Authors: 

Saman Nazari, Dr. Lumi Sarvela, Alliance4Europe

Main Contributors for the Czech Republic: 

Kristína Šefčíková, Ondřej Perušič, Prague Security Studies Institute

Pavel Havlíček, Association for International Affairs (AMO)

March 2026 

 

Influence operations targeting democratic societies have evolved in scale, coordination and strategic sophistication. They constitute a systemic risk to European democratic processes, public trust and societal cohesion, as well as long-term competitiveness and resilience. This threat is increasingly being recognised at both European and national levels, with detection capacity across the Union having significantly improved. However, no overarching coordinated method had yet been developed to systematically disrupt influence operations. PSSI joined Alliance4Europe and Association for International Affairs (AMO) to deliver this white paper which provides a first-of-a-kind operational framework to disrupt influence operations. The proposed  Disruption Framework operationalises a whole-of-society approach, providing:

  1. A Disruption Framework comprising all the actions a practitioner can take to prepare the evidence needed for disruption, the disruption steps available, and steps to mitigate the effect of an influence operation if disruption fails or takes a long time;
  2. Guides and templates for the preparation, disruption, and mitigation measures;
  3. Step-by-step workflows to analyse, disrupt and mitigate six different kinds of influence operations, based on the Disruption Framework. These include coordinated inauthentic behaviour, deepfakes and manipulated content, Impersonation, sanctions circumvention, doxing and gendered smear campaigns targeting political candidates. 
  4. An adaptation of these workflows to the national context of four EU countries;
  5. A digital research infrastructure, the Threat Intelligence Database and Coordination Platform (TRANSCRIPT), to enable the operationalisation of the framework, the aggregation of cases and threat actors’ assets, and the steps that have been taken to disrupt them. 

While the framework was foremost developed to equip non-government actors, it is also a tool to support the work of governments. 

The Framework represents the formalisation of the concrete collective experience of the largest counter-disinformation networks in Europe, involving open source intelligence researchers, fact-checkers, policy-makers, journalists, academics, stratcom professionals, cyber security experts, and national authorities across Europe. 

The framework introduces a lifecycle-based model structured around three phases:

  • Prepare – data collection, documentation, attribution and qualification of an influence operation;
  • Disrupt – who to contact, when and how to disrupt ongoing activities. 
  • Mitigate – mitigating the harm from the operation and building long-term resilience.

The Disruption Framework represents a scalable, concrete model to achieve the objectives of the European Democracy Shield and truly protect citizens from influence operations.

 

Key Takeaways for Decision-Makers

  • By disrupting influence operations, we protect free and democratic discourse, acting on manipulative, inauthentic behaviour and threat actor infrastructure, rather than ever-changing content or narratives. 
  • The gap is operational timing, not capability – Member States already possess detection, regulatory and mitigation capacity. The recurring vulnerability lies in delayed escalation and uncoordinated workflows between detection and disruption.
  • Response and resilience require standardisation, not centralisation. – The framework model (Prepare → Disrupt → Mitigate) sets a basic standard for evidence gathering, analysis and then points towards countermeasures. This improves coordination while fully respecting subsidiarity and national mandates.
  • Early disruption reduces systemic harm – Structured disruption reduces the exposure of citizens to influence operations,   reducing over-reliance on post-impact communication and reputational repair.
  • Whole-of-society capacity can be operationalised – Civil society, media and independent monitoring actors frequently detect incidents first. Structured workflows and coordination mechanisms ensure early warning strengthens institutional response without transferring enforcement authority.
  • A common operational language enhances EU interoperability – Embedding the framework within the European Democracy Shield architecture – including coordination through the Democracy Resilience Centre – would improve cross-border incident alignment and collective response coherence without requiring legal harmonisation.