GCRI · Cybersecurity and Digital Resilience
Information operations
Information operations are coordinated efforts to manipulate what people see, believe and do, through fake accounts, deceptive networks, hacked and leaked material, synthetic media and amplification. They target elections, public health, conflicts and trust in institutions. This page sets out how such operations work, how they are detected and documented, and what evidence serves the electoral bodies, platforms, researchers and agencies that respond.
Information operations on the record.
Information operations: how the risk develops.
Information integrity and digital disruption. The dossier below sets out how the risk develops, what is measured, where the data come from, how it is modelled and who decides.
Coordination creates false scale
Networks of accounts, pages and sites post and share in coordination to make fringe narratives look popular and to game recommendation systems.
Hack and leak
Stolen documents, sometimes altered, are released at moments chosen for effect. The cyber intrusion and the information operation are parts of one campaign.
Synthetic content lowers costs
Generative AI produces text, images, audio and video quickly and cheaply. Its measured effect on persuasion and reach is still being studied.
Effects depend on audiences
Operations exploit existing divisions and distrust. Many reach few people, while some succeed by being picked up by authentic users and media.
Incident response timeline.
The screen a team would use to follow this subject: its measures, states and decisions. Names are examples and values are illustrative.
Incident response timeline
Information operations · Critical service A · Incident IR-3812
CSF 2.0 functions
- GovernGV
- IdentifyID
- ProtectPR
- DetectDE
- RespondRS
- RecoverRC
Timeline
- T+00:00DE.AEAnomalous logins flagged on identity platform
- T+00:21RS.MAIncident declared, commander assigned
- T+01:31RS.ANScope: 6 hosts, one service account
- T+02:24RS.MIAccount disabled, hosts isolated
- T+04:00RS.CORegulator notification window opens
Affected assets
| IDP-01 | Identity | Compromised | Identity platform |
| APP-07 | Payments API | Isolated | Service owner |
| DB-02 | Customer data | Forensics | Data owner |
| BK-01 | Backups | Clean | Operations |
Response actions
- RS.MIRotate keys for affected service accountsIdentity team29 min
- RC.RPRestore APP-07 from clean backupAfter containment3 h
- RS.CODraft customer noticeLegal review10 h
Information operations target trust in every domain.
Studies are designed for the Evidence Brief series. The UN Global Principles for Information Integrity (2024) and the EU Digital Services Act frame responses; the page takes no position on any political content.
- Documented information operation cases with sources.
- Evaluations of counter-messaging.
How information operations is modelled, measured and tested.
The model, its assumptions, its data and its uncertainty, in the form a scientist or engineer would check. Structures follow published methods. The values drawn are illustrative, not findings.
System model
The couplings between the systems in information operations: signs of influence, a reinforcing and a balancing loop, and cross-links where stress jumps.
What is measured, and how well.
Each indicator carries its unit, its cadence, the kind of source behind it and the evidence label a value would carry. No values are shown: a programme supplies them under its own authority.
| Indicator | Unit | Cadence | Source type | Label |
|---|---|---|---|---|
| Coordinated inauthentic networks removed | count of networks | quarterly | Platform threat reports | REPORTED |
| Documented foreign information manipulation incidents | count | annual | Government and EU reports | REPORTED |
| Reach of identified operations | estimated audience | per case | Researcher and platform analysis | ESTIMATED |
| Synthetic media incidents in elections | count | per election | Election observation reports | REPORTED |
| Researcher data access under platform rules | count of approved requests | annual | Platform transparency reports | DECLARED |
| Content moderation actions | count by policy | per reporting period | Platform transparency reports | DECLARED |
Where the evidence comes from.
Named public datasets and institutional records, each with its licence class. Sources by agreement are used only under their terms and never republished.
| Source | What it gives | Licence class |
|---|---|---|
| EEAS reports on foreign information manipulation and interference | Documented FIMI incidents and analytical framework | Public, EU terms |
| Platform adversarial threat reports | Networks removed with tactics described | Public documents, terms per platform |
| DSA Transparency Database | Statements of reasons for content moderation decisions in the EU | Open, EU terms |
| Atlantic Council DFRLab and academic case studies | Investigations of operations with methods | Public, terms per publisher |
| Election observation mission reports | Assessments of information environments around elections | Public, terms per mission |
Who decides, and what the evidence serves.
Cybersecurity and Digital Resilience prepares evidence. The decisions below are taken by the authorities named, under their own rules, and never by the platform.
| Who decides | The question | Evidence this page serves |
|---|---|---|
| Electoral management bodies | How to prepare for and respond to manipulation around elections | Case libraries; election observation evidence |
| Platforms and regulators | Which behaviours to act against and how to report | Detection methods; transparency data |
| Governments and agencies | When to attribute and respond publicly | Documented incidents with confidence stated |
Outputs this topic produces
- Detection methods for coordinated behaviour
- Case libraries of documented operations with methods described
- Evidence notes for electoral and media authorities
- Reach and impact assessment frameworks
What experts ask.
Trust in information is part of societal resilience. During an emergency, people need accurate warnings and instructions; during elections, voters need reliable information about candidates and procedures. Operations that flood channels with falsehoods, impersonate authorities or leak manipulated documents can weaken that trust, and the damage can outlast any single campaign. Responses must be careful, because measures against manipulation can also restrict legitimate speech.
- How do coordinated influence operations work, which techniques do they use and how can they be distinguished from authentic public debate?
- How do hack-and-leak operations, impersonation and disruption of communication channels combine with false content?
- What makes communities and institutions more or less resilient to manipulation, especially during crises?
- Which responses, from platform policies to public communication, reduce harm without suppressing legitimate expression?
Drivers and processes.
Information operations exploit technical systems and human behaviour together.
Manipulation methods
Inauthentic accounts, coordinated amplification, fabricated or altered media, impersonation of trusted sources and selective leaking of stolen material.
Attacks on channels
Defacement, denial of service and account takeover of authority channels can block accurate information when it is most needed.
Trust and vulnerability
Polarisation, low trust in institutions and information gaps make manipulation more effective; clear, consistent public communication makes it less so.
Research has found that coordinated behaviour is a more reliable signal of an operation than any single false claim. Many campaigns mix true, misleading and false material, and rely on amplification by networks of accounts to create an impression of popularity. This is why the field emphasises detection of coordination and protection of authority channels, alongside timely and trusted public communication.
How the evidence is built, and its limits.
- 01
Network analysis
Detection of coordinated behaviour, using network science and contagion. Coordination is evidence of an operation; content alone often is not.
- 02
Content provenance
Methods for tracing the origin of media and detecting manipulation. Detection of synthetic media is an arms race with no permanent solution.
- 03
Platform transparency data
Takedown reports and researcher access programmes provide evidence, but access is uneven and can change.
- 04
Social research
Surveys and experiments on belief and behaviour show what influences people, with results that vary across cultures and contexts.
How it is studied, and what the methods cannot say.
- 01Network science and contagionAttack path analysis · Digital dependency concentration · Coordination detectionApplied here
- 02Cybersecurity and cryptographyControl baselines and gap analysis · Exploited vulnerability prioritisationApplied here
- 03Communications and network technologyNetwork segmentation design · Protocol security review · Post-quantum protocol readinessApplied here
Where this page's references lead.
The bodies and documents this page is read against. Status and editions change; each link goes to the issuing body.
Questions and answers.
What is coordinated inauthentic behaviour?
What is FIMI?
Does disinformation change elections?
Does the platform fact-check content?
How is freedom of expression protected in this work?
Is generative AI changing information operations?
Why is this a cyber topic?
Contribute evidence from this page.
Reports is the Consortium's quarterly publication. What you know about this subject can become evidence, a case or a correction in the next edition, credited to you and published under CC BY 4.0 where it is your own work.
- EmailGateway GW-GCRISend it from this pageEvidence, a correction, a case, a method, a review, a translation or profile input. It arrives tagged with this page, so the editor who owns it receives it.
- ZenodoOpen depositDeposit it and submit to the communityPublish your own record on Zenodo with your ORCID iD, then submit it to the Reports community there. Curators review it; the DOI stays yours.
- ReportsGCRISee every way to contributeThe contribution types, how each is reviewed, what credit you receive, the licence and what is never accepted.
Never send personal data, sensitive infrastructure detail or anything you have no right to share. A contribution is reviewed before use; sending it confers no authorship or editorial rights, and sponsorship never buys a finding.
Bring a method, a dataset or a question.
Information and enquiries are open today. An enquiry receives a reference and names the next step; applications, payments, compute allocations and registrations open only when their team, terms and review capacity exist.
Legal documents.
Maps, data and figures on this site are shown for context and general information. They are not advice, forecasts or warnings; the limits of the information are set out in the Disclaimers and Data Notices.