A crisis creates two races. The first is to determine what happened. The second is to explain what happened.
They do not run at the same speed.
Evidence takes time. Witnesses contradict one another. Investigators establish timelines. Records have to be checked. Video must be authenticated. Organizations decide what they know, what they suspect, what they can prove and what they are prepared to say.
The information environment has no equivalent obligation. A cellphone video can appear in seconds. A theory can appear immediately afterward. A caption can turn uncertainty into accusation. A creator can turn the accusation into content.
Millions of people can begin asking what an event means before anyone is in a position to say confidently what occurred. That interval is the terrain of this chapter.
Seventeen minutes is not a scientific constant
The distinction matters. There is no established research finding that says an actor has precisely seventeen minutes to capture a breaking event. The number belongs to the operation in the novel, whose analysts estimate afterward that they owned the opening direction for roughly that long, and conclude by the fourth hour that they are no longer necessary.
That is fiction. The underlying mechanism is not.
Researchers have documented a recurring vulnerability around breaking news: people suddenly begin searching for information before authoritative or high-quality material exists. Michael Golebiewski and danah boyd call one version of this a data void. Breaking events can produce abrupt spikes in unfamiliar search terms while reliable information is still scarce, and manipulators can exploit that interval by publishing faster than legitimate sources can establish the facts.
The window does not have to last seventeen minutes. It only has to exist.
The demand for meaning arrives before the evidence
People rarely encounter a major event and calmly suspend judgment. They search. They ask friends. They watch the same clip repeatedly. They look for someone who can explain what they are seeing.
Uncertainty itself appears to help keep information moving. Research on large sets of fact-checked stories has found evidence that ambiguous information can reappear strongly, in part because uncertainty encourages additional information seeking.
- Who did it?
- Why?
- Was it deliberate?
- What are they hiding?
- Who benefits?
- Is this connected to something else?
A narrative that arrives during this period does not enter an empty mind. It enters an active investigation being conducted by millions of people with wildly different levels of knowledge.
The first frame does not have to be false
This is where misinformation becomes too narrow a category. The most effective early narrative may contain genuine evidence: a real photograph, a real argument, a real government failure, a real suspicious coincidence, a real person saying something foolish.
The manipulation can occur in the relationship between those facts. Selection. Sequence. Omission. Inference. The operator may not need to invent the event. It needs to answer the question of what the event means.
In the novel the Beijing team is not trying to manufacture an entirely new American worldview after the shooting. They are selecting among interpretations Americans already know how to recognize. The operation provides a route through the evidence. The audience provides everything else.
An interpretive void, not only a data void
Immediately after an event there can be plenty of data: video, photographs, posts, witness accounts, police radio, screenshots, maps. The scarce resource is not information. It is a reliable explanation connecting the information.
A modern crisis can simultaneously contain too much evidence and too little knowledge.
The person who supplies the first coherent interpretation therefore has an advantage. Not because people will believe it forever. Because later information arrives into a structure that now exists. The question has already been framed.
The operator does not need to persuade everyone
Traditional propaganda is often imagined as a message created and a message believed. Modern influence can work differently. The actor creates a stimulus. Some people believe it. Others attack it, investigate it, ridicule it, produce reaction videos, search the phrase, create explainers. Journalists cover the controversy. Politicians respond to the coverage.
Each reaction can increase the visibility of the underlying frame. The original claim can even lose, and the frame can survive.
The message can fail. It only has to fail interestingly.
Domestic adoption changes the operation
Real influence operations have demonstrated versions of this, usually with far less success than the novel grants its operators. After Hurricane Helene, Graphika observed likely Spamouflage-linked and pro-China accounts copying and amplifying criticism of U.S. disaster relief that was already circulating among prominent English-language users.
The foreign accounts did not need to invent the domestic grievance. They attached themselves to a narrative already moving through American communities. The division already exists. The suspicion already exists. The authentic voices already exist.
The audience becomes the distribution network
Once authentic people begin carrying the narrative, attribution becomes less useful. An account with a foreign operator behind it can be identified. A coordinated network can be mapped. A bot can be removed.
But what happens when a domestic creator with a large audience sees the claim, independently finds it plausible and repeats it? The creator may have no relationship with the original operation. The audience is real. The outrage is real. The shares are real. The political consequences can be real.
The foreign actor may have supplied the spark. The combustion belongs to the domestic information environment.
The most prepared frame has the advantage
The deeper principle is not that the most convincing frame wins. It is that the frame the audience is already prepared to recognize wins. People possess reusable explanations: institutions are corrupt, the government lies, the media covers things up, elites protect one another.
These beliefs differ across communities. Some contain elements of truth. Some are wildly generalized. Some contradict one another. Their operational value is that they already exist, and a new event can be attached to them very quickly.
The adversary does not have to build the highway. It has to choose the exit.
Why correction starts behind
Institutions face the opposite problem. The investigator cannot simply select the most plausible explanation, because evidence constrains the answer.
From an evidentiary standpoint the second statement is stronger. From a narrative standpoint the first is more complete: it has protagonists, intent, causality and meaning. That does not make correction impossible, but it means truth often enters the contest later and with more qualifications.
Be first does not mean speculate first
The defensive lesson is not that institutions should race disinformation by making claims before they have evidence. That would destroy the credibility they need.
The CDC crisis and emergency risk communication framework uses the formulation be first, be right, be credible. Its guidance recommends quickly acknowledging that an event has occurred, stating what is known and unknown, establishing where reliable updates will appear, monitoring misinformation and avoiding speculation.
You may not know who fired the shot. You can still say what is known, what is not known, what emergency services are doing, where authentic updates will appear, and when the next briefing will occur.
The objective is not to win the narrative before the investigation begins. It is to keep uncertainty from becoming an abandoned space.