Counter Disinformation Operations
When false information is spreading about your organisation, you do not have to face it alone.
When a coordinated disinformation campaign, smear, or fabricated narrative targets your business or your people, we work to understand it, identify where it may come from, limit how far it travels, and pursue removal where possible. And we are straight with you about what can and cannot be changed.
What we actually do when you are being attacked.
Every campaign is different, so the work is directed by relevant context and judgement, not a fixed checklist. An operation almost always moves through the same five lines of effort. We describe these as what we work to achieve rather than guaranteed outcomes, because in this domain the honest position is that some content cannot be removed and some sources cannot be named with certainty. The value is in how each call is made, and in doing the achievable things properly.
1. Establish Context
We map the false claim across every channel carrying it. We cover social platforms, forums, niche press, wider web search results, and AI assistants, to measure how far it has actually travelled. The first judgement is the most important: is this a coordinated campaign, or organic criticism that happens to hurt? The two demand opposite responses, and treating one as the other makes it worse.
2. Map the Actors
Using open-source intelligence and network analysis, we work to identify the actors driving the campaign and the infrastructure behind it — separating real people from fake accounts, bots, and sock puppets, and reading the timing and behaviour that betray coordination. Knowing who is attacking you, and why, changes every decision that follows.
3. Determine the Response
This is the call that separates expertise from instinct. Responding publicly to a low-reach lie can hand it an audience it never had — so we weigh reach, the audiences affected, and the campaign's objective to decide whether to disrupt it quietly, correct the record where it carries weight, or deliberately deny it the oxygen of a reaction. Often the right move is not the loudest one.
We pursue takedowns through the routes that actually work: platform enforcement against coordinated inauthentic behaviour, impersonation, harassment, and synthetic or AI-generated media; and evidenced referral to your lawyers for defamation or injunctive action. Not everything can be removed as some content is lawful, and some platforms will not act. Where removal is not available we work to limit its reach and erode its credibility, and to make sure the accurate account is present and authoritative where the people the campaign is targeting will look.
4. Pursue Removal, and limit Exposure
5. Record , Learn, and Prepare
Everything is preserved to an evidential standard so you hold a record that stands up in front of a platform, a court, or your board, and can act on it long after the campaign fades. We then show you how the attack got traction, so actions can be taken to ensure that the next one meets a prepared organisation rather than a surprised one.
Find out more
A press statement does not stop an adversary who is fabricating the story.
Disinformation campaigns cannot be classed simply as bad publicity. They are deliberate, often coordinated operations a fabricated allegation seeded across forums and social media platforms, a network of inauthentic accounts amplifying a claim until it looks like consensus, a manufactured controversy timed to influence a funding round, a deal, or a public appearance.
Left alone, a false narrative can be dangerous. It can be repeated until it is treated as fact, picked up by people acting in good faith, and absorbed into search results, due-diligence checks, and the assumptions of customers, partners, and regulators. By the time it reaches the boardroom as a reputational problem, the operation that created it has usually already achieved its aim.
Public relations or communications teams manage what you say. Legal can act once a line is crossed. Neither is built to investigate who is attacking you, test what can be proven, and work against the campaign itself while it is still moving. That is the gap a counter-disinformation operation is built to address and why it is a distinct discipline. We are candid from the outset about what is realistic in your situation; the value is in doing the right things well, not in promising an outcome no one can guarantee.
Greatest resilience comes from a proactive, always-on capability.
You can engage us either way, but the two are not equal. A retained relationship is where this work is most effective: we already understand your information landscape, your sensitivities, and your likely threats, so when something starts we are responding from minute one rather than spending the first days learning who you are. A one-off project can absolutely help in a live crisis — but a large part of any ad-hoc engagement is context-building that a retained client has already behind them.
Always-On Disinformation Monitoring & Remediation
An established relationship, ready to act.
We hold a live picture of your information environment and stay close to your pain points, so a response begins the moment a campaign emerges — not after a contract is negotiated mid-crisis. The context building that slows an ad-hoc job is already done, which means faster, better-judged action when it matters.
Continuously updated understanding of your information landscape and sensitivities
A baseline of normal, so anomalies are spotted sooner
Defined escalation and immediate mobilisation
Ongoing monitoring feeding straight into response
Integration with your comms, legal, and security teams
Ad-hoc projects as unforeseen needs arise
For unforeseen needs as they arise. If something is happening now and you have no current support in place, we can still help — a scoped operation against a specific campaign, with clear boundaries on what we will look at and what we are working to achieve. The honest trade-off is that the opening phase is necessarily spent building the context a retained client already holds, so the same job moves faster under a standing relationship.
Rapid assessment of the campaign and its reach
Source tracing and attribution to agreed confidence levels
Containment and takedown effort across the relevant platforms
Closing report and evidence pack for legal or board use
Questions about Counter-Disinformation Operations Services
What is a counter-disinformation operation?
A counter-disinformation operation is a coordinated response to a disinformation campaign targeting an organisation. It combines investigation, source attribution, narrative containment, and content remediation: establishing what false claim is spreading and where, identifying who is driving it and how, reducing its reach and credibility, getting fabricated content removed where possible, and restoring an accurate information environment around the target.
How is this different from PR or crisis communications?
PR and crisis communications manage the message your organisation sends out to your organisation and the world. Counter-disinformation acts on the hostile campaign itself: it investigates the actors and infrastructure behind the false narrative, separates organic criticism from coordinated manipulation, and works to remove or de-amplify fabricated content through platform enforcement and legal routes. The two are complementary, but a press statement alone does not stop an adversary who is fabricating and seeding false claims.
Can you find out who is behind a disinformation campaign or smear?
Often, yes. Using open-source intelligence (OSINT), network analysis, and behavioural indicators, it is frequently possible to attribute a campaign to a coordinated source, distinguish real accounts from inauthentic ones, and document the infrastructure and tradecraft involved. Attribution is reported with stated confidence levels rather than asserted as certainty, and the evidence is preserved to a standard that supports legal and platform action.
Can false or defamatory content actually be removed?
Frequently, yes, though not always. Removal routes include platform enforcement against policy violations such as coordinated inauthentic behaviour, impersonation, harassment, and synthetic or AI-generated media; evidenced referral to legal counsel for defamation or injunctive action; and de-amplification where outright removal is not available. The right route depends on the platforms involved, the jurisdiction, and whether the activity is unlawful, manipulative, or hostile but lawful.
Should we always respond publicly to disinformation?
No, and assuming you should is a common, costly mistake. Responding to a low-reach false claim can amplify it to an audience that would otherwise never have seen it. A central judgement in any operation is whether to disrupt the campaign quietly, correct the record publicly, or deliberately starve it of attention. That decision rests on the reach, the audiences affected, and the campaign's likely objective — not on how loud it feels.
How quickly can you respond?
An initial assessment of the campaign, its reach, and its likely source can typically begin within hours of instruction. Retained clients have a pre-agreed escalation path and mobilise immediately. Early intervention materially affects the outcome: a false narrative contained before it is widely adopted is far easier to address than one that has settled and is being repeated as fact.
Who needs counter-disinformation operations?
Any organisation or individual facing a coordinated false narrative: companies targeted during an IPO, merger, or funding round; executives subjected to a personal smear or character assassination; brands hit by fabricated reviews, deepfakes, or manufactured controversy; and organisations attacked by competitors, activists, disgruntled insiders, or state-aligned actors. It is bought as a standalone response to a live attack, and can also be retained as a standing capability.
Find out more
