Cybersecurity and Digital Resilience
The Global Centre for Risk and Innovation (GCRI)
Information operations are coordinated efforts to manipulate what people see, believe and do, through fake accounts, deceptive networks, hacked and leaked material, synthetic media and amplification. They target elections, public health, conflicts and trust in institutions. This page sets out how such operations work, how they are detected and documented, and what evidence serves the electoral bodies, platforms, researchers and agencies that respond.
GCRI · In development · service level R0
Information operations are coordinated efforts to manipulate what people see, believe and do, using fake accounts, deceptive networks, hacked material, synthetic media and amplification. They target elections, health and trust in institutions, and their reach is easier to measure than their effect on beliefs and votes.
For information operations, in GCRI's spatial-intelligence reading, the map opens on true-colour imagery, night lights and population density with true colour from NASA GIBS, framed on Europe; every other NASA layer, live feed and forecast waits in the layer list.
The interactive map needs JavaScript; the layer list and sources are below.
Layers 3
Connected activity, for this page
Keyboard, with the map focused
Hold Ctrl or ⌘ and scroll to zoom
Latest available
NASA GIBS / EOSDIS · ASTER GDEM (METI, NASA) · Blue Marble (NASA) · © OpenStreetMap contributors (ODbL) · Natural Earth
Loading the latest NASA imagery.
Drag to move. Ctrl or ⌘ and scroll, pinch or the buttons to zoom; hover for the values under the pointer; reset returns to the region.
For information operations, in GCRI's spatial-intelligence reading, the map opens on true-colour imagery, night lights and population density with true colour from NASA GIBS, framed on Europe; every other NASA layer, live feed and forecast waits in the layer list.Satellite and model products as NASA publishes them, each with its own date; indicators, not assessments of any place; claim ceiling INTEGRATED.
Layers and dates
The working screen behind this subject: its structure, terms and states. Names are placeholders and values illustrative.
Information operations · Critical service A · Incident IR-3812
| IDP-01 | Identity | Compromised | Identity platform |
| APP-07 | Payments API | Isolated | Service owner |
| DB-02 | Customer data | Forensics | Data owner |
| BK-01 | Backups | Clean | Operations |
Information integrity and digital disruption. The dossier below sets out how the risk develops, what is measured, where the data come from, how it is modelled and who decides.
Networks of accounts, pages and sites post and share in coordination to make fringe narratives look popular and to game recommendation systems.
Stolen documents, sometimes altered, are released at moments chosen for effect. The cyber intrusion and the information operation are parts of one campaign.
Generative AI produces text, images, audio and video quickly and cheaply. Its measured effect on persuasion and reach is still being studied.
Operations exploit existing divisions and distrust. Many reach few people, while some succeed by being picked up by authentic users and media.
Each term as this page uses it. Where a standard-setting body defines the term, the wording follows that body.
| Term | Definition |
|---|---|
| Disinformation | False or misleading information that is created or spread deliberately to deceive people. |
| Hack and leak | An operation combining a cyber intrusion with selective release of stolen material. |
| Synthetic media | Images, audio, video or text generated or altered by AI to appear authentic. |
Each indicator carries its unit, its cadence, the kind of source behind it and the evidence label a value would carry. No values are shown: a programme supplies them under its own authority.
| Indicator | Unit | Cadence | Source type | Label |
|---|---|---|---|---|
| Coordinated inauthentic networks removed | count of networks | quarterly | Platform threat reports | REPORTED |
| Documented foreign information manipulation incidents | count | annual | Government and EU reports | REPORTED |
| Reach of identified operations | estimated audience | per case | Researcher and platform analysis | ESTIMATED |
| Synthetic media incidents in elections | count | per election | Election observation reports | REPORTED |
| Researcher data access under platform rules | count of approved requests | annual | Platform transparency reports | DECLARED |
| Content moderation actions | count by policy | per reporting period | Platform transparency reports | DECLARED |
The topic as a computational graph: named sources feed the methods, an evidence review gates the outputs, and the decisions stay with the authorities that hold them.
Fig. 02Nodes carry their type, two metric rows and a state; connectors show what feeds what; dashed frames name the owners; the timeline is the cadence. Design of the pipeline, not a record of a run.
Named public datasets and institutional records, each with its licence class. Sources by agreement are used only under their terms and never republished.
| Source | What it gives | Licence class |
|---|---|---|
| EEAS reports on foreign information manipulation and interference | Documented FIMI incidents and analytical framework | Public, EU terms |
| Platform adversarial threat reports | Networks removed with tactics described | Public documents, terms per platform |
| DSA Transparency Database | Statements of reasons for content moderation decisions in the EU | Open, EU terms |
| Atlantic Council DFRLab and academic case studies | Investigations of operations with methods | Public, terms per publisher |
| Election observation mission reports | Assessments of information environments around elections | Public, terms per mission |
Cybersecurity and Digital Resilience prepares evidence. The decisions below are taken by the authorities named, under their own rules, and never by the platform.
| Who decides | The question | Evidence this page serves |
|---|---|---|
| Electoral management bodies | How to prepare for and respond to manipulation around elections | Case libraries; election observation evidence |
| Platforms and regulators | Which behaviours to act against and how to report | Detection methods; transparency data |
| Governments and agencies | When to attribute and respond publicly | Documented incidents with confidence stated |
Trust in information is part of societal resilience. During an emergency, people need accurate warnings and instructions; during elections, voters need reliable information about candidates and procedures. Operations that flood channels with falsehoods, impersonate authorities or leak manipulated documents can weaken that trust, and the damage can outlast any single campaign. Responses must be careful, because measures against manipulation can also restrict legitimate speech.
Information operations exploit technical systems and human behaviour together.
Inauthentic accounts, coordinated amplification, fabricated or altered media, impersonation of trusted sources and selective leaking of stolen material.
Defacement, denial of service and account takeover of official channels can block accurate information when it is most needed.
Polarization, low trust in institutions and information gaps make manipulation more effective; clear, consistent public communication makes it less so.
Research has found that coordinated behaviour is a more reliable signal of an operation than any single false claim. Many campaigns mix true, misleading and false material, and rely on amplification by networks of accounts to create an impression of popularity. This is why the field emphasizes detection of coordination and protection of official channels, alongside timely and trusted public communication.
Detection of coordinated behaviour, using network science and contagion. Coordination is evidence of an operation; content alone often is not.
Methods for tracing the origin of media and detecting manipulation. Detection of synthetic media is an arms race with no permanent solution.
Takedown reports and researcher access programmes provide evidence, but access is uneven and can change.
Surveys and experiments on belief and behaviour show what influences people, with results that vary across cultures and contexts.
The current service level is R0: information and enquiries. An enquiry receives a reference and names the next step; applications, payments, compute allocations and registrations open only when their team, terms and review capacity exist.