Fake News Incidents through the Lens of the DCAM Disinformation Blueprint

: The emergence of the Internet and web technologies has magniﬁed the occurrence of disinformation events and the dissemination of online fake news items. Fake news is a phenomenon where fake news stories are created and propagated online. Such events occur with ever increasing frequency, they reach a wide audience, and they can have serious real-life consequences. As a result, disinformation events are raising critical public interest concerns as in many cases online news stories of fake and disturbing events have been perceived as being truthful. However, even at a conceptual level, there is not a comprehensive approach to what constitutes fake news with regard to the further classiﬁcation of individual occurrences and the detection/mitigation of actions. This work identiﬁes the emergent properties and entities involved in fake news incidents and constructs a disinformation blueprint (DCAM-DB) based on cybercrime incident architecture. To construct the DCAM-DB in an articulate manner, the authors present an overview of the properties and entities involved in fake news and disinformation events based on the relevant literature and identify the most prevalent challenges. This work aspires to enable system implementations towards the detection, classiﬁcation, assessment, and mitigation of disinformation events and to provide a foundation for further quantitative and longitudinal research on detection strategies.


Introduction
The Internet provides new ways (e.g., websites, blogs, and social media) of news sharing that reach a wider audience almost instantaneously. For its first few decades, this connected world was idealized as an unfettered civic forum space where disparate views, ideas, and conversations could constructively converge [1]. However, the emergence of the Internet and web technologies, apart from original news dissemination, magnified the intentional spread of disinformation or 'fake news'. Fake news is a phenomenon whereby fake news stories are created and propagated online, often by small-scale digital media platforms that are not subject to effective regulation and do not subscribe to normal standards of professional journalism.
Fake news stories can be hard to spot; they are typically designed to appear plausible, commonly mimic the appearance of articles from reputable sources, and are disseminated through the same channels as original news. The emergence of fake news negatively influences online users through false, slanderous, and misleading information and completely denigrates the reporting of original news items. Disinformation events, fake news stories, and misleading information in general can reach as many readers as a reputable online newspaper [2]. The frequency of disinformation events is increasing exponentially, and this trend is unlikely to be reversed anytime soon [3]. The importance of thoroughly examining fake news lies in the fact that although it mostly occurs online, its implications are far reaching with serious real-life consequences. The dissemination of fake news is argued to have large negative effects on public information and to disrupt political processes, including elections [4,5]. This phenomenon appears to have three important elements: (i) it is intentional and originates mostly from human actors; (ii) it is exploiting and advancing current and emerging networking technologies; and (iii) it largely occurs online, but its implications-both short-term and long-term-can have drastic effects in the real world (e.g., election results, reduction in vaccinations, etc.).
Based on the above, this research intends to propose DCAM-DB, a disinformation blueprint (DB) that Detects, Classifies, Assesses and Mitigates (DCAM) fake news incidents in a systematic and timely manner. The proposed blueprint is based on the cybercrime incident (CI) architecture [6], a framework that serves as a reference for monitoring, assessing, and mitigating cybercrime incident occurrences [7,8], and it has been the foundation for many applied approaches such as the classification of cybercrime offenses using machine learning techniques [9]. Using a similar approach, this work aims to lay the ground for the investigation and mitigation of fake news incident occurrences. The first step towards constructing a blueprint for the effective handling and mitigation of such incidents is to investigate the fake news phenomenon and examine its various properties. The authors conducted an extensive literature research and identified the main issues and challenges of fake news dissemination. Each of the challenges corresponds to a fake news property that is incorporated in DCAM-DB. These challenges are articulated below and detailed in the rest of the paper: 1.
What have fake news and disinformation come to encompass? What phenomenon do they describe? 2.
What are the types of disinformation, and what are the attributes that distinguish them? Are all types of disinformation malicious? 3.
Who are the participating actors in the fabrication and propagation of fake news? What is their motivation and expected gains/benefits, if any? 4.
What is the target audience of disinformation, and what is the impact and consequences of fake news exposure? 5.
What are the existing detection strategies, and what is expected towards fake news mitigation and handling?
The aim of the paper is to identify the emergent properties and entities involved in fake news incidents and to construct a disinformation blueprint of such events. The rest of the paper is organized around these issues, providing a critical overview of the existing literature. The first two challenges are discussed in Section 2. Section 3 separates the participating actors in content producers and broadcasters and discusses these two groups along with their motivation for fabricating and disseminating intentionally deceiving content. Section 4 examines the target audience of fake news, the factors that affect its susceptibility, and the impact of exposure to disinformation. Section 5 discusses the existing detection and mitigation strategies that include both manual and automated approaches. Finally, in Section 6 the authors lay the ground for DCAM-DB by proposing a thorough examination of the emergent fake news properties and entities through the lens of the cybercrime incident architecture [6].

Definitions, Types and Attributes of Fake News
Based on the first two challenges, the aim of this section is to provide a framework for understanding the phenomena of fake news and intentional disinformation. We argue that not having an established common understanding for fake news undermines its effective handling, detection, and mitigation. In this context, the authors examine existing fake news definitions, identify common forms of disinformation, and discuss the importance of two distinguishing content-related attributes: essence and intention.

Fake News Definitions
The term 'fake news' is not appropriately defined and is often interchangeably used with other Internet or technology-linked misinformation acts such as fabricated news, hoaxes, clickbait, etc. [10]. The Collins English Dictionary [11] selected fake news as the most popular term in 2017 and defined it as "false, often sensational, information disseminated under the guise of news reporting". Based on Shu et al. [12], fake news is intentionally and verifiably false and can mislead readers. These authors also suggest that "fake news is essentially a distortion bias on information manipulated by the publisher" [12]. Tandoc et al. [13] note that the word 'fake' is often used interchangeably with words such as copy, forgery, counterfeit, and inauthentic. Other authors situate fake news within the context of misinformation and disinformation. Wardle [14] suggests that precise definitions often deal narrowly with fabricated news reports produced either for profit or for political purposes and that the term 'fake' does not fully describe the complexity of the different types of misinformation and disinformation. Misinformation refers to "the inadvertent sharing of false information" [14,15] and disinformation refers to "the deliberate creation and sharing of information known to be false" [14]. A European Union (EU) report based on the independent High-Level Expert Group [16] discourages the use of the term fake news as the term is considered inadequate to communicate the magnitude of the consequences it begets. Instead, the report adopts the term disinformation described as "false, inaccurate, or misleading information designed, presented and promoted to intentionally cause public harm or for-profit" [16,17].
There are considerable challenges in finding common ground on what the phenomenon of fake news encompasses as depending on the area of focus, it is identified differently. Based on our research on existing fake news and disinformation definitions, we assert that fake news is an umbrella-term synonymous with disinformation, and it is the deliberate dissemination of distorted events, non-cross-referenced facts, or fabricated information that is spread online with the intent to mislead or deceive its target audience.

Prevalent Types of Disinformation
Less research exists on the categorization of the disinformation events that occur online. Zannettou et al. [18] conducted relevant research on the types of false information available online and proposes a categorization into six types: fabricated, propaganda, hoaxes, rumors, clickbait, and satire news. Similarly, Tandoc et al. [13] categorize the types of fake news into propaganda, advertising, photo manipulation, fabrication, parody, and satire. Based on extensive research and consulting the above classifications, we assembled the most prevalent forms of disinformation that are encountered online and fall under our fake news umbrella-term definition. For each of the identified types below, the authors provide a short description and an indicative occurrence: Clickbait-News items with misleading headlines, or captions that intend to incite excitement and curiosity to entice users. Such items exploit linguistic features such as capital and bold letters, exclamation marks, ellipsis, sentimental words and interjections, or unfinished sentences. The content of click bait articles generally contains opinionated and inflammatory language [12,19,20]. An example of clickbait is a news story [21] titled "Cat DIES after COVID-19: Report". In this article it is explicitly mentioned that the cat did not die from the SARS-CoV2 infection. This is a typical clickbait example, using capital letters and a strong word to attract the users, whereas the actual content of the article does not reflect the clickbait title.
Computational propaganda-The deployment of algorithms and automated propagation methods to intentionally generate and share distorted information online. Computational propaganda includes learning from and mimicking original online accounts on social media platforms and aims to distort public opinion. It is mainly executed by bots that orchestrate the activity of several online accounts to disperse false information [22]. A recent example of computational bot-produced propaganda is tweets-produced by fake accounts-demeaning climate change an as non-existent [23].
Conspiracy theories-Fictional stories that invoke a conspiracy without proof; such stories revolve around supposedly illegal acts conducted by governments or powerful individuals. These theories put forward unsourced information or jump to conclusions lacking disclosure [18,24]. A popular example of conspiracy theory is the one claiming that the Earth is flat [25]. The conspiracy theorists do not benefit in any particular way from disseminating such theories; they strongly consider them as true and aspire to reach a wider audience.
Fabricated news-News items with no factual basis that appear legitimate by being disguised as original news items. They include no implicit disclosure that the item is fabricated, including the intention of misinforming, and can be published on a website, blog, or social media platform. An example of fabricated news is the Washington Post story of an 8-year-old heroin addict titled "Jimmy's World" that earned a Pulitzer Prize for the journalist Janet Cook. Later research showed that Jimmy did not exist [26].
Hoax articles-News stories that contain facts that are either fabricated or inaccurate but presented as legitimate half-truth or factoid stories (hoax facts or hoax articles, respectively) [10]. These stories are published online in an attempt to convince their reader into believing that something false is valid [14,26,27]. One of the most well-known examples of hoax stories is known as the "Great Moon Hoax", published in 1835 by the New York Sun about the alleged exploration of life on the moon [28].
News parody-This shares many characteristics with satire due to the fact that both rely on humor as a means of drawing an audience; it also uses a presentation format that mimics mainstream news media [13]. news parodies differ from satire in their use of nonfactual information to inject humor [29]. An example of news parody is the Saturday Night Live TV show with spoof and parody performances [30].
News satire-Disguised as real news, it contains humor or exaggeration to present audiences with news updates; they are not meant to be taken seriously and can be found on TV or websites. Nonetheless, a key difference of satire and parody compared to other forms of disinformation is that they provide disclosure to the fact that their primary target is entertainment rather than accurate news delivery [13,18,31]. A typical example of news satire is the content produced by the known website "The Onion" [32]. As an example, a satire report titled "DNC Concerned Warm, Cozy Beds On Brisk November Morning Could Keep Voters From Going To Polls On Election Day" addresses the issue of abstinence during the elections in a humorous manner [33].
Photo manipulation-Tampering with original images or videos to create a false narrative; visual news that aims to mislead, which takes advantage of the advent of digital photos, powerful image manipulation software, and knowledge of manipulation techniques [10]. It is common knowledge that an image can be easily used to mislead [13,34] when placed in unrelated context. An example of photo manipulation occurred on January 2020 during the Australia wildfires where photos of animal suffering spread online. However, one illustrating a deer standing amid burned rubble was taken in a previous fire and a totally different location, specifically in California during another fire season [35].
Political propaganda-A type of fake story that aims to inflict damage on a particular political party or nation-state with no implicit disclosure that the story is fabricated and with the intention of deceiving the audience into a particular political/social agenda [17,31,36]. A recent item of political propaganda was produced by Donald Trump, claiming that "In manufacturing I brought back 700 thousand jobs, (Obama and Biden) brought back nothing". This statement according to the statistics is false [37,38] as the actual increase is about 450 thousand and during the Obama presidency the increase was about 900 thousand.
(Online) rumors/comments-Narratives whose accuracy is vague or never established, passed along from person to person, usually by word of mouth or online comments/posts, without reliable standards of evidence; however, the information is ever-modified according to the desires of those who pass it on [39,40]. For example, many individuals and groups believe that Barack Obama is a Muslim even after this was exposed to be untrue [41].

The Importance of Content Essence and Intention
Two underlining features emerging from the identified types of fake news are that (i) its content is presented as original but it is-entirely or partly-fabricated and (ii) it is easily propagated online. Apart from these features, which serve as a common denominator, there are also two attributes that differentiate them: 1.
The essence of the content; whether the news item is based on actual facts or is entirely fictional, and, 2.
The intention of the authoring source; whether the news item attempts to intentionally mislead and deceive, or whether it properly discloses the nature of the content. Table 1 presents a classification of the identified fake news types based on the above attributes. In relation to essence, conspiracy theories, fabricated news, and news parodies present entirely fictional stories with no factual basis. Computational propaganda, clickbait, photo manipulation, and political propaganda and rumors present stories that have a partial factual basis but, in most cases, contain a distorted fact, an exaggerated truth, or a non-cross-referenced event [10]. Finally, hoax articles and news satire can either contain factual or fictional content. Regarding intention, news parody and news satire are the only types that provide disclosure of the nature of their content; they hence alleviate any malignant effect from their factual or fictional-but not genuine-nature. All the remaining types of fake news do not provide any explicit disclosure and thus attempt to intentionally mislead and deceive their audience. Based on the essence and intention criteria, it emerges that the disinformation items that combine a fact-based essence with misleading intentions are the most dangerous as they can deceive their recipients. This conjecture stems from the observation that a semi-true story could be much more easily perceived as true. On the other hand, the pieces of information that are completely fictional are less dangerous since the deception is generally more obvious and thus is easily dismissed. At a later research stage, the severity of fake news types based on the targeted audience and the projected impact can be added to the proposed classification.

Fake News Producers and Broadcasters
The emergence of fake news originates from specific actors that generate, host, support, and disseminate the disinformation material. These entities can be human or non-human, and their aim is to produce and broadcast content that falls into one or more of the categories of the previous section, i.e., to disseminate fake news. Based on further examination, these actors can be broadly separated into the content producers or generators (human and nonhuman) and the content hosts or broadcasters. This section also touches on the motivating factors behind the generation of disinformation material.

Content Producers (Human)
The web has made content generation easy and accessible to the public within various platforms (e.g., WordPress) and social media sites (e.g., Facebook, Twitter). This means that any individual with Internet access can potentially generate fake news content by writing an article or uploading a post or a tweet [42]. These posts can either be anonymous or eponymous, both with their own advantages and disadvantages. Posting anonymously-or under a nickname-can lead to unrestrained, conspiring, or obscene claims since there is (in the majority of cases) no accountability. A particular group that engages in malicious anonymous posting is trolls. The term "troll" [43] is used increasingly in social media networks and digital news media and applies to users that intend to bother or upset other users [10]. An example of troll-originating offensive practice is posting aggravating or irrelevant messages to derail the flow of discussion on a website and upset its users [44].
Posting eponymously can utilize the weight of the name bearer, especially in the case of an influencer or a professional journalist, thus lending credibility to non-credible sources, claims, and theories. Influencers are digitally famous individuals that assert significant influence over online users and have gained prominence by promoting products and services through specific lifestyle choices. Journalists are responsible for the majority of online news-related generated content. They can employ professional techniques and strategies to increase traffic, i.e., by using an exaggerated headline or a provocative distorted photo that is appealing to the readers [4,17,45].

Content Generators (Non-Human)
Another category of the disinformation crew is bots. Bots are automated software programs deployed to spread computational propaganda, by performing simple, repetitive, robotic tasks [21,22,46]. These are programs that are, among others, responsible for the online activity of several fake accounts that disseminate false information. Bots are usually attached to fake accounts that are recruited to produce and spread false information on the Web [10]. A bot is usually used for financial gain by organizations [18] or to infiltrate political dialogue, handle the stock market, remove personal information, and spread misinformation in general. This category is severely harmful for the public as bots have the capability to disguise themselves as human users [47] and reproduce content on a very large scale [48]. This can easily mislead users to share the disinformation item after believing it is actually legitimate news. Bots are capable of increasing traffic in a website in a much higher quantity than human content generators [49].

Content Hosts and Broadcasters
This category refers to the (dis)information broadcaster, which can be a news organization, a political or activist organization, an unlawful acting group or even a government, or a social networking site (SNS). The influential power of a news organization provides them with the capability to skew data and relevant information towards a specific point of view. Additionally, some news organizations can be prone to broadcasting falsehoods by making stories more appealing, to increase their audience and business activity [18,50]. There are also other groups that promote their interests by sharing false information to support a specific narrative. A recent example involves the National Rifle Association, a non-profit organization that defends gun rights, which disseminated false information to manipulate people about guns [51]. Other examples include political parties that share false information, especially near major elections [2]. Another type of fake content broadcasters is entities with unlawful background that employ mischievous tactics to communicate their message. Recent examples include the ISIS terrorist organization, which feeds SNSs with fabricated information [12,20,52], and white supremacist/nationalist groups, which employ the web to recruit new members [53]. Such groups use misleading tactics to draw attention to their causes while presenting themselves as serious and scholarly [54].
National governments have also been exploiting social media to shape public opinion on different topics. Donald Trump, as President of the USA, embraced anti-vaccination conspiracies [54,55]. Another recent example of government-oriented information manipulation took place in early 2020, when a network of Twitter accounts was employing coordinated inauthentic activity that was primarily targeted at domestic audiences within Turkey. This was proved to be a collection of fake and compromised accounts that were being used to amplify political narratives. As a result, Twitter removed 7340 accounts. The same happened with inauthentic Saudi, Russian, and Chinese accounts that were inflating information on geopolitical issues [56,57]. Social networking sites (i.e., Facebook, Twitter, and YouTube) play an important role in hosting and broadcasting disinformation items as they are the main gateways through which information is being sought and shared. They have developed into a fertile ecosystem for the extensive dispersion of unverified stories because they nurture homogeneous and polarized communities (echo chambers) that have similar information consumption patterns [58,59]. It is shown in [60] that users on Facebook tend to follow like-minded people and thus acquire knowledge that supports their existing narratives. We argue that the echo chamber effect facilitates and accelerates the consumption and propagation of fake news.

Motivation
In relation to the motivation that drives the fake news content producers and broadcasters, it can be financial, political, or to assert influence on their audience. Shu et al. [12] refer to the social and psychological foundations of the fake news ecosystem, while Bakir and McStay [61] report the economic or political gain that motivates the fake news circulation. Many actors in the false information ecosystem seek monetary profit for their organization or website. To accomplish this, they regularly propagate false information that raises the traffic on their website. This leads to grown advertisement income that results in pecuniary profit for the organization or website, at the expense of manipulated users [18]. One of the most recent examples of fake news stories produced for financial profit includes North Macedonian teenagers who created and spread distorted and fictional stories about the 2016 American presidential candidates [62].
A political impulse has also been recognized as a strong motivator in fake news stories recently [22]. The actors of such disinformation intend to manipulate public judgment on special matters and individuals and on their opinions of the society [52]. Political disinformation efforts are typically used to plant mistrust and confusion about what sources of information are authentic, making people confused about what and whom to believe in. Politically driven disinformation requires serious attention due to the hurdles it poses for society and democratic institutions [10]. New advanced technologies produce and share political disinformation and thus make it harder to detect and fight the manipulation, for journalists, fact-checkers, and citizens [17].

Target Audience and Projected Impact
On the receiving and consuming side of the digital communities are the content recipients, the platform users, or simply the online audience. The content recipients are the individuals who use the Internet as a portal to receiving the news but also to repost articles, react, comment, "like", retweet, and share without being the content producers themselves. The content recipients can propagate disinformation by reading, relating to, and sharing a story they encountered on a social media platform or a website, without previously cross-checking the accuracy of the content. It has been noted that the spread of information among users is characterized by homophily, i.e., the tendency for people to seek out or be attracted to those who are similar to themselves [60]. Online users tend to follow online communities of like-minded people and acquire knowledge that reinforces their already-supported existing narratives [60].
The most prevalent audience motives that make it susceptible to disinformation are entertainment, personal enjoyment, online socializing, information seeking, self-expression, and status-seeking [63]. Users may actively generate and distribute disinformation to create online social relations to earn fame and digital friends [64]. They are mobilized by likes, shares, and comments to create content that will resonate with their friends, followers, and groups, and media manipulation might be a way to gain "rank" and express individuality among their peers [54,65].
Two important concepts that explain the behavior of the online audience regarding disinformation are naive realism and confirmation bias [12]. Naive realism represents users who tend to believe that their opinions and understandings of reality are the only accurate ones, while others who differ are considered uninformed, irrational, or biased. Confirmation bias users prefer to accept information that establishes their existing beliefs. Due to these patterns of thought, fake news can often be regarded as real. The effects of fake news regarding the online audience are also influenced by three main factors.

Target Group Availability
The availability characteristic focuses on the quality and quantity of time the users spend on using the Internet in the first place. People with more free time, and thus more availability, are characterized as heavy media users [66], and are the ones who have more time to spend searching various media offerings. The heavy media users are aware of most of the information alternatives that are offered by the media ecosystem since they have the time to investigate more. According to a study [67], the heavy media users cover a smaller part of the overall audience but they are also the ones that exploit the popular, as well as the unpopular, news outlets; thus, they are far more prone to propagate fake news content [68]. On the other hand, those with less free time, and thus less availability, are characterized as light media users [69]. Light media users focus their attention on the more established news media platforms and websites since they lack the time to devote to additional sources.

Target Group Age
Age is a very important factor of fake news distribution by users [70]. Particularly, the older people are more affected and manipulated by fake news stories [10]. The age factor is one of the most reliable signs of how the Internet and especially social media users interact with disinformation, more than factors such as sex, race, income, or education

Digital Intelligence
Digital literacy is the ability to understand information and to evaluate and integrate information in multiple formats that the computer can deliver. In light of the accelerated and constant evolution of digital technology, people are expected to use a developing variety of technical, cognitive, and sociological skills to perform tasks and solve problems in digital ecosystems [71][72][73][74]. The lack of digital intelligence equated to not comprehending the ways that information is produced and distributed, or the motives that drive the disinformation-content producers.
Regarding the impact of fake news, there is also scarce research [75]. Apart from elementary results, knowledge about the effects of disinformation consists of some possible kinds of influence such as increasing cynicism and apathy, and the encouragement of extremism [75,76]. Based on relevant research [77], news stories can lure audiences into developing false beliefs. Moreover, according to Gelfert [78], repetition effects entail that repeated exposure to the same information renders that information more persuasive. On an individual level, regular exposure to a particular message affects a user's perspective, viewpoints, and their behavior in general [79,80].

Detection Strategies
Fake news detection is the prompt and accurate identification of a news item being intentionally misleading. Timely detection is essential for the prevention and mitigation of the disinformation phenomenon to minimize its consequences. The volume of scattered information and the speed of its propagation creates a practical impossibility of estimating trustworthiness and authenticity promptly, increasing the need for automatic fake news detection systems [42]. Conroy et al. [81] claim that disinformation may be defined as the prediction of the chances of a particular news article being intentionally deceptive. The authors of the particular study also claim that a text analytical system can improve human skills to recognize falsifications, contribute proof for its doubts, and alert users to further fact-checking. However, it is shown that people are not great in recognizing lies, not much better than speculation, and computers can insignificantly defeat humans on limited tasks [82]. Our assertion is that fake news detection and mitigation can be deployed across two distinct paths: • Soft detection and reporting by educating and training the online audience, and, • Hard (automated) detection by designing and developing algorithms that can trace, detect, and recognize fake news.
In the relevant literature, a series of hard detection approaches are explored. An example is the code developed for hoax detection that samples and classifies posts into hoax and non-hoax [83]. Another instance is developed by Vlachos and Riedel [84] that constructs fake news and fact-checking datasets. Similarly, Ferreira and Vlachos [85] have published the Emergent dataset, which includes 300 labeled rumors. However, limited-size datasets cannot be utilized to yield a model for machine learning algorithms to detect disinformation events. Wang [86] introduced a different method to reveal falsehood. The author utilized empirical techniques to investigate disinformation events based on surface-level linguistic patterns by composing a heterogeneous network to combine metadata with text. Conroy, Rubin, and Chen [81] separate the fake news detection methods in (a) linguistic approaches in which the content of deceptive messages is extracted and analyzed to associate language patterns with deception; and (b) network approaches in which network information, such as message metadata or structured knowledge network queries, can be harnessed to provide aggregate deception measures. Both forms typically incorporate machine learning techniques for training classifiers to suit the analysis. Likewise, Figueira and Oliveira [87] divide these methods into (i) algorithms that are based on the content; (ii) algorithms that are based on the diffusion dynamics of the message; and (iii) hybrid algorithms, which are based on a weighted sum, or a group of features feeding a learning algorithm. Similarly, Rubin et al. [88] discuss that for a fake news detection tool to be developed, news satire needs to be studied as a starting point for the investigation of deliberate deception in news stories.
Some of the most popular social platforms such as Facebook and Twitter are more and more under increasing pressure to control their algorithms [89,90]. As a result, social media platforms are currently warning their members about misleading and dubious content, by developing their policies over falsehoods and adopting automated systems in detecting such content [91,92]. For example, regarding the dealing of the COVID-19 health crisis, Facebook formed a full sub-section informing its members about the new virus and at the same time, along with the Twitter platform, they have introduced a new policy of blocking posts with inaccurate content [93][94][95].
Apart from the automatic technologies that will be able to assist the users in recognizing falsehood, the digital education of the users is equally important. Digital skills, as a sum of technical, cognitive, post-cognitive, and socioemotional abilities and skills, allow users to cope with digital life's challenges and adjust to its demands [10]. People educated and equipped with digital intelligence are more capable, intelligent, and future-ready to be digital citizens [96]. Recently, on an official level, an intensive effort has been made to identify and reduce incidents of disinformation. Part of the EU Program "Horizon 2020" is the Social Observatory for Disinformation and Social Media Analysis (SOMA) [97], a content verification platform. It includes incident-control tools, methods for assessing the socio-economic impact of misinformation, actions to increase digital literacy, the analysis of legal regulations, and a repository of knowledge on disinformation. Likewise, other EU-funded disinformation-control programs have been formed, such as the PROVE-NANCE [98], which aims to establish solutions for verifying digital content directly from the source, without intermediaries, providing greater control to social media users and supporting the dynamics of social sharing with values of trust, transparency, and open participation. The European-funded projects "SocialTruth", "EUNOMIA", and "WeVerify" have a similar goal [99].
As for education, the EU Commission [100] suggests that a greater level of digital literacy will benefit European citizens to recognize online disinformation and access the Internet critical content. This would be accomplished by providing educational material to schools and students via the fact-finding teams and civil society organizations [100]. This pathway is also being followed by Canada, the Netherlands, Denmark, and Singapore, which have concentrated on peoples' fake news education with projects, campaigns, and school lessons [101][102][103]. Several manual, human-operated fact-checking tools and platforms such as PolitiFact [104] and Snopes [105] have emerged to assist the public on this matter. Equally, some automated falsehood predictors have arisen. For example, the Captain Fact tool [106] is trying to bring to the surface the credibility of an item based on users' votes. Likewise, the Claim Buster is using natural language processing methods for live fact-checking, functioning as a search engine for key words and structures that are commonly found in factual statements through fact-checking websites [107]. Nevertheless, the existing fact-checking tools cannot compete with the volume of newly generated and distributed information, particularly on social media. This enhances the necessity for further systematic approaches in fake news mitigation that combine both soft and hard detection methods.

Towards a Disinformation Blueprint Based on CI Architecture
What is evident from the above overview is that, even at a conceptual level, a comprehensive blueprint of what constitutes fake news, that features the further classification of occurrences, detection methods, and mitigation actions, does not exist. The authors identify three main challenges that prohibit the effective detection and mitigation of disinformation events: (a) a lack of a commonly accepted reference of what the fake news phenomenon encompasses; (b) a lack of a typology for the various occurrences of fake news incidents; and (c) the absence of longstanding qualitative/quantitative studies of fake news cases that could effectively contribute to the recommendation and adoption of appropriate measures and effective mitigation actions. In previous work [6], we have identified similar challenges for cybercrime incidents (CIs) and constructed the cybercrime incident architecture, a comprehensive blueprint towards effective CI management. This structure has succeeded in generating insights for CIs, monitoring their threat severity, and producing actionable measures and guidelines for individuals, organizations, and law enforcement agencies.
The architecture has been the foundation for a variety of applied approaches such as the classification of cybercrime offenses using machine learning techniques [9]. In a similar manner, this work proposes DCAM (detect, classify, assess, and mitigate)-DB (disinformation blueprint) for fake news mitigation based on the CI architecture. Table 2 shows the architectural components for handling CIs and how they can be accommodated towards disinformation handling and mitigation.
The first component of the CI architecture identifies the main features of cybercrime incidents and results in a feature-based description that facilitates the elaborate understanding of a specific incident. This component could be fine-tuned to the context-specific features of disinformation that are discussed in this paper, namely, essence, intention, producer, broadcaster, motivation, audience, and impact. By distinguishing between these features in terms of specific values for particular fake news incidents, we argue that the detection strategies will be facilitated and become more customized and effective based on specific feature combinations. For example, different techniques will need to apply for detecting computational propaganda originating from another country, unlike conspiracy theories on a non-crucial issue. The second component of the CI architecture provides a two-level offense classification system for CIs that can produce association rules that contextualize the CI features. In Section 2, the authors presented an initial classification of fake news types that can be further elaborated on and combined with the component I features in DCAM-DB to help identify how these features associate and interact with each other. This will result in a much better understanding of fake news dynamics. For example, it could emerge that conspiracy theories (fake news type) target a specific vulnerable portion of the audience (fake news feature); thus, this needs to be prioritized in training and education. The third component is occupied by monitoring cybercrime offenses and analyzing their individual occurrences. As this paper discussed, there is largely a lack of datasets or assessment methods for fake news incidents, except for mostly manual approaches. This component can be used in DCAM-DB as a qualifier to monitor and gather data from past acknowledged fake news incidents to be able to better assess and take appropriate action towards existing and/or new disinformation events. The first three components essentially help one to distinguish between unique disinformation events and the fourth component attempts to match them with appropriate (a) short-term preventive measures and actions for mitigation, and (b) long-term policy legislation in national or international level. The principal aim of adaptive response policy (ARP) [6] is to produce (i) immediate actions for particular CIs, (ii) specific measures to prevent similar offenses, and (iii) elaborated policies for a specific category of CIs. The same should transfer to disinformation events by allocating specific actions, measures, and policies so that they are tackled with an ammunition that ranges from immediate actions to national policies.
The cybercrime incident architecture-by having four interconnected components, each dealing with a separate aspect of an incident-can be a rounded approach for mitigating disinformation events. The authors intend, as future work, to further adapt and customize DCAM-BD as a solid blueprint for disinformation detection and effective mitigation. Currently, we are working on acclimatizing components I and II with corresponding case studies based on recent disinformation events (e.g., COVID-19 pandemic, USA 2020 presidential elections). We assert that DCAM-DB will facilitate the detection approaches by (a) creating real-life or synthetic structured datasets based on the identified features and their values, and (b) enabling machine learning and natural language processing algorithms to be trained on crawled datasets based on a given structure.

Conclusions
The Internet contributed to the democratization of the media as it extended their reach and the capability of content creation to the wider public. However, the digital ecosystem has become a rich soil for disinformation dissemination. This paper presented an overview of challenges surrounding fake news and disinformation events based on the relevant literature under the lens of composing them to a structured disinformation blueprint. It provided a definition of fake news along with examples of the most prevalent types of fake news. These types were discerned based on essence and intention in a classification that can be further elaborated on based on additional distinguishing features. The human and non-human producers of fake news, along with their respective motives, were discussed in an effort to understand the originators of disinformation events. The vulnerability of the target audience was identified based on respective attributes, i.e., availability, age, and digital literacy. Additionally, the most common detection approaches were located in literature and were classified as either soft or hard detection strategies. The paper argued that an effective mitigation course of action should deploy a combination of both strategies.
The overview of these subsequent challenges revealed the importance of addressing them in the context of a concise framework such as DCAM-DB. The authors qualified the CI architectural framework, briefly addressing how it could be further customized to accommodate disinformation events. The benefits of having an established approach towards detection, classification, assessment, and mitigation could provide a solid foundation for the timely resolution of the ubiquitous fake news phenomenon. The main contributions of this work to disinformation are (i) a thorough study of relevant literature, (ii) the compilation of the different properties and entities around disinformation, and (iii) the proposal of DCAM-DB as a systemic investigation approach through the lens of the cybercrime incident architecture. The authors acknowledge the need for further quantitative and longitudinal research to solidify their theoretical findings, the more elaborate classification of fake news incidents, and the effective detection and mitigation of disinformation.