Foreign Interference Research Center

Tracking and analyzing foreign interference worldwide.

[Foreign Interference Research Center @ForIntOrg]

Academic paper from 2012 called it. Bots, platform exploitation, targeting social fractures. The whole playbook, documented before most policymakers had even heard the term "influence operation." Twelve years of warning time, largely wasted.

https://t.co/Vr1eM4cCqT

#foreigninterference #CognitiveExploitation #DisinformationCampaigns #SocialMediaHijacking

[Foreign Interference Research Center @ForIntOrg]

Foreign Policy's October 22 assessment of AI disinformation in the 2026 midterms lands roughly where careful analysts expected: the sky didn't fall, the threat is real, and the current containment architecture is holding some of it back. Some.

That framing is fine as far as it goes. The more interesting question is what the partial success of detection systems tells us about where operators are going next.

Start with what the assessment actually shows. OpenAI and Anthropic guardrails blocked some electoral disinformation generation at the model level. Platform detection systems caught some synthetic content before it spread. Public skepticism, elevated by years of AI-panic coverage, reduced persuasion rates on the content that did get through. Intelligence community pre-bunking neutralized specific narratives in specific audiences. These are genuine interventions with genuine effects.

But every one of those containment mechanisms is reactive and surface-level in a way that sophisticated state actors can route around, and the routing is already happening.

The Foreign Policy piece flags encrypted messaging as the obvious gap. That's correct but undersells the structural problem. Telegram, Signal, WhatsApp: content moving through those channels doesn't touch platform moderation at all. The IC can issue public warnings about specific narratives, but warnings work on people who see them. A synthetic audio clip of a House candidate in a competitive Wisconsin or Arizona district, distributed through precinct-level WhatsApp groups three days before the election, reaches an audience that is unlikely to have read an ODNI advisory. The clip doesn't need to be convincing to everyone. It needs to move a few hundred persuadable voters in a district that ends up decided by 900.

That's not a hypothetical threat architecture. It's a logical inference from what state actors, particularly Russian GRU-linked operations and Iranian IRGC-adjacent influence units, were already doing in 2022 and 2024 at lower AI capability levels. The qualitative shift the FP piece documents, lower production cost, higher content volume, better translation fidelity, means the same targeting logic now applies to more districts simultaneously and in more languages with less manual overhead.

The translation point deserves more attention than the assessment gives it. AI-enhanced translation enabling foreign-language disinformation to reach English-speaking audiences is mentioned almost as an afterthought, but run the logic in reverse: it also means that disinformation originally produced in English can now be translated into Spanish, Haitian Creole, Vietnamese, or Tagalog at production scale and with enough idiomatic accuracy to not immediately read as machine-translated. Diaspora communities in competitive congressional districts have historically been underserved by English-language media literacy campaigns. The geographic concentration of those communities, Vietnamese-American voters in Orange County, Haitian-Creole speakers in South Florida, Somali-American communities in Minnesota, makes them both targetable and, in close races, potentially decisive.

Platform detection systems are calibrated against known content signatures. That's the core limitation. The detection architecture that caught synthetic content in the 2026 cycle was built against the AI capability levels and stylistic fingerprints of 2024 and 2025 model outputs. Operators who are paying attention, and state actors running influence operations are paying attention, have already observed what got flagged and what didn't. The next generation of operations will be built around what survived detection, not what didn't.

There's also a model access question the assessment addresses only obliquely by noting that sophisticated state actors have AI capabilities not constrained by commercial platform policies. China's domestic large language model ecosystem (Ernie Bot, Qwen, others developed under state-adjacent conditions) is not subject to OpenAI or Anthropic policy. Neither are locally-run open-weight models. The guardrails that Anthropic implemented against electoral disinformation generation apply to API calls and consumer-facing products. They do not apply to a GRU signals intelligence unit running a fine-tuned Llama derivative on local compute. This is not a hypothetical. Fine-tuning open-weight models for disinformation-optimized output is technically accessible to any moderately resourced state or non-state actor that has been watching the space for the past two years.

So what does the post-2026 trajectory look like, based on what this cycle has demonstrated?

The next operational adaptation is almost certainly going to be distributed targeting rather than broadcast. The 2024-2026 operations that got caught mostly got caught because they tried to achieve reach at scale on detectable platforms. The lesson from partial containment isn't that disinformation doesn't work. It's that broadcast methods are getting harder and targeted methods are not. Expect more operations designed around specific precincts, specific voter microsegments, specific local Facebook groups and community WhatsApp channels, and fewer operations trying to push a single synthetic narrative to a national audience. Harder to detect. Harder to pre-bunk. Harder to attribute.

The timing compression is also worth flagging. Intelligence community warnings work partly because they give audiences time to encounter the warning before encountering the disinformation. Operations timed to the 72 hours before election day, after most IC advisory cycles have already run, against encrypted channels that moderation can't reach in time, sidestep that mechanism almost entirely. Early voting complicates this further in both directions: votes cast weeks before election day are immunized against late operations, but they're also cast before any late-breaking authentic news, which means early-voting-targeted operations that land in the three-week early voting window have a longer runway.

For election administrators and the campaigns actually competing in marginal districts in 2028, the operational implication of all this is that the useful unit of analysis has shifted. The question is no longer "is there a broad AI disinformation campaign running against this election" but rather "which specific communities in which specific zip codes are being targeted through which specific channels, and how do we build communication pipelines into those communities that exist before an operation drops." That requires relationships with trusted local messengers, multilingual rapid-response capacity at the local level, and coordination with platform trust-and-safety teams that is granular enough to flag specific groups and specific accounts rather than waiting for something to achieve national scale.

The platforms themselves have an asymmetric incentive problem that isn't going away. Aggressive pre-election content moderation generates accusations of political bias. Under-moderation generates accusations of election interference. The safest political position for a platform is to implement visible, defensible, but not maximally aggressive detection. That's roughly what the FP assessment describes. It contains some of the threat. It doesn't contain the sophisticated part.

Congress is largely not in a position to move faster than the threat. The DEEPFAKES Accountability Act has been introduced in various forms since 2019. Disclosure requirements for AI-generated political content exist in some state laws and in FEC guidance that isn't uniformly enforced. Platforms have more operational flexibility to adapt quickly than any legislative or regulatory body does, which makes the platform governance piece the most important near-term lever and also the most politically fraught one to pull.

The Foreign Policy assessment is right that this is neither an ungovernable catastrophe nor a non-problem. It's a real evolving threat with partial defenses that are already being adapted around. The 2026 result, a more manageable threat than feared, is probably best read as the last election in which the current containment architecture was good enough to hold. The next cycle will be fought on different terrain, through channels the current systems don't see, in languages the current rapid-response infrastructure isn't staffed to handle, in the final 72 hours of campaigns that are decided by margins of hundreds of votes in districts most national observers can't name.

That's the specific version of the problem. The general version is a lot less useful to anyone trying to do something about it.

https://t.co/5S1Q5Vxliu

#foreigninterference #DisinformationCampaigns #DeepfakeVideoCreation #AIProfileGeneration #ComputationalPropaganda #ElectionInterference #AIEnhancedSocialEngineering #CounterDisinformationFrameworkDevelopment

[Foreign Interference Research Center @ForIntOrg]

Europe is arguing about what to call Russian sabotage while Russia runs it.

The UK has documented £1.5 billion in Russian disinformation spending. There are assassination plots on European soil. Infrastructure mapping. Coordinated sabotage across the continent. Poland and the Baltics are building defenses. Germany and France are still debating terminology.

Russia's hybrid warfare doctrine was designed for exactly this. The ambiguity isn't a problem for Moscow. It's the strategy.

https://t.co/l4zRArijcg

#foreigninterference #MultiDomainWarfareCoordination #InfluenceOperations #InfrastructureAttacks #DisinformationCampaigns #GovernmentDestabilization #SabotagePlanning #WeaponizedUncertaintyPropagation

[Foreign Interference Research Center @ForIntOrg]

Javier Milei flew to Madrid and told Spanish voters to remove Pedro Sánchez from office. That happened. A sitting foreign head of state, on foreign soil, running what amounted to a campaign appearance for the Spanish opposition. Spain's government called it "disgraceful" interference in domestic political affairs. The diplomatic relationship between two countries with deep historical and economic ties took a real hit over it.

The conduct itself is not complicated to categorize. When a foreign government official uses a visit to another country to publicly attack that country's sitting prime minister and call for his removal by voters, that is election interference by the most straightforward definition available. The only reason this requires any analysis at all is that Milei is not Russian, not Chinese, and not operating through cutouts or laundered social media accounts. He did it at a podium, in public, with his name on it.

That visibility is actually what makes the Spain case useful for tracking purposes. Most foreign interference analysis deals with covert or semi-covert operations: troll farms, purchased influence, proxies. This was overt. Milei is not hiding what he is doing or pretending to be a neutral observer of Spanish politics. He is explicitly part of a transnational political network, publicly aligned with Donald Trump, and he treats electoral interventions in allied countries as a normal feature of that network's operation. Which is exactly what makes it worth documenting carefully.

The network in question, and it functions enough like a network to call it one, includes Trump, Milei, Giorgia Meloni, and several other leaders who have used public statements, social media reach, and direct political endorsements to intervene in each other's countries' elections. The interference mechanism is not hidden infrastructure. It is the leaders themselves, speaking plainly, with full deniability because everything is technically "just speech" and "just politics." That framing does a lot of work for them.

France has been through a version of this. Macron raised concerns about foreign leaders, with Trump in the implicit frame, exploiting French domestic unrest for electoral purposes. The French and Spanish cases together form something more than coincidence. The same network, the same approximate targets (center-left or centrist governments in Western Europe), the same method of overt public political attack timed to domestic political vulnerability. Whether this is coordinated in any formal sense or whether it is structurally emergent from a shared ideology and mutual political interest, the effect is functionally similar.

Here is where the doctrine question gets genuinely difficult. The existing foreign interference frameworks, legal and normative, were built primarily around adversarial actors. The model is Russia running influence operations against Western elections, and the response framework involves sanctions, expulsions, counter-intelligence operations, and international condemnation organized through allied coalitions. That framework does not map cleanly onto a situation where the interfering actor is Argentina, a Western-aligned country with no adversarial relationship to Spain, and the interfering leader is a head of state who shares a political alignment with governments in Washington and Rome.

Spain called it disgraceful. That was the response. Compare that to what would have happened if a Russian official had flown to Madrid and held a press conference calling for Sánchez's removal. The response asymmetry is the problem. If the normative framework only applies when the actor is adversarial, then it is not really a framework against foreign election interference. It is a framework against hostile foreign election interference, which is a much narrower and more politically contingent standard. Adversarial states will notice this gap. They already have.

There is also a domestic political layer here that the interference framing can obscure. Milei is not just performing for Spanish audiences. He is performing for his own base, reinforcing his identity as a global figure in the MAGA-aligned populist movement, and building the kind of cross-border political capital that benefits him at home. The interference serves dual purposes: it is genuinely an attempt to shift Spanish political outcomes, and it is a branding exercise for Milei's domestic political positioning. Those two functions reinforce each other, which is part of why the network sustains this behavior. Everyone in it gets something out of it regardless of whether any specific intervention succeeds.

The Spain episode is not going to produce a new international legal standard. Milei will not face sanctions. The diplomatic incident will settle into background noise relatively quickly, especially given that Spain has limited leverage over Argentina and limited appetite for escalation with a country it has no adversarial interest in antagonizing. But the documentation matters for pattern purposes. This is not an isolated incident of a populist leader saying something intemperate abroad. It is the third or fourth documented case of this specific network conducting overt electoral interventions in European democracies within a relatively short timeframe, and the targets are not random.

What happens to the interference deterrence framework if the standard gets set that overt foreign electoral intervention is only unacceptable from adversaries? You lose the principle entirely and replace it with a geopolitical carve-out that any actor sophisticated enough to maintain nominal alignment with the right governments can exploit. That is not a hypothetical problem for the future. It is what is already happening.

https://t.co/t3qYlRh4Fj

#foreigninterference #ElectionInterference #DirectLeadershipIntervention #GovernmentDestabilization #InfluenceOperations

[Foreign Interference Research Center @ForIntOrg]

WeChat doesn't care what country you live in. If you're Chinese diaspora and you use it, which most do because that's how you stay in contact with family back home, the same filters that suppress LGBTQ content in Shanghai are running on your conversations in Toronto, in Paris, in Auckland. The app is the border crossing that never gets stamped.

That's one of the central findings in a piece The Diplomat published in October 2026 documenting how China's social control architecture has followed LGBTQ communities across multiple jurisdictions. Not just monitoring. Actively shaping the information environment, applying community pressure, and in some cases leveraging the safety of people's relatives inside mainland China as a silent enforcement mechanism.

Start with Hong Kong, because Hong Kong is where the template got built.

Before 2020, Hong Kong had a functioning LGBTQ civil society. Pride events, advocacy organizations, community media. Not perfect, not without opposition, but present. Then the National Security Law came in, and the chilling effect was immediate and comprehensive. The NSL was written broadly enough that almost any organized advocacy could theoretically fall within its scope. Organizations didn't need to be explicitly told to shut down. The legal ambiguity was the point. By the time The Diplomat was writing about this in 2026, the report was describing a "vanishing rainbow," a documented erosion of civic space that happened incrementally, through self-censorship, disbandment, and the quiet departure of people who saw where things were heading.

That's the model. You don't need to send police to every meeting. You create conditions under which people police themselves.

The piece documents how that same model travels internationally through several distinct channels.

In Bangkok, it operates through a combination of Chinese diplomatic pressure and the practical reality of Thailand's significant Chinese tourist and diaspora presence. Thai authorities have shown increased sensitivity to public LGBTQ visibility that conflicts with CCP-aligned social conservatism. The mechanism here is indirect. China doesn't need to threaten Thailand with anything dramatic. Economic leverage and the desire to remain on good terms do the work. The result is a gradual calibration of what's publicly acceptable in spaces where Chinese presence is significant.

Paris is a different mechanism entirely, and in some ways a more instructive one. Chinese community organizations there with leadership linked to the CCP have worked to discourage LGBTQ visibility in community events and spaces. No government action required. Just internal community pressure, applied through organizations that control social resources, event access, and standing within the community. This is how you export censorship to a liberal democracy without touching the host country's laws at all. You run it through civil society structures you already control.

Taiwan gets its own section because Taiwan's situation is distinct. It's the most LGBTQ-affirming jurisdiction in Asia, legally and culturally. Legalized same-sex marriage in 2019. Genuine civic support. So direct suppression isn't available as a tool. Instead, The Diplomat documents Chinese-linked social media operations working to amplify anti-LGBTQ sentiment inside Taiwan as part of broader information operations targeting Taiwanese social cohesion. The goal there isn't to suppress a community. It's to widen social divisions, make LGBTQ rights a wedge issue, and weaken the internal solidarity of a society that China has sustained strategic interest in destabilizing. The LGBTQ community becomes a pressure point in an operation that's really about something else.

In North America, the report documents coercive pressure from CCP-affiliated community organizations in both Canada and the United States against LGBTQ visibility within diaspora communities. Some of that pressure is direct social coercion. Some of it is more insidious: individuals facing family pressure that's amplified by the awareness that relatives back in China could face consequences. You don't have to say that explicitly. Everyone in the room already knows it. The threat doesn't need to be spoken to be effective.

This is transnational repression operating through family structure. It's sophisticated in the specific sense that it requires almost no direct action from the Chinese state once the basic dynamic is established. The coercion is distributed through personal relationships, community organizations, and platform architecture. Deniable at every level.

Freedom House, the European Parliament, and multiple national intelligence services have documented Chinese transnational repression expanding in scope over the past several years. The usual targets are political dissidents, democracy activists, Uyghurs, Tibetans, Hong Kong activists. People who have taken explicit political positions against the CCP. The Diplomat's analysis points to something the standard transnational repression frameworks have been slower to document: the architecture is now being extended to communities whose "offense" is simply existing publicly in ways that conflict with CCP-defined social norms. No manifesto required. No protest activity. Just visibility.

That's a meaningful expansion of who's in scope. It suggests the system isn't just about containing political opposition. It's about projecting a model of social order into diaspora communities globally, maintaining a version of CCP-compatible cultural norms among Chinese communities regardless of where those communities physically are.

The WeChat piece matters here because it's structural. Diaspora communities don't use WeChat because they love the CCP. They use it because their parents are on it, their cousins are on it, their friends from home are on it. It's the dominant communication infrastructure for staying connected to China. And it runs CCP content moderation everywhere it operates. So you can move to Vancouver and still live inside an information environment that has been shaped by Beijing's censorship apparatus. That's not an accident of design.

The United Front Work Department, which The Diplomat identifies as a key vector for this through its affiliated community organizations, has been operating in Western diaspora communities for decades. Its role in LGBTQ suppression is a relatively recent emphasis, but the organizational infrastructure was already there. Community associations, business groups, cultural organizations. They were built for influence operations in a general sense. Directing them toward enforcing social conformity on LGBTQ issues is an application of existing capacity.

One thing the article doesn't fully resolve, and it's a genuinely hard question, is what appropriate responses look like for liberal democracies. The community pressure mechanisms are largely legal. A community organization telling its members that certain behavior is frowned upon isn't a crime. WeChat's content moderation is a terms-of-service issue, not obviously a legal violation in most Western jurisdictions. The family leverage dynamic is almost impossible to address through law because it operates through personal relationships. The information operations in Taiwan are at least partially visible and have attracted counter-response, but attribution and response remain difficult.

What you're left with is a system that's effective precisely because it doesn't require the kinds of overt action that trigger legal or diplomatic responses. It runs below most intervention thresholds while achieving real suppression outcomes.

The communities experiencing this, LGBTQ Chinese diaspora members in particular, are navigating something genuinely difficult. They're living in countries with legal protections for LGBTQ people and facing informal coercive systems that those legal protections weren't designed to address. The gap between what the law protects and what the community experience actually looks like is real and documented.

The Diplomat is situating this within the broader transnational repression literature, which is the right frame. But it's worth being clear that targeting a community for its identity rather than its political activity represents a different kind of claim about what the CCP considers threatening. The implication is that openly LGBTQ Chinese diaspora life is itself incompatible with the social order the CCP wants to project, even at a distance of ten thousand miles.

That's a fairly ambitious form of social control to be attempting. The evidence suggests it's working, at least partially.

https://t.co/wdlgztBKwM

#foreigninterference #TransnationalRepression #DiasporaSurveillance #InternetCensorship #ExtraterritorialCensorship #FrontOrganizationOperations #SocialMediaMonitoring #CognitiveExploitation

[Foreign Interference Research Center @ForIntOrg]

Asadullo Boboev got deported from Europe, went back to Tajikistan, and is now sitting in prison on what Human Rights Watch and RFERL both describe as politically motivated charges. Germany and Austria are named in the reporting. That's the short version.

Here's what I actually want to talk about: the trajectory.

Tajikistan didn't need to send anyone to kidnap Boboev. It didn't need to run a honey trap, poison anyone's tea, or hire a fixer in Vienna. It filed paperwork. Or it let an Interpol Red Notice do the work, or it simply waited for a deportation process to run its course. Either way, a European government loaded him onto a plane and sent him home, and home is where the prison sentence was waiting.

This is the move authoritarian states have been refining for about a decade, and the Boboev case is evidence it has matured into something close to a reliable playbook. You don't need to be sophisticated to run it. You just need a legal pretext that sounds plausible to a European immigration judge, a charge sheet that uses words like "extremism" or "terrorism" or "drug trafficking," and a bureaucratic process on the other end that isn't asking hard questions.

Tajikistan is reasonably good at generating those charge sheets. The government routinely deploys terrorism and extremism designations against political opponents. These aren't fringe charges filed in kangaroo courts that no Western official recognizes. They're nominally legal instruments that can survive at least initial scrutiny in an extradition or deportation proceeding, especially if the receiving country's officials aren't specifically briefed on Tajikistan's documented pattern of using them pretextually.

The result, as RFERL's reporting lays out, is a chilling effect running through Tajik diaspora communities in Germany and elsewhere right now. People who left because they feared political persecution are watching what happened to Boboev and recalibrating. Do I go to that protest? Do I give that interview? Do I post that? The Tajik government didn't have to touch those people to change their behavior. It just had to make an example and let the news travel. That's extremely cost-effective repression.

So where does this go from here.

The first thing to watch is whether Tajikistan and similar Central Asian governments start using this outcome as a proof of concept to accelerate similar cases. One successful deportation-to-imprisonment cycle teaches the regime something important: that Germany and Austria will, under at least some circumstances, deport individuals back to Tajikistan despite the documented persecution record. That's genuinely useful information for a government that wants to neutralize diaspora opposition. Expect more requests, more Red Notices, more legal-framework charges designed specifically to clear the bar for European compliance.

The second thing to watch is whether European governments start differentiating between these cases at the policy level or keep treating them as individual immigration decisions made in isolation. Right now the problem, as described in both the HRW reporting and the RFERL coverage, is essentially procedural. Each deportation case gets processed more or less on its own terms. The Tajik government's overall pattern of persecuting political opponents doesn't necessarily enter the room in a systematic way. That's fixable, but fixing it requires political will and a degree of institutional coordination that European governments have historically been slow to generate on Central Asian cases specifically, partly because the stakes feel distant and partly because Tajikistan isn't a country that generates a lot of European press coverage on a normal day.

Third, and this is the piece that gets underreported: the Interpol Red Notice angle. Freedom House and others have been documenting for years that several authoritarian governments treat Interpol's Red Notice system as an instrument of political harassment rather than a legitimate law enforcement tool. Russia, Kazakhstan, Azerbaijan and others have been caught running politically motivated Red Notices against dissidents and opposition figures. Tajikistan fits the same profile. The problem is that a Red Notice, even a politically motivated one, can create real legal exposure for the person named in European jurisdictions. It can trigger detention, complicate asylum applications, and provide cover for a deportation that might not otherwise proceed. Interpol has rules against politically motivated notices and a review process, but the review process is slow, the burden on the individual to challenge the notice is significant, and by the time a notice gets successfully challenged the damage may already be done. In Boboev's case, we don't know from the public reporting exactly what mechanism drove the deportation, but the pattern RFERL describes across multiple Tajik cases fits the profile of Red Notice leverage.

What officials and advocates should be doing concretely, not theoretically:

European asylum and immigration adjudicators need country-specific guidance on Tajikistan that explicitly flags the terrorism and extremism charge pattern as a documented political persecution mechanism. This exists for some countries in some jurisdictions. It needs to exist more systematically for Tajikistan, and the Boboev sentence is a usable data point for advocates pushing to get that guidance written or updated.

European governments should be communicating directly with Tajikistan that the Boboev imprisonment has diplomatic consequences. It probably won't change the sentence. But silence reads as acceptance, and acceptance is essentially a green light for the next case.

Diaspora organizations in Germany, Austria and elsewhere should be building legal support infrastructure now, before the next deportation proceeding, not after. The window to contest a deportation is narrow and the individuals most at risk often don't have legal representation in place when they need it. Proactive outreach to Tajik community organizations by European human rights lawyers is probably the single most direct intervention available right now.

And for anyone in those diaspora communities reading this: document everything. Asylum applications, evidence of political activity, documentation of threats, contact with Tajik government officials. Courts and advocates can only work with what they have.

The broader pattern here, across Tajikistan, across other Central Asian states, across any authoritarian government that's been paying attention to what works, is a deliberate strategy of co-opting democratic legal systems to do repression work that the regime itself would prefer not to do visibly. It's cheaper than running field agents. It's more durable than a harassment campaign. And it outsources the reputational cost to the democratic government that actually executes the deportation.

The Boboev case won't be the last one. The question is whether European governments start treating these cases as a category that requires a different analytical framework, or keep processing them one at a time until the pattern becomes undeniable to the point of embarrassment.

Given the historical pace of European policy response on Central Asian human rights issues, that embarrassment threshold may be a while away. Which means the diaspora communities bearing the cost of that delay are largely on their own in the interim.

https://t.co/QTcDAowZtu

#foreigninterference #TransnationalRepression #CrossBorderRendition #LegalWeaponization #InterpolRedNoticeAbuse #PersonnelDetention #JurisdictionalManipulation

[Foreign Interference Research Center @ForIntOrg]

Canada just told its diplomats to steer clear of U.S. midterm candidates. Not because they were interfering. Because Washington called criticizing tariffs "election interference" and Ottawa needed to make the photos stop.

The U.S. framing here is doing a lot of work: Carney says Trump's tariffs hurt Americans, the embassy files a formal complaint, and suddenly allied government speech becomes foreign meddling. That's a useful precedent if you want allies to shut up.

Canada is playing defense on charges it rejects. That's the tell.

https://t.co/oaoPiVdFwW

#foreigninterference #ElectionInterference #ForeignAccusation #DiplomaticCoercion #AntiInterferenceRhetoric

[Foreign Interference Research Center @ForIntOrg]

The Shin Bet disclosed sometime in the week of October 21-24, 2026 that it had identified and dismantled a network of social media accounts tied to foreign interference operations targeting Israel's upcoming national elections. That's the kind of announcement Israeli counterintelligence does not make casually.

The service did not name the foreign actor. That's deliberate. When an intelligence agency goes public without identifying the source, the calculation is usually that naming the actor would expose more about how they were caught than what was gained by the attribution. The detection capability stays protected. The message still lands.

The message being: we see you, and we're telling voters we see you.

That dual function, operational deterrence plus public inoculation, is now a recognizable pattern across democratic intelligence services. The UK's NCSC does versions of this. So does the FBI before American election cycles. The logic is that once voters know manipulation is being attempted, they engage with politically charged content differently. Whether that actually works is debated. But governments keep doing it, which tells you something about how they weigh the alternatives.

What makes the Israeli context specific is the structure of the target. Israel holds elections at a frequency most democracies don't. The political system is fragmented enough that relatively small shifts in sentiment or turnout among particular constituencies can tip coalition math in meaningful directions. That's not a vulnerability in the abstract. Foreign intelligence services track it concretely. Iran has a documented operational interest in amplifying Israeli societal divisions, particularly around the Gaza conflict, West Bank policy, and the domestic tensions that have made Israeli governance so unstable over the past several years. Russia has historically worked the Israeli political spectrum through diaspora networks and media channels, often without taking hard sides, preferring to cultivate access across factions. Both represent standing interference incentives that don't require a particular election cycle to activate. They just get more active when one approaches.

The current moment is unusually target-rich from an adversary's perspective. The relationship between Israel and the United States under the Trump administration has involved enough ambiguity and friction that foreign actors can find genuine wedge material without fabricating much. The ongoing Gaza conflict produces daily polarization. Regional realignment, the pressure on normalization frameworks, the question of what Israel's strategic position looks like after the war, all of this is live and contested. Influence operations work best when they're amplifying real fault lines rather than inventing fake ones.

There's an institutional context worth holding onto here. Israel's State Comptroller had previously documented that Israel lacked a comprehensive government policy framework for countering foreign electoral interference. That finding is significant because it means the Shin Bet's operation, whatever its scope, was conducted against a backdrop of incomplete institutional infrastructure. The service demonstrated operational capacity while the policy architecture around it remained underdeveloped. That's not unusual globally. A lot of democratic states have capable intelligence components working election security while their legislative and regulatory frameworks lag years behind. But it does mean the disruption here reflects individual institutional initiative more than a whole-of-government system functioning as designed.

The accounts that were targeted remain unspecified in the public disclosure. The Shin Bet did not describe the content they were pushing, the platforms they operated on, the audiences they were targeting, or how long the network had been active before detection. All of that is standard omission. Operational details at that level either compromise sources and methods or they preview the next operation to whoever runs the next one. So we work with what's public: a network existed, it was tied to foreign interference, it was disrupted before the election rather than discovered afterward.

Discovered afterward is the more common story. The fact that this was disrupted proactively, and then disclosed proactively, puts it in a smaller category.

https://t.co/4VSRLzbxrJ

#foreigninterference #ElectionInterference #ComputationalPropaganda #SocialMediaHijacking #PlatformTakedown #CounterintelligenceOperations

[Foreign Interference Research Center @ForIntOrg]

October 1997. Montenegro. Milo Đukanović wins a presidential election so close and so disputed that the country nearly came apart over it. His opponent, Momir Bulatović, had Milošević's backing. Đukanović had Washington's.

That intervention is now documented in Wikipedia's List of Foreign Electoral Interventions, which catalogs covert and overt foreign meddling in elections going back decades across dozens of countries. The 1997 Montenegrin case sits there plainly, without much ceremony, alongside a lot of other entries that make for uncomfortable reading depending on which direction your outrage usually points.

Here's what was actually happening in Montenegro that year. The republic was in the middle of a political identity crisis. The Democratic Party of Socialists, Đukanović's party, was peeling away from Belgrade. After years of being closely aligned with Milošević's Serbia, Đukanović saw which way the wind was blowing, or decided to blow it himself, depending on how charitable you want to be. He was moving Montenegro toward a more Western-oriented posture. The Clinton administration, which was already neck-deep in Balkan policy after Bosnia, recognized this as useful. A Montenegro that drifted away from Milošević weakened him. Simple math.

So the U.S. leaned in. Not with troops, not with anything that loud. The methods were the standard toolkit of what gets called "democracy promotion" when your side does it and "electoral interference" when the other side does it. Political party support through democracy promotion organizations and what the article diplomatically calls "intelligence-adjacent NGOs." Civil society funding and training. Assistance to independent media willing to run coverage that wasn't Milošević-friendly. And diplomatic signaling, the kind of public and private statements from U.S. officials that make clear who Washington is rooting for without technically being an endorsement.

The election was close enough that Bulatović's camp disputed the results. There were street protests. Real tension. Đukanović was eventually certified as the winner and went on to run Montenegrin politics for the better part of three decades, which is its own story. But in 1997, the immediate effect of his victory was to drive a wedge between Podgorica and Belgrade at exactly the moment the Clinton administration wanted that wedge.

This case fits into a pattern that researchers have documented pretty thoroughly. The War on the Rocks analysis of foreign electoral interventions from 1946 to 2000 flags the Balkans as one of the most active theaters for this kind of activity during the 1990s, with both the U.S. and Russia working to pull successor states in their preferred directions as Yugoslavia finished collapsing. The 1997 Montenegro operation is a relatively modest entry in that catalog. The 2000 Serbian election, where U.S. support for the Otpor movement and the opposition coalition helped push Milošević out of power entirely, is the bigger and better-known example. Montenegro in '97 was a precursor, a proof of concept, or at minimum a parallel track.

The definitional question this raises is real and worth taking seriously, even if it's often deployed selectively. What the U.S. did in Montenegro combined at least three different things: covert intelligence support, overt democracy promotion funding that was legally sanctioned and publicly documented (if not loudly advertised), and diplomatic pressure. Each of those elements has a different legal and ethical weight. Overt democracy promotion through organizations like the National Endowment for Democracy is legal under U.S. law and disclosed, at least in aggregate. Covert intelligence support to political parties in a foreign election is a different matter. And diplomatic signaling occupies a third category that almost every government engages in and nobody has figured out how to regulate.

International law doesn't cleanly resolve any of this. The principle of non-interference in internal affairs is in the UN Charter. So is a lot of other language about human rights and democratic governance that cuts the other way. The result is a framework that lets every government justify what it does and condemn what its adversaries do, which is more or less where we've been for eighty years.

None of that is an argument that what the U.S. did in Montenegro was equivalent to, say, Russian disinformation campaigns in Western elections, or that all interventions are equally harmful. Context matters. Methods matter. Scale matters. But the documented U.S. role in the 1997 Montenegrin election is a useful corrective to the framing, still common in some quarters, that foreign electoral interference is something the United States only receives and never practices. The historical record is more complicated than that, and has been for a long time.

Đukanović, for his part, ran Montenegro until 2023, when his coalition finally lost its parliamentary majority. His legacy is contested sharply, including allegations of corruption and organized crime ties that accumulated over decades in power. The Western governments that backed his rise in 1997 had mostly moved on long before that reckoning arrived.

https://t.co/a7JRRcwU2A

#foreigninterference #ElectionInterference #InfluenceOperations #CovertMediaFunding #FrontOrganizationOperations #PoliticalInfiltration

[Foreign Interference Research Center @ForIntOrg]

2 years ago today, DFRLab rolled out its Foreign Interference Attribution Tracker, and the headline finding wasn't about any single operation. It was structural: China, Iran, and Russia were converging on the same toolbox even while their objectives stayed distinct.

The FIAT framework documented this carefully. Russia kept doing Russia things, computational propaganda at scale, surrogate media networks, deepfakes stitched into narrative amplification loops. Iran had made a noticeable pivot, leaning hard into the Gaza humanitarian crisis as raw material for stoking division inside Western democracies rather than just projecting regional messaging. China stayed patient and covert, fake personas, LinkedIn-style professional network infiltration, and the kind of media ecosystem manipulation that produces coverage favorable to Beijing without ever leaving obvious fingerprints.

Different goals, different targets, increasingly similar plumbing.

The shared infrastructure piece is what made FIAT useful beyond a simple actor scorecard. All three were running generative AI tools into their content pipelines by 2024, using them to compress what previously took rooms full of contractors into something much leaner. Personalization at scale, lower production cost, faster iteration. The operational tempo implications are obvious if you've watched these campaigns long enough. Attribution windows that used to be measured in weeks started shrinking because the volume of material was high enough that pattern-matching could catch up faster, but the sheer throughput also meant more noise to sort through. The net effect on defenders wasn't clearly positive.

The tracker was also explicitly designed to close the attribution ambiguity gap, the space where foreign interference actors have historically operated with relative comfort because no public record connected incidents to documented actor profiles. By making the TTP database open-source and cross-referenceable, DFRLab was handing journalists and civil society organizations a common reference layer that hadn't existed in any systematic form before. Prior to something like FIAT, you had individual platform takedown reports, occasional government attribution statements, and academic analyses running on months-long publication cycles. None of it was built for operational tempo.

Atlantic Council analysts framed 2024 as exceeding both 2016 and 2020 in raw operational scale, which is a significant claim given how much attention those two cycles received. The difference was partly the AI acceleration, partly the density of the electoral calendar. Roughly 50 countries held national elections in 2024, and that kind of target-rich environment doesn't go unnoticed by actors who've been running influence operations as a matter of routine foreign policy for the better part of a decade.

Two years on, the convergence FIAT documented has only sharpened. The cost curves on AI-generated content kept dropping. Platform detection improved in some areas and regressed in others depending on how much appetite any given company had for enforcement. The public attribution infrastructure that FIAT helped build is more developed now than it was, but the adversaries adapted too, they always do. The tracker was a snapshot of a moving target, and the value was always less in the specific incidents it catalogued and more in demonstrating that systematic open-source attribution was achievable at all.

That proof of concept mattered. It still does.

https://t.co/a5cKHuajWR

#foreigninterference #AIProfileGeneration #DisinformationCampaigns

[Foreign Interference Research Center @ForIntOrg]

8 years ago today, the Internet Research Agency was still running fake American accounts across Facebook, Instagram, Twitter, and YouTube. After a public indictment. After months of congressional hearings. After everyone knew the name.

That's the part worth sitting with.

NPR published its reconstruction of Russia's 2018 midterm disinformation operation in October of that year, working from DOJ court filings. What the documents showed wasn't improvised. The IRA had divided its labor: some units pushed content aimed at racial divisions, others ran separate tracks for right-wing and left-wing audiences, and dedicated teams produced voter suppression messaging designed to look like it came from inside the communities it was targeting. Purchased advertising. Targeted demographics. Fake personas with posting histories built to look real.

The GRU was running a separate lane at the same time. The same unit indicted for the 2016 DNC and DCCC hacks was back at it, combining network intrusion against election-related infrastructure with the IRA's influence work. Not two separate operations. An integrated one.

U.S. intelligence chiefs issued public warnings that fall, which was notable for its directness. The DOJ unsealed new charges against a Russian national tied specifically to midterm interference. The warnings were unusual enough that people commented on them at the time.

Then the election happened, and in February 2019, DOJ and DHS released a joint assessment concluding there was "no evidence to date that any foreign adversary successfully changed vote tallies, changed voter registration data, or prevented a qualified voter from casting a ballot."

The Trump administration called it vindication. Critics, including analysts at Just Security, pointed out the obvious: the assessment was scoped exclusively to electoral infrastructure. Vote tallies. Registration systems. Ballots cast. It said nothing about the influence operation the court documents had already described in detail, an operation that had reached tens of millions of Americans with divisive content. The "no material impact" conclusion was technically defensible only if you defined the operation narrowly enough to exclude most of what the operation actually did.

That definitional argument mattered. It still does. How a government officially characterizes interference determines what counts as a successful defense against it.

The broader lesson from 2018 was structural. Russia didn't stop after 2016 when the whole world found out what had happened. The exposure didn't change the calculation in Moscow. Criminal indictments didn't change it. The operational continuity across two election cycles told analysts something direct: the benefits, from Russia's perspective, outweighed the costs. That assessment shaped how U.S. counter-interference policy was debated in the years that followed, with ongoing disagreement about whether criminal charges, platform takedowns, and public attribution actually deter anything.

The playbook documented in those 2018 court filings didn't disappear after the midterms. Fictitious personas, demographically targeted content, suppression messaging framed as community voices. Other actors studied it. Some adopted it. The geographic scope widened. The platforms shifted as moderation got more aggressive on the major ones. The architecture stayed recognizable.

Eight years on, the IRA itself is gone in its original form, sanctioned and reorganized under different structures. The GRU units involved have been indicted, named publicly, and continue operating. The people who ran those accounts in 2018 faced no practical consequences. The court documents exist. The defendants remain in Russia.

https://t.co/Qz8fh0RzBP

#foreigninterference #DisinformationCampaigns #ElectionInfrastructureTargeting #ElectionInterference #IdentityConcealment #IdentityGrievanceCampaigns #InfluenceOperations #VoterIntimidation

[Foreign Interference Research Center @ForIntOrg]

Academic researchers flagged state-sponsored disinformation as a systemic threat in 2012. Bot networks, platform exploitation, deliberate amplification of domestic divisions. The playbook was documented. Democratic governments had over a decade to act on it.

https://t.co/Vr1eM4cCqT

#foreigninterference #CognitiveExploitation #DisinformationCampaigns #SocialMediaHijacking

[Foreign Interference Research Center @ForIntOrg]

Researchers flagged state-sponsored disinformation as a systemic threat back in 2012. Bot networks, coordinated narrative campaigns, deliberate exploitation of political divisions. The full playbook, documented. Nobody acted on it.

https://t.co/Vr1eM4cCqT

#foreigninterference #CognitiveExploitation #DisinformationCampaigns #SocialMediaHijacking

[Foreign Interference Research Center @ForIntOrg]

Canada's senior security adviser admitted on October 21 that the national screening architecture "can be strengthened." That's bureaucratic language for: it has holes. The admission came the same day the U.S. Embassy in Ottawa was formally alleging that the Carney government was meddling in the U.S. midterms. That timing is not incidental.

Now look at where this goes.

The U.S. Embassy's three-category allegation (tariff policy as voter pressure, official meetings with U.S. political figures, anti-Trump ad campaigns with government-linked funding) is a template. It's the first time a Five Eyes partner has formally accused another of electoral interference through economic and political levers rather than covert tradecraft. That precedent doesn't disappear after the midterms. It gets cited. It gets expanded. Other actors are watching how it lands.

The screening gap acknowledgment is the more durable problem. Canada's Foreign Influence Registry was already documented as failing to capture the full scope of foreign agent activity before this week. The Hogue Commission laid that out. What the adviser's concession does is transform a critics' argument into an official admission. That matters for the next time a foreign actor decides whether Canadian political infrastructure is worth penetrating. The answer just got easier to calculate.

Here's what the trajectory looks like from here.

On the Canadian side, the domestic pressure to close the registry gaps will now compete with the political cost of appearing to capitulate to U.S. pressure. Carney's team has framed this dispute as symmetrical, both countries making economic arguments across the border. That framing is tactically useful but operationally misleading. Canada's screening weaknesses are real regardless of whether the U.S. allegations are fair, and conflating the two lets the genuine vulnerabilities ride.

The specific gaps matter. Inadequate vetting of foreign-linked campaign financing is not a minor administrative issue. It's the entry point that Chinese and Indian interference operations have already used in Canadian federal elections, per the Hogue findings. Leaving it unaddressed while publicly feuding with Washington about who is interfering in whose elections is a fairly remarkable position to be in.

On the bilateral intelligence side, the operational friction is already starting. Canada and the United States share the deepest counterintelligence relationship in the Five Eyes architecture. When that relationship is publicly framed as adversarial, even rhetorically, the working-level cooperation gets complicated. Officers on both sides become careful about what they share and when. Beijing and Moscow do not need to manufacture that friction. Ottawa and Washington just demonstrated they can generate it themselves.

What should defenders watch for in the next cycle?

Attempts by third-party actors to exploit the bilateral noise. When Canada and the U.S. are publicly disputing the definition of interference, the operational space for actual foreign interference operations expands. China's United Front Work Department, Russian political influence infrastructure, and Iranian diaspora pressure networks have all been active in Canadian political environments. A distracted bilateral relationship is a permissive environment.

Watch the Foreign Influence Registry specifically. If the "strengthening" the adviser referenced stays at the level of vague commitment with no legislative action before the next Canadian election cycle, the gap is effectively permanent for planning purposes. Foreign actors can time operations around reform timelines. If the registry amendments don't move in Parliament by mid-2027, assume adversarial planners have already noted that.

Watch the anti-Trump advertising allegation more carefully than it's currently being covered. The U.S. Embassy's inclusion of government-linked ad campaigns as an interference category is genuinely novel. If that framing holds, it sets a precedent that any government-funded political communication that crosses borders and influences electoral sentiment could be characterized as interference. That cuts in multiple directions. It's worth tracking whether the State Department formalizes that definition, because if it does, it changes the rules for every allied government that runs public communications campaigns.

Canadian officials who meet with U.S. political figures should expect those meetings to be documented, reported, and potentially cited in the next U.S. complaint. The Embassy already named that category explicitly. Treat it as a surveilled activity now, because it is.

The Carney government's instinct to reframe this as a symmetrical dispute is understandable politics but it doesn't resolve the underlying architecture problem. A senior adviser just confirmed the screening system needs work. That's the sentence that will be quoted when the next incident surfaces. And there will be a next incident.

https://t.co/Wn8IEIMofr

#foreigninterference #ElectionInterference #DiplomaticCoercion #ForeignAccusation #EconomicCoercion #LegislativeGapAssessment

[Foreign Interference Research Center @ForIntOrg]

Russia's shadow fleet is not a shipping problem. It's the balance sheet behind everything else.

600-plus vessels, running outside standard insurance and flag frameworks, pumping revenue directly into the machine that funds European sabotage, election interference, and the UK government's recently assessed £1.5 billion Russian disinformation spend. Small Wars Journal's October piece makes the case that Western counter-fleet doctrine is chasing satellites when it should be chasing accountants and port fixers in Dubai, Istanbul, and Hong Kong.

The HUMINT gap here is the real exposure. Flag state corruption, ship-to-ship transfers at sea, opaque re-insurance chains: none of that yields to a better sensor.

https://t.co/oGKcQYBrmy

#foreigninterference #FinancialSystemWeaponization #MoneyLaundering #MaritimeIntelligenceGathering #MaritimeSurveillanceDetection #ExportControlViolations #CriticalFinancialInfrastructureTargeting

[Foreign Interference Research Center @ForIntOrg]

Huang Yi-hao was hit by a car in Taiwan. Prosecutors confirmed on October 21, 2026 that they are treating it as a criminal matter. He had been publicly criticizing Xi Jinping.

That last sentence is doing a lot of work.

Taiwan is not a third country where Chinese intelligence services operate in the usual ambiguous gray zone. It has its own security apparatus. It is actively monitored. An operation conducted there, against a civilian critic, on Taiwanese soil, carries a different weight than the coercion operations Freedom House has documented in places like Canada, the Netherlands, or Australia. The operational risk is higher. Which means, if this is confirmed as politically motivated, the signal being sent is deliberate.

The broader pattern here is worth laying out carefully, because this incident does not exist in isolation.

Freedom House has consistently identified the PRC as the most prolific perpetrator of transnational repression globally. The mechanisms are varied: physical assault, cyberattacks, coercion of family members still inside China, legal harassment through Interpol notices and civil suits, and surveillance platforms like CHOSEN BRICK targeting diaspora communities. The physical operations tend to get the most attention when they surface, but they represent only one layer of a much larger system designed to make critics outside China's borders feel the reach of that border anyway.

Recent documented cases give this context. There were arrests in the United States connected to an operation targeting family members of President Lai Ching-te. Tibetan protesters were attacked at the Xi-Trump summit in Washington. Hong Kong dissidents in multiple jurisdictions have faced cross-border intimidation. These are not isolated incidents. They are a pattern with a consistent logic: the geographic location of the critic does not determine whether Beijing treats them as a domestic problem.

What has shifted, and what the Huang case potentially represents, is the expansion of who counts as a threat.

Huang Yi-hao is a comedian. Not a politician. Not a formal dissident with ties to independence movements or Tibetan or Uyghur advocacy networks. A cultural figure who made jokes about Xi Jinping. Beijing's domestic censorship apparatus has long treated personal satire of Xi with exceptional sensitivity, but the question of whether that sensitivity would translate into cross-border physical operations against comedians was, until recently, somewhat open.

If the investigation confirms political motivation here, it closes that question.

The logic from Beijing's perspective is not hard to trace. Satire circulates. It erodes the image of leadership in ways that formal political speech sometimes does not, precisely because it is funny and shareable and cuts through the register of official discourse. A comedian with a following in Taiwan, producing content critical of Xi that can spread across Mandarin-speaking communities globally, is not nothing from an information environment standpoint. The sensitivity is real. The response, if confirmed, is a choice to treat that sensitivity as an operational priority even at the cost of conducting an operation in a jurisdiction where the risk of exposure and political blowback is high.

That cost-benefit calculation tells you something.

Huang's response to the incident is worth noting on its own terms. He vowed to return to the stage. He invited the police and prosecutors working the case to his upcoming performances. This is not an accident of temperament. It follows a documented counter-intimidation strategy: respond with increased public visibility rather than self-censorship, convert the intimidation itself into a story that mobilizes support and makes the target harder to silence. Maria Ressa at Rappler used the same approach. The logic is that silence achieves the attacker's goal; visibility does the opposite, while also providing some measure of protection through public attention.

It is an effective strategy, and it requires a certain kind of nerve to execute when someone has just been struck by a car.

Taiwan presents a specific operational challenge for Chinese intelligence services that is worth being precise about. Beijing claims Taiwan as its own territory. It has not renounced the use of force to achieve unification. But Taiwan operates a functioning democratic state with its own judicial system, its own security and counterintelligence apparatus, and its own political institutions that actively monitor and push back against Chinese interference operations. The island has experience with this. Taiwanese authorities have prosecuted individuals for espionage and foreign agent activity. They are not naive about what Beijing does.

Conducting a physical intimidation operation there is therefore not like conducting one in a country where the government may be indifferent, sympathetic to Beijing, or simply unprepared to investigate. It is a choice to operate inside a jurisdiction that will investigate, that has the capability to attribute, and that has political incentive to make any confirmed PRC operation into a public story.

If Beijing made that choice, the signal is intentional. The message is that Taiwan's jurisdiction does not function as a limit on what critics there can face. That message is directed at Huang, but it is also directed at everyone else in Taiwan who might be considering whether to say something publicly about Xi Jinping.

The investigation is ongoing. Attribution in cases like this is difficult and takes time. Prosecutors have confirmed the criminal inquiry; they have not publicly confirmed a link to PRC state actors. That distinction matters and should be held carefully. What can be said now is that the pattern this incident fits is documented, that the targeting profile is consistent with Beijing's expansion of what counts as hostile speech, and that the location, Taiwan rather than a third country, is significant if attribution is eventually established.

Huang Yi-hao is planning his next performance. The police are invited.

https://t.co/k5DFp3SCHC

#foreigninterference #TransnationalRepression #CrossBorderIntimidation #IndividualTargeting #MediaIntimidation

[Foreign Interference Research Center @ForIntOrg]

The UK's Counter-Disinformation Unit is under documented, multi-vector pressure. Russia spent £1.5 billion on disinformation in 2026, the transatlantic coordination architecture has been fractured by Washington's withdrawal from Disinfo2026, and the Burnham government handed Moscow a free goal by letting its own ministers publicly contradict the Prime Minister's Brexit-Russia attribution claims. That last one is the part worth watching most carefully going forward.

Here is the underlying dynamic, stripped of the dramatics. Russia's strategic objective in targeting counter-disinformation institutions is not simply to spread narratives. It is to discredit the people and structures responsible for exposing them. When UK ministers publicly rebuked Burnham over the Russian referendum interference claims in October, the disinformation operation achieved something more durable than any individual planted story could. It made the UK government's own credibility apparatus look like a political football. The CDU's job, on a good day, is hard. Its job in the wake of that public ministerial split is significantly harder, because now any attribution claim it supports can be dismissed as politically motivated by Downing Street. That is a structural wound, not a news cycle.

The trajectory from here runs in a fairly predictable direction, because it always does.

Russia will press the Brexit angle harder, not softer. Burnham reopened that wound himself by making public claims about referendum interference. Moscow did not need to manufacture that opening. It was handed to them, and the operational logic now says you exploit a domestic political fault line while it is still raw. Expect a surge in content targeting the gap between Burnham's position and his ministers', framed as proof that the UK government lies about Russian interference to serve domestic political ends. That framing does not need to be believed universally. It just needs to be believed enough to generate friction and reduce the political bandwidth available for coherent counter-disinformation policy.

On the AI angle: the 450 to 700% surge figure in AI-driven disinformation is being cited in European assessments, and Russia is explicitly identified as leading the technological adaptation curve. The CDU was not resourced for the volume of operations it was facing in 2024. It is certainly not resourced for a 5x to 7x expansion of that volume, particularly while the transatlantic intelligence-sharing and coordinated-response architecture is partially dismantled. The U.S. withdrawal from Disinfo2026 was not a symbolic slight. It was a concrete operational disruption. The coordination mechanisms that allowed UK, EU, Canadian, and allied analysts to share attribution data and synchronize public responses took years to build. They did not survive Washington's decision to walk away, and rebuilding them bilaterally, country by country, outside the multilateral framework, is slower and less effective by design.

Platform dependency is the quiet structural problem that tends to get buried under the flashier threat assessments. The CDU's practical ability to counter disinformation at scale depends substantially on what X, under its current ownership, is willing to do. The answer, based on the last two years of observed behavior, is: considerably less than its predecessors agreed to. The Online Safety Act gives the UK some regulatory leverage, but regulatory proceedings move at a pace that is simply not calibrated to the speed of an active influence operation. By the time a formal enforcement action concludes, the narrative has run its course and the damage is done. This is not a solvable problem within current architecture. It is a known gap that adversaries have already mapped.

What defenders inside government need to be honest about right now: the institutional credibility problem created by the Burnham-Brexit row is not going to resolve itself. It requires active, deliberate repair, which means the CDU and DSIT-linked structures need political cover from ministers who are visibly unified on attribution methodology, even when specific attributions are politically inconvenient. The October episode demonstrated precisely the opposite dynamic. Until that changes, every public attribution the CDU makes will be received in a media environment that has been primed, partly by the UK government's own behavior, to treat those attributions as politically suspect.

For officials trying to build the bilateral intelligence-sharing relationships that now have to substitute for the multilateral framework: the EU partners are willing, Canada is willing, the Five Eyes arrangement still functions, but none of that fully replaces what Disinfo2026 and its predecessor structures provided in terms of coordinated public response. Coordinating a joint attribution statement among five or six partners outside a standing framework is slower and harder to sustain, and Russia knows this. The disruption of the multilateral architecture was a deliberate strategic win for Moscow, delivered for free by Washington.

Voters and the public-facing element: watch for the second-order narrative. Not just "Russia interfered in Brexit," which is contested terrain now. The next wave will be "the UK government fabricates Russian interference claims when it's politically useful," which is more corrosive because it poisons the attribution well regardless of the underlying facts. That narrative is already being built. The ministerial contradiction in October was the foundation stone.

One thing that tends to get lost in the volume and sophistication conversation: Russia's disinformation operations have always been more effective at degrading trust than at persuading. The £1.5 billion is not buying converts. It is buying confusion, cynicism, and the sense among ordinary people that they cannot know what is true. That is a much cheaper outcome to achieve, and it compounds over time. The CDU was built primarily to identify and expose specific operations. It was not built, and is not currently resourced, to address the cumulative erosion of epistemic trust that is the actual long-term objective. That gap is not new, but the conditions of late 2026 have made it considerably more acute.

The next six months will tell us whether the Burnham government treats counter-disinformation as a genuine policy priority or as an occasional rhetorical weapon. The difference matters enormously to the people trying to do that work inside DSIT, and to every allied partner still trying to figure out whether the UK is a reliable anchor in European counter-disinformation architecture. Right now the answer is unclear, which is exactly where Moscow wants it.

https://t.co/VzcmCjVGMK

#foreigninterference #DisinformationCampaigns #CounterDisinformationFrameworkElimination #InfluenceOperations #ForeignInformationManipulation #AIEnhancedSocialEngineering #InstitutionalDismantlement

[Foreign Interference Research Center @ForIntOrg]

Two RT employees were indicted by the U.S. Department of Justice in September 2024. Not sanctioned. Not expelled. Indicted, for directing covert influence operations through a contracted American company that produced and distributed content serving Russian messaging objectives, with no disclosure of Russian direction. That's the floor. The ceiling is considerably higher.

The Soufan Center's October 31 brief and NPR's post-election analysis, taken together, paint a picture of the final weeks before November 5 as the most operationally dense foreign influence environment the U.S. has faced in a modern election cycle. Russia, Iran, and China were all running simultaneously, each with distinct objectives and methods, and the overlap between their efforts created compounding effects that U.S. defensive systems were not built to cleanly separate.

Russia ran what the Kettering Foundation's analysis called a significantly evolved operation compared to 2016 and 2020. Better operational security. Faster adaptation to the news cycle. More intermediary layers between Russian direction and visible attribution. RT was the spine, but RT was supplemented by proxy outlets and covert amplification networks across major platforms. The core messaging objectives were consistent: exacerbate social divisions, erode institutional confidence, and amplify narratives favorable to candidates perceived as less committed to supporting Ukraine. That's not speculation. That's what Global News and DW documented from U.S. government characterizations of the campaign.

Iran is the one that moved fastest. AI-assisted content generation, deployed at a scale that dwarfed previous Iranian election cycle operations. They built AI-generated personas across multiple platforms, ran targeted outreach to campaign figures with fabricated opposition research as the hook, and ran a sustained messaging operation aimed specifically at Arab-American and Muslim-American communities. The goal there was suppression, not persuasion: reduce enthusiasm for specific candidates based on their positions on Gaza. The National Intelligence Council's October 2024 declassified assessment named Iran explicitly alongside Russia as actively running influence operations in the weeks before the vote.

China played a longer game. No direct electoral interference in the acute sense. The focus was structural: shape diaspora sentiment, maintain pressure on politicians the PRC considers hostile to its interests, seed narratives that could take root over time. NewsGuard's 2024 Elections Misinformation Tracker attributed a subset of false claims to state-sponsored Chinese narratives. The Brookings Institution flagged that AI tools had lowered the barrier for Chinese and other state-linked actors to produce and distribute disinformation at scale, which is a meaningful shift even when the posture looks restrained on the surface.

The ODNI's post-election declassified assessment landed on a careful conclusion: no foreign actor successfully compromised the conduct of the election. But the assessment also flagged something worth sitting with. The influence operation environment had developed enough capacity to generate serious uncertainty, specifically around scenarios where ransomware attacks on peripheral election infrastructure or software errors could be misattributed to foreign interference. The problem isn't just interference. The problem is that the line between actual foreign interference and domestic technical failure is getting harder to hold in public perception, and adversaries know it.

That attribution gap is a feature, not a bug, from an adversary's perspective. You don't have to successfully attack an election to benefit from the possibility that something went wrong. The Soufan Center brief was published four days before the vote. The operations it was documenting were already at peak tempo. Whatever was built for 2024 will be the baseline for what comes next.

https://t.co/xQuZKmTrIZ

#foreigninterference #DisinformationCampaigns #StateMediaCoordination #InfluenceOperations #ComputationalPropaganda #AIProfileGeneration #ElectionInterference #FrontOrganizationOperations #CrisisThemeExploitation

[Foreign Interference Research Center @ForIntOrg]

Salt Typhoon didn't target specific people. That's what made it different.

China's telecommunications operation, named by the House Homeland Security Committee as the single most consequential nation-state cyber breach of 2024, compromised multiple major U.S. telecom companies and pulled call audio, metadata, and location data across the board. Government officials, congressional staff, people connected to both presidential campaigns. Not because Chinese intelligence had identified them in advance. Because the access was broad enough that it didn't need to. Analysts called it a "collect everything" posture inside American communications infrastructure. That framing is accurate, and it should bother people more than it seems to.

Microsoft's October 2024 threat intelligence report, cross-referenced with assessments from SentinelOne, Picus Security, and congressional reviews, treated 2024 as a qualitative break from prior years. Not just more attacks. A different level of capability and ambition across multiple state actors simultaneously.

Salt Typhoon got the most attention, but it wasn't the only Chinese operation worth tracking. Storm-0558 was documented in the same report: Chinese actors forged authentication tokens using an acquired Microsoft encryption key to access cloud email accounts. No brute force, no phishing chain, no traditional exploitation. They used a trusted infrastructure component against itself. Once you have a key that systems are designed to trust, you're not breaking in. You're walking in.

The zero-day picture was bad independently. Picus Security characterized the 2024 surge as exposing a "dangerous gap in many organizations' security strategies, preparedness for the unknown." Chinese and Russian APTs were discovering and weaponizing zero-days faster than defenders could identify them, let alone patch. Living-off-the-land techniques made it worse: malicious activity that mimics legitimate system behavior is genuinely hard to detect, and state actors have gotten good at it. The gap between offensive discovery and defensive response widened in 2024. That's not a trend line anyone wants to see continuing.

Russia's contribution to the year was mostly on the influence and AI side. Microsoft documented Russian actors using AI-generated content to scale influence operations at volumes that broke traditional moderation and attribution workflows. Speed and volume were the weapons. By the time content could be identified and removed, the next wave was already out. AI didn't make Russian disinformation more sophisticated in a technical sense. It made it faster and cheaper to run at scale, which turns out to be sufficient.

The cross-domain picture is what matters here. You had China running a passive mass-collection operation inside telecom infrastructure, a parallel campaign exploiting trusted cloud authentication, an accelerating zero-day capability gap, Russian AI-enabled influence operations running at industrial scale, and pre-positioned malware sitting inside critical infrastructure waiting. Microsoft's Corporate Vice President for Customer Security and Trust said explicitly that the scale had exceeded what any single government or company could handle alone, and argued for stronger integration across Five Eyes and NATO, pooled detection, near-real-time intelligence sharing, coordinated attribution.

That call isn't new. The argument for allied cyber defense integration has been circulating for years. What 2024 added was a concrete body of evidence that the alternative, handling it in national silos, was visibly failing. Salt Typhoon alone should be sufficient to drive that conversation with some urgency. Whether it does is a different question.

https://t.co/JW99VXPhVJ

#foreigninterference #AdvancedPersistentThreatOperations #TelecommunicationsInfiltration #ZeroDayExploitation #CyberEspionage #LivingOffTheLandExploitation #AIEnhancedSocialEngineering #CloudTrustAbuse

[Foreign Interference Research Center @ForIntOrg]

Brazil didn't file a formal protest with Washington. It briefed Paris and Berlin instead.

That tells you everything about how Brasília reads the current diplomatic environment. Lula's government is shopping its interference allegations, both U.S. and Russian, to European capitals that have their own reasons to care. The OAS observation mission gave them multilateral cover. The Trump administration gave them no bilateral off-ramp worth using.

Coalition-building as a response to interference is rare. Watch whether France and Germany do anything with what they just heard.

https://t.co/un4ToRPdym

#foreigninterference #ElectionInterference #DisinformationCampaigns #InfluenceOperations #CrossBorderInfluenceOperations #IntelligenceAssessmentDisclosure #ForeignAccusation