Inside the disinformation networks: from Southport to Spamouflage

The clip showed a boy in a black T-shirt lying in a pool of blood, a camera above him, a man shouting directions. Men in kippahs and men in green fatigues resembling IDF uniforms stood around. A verified X user shared it with the caption: "Video showing Israel attempting to create fake footage of deaths." The Guardian identified the footage as a behind-the-scenes shot from Empty Place, a Palestinian short film about the vacuum left by Palestinians who fled the Israeli occupation. It started on TikTok and migrated to X. The original TikTok post is no longer available, but the repurposed version kept circulating and accumulating views. The user behind the 2m-view post later acknowledged the clip may have been used out of context.

The story matters less for what it says about one video than for what it says about the supply chain. Real footage, stripped of context, becomes evidence for a claim it was never meant to support. The correction, if it comes at all, arrives late and travels poorly.

Networks, not lone posters

Within days of the 7 October attack, X was flooded with similar material. A second video, also originating on TikTok and now unavailable there, racked up 2m views on X claiming to show high-profile Israeli generals captured by Hamas fighters. In reality, per the Guardian, it had been published days earlier by the official YouTube channel of Azerbaijan's state security service and showed arrested former leaders of the breakaway Nagorno-Karabakh government. A doctored document suggesting Joe Biden had given $8bn in assistance to Israel was viewed 400,000 times on X; it was an edited version of his July memo announcing $400m in aid to Ukraine. The White House confirmed to NBC that the document was fake. The common thread is not a single ideology but a method: take real material, relabel it, and let the platform's distribution do the rest.

Russia has been a longstanding culprit for spreading disinformation on X, and appears to have capitalised on the Israeli-Palestinian conflict, the Guardian reported. On the Monday after the attack, the former Russian president Dmitry Medvedev, deputy chair of the Russian Security Council, tweeted: "Well, Nato buddies, you've really got it, haven't you? The weapons handed to the Nazi regime in Ukraine are now being actively used against Israel." Separately, an X account linked to the Wagner mercenary group posted a video apparently showing Hamas thanking Ukraine for weapons it planned to use against Israel. It drew more than 300,000 views and was amplified by far-right US accounts.

The Ukrainian side pushed back. Ukrainian intelligence accused Russia of placing "trophy" western weapons seized from battlefields in Ukraine with Hamas to undermine support for Kyiv. In February, the Pentagon's inspector general had reported no evidence to date of weapons and aid to Ukraine being diverted to third parties. Eliot Higgins, founder of the investigative outlet Bellingcat, flagged a fake video purporting to be from the BBC that claimed to feature a Bellingcat investigation into Ukrainian weapons smuggling to Hamas. Higgins said it was being pushed by Russian social media users but added that it was unclear whether this was a Russian government campaign or a grassroots effort. That caveat is worth keeping. Attribution is the hardest part of this work, and the loudest claims often come with the thinnest evidence.

When the fake name becomes a trending topic

The UK riots of August 2024 showed what happens when a network gets a story that fits an existing grievance. After three young girls were killed in a knife attack in Southport in July, false information about the attacker's name, religion and migration status appeared within hours. "Referencing a post on LinkedIn, a post on X falsely named the perpetrator as 'Ali al-Shakati,' rumored to be a migrant of Muslim faith. By 3 p.m. the following day, the false name had over 30,000 mentions on X alone," Hannah Rose, a hate and extremism analyst at the Institute for Strategic Dialogue, told CNBC via email. Other posts claimed the attacker was on an intelligence services watchlist, had arrived on a small boat in 2023, and was known to local mental health services, according to ISD's analysis. Police debunked the claims the day after they emerged, saying the suspect was born in Britain. By then the narrative had traction.

Far-right groups organised anti-migrant and anti-Islam protests, including a demonstration at the planned vigil for the girls. The demonstrations escalated into days of riots, with attacks on mosques, immigration centres and hotels housing asylum seekers. Joe Ondrak, research and tech lead for the UK at the tech company Logically, told CNBC the false claims were "catnip" to groups already primed to react. "It's not a case of this false claim goes out and then, you know, it's believed by everyone," he said. The reports instead acted as "a way to rationalize and reinforce pre-existing prejudice and bias and speculation before any sort of established truth could get out there."

The algorithm did not merely fail to stop it. In at least one case, it recommended it.

Platform mechanics amplified the lie in ways that are easy to miss if you only look at who posted it. Rose told CNBC that accounts with hundreds of thousands of followers and paid-for blue ticks shared the false information, which was then pushed by algorithms. On TikTok, when users searched "Southport," the "Others Searched For" section, which recommends similar content, promoted the false name of the attacker, including eight hours after police had confirmed it was incorrect. ISD's analysis found similar behaviour on X, where the incorrect name featured as a trending topic. The false claims also moved onto Telegram, which Ondrak described as consolidating narratives and exposing more people to "more hardline beliefs," including channels that began as anti-vaccine and were co-opted by far-right figures. Telegram told CNBC it denied helping spread misinformation, saying its moderators were monitoring the situation and removing channels and posts calling for violence.

Some accounts calling for participation in the protests could be traced to the extreme right, according to Logically's analysis, including some linked to the banned group National Action, named a terrorist organisation in 2016 under the UK's Terrorism Act. The UK's Online Safety Act was meant to address hate speech, but it only came into effect early the following year and may not be enough for some forms of disinformation. On the Wednesday after the worst of the riots, the media regulator Ofcom wrote to social media platforms saying they should not wait for the new law to come into force. By then, thousands of anti-racism protesters had rallied in cities and towns across the UK, outnumbering the anti-immigrant demonstrations.

The largest known operation

Not every network is improvised around a breaking news event. CNN reported in November 2023 that the Chinese government had built the world's largest known online disinformation operation and was using it to harass US residents, politicians and businesses, at times threatening targets with violence. The reporting was based on a review of court documents and public disclosures by social media companies. Victims described a barrage of tens of thousands of social media posts calling them traitors, dogs, and racist and homophobic slurs. Some had spoken to law enforcement, including the FBI, with little result. Tech and social media companies had shut down thousands of accounts, but new ones appeared virtually every day.

The network is tracked under names including "Spamouflage" and "Dragonbridge." Its hundreds of thousands of accounts spread across every major social media platform, harassing Americans who criticised the Chinese Communist Party, seeking to discredit US politicians, disparaging American companies at odds with China's interests, and hijacking online conversations that could portray the CCP negatively. Private researchers have followed it since its discovery more than four years ago, but only in recent months had federal prosecutors and Meta publicly concluded that the operation had ties to Chinese police. Meta said in August it had taken down a cluster of nearly 8,000 accounts attributed to the group in the second quarter of 2023 alone. Google, which owns YouTube, told CNN it had shut down more than 100,000 associated accounts in recent years. X has blocked hundreds of thousands of China "state-backed" or "state-linked" accounts, according to company blogs.

The scale is the point. Low operating costs mean the networks can absorb takedowns and rebuild. "We might think that this is confined to certain chatrooms, or this platform or that platform, but it's expanding across the board," Rep. Mike Gallagher, chairman of the House Select Committee on the CCP, told CNN. "And it's only a matter of time before it happens to that average American citizen who doesn't think it's their problem right now." The US State Department has described the tactics as part of a broader multi-billion-dollar effort to shape the world's information environment and silence critics of Beijing, an effort it says expanded under President Xi Jinping.

What audiences say they want

Public concern is not a niche position. A Unesco-commissioned Ipsos survey of 8,000 people in 16 countries due to hold national elections in 2024, with a total of 2.5 billion voters, found that 85% worried about the influence of online disinformation and 87% said it had had a major impact on national political life. Social media was the main source of news for 56% of internet users, ahead of television at 44% and media sites at 29%, even though trust in it was lower: 50% against 66% for television, 63% for radio and 57% for media websites and apps. Across all 16 countries, 68% said social media was where fake news was most widespread, ahead of messaging apps at 38%.

Audrey Azoulay, director general of Unesco, told reporters that false information and hate speech online, accelerated and amplified by platforms, posed "major risks to social cohesion, peace and stability." Regulation was urgently needed "to protect access to information ... while at the same time protecting freedom of expression and human rights," she said, presenting a governance blueprint. Unesco said more than 50 countries were already regulating social media, but often not in line with international free speech and human rights norms, and that at least one major platform had told the 194-member body it would prefer a consistent global framework over a patchwork of national systems. The organisation plans a World Conference of Regulators in 2024.

The policy fight is not settled, and some of it cuts against the grain of the platforms' own business models. Senator Sheldon Whitehouse has argued for repealing Section 230 of the Communications Decency Act and replacing it with a narrower version that would force "disclosure of disinformation funders," writing that the threat of legal liability "could make Facebook and other companies more likely to adopt measures that stop the spread of misinformation even if they also reduce user engagement, as failing to act would carry its own financial risks." Critics of that approach argue much disinformation would end up protected by the First Amendment. Both sides are arguing about the same thing: who bears the cost when a lie travels faster than the correction.

What the cases share is a division of labour. Someone produces the false claim, often by repurposing real material. Someone with reach posts it. Algorithms decide how far it goes. Regulators arrive after the fact, if at all. And the people most likely to be targeted, from Southport residents to Chinese dissidents in the US, are the ones with the least leverage over any of it.