Anatomy of an online disinformation network: what four documented cases show

Disinformation research rarely gets a clean look at a network's machinery. Between October 2023 and August 2024, several cases produced exactly that: documented false claims, measurable reach, and named actors. Together they sketch how modern influence operations are assembled, amplified and monetised.

The clearest example came in the first days of the Israel-Hamas war. According to the Guardian, a video showing a boy in a black T-shirt lying in apparent blood, surrounded by a camera and men in kippahs and green fatigues, was posted on X with the caption "Video showing Israel attempting to create fake footage of deaths." It was viewed about 2m times. The clip was in fact a behind-the-scenes shot from Empty Place, a Palestinian short film about the vacuum left by Palestinians who fled the Israeli occupation. The user who posted it later acknowledged it may have been used out of context.

That was not an isolated case.

A second video, also originating on TikTok, claimed to show high-profile Israeli generals captured by Hamas. It collected 2m views on X. The footage had actually been published by the official YouTube channel of Azerbaijan's state security service, showing arrested former leaders of the breakaway Nagorno-Karabakh government. A doctored memo suggesting Joe Biden had given $8bn in assistance to Israel was viewed 400,000 times. The Guardian reported it was an edited version of Biden's July memo announcing $400m in aid to Ukraine, and that the White House confirmed to NBC the document was fake. A fourth video, apparently showing Hamas thanking Ukraine for weapons, was posted by an account linked to the Russian mercenary group Wagner and viewed more than 300,000 times.

The mechanics matter as much as the falsehoods. On X, the Trust and Safety Council was dissolved after Elon Musk's 2022 takeover. The company has since relied on Community Notes, a crowdsourced moderation programme that places the onus on users to correct facts. The European Commission sent Musk a letter on Tuesday warning him over alleged disinformation about the Hamas attack, including fake news and "repurposed old images." The Guardian reported that X is cooperating with the EU's request for information.

Amnesty Tech's Pat de Brún told the Guardian that platforms such as Meta and X have "clear responsibilities under international human rights standards" and that these are heightened in times of crisis and conflict. "However, all too often, big tech companies have failed to step up in the face of such emergencies," de Brún said, according to the paper.

The UK riots of August 2024 showed what happens when those failures meet a volatile local story. After three young girls were killed in Southport in July, false claims about the attacker's name, religion and migration status spread within hours. Hannah Rose of the Institute for Strategic Dialogue told CNBC that a post on X falsely named the perpetrator as "Ali al-Shakati," rumoured to be a migrant of Muslim faith. By 3pm the following day the false name had over 30,000 mentions on X alone. Police debunked the claims the day after they emerged, saying the suspect was born in Britain, but the narrative had already gained traction.

Algorithmic recommendation did part of the work. Rose said that when users searched "Southport" on TikTok, the false name of the attacker was promoted in the platform's "Others Searched For" section, including eight hours after police confirmed the information was incorrect. ISD found similar effects on X, where the name trended.

Joe Ondrak of Logically told CNBC the false reports acted as "a way to rationalize and reinforce pre-existing prejudice and bias and speculation before any sort of established truth could get out there." He described such claims as "catnip" to anti-migration groups: "It's really the exact right thing to say to provoke a much angrier reaction than there likely would have been were the disinformation not circulated."

Telegram played a consolidating role, according to Ondrak, funnelling claims into channels that began as anti-vaccine communities and were co-opted by far-right figures. Telegram denied helping spread misinformation and said its moderators were removing channels and posts calling for violence. Logically's analysis traced at least some accounts calling for protest participation to the extreme right, including links to National Action, banned as a terrorist organisation in 2016 under the UK's Terrorism Act.

China's operation is larger and more industrial. CNN reported in November 2023 that the Chinese government had built the world's largest known online disinformation operation, known as "Spamouflage" or "Dragonbridge," with hundreds of thousands of accounts used to harass US residents, politicians and businesses. Meta said it removed a cluster of nearly 8,000 accounts in the second quarter of 2023 alone. Google told CNN it had shut down more than 100,000 associated accounts in recent years. X said it had blocked hundreds of thousands of China "state-backed" or "state-linked" accounts. The US State Department described the tactics as part of a broader multi-billion-dollar effort to shape the global information environment.

Public concern is broad, if not always well informed. A Unesco-commissioned Ipsos survey of 8,000 people in 16 countries due to hold elections in 2024 found 85% worried about the influence of online disinformation and 87% said it had already harmed their country's politics. Social media was the main news source for 56% of internet users, ahead of TV at 44%, despite trust in it being lower: 50% against 66% for television.

Unesco's response was a seven-principle governance blueprint, drawn from more than 10,000 contributions across 134 countries over 18 months. Guilherme Canela de Souza Godoi, the body's chief of section for freedom of expression, noted that more than 50 countries already regulate social media, often outside international free speech norms. A World Conference of Regulators was planned for 2024.

What the four cases share is a pattern rather than a single actor: old footage, recycled documents, a handful of high-reach accounts, and recommendation systems that keep false claims visible after corrections land. The reach is measurable. The cleanup, so far, is not.