Guide

November 12, 202624 min read

Narrative IntelligenceOSINTMonitoringInvestigations

How to Counter Narratives Online: Strategy and Techniques

Christopher Fitzgerald

Learn how companies and governments can counter harmful online narratives through narrative intelligence, credible messaging, advocacy, and paid amplification.

Abstract visualization of narrative threads organized into structured red and white flows against a dark background

A single correction answers a claim. A sustained narrative response addresses the wider story, the evidence people see, and the places where that story keeps spreading.

Companies and public institutions need ways to explain their position, answer genuine concerns, and respond to misleading or harmful narratives over time. That can involve original reporting, expert participation, clearly sponsored content, public discussion, and repeated updates as well as fact checks.

Narrative intelligence supports this work by showing which themes recur, how discussion changes, and where evidence or useful context is missing.

This guide covers proactive communication and responses to harmful narratives, including disinformation. Its recommendations focus on factual communication with clear authorship and sponsorship.

What does it mean to counter a narrative?

A narrative connects individual events and claims into a larger explanation. It can contain facts, opinions, omissions, and falsehoods in different combinations.

Countering a narrative means presenting and substantiating a different account, addressing the concerns behind it, and distributing that account where people can examine it.

A negative narrative is not automatically disinformation. A fair response to criticism can involve acknowledging a failure, explaining a tradeoff, publishing more evidence, or changing the underlying conduct.

Approach	Main purpose	Example
Rebuttal	Correct a specific factual claim	Publish the original notice and its actual date
Counter narrative	Present a supported alternative account	Explain what happened, why, and what changed
Proactive communication	Establish useful context before a dispute	Publish a project timeline and progress reports
Advocacy	Explain an organization's position openly	Have identified staff discuss evidence and answer questions
Amplification	Increase access to useful content	Distribute through owned channels, disclosed partnerships, and permitted advertising

Separate disinformation from criticism and uncertainty

Misinformation is false information shared without deceptive intent. Disinformation involves intent to deceive. Critical opinion, an unresolved allegation, satire, and a genuine complaint need different handling.

Do not infer intent from an inaccurate post alone. Verify the factual claim and record what supports any assessment of deliberate deception. The UK Government Communication Service’s RESIST 3 framework distinguishes content, narratives, account behavior, and impact when assessing information threats. 1

1. Define the harm you need to prevent

Before drafting a response, write down the consequence you are trying to avoid.

For a company, that could be customers following fraudulent refund instructions, employees acting on a false closure notice, or a forged announcement misleading suppliers.

For a public institution, it could be people relying on an incorrect service location, ignoring a genuine safety notice, or sending documents to an impersonator.

Use a statement such as:

A forged notice gives the wrong location for a public service. Our goal is to make the correct location easy to verify and reduce journeys to the wrong address.

Avoid vague goals such as “improve sentiment.” Decide what a successful response would change.

WHO’s toolkit for false information in health emergencies follows five stages: detection, verification, risk assessment, response design, and outreach. Its sequence provides a useful reference beyond health, although the response must fit the setting. 2

2. Map the narrative and verify the evidence

Create a short intelligence brief before choosing countermeasures.

Question	What to record
What is being claimed?	Exact wording and meaningful variants
What wider story does it support?	The recurring explanation or allegation
Where is it spreading?	Platforms, websites, languages, and offline reports
What can we verify?	Source documents, dates, locations, and expert checks
Who is amplifying it?	Relevant public accounts and observed connections
What harm is occurring?	Documented incidents, inquiries, or disruption
What remains uncertain?	Coverage gaps, disputed facts, and attribution limits

Use a narrative analysis platform, such as Intrace’s Narrative Intelligence, to group related discussion, review prominent accounts and communities, and examine indicators of coordination. Treat automated flags as leads for analyst review. 3

Verify content separately from distribution

A claim can be false even when ordinary people share it sincerely. Coordinated posting can also distribute accurate information.

Check the content first:

Find the original document, recording, or image where possible.
Check its date, source, and full context.
Compare the claim with records held by the responsible organization.
Ask a relevant specialist to review technical claims.
Label the finding as verified, false, misleading, unresolved, or opinion.

Then assess distribution. Repeated wording, shared links, and synchronized activity can justify further inquiry. They do not alone prove bots, common control, or a foreign sponsor.

Preserve URLs, screenshots, timestamps, and supporting files. Use an evidence collection and analysis tool, such as Intrace’s Social Vault, where appropriate to the sources available. 10

3. Decide whether to respond publicly

Public responses can give a minor rumor a larger audience. The Government Communication Service’s Wall of Beliefs guidance recommends considering how widespread a belief is, how firmly people hold it, and the harm it causes before selecting a response. 4

Use the following as a decision aid, rather than a fixed scoring system:

Situation	Response to consider
Limited circulation and little plausible harm	Monitor and prepare an answer
Repeated questions from affected people	Answer directly and update public information
A false claim is spreading widely	Publish a correction and distribute it through relevant channels
A false instruction creates immediate danger or fraud risk	Issue a prompt warning and involve the responsible response team
Impersonation or a forged document is involved	Preserve evidence, publish verification guidance, and report the specific abuse
A true failure is driving the discussion	Acknowledge it, explain the remedy, and report progress

Set triggers for reviewing the decision. A rumor that initially warrants monitoring can require action when it reaches employees, customers, journalists, or service users.

Mention counts should inform this decision, alongside evidence of impact.

4. Build an evidence based counter narrative

Start with a concise account your organization can support.

Write down the concern, your explanation, the evidence behind it, and the action you are taking. Give the reader enough information to assess the account, including facts that complicate your position.

For a hypothetical company accused of abandoning a community, the response could include:

A dated explanation of what the company is changing.
Verified figures on current employment and investment.
A clear account of any job losses or reduced services.
The commitments the company has made and who can check progress.
A recurring update on delivery against those commitments.

This creates material for a sustained response. An interview can explain the decision, a short video can show the relevant site, and a progress report can document what changed.

Avoid building the campaign around an unsupported positive slogan. If your account depends on a commitment, report whether the organization met it.

Address the wider story without repeating every allegation

A recurring narrative such as “the organization hides important information” requires more than separate denials. Publish the relevant records, explain decisions, answer difficult questions, and show how people can challenge errors.

Some concerns are disputes about priorities or values. Explain the organization's position and tradeoffs honestly rather than labelling disagreement false.

5. Plan sustained publication and amplification

A large narrative often requires a series of useful communications rather than one statement.

Create a shared content plan with a factual source page, several supporting formats, named contributors, and a review schedule. Each piece should answer a real question or add evidence.

Asset	Purpose	Example
Main explainer	Set out the full account	A dated page with sources and known limits
Short video	Make a complex point accessible	An identified specialist explains the evidence
Public question session	Answer unresolved concerns	A moderated discussion with published follow up
Expert article	Add technical context	An authored explanation with disclosed affiliations
Progress update	Demonstrate follow through	Results against published commitments
Sponsored distribution	Make the material easier to find	Clearly labelled placements linking to the evidence

Use repetition to reinforce verified facts, while adding useful context. Avoid filling discussions with duplicate replies.

Keep the campaign responsive

Review incoming questions and changes in the discussion. If people keep asking about a detail your materials omit, address it. If a claim changes, update the relevant evidence.

Set a budget and review point for paid distribution. Evaluate whether readers understood the information and whether the intended practical benefit occurred.

For public institutions, use this approach to explain services, public safety information, and institutional decisions within a clear public mandate. Keep it separate from covert or partisan political persuasion.

6. Use disclosed advocacy accounts and real participants

Organizations can extend participation beyond the main corporate or agency account.

Options include identified subject specialists, voluntary employee advocates, labelled service accounts, named spokespeople, and clearly sponsored contributors. Choose the account type the platform permits and disclose relevant affiliations.

A technical specialist can explain the evidence in their own words. A service account can answer practical questions. A sponsored contributor can produce an accessible explanation with the funding relationship made clear.

Give participants access to verified sources, a contact for difficult questions, and a process for correcting errors. Let real participants express their own views. Do not require fabricated personal experiences or identical endorsements.

What about sock puppets?

A sock puppet is an account used to conceal its controller or falsely appear to be an independent participant. That differs from a clearly labelled organizational account or a permitted pseudonym used without misleading people about sponsorship.

This article does not endorse illegal activity, impersonation, concealed sponsorship, fake engagement, or conduct that violates a platform's terms of service. The aim is not to evade those rules. A disclaimer does not make a deceptive account network compliant.

Rules differ across services. LinkedIn prohibits false identities in member profiles. Reddit permits participation without a real name but prohibits intentionally misleading others and disruptive content manipulation. 1314

Use disclosed advocacy and permitted account structures to achieve broader participation. Do not describe these as sock puppets: the point is that readers can understand who is speaking and on whose behalf.

Make sponsorship clear in the content

For commercial endorsements, the FTC's guidance calls for clear disclosure of relevant connections. A relationship hidden on a profile page can be insufficient. 15

Use plain descriptions such as “I work for this company” or “This video is sponsored by this organization,” where they accurately describe the relationship. Apply the relevant rules for the jurisdiction, content, and platform. Disclosure is one requirement, not blanket approval for a campaign.

7. Escalate the response to a persistent harmful narrative

When a narrative keeps returning, increase the depth and reach of the response.

A sustained response can combine:

An updated public evidence page.
Regular briefings by identified staff.
Permitted, clearly sponsored distribution.
Factual engagement with relevant publications and professional groups.
Public documentation of verified impersonation or fabricated material.
Reports of specific abuse to the responsible provider.
Protective action when threats, fraud, or account compromise occur.

Publish findings about manipulation only to the extent the evidence supports them. Distinguish observed coordination from an established link to a named actor.

Prepare for recurrence. Preserve earlier evidence, maintain current answers, and identify who can approve an update. Retire stale messages when the facts change.

A bigger response should offer more evidence, clearer access, and accountable participation. It should not manufacture the appearance of independent consensus.

8. Use prebunking before predictable falsehoods spread

Prebunking prepares people to recognize misleading claims or manipulation before they encounter them.

A 2022 study by Roozenbeek and colleagues found that short videos explaining manipulation techniques improved recognition and sharing judgments in the settings studied. This supports testing such interventions, rather than assuming any warning will work for every audience. 5

How to apply it

Identify events likely to produce confusion, such as a service change, product update, emergency exercise, or planned outage.

Publish information that answers:

What is changing?
When will it happen?
Which channels will carry official updates?
What will the organization never ask people to do?
How can someone verify a suspicious message?

For example, a company preparing a customer account migration could publish:

The account update begins on Monday. You will receive instructions through your existing account dashboard. We will never ask you to send your password by email. Open the app directly to check any message about the update.

This is a hypothetical example. Its value comes from specific verification steps that the organization can actually honor.

Prepare staff to recognize recurring formats, including cropped notices, old footage presented as new, and messages impersonating a trusted sender.

9. Publish a correction people can check

A useful correction gives people an accurate explanation and enough evidence to verify it.

The Debunking Handbook 2020 recommends leading with the fact, identifying the false claim briefly when needed, explaining the error, and reinforcing the accurate account. A bare denial leaves important questions unanswered. 6

A practical correction format

State the verified fact.
Briefly identify the misleading claim.
Explain what is wrong or missing.
Link to the evidence.
Give the reader a useful next step.
State when the information was checked.

Hypothetical example:

The North Street service office remains open at its usual address. A notice circulating online gives an incorrect relocation date and address. It was not issued by the agency. Current opening hours and location details are listed on our service page. Check that page before travelling. This update was verified at 10:00 a.m. on 12 March.

Use this format only when each statement is verified.

Show the evidence in a usable form

Choose proof that answers the disputed point:

Disputed material	Evidence to publish
A cropped document	The full document, with the relevant passage clearly identified
An old video described as recent	The original publication and verified date
A fabricated announcement	The genuine announcement and official publication channel
A misleading statistic	The underlying data, definition, period, and comparison
A genuine mistake	What happened, who was affected, and what has changed

Keep sensitive personal and security information out of public evidence.

If facts remain unresolved, publish a holding statement explaining what you are checking and when you will update it. Avoid an early denial that outruns the evidence.

10. Make accurate information easy to find

A correction on a social feed needs a stable place readers can return to.

A rumor control guide hosted by CISA recommends authoritative information within the organization’s expertise, plain language, supporting sources, and a documented decision about which rumors to address. It was developed for election infrastructure, so its application elsewhere requires adaptation. 7

For a company or public institution, create a dated information page with:

A clear title describing the issue.
A short factual answer near the top.
Evidence and source links.
Common questions.
Contact and reporting options.
A visible update time and change history.
Accessible formats and relevant translations.

Use the words people naturally search for. For a false closure rumor, a title such as “North Street office opening hours and location” is more useful than “An important statement.”

Link this page from relevant service, product, and contact pages. Ensure it works on mobile and that search engines can access it. Search visibility takes time, so combine it with direct communication.

Maintain one current account of the facts across channels. If the facts change, explain the change.

11. Get the response to the people affected

Publishing is one task. Distribution is another.

UNHCR’s information ecosystem guidance emphasizes learning which channels people use and which sources they trust. This helps organizations choose appropriate messengers and formats. 8

Build a distribution plan around the practical information need:

Channel	Practical action
Organization accounts	Publish a concise update linked to the evidence page
Existing discussion	Add one clear correction where it helps readers, without repeatedly arguing
Employees and service staff	Provide a short briefing, approved answer, and escalation route
Journalists	Send a factual note explaining the claim, evidence, and available expert
Professional and community groups	Offer a shareable fact sheet through established contacts
Customer or service channels	Update relevant email notices, recorded messages, and help pages
Paid placements	Use clearly identified sponsorship to direct people to verified information where platform rules permit

Use broad, relevant placement based on the issue and channel. Keep sponsorship and authorship clear.

Equip credible messengers

Give relevant experts and partner organizations an evidence pack containing the verified facts, source links, date, contact, and known limits.

Let independent reviewers reach their own conclusions. A public correction gains little from presenting a paid spokesperson as an independent observer.

Use short videos, captions, translated notices, or diagrams when they make the evidence easier to understand. Keep the facts consistent across formats.

12. Report impersonation and other specific abuse

Some incidents require more than communications.

For impersonation, fraud, doxxing, or suspected coordinated abuse, prepare a report that the platform or service provider can assess.

Include:

The exact URLs and account identifiers.
Screenshots and observation times.
A short description of the conduct.
Evidence of impersonation or other relevant abuse.
The applicable reporting category.
The harm observed or reasonably anticipated.
A contact for follow up.

Use the provider’s current reporting process and rules. Track the case reference and outcome. Preserve evidence before content disappears.

UNHCR’s response guidance includes engagement with platforms as part of a wider response involving communication, protection, and advocacy. 9

A takedown request should identify a specific violation. Criticism, embarrassment, and disagreement alone do not establish one. Avoid mass reporting or attempts to manufacture apparent public support.

Route credible threats to security staff and relevant authorities. Treat account compromise as a cybersecurity incident and fraudulent payment instructions as a fraud incident, alongside any public correction.

13. Address the conditions that keep the narrative alive

A false story can exploit a real service failure, unanswered question, or gap in public information.

Suppose a misleading post claims a company has stopped paying all suppliers. The investigation finds that payments continue, but some invoices are overdue.

A credible response would correct the sweeping claim, acknowledge the overdue payments, explain the remedy, and give affected suppliers a clear contact.

Repeatedly posting “false” would leave the real concern unresolved.

For public institutions, the OECD recommends transparent public communication, disclosure of uncertainty, timely information, and a clear separation from partisan communication. Its framework also stresses freedom of expression and an independent information environment. 11

Build a feedback loop between monitoring and the teams that can fix the underlying problem. Record common questions, assign owners, and publish progress people can verify.

14. Measure outcomes, then adjust

Decide what you will measure before launching the response.

AMEC’s evaluation framework distinguishes communication activity and outputs from audience understanding, outcomes, and wider impact. This helps prevent a high posting volume from being mistaken for success. 12

Measure	What it tells you	Main limitation
Time to verify and respond	How quickly the process works	Speed does not establish accuracy
Visits to the evidence page	Whether people accessed the response	Visits do not prove agreement
Repeated questions	Whether uncertainty persists in service channels	Inquiry patterns can change for other reasons
Short comprehension checks	Whether readers understood the key facts	Samples may be unrepresentative
Recorded fraud or disruption	Whether the practical harm is changing	Attribution needs care
Platform report outcomes	Whether specific abuse was reviewed or removed	Removal does not erase the narrative
Narrative spread over time	Whether variants continue across observed sources	Coverage and audience overlap are incomplete

Do not add follower counts together and label the result actual reach. Do not treat sentiment as proof of belief.

Use comparable time windows and record changes in collection coverage. Annotate publication times, news events, and platform actions.

Where feasible, test clarity and comprehension before publishing. For nonurgent material, compare accurate formats through an appropriate evaluation design. Do not withhold essential safety information for a test.

A fall in discussion after a correction is consistent with improvement, but it does not prove the correction caused the change.

A practical response sequence

The following is a suggested planning sequence, not a universal deadline. Urgent safety warnings and fraud responses should start as soon as the facts support them.

Phase	Main work	Reviewable output
Detection	Capture the claim and alert the responsible team	Incident record and named owner
Verification	Check evidence, scope, and potential harm	Fact brief with uncertainties
Decision	Select whether, where, and how to respond	Approved response and rationale
Publication	Release the correction or useful factual information	Dated evidence page and channel copy
Distribution	Brief relevant staff, media, and partners	Record of channels and materials used
Escalation	Report specific abuse and handle related incidents	Case references and assigned actions
Evaluation	Review comprehension, harm, and continuing spread	Updated assessment and next steps

Define an approver, a backup, and a subject specialist in advance. Give staff authority to publish routine verified updates under agreed rules, with escalation for disputed or sensitive claims.

Example: combining a correction with a sustained narrative response

Consider a hypothetical notice claiming that a distribution site has closed immediately.

The company verifies that the notice is fabricated and confirms the site’s status with the responsible manager.

A coordinated response would:

Preserve the notice and observed sources.
Publish the verified site status and the genuine update channel.
Brief employees, suppliers, and customer service.
Ask relevant trade publications to link to the correction.
Report impersonating accounts or domains through appropriate channels.
Monitor for variants, including translated notices and altered dates.
Track missed deliveries and repeated inquiries.
Review whether slow or unclear company updates helped the rumor spread.

The company can then maintain a site information page, arrange briefings by identified managers, and publish verified progress against its commitments. This addresses the wider story about the site's future as well as the forged notice.

A public institution facing a forged service notice can apply the same sequence, using the responsible service authority and its established public channels.

How narrative intelligence supports countermeasures

Narrative intelligence tools help organize the evidence behind response decisions.

A platform such as Intrace’s Narrative Intelligence can help teams group related claims, examine communities and prominent accounts, track changes across available sources, and prepare reports for communications and security staff. 3

Investigation tools, such as Intrace’s Search, Social Vault, and Graph, can support source review, evidence collection, and analysis of relevant connections. 10

The practical task is to connect findings to action: which fact needs checking, who needs the answer, which channel can reach them, and what evidence will show whether the response helped.

Book an Intrace demo to see a narrative analysis and investigation workflow.

Frequently asked questions

What is the best way to counter a narrative online?

Understand the wider story, verify the evidence, and decide what your organization can substantiate. Combine a clear account with useful content, disclosed advocacy, appropriate distribution, and follow through. Use factual corrections where claims are false, and acknowledge legitimate criticism.

Should organizations reply to every misleading post?

No. Prioritize according to harm, spread, and the information needs of affected people. Keep monitoring cases where a public response would add attention without a clear benefit.

Can AI determine whether a narrative is disinformation?

AI can help organize content and flag patterns. Establishing falsity and deceptive intent still requires source checks, context, and human review. Automated confidence scores do not establish who controls an account or why it posted.

Are countermeasures the same as content removal?

No. Corrections, prebunking, public information, support for affected people, and fixes to underlying problems are all possible responses. Removal depends on the platform’s rules or an applicable legal process.

Sources

This article adapts principles from public guidance. The cited institutions do not endorse Intrace. Examples and suggested workflows are illustrative.