A false flag operation is a covert act carried out by one party but staged to look as though a different party is responsible. The perpetrator plants evidence, uses another group’s identifiers, or fabricates an incident so that blame falls on a chosen scapegoat, usually to justify a war, a crackdown, or a diplomatic reprisal. Some battlefield deceptions are legal under the laws of war; a staged attack that kills or injures people, or one that misuses protected humanitarian symbols, is a war crime.
What Makes an Operation a False Flag
Three parties are always involved: the actual perpetrator, the party being framed, and the audience whose reaction the perpetrator is trying to shape. That audience might be a domestic public, a foreign government, an international body, or a military command. The operation is designed so the audience blames the framed party and responds accordingly.
The defining feature is deliberate misattribution. A covert operation only needs the perpetrator to stay hidden. A false flag needs a specific someone else to look guilty. Strip the planted blame and you have an ordinary clandestine act; add it, and you have a false flag. The goal is almost always to provoke a particular response the perpetrator could not obtain openly: public support for an invasion, sanctions against a rival, or political upheaval that serves the orchestrator’s interests.
Where the Term Comes From
The phrase comes from naval warfare. Warships and privateers would hoist another nation’s ensign to approach a target without alarming it. Maritime custom treated this as acceptable for maneuvering, but attacking ships were expected to raise their true colors before opening fire. Firing under false colors was considered a betrayal of trust. That old line between permissible deception and prohibited betrayal still runs through the modern laws of armed conflict.
Confirmed Historical Examples
Real, documented false flag operations are less common than popular usage suggests. A few are well-established.
In September 1931, Japanese officers detonated a small explosive along a Japanese-owned railway near Shenyang and blamed Chinese dissidents. The damage was minor, but the Mukden Incident gave Japan its pretext to invade and occupy Manchuria.
On the night of August 31, 1939, Nazi operatives staged an attack on a German radio station at Gleiwitz near the Polish border. They dressed a murdered German civilian in a Polish uniform and left the body as staged proof of Polish aggression. German propaganda ran with the story overnight, and German forces crossed into Poland the next morning.
Not every plan is carried out. In 1962, the U.S. Joint Chiefs of Staff drafted proposals for staged attacks that could be blamed on Cuba to build public support for military intervention, including a scenario involving the sinking of a U.S. ship at Guantánamo Bay. President Kennedy rejected the plan. The document was declassified decades later.
Cyberattacks and Attribution
Computer networks make false flag deception easier than it has ever been. Attackers route traffic through servers in a chosen country, borrow code snippets and malware signatures associated with known state-sponsored groups, and manipulate metadata such as timestamps, keyboard layouts, and language settings so the trail points at a rival government.
Forensic analysts can eventually pick apart planted clues, but the work is slow. A false flag cyberattack only has to hold up long enough for the political consequences to land. The 2017 NotPetya attack looked at first like ransomware but was built to destroy data. It spread globally from an initial target in Ukraine and caused an estimated $10 billion in damage worldwide. Attribution to Russian military intelligence took months, during which the incident was widely misread.
What the Laws of War Permit and Prohibit
International humanitarian law splits wartime deception into two categories. One is legal. The other is a crime called perfidy.
Ruses of war are permitted. The Hague Regulations of 1907 allow them, and Additional Protocol I to the Geneva Conventions defines them as acts meant to mislead an adversary without abusing legal protections designed to limit suffering. Camouflage, decoy positions, mock troop movements, and disinformation all qualify.1ICRC. IHL Treaties – Regulations: Art. 24
Perfidy is prohibited. Under Article 37 of Additional Protocol I, it is unlawful to kill, injure, or capture an adversary by inviting their confidence that they are entitled to legal protection, with the intent to betray that confidence. Feigning surrender, pretending to be a civilian, and displaying the Red Cross or United Nations emblem to lure an enemy into lowering its guard are the classic examples.2Office of the United Nations High Commissioner for Human Rights. Protocol Additional to the Geneva Conventions of 12 August 1949
The distinction has a purpose. Perfidy exploits the very rules that protect wounded soldiers, medics, and civilians. If a white flag or a Red Cross vehicle cannot be trusted, the whole framework of wartime protection breaks down. Ruses only mislead an enemy; perfidy attacks the legal architecture itself.
Enemy Uniforms
Wearing an enemy’s uniform sits in a contested zone. Article 39 of Additional Protocol I prohibits using enemy uniforms “while engaging in attacks or in order to shield, favour, protect or impede military operations.”3ICRC. Improper Use of the Flags or Military Emblems, Insignia or Uniforms of the Adversary The Hague Regulations separately forbid the “improper use” of enemy uniforms and insignia without fully defining the term.4Yale Law School Avalon Project. Laws and Customs of War on Land (Hague IV) National military manuals differ. Some allow enemy uniforms for infiltration or intelligence gathering as long as soldiers change before combat; others prohibit them during any military operation. Opening fire while disguised as the enemy is universally treated as illegal. Non-combat use remains genuinely disputed.
Protected Emblems
Misusing the Red Cross, Red Crescent, or United Nations emblem to gain a military advantage is always prohibited and always a war crime. There is no gray area. These symbols exist to protect medical staff and humanitarian workers, and using them as cover for an attack endangers every legitimate aid worker in every future conflict.2Office of the United Nations High Commissioner for Human Rights. Protocol Additional to the Geneva Conventions of 12 August 1949
Criminal and State Consequences
The Rome Statute, which established the International Criminal Court, classifies the improper use of flags, military insignia, uniforms, or Geneva Convention emblems as a war crime when it results in death or serious personal injury.5International Criminal Court. Rome Statute of the International Criminal Court Individuals convicted of war crimes face up to 30 years in prison, or a life sentence when the gravity of the crime justifies it.6Office of the United Nations High Commissioner for Human Rights. Rome Statute of the International Criminal Court Trials take place at the ICC in The Hague, and sentences are served in states that have agreed to enforce ICC judgments.7International Criminal Court. How the Court Works
Liability reaches upward. Under Article 28 of the Rome Statute, military commanders are criminally responsible for crimes committed by forces under their effective control if they knew or should have known the crimes were occurring and failed to take reasonable measures to prevent them. For civilian superiors, the standard is that they knew or consciously disregarded information clearly indicating the crimes.5International Criminal Court. Rome Statute of the International Criminal Court A general who orders a false flag attack and the intelligence officer who plans it can both be prosecuted, even if neither planted a piece of evidence or fired a shot.
At the state level, Article 51 of the United Nations Charter preserves the right of self-defense only when “an armed attack occurs.”8United Nations. United Nations Charter (Full Text) A country that stages or fabricates an attack to justify retaliation has no genuine attack to defend against, so the self-defense premise falls away. The Security Council has broad authority to respond, including arms embargoes, travel bans, and financial restrictions.9United Nations. Security Council – Sanctions Whether it acts in any given case depends on the politics of the moment and on whether a permanent member uses its veto.
How the Term Is Used Today
The phrase has drifted far from its military and legal roots. Mass shootings, terrorist attacks, and political crises are labeled false flags within hours, often before any facts are available. Genuine confirmed false flag operations are rare compared with the volume of accusations. When every violent event is reflexively described this way, the term loses its analytical usefulness, and families of victims are frequently harassed by people convinced the incident was staged. A real false flag has a perpetrator with resources, planted evidence, and an identifiable beneficiary, and it leaves forensic traces that investigators can eventually surface.