---
title: "State Actors & Information War"
description: "When governments deliberately weaponise the commercial infrastructure others built for profit."
url: https://attentionmachine.org/en/attention-machine/state-actors/
lang: en
updated: 2026-10-25
license: "CC BY-NC-SA 4.0 (https://creativecommons.org/licenses/by-nc-sa/4.0/)"
---

# State Actors & Information War

Most harms on this site are emergent from commercial incentives. This page is the exception. Some governments have deliberately weaponised what others built.

No conspiracy is required to explain most of what this site documents. State actors are the explicit exception — some governments act with deliberate intent to deceive populations and undermine democratic institutions.

## Russia's Internet Research Agency — confirmed fact

Russia's Internet Research Agency (IRA) ran systematic, funded operations to influence the 2016 US election by creating fake American personas across Facebook, Twitter, Instagram, and YouTube — producing tens of thousands of posts designed to inflame divisions on immigration, race, and policing. This is not an allegation. It is documented in the Mueller Report (2019)[^src-mueller-report-2019], the US Senate Intelligence Committee's five-volume report (2019–2020)[^src-senate-intelligence-2019], and the platforms' own Congressional testimony[^src-senate-judiciary-2017].

> **Active measures (aktivnye meropriyatiya)**
>
> The long-standing Russian (and earlier Soviet) doctrine of influencing other countries by means short of war: disinformation, forgery, front organisations, and the amplification of existing social divisions. Online influence operations are this doctrine ported to a new medium — the goal is less to make you believe one specific lie than to corrode shared trust in institutions and in the idea of verifiable fact.
>
> **Sources**
>
> - [US Senate Intelligence Committee Report on Russian Active Measures Campaigns and Interference](https://www.intelligence.senate.gov/2020/08/18/publications-report-select-committee-intelligence-united-states-senate-russian-active-measures/) (2019–2020, five volumes).

> **Sockpuppet accounts**
>
> Accounts run by an operator while posing as an unconnected, ordinary person — a fake "American voter" actually run from a troll farm abroad. At scale, a coordinated network of sockpuppets manufactures the appearance of a genuine grassroots movement (sometimes called "astroturfing"), which is what made the IRA's operation effective: the divisive content looked like it came from real fellow citizens.
>
> **Sources**
>
> - [Mueller Report](https://www.justice.gov/archives/sco/file/1373816/dl) (2019), Volume I.

On 4 November 2024, the day before the US presidential election, the Office of the Director of National Intelligence, FBI, and CISA issued a joint public statement[^src-odni-2024]: "The IC has been observing foreign adversaries, particularly Russia, conducting additional influence operations intended to undermine public confidence in the integrity of US elections and stoke divisions among Americans."

## The Meliorator tool

In 2024, the FBI, Dutch AIVD and MIVD, Dutch Police, and Canadian CCCS issued a joint advisory[^src-fbi-2024] warning social media companies about "Meliorator", which the advisory describes as Russian state-sponsored software for creating and managing fake social media accounts at scale. The same day, the US Department of Justice announced[^src-justice-2024] the seizure of two domain names and the search of 968 accounts on X used by the bot farm, under court warrants. The advisory described the tool as a "covert software" enabling social media farm operations. The joint statement of allied intelligence agencies is itself significant: multiple NATO democracies coordinating publicly on an active Russian information operation.

## What European intelligence agencies are saying

The infrastructure that state operations exploit is the one several European intelligence agencies now name in their own caseloads: they say publicly, in their annual reports and threat updates, that much of today's radicalisation happens online. That is narrower than this site's argument about engagement ranking — the agencies describe where it happens, not what ranks it — and most of what they describe is domestic extremism, set out on the [Radicalisation](https://attentionmachine.org/en/symptoms/radicalisation/#security-services) page. The part that concerns a state actor is this.

**AIVD (Netherlands), April 2026:** On the AIVD's 2025 annual report[^src-aivd-2025], NOS quotes[^src-nos-2026] Director-General Simone Smit: "In the eighty years that the AIVD and its predecessors have existed, there has never been a threat picture like the present one, with national security under pressure from so many sides at once, for so long." The report itself[^src-aivd-2025] described a minor who mapped the digital networks of embassies and other organisations in The Hague at the request of a Russian state-backed hacking group.

**VIGINUM (France), June 2026:** France's service for detecting foreign digital interference — an open-source analysis service of the Prime Minister's defence secretariat, not one of the intelligence services — wrote in its report on the March 2026 municipal elections[^src-viginum-2026] that "since the 2017 presidential election in France, no major election or referendum has been spared attempts at information manipulation involving foreign actors". Its May 2025 report[^src-viginum-2025] documented 77 operations by the Russian influence network Storm-1516 between August 2023 and March 2025, including during the July 2024 snap legislative election. Its February 2025 review[^src-viginum-2025-ukraine] of three years of Russian operations judged their reach "relatively limited".

## The structural point

State actors did not build the attention machine. They found a commercial infrastructure — designed to maximise engagement, calibrated to emotional vulnerabilities, capable of reaching billions of people with precisely targeted content — and discovered it was extraordinarily useful for their purposes.

The platforms were not designed for information warfare. They turned out to be almost perfectly suited for it. Polarising content is engaging, and engagement is what the platforms sell. Confusion benefits state actors seeking to undermine democratic institutions. The incentives aligned.

Addressing state actor misuse requires both the structural reforms described in the Laws & Regulation section and the geopolitical responses (sanctions, coordination, attribution) that are beyond the scope of this site. What this site documents: the infrastructure that makes the weaponisation possible is the same infrastructure described throughout these pages.

**How we know — why this page states things as fact, and the sourcing standard**

This is the one section of the site that asserts deliberate intent, so the evidence bar is deliberately higher. The IRA claims rest on _primary documents_: the Mueller Report[^src-mueller-report-2019] (a US Department of Justice investigation, with indictments naming the IRA and its financier) and the Senate Intelligence Committee's bipartisan five-volume report[^src-senate-intelligence-2019], corroborated by the platforms' sworn Congressional testimony[^src-senate-judiciary-2017]. These are not journalistic summaries or single-source reports; they are official investigations that survived adversarial scrutiny.

**How we use intelligence-agency statements.** Annual reports such as the AIVD's[^src-aivd-2025] are used as _corroboration_, not as the sole basis for a claim. Intelligence services have institutional incentives and cannot always show their evidence, so we treat a single agency assertion as one input. The domestic caseloads that MI5 and the BfV describe — arrest counts and recorded crimes, which are checkable — are on the [Radicalisation](https://attentionmachine.org/en/symptoms/radicalisation/#security-services) page, beside the research they corroborate.

**Where we stop.** "Confirmed" applies to the existence and conduct of the operations. The _effect_ on any election outcome is a separate, harder question that this page does not claim to settle — the same discipline applied to Cambridge Analytica on the Advertising page.

## Sources

[^src-mueller-report-2019]: [Mueller Report](https://www.justice.gov/archives/sco/file/1373816/dl) (2019).

[^src-senate-intelligence-2019]: [US Senate Intelligence Committee Report on Russia](https://www.intelligence.senate.gov/2020/08/18/publications-report-select-committee-intelligence-united-states-senate-russian-active-measures/) (2019–2020, five volumes).

[^src-senate-judiciary-2017]: US Senate Judiciary Subcommittee hearing (31 October 2017) — platform testimony on IRA reach: [PBS NewsHour / AP report](https://www.pbs.org/newshour/politics/in-hearing-on-russia-facebook-twitter-google-defend-their-security-measures) (126 million on Facebook; 1,108 YouTube videos with 309,000 views).

[^src-odni-2024]: [Joint ODNI / FBI / CISA statement](https://www.fbi.gov/news/press-releases/joint-odni-fbi-and-cisa-statement-110424), 4 November 2024.

[^src-justice-2024]: US Department of Justice (9 July 2024), [_Justice Department Leads Efforts Among Federal, International, and Private Sector Partners to Disrupt Covert Russian Government-Operated Social Media Bot Farm_](https://www.justice.gov/archives/opa/pr/justice-department-leads-efforts-among-federal-international-and-private-sector-partners) — “the seizure of two domain names and the search of 968 social media accounts”.

[^src-fbi-2024]: FBI, Cyber National Mission Force, AIVD, MIVD, Dutch Police and Canadian Centre for Cyber Security (9 July 2024), [_State-Sponsored Russian Media Leverages Meliorator Software for Foreign Malign Influence Activity_](https://www.ic3.gov/CSA/2024/240709.pdf) — joint cybersecurity advisory.

[^src-aivd-2025]: [AIVD Jaarverslag 2025](https://www.aivd.nl/documenten/2026/04/23/jaarverslag-2025) (April 2026).

[^src-nos-2026]: NOS (23 April 2026), [_Rusland, China, terroristen: AIVD zag 'in 80 jaar niet meer dreiging dan nu'_](https://nos.nl/l/2611683) — "In de tachtig jaar dat de AIVD en zijn voorlopers bestaan, was er niet eerder een dreigingsbeeld zoals nu".

[^src-viginum-2026]: VIGINUM (SGDSN) (11 June 2026), [_Protection du débat public contre les ingérences numériques étrangères durant les élections municipales des 15 et 22 mars 2026_](https://www.sgdsn.gouv.fr/files/files/viginum/Publications/20260611_SGDSN_VIGINUM_Rapport-public_Elections-municipales.pdf) (public report) — the sentence quoted (in our translation above); the original: « depuis l'élection présidentielle de 2017 en France, aucun rendez-vous électoral ou référendaire majeur n'a en effet été épargné par des tentatives de manipulations de l'information impliquant des acteurs étrangers ». VIGINUM describes its work as open-source investigation; "not one of the intelligence services" is our description, not its own.

[^src-viginum-2025]: VIGINUM (SGDSN) (6 May 2025), [_Analyse du mode opératoire informationnel russe Storm-1516_](https://www.sgdsn.gouv.fr/files/2025-05/20250507_TLP-CLEAR_NP_SGDSN_VIGINUM_Rapport%20technique_Storm-1516.pdf) (technical report) — 77 information operations documented up to 5 March 2025, the July 2024 snap legislative election among the votes targeted.

[^src-viginum-2025-ukraine]: VIGINUM (SGDSN) (24 February 2025), [_Guerre en Ukraine : trois années d'opérations informationnelles russes_](https://www.sgdsn.gouv.fr/files/files/Publications/20250224_TLP-CLEAR_NP_SGDSN_VIGINUM_Guerre%20en%20Ukraine_Trois%20ann%C3%A9es%20d'op%C3%A9rations%20informationnelles%20russes_1.0_VF.pdf) — « la portée des campagnes conduites par les MOI russes présentés dans ce rapport reste relativement limitée » (in our translation, "relatively limited").

[^src-euvsdisinfo-disinformation]: [EUvsDisinfo disinformation case database](https://euvsdisinfo.eu/disinformation-cases/).

[Symptoms: Elections & Democratic Harm →](https://attentionmachine.org/en/symptoms/elections/)\
[Laws & Regulation: Digital Services Act →](https://attentionmachine.org/en/laws/dsa/)

---

Some content on this site was created with the assistance of AI tools and may contain errors. [How we use AI →](https://attentionmachine.org/en/about/how-we-use-ai/)