A Whole-of-Society Approach to Defending Democracy Against Influence Operations
Access toolkit here.
Influence operations targeting democratic societies have evolved in scale, coordination and strategic sophistication. They constitute a systemic risk to European democratic processes, public trust and societal cohesion, as well as long-term competitiveness and resilience. This threat is increasingly being recognised at both European and national levels, with detection capacity across the Union having significantly improved. However, no overarching coordinated method had yet been developed to systematically disrupt influence operations.
This white paper provides a first-of-a-kind operational toolkit to disrupt influence operations. The proposed Disruption Toolkit operationalises a whole-of-society approach, providing:
- A Disruption Framework comprising all the actions a practitioner can take to prepare the evidence needed for disruption, the disruption steps available, and steps to mitigate the effect of an influence operation if disruption fails or takes a long time;
- Guides and templates for the preparation, disruption, and mitigation measures;
- Step-by-step workflows to analyse, disrupt and mitigate six different kinds of influence operations, based on the Disruption Framework. These include coordinated inauthentic behaviour, deepfakes and manipulated content, Impersonation, sanctions circumvention, doxing and gendered smear campaigns targeting political candidates.
- An adaptation of these workflows to the national context of four EU countries;
- A digital research infrastructure, the Threat Intelligence Database and Coordination Platform (TRANSCRIPT), to enable the operationalisation of the framework, the aggregation of cases and threat actors’ assets, and the steps that have been taken to disrupt them.
While the framework was foremost developed to equip non-government actors, it is also a tool to support the work of governments.
The Framework represents the formalisation of the concrete collective experience of the largest counter-disinformation networks in Europe, involving open source intelligence researchers, fact-checkers, policy-makers, journalists, academics, stratcom professionals, cyber security experts, and national authorities across Europe.
The framework introduces a lifecycle-based model structured around three phases:
- Prepare – data collection, documentation, attribution and qualification of an influence operation;
- Disrupt – who to contact, when and how to disrupt ongoing activities.
- Mitigate – mitigating the harm from the operation and building long-term resilience.
This core model can be adapted to different national contexts, in Europe and beyond, by mapping relevant national actors, mandates, capacity, and legal frameworks. The Framework presented in this White Paper has already been localised, through a co-creative process, to the Romanian, Bulgarian, Polish and Czech contexts.
Practically, the framework enables the creation of national taskforces who have set workflows on how to detect, disrupt, and mitigate influence operations, in collaboration with government agencies. With shared standards, established frameworks, and common tools, these national taskforces can establish a pan-European decentralised web of responders who continuously disrupt threats towards European democracies, while being able to mobilise against regional or global crises. Additionally, the Framework lays the basis for a digital research infrastructure dedicated to data sharing, knowledge aggregation, a best practice repository, and response monitoring.
The Framework makes the most of what Europe has, because disruption is an immediate need. At the EU level, the framework complements and makes the most of existing legal and resilience instruments, without necessarily requiring further regulatory harmonisation. improving interoperability across Member States. It makes use of existing capabilities by providing the operational sequencing layer required for coordinated incident management under the emerging European Democracy Shield architecture. Embedding the framework logic within cross-border coordination mechanisms would strengthen collective situational awareness and alignment of disruption in multi-state incidents. Crucially, the framework is intended to protect fundamental rights within a democratic system, including the rights to freedom of expression and association.
The Disruption Toolkit represents a united European solution to a global challenge. It builds on years of theoretical research funded by the Horizon Europe Programme (e.g. the DISARM Framework), as well as on the experience of the Counter Disinformation Network (CDN), the EU-funded European Digital Media Observatory (EDMO) network, the Polish Resilience Council, the Digital Service Act implementation and the Code of Conduct on Disinformation Rapid Response System.
The Disruption Framework represents a scalable, concrete model to achieve the objectives of the European Democracy Shield and truly protect citizens from influence operations.
Key Takeaways for Decision-Makers
- By disrupting influence operations, we protect free and democratic discourse, acting on manipulative, inauthentic behaviour and threat actor infrastructure, rather than ever-changing content or narratives.
- The gap is operational timing, not capability – Member States already possess detection, regulatory and mitigation capacity. The recurring vulnerability lies in delayed escalation and uncoordinated workflows between detection and disruption.
- Response and resilience require standardisation, not centralisation. – The framework model (Prepare → Disrupt → Mitigate) sets a basic standard for evidence gathering, analysis and then points towards countermeasures. This improves coordination while fully respecting subsidiarity and national mandates.
- Early disruption reduces systemic harm – Structured disruption reduces the exposure of citizens to influence operations, reducing over-reliance on post-impact communication and reputational repair.
- Whole-of-society capacity can be operationalised – Civil society, media and independent monitoring actors frequently detect incidents first. Structured workflows and coordination mechanisms ensure early warning strengthens institutional response without transferring enforcement authority.
- A common operational language enhances EU interoperability – Embedding the framework within the European Democracy Shield architecture – including coordination through the Democracy Resilience Centre – would improve cross-border incident alignment and collective response coherence without requiring legal harmonisation.
