Disinformation Campaigns: Actors, US Law, and Defenses

Disinformation campaigns are coordinated operations that create and spread knowingly false or misleading information to deceive the public, manipulate opinion, or cause political, economic, or military harm. The word that separates a campaign from ordinary rumor is intent. Someone who forwards a fake headline they believe is real is spreading misinformation. The operator who fabricated that headline, funded its distribution, and pushed it through bot accounts and cloned news sites is running disinformation. When that fabrication is organized, resourced, and sustained, it becomes a campaign.

The European Commission defines disinformation as “verifiably false or misleading information that is created, presented and disseminated for economic gain or to intentionally deceive the public, and may cause public harm,” with public harm understood to include threats to democratic processes, public health, the environment, or security. There is no equivalent internationally accepted legal definition, and among EU member states, only Lithuania has written a specific statutory definition of disinformation into its law on the provision of information to the public.¹

How a Campaign Actually Works

The European Parliament identifies six recurring tactics: emotional manipulation designed to provoke fear or anger and encourage impulsive sharing; polarization that amplifies extreme viewpoints while drowning out moderate voices; flooding the information space with conflicting narratives to induce confusion and apathy; exploiting confirmation bias by tailoring content to audiences’ pre-existing beliefs; manipulating context by presenting real images or quotes in misleading ways; and silencing critical voices through coordinated harassment.²

The infrastructure has grown more sophisticated. Bot networks operating thousands of automated accounts simultaneously create a false sense of consensus or outrage. Generative AI produces convincing deepfake video, audio, and imagery. Micro-targeting uses data analytics to deliver tailored messages to receptive audiences, while geofencing concentrates a campaign’s impact within a specific community or electoral district.³ Cloned websites mimicking legitimate news outlets or government agencies lend fabricated stories false credibility, a technique used extensively by the Russian DoppelGänger operation.⁴

Who Runs Them

The most consequential campaigns are state-sponsored. U.S. intelligence and law enforcement have publicly identified Russia, Iran, and China as active operators, each with different signature methods.

Russia

The DoppelGänger campaign, run by Russia’s Social Design Agency and Structura National Technologies, has been active since at least May 2022. It clones the websites of outlets like Bild, The Guardian, and NATO and publishes fabricated articles pushing pro-Kremlin narratives, including portraying Ukraine as a failed state and warning of consequences from Western sanctions.⁴ In September 2024, the U.S. Treasury sanctioned entities tied to the operation, including ANO Dialog and its director general Vladimir Tabak, and the FBI seized associated internet domains.⁵

That same month, the Justice Department indicted two RT employees, Kostiantyn Kalashnikov and Elena Afanasyeva, for allegedly funneling nearly $10 million to an American media company to produce content favorable to Russia without disclosing the foreign involvement.⁶ In July 2024, the DOJ had already disrupted a separate Russian AI-enhanced bot farm, seizing two domains and identifying 968 bot accounts allegedly organized by a private intelligence organization with ties to the FSB.⁷

Iran

Iran’s Islamic Revolutionary Guard Corps has been linked to hack-and-leak operations. In September 2024, the DOJ indicted three IRGC cyber actors, Masoud Jalili, Seyyed Ali Aghamiri, and Yaser Balaghi, for gaining access to personal accounts of individuals associated with a U.S. presidential campaign and leaking stolen materials to media organizations and to people connected to the opposing campaign. The Treasury sanctioned Jalili, and the State Department offered a reward of up to $10 million for information regarding IRGC interference in U.S. elections.⁸

China

Chinese state-linked activity is primarily associated with “Spamouflage,” a network identified since 2019 and linked to an arm of China’s Ministry of Public Security. It uses hijacked accounts and AI-generated profile pictures to attack U.S. foreign and domestic policy on Facebook, YouTube, and X. Researchers have described the network as “prolific, but ultimately low-engagement.”⁹ Meta removed thousands of inauthentic accounts tied to Spamouflage, calling one cluster “the largest known cross-platform influence operation to date.”¹⁰ No U.S. indictments or sanctions have been publicly announced against individuals running the network.

What US Law Actually Prohibits

There is no general federal law criminalizing the spread of false information. American law addresses disinformation through narrow federal statutes, growing state legislation, and an unsettled debate over platform immunity.

Existing federal criminal provisions target specific categories of harmful false speech. Under 18 U.S.C. § 1038, knowingly conveying false information about events like bombings, biological attacks, or threats to infrastructure carries penalties from five years in prison to life if someone dies as a result.¹¹ Federal voter intimidation statutes, including 18 U.S.C. § 594, prohibit threats or false information designed to deter voting. Social media influencer Douglass Mackey was convicted for conspiring to deprive voters of their rights after posting fabricated advertisements during the 2016 election telling people they could vote by text message.¹²

Congress has considered but not enacted legislation directly targeting disinformation campaigns. In the 119th Congress, H.R. 1233 would prohibit federal funding for disinformation research grants,¹³ and H.R. 1734, the Preventing Deep Fake Scams Act, targets AI-generated content.¹⁴ Prior proposals like the REAL Political Advertisements Act and the Protect Elections from Deceptive AI Act did not pass.

State legislatures have moved faster. As of mid-2026, 29 states have enacted laws regulating deepfakes in political messaging, typically through disclosure requirements or prohibitions within a set window before an election. Texas made it a misdemeanor in 2019 to publish deepfake videos intended to harm a candidate within 30 days of an election. Minnesota bans political deepfakes once absentee voting begins. Maine’s law allows the attorney general to seek penalties up to 500% of the amount spent producing the deceptive media.¹⁵

Not all of these have survived. In August 2025, a federal court struck down California’s deepfake law in Kohls v. Bonta, finding it overbroad in who could sue, vague in defining electoral harm, and unduly burdensome in its labeling requirements for satire and parody. Hawaii’s law was struck down for similar reasons in The Babylon Bee v. Lopez.¹⁵

Section 230 of the Communications Decency Act sits underneath all of this. Its two key provisions shield internet platforms from liability for user-posted content and protect them when they choose in good faith to moderate objectionable material. Critics on the left argue it lets platforms profit from disinformation without accountability; critics on the right argue it lets them suppress conservative viewpoints without consequence. Reform proposals include carving specific categories of harmful content out of immunity (as FOSTA did for sex trafficking in 2018), requiring algorithmic transparency, or removing immunity for paid content. Despite years of bipartisan rhetoric, no reform has passed, largely because the two sides want opposite things from any amendment.¹⁶

Where Courts Have Drawn the Lines

Three 2024 Supreme Court rulings frame how governments can and cannot interact with platforms over content.

In Murthy v. Missouri, decided June 26, 2024, the Court addressed whether federal officials violated the First Amendment by communicating with social media companies about content moderation during the COVID-19 pandemic and the 2020 election. In a 6-3 opinion written by Justice Barrett, the Court held that the plaintiffs, two states and five individual users, lacked standing. They could not show that their content was suppressed because of government coercion rather than the platforms’ independent moderation. The Court noted that intense government-platform communications from 2021 had “considerably subsided by 2022,” making claims of future injury too speculative to support an injunction.¹⁷ The Court never reached the underlying question of whether the government’s communications actually crossed a constitutional line.¹⁸

In National Rifle Association v. Vullo, decided unanimously on May 30, 2024, the Court drew a clearer line. The NRA alleged that a New York financial regulator used her office to pressure insurance companies into severing ties with the organization as punishment for its advocacy. Justice Sotomayor, writing for all nine justices, held that the First Amendment prohibits government officials from using the power of their office to coerce private parties into suppressing disfavored speech, whether directly or through intermediaries. The ruling set out a multifactor test for distinguishing permissible persuasion from impermissible coercion, weighing the official’s regulatory authority, the content of the communications, and how the target reasonably perceived them.¹⁹²⁰

In Moody v. NetChoice, decided July 1, 2024, the Court unanimously vacated lower court rulings on Florida and Texas laws that sought to prevent large social media platforms from removing content based on viewpoint. Justice Kagan’s majority opinion affirmed that content moderation is an exercise of editorial discretion protected by the First Amendment, and that the government cannot justify regulating platforms by asserting an interest in “correcting the mix of viewpoints” or “balancing the marketplace of ideas.”21 The case was remanded for a proper facial analysis, but the opinion signaled that state laws forcing platforms to host disinformation face significant First Amendment obstacles.

What the US Government Is (and Isn’t) Doing

Federal institutional capacity to counter disinformation has contracted sharply. The State Department’s Global Engagement Center, which coordinated federal efforts to expose and counter foreign propaganda, closed on December 23, 2024, after Congress did not reauthorize its funding.²²

The Cybersecurity and Infrastructure Security Agency has changed even more dramatically. CISA stopped communicating directly with social media companies about disinformation after the November 2022 election, partly in response to the litigation that became Murthy v. Missouri.²³ In early 2025, the agency’s election security programs were placed on hold pending a DHS review. CISA cut $10 million in annual funding to the Center for Internet Security, which in turn shut down the Election Infrastructure Information Sharing and Analysis Center, and mass layoffs of CISA employees followed.²⁴ Much of CISA’s election disinformation staff had been placed on leave by 2025. The White House’s fiscal year 2027 budget proposal seeks to eliminate CISA’s election security program entirely. In an April 2026 congressional hearing, state officials reported that 75% of surveyed local election administrators said their governments lacked the resources to fill the gap.²⁵

How Europe Is Regulating

The European Union has moved in the opposite direction, building a layered framework of legislation, platform enforcement, and institutional coordination.

The Digital Services Act, which began applying to very large online platforms in 2024, requires platforms with more than 45 million monthly EU users to identify and mitigate systemic risks, including threats to electoral processes and media pluralism.²⁶ The European Board for Digital Services identified disinformation, foreign information manipulation, and algorithmic amplification as recurring systemic risks in its first annual report in November 2025.²⁷

Enforcement has followed. In December 2025, the Commission fined X €120 million for misleading blue checkmark designs, deficiencies in its advertising repository, and failing to provide researcher data access. In January 2026, the Commission opened a new investigation into X concerning systemic risks linked to its AI tool Grok, including manipulated content and potential generation of nonconsensual deepfakes.²⁷²⁸ The originally voluntary Code of Conduct on Disinformation has been formally recognized as a DSA Code of Conduct, with signatories publishing transparency reports through its Transparency Centre as of March 2026.²⁶

In November 2025, the Commission introduced the European Democracy Shield, a package of roughly 50 action points to protect democratic processes from foreign information manipulation. Its centerpiece is the European Centre for Democratic Resilience, coordinating expertise across member states and EU institutions, with a stakeholder platform for civil society, researchers, and fact-checkers.²⁹ The initiative includes a DSA crisis protocol for large-scale manipulation events, an independent European Network of Fact-Checkers, guidance on AI use in elections, and a Media Resilience Programme funding independent journalism.³⁰ The Commission has proposed €8.6 billion for the AgoraEU programme supporting democracy and civic participation in its next budget cycle.³¹

The Free-Expression Boundary

Every legal framework in this space runs into the same tension with freedom of expression. The United Nations emphasizes that restrictions on speech to counter disinformation must be provided by law, necessary for a recognized purpose like protecting individual rights or national security, and proportionate. The UN warns that approaches relying on “vague definitions, disproportionate sanctions, or criminalizing legitimate content” risk censoring protected speech.³²

A 2017 joint declaration by the UN Special Rapporteur on Freedom of Expression and counterparts from the OSCE, OAS, and African Commission on Human and Peoples’ Rights stated that general prohibitions on “false news” based on vague concepts are “incompatible with international standards” and should be abolished.³³ The European Court of Human Rights has consistently found that criminalizing the dissemination of false information violates Article 10 of the European Convention on Human Rights.¹

Some EU member states have moved in the other direction. Hungary amended its Criminal Code during the COVID-19 pandemic to create a felony offense for spreading disinformation during a state of emergency, and Malta, Slovakia, Cyprus, and Croatia maintain similar criminal provisions.¹

Defenses Beyond Regulation

One of the more promising defensive strategies focuses on proving what content is authentic rather than labeling everything false. The Coalition for Content Provenance and Authenticity, known as C2PA, is developing an open technical standard called Content Credentials that functions as a kind of nutrition label for digital content, cryptographically recording a file’s origin, creation method, and editing history. The coalition’s steering committee includes Adobe, Amazon, BBC, Google, Meta, Microsoft, OpenAI, and Sony.³⁴ The specification is being fast-tracked to become ISO standard 22144.³⁵

Regulatory drivers are pushing adoption. The EU’s AI Act requires AI-generated content to be labeled by August 2026.³⁵ Colorado and Utah already require metadata disclosures on political deepfakes, including information about the creator and editing tools used.¹⁵

The approach has limits. Content Credentials are currently opt-in, and metadata can be stripped when files move across platforms or messaging apps. The C2PA specification addresses this through “durable” credentials that combine digital watermarking with media fingerprinting, allowing provenance to be retrieved from a database even if the original metadata is lost.³⁵ Researchers and policymakers have also advocated for “inoculation” or “prebunking” strategies that expose people to weakened doses of disinformation tactics to help them recognize the same techniques in the wild.³³

1
Internet Policy Review. The Perils of Legally Defining Disinformation
2
European Parliament. Spotting Disinformation: Six Tactics Used to Fool Us
3
CrowdStrike. Disinformation Campaign
4
U.S. Cyber Command. Russian Disinformation Campaign DoppelGänger Unmasked
5
U.S. Department of the Treasury. Treasury Targets Russian Government Actors Involved in Covert Influence Operations
6
ABC News. Biden Admin Targets Russia 2024 Election Disinformation Efforts
7
U.S. Department of Justice. Justice Department Leads Efforts Among Federal, International, and Private Sector Partners
8
U.S. Department of Justice. Three IRGC Cyber Actors Indicted for Hack-and-Leak Operation
9
Graphika. Spamouflage Goes to America
10
U.S. House of Representatives. Hearing on Information Operations
11
Cornell Law Institute. 18 U.S. Code § 35
12
Georgetown Law ICAP. False, Misleading, and Intimidating Election Information
13
U.S. Congress. H.R.1233
14
U.S. Congress. H.R.1734 – Preventing Deep Fake Scams Act
15
National Conference of State Legislatures. Artificial Intelligence in Elections and Campaigns
16
Bipartisan Policy Center. Summarizing the Section 230 Debate
17
Supreme Court of the United States. Murthy v. Missouri
18
SCOTUSblog. Murthy v. Missouri
19
Supreme Court of the United States. National Rifle Association of America v. Vullo
20
Knight First Amendment Institute. Knight Institute Welcomes Supreme Court Decision in NRA v. Vullo>
21
Supreme Court of the United States. Moody v. NetChoice, LLC
22
U.S. Department of State. About the Global Engagement Center
23
DHS Office of Inspector General. OIG-24-52
24
Politico. Trump Admin Cuts Election Security Funds
25
Nextgov. Federal Drawdown in Election Support Destroyed Ongoing Relationships, Experts Say
26
European Commission. Digital Services Act
27
EU Crime. Overview of the Latest Developments Under the Digital Services Act
28
LexisNexis. Commission Opens EU DSA Investigation Into X Over Grok AI Content Risks
29
European Commission. European Democracy Shield and EU Strategy for Civil Society
30
European Parliament. European Democracy Shield At a Glance
31
Delors Centre. The European Democracy Shield: Papering Over the Cracks
32
United Nations. Countering Disinformation
33
UN Office on Drugs and Crime. Information Warfare, Disinformation and Electoral Fraud
34
C2PA. Coalition for Content Provenance and Authenticity
35
National Security Agency. Content Credentials