Blog
Why DISARM Red Tagging Matters
DISARM Red is a framework for describing and organizing online influence and disinformation behaviors. Tagging incoming content with DISARM Red helps teams:
- Speak a common language across analysts, reviewers, and stakeholders
- Track recurring narratives and tactics over time
- Compare campaigns across platforms, regions, and languages
- Support consistent reporting, escalation, and response workflows
For new analysts, the challenge isn’t learning the tag names—it’s applying them consistently under time pressure and with incomplete context. This guide focuses on repeatable steps that reduce ambiguity and improve tag quality.
Before You Tag: Set Up a Consistent Workflow
1) Define your “unit of analysis”
Decide what you’re tagging, and keep it stable across your work queue. Common units include:
- A single post (text, image, video, or link preview)
- A piece of media (one image/video reused in many posts)
- An account/profile behavior (when the post is secondary to the actor)
- A conversation thread (when meaning depends on replies)
Rule of thumb: Tag the smallest unit that still contains the behavior you’re describing. If one post includes multiple distinct behaviors, tag at the post level but note the split in your internal comments.
2) Capture the minimum evidence set
Before selecting tags, record what you’ll later need to justify them:
- Exact text (copy/paste) and/or transcript
- Key frames or screenshots if visuals matter
- Language and any notable translation choices
- Date/time and platform context (if available)
- Any observable metadata (hashtags, mentions, claimed sources)
This protects you from having to “reconstruct” reasoning after content is removed or edited.
3) Separate what from why
DISARM Red tagging works best when you distinguish:
- Observed behavior (what is present in the content)
- Inferred intent (why you think it was done)
Tag the observed behavior first. Use internal notes for intent hypotheses unless your tagging rules explicitly allow intent-based selection.
Step-by-Step Tagging Process for Incoming Content
Step 1: Identify the primary objective of the content
Ask: “If this content succeeds, what changes?”
Typical objectives include:
- Shaping beliefs (persuasion, narrative reinforcement)
- Driving actions (protest, donations, voting behavior, harassment)
- Undermining trust (institutions, media, elections, public health)
- Amplifying division (identity-based hostility, polarization)
Pick one primary objective to anchor your tagging. Secondary objectives can be noted, but anchoring prevents “tag sprawl.”
Step 2: Identify the tactic(s) used to achieve that objective
Now examine how the content attempts to work. Focus on observable mechanisms, such as:
- Emotional manipulation (fear, anger, disgust)
- Misleading framing (selective context, loaded language)
- Impersonation cues (handles, logos, “official” styling)
- Coordinated amplification signals (copy-paste text, synchronized posting)
- Harassment or intimidation behaviors
At this stage, you’re creating a shortlist of candidate tags. Don’t commit yet—just narrow the field.
Step 3: Decide whether you are tagging content, actor behavior, or distribution
A common inconsistency among new analysts is mixing three different perspectives in one tag set:
- Content-focused tags: What the message says or depicts
- Actor-focused tags: What the publisher is doing (identity misrepresentation, persona management)
- Distribution-focused tags: How the content spreads (coordination, boosting, cross-posting)
Practical rule: You can apply tags from more than one perspective, but each tag must be justified by direct evidence in the artifact or in your available context. If distribution behavior isn’t observable in a single post, don’t force it—flag for network analysis instead.
Step 4: Apply the most specific tag you can justify
When multiple tags seem plausible, prefer:
- More specific over more general (if evidence supports it)
- Observable over inferred
- Direct behavior over downstream interpretation
If your team uses parent/child tags, apply the child tag and add the parent only if your rules require both.
Step 5: Add qualifiers and notes consistently
Use a short, standardized note format to record why you chose a tag. For example:
- Evidence: quote or description of visual element
- Reasoning: why this matches the tag definition
- Uncertainty: what you don’t know (language nuance, missing context)
- Dependencies: what additional data would confirm/refute (account history, timestamp series)
These notes are critical for peer review and training calibration.
Tagging Rules That Improve Consistency
Rule 1: Don’t tag “truthfulness” unless your process supports it
Analysts often drift into labeling content as “false” or “misleading” without verification. If your workflow doesn’t include fact-checking, stick to DISARM-style behavioral descriptors (e.g., selective context, deceptive presentation) and document the claim for later verification.
Rule 2: Treat humor, satire, and irony as formats—not automatic exemptions
Memes and jokes can still function as influence artifacts. Tag the behavior (e.g., dehumanization, scapegoating, delegitimization) while noting the format (satirical tone, comedic framing). Only exempt if your policy explicitly excludes satire.
Rule 3: Avoid “kitchen sink” tagging
More tags do not equal better analysis. Over-tagging reduces signal and makes trend reporting noisy.
A helpful limit for single-post tagging:
- 1 primary objective tag
- 1–3 tactic tags
- 0–2 supporting tags (format, target group, or distribution cues when clear)
Rule 4: Use the same threshold for “coordination” every time
Coordination is easy to over-claim. Establish a consistent bar, such as:
- Repeated identical text across multiple accounts within a narrow timeframe
- Shared unique media assets with synchronized posting
- Observable call-to-action to repost with templated language
If you only see a single post, consider using a potential coordination internal flag rather than a definitive coordination tag, depending on your ruleset.
Rule 5: Be careful with identity-based targeting labels
If your taxonomy includes protected classes or identity groups, apply them only when:
- The content explicitly names the group, or
- The visual/textual cues are unambiguous in your language/cultural context
When ambiguous, document uncertainty and request cultural/language support.
Common Tagging Scenarios (and How to Handle Them)
Scenario A: A misleading chart or screenshot
What to look for
- Missing axes, cropped timestamps, or selective comparison windows
- Overlays that mimic credible news branding
- Claims that rely on “looks official” rather than cited evidence
Tagging approach
- Tag the presentation technique (manipulative framing, misleading context)
- If impersonation cues exist, tag the imitation of authoritative style
- Note exactly what is edited/cropped and what the viewer is meant to conclude
Scenario B: A post urging people to “share before it’s deleted”
What to look for
- Urgency cues and suppression narratives (“they don’t want you to know”)
- Calls for amplification across platforms
- Emotional triggers paired with forwarding instructions
Tagging approach
- Tag the amplification prompt
- Tag the conspiracy/suppression framing if present
- Avoid assuming coordinated behavior unless you observe repetition across accounts
Scenario C: A profile pretending to be a local journalist or official
What to look for
- Name/branding similar to real entities
- Bio claims of affiliation without verification
- Content that leverages “inside access” credibility
Tagging approach
- Tag identity misrepresentation/impersonation behavior
- Tag any downstream tactics (credibility laundering, false authority)
- Capture screenshots of profile elements, not just posts
Scenario D: A thread that reframes a real event to inflame hostility
What to look for
- Selective clips, out-of-context quotes
- Loaded language aimed at an outgroup
- Calls for retaliation, exclusion, or harassment
Tagging approach
- Tag decontextualization (if evidence supports it)
- Tag incendiary or dehumanizing rhetoric when explicit
- If harassment is directed at a person, record the target and the directive language
Quality Control: How to Calibrate With Your Team
Use “tagging huddles” and a shared decision log
On a regular cadence (daily or weekly), review a small sample of tagged items and discuss disagreements. Maintain a decision log that captures:
- Borderline examples
- Final agreed tag choice
- The reasoning and evidence threshold
- Any updates to tag definitions or local rules
This is one of the fastest ways to align new analysts with experienced ones.
Build a local “gold set”
Create a curated set of previously tagged items that represent:
- Clear, textbook cases for key tags
- Tricky edge cases where mistakes are common
- Examples across languages, formats, and platforms
New analysts should practice on the gold set and compare their choices to the team standard.
Track two simple metrics (without over-quantifying)
You don’t need elaborate scoring to improve quality. Two practical signals:
- Reversal rate: how often tags are changed in review
- Ambiguity rate: how often “uncertain” notes appear for the same tag type
If one tag produces many reversals, refine its definition and add examples.
A Practical Tagging Checklist (Use Every Time)
- [ ] What is the unit of analysis (post, media, account, thread)?
- [ ] Did I capture sufficient evidence (text, visuals, context)?
- [ ] What is the primary objective of the content?
- [ ] Which tactic(s) are observable in this artifact?
- [ ] Am I mixing content, actor, and distribution tags without evidence?
- [ ] Did I choose the most specific tag supported by evidence?
- [ ] Did I limit tags to a focused set and avoid over-tagging?
- [ ] Did I write a short evidence-based note with any uncertainties?
Consistent DISARM Red tagging isn’t about never being unsure—it’s about applying the same rules, the same thresholds, and the same documentation habits every time. Over time, that consistency becomes the difference between a pile of labeled posts and an analysis program that can reliably detect patterns and inform decisions.