Guides
Understanding EEAS-FIMI Reporting Structure
Professionals who track influence operations often struggle not with finding information, but with presenting it in a consistent, decision-ready format. The EU External Action Service’s approach to reporting on Foreign Information Manipulation and Interference (FIMI) is designed to turn messy signals—claims, narratives, channels, tactics—into an intelligence-style brief that supports rapid comprehension and defensible action.
This guide breaks down a practical structure you can use to draft EEAS-FIMI–style briefs: what to include, how to organize it, and how to write it so it remains analytic, comparable over time, and usable by policy and operational audiences.
1) Start with the purpose and scope (before you write)
A strong brief is constrained on purpose. Define these elements in one working note (you can later convert them into the “Scope” line in the brief):
- Timeframe: What window does the brief cover (e.g., last 24–72 hours; week-to-date; event-based)?
- Geography: Which countries/regions are in scope?
- Theme or trigger: Election, conflict escalation, sanctions, migration, protests, health, etc.
- Audience needs: Strategic (senior leaders), operational (comms teams), or analytical (intel/OSINT units)?
- Confidence discipline: Agree how you will express certainty (e.g., high/medium/low) and what evidence thresholds mean internally.
This step prevents the most common failure mode: a “news dump” that reads like a timeline without analytic conclusions.
2) Use a predictable brief layout (so readers can scan)
A practical EEAS-FIMI–style structure follows a top-down logic:
- Executive Summary (Key Judgements)
- What’s happening (Situation Overview)
- What is being pushed (Narratives & Claims)
- How it’s being done (TTPs: tactics, techniques, procedures)
- Where and by whom (Channels, Actors, Amplification)
- Why it matters (Impact & Risk)
- What to do next (Recommendations / Mitigations)
- Annex (Evidence notes, examples, methodology)
Even if your organization changes labels, keep the order. It reflects how decision-makers consume information: conclusions first, then supporting detail.
3) Write Key Judgements like intelligence, not commentary
Your first section should be short and assertive: 3–6 bullets that convey what the reader must remember. Each judgement should connect actor → action → objective → implication, and include confidence.
How to do it:
- Use active voice and analytic verbs: assesses, judges, likely intends, indicates.
- Separate observations (“we saw X posts”) from assessment (“X suggests coordinated seeding”).
- Avoid moral language; stick to measurable effects.
Template (bullet):
- Judgement: A cluster of outlets and social accounts amplified claims that [event] was staged, likely aiming to erode trust in [institution/process]. Confidence: Medium.
Keep this section free of platform-specific clutter and avoid listing every narrative—save detail for later.
4) Build a Situation Overview that frames the context
This section answers: What’s the real-world context that makes this information operation relevant right now?
Include:
- A one-paragraph context: the triggering event, timeline, public sensitivity.
- A short snapshot of volume/velocity in plain language (approximate if needed): e.g., “spiked over the weekend,” “spread across multiple languages,” “migrated from fringe channels to mainstream commentary.”
- A boundary statement: what you did not assess (e.g., attribution beyond open sources, private messaging apps, domestic political actors outside scope).
Actionable tip: Write this section as if it must stand alone on a single screen. If it can’t, cut.
5) Map Narratives and Claims (the core of FIMI reporting)
EEAS-FIMI reporting emphasizes narrative ecosystems: recurring storylines built from many individual claims.
Step-by-step narrative mapping
- List discrete claims you observed (verbatim or near-verbatim).
- Cluster claims into 2–5 broader narratives (each narrative should be reusable over time).
- For each narrative, document:
- Core message (one sentence)
- Key variants (2–4 bullets)
- Target audience (who it’s meant to influence)
- Intended effect (confuse, polarize, intimidate, demobilize, delegitimize)
- Resilience factors (why it may stick: existing grievances, ambiguity, emotional triggers)
Narrative format you can reuse
Narrative A: [Short label]
- Core message: …
- Claim variants:
- …
- …
- Target / vulnerability: …
- Intended effect: …
- Confidence: …
Practical discipline: Keep narrative labels stable across briefs (e.g., “Institutional illegitimacy,” “False-flag framing,” “Sanctions backlash”), so trend comparisons are possible.
6) Describe TTPs: how manipulation is executed
This is where your brief becomes operationally useful. TTPs translate “what was said” into “how it was made persuasive or spread.”
Cover categories such as:
- Seeding: origin points, early boosters, coordinated initial posting
- Amplification: cross-posting, influencer pickup, coordinated reposts, hashtag/keyword flooding
- Content tactics: misleading edits, selective clips, false context, fabricated documents, impersonation
- Audience targeting: language choices, community-specific framing, diaspora targeting
- Cross-platform movement: migration from fringe to mainstream; screenshotting to bypass moderation
- Obfuscation: deletion patterns, account recycling, mirror channels
How to write this section:
- Use a bullet list of observed tactics, each with a short example.
- Avoid technical overreach. If you can’t show coordination, describe it as “behavior consistent with” rather than declaring it coordinated.
7) Capture actors and channels without over-claiming attribution
EEAS-FIMI–style reporting often distinguishes between:
- Actors: state-linked outlets, proxy sites, local amplifiers, opportunistic influencers, inauthentic networks
- Channels: state media, fringe blogs, messaging channels, mainstream platforms, video platforms, diaspora community pages
- Amplifiers: accounts or outlets that repeatedly bridge content between communities
Practical approach:
- Create a tiering model:
- Tier 1: consistent originators (frequent first-publishers)
- Tier 2: repeat amplifiers (high-repetition spreaders)
- Tier 3: opportunistic spread (one-off sharing, commentary)
Then describe roles, not just names:
- “A state-aligned outlet seeded the frame; lifestyle influencers normalized it; partisan commentators translated it into domestic politics.”
This avoids the trap of focusing on a single “villain” when the real impact comes from multi-actor propagation.
8) Assess impact and risk in decision terms
Impact in FIMI reporting is rarely about immediate conversion; it’s about information conditions: confusion, distrust, polarization, intimidation, agenda-setting.
Structure impact with three lenses:
- Audience impact: who is likely affected and how (trust erosion, fear, mobilization/demobilization)
- Institutional impact: pressure on public bodies, election administrators, media integrity, crisis response
- Operational impact: risks to staff safety, diplomatic messaging, or on-the-ground operations
Then add a risk statement:
- Risk level: low/medium/high (use your internal rubric)
- Time sensitivity: immediate vs. persistent narrative
- Second-order effects: likelihood of offline harassment, diplomatic friction, policy misperceptions
Keep this grounded: link each impact claim to an observable mechanism (reach signals, elite pickup, cross-language spread, repetition).
9) End with recommendations that match the observed tactics
Recommendations should be proportionate, role-specific, and actionable. Avoid generic “increase awareness.”
Examples of actionable recommendation types:
- Monitoring: watch specific narrative markers, keywords, language variants, and bridging channels
- Prebunking: publish anticipatory clarifications before the narrative peaks
- Debunking: address the core message and the mechanism (e.g., false context), not every variant
- Message discipline: provide suggested lines, Q&A, and “do/don’t repeat” guidance (avoid amplifying the claim)
- Engagement: coordinate with trusted intermediaries (community leaders, sector experts) when appropriate
- Resilience measures: media literacy prompts, transparency releases, rapid publication of primary documents
Tip: Tie each recommendation back to a specific narrative or TTP: “Because the operation relies on screenshot-based recirculation, publish an easily shareable visual clarification.”
10) Use an annex to preserve rigor without bloating the brief
Keep the main brief readable. Put the audit trail in an annex:
- Representative examples of claims (short excerpts)
- Language variants and translations (if relevant)
- Chronology (key timestamps)
- Method notes: collection constraints, what was and wasn’t verified
- Confidence rationale: why you rated attribution or coordination as you did
The annex lets analysts defend the assessment while keeping the body focused on decisions.
A workable one-page outline you can copy
- Title: FIMI Brief — [Topic/Event] — [Date/Time window]
- Key Judgements (3–6 bullets + confidence)
- Situation Overview (1–2 short paragraphs)
- Narratives & Claims (2–5 narrative blocks)
- TTPs (bullets with examples)
- Actors/Channels (tiered roles, not just names)
- Impact & Risk (audience/institution/operational + risk level)
- Recommendations (tied to narratives/TTPs)
- Annex (evidence notes + methodology)
Final quality checks before sending
- Consistency: Are narrative labels stable with previous briefs?
- Clarity: Can a non-specialist summarize your key judgements in 30 seconds?
- Discipline: Did you avoid stating intent or coordination without support?
- Actionability: Do recommendations specify who should do what, and when?
- Comparability: Did you include the same core fields so trends can be tracked?
A reliable EEAS-FIMI–style reporting structure is less about “perfect attribution” and more about repeatable analytic craft: clear judgements, coherent narrative mapping, concrete TTPs, and recommendations that reduce risk in the next news cycle.