No outbound content path

PROVING GROUND cannot deploy anything, to anyone, ever.

Every exercise is a closed rehearsal against a consenting organization. Injects are text prompts delivered to that org's own blue cell inside this tool. There is no code path that creates an account, publishes content, or reaches a real person, platform, or press outlet.

✓No capability to create or operate accounts on any platform

✓No capability to post, publish, or otherwise deploy content into the world

✓No capability to contact real targets — no outbound call, email, or message path exists

✓Injects are text prompts to the consenting org's blue cell only, held inside this exercise record

Asserted at build time by boundary.test.js — per 00-build-conventions §4 · RUTTER §6

PG-014 · Election Week

Sample County Elections Office · consented · facilitator: R. Osei

LIVE

A compressed rehearsal of a coordinated influence campaign timed to election week — run to reveal the office's gaps before a real adversary finds them, not to grade individuals.

Readiness

64%

weighted roll-up of 5 dimensions, live

Injects

6 / 8

2 queued, not yet delivered

Elapsed

2h 45m

of a 4h compressed window

Grades so far

2S · 2SL · 1O · 1M

strong · slow · open · miss

Inject Timeline

RED CELL → BLUE CELL · DISARM-TAGGED

T+00:00

Anonymous tip: tabulation-system breach rumor

DISARM T0097 · Amplify Existing Narrative Phase: Execute

Strong

Red cell promptA caller claims the county's tabulation system was breached overnight. No evidence is offered. What does the county do?

Blue cell responseDuty officer logged the tip, escalated to the IT security lead, and held all public comment pending verification.

Detected in 4 min · owner: IT Security Lead

T+00:35

Cloned clerk account posts wrong polling hours

DISARM T0129 · Impersonate Legitimate Entity Phase: Execute

Slow

Red cell promptA lookalike account posts the wrong polling hours under the clerk's name and photo. Reach is small but growing.

Blue cell responseNoticed via a resident's screenshot, not internal monitoring; correction posted from the real account 40 minutes later.

Detected in 40 min · owner: Comms Lead

T+01:10

Cloned-voice robocall citing wrong close time

DISARM T0146 · Deepfake Audio/Video Phase: Execute

Open

Red cell promptResidents report a robocall in a voice that "sounds like" the county clerk, citing an earlier poll close time.

Blue cell responseTwo duty officers each assumed the other owned it; no one routed it for authentication before the inject window closed.

Still open at inject close · owner: unassigned

T+01:45

Coordinated “the count is already rigged” hashtag flood

DISARM T0084 · Amplify via Coordinated Inauthentic Behavior Phase: Execute

Strong

Red cell promptA synchronized cluster of accounts pushes a pre-emptive "rigged" narrative timed to poll close.

Blue cell responseFlagged as coordinated before it crossed into authentic reshare; prebunk statement queued and cluster reported.

Detected in 9 min · owner: Comms Lead

T+02:05

Journalist DM presses to confirm the rumor

DISARM T0138 · Leverage Journalists/Bloggers Phase: Execute

Slow

Red cell promptA reporter DMs the clerk's personal account (per scenario, not real) asking to confirm the breach rumor on background.

Blue cell responseResponse routed through the correct spokesperson eventually, but only after it was raised twice.

Detected in 22 min · owner: Comms Lead

T+02:30

Fabricated “leaked internal memo” screenshot

DISARM T0115 · Create Fabricated Document Phase: Prepare

Miss

Red cell promptA doctored "internal memo" screenshot begins circulating in a local forum, implying the office knew of problems in advance.

Blue cell responseNo response recorded before the inject window closed — no monitoring channel covers document-style fabrications.

No detection recorded · owner: none

T+03:00

Second-wave account cluster reactivates

DISARM T0083 · Reuse/Resurrect Dormant Accounts Phase: Prepare

Queued

T+03:40

Post-close “results changed overnight” claim

DISARM T0097 · Undermine Institutions Phase: Assess

Queued

Findings & After-Action

STRENGTH / GAP · TOOL-LINKED RECOMMENDATION

Strength

Breach rumor was triaged and escalated within 4 minutes with no premature public statement.

Recommendation: codify this triage step as a standing playbook → REDOUBT

Strength

The coordinated hashtag flood was correctly flagged as inauthentic and muted before it crossed into organic reach.

Recommendation: feed this detection pattern into the standing monitor → BEACON WATCH

Gap

No single owner triaged the cloned-voice robocall; response stalled over 40 minutes while two officers each assumed the other had it.

Recommendation: assign audio-authentication triage ownership → TOUCHSTONE

Gap

Three injects were logged only in personal notes — no threat-logging owner was assigned before the exercise started.

Recommendation: stand up a shared incident ledger → REDOUBT

Gap

The fabricated "leaked memo" inject drew zero blue-cell response — no channel monitors document-style fabrication.

Recommendation: extend narrative monitoring to document artifacts → BEACON WATCH

Consent Record

GATES STATUS → LIVE

Signed, scoped consent row on file

Live Defensive Scorecard

5 DIMENSIONS

Detection speed72%

Response ownership48%

Authentication reflex55%

Protect the target81%

Public correction66%

Scenario Library

Templates drawn from RUTTER's threat taxonomy · DISARM-mapped injects

DISARM technique IDs shown are illustrative sample mappings for this prototype; the production build pins the official DISARM Red Framework release (v1.5) so a definition change is a visible diff, not silent drift.

Election Week

A compressed, election-week timeline testing rumor triage, impersonation, synthetic media, and coordinated delegitimization.

8 injectsPlan · Prepare · Execute · Assess

Currently running · PG-014

Anonymous breach rumor T0097

Cloned clerk account, wrong hours T0129

Cloned-voice robocall T0146

Coordinated "rigged" hashtag flood T0084

Journalist pressure DM T0138

Fabricated "leaked memo" T0115

Dormant-account reactivation T0083

Post-close "results changed" claim T0097

Newsroom Under Flood

A local newsroom faces a coordinated flooding-and-discrediting campaign meant to exhaust staff and erode reader trust.

5 injectsPrepare · Execute

Agency Impersonation

A government agency is spoofed at the domain, spokesperson, and document level to seed confusion and harvest credentials.

5 injectsPrepare · Execute

School District Under Pressure

A fabricated "leaked" board recording and a coordinated meeting-disruption campaign test a small district's response chain.

5 injectsPrepare · Execute

Public Health Rumor Surge

A fabricated recall notice and a coordinated doubt-seeding wave test a health agency's correction speed.

5 injectsPrepare · Execute