Building Resilience Against Information Threats: A Deep Dive into the UK Government's RESIST 3 Framework
In an era where disinformation can spread faster than facts, governments worldwide are grappling with how to protect democratic institutions, public trust, and policy outcomes from information manipulation. The UK Government's newly updated RESIST 3 framework offers a comprehensive, pragmatic approach that any institution can adapt to strengthen its strategic communications and counter disinformation efforts.
https://www.communications.gov.uk/wp-content/uploads/2025/10/RESIST-FINAL.pdf
What is RESIST 3?
RESIST (Recognise, Early warning, Situational insight, Impact analysis, Strategic communication, Tracking effectiveness) is a structured methodology developed by Dr. James Pamment, Director of the Lund University Psychological Defence Research Institute, in collaboration with UK Government Communications. Originally launched in 2018, the framework has evolved through three iterations, with RESIST 3 representing the most mature and comprehensive version to date.
Unlike purely reactive approaches that scramble to debunk false narratives after they've taken hold, RESIST 3 frames disinformation as a multifaceted risk that threatens not just communications, but policy delivery, national security, international reputation, and democratic legitimacy itself.
My Privacy Blog
Why RESIST 3 Matters Now
The information landscape has transformed dramatically in recent years. AI-generated content, bot-driven influence campaigns, and sophisticated coordination tactics allow false narratives to spread at unprecedented speed and scale. The 2024 UK summer riots, where misinformation about a suspect's identity fueled coordinated unrest across multiple cities within days, illustrate how rapidly online narratives can translate into real-world harm.
RESIST 3 acknowledges these evolving threats while providing practical tools for organizations to:
- Build institutional capacity for identifying and responding to information threats
- Shift from reactive to proactive posture through continuous monitoring and resilience-building
- Make evidence-based decisions using structured analysis rather than "gut feelings"
- Measure effectiveness to continuously improve response strategies
The Six-Step RESIST Methodology
1. Recognise: Identifying Information Threats
The journey begins with recognition—learning to spot misinformation, disinformation, and malinformation (collectively termed MDM). RESIST 3 introduces the FIRST indicators to help communicators identify manipulated content:
- Fabrication: Forged documents, manipulated images, falsified citations
- Identity: Disguised sources, fake accounts, false claims about who created content
- Rhetoric: Aggravating tone, false arguments designed to polarize
- Symbolism: Data or events exploited out of context to support unrelated narratives
- Technology: Coordinated bot networks, AI-generated content, algorithmic manipulation
For example, after the October 7, 2023 Hamas attacks, pro-Kremlin outlets circulated fabricated BBC articles claiming Ukraine had sold Western weapons to Hamas—combining fabrication (fake articles) with identity deception (impersonating trusted news sources).
2. Early Warning: Monitoring the Information Space
Proactive monitoring forms the backbone of resilient communications. Rather than waiting for a crisis to erupt, organizations should establish baseline monitoring that tracks:
- Priority policy areas and known vulnerabilities
- Key audiences and influencers in relevant communities
- Emerging narratives that could threaten organizational objectives
- Behavioral patterns suggesting coordinated inauthentic activity
The framework recommends using a combination of commercial monitoring tools, AI-powered early warning systems, and human analysis. During the 2024 UK general election, the Joint Election Security and Preparedness Unit (JESP) implemented enhanced monitoring with predefined thresholds for cross-government response—demonstrating how advance preparation enables rapid, coordinated action when threats materialize.
Compliance Hub
3. Situational Insight: Turning Data into Action
Monitoring generates vast amounts of data. Situational insight transforms that data into actionable intelligence. The framework recommends using the ABCDE structure for concise briefings:
- Actor: Who is behind the activity?
- Behavior: What tactics are being employed?
- Content: What narratives are being pushed?
- Degree: How widely is it spreading?
- Effect: What impact could it have?
This structure ensures that insights are immediately comprehensible to decision-makers who may not be communication specialists. For instance, a briefing might note: "Actor (accounts linked to foreign state) is exhibiting Behavior (coordinating bot amplification) to spread Content (misleading narratives about election integrity) to Degree (currently 500 inauthentic reposts) with Effect (disinformation that poses risk to public trust in democratic processes)."
4. Impact Analysis: Prioritizing Response
Not every instance of misinformation warrants a response. The Impact Analysis stage helps organizations prioritize by assessing:
- Severity of the threat: Is this isolated MDM or part of a coordinated campaign?
- Potential consequences: Could it harm policy delivery, public safety, vulnerable audiences, or national security?
- Organizational responsibility: Is this within your mandate to address?
- Likelihood of impact: How vulnerable are target audiences to this narrative?
RESIST 3 provides example prioritization matrices that guide communicators through structured decision-making. For instance, content that poses "significant risk to the public and high likelihood of attracting media attention" warrants immediate escalation and cross-government coordination, while content with "limited circulation and mixed-quality evidence" may simply require routine monitoring.
Crucially, the framework emphasizes expressing confidence levels in assessments (high, medium, or low confidence), acknowledging the inherent uncertainty in analyzing information threats while still enabling evidence-based decision-making.
5. Strategic Communication: Choosing How to Respond
When response is warranted, RESIST 3 outlines multiple strategic options:
Proactive approaches:
- Public information campaigns: Filling the information space with accurate content to reduce room for misinformation
- Media literacy initiatives: Building long-term audience resilience (e.g., Montenegro's INFO campaign, adapted from the UK's SHARE checklist)
- Trust-building: Transparent, timely communications that strengthen institutional credibility
- Counter-brand campaigns: Imposing reputational costs on persistent threat actors
Reactive approaches:
- Monitoring without action: Strategic silence when public response might amplify false narratives
- Debunking: Directly refuting false claims with facts (though this risks reinforcing the original misinformation)
- Counter-narratives: Promoting truthful narratives without explicitly referencing the false ones
- Crisis communication: Delivering accurate, timely information during rapidly evolving situations
The UK's HM Revenue and Customs (HMRC) demonstrated effective reactive response during the 2024 "side hustle tax" misinformation episode. When false claims spread that people selling personal items would face taxation, HMRC deployed multiple tactics: AI-enabled early warning to detect the trend early, social media moderation, myth-busting videos amplified by trusted voices like financial journalist Martin Lewis, a dedicated GOV.UK campaign page, and engagement with influencers on platforms where HMRC doesn't have presence. The first response video gained over one million views, and the public began self-moderating by sharing accurate information.
6. Tracking Effectiveness: Measuring Impact and Learning
The final step closes the loop by evaluating both communication activities and response processes themselves. The framework applies the Government Communications Evaluation Cycle to track:
- Inputs: Resources allocated, evidence used, content created
- Outputs: Reach, engagement, distribution metrics
- Outtakes: Audience awareness, understanding, trust levels
- Outcomes: Behavioral changes, information-sharing patterns, resilience indicators
- Impact: Reduced MDM spread, enhanced public trust, strengthened democratic discourse
Beyond measuring communication effectiveness, RESIST 3 emphasizes evaluating organizational processes: How quickly were threats identified? How effectively did teams collaborate? Were decision-making protocols clear? This meta-level evaluation helps organizations continuously strengthen their institutional capacity.
Underlying Principles: Building Resilience
Several core principles differentiate RESIST 3 from purely reactive approaches:
Resilience as the North Star
The framework isn't merely about countering individual instances of disinformation—it's about building systemic resilience in institutions, public trust, and policy delivery mechanisms. This long-term perspective recognizes that information threats are an ongoing challenge requiring sustained capacity rather than episodic crisis response.
Whole-of-Society Approach
Information threats don't respect organizational boundaries. Effective response requires partnership across government departments, with civil society organizations, academia, media outlets, and international partners. During the 2024 West Midlands measles outbreak, the UK Health Security Agency (UKHSA) combined social listening with community engagement, working with local clinicians and platforms like TikTok to counter vaccine misinformation with culturally tailored content.
Audience-Centered and Vulnerability-Aware
Different audiences face different susceptibilities to disinformation based on digital literacy, language, socio-economic factors, historical grievances, and information consumption patterns. RESIST 3 emphasizes detailed audience mapping to identify vulnerable segments and tailor prevention strategies accordingly. The framework also addresses gender and identity-based disinformation, recognizing how these attacks uniquely target women in public life and compound existing inequalities.
Proactive Posture Alongside Reactive Capability
While reactive debunking has its place, pre-bunking and narrative shaping prove more effective. Filling the information space with accurate, accessible content before false narratives emerge reduces the oxygen available for misinformation to spread. The Montenegro media literacy campaign and UK's SHARE checklist exemplify proactive resilience-building that equips citizens to evaluate information critically.
Evidence-Based, Not Gut-Based
The framework consistently emphasizes structured analysis, baseline metrics, and systematic evaluation over instinctive reactions. This discipline helps organizations avoid both under-response (ignoring genuine threats) and over-response (amplifying minor incidents through disproportionate attention).
Real-World Applications: Lessons from UK Experience
Several case studies in the RESIST 3 framework illuminate how these principles work in practice:
Summer 2024 Riots: False claims about a suspect's identity following a tragic stabbing in Southport spread rapidly across social media, with AI-generated images and coordinated messaging apps fueling disorder across ten UK cities within five days. The government response included cross-departmental collaboration to identify harmful narratives, proactive content referrals to platforms, and a rapid paid media campaign that reached 28.7 million adults in its first week, with directive text-based messaging proving twice as effective as video alone.
2024 Hurricane Misinformation (US FEMA): When hurricanes Helene and Milton struck the southeastern United States, false claims proliferated—from allegations that aid was diverted to immigrant communities to conspiracy theories about government weather manipulation. FEMA created a dedicated Hurricane Rumor Response page in 15+ languages, providing clear, accessible information to help communities separate fact from fiction during a crisis.
Tax Misinformation (HMRC): AI-enabled early warning allowed rapid detection of spreading tax misinformation, enabling HMRC to deploy a multi-channel response including social moderation, media corrections, myth-busting content amplified through trusted voices, a dedicated campaign page, and influencer engagement on platforms where the agency lacks direct presence.
Adapting RESIST for Other Nations and Organizations
While developed within the UK government context, RESIST 3's structured approach translates effectively to other national governments, international organizations, and even large private institutions facing information threats. Here's how:
1. Establish Institutional Foundations
Begin by mapping your current capabilities:
- Who in your organization currently monitors information threats?
- What tools and data sources are available?
- Where are decision-making authorities and escalation protocols?
- What partnerships exist with other government entities, civil society, or platforms?
Document existing processes, identify gaps, and clarify roles and responsibilities. The framework provides templates for risk assessment matrices and process mapping that can be adapted to your context.
2. Start with Baseline Monitoring
You don't need sophisticated AI tools to begin. Start with:
- Regular monitoring of social media conversations about your priority policy areas
- Tracking key influencers and journalists covering your work
- Simple sentiment analysis to identify shifts in public perception
- Documentation of common narratives—both accurate and misleading
As capacity grows, layer in more advanced monitoring, AI-assisted early warning, and cross-platform analysis.
3. Build Cross-Functional Teams
Counter-disinformation work sits at the intersection of communications, policy, security, and sometimes law enforcement. Establish regular coordination mechanisms that bring together:
- Communications professionals who understand messaging and audiences
- Policy experts with subject-matter knowledge
- Analysts who can assess information threats
- Legal advisors familiar with relevant frameworks
- Partnership managers who maintain external relationships
4. Develop Response Protocols
Create playbooks for different scenarios: How will you respond to routine misinformation? Coordinated disinformation campaigns? Emergencies where false information threatens public safety? Define:
- Thresholds for escalation at different priority levels
- Pre-approved messaging frameworks for common scenarios
- Approval processes that balance speed with appropriate oversight
- Channels and partners for different types of response
5. Invest in Proactive Resilience
Don't wait for crises. Implement ongoing programs that build long-term resilience:
- Media literacy initiatives to strengthen critical thinking
- Transparent, timely communications that build institutional trust
- Partnerships with civil society, academia, and media
- Regular training for communicators on information threat recognition
6. Measure, Learn, and Adapt
Establish evaluation frameworks from the outset:
- Define clear objectives for your counter-disinformation work
- Identify metrics for both communication activities and organizational processes
- Conduct after-action reviews following major incidents
- Share lessons learned across teams and with partners
- Regularly update protocols based on emerging threats and evidence
Challenges and Limitations
While RESIST 3 offers a comprehensive framework, implementation faces real challenges:
Resource Constraints: Comprehensive monitoring, analysis, and response require significant human and technical resources. Organizations may need to prioritize certain policy areas or audiences based on available capacity.
Speed vs. Accuracy Trade-offs: Information threats often demand rapid response, but rushing can lead to errors. The framework's emphasis on structured analysis helps, but tensions remain between thoroughness and timeliness.
Attribution Difficulties: Determining who is behind disinformation campaigns—particularly when sophisticated actors deliberately obscure their involvement—proves persistently challenging. The framework recommends focusing on observable behaviors and effects rather than speculating about ultimate attribution.
Avoiding Overreach: Government responses to misinformation must carefully respect freedom of expression. The framework emphasizes that the role of government is to provide facts and support informed debate—not to act as arbiter of truth or censor dissenting opinions.
Cross-Border Complexity: Information threats increasingly operate across national boundaries, while response capacities remain largely national. This creates gaps that require international cooperation to address effectively.
Platform Dependence: Much information threat activity occurs on platforms outside government control. While the framework emphasizes partnership with platforms, governments remain dependent on platform cooperation for key interventions like removing coordinated inauthentic behavior.
Looking Forward: The Evolution of Information Threats
RESIST 3 represents a significant maturation in how governments approach information threats, but the landscape continues evolving:
AI Acceleration: Generative AI is already enabling more sophisticated content creation, more effective audience targeting, and greater scale of operations. Future iterations of the framework will need to address AI-driven threats more comprehensively, while also harnessing AI for detection and response.
Cross-Platform Coordination: Threat actors increasingly coordinate across multiple platforms simultaneously. Counter-efforts need similar cross-platform capability and information-sharing.
Micro-Targeting: As actors develop more sophisticated audience analysis, disinformation becomes increasingly personalized and harder to detect through aggregate monitoring. Response strategies need corresponding sophistication in understanding and reaching micro-segments.
International Dimension: FIMI (Foreign Information Manipulation and Interference) campaigns demonstrate the need for international cooperation in detection, analysis, and response. Frameworks like RESIST need to integrate more fully with international partnerships and information-sharing mechanisms.
Conclusion: From Reactive to Resilient
The RESIST 3 framework represents a fundamental shift in how governments can approach information threats—from reactive firefighting to proactive resilience-building. By providing structured tools for recognition, monitoring, analysis, response, and evaluation, it helps organizations move beyond ad-hoc responses toward systematic capability development.
The framework's emphasis on building long-term institutional capacity, fostering whole-of-society partnerships, and measuring effectiveness distinguishes it from purely tactical approaches. While developed within the UK government context, its principles and tools offer valuable guidance for any organization seeking to strengthen its strategic communications and counter information manipulation.
As information threats continue evolving in sophistication and scale, frameworks like RESIST 3 provide essential structure for organizations navigating this complex landscape. The goal isn't to eliminate all misinformation—an impossible task in free societies—but to build resilient institutions, informed publics, and robust democratic discourse that can withstand and counter manipulation attempts.
For governments, civil society organizations, and institutions worldwide grappling with information threats, RESIST 3 offers a pragmatic, evidence-based starting point. The framework itself will continue evolving as threats and best practices develop, but its core insight remains: systematic, proactive resilience-building proves more effective than reactive crisis response alone.
The full RESIST 3 framework documentation is available through UK Government Communications. Organizations interested in adapting the framework should consider both the detailed guidance and the underlying principles that make it effective across different contexts and threat landscapes.
