Summary Threat Type Vulnerabilities Surface Matrix Motivations Kill Chain Recommendations Appendix
Print Report

Harry Daniels TikTok video singing to President Joe Biden repurposed for disinformation messaging

Submitted File

On April 5, 2024, Social Media Influencer, Harry Daniels, who is known to serenade celebrities, approached U.S. President Joseph Biden, and sang him a portion of singing a Lana Del Rey song in front of him. At the end of the song, President Biden thanked Daniels in a very low and nearly inaudible volume. The same day, X user Misha Schizarella repurposed the video and posted it on X with the caption "🚨 BREAKING: President Biden has reportedly called a man "f*gg*t" after he randomly began singing a Lana Del Rey song in front of him." As of the writing of this DTIR, the post has 10.1M Views, 662 comments, 2.5K reposts, 19k likes, and 5.7K bookmarks.

Threat Level

Low

Moderate

Elevated

High


Authenticity Spectrum

Real

Suspicious

Likely Fake

Fake



Deepfake Attack Profile

Credibility

Moderate

The more synthetic media is perceived to be legitimate and authoritative, the content is more likely to be trusted, persuasive, and acted upon.

Interactivity

Low

Synthetic media can range from non-interactive, not ongoing, or not consistent (low) to interactive, ongoing, and consistent (high).

Familiarity

High

Synthetic media can range from very recognizable and familiar (high) or hardly (or not) recognizable and familiar (low).

Evocation

Moderate

Synthetic media can range from evoking a significant affective response (high) to barely or not at all eliciting an affective reaction.

Distribution

Broadcast

Synthetic media can range from broadcast to a wide human audience or technical security measures (high) to a narrow, specific human audience or tailored technical security measure (low).


Deepfake & Synthetic Media Analysis Framework (DSMAF) Assessment™. The media submitted for this Deepfake Threat Intelligence Report (DTIR) was assessed with the Psyber Labs Deepfake & Synthetic Media Analysis Framework (DSMAF)™, a set of psychological, sociological and affective influence factors and sub-facets, that when holistically applied, inform the motivations, intentions, and targeting process in synthetic media and deepfake propagation. The findings of each DSMAF factor is described in respective sections and graphically plotted on the Deepfake Risk Factor Radar. The combined DSMAF findings are given a Synthetic Media Threat Level (Low, Medium, Elevated, or High) for actionable awareness and risk mitigation.

Threat Type

Threat Type is the category of intended purpose and the risk proposed by the synthetic media or deepfake. Often, cyber deception efforts through deepfake content are multi-purpose, and a result, are categorized with multiple threat types.

The video in question, although authentic, has been repurposed with the intent to cause viewers to question or believe that President Biden is homophobic.

Malinformation

Malinformation is information or narratives based on fact, but used out of context to mislead, harm, or manipulate

Political Instigator

The media is intended to serve as a catalyst for political argument, discord and divisiveness.

Disinformation

False information purposely spread to influence public opinion or obscure the truth

Deception

Intentional strategy and tactics meant to mislead, misdirect and manipulate the perceptions of a target audience through simulation (showing the false) and/or dissimulation (hiding the real)

Common Cognitive Vulnerabilities & Exposures™ (CCVE)

Common Cognitive Vulnerabilities & Exploits (CCVEs) are perceptual distortions, cognitive biases, heuristics misapplied, or any mental process that exposes a person to a potential manipulation by an adversary.

Devil Effect

Category: Interpersonal Biases

In assessing other people, it is the tendency for a person’s undesirable trait to be generalized to possess other poor traits.

Suggestibility

Category: Other Psychological Vulnerabilities

Technique that attempts to implant a false memory in the target through suggestion. 

False Memory Implantation

Category: Other Psychological Vulnerabilities

False memory implantation is a recollection that seems real but is actually a fabricated or distorted recollection of an event by virtue of being fed untrue information about an event or experience. These memories may be entirely false and imaginary, or in some cases may contain elements of fact that have been distorted by interfering information or other memory distortions.


Deepfake Attack Surface & Vectors

As part of the DSMAF criteria, Deepfake Attack Surface & Vectors assesses the intended target; the manner of control, or how the synthetic media is being presented to the target; and medium, or the type of synthetic media being presented to the intended target.


Intended Target

Both humans and automation may be targeted by synthetic media attacks. This criteria references whether the target of the attack was human or automation. The highlighted icon represents the intended target of this submitted media.


Human

Technical

Hybrid

Unknown



Control

A measure of if the attack was constructed by a human or by artificial intelligence. The highlighted icon represents the method of control of this submitted media.


Human

Automation

Hybrid

Unknown



Medium

The medium is the format of the content submitted. Highlighted items represent all of the various formats contained in the submitted content.


Text

Image

Video

Audio

Synthetic Media Exploitation Matrix

The Synthetic Media Exploitation Matrix Is a visual representation of the combined levels of attacker sophistication and maliciousness.

  • Sophistication is a judgment of the level of demonstrated technological prowess and capability involved in the attack.
  • Maliciousness is a conclusion regarding the degree to which the attack was deliberately intended to cause harm.

Sophistication

Moderate

Technical complexity of the atttack.

Sophistication
Maliciousness

Chart Not Available on Printed Version

Maliciousness

High

How damaging the attack was intended to be.



Motivations

Motivations are the underlying activators, purposes or sustained reasons for why the deepfake threat actor sought to create and take the necessary steps to produce and disseminate synthetic media or deepfake content.

The creator of the X posting suggesting President Biden made a homophobic slur with a alert light/siren emoji is seeking to instigate emotional reactivity to a reputation damaging post.

Divisiveness

Create group, organization or societal division

Suggestion

Offering information that affects the target audience legally, morally, ideologically or in other areas

Provocation

Instigating, eliciting or forcing the target audience to take and action that is advantageous to the deepfake threat adversary

Political Tumult

The creator and/or disseminator of the media seeks to create political discord, argumentation and divisiveness.

The Deepfake Kill Chain™

The Deepfake Kill Chain™ describes the various, distinct, sequential stages of deepfake media creation and dissemination. Understanding these stages, and the adversary’s efficacy in the respective stages not only reveals the adversary’s modus operandi and decision-making process, but when contrasted with the Deepfake & Synthetic Media Analysis Framework™, identifies and elucidates methods of preventing and defending against the adversary’s deepfake attacks.

While not synthetic media, aspects of the Kill Chain are relevant to dissect and discern how this false narrative was produced.

Motivation

Motivation is the underlying activator, purpose or sustained reasons for why the deepfake threat actor wants to create nefarious synthetic media.

This false narrative was created to give viewers the perception and/or belief that President Biden made a homophobic remark.

Targeting

Targeting is the threat actor’s intentional selection of a target audience, or the group or individual whom he is interested in impacting with his deepfake campaign.

The target audience of this campaign is the American voting public who may be influenced by the content.

Research and Reconnaissance

Research & Reconnaissance occurs when the threat actor is effortfully gathering information about the target audience, the optimal channels to conduct their campaign on, the relevant narratives for the attack, and type of content that will have the desired impact on the target audience.

No case specific insights generated.

Preparation and Planning

Preparation & Planning are the steps and processes that the threat actor takes to acquire the tools and content needed to create the deepfake media for their campaign and their deliberation for the execution of the campaign.

Repurposing of the Harry Daniels TikTok video and re-posting it on X.

Production

Production is the threat actor’s use of tools and content for the creation and development of deepfake media for their attack campaign.

No deepfake production tools or efforts. This is simply repurposing of the Harry Daniels TikTok video and re-posting it on X.

Narrative Testing

Narrative Testing. A narrative is a story, or an account of related events or experiences. A good narrative will have story coherence, such that both the story being told and its relationship to the real world are cohesive and clear. In deepfake campaigns, threat actors consider and evaluate the possible narratives—particularly in relation to events and context—to support the campaign in an effort to maximize the believability and efficacy of the attack.

The story transmitted in this short video is that President Biden callously used a homophobic slur toward a social media influencer who sang to him.

Deployment

Deployment is the threat actor’s intentional transmission of deepfake content to the target audience through selected online channels.

Repurposing of a TikTok Video and posted on X with a nefarious new narrative. As of the writing of this DTIR, the post has 10.1M Views, 662 comments, 2.5K reposts, 19k likes, and 5.7K bookmarks.

Amplification

Amplification is the threat actor’s intentional efforts to maximize the visibility, virality and target audience exposure to their deepfake content.

Amplification has been natively occurring in X via re-posts.

Post-Campaign

Post-Campaign is the period after the target audience has received and been exposed to the deepfake content.

Not a part of a larger campaign.



Cognitive Security Recommendations

This section identifies the steps and measures to prevent and defend against the synthetic media/deepfake content assessed in this DTIR. For a more detailed recommendation, training or consultation, connect with Psyber Labs.


Psyber Labs encourages consumers of social media content to contextualize content before investing in veracity and narrative. When video content has watermarks of prior creators, always go to the source and origin and review the content there first. Often, as is the case with this video re-posting on X, the user has repurposed a video and shaped a nefarious false narrative with the video.

Appendix

DTIR™ Version: 1.0

Submission Date (UTC): April 14, 2024 00:39

Assessment Date (UTC): April 14, 2024 04:01

SHA256 Hash: 45a5bb10bc855edac16049a905692824b3df31acd08295aa91b45c62d1a3ee14

Source: https://www.tiktok.com/@harry.daniels/video/7354471424477777195

Source: https://twitter.com/schizarella/status/1776342439340707886