How Online Disinformation Networks Work: Four Cases, One Playbook

The video showed a young boy in a black T-shirt lying in a pool of blood. A camera hovered above him, and a man shouted directions. Men in kippahs and men in green fatigues resembling IDF uniforms stood around. A verified user shared it on X with the caption "Video showing Israel attempting to create fake footage of deaths." According to the Guardian, it reached about 2m views. The clip was a behind-the-scenes shot from the Palestinian short film, Empty Place. It appears to have originated on TikTok before moving to X. The user behind the post later acknowledged the clip may have been used out of context.

The Guardian reported this case in October 2023. It is a useful specimen because every stage is documented.

Disinformation networks are not one thing. They are a set of repeatable mechanics: find raw material that can be recontextualised, push it through accounts that carry reach, let platform ranking do the distribution, and rely on the fact that corrections arrive late and travel badly. The dossier behind this analysis covers four distinct operations in four countries, running on four different sets of motives. The mechanics overlap more than the politics do.

Recycled footage, relabelled

Another video, also originating on TikTok and now unavailable there, claimed to show high-profile Israeli generals captured by Hamas. It racked up 2m views on X. It was originally published by the official YouTube channel of Azerbaijan's state security service and showed arrested former leaders of the breakaway Nagorno-Karabakh government. A doctored document suggesting Joe Biden had given $8bn in assistance to Israel was viewed 400,000 times on X. It was an edited version of Biden's July memo announcing $400m in aid to Ukraine. There is no such document on the White House website or social media. The White House confirmed to NBC that the document was fake.

None of these required technical sophistication. They required an audience primed to believe the claim and a platform that would carry it.

Russia has been a longstanding culprit for spreading disinformation on X and appears to have capitalised on the conflict. On Monday, Dmitry Medvedev, former Russian president and deputy chair of the Russian Security Council, tweeted: "Well, Nato buddies, you've really got it, haven't you? The weapons handed to the Nazi regime in Ukraine are now being actively used against Israel." An X account linked to the Wagner mercenary group posted a video apparently showing Hamas thanking Ukraine for weapons sales. It was viewed more than 300,000 times and amplified by far-right US accounts. In February, the Pentagon's inspector general reported no evidence to date of weapons and aid to Ukraine being diverted to third parties. Ukrainian intelligence this week accused Russia of placing "trophy" western weapons seized from Ukrainian battlefields with Hamas to undermine support for Kyiv. Eliot Higgins of Bellingcat flagged a fake BBC video claiming to show a Bellingcat investigation into Ukrainian weapons smuggling to Hamas. Russian social media users pushed it, though Higgins said it was unclear whether this was a state campaign or a grassroots effort.

When the lie leaves the screen

In July 2024, three young girls were killed in a knife attack in Southport, in the UK. Within hours, false information about the attacker's name, religion and migration status gained significant traction, sparking days of violent riots across the country. Hannah Rose, a hate and extremism analyst at the Institute for Strategic Dialogue, told CNBC that a post on X falsely named the perpetrator as "Ali al-Shakati," rumoured to be a migrant of Muslim faith. By 3pm the following day, the false name had over 30,000 mentions on X alone.

Other false claims said the attacker was on an intelligence services watchlist, had come to the UK on a small boat in 2023, and was known to local mental health services, according to ISD's analysis. Police debunked the claims the day after they emerged, saying the suspect was born in Britain. By then the narrative had traction.

Joe Ondrak, research and tech lead for the UK at Logically, told CNBC the false reports acted as "a way to rationalize and reinforce pre-existing prejudice and bias and speculation before any sort of established truth could get out there." He described the material as "catnip" to anti-migration groups: "It's really the exact right thing to say to provoke a much angrier reaction than there likely would have been were the disinformation not circulated."

The distribution side matters as much as the claim. Rose said accounts with hundreds of thousands of followers, and the paid-for blue ticks on X, shared the false information. Platform algorithms then pushed it to other users. When users searched "Southport" on TikTok, the platform itself promoted the false name of the attacker in the "Others Searched For" section, including eight hours after police confirmed the information was incorrect. ISD found similar algorithmic behaviour on X, where the incorrect name trended. The claims also reached Telegram. Ondrak said it consolidates narratives and exposes more people to "more hardline beliefs." Telegram denied helping spread misinformation, saying moderators were monitoring the situation and removing channels and posts calling for violence, which are not permitted under its terms of service. Some accounts calling for participation in protests traced back to the extreme right, according to Logically, including some linked to the banned group National Action, named a terrorist organisation in 2016 under the UK's Terrorism Act.

The largest known operation

Scale changes the picture. A CNN review of court documents and public disclosures by social media companies found that the Chinese government has built the world's largest known online disinformation operation. It is using it to harass US residents, politicians and businesses, at times threatening targets with violence. The network, known as "Spamouflage" or "Dragonbridge," runs hundreds of thousands of accounts across every major social media platform. The US State Department describes the tactics as part of a broader multi-billion-dollar effort to shape the world's information environment and silence critics of Beijing. It says the effort has expanded under President Xi Jinping.

Victims described a barrage of tens of thousands of posts calling them traitors, dogs, and racist and homophobic slurs. Some spoke to law enforcement, including the FBI, but little was done, CNN reported. Platforms have shut down thousands of accounts targeting these victims but are outpaced by new ones appearing daily. Meta said in August it had taken down a cluster of nearly 8,000 accounts attributed to the group in the second quarter of 2023 alone. Google told CNN it had shut down more than 100,000 associated accounts in recent years. X has blocked hundreds of thousands of China "state-backed" or "state-linked" accounts, according to company blogs.

Private researchers have tracked the network since its discovery more than four years ago. Only in recent months have federal prosecutors and Meta publicly concluded the operation has ties to Chinese police. Rep. Mike Gallagher, chairman of the House Select Committee on the CCP, told CNN: "We might think that this is confined to certain chatrooms, or this platform or that platform, but it's expanding across the board. And it's only a matter of time before it happens to that average American citizen who doesn't think it's their problem right now."

Chen Pokong, a New York-based activist, saw trolls disrupt an anti-communism Zoom event he organised in January 2021. They mocked participants and threatened that one victim would "die miserably." His suspicions about who was behind it solidified when the Department of Justice charged more than 30 Chinese officials earlier this year over a sprawling disinformation operation targeting dissidents in the US, including people in that Zoom meeting.

What the audiences say

Public concern is not marginal. A Unesco-commissioned Ipsos survey of 8,000 people in 16 countries due to hold national elections, with a total of 2.5 billion voters, found that 85% worried about the influence of online disinformation. 87% said it had already had a major impact on national political life. Fifty-six per cent of internet users got their news mainly from social media, more than from TV (44%) or media sites (29%). Trust in social media was 50%, against 66% for television, 63% for radio and 57% for media websites and apps. Across all 16 countries, 68% said social media was where fake news was most widespread, ahead of messaging apps at 38%.

Audrey Azoulay, director general of Unesco, told reporters that false information and hate speech online, accelerated and amplified by platforms, posed "major risks to social cohesion, peace and stability." Regulation was urgently needed, she said, "to protect access to information ... while at the same time protecting freedom of expression and human rights." Unesco's blueprint rests on seven principles, drawn from what it calls an unprecedented consultation of more than 10,000 contributions from 134 countries over 18 months. Guilherme Canela de Souza Godoi, Unesco's chief of section for freedom of expression, said more than 50 countries already regulate social media, often not in line with international free speech and human rights norms. Unesco plans a World Conference of Regulators in 2024.

Regulation has its own argument. Senator Sheldon Whitehouse has called for repealing Section 230 of the Communications Decency Act and replacing it with a narrower version that would force "disclosure of disinformation funders," according to Reclaim The Net. Whitehouse argues that liability risk could push companies to act against misinformation even at the cost of engagement. Critics counter that most disinformation would end up as protected speech.

None of these debates changes the operational arithmetic. The Guardian's reporting on X notes that Musk dissolved the platform's Trust and Safety Council after his 2022 takeover. The company said it planned to reorganise the team, but the plans remain unclear. X introduced Community Notes, a crowdsourced moderation programme that places much of the onus on users rather than employed moderators. The Union of Concerned Scientists, citing the Center for Countering Digital Hate, reported that X "continues to host nearly 86% of a set of 300 hateful posts after a week since we reported them." Researcher Abbie Richards found climate denial tweets rose from an average of 30,000 a week between December 2021 and July 2022 to nearly 110,000 a week after July 2022.

The pattern across all four cases is the same. A claim is manufactured or recycled, seeded through accounts with reach, ranked upward by systems tuned for engagement, and corrected after the damage. The correction, as the Southport case showed, can arrive within a day. The riot still happened.