Topic
Theory is essential, but nothing illuminates the mechanics of cognitive warfare like documented operations — real-world cases where nations and non-state actors have waged war in the information space. These operations reveal tactics, techniques, and procedures (TTPs) that would remain abstract in doctrinal documents. They expose vulnerabilities, demonstrate consequences, and provide lessons for defense.
Documented operations are not historical curiosities. Adversaries study them. They adapt and improve. Defenders who ignore past operations are condemned to be surprised by their evolution. This article examines some of the most significant documented influence operations, from Cold War active measures to contemporary disinformation campaigns.
A documented operation is a case study of an influence, disinformation, or cognitive warfare campaign that has been:
Attributed (with high confidence) to a specific state or non-state actor
Analyzed by intelligence agencies, academic researchers, or investigative journalists
Verified through multiple sources (technical forensics, human intelligence, leaked documents, whistleblower testimony)
Declassified or otherwise made available for public or professional study
Documented operations serve as the empirical foundation for cognitive warfare doctrine, threat assessment, and countermeasure development.
One of the most successful disinformation campaigns in history. The Soviet KGB fabricated the story that the United States invented HIV/AIDS as a biological weapon during Pentagon experiments. The disinformation was laundered through a Soviet-aligned Indian newspaper, amplified by Soviet-backed front organizations, and eventually spread globally.
Impact: The “AIDS is man-made” narrative persists decades later, undermining public health efforts and trust in Western medicine. The operation demonstrated the long-term durability of successful disinformation.
Tactics used: Black propaganda (false attribution), information laundering, front organizations, long-term narrative persistence.
Defense lessons: Once a disinformation narrative takes root, debunking is insufficient. Pre-bunking (inoculation) and trusted messenger networks are essential.
A forged letter purportedly from Soviet leader Grigory Zinoviev to British communists, instructing them to incite revolution. The forgery, likely created by White Russian émigrés or British intelligence, was published in the British press days before the 1924 general election.
Impact: Contributed to the defeat of the Labour Party and the election of Conservative Prime Minister Stanley Baldwin. Demonstrated that a single forged document, timed to an election, could change national political outcomes.
Defense lessons: Election-timed forgeries remain a tactic. Verification protocols and journalistic standards are essential defenses.
The most extensively documented cognitive warfare operation in history. The Russian Internet Research Agency (IRA), a St. Petersburg-based “troll farm,” conducted a multi-year campaign to influence the 2016 US election. The operation included:
Social media manipulation: Thousands of fake accounts on Facebook, Twitter, Instagram, YouTube, and Tumblr
Divided audiences: Content tailored to polarize: pro-Black Lives Matter content to African American audiences; anti-immigrant content to conservative white audiences
Real-world events: Organized rallies both supporting and opposing candidates (often both simultaneously)
Hacked-and-leaked operations: GRU cyber intrusions into Democratic National Committee and Hillary Clinton campaign emails, released through WikiLeaks and DCLeaks
Local targeting: Focused on swing states (Michigan, Wisconsin, Pennsylvania, Florida) with geo-targeted content
Impact: While the effect on election outcomes remains debated, the operation succeeded in: exacerbating existing social divisions, eroding trust in democratic institutions, normalizing disinformation consumption, and creating an enduring “information fog” around the election.
Tactics used: Coordinated inauthentic behavior (CIB), bot networks, paid advertising, fake grassroots events, hacked-and-leaked, influence on journalists, microtargeting.
Defense lessons: Social media platforms are vulnerable to state-sponsored manipulation; defensive responses were slow and reactive; attribution is possible but requires political will; societal resilience (media literacy, trust in institutions) is the ultimate defense.
Following the US experience, Russian actors attempted similar interference in the French election between Emmanuel Macron and Marine Le Pen. Tactics included:
MacronLeaks: Hacked Macron campaign emails released days before the election
Bot amplification: Massive bot networks amplified “#MacronLeaks” and disinformation narratives
Fake news sites: Dozens of French-language disinformation websites created
Politically balanced interference: Content both supporting Le Pen and opposing Macron
Impact: The French response was more effective than the US response. A law prohibiting election coverage of hacked materials in the final days limited the leak’s impact. Platform cooperation was faster. Macron won decisively.
Defense lessons: Pre-election legal frameworks, platform cooperation, rapid public communication, and societal awareness can mitigate interference.
Researchers have documented a massive Chinese influence operation dubbed “Spamouflage” — networks of fake social media accounts promoting Chinese government narratives and attacking critics. Key features:
Scale: Hundreds of thousands of accounts across multiple platforms (Twitter, Facebook, Reddit, Medium, Quora)
Content: Pro-China narratives on Xinjiang, Hong Kong, Taiwan, COVID-19 origins, Belt and Road Initiative
Tactics: Copy-pasted identical comments, coordinated hashtag campaigns, harassment of journalists and activists
Evolution: Increasing sophistication over time; use of AI-generated profile photos; integration of video and multimedia
Impact: Limited penetration in Western audiences (lower effectiveness than Russian operations) but significant influence in Global South and diaspora communities. Chinese operations focus more on shaping international institutional narratives (UN, WHO) than electoral interference.
Defense lessons: Attribution is possible through technical forensics (coordinated behavior, infrastructure overlaps). Content moderation challenges differ for state-sponsored disinformation vs. organic content.
During the Hong Kong anti-extradition protests, Chinese state and party actors conducted extensive information operations:
WeChat censorship and surveillance: Domestic platform used for monitoring and suppressing protest coordination
Global narrative shaping: State media (Xinhua, CGTN, Global Times) framed protests as “violent riots” encouraged by foreign powers
Targeted Western journalists: Coordinated harassment and doxxing of journalists covering protests critically
Suppression of protest-related content: WeChat, Weibo, and Douyin removed protest content; overseas platforms pressured to follow
Impact: Successfully isolated protest information within Hong Kong; limited international sympathy; framed global discourse around “foreign interference” in Chinese affairs.
Defense lessons: Authoritarian information control differs from democratic information warfare; platform governance becomes geopolitical.
Iran conducts influence operations targeting regional adversaries (Saudi Arabia, Israel) and Western nations. Notable campaigns include:
Operation “Endless Mayfly”: A network of fake news sites and social media accounts impersonating legitimate US media (e.g., fake “News Examiner,” fake “Real Progressive Front”)
Hawaii missile alert hoax: Iranian actors reportedly amplified false reports of a missile attack on Hawaii during the 2018 false alert incident
Inauthentic social media clusters: Coordinated campaigns supporting Palestinian causes, criticizing Saudi Arabia, promoting anti-US narratives
Impact: Less sophisticated than Russian operations, but persistent. Iranian operations focus on regional influence and disrupting adversaries.
Defense lessons: Attribution is challenging for nations with less technical infrastructure; threat actors share TTPs and may collaborate.
ISIS revolutionized terrorist use of information operations. Key elements:
Professional-grade propaganda: “Media wings” (Al-Hayat, Al-Furqan) produced high-quality videos, magazines (Dabiq, Rumiyah), and nasheeds (acapella hymns)
Decentralized distribution: Telegram channels, Rocket.Chat servers, and decentralized social media strategies that survived platform bans
Inspiration, not direction: Shift from operational direction to “inspiration” — providing ideological justification and tactical guidance for lone actors
Gaming platform recruitment: Use of Discord, Steam, and gaming voice chat for recruitment
Virtual entrepreneurs: Self-radicalized individuals who operated independently, reducing attribution to central command
Impact: Inspired attacks globally (San Bernardino, Orlando, Nice, Manchester, Barcelona). Demonstrated that non-state actors can conduct sophisticated information operations without state resources.
Defense lessons: Counterterrorism information operations require different approaches (counter-narratives, exit programs) than state-on-state cognitive warfare.
| Tactic | Description | Actors |
|---|---|---|
| Fake grassroots (astroturfing) | Creating illusion of organic movements | Russia, China, Iran |
| Hacked-and-leaked | Stealing and selectively releasing compromising information | Russia, China (alleged) |
| Bot amplification | Using automated accounts to inflate engagement | Russia, China, Iran |
| Information laundering | Moving disinformation from fringe to mainstream | Russia, China, Iran, ISIS |
| Targeted harassment | Silencing journalists, activists, officials | China, Russia |
| Election timing | Releasing compromising material days before votes | Russia |
| Divided audiences | Sending different messages to different demographics | Russia |
Documented operations that were mitigated or defeated share common factors:
Rapid detection and attribution: Shortening the window between operation launch and public identification
Platform cooperation: Social media companies removing inauthentic accounts quickly
Legal frameworks: Laws limiting election-period disinformation (France) or requiring transparency (EU Digital Services Act)
Media literacy: Populations trained to recognize manipulation tactics
Trusted institutions: Credible counter-messengers (elections officials, public health authorities, journalists)
International coordination: Information sharing among affected nations
For defense professionals, documented operations serve multiple purposes:
Identify adversary TTPs (tactics, techniques, procedures)
Map adversary infrastructure (domains, accounts, hosting providers)
Understand targeting preferences (demographics, regions, platforms)
Anticipate future operations based on past patterns
Simulated operations based on real-world cases
Red teaming using adversary TTPs
After-action reviews of defensive responses to actual operations
Codify lessons learned from successful and failed defenses
Develop counter-TTP libraries
Establish attribution and response protocols
Declassify and communicate past operations to build public awareness
Inoculate populations by exposing manipulation tactics (pre-bunking)
Build trust through transparency
Documented operations have inherent limitations for defense analysis:
Attribution uncertainty: Some operations remain unattributed or contested
Counterfactual impossibility: Cannot know what would have happened without the operation
Observation effects: Adversaries change TTPs when operations are exposed
Classification barriers: Most sensitive operations remain classified indefinitely
Attribution-response gap: Knowing who conducted an operation does not guarantee ability to respond
Documented operations are the empirical foundation of cognitive warfare defense. From Cold War forgeries to contemporary social media manipulation, these cases reveal how adversaries think, what tools they use, and which vulnerabilities they exploit. They demonstrate that disinformation works — not always in achieving specific outcomes, but reliably in eroding trust, exacerbating divisions, and creating information fog.
For defense professionals, studying documented operations is not academic. It is operational preparation. Adversaries study past operations to improve future ones. Defenders who do the same will be perpetually behind. Those who learn systematically — extracting TTPs, identifying patterns, developing countermeasures — can anticipate, detect, and mitigate before the next operation achieves its objectives.
The cognitive battlefield is not new. But the documented operations of the past decade have revealed its contours with unprecedented clarity. The question is whether defenders will learn from them.
6 analyses
Between 2014 and 2024 the Internet Research Agency evolved from domestic test campaigns into a persistent, adaptive foreign influence capability. Each round of platform countermeasures produced subtler methods, not retreat.
Soviet active measures were not just propaganda but a covert influence doctrine built on deniability, forgeries and long-term source cultivation. They anticipated much of today's hybrid toolkit and faced the same limits.
In 1983 the KGB planted a story that the US Army had created AIDS. The claim was false and its Soviet origin was later admitted, yet it still circulates four decades on.
Influence operations target the analytical process itself: they plant sources, launder citations and inflate credibility. Source evaluation therefore has to be continuous and treated as an operational security issue.
Attribution is not just a forensic exercise: sophisticated states plant, blur and contradict evidence to shape how investigators and governments respond. Treating attribution as a contested space changes how it should be done.
A documented influence operation is a coordinated campaign whose methods and, ideally, sponsor have been established through evidence published by researchers, platforms or governments. Studying them shows that most work by amplifying divisions, not…
