sense. It is actively destabilizing, and the record is maintained only through continuous reconciliation work that never reaches an end state. Identifiable retrospectively more easily than prospectively.

The selection mechanism that determines which events are candidates for narrative mass. Certain structural slots, including the slain leader, the hidden cabal, the captive princess, the visitor from elsewhere, the fallen citadel, and the vanishing, predate the modern information environment and shape which events the cultural imagination has somewhere to put. Kennedy fills the slain king slot. September 11 fills the fallen citadel slot. Epstein fills the rot-behind-the-throne slot. Most events do not fit any slot deeply and decay normally; candidates for accumulation fit one or more.

The cultural infrastructure that converts accumulated narrative mass into stabilized myth. Operates when a culture has a small set of trusted authorities, slow distribution of variants relative to consensus formation, and shared frameworks for what a settled account looks like. Lincoln's assassination occupied the same archetypal slot Kennedy's would a century later; the difference in outcome is structural. Lincoln's era still had the closure function intact. Kennedy's did not. Distinguishes events that accumulate mass and resolve from events that accumulate mass and never close.

The period during which intervention can still affect an event's interpretive load before the system crosses interpretive criticality. After the window closes, the recoil dynamic takes over and conventional intervention becomes counterproductive. Duration depends on three variables: how deeply the event lands in an archetypal slot, the rate of variant generation, and the analyst's ability to reconstruct closure conditions locally. The seventeen-minute window is a subset of the closure window where structured intervention operates at maximum leverage.

The analytical posture for events still within the closure window. Establishes, for one specific event, the conditions under which the closure function can operate even though those conditions are absent in the broader culture. Components include establishing a small set of trusted authorities before competing authorities can be improvised, framing a consensus baseline before variants proliferate, acknowledging the archetypal slot directly to deflate its pull, and providing a complete official account quickly enough that gaps cannot be filled by speculation. Not correction, because there is nothing to correct yet. Preemptive structuring.

The structural property of high-mass fields that prevents any single operation, including extrusion, from collapsing the accumulated interpretive load. Emerges from a property unique to mass-bearing events: their stability is contested interpretation, not consensus. Any input that threatens the contest gets folded back into it. Explains why fact-checking, file releases, official commissions, and named perpetrators tend to add to high-mass fields rather than discharge them. Correction is contribution. The field cannot be drained, only fed.

The first of four field operations the framework predicts at criticality. The system, having failed to compress an event into a stable record, reaches for the missing source instead. Whatever is most absent from the record, and most needed to reconcile the contradictions, gets pushed toward presence: a person, a document, a confession. The hard reading is metaphysical and is the conceit of the companion novella. The soft reading is observational: AI systems generate the missing testimony, synthetic media produce the missing footage, and the contest about authenticity itself becomes part of the mass. Also called temporal extrusion.

The second of four field operations. Warps the present without a backward pull. Rather than producing a missing source, the field corrupts current reality by generating overlapping interpretations that compete for the same factual space. Pizzagate, QAnon, election denial loops, and COVID origin narratives are canonical examples. The missing source in contamination is not a person or document; it is consensus itself. The field maintains the contest by ensuring no shared baseline can stabilize. Characters caught in contamination fields lose their ability to locate themselves in shared reality.

The third of four field operations. Figures who never quite died in cultural memory continue to arrive across decades. Elvis, Tupac, Diana, Cobain. Sightings, sequels, posthumous discoveries, AI reconstructions, and anniversary cycles all serve the same function. The figure does not return because anyone needs them to; the field continues to produce them because the closure function failed at the time of death and has never since recovered. Revenance is extrusion at low intensity over long duration.

The fourth field operation and the only agent-driven one in the typology. The inverse of extrusion: rather than the field producing a missing source, agents attempt to suppress the contest through direct manipulation of the field. State-sponsored memory management, Holocaust denial, Tiananmen erasure, campaigns to relitigate settled events as unsettled, campaigns to declare unsettled events resolved by fiat. The framework predicts such operations rarely succeed at their stated goal. They more often add to the mass than reduce it; the campaigns themselves become part of the field they sought to control.