# Foreign influence campaigns: historical evidence review for Getting It Right

Research conducted: 6–7 October 2026 UTC. Scope: selected documented operations and public US warnings, principally 2014–2025, within the requested approximately 2006–2026 window. This is a structured narrative evidence review, not an exhaustive census or systematic meta-analysis. Historical claims are dated to their sources; this review does not certify the current docket status of every defendant.

## Bottom line

US agencies have repeatedly warned about foreign efforts to exploit existing controversies over race, religion, immigration, public health, elections, and war. The best-supported public examples identify particular accounts, organizations, forged artifacts, covert funding arrangements, or observed behavior. They do **not** establish that a whole political viewpoint originated abroad, that ordinary people sharing it are foreign agents, or that observed posting changed votes.

The evidence supports a useful educational section about **how claims travel and who promoted them**, kept separate from the evidence deciding **whether the claim is true**. A true report, legitimate grievance, opinion, misleading framing, and fabricated document can all appear in the same influence operation. Foreign provenance is not a substitute for factual adjudication.

## Which US agencies warned?

The 6 January 2017 assessment was drafted and coordinated by CIA (Central Intelligence Agency), FBI (Federal Bureau of Investigation), and NSA (National Security Agency), published through ODNI (Office of the Director of National Intelligence). Its scope expressly excluded assessing election-outcome effects. [S26] FBI/CISA joint public warnings and DOJ prosecutions provide later concrete records below; CISA is the Cybersecurity and Infrastructure Security Agency and DOJ the Department of Justice. ODNI and CISA are included despite having four-letter acronyms.

## How evidence is classified

- **Intelligence assessment:** agency judgment, sometimes with stated confidence, often relying partly on classified evidence unavailable for replication.
- **Criminal allegation:** indictment, complaint, or seizure affidavit. Detailed allegations and exhibits can be probative, but are not convictions or adjudicated facts.
- **Legislative investigation:** committee findings integrating documents, testimony, intelligence, and platform submissions. Bipartisan agreement is relevant provenance, not independent proof of every underlying datum.
- **Platform attribution:** a company's determination from its own telemetry and investigation. Valuable privileged access; attribution may not be reproducible publicly.
- **Independent analysis:** academic or investigative analysis. Independence of authors is distinct from independence of the dataset or initial attribution.
- **Threat warning:** prospective risk statement; not proof that the predicted event happened.

Confidence must attach separately to account linkage, government sponsorship, intent, message falsity, audience exposure, and effects. Labels such as “Russia-linked,” “Russian-origin,” and “Russian-government-directed” are not interchangeable.

## Evidence matrix

### 1. IRA: race, immigration, religion, political identity; US, especially 2015–2017

**Evidence:** Senate Intelligence Committee Volume 2 (8 October 2019), especially printed pp. 45–47 and appendix p. 77. It catalogs IRA-controlled pages presenting anti-immigration, Black activism, Muslim rights, Latino heritage, Christian, gun-rights, and LGBT themes. It describes opposing anti-Islam and Muslim-support rallies promoted for Houston on 21 May 2016. The report's underlying account designations came from platforms' internal investigations. Facebook's estimated 126 million possible contacts with IRA content during 2015–2017 is a reach estimate, not 126 million persuaded voters. “Stop A.I.” and “Blacktivist” engagement counts show activity, not endorsement or changed beliefs.

**Interpretation:** ideological flexibility and exploitation of pre-existing tensions; neither race injustice nor religious liberty advocacy is thereby discredited. This is stronger evidence for impersonated community voices than for foreign origination of those controversies. **Status:** legislative finding drawing on platform data and other investigations. [S1]

### 2. IRA criminal case; US, 2014–2016

The February 2018 indictment describes fabricated American identities and groups, political advertising and rallies, and alleged efforts favoring some candidates and opposing others. Its issue-specific allegations include immigration, Black Lives Matter, religion, and regional identity (pp. 14 onward). **Status:** indictment allegations, not a trial verdict. [S2]

A necessary legal caveat: prosecutors moved in March 2020 to dismiss the Concord corporate defendants' charge with prejudice, citing changed available proof, classified-information concerns, and limited practical punishment. The primary motion is accessible; the final dismissal order was not retrieved in this review, so a published account of final disposition should separately verify it. The motion itself expressly distinguished remaining individual defendants. It does not constitute an acquittal of the entire historical account, and an indictment should not be called a conviction. [S3]

### 3. Project Lakhta; US and other audiences, 2016–2018

DOJ's 19 October 2018 Khusyaynova announcement alleges amplification of immigration, guns, Confederate-symbol disputes, race, LGBT issues, the Women's March, and NFL anthem controversies. It identifies opportunistic use of Charleston, Las Vegas, Charlottesville, and police shootings. This is particularly clear evidence of exploiting events already occurring in domestic society. **Status:** criminal complaint allegations; the source is an official announcement, with the linked complaint available as a separate research lead. The announcement was accessible in search extraction but direct opening failed. [S4]

### 4. GRU hack-and-release; US election, 2016

DOJ's 13 July 2018 announcement charges twelve GRU officers with hacking Democratic organizations and the Clinton campaign and staged publication through DCLeaks, Guccifer 2.0, and another entity. It alleges that Guccifer 2.0's purported Romanian-hacker identity concealed Russian involvement. Importantly, stolen authentic material is not equivalent to fabricated content. The false identity and selective release are distinct analytical issues from the truth of individual emails. DOJ explicitly said the indictment did not allege changed vote counts or an altered election outcome. **Status:** charges, not adjudication; not evidence that every American contacting the personas knowingly assisted Russia. [S5]

### 5. GRU sports/chemical-weapons-related operations; international, 2014–2018

DOJ's 4 October 2018 case alleges efforts to delegitimize anti-doping bodies and damage athletes' reputations by presenting them as using prohibited performance-enhancing drugs. It also describes targeting chemical-weapons investigative organizations. **Status:** indictment allegations. This broadens the record beyond electoral politics: stolen information can be framed misleadingly to discredit institutions that investigate state misconduct. Do not infer that a particular sports or chemical-weapons claim was fabricated without its own evidence. [S6]

### 6. Vaccines; English-language Twitter, July 2014–September 2017

Broniatowski et al., AJPH (2018), analyzed approximately 1.79 million tweets and 253 #VaccinateUS messages. Known Russian-troll accounts amplified both pro- and antivaccine material; the hashtag sample was 43% pro, 38% anti, 19% neutral. Themes included government distrust, class privilege, freedom, religion, autism, and hostility toward nonvaccinating parents (printed pp. 1381–1383). One example was “Did you know #vaccines caused autism? #VaccinateUS”.

**Limits:** observational content research, not an experiment measuring uptake; attribution relies on account lists and classifications. Unknown provenance cannot be assigned to Russia. This pre-COVID sample does not establish COVID narrative origins. **Status:** peer-reviewed research, not an FBI or CDC finding. [S7]

### 7. Russia and Iran; US election, 2020

ODNI's assessment dated 10 March 2021 gives high confidence that Russia sought to harm Biden, support Trump, undermine electoral confidence, and aggravate divisions; it describes laundering misleading or unsupported Biden/Ukraine allegations through intermediaries. It separately assesses an Iranian campaign to hurt Trump's reelection prospects without directly promoting rivals. It reports no indications of foreign attempts to alter the technical voting process. The majority judgment says China did not undertake efforts intended to change the presidential outcome; a named analytic dissent judged China took some steps against Trump's reelection. **Status:** intelligence judgments with public redactions, not independently reproducible attribution. A claim about a particular Biden-related document still requires artifact-level verification rather than rejection by thematic association. [S8]

### 8. Iran's Proud Boys impersonation; US, August–November 2020

DOJ's November 2021 charges allege threatening emails to registered Democrats purporting to require Trump votes, plus a fabricated video purporting to show creation of fraudulent overseas ballots using stolen voter data. Another message falsely claimed Democrats planned to exploit registration vulnerabilities. **Status:** charges against Kazemi and Kashian, not a conviction established here. **Interpretation:** apparent pro-Trump surface messaging does not necessarily disclose the sponsor's strategic preference; intimidation and discrediting institutions can coexist. A compromise of voter information does not itself demonstrate manipulation of counted ballots. [S9]

### 9. FBI/CISA prospective warning; US, September 2020

The 22 September 2020 PSA warned that foreign actors and criminals could exploit ordinary counting/certification delays with false fraud, suppression, and hacking claims. It distinguished changes to a public-facing website from changes to underlying election data. **Status:** warning, not attribution of every later election-fraud statement. Cite it as evidence of what agencies warned about, not retrospective proof of a specific speaker's foreign connection. [S10]

### 10. Doppelganger; Europe from May 2022, expanded US/other audiences by 2023–2024

Meta's September 2022 report describes over 60 imitation news websites publishing anti-Ukraine/refugee messages and arguments that sanctions would harm Western countries. Initial geography centered on Germany, also France, Italy, Ukraine, and the UK; its December update named Structura and Social Design Agency. Much social-platform activity was removed automatically and the network mixed sophisticated website imitation with crude amplification. **Status:** platform attribution, not judicial determination. Meta reports collaboration with journalists, researchers, and authorities, so these sources are not wholly independent. [S11]

DOJ's 4 September 2024 seizure announcement alleges Russian Presidential Administration direction of SDA, Structura, and ANO Dialog, using deceptive domains and concealed sponsorship to weaken Ukraine support and influence elections. It identifies a 32-domain seizure and links internal project-document exhibits. **Status:** affidavit-supported seizure allegations, not a merits conviction. The full 277-page affidavit repeatedly failed to open in this review; do not quote uninspected project passages or treat proposed plans as executed outcomes. [S12]

### 11. Fabricated voter-fraud video; Georgia/US, November 2024

On 1 November, ODNI, FBI, and CISA attributed a fabricated video depicting purported Haitians voting illegally in multiple Georgia counties to Russian influence actors. The agencies also identified a manufactured bribery accusation video. Their statement references Georgia officials' separate refutation of the voting claim. **Status:** intelligence attribution, without public underlying forensic evidence. This is a narrow, concrete instance linking an immigration narrative to election distrust; it is not evidence that every concern about voter eligibility is foreign-directed. No persuasion estimate accompanies the attribution. [S13]

### 12. Covert RT financing of US content; 2023–2024

DOJ's September 2024 indictment announcement alleges nearly $10 million covertly financed a Tennessee content company distributing videos to US audiences. **Status:** charges against two RT employees, at large when announced; current docket status not certified here. Funding, content direction, knowledge by intermediaries, audience reach, and effects are separate questions. Do not label unnamed commentators knowing agents merely because their work was distributed through an allegedly covertly funded company. [S14]

### 13. Spamouflage; Chinese/English audiences, 2019–2020

Graphika's August 2020 report documents attacks on Hong Kong protesters and Guo Wengui, praise of China's pandemic response, and English-language attacks on US pandemic handling, racial inequality, TikTok restrictions, and the Houston consulate closure. A June 13 video combined COVID and George Floyd protest narratives. Some material reused genuine news clips. Graphika then explicitly said it could not establish a government connection itself, although Twitter had attributed relevant antecedent accounts to state-linked actors. Most observed videos had low engagement. **Status:** network analysis with qualified contemporary attribution. Distinguish original video production from invention of the underlying real events. [S15]

### 14. Spamouflage attribution development; global, 2023

Meta's 29 August 2023 disclosure linked the previously fragmented Spamouflage activity to individuals associated with Chinese law enforcement and described activity across more than 50 platforms. This is materially stronger attribution language than Graphika's 2020 report. It should be dated, not retroactively represented as knowledge all researchers already possessed in 2019. **Status:** platform finding from internal investigation, with limited public reproducibility. [S16]

Separately, DOJ's April 2023 complaint announcement alleges that the MPS's 912 Special Project Working Group used fabricated personas to harass dissidents and promote favorable CCP narratives about democracy, Hong Kong/Xinjiang, Ukraine, George Floyd unrest, and COVID. **Status:** criminal allegations. The complaint and Meta report offer related but not entirely independently sourced lines; do not automatically identify every account in both descriptions as the same operational unit. [S17]

### 15. Spamouflage US-voter personas; US, 2023–2024

Graphika's September 2024 report identified 15 X accounts, one TikTok account, and a separate media persona. Themes included political-system failure, guns, homelessness, drugs, race, and Israel-Hamas; content attacked candidates of both major parties. Its high-confidence state-linked attribution combined open indicators and industry-partner assessments. Typical traction remained low, with an important exception: a July TikTok video recorded 1.5 million views. Neither low average reach nor one viral item measures belief change. **Status:** commercial investigative research; report explicitly builds on ISD and industry findings, so avoid counting each citation as independent replication. [S18]

### 16. Iran, fake news brands and Gaza-related activism; US, 2024

Microsoft's August report describes Iranian sites serving different ideological audiences: Nio Thinker attacked Trump, while Savannah Time presented as conservative local news and covered gender/LGBTQ issues. **Status:** private threat-intelligence attribution; site existence and topic selection do not validate every claim about government control or effects. [S19]

DNI Avril Haines's 9 July statement says Iranian actors impersonated activists and opportunistically encouraged or financially supported some Gaza protests. Crucially, she explicitly preserved the legitimacy of Americans expressing views in good faith and warned that targeted Americans might not know the foreign connection. **Status:** official intelligence statement, not a claim that the protest movement was manufactured or that all participants received funds. This is a particularly useful anti-guilt-by-association citation. [S20]

### 17. Earlier overt state-media messaging; US, 2012

The 2017 assessment reproduces an Open Source Center analysis originally published 11 December 2012. Its annex (printed pp. 6–8) describes RT election-fraud/voting-machine narratives, Occupy and corporate-corruption coverage, anti-fracking programming, and opposition to intervention in Syria. This is overt state-media analysis, not evidence that domestic environmental or Occupy movements were foreign-created. Scientific claims about fracking need their own evidence; an analyst’s inference about Gazprom-related motivation cannot determine their truth. [S26]

## Effects: what can and cannot be claimed

Eady et al. (2023) linked a three-wave survey to respondents' Twitter timelines during the eight months before the 2016 election. Exposure to IRA content was highly concentrated: 1% of sampled users accounted for 70% of exposures; domestic political/news content dwarfed it. The study detected no meaningful relationship with measured attitude, polarization, or vote-choice changes. This is a significant corrective to treating content counts as electoral effects, but it does not establish zero effects across all platforms, indirect media pathways, or trust in elections. The publisher full text failed to load; the authors' NYU research summary, abstract, methods overview, and results were accessible. [S21]

General editorial rule: report the actual metric. Posts ≠ impressions; impressions ≠ unique humans; potential reach ≠ verified attention; engagement may be fake, hostile, or curiosity-driven; belief ≠ behavior; behavior ≠ a changed election winner. Do not turn absence of measured effects into proof of no risk, or intended effects into achieved effects.

## Conflicting official assessments and later revisions

The 2017 assessment should not be presented as an uncontested timeless institutional statement. The Senate's April 2020 Volume 4 summary affirmed the assessment's evidentiary basis and analytic process, including the treatment of the Steele material. It acknowledged extensive redaction and a compressed timeline. [S22]

CIA's 26 June 2025 tradecraft review, released 2 July, criticized process, confidence calibration, alternative analysis, and Steele-related treatment, especially the specific judgment that Putin aspired to help Trump win. It called NSA's moderate confidence more consistent with standards, while not disputing the credibility of a key CIA report; it also said the original interpretation was most consistent with the raw intelligence. Its cover says this is a CIA perspective, not an IC-coordinated product. This nuanced primary text matters more than sweeping summaries that claim it erased all documented Russian activity. [S23]

ODNI's July 2025 release advanced considerably broader allegations of deliberate intelligence manipulation and conspiracy by former officials. Those are the issuing leadership's allegations, not convictions or an independent adjudication supplied by the press release. The release emphasizes a lack of changed vote counts alongside disputes over intentions; these are analytically different questions. Include the institutional disagreement when discussing the assessment's history, without using it to silently discard separately evidenced accounts, documents, or financing. [S24]

The 2025 Annual Threat Assessment still describes PRC covert influence capabilities and 2024 AI-assisted content around drugs, immigration, and abortion (printed p. 16). This supplies a later official warning, not an evaluation of campaign success. [S25]

## Responsible use on existing topic pages

1. Lead with the substantive factual question and its relevant scientific, historical, or administrative evidence.
2. Add a bounded “Documented amplification” note only when the source identifies the exact claim or a sufficiently narrow narrative. State actor, date, geography, source type, and confidence.
3. Separate fabricated artifacts from distorted context, truthful criticism, opinion, and undisclosed sponsorship.
4. Never imply that all adherents of a position are bots, dupes, paid agents, or knowingly aligned with a foreign government.
5. Do not infer provenance from ideological similarity, repeated wording alone, nationality, ethnicity, or religion.
6. Use named operations, not sweeping categories such as “the Russians control this debate.”
7. Record publication/update dates and a correction path. Political attribution needs periodic review, especially after new court records or institutional assessments.

Suggested neutral wording: “A 2018 study documented Russian-troll accounts posting both pro- and antivaccine messages in a 2014–2017 Twitter sample. That finding concerns the communication campaign; vaccine safety questions must be evaluated using medical evidence.”

Suggested election wording: “On 1 November 2024, ODNI, FBI, and CISA attributed this particular fabricated Georgia voting video to Russian influence actors. Their public statement did not estimate its effect on voting.”

These are editorial models, not findings that any uninspected existing topic page already warrants the addition. No existing page was supplied or inspected by this reviewer.

## Provenance, independence, and access register

All links below were discovered or checked in this review. “Full text” means text accessible to the research tool, not manual inspection of every appendix or forensic replication.

- **S1:** [Senate Volume 2 PDF](https://www.intelligence.senate.gov/sites/default/files/documents/Report_Volume2.pdf). Full PDF text accessible; selected relevant pages inspected. Platform datasets underpin much content attribution; Senate and commissioned studies are not independent datasets.
- **S2:** [IRA indictment, 16 February 2018](https://www.justice.gov/archives/sco/file/1035477/dl). Search-extracted relevant passage; complete indictment not fully inspected in this pass. Primary legal pleading.
- **S3:** [DOJ Concord dismissal motion, 16 March 2020, ECF 381](https://www.courthousenews.com/wp-content/uploads/2020/03/ConcordMgmt-USDismissal.pdf). Full nine-page text accessible. Primary pleading hosted by news organization; not the signed disposition order.
- **S4:** [DOJ Khusyaynova announcement](https://www.justice.gov/archives/opa/pr/russian-national-charged-interfering-us-political-system). Substantive search extraction accessible; direct opening failed. [Complaint lead](https://www.justice.gov/d9/press-releases/attachments/2018/10/19/khusyaynova_complaint_003_0.pdf), not full-read.
- **S5:** [DOJ GRU election case](https://www.justice.gov/archives/opa/pr/grand-jury-indicts-12-russian-intelligence-officers-hacking-offenses-related-2016-election). Full announcement accessible; prosecution's summary of allegations.
- **S6:** [DOJ international GRU case](https://www.justice.gov/archives/opa/pr/us-charges-russian-gru-officers-international-hacking-and-related-influence-and). Full announcement accessible; describes allied investigative assistance, so cross-government statements may share evidence.
- **S7:** [Broniatowski et al. primary paper, government-hosted PDF](https://portal.ct.gov/-/media/dcf/agency/jic-resources/ajph2018304567.pdf). Seven-page paper text accessible, selected results/methods inspected; [PMC bibliographic record](https://pmc.ncbi.nlm.nih.gov/articles/PMC6137759/) hit a browser check. NIH funding does not make its findings official NIH policy.
- **S8:** [ODNI 2020-election assessment](https://www.dni.gov/files/ODNI/documents/assessments/ICA-declass-16MAR21.pdf). Full 15-page text accessible; classified source base unavailable.
- **S9:** [DOJ Iranian intimidation indictment announcement](https://www.justice.gov/archives/opa/pr/two-iranian-nationals-charged-cyber-enabled-disinformation-and-threat-campaign-designed). Full announcement accessible; not a separate independent verification of the FBI investigation.
- **S10:** [FBI/CISA September 2020 PSA](https://www.ic3.gov/PSA/2020/PSA200922). Full text accessible.
- **S11:** [Meta September/December 2022 CIB report announcement](https://about.fb.com/news/2022/09/removing-coordinated-inauthentic-behavior-from-china-and-russia/). Full announcement accessible; linked technical report not fully inspected.
- **S12:** [DOJ Doppelganger announcement](https://www.justice.gov/archives/opa/pr/justice-department-disrupts-covert-russian-government-sponsored-foreign-malign-influence). Full announcement accessible. [277-page affidavit](https://www.justice.gov/d9/2024-09/doppelganger_affidavit_9.4.24.pdf) failed on repeated opens; search excerpts only.
- **S13:** [FBI-hosted joint statement, 1 November 2024](https://www.fbi.gov/news/press-releases/joint-odni-fbi-and-cisa-statement-on-russian-election-influence-efforts). Full text accessible. Three agency signatures constitute one joint statement, not three independent findings.
- **S14:** [DOJ RT financing case](https://www.justice.gov/archives/opa/pr/two-rt-employees-indicted-covertly-funding-and-directing-us-company-published-thousands). Announcement accessible; underlying indictment not fully reviewed.
- **S15:** [Graphika, Spamouflage Goes to America](https://public-assets.graphika.com/reports/graphika_report_spamouflage_goes_to_america.pdf). Full 34-page PDF text accessible; pp. 1–15 and engagement examples inspected. Primary network research; attribution partly platform-derived.
- **S16:** [Meta August 2023 disclosure](https://about.fb.com/news/2023/08/raising-online-defenses/). Full text accessible; linked quarterly report not fully inspected. Not independent of shared threat-research ecosystem.
- **S17:** [DOJ MPS 912 complaint announcement](https://www.justice.gov/usao-edny/pr/34-officers-peoples-republic-china-national-police-charged-perpetrating-transnational). Full text accessible; primary allegation summary.
- **S18:** [Graphika, The #Americans, September 2024](https://public-assets.graphika.com/reports/graphika-report-the-americans.pdf). Full 17-page text accessible; selected pp. 1–9 inspected. Explicit dependencies on ISD and industry partners.
- **S19:** [Microsoft Iran report announcement](https://blogs.microsoft.com/on-the-issues/2024/08/08/iran-targeting-2024-us-election/). Article accessible; primary private-sector attribution, underlying telemetry not public here.
- **S20:** [DNI Haines statement, 9 July 2024](https://archive.dni.gov/index.php/newsroom/press-releases/press-releases-2024/3842-statement-from-director-of-national-intelligence-avril-haines-on-recent-iranian-influence-efforts). Full text accessible.
- **S21:** [Eady et al. author institution summary](https://csmapnyu.org/research/academic-research/exposure-to-the-russian-internet-research-agency-foreign-influence-campaign-on-twitter-in-the-2016-us-election-and-its-relationship-to-attitudes-and-voting-behavior). Full summary accessible; [publisher paper](https://www.nature.com/articles/s41467-022-35576-9) repeatedly failed, indexed abstract accessible. Academic authors analyze platform-attributed accounts; independent analysis does not independently establish initial attribution.
- **S22:** [Senate Volume 4 release and findings](https://www.intelligence.senate.gov/2020/04/21/press-senate-intel-releases-new-report-intel-community-assessment-russian-interference/). Full text accessible; heavily redacted underlying report linked.
- **S23:** [CIA tradecraft review, 26 June 2025](https://www.cia.gov/static/Tradecraft-Review-2016-ICA-on-Election-Interference-062625.pdf). Full eight-page PDF text accessible; relevant pp. 1, 6–8 inspected.
- **S24:** [ODNI July 2025 allegations and declassification announcement](https://archive.dni.gov/index.php/newsroom/press-releases/press-releases-2025/4090-pr-18-25). Full text accessible; accompanying source packets not comprehensively audited.
- **S26:** [2017 CIA/FBI/NSA assessment, GovInfo mirror](https://www.govinfo.gov/content/pkg/GOVPUB-PREX28-PURL-gpo76345/pdf/GOVPUB-PREX28-PURL-gpo76345.pdf). PDF text accessible; scope and 2012 annex inspected after original ODNI link failed.
- **S25:** [2025 Annual Threat Assessment](https://www.dni.gov/files/ODNI/documents/assessments/ATA-2025-Unclassified-Report.pdf). Full 31-page text accessible; relevant influence passages inspected.

## Explicit search log

Search queries run 6 October 2026 UTC; supplementary document checks continued 7 October using web search; batches were followed by primary-source opening and relevant in-document searches. Quoted below are literal query strings (including deliberately broad initial discovery terms). Search-result publication/crawl dates were not substituted for dates printed on documents.

1. site.intelligence.senate.gov Russia social media report IRA African Americans 2019 volume 2
2. site.justice.gov Doppelganger 32 domains September 2024 affidavit narratives
3. site.dni.gov 2020 election influence Iran Russia China assessment March 2021
4. site.nature.com Russian influence Twitter 2016 election no relationship exposure attitudes voting 2023 Eady
5. site.ajph.aphapublications.org weaponized health communication Russian trolls vaccines 2018
6. site.about.fb.com August 2023 Spamouflage largest covert influence operation China law enforcement covid
7. site.justice.gov Iran 2020 election Proud Boys disinformation indictment November 2021
8. site.fbi.gov November 2024 Russian actors video Haitians voting Georgia joint statement
9. site.dni.gov October 2024 ballot destruction Bucks County video Russia
10. site.justice.gov 2023 40 officers China ministry public security troll farm covid George Floyd
11. site.dni.gov 2017 assessing Russian activities intentions recent US elections assessment not impact
12. site.cia.gov 2025 review 2016 election assessment tradecraft Putin aspirational preference
13. site.intelligence.senate.gov 2020 volume 4 intelligence assessment Russia sound tradecraft
14. site.justice.gov 2018 internet research agency indictment February 16 United Muslims heart texas
15. site.justice.gov 2018 twelve Russian intelligence officers GRU indictment Guccifer DCLeaks
16. "Weaponized Health Communication" "PMC" Broniatowski
17. "Exposure to the Russian Internet Research Agency" "1%"
18. site.graphika.com reports spamouflage dragon goes america 2020 covid
19. site.graphika.com secondary infektion 2020 2014 forged documents
20. site.nyu.edu Russian trolls 2016 Eady 2023 exposure Twitter 1 percent
21. site.dni.gov Iran influence protests Gaza July 9 2024 unwitting Americans
22. site.microsoft.com Storm-2035 Iran election 2024 Savannah Time Nio Thinker
23. site.justice.gov Russian state media employees covertly funding 10 million Tennessee company 2024
24. "Statement from Director of National Intelligence Avril Haines on Recent Iranian Influence Efforts" site:archive.dni.gov
25. site.justice.gov Concord dismissal March 2020 prejudice IRA
26. site.fbi.gov 2025 2026 foreign influence disinformation Russia China Iran
27. site.dni.gov 2025 annual threat assessment influence operations China Russia Iran narratives
28. site.state.gov 2020 pillars Russia disinformation propaganda ecosystem health HIV covid
29. site.cisa.gov 2020 foreign actors disinformation election results public service announcement
30. site.justice.gov Khusyaynova October 2018 immigration gun control race LGBT Charlottesville narratives
31. site.graphika.com "Spamouflage" "2024" "American"
32. site.courtlistener.com Concord March 16 2020 dismissed prejudice

Within-document searches included VaccinateUS, plausible (CIA review), good faith (Haines), influence operations (2025 ATA), and fracking/Occupy (2017 assessment). A supplementary 2026 ATA text search for influence found broad Russian gray-zone language but was not treated as a new operation-specific finding. Failed opens were retried through alternative primary mirrors or institutional summaries where available, without circumventing access restrictions.

## Limits and research gaps

- Selection is purposive: prominent publicly documented Russia/PRC/Iran cases, not prevalence estimates, an exhaustive actor list, or a balanced sample of all countries' activity.
- Evidence density is strongest from 2014 onward. Apart from the 2012 state-media annex, the 2006–2013 portion of the requested window was not reconstructed sufficiently to claim comprehensive twenty-year coverage. Do not imply the phenomenon began in 2014.
- A 2026 ATA received a limited text search and 2026 Graphika reports surfaced in discovery; neither received an operation-level review, and no 2026 operation-specific finding is asserted. Current records could change older legal or attribution statuses.
- Secondary Infektion and State Department COVID ecosystem reports were located but not sufficiently inspected to add their detailed narratives to the matrix. State archive access returned technical errors. These are research leads, not silently incorporated evidence.
- Public case selection favors operations detected and disclosed; clandestine undetected campaigns and failed campaigns are missing. Platform takedown datasets reflect platform detection incentives and incomplete visibility.
- No raw takedown datasets were downloaded/reanalyzed, no influence content manually recoded, no original-language cross-check performed, and no causal effect reanalysis undertaken.
- Government, platforms, and researchers often exchange intelligence; multiple publications may recycle one attribution chain. Corroboration is strongest when public artifacts or genuinely separate methods converge, not merely when many organizations repeat a claim.
- Seized domains, indictments, and historical statements do not alone establish current court disposition. Named-person accusations require an up-to-date docket check before publication.
- Broad content moderation, media bias, or domestic misinformation debates are outside this review. Disagreement with a policy is not itself disinformation. A falsehood's foreign amplification does not resolve questions about domestic responsibility or origin.