3.1.1
Disinformation Drivers & Modus Operandi
Module: M3 | Type: Lecture
This publicactuin has been funded by the Erasmus+ Programme of the European Union under the project POWER - Prevention Of Weaponization and Enhancing Resilience against Security-related Disinformation on Clean Energy (Reference: 2024-1-RO01-KA220-HED-000245038). Views and opinions expressed are however those of the author(s) only and do not necessarily reflect those of the European Union or the European Education and Culture Executive Agency (EACEA). Neither the European Union nor EACEA can be held responsible for them.
POWER Project [2024-1-RO01-KA220-HED-000245038]
Drivers of disinformation
In this lecture, you will explore the key drivers behind the spread of disinformation, which range from political and geopolitical motivations to psychological vulnerabilities, platform structures, and economic incentives. You will examine how disinformation campaigns operate in practice, including the tactics, techniques, and procedures used by state and non-state actors to manufacture, launder, and amplify false narratives. You will also investigate the technological dimension of modern disinformation, including AI-generated deepfakes, LLM-powered bots, and emerging threats such as LLM grooming, and understand how these connect to the EU's regulatory and policy responses.
POWER Project [2024-1-RO01-KA220-HED-000245038]
OER Learning Objectives
By the end of this lecture, you will be able to:
Identify and distinguish the key drivers of disinformation: political, psychological, structural, and economic and explain how each contributes to the production and spread of false narratives
Describe the modus operandi of disinformation campaigns
Analyse the technological tools used in modern disinformation operations
Evaluate the EU's regulatory and institutional responses to disinformation
POWER Project [2024-1-RO01-KA220-HED-000245038]
01
disinformationdrivers
POWER Project [2024-1-RO01-KA220-HED-000245038]
01
Drivers of disinformation
Political & Geopolitical Drivers
Psychological & Cognitive Drivers
Structural & Platform Drivers
Economic Drivers
POWER Project [2024-1-RO01-KA220-HED-000245038]
01
disinformationdrivers
POWER Project [2024-1-RO01-KA220-HED-000245038]
02
Modus operandi
Narrative construction Content production Seeding & Laundering Amplification networks Mainstreaming Iteration & adaptation
Operation Doppelgänger
POWER Project [2024-1-RO01-KA220-HED-000245038]
01
disinformationdrivers
POWER Project [2024-1-RO01-KA220-HED-000245038]
03
technological dimension of disinformation
Technology has fundamentally transformed the disinformation landscape by dramatically lowering the cost of production, increasing the realism of fake content, and enabling personalised targeting at scale. Deepfakes AI / LLM Bots Domain Spoofing Generative AI text Algorithmic targeting LLM Grooming
Technology has fundamentally transformed the disinformation landscape by dramatically lowering the cost of production, increasing the realism of fake content, and enabling personalised targeting at scale.
The Deepfake escalation
POWER Project [2024-1-RO01-KA220-HED-000245038]
01
disinformationdrivers
POWER Project [2024-1-RO01-KA220-HED-000245038]
04
Connection to SDGs & European Green Deal
The EEAS infrastructure map shows that attributed channels are only the tip of the iceberg. Covert networks, including Doppelgänger, African Initiative, Portal Kombat and False Façade operate with hidden connections across multiple platforms:Overt layer Covert layer Amplification layer
POWER Project [2024-1-RO01-KA220-HED-000245038]
POWER Project [2024-1-RO01-KA220-HED-000245038]
Test your knowledge
POWER Project [2024-1-RO01-KA220-HED-000245038]
Test your knowledge
POWER Project [2024-1-RO01-KA220-HED-000245038]
Test your knowledge
POWER Project [2024-1-RO01-KA220-HED-000245038]
Well
Done
POWERInformation that drives the energy of tomorrow
power.ciberimaginario.es
This publicactuin has been funded by the Erasmus+ Programme of the European Union under the project POWER - Prevention Of Weaponization and Enhancing Resilience against Security-related Disinformation on Clean Energy (Reference: 2024-1-RO01-KA220-HED-000245038). Views and opinions expressed are however those of the author(s) only and do not necessarily reflect those of the European Union or the European Education and Culture Executive Agency (EACEA). Neither the European Union nor EACEA can be held responsible for them.
POWER Project [2024-1-RO01-KA220-HED-000245038]
Domain spoofing is the practice of creating fake websites that visually and nominally mimic legitimate, trusted news outlets. It is one of the most effective tools for laundering disinformation into the mainstream information ecosystem. The technique exploits the fact that audiences rarely verify URLs beyond a superficial glance, and that search engines and social media platforms often index or amplify these sites before they are detected. A report by Newtral and Science Feedback revealed how various actors weaponised the 2024 European farmers' protests to spread disinformation about climate and undermine climate action, with far-right politicians behind 81.6% of the most popular anti-climate action posts, which included false claims about the EU promoting lab-grown meat and destroying water infrastructure. The operational architecture of domain spoofing in the energy disinformation space follows a clear pattern: fabricated articles are published on cloned or lookalike sites mimicking credible European outlets, then shared across social media before fact-checkers can intervene. Documented Russian spoofing campaigns have systematically cloned major European media outlets.
The overt layer of disinformation infrastructure consists of state-controlled media outlets, official government social media accounts, and sanctioned spokespeople that operate openly, providing both a broadcasting platform and a layer of plausible deniability for the covert operations that run in parallel.The HEAT project - a cross-border investigation by Logically and EU DisinfoLab covering Germany, France, and the Netherlands between October 2024 and April 2025 identified 3,424 climate-related posts across 115 hostile state-affiliated websites and accounts, with RT.com contributing 430 posts despite its EU ban since 2022, operating through mirror domains such as RT.de to continue disseminating climate disinformation. These overt channels systematically push narratives that reframing decarbonisation as economic recklessness, rehabilitate fossil fuels as "rational" energy policy, and exploit moments of public frustration over energy prices, all while providing the narrative scaffolding that covert networks then amplify.
Algorithmic targeting is the mechanism by which false or misleading content is not merely published but systematically delivered to the audiences most psychologically susceptible to it. Platform algorithms optimise for engagement, and emotionally charged content, such as fear, outrage, and identity threat, consistently outperforms factual reporting. False information about the Valencia flooding disaster in October 2024, which killed 237 people and was Europe's most catastrophic flooding event since 1967, was seen over 21 million times on YouTube and TikTok in the month following the disaster, with YouTube and TikTok algorithmically amplifying falsehoods that "sowed confusion." Research by Maldita and AI Forensics found significantly higher engagement with content that contains or discusses climate disinformation than with factual information about the flooding, suggesting that disinformation was "derailing" the public information environment during an active climate emergency.
This lecture aims at presenting the fundamental clean energy sources and supporting technologies that are central to Europe's energy transition, providing learners with the scientific and technical foundations needed to identify and counter energy-related disinformation. Within the general architecture of the POWER educational platform, this lecture equips the target group with a solid understanding of how clean energy works in practice, enabling them to critically evaluate claims about renewable energy and recognise when factual information is being distorted or misrepresented. Therefore, the lecture is structured into four main parts: (1) an overview of the five main clean energy sources — solar, wind, hydro, geothermal, and biomass — and their key characteristics; (2) an introduction to the supporting technologies that make the energy transition viable, including smart grids, battery storage systems, and energy efficiency measures; (3) an exploration of emerging solutions such as electric vehicles and green hydrogen and their role in decarbonising hard-to-electrify sectors; and (4) an explanation of how these technologies connect to broader policy frameworks, namely the UN Sustainable Development Goals and the European Green Deal.
Main learning questions addressed:
- What are the main clean energy sources and how do they contribute to a sustainable energy mix?
- How do supporting technologies such as smart grids and energy storage enable a reliable clean energy system?
- What role do electric vehicles and green hydrogen play in the broader energy transition?
- How do European and international policy frameworks — the SDGs, the Green Deal, Fit for 55, and REPowerEU — drive the deployment of clean energy technologies?
The amplification layer is the mechanism through which state-seeded disinformation achieves the visibility and apparent legitimacy of organic public debate. This layer operates through coordinated inauthentic behaviour (CIB): synchronised posting, hashtag flooding, bot-driven engagement inflation, and cross-platform distribution, which create the illusion of widespread public concern where none organically exists. At COP29 in November 2024, hosted by Azerbaijan, Global Witness exposed coordinated inauthentic accounts on X that radically shifted the nature of climate conversations on the platform in the months leading up to the summit, amplifying pro-petrostate narratives and suppressing scrutiny of fossil fuel interests.
Coordinated inauthentic behaviour (bot networks, sockpuppet accounts, influencer networks) amplifies content. At least 38,000 accounts are involved in FIMI activities in 2024, across 25 platforms.
Deepfakes are AI-generated video and audio content that make real people appear to say or do things they never did. In recent years, they have undergone an exponential expansion in scale and realism. In the energy and climate domain, deepfakes could be used to falsely demonstrate commitment to renewable energy, carbon capture, and sustainable development, in what the World Economic Forum has termed "deepfake greenwashing." A documented early example occurred in March 2023, when a think tank (Texas Public Policy Foundation) was accused of using a doctored AI image of a dead whale positioned near wind turbines to argue against offshore wind projects. The fake image was leveraged by conservative think tanks and anti-wind advocacy groups to push the unfounded claim that renewable energy projects pose a lethal threat to marine wildlife.
Generative AI text is the practice of using LLMs to generate content that previously required teams of human writers at an industrial scale, in multiple languages, at minimal cost, with a grammatical fluency and persuasive sophistication that is increasingly indistinguishable from legitimate journalism. Studies show that AI-generated messages can be as persuasive as human ones and, in some cases, are perceived as even more persuasive (e.g., considered more factual and logical), particularly on polarised policy issues, while individuals often fail to distinguish between AI- and human-generated text. According to an EU report published in March 2026, 27% of attempts by foreign powers to manipulate information globally involved the use of AI in 2025, an almost threefold increase over 2024, with climate and energy policy consistently among the targeted issue areas.For example, in April 2025, NewsGuard found that AI chatbots repeated false narratives about France sourced from Russian influence operation Storm-1516. Leading AI chatbots repeated Storm-1516 linked disinformation narratives 32% of the time as a result of strategic information laundering through fake local news sites and fake "whistleblower" YouTube videos.
False or misleading narratives are crafted to exploit existing tensions, such as migration, climate, economic anxiety, war. Narratives are often built on a kernel of truth, making them harder to refute.
AI/ LLM Bots, more specifically, "sleeper social bots" represent a qualitative leap beyond the original automated accounts of previous years. Unlike earlier bots that simply posted easily identifiable automated messages, LLM-powered bots can pass themselves off as authentic humans, befriend other users, and over days, weeks, or months engage in dialogue attuned to the sentiments, attitudes, and ways of speaking of each user, in order to convert, radicalise, or otherwise influence them. An analysis by Brown University revealed that 25% of all tweets about the climate crisis during the period when Donald Trump announced the US withdrawal from the Paris Agreement were generated by bots, which overwhelmingly supported anti-climate policies. Bot activity was especially high in topics such as "fake science" (38%) and discussions about petroleum giant Exxon (28%). Similarly, investigations during COP28 and COP29 exposed coordinated bot networks that amplified pro-petrostate narratives and suppressed criticism. In 2024, researchers uncovered a major network of Chinese-run AI accounts, dubbed "Green Cicada," posting about contentious issues including nuclear energy.
The covert layer operates through networks of fake accounts, sockpuppets, influencer-for-hire schemes, and domain-cloned websites that carry no visible connection to state actors, making attribution difficult and enforcement slower. In the climate and energy domain, this layer has been directly and repeatedly exposed. A 2025 investigation by The American Sunlight Project uncovered a sprawling Russian disinformation network dubbed "EcoBoost," in which over 600 fake X accounts posted more than 245,000 messages since June 2024, using AI-generated personas posing as grassroots environmental activists to infiltrate left-leaning movements and subtly push disinformation about climate and energy policy in Western democracies. Similarly, the Russian Doppelgänger campaign cloned at least 17 authentic European media outlets, including German, French, and Italian titles that regularly cover EU energy and climate legislation, using lookalike domains to publish fabricated articles attacking EU energy sanctions and the European Green Deal before being detected and seized.
Campaigns adapt in near real-time based on audience response. AI tools allow rapid modification of messaging. The Doppelgänger campaign has been running since 2022 and continues to evolve.
LLM Grooming is a form of "data poisoning", which involves flooding the internet with large volumes of AI-generated false content, often on fake news websites, manipulated Wikipedia entries, and content farms, with the specific intent that this material will be scraped and ingested into the training datasets of large language models.Attackers publish millions of articles across hundreds of websites (often using AI themselves to generate the volume). When AI companies scrape the web for training data, this coordinated narrative statistically outweighs factual information, leading the model to repeat the disinformation as fact. Attackers often target topics with little existing reputable information (data voids), making it easier for their fabricated narrative to become the dominant source for an AI. The Pravda Network: Researchers identified a network of nearly 50 domains that generated over 3.6 million pro-Russia articles in a single year. This high volume was designed to "contaminate" the datasets of Western LLMs so they would reproduce Kremlin viewpoints. This is directly relevant to EU energy policy given that Kremlin disinformation narratives systematically conflate EU energy sanctions, Russian gas dependency, and renewable energy transition.
Material produced as fake news articles, memes, deepfake videos, and manipulated images. AI now enables mass production at low cost. Russian and Chinese actors use AI to "accelerate content production
Content is first seeded on fringe or fake platforms, then "laundered" through fake local news sites, fake whistleblower videos, and pseudo-academic sources to appear credible.
Content crosses into mainstream media through organic sharing or by being picked up by politicians or media outlets, achieving legitimacy and massive reach.
Disinformation is increasingly used as a tool of hybrid warfare. The European Parliament (2022) identified Russia and China as the primary state actors targeting EU institutions through disinformation. Key motivations include:
- Undermining support for Ukraine: Campaigns target public backing for EU sanctions and military aid
- Electoral interference: FIMI actors systematically target electoral processes (e.g. 33 incidents analysed by EEAS in recent elections)
- Eroding trust in institutions: Attacks on democratic values, EU institutions, and political leaders (66% of FIMI attacks target politicians)
- Polarisation: Amplifying societal divisions on migration, climate, COVID-19
Example: The Storm-1516 operation used AI to create over 100 fake websites pushing deepfakes targeting German politicians Annalena Baerbock and Robert Habeck before the 2025 federal elections
Disinformation exploits fundamental features of human cognition. The EEAS has noted that threat actors deliberately target cognitive biases to reach and influence audiences.
- Illusory Truth Effect: Repeated exposure to false information increases perceived truthfulness, even when people know better.
- Emotional Amplification: Content evoking fear, anger, or outrage spreads faster and wider. Disinformation campaigns deliberately engineer emotional triggers.
- In-group Identity: People more readily accept disinformation that confirms their group identity or attacks out-groups. Partisan identity overrides fact-checking.
- Liar's Dividend: Growing awareness of deepfakes enables bad actors to dismiss authentic evidence as fake; the paradox of better technology increasing doubt.
EU Policy Lab research identifies the following persuasion techniques used in disinformation: emotional language, scapegoating, black-and-white fallacies, and discrediting sources.
The architecture of digital platforms creates structural incentives for the spread of disinformation:
- Algorithmic amplification: Platforms optimise for engagement; emotionally charged (often false) content performs better.
- Data restrictions: Most major platforms restrict access to data that would allow the scale of manipulation to be assessed.
- Ease of fake accounts: On X, ease of creating fake accounts and networks of coordinated inauthentic behaviour explains the concentration of 88% of EU-targeted disinformation.
- Cross-platform amplification: Content seeded on fringe platforms is amplified to mainstream audiences through coordinated sharing
- Declining moderation: US-based platforms are scaling back anti-disinformation efforts, deepening vulnerabilities.
Disinformation is not only politically motivated. A significant portion is commercially driven:
- Attention economy: Provocative content generates clicks and ad revenue for content farms.
- Influence-for-hire: Private firms offer disinformation services to political actors (documented in EU and candidate countries).
- AI cost reduction: Generative AI makes disinformation "significantly cheaper" (e.g. a Russian/Chinese campaign can now operate with far fewer resources).
- Fake news ecosystem: Low-quality multilingual AI content floods the information space, including LLM grooming (e.g. attempts to inject false claims into AI training data).
Actors linked to Russia systematically cloned or mimicked legitimate European media outlets using domain lookalikes and spoofed website layouts to amplify disinformation undermining EU support for Ukraine and manipulating public opinion across Member States.
The operation includes sub-networks: RRN (Reliable Recent News), WarOnFakes, and Matriochka. A living timeline maintained by EU DisinfoLab tracks its evolution. The EU responded with sanctions, platform takedowns, and regulatory measures under the DSA.
Deepfakes have now eliminated earlier telltale glitches and are accessible to anyone with a smartphone. With the technology widely accessible, experts warn that manual "eyeballing" of deepfakes is no longer reliable. Instead, security is moving toward on-device detection, or cryptographic watermarking.Deepfakes in numbers:
- 550% increase in known deepfake videos since 2019.
- 46% of fraud experts have encountered synthetic identity fraud
- 32% of AI chatbots repeated Storm-1516 disinformation narratives
- $442B projected generative AI market by 2031 (560% growth)
311-POWER-Lecture
URJC
Created on April 7, 2026
Start designing with a free template
Discover more than 1500 professional designs like these:
View
Magazine dossier
View
Momentum: Onboarding Escape Game
View
Momentum: Manager Guide
View
Wizardry Letter
View
Search Bar Card
View
Piñata
View
Microlearning: When to Use Chat, Meetings or Email
Explore all templates
Transcript
3.1.1
Disinformation Drivers & Modus Operandi
Module: M3 | Type: Lecture
This publicactuin has been funded by the Erasmus+ Programme of the European Union under the project POWER - Prevention Of Weaponization and Enhancing Resilience against Security-related Disinformation on Clean Energy (Reference: 2024-1-RO01-KA220-HED-000245038). Views and opinions expressed are however those of the author(s) only and do not necessarily reflect those of the European Union or the European Education and Culture Executive Agency (EACEA). Neither the European Union nor EACEA can be held responsible for them.
POWER Project [2024-1-RO01-KA220-HED-000245038]
Drivers of disinformation
In this lecture, you will explore the key drivers behind the spread of disinformation, which range from political and geopolitical motivations to psychological vulnerabilities, platform structures, and economic incentives. You will examine how disinformation campaigns operate in practice, including the tactics, techniques, and procedures used by state and non-state actors to manufacture, launder, and amplify false narratives. You will also investigate the technological dimension of modern disinformation, including AI-generated deepfakes, LLM-powered bots, and emerging threats such as LLM grooming, and understand how these connect to the EU's regulatory and policy responses.
POWER Project [2024-1-RO01-KA220-HED-000245038]
OER Learning Objectives
By the end of this lecture, you will be able to:
Identify and distinguish the key drivers of disinformation: political, psychological, structural, and economic and explain how each contributes to the production and spread of false narratives
Describe the modus operandi of disinformation campaigns
Analyse the technological tools used in modern disinformation operations
Evaluate the EU's regulatory and institutional responses to disinformation
POWER Project [2024-1-RO01-KA220-HED-000245038]
01
disinformationdrivers
POWER Project [2024-1-RO01-KA220-HED-000245038]
01
Drivers of disinformation
Political & Geopolitical Drivers
Psychological & Cognitive Drivers
Structural & Platform Drivers
Economic Drivers
POWER Project [2024-1-RO01-KA220-HED-000245038]
01
disinformationdrivers
POWER Project [2024-1-RO01-KA220-HED-000245038]
02
Modus operandi
Narrative construction Content production Seeding & Laundering Amplification networks Mainstreaming Iteration & adaptation
Operation Doppelgänger
POWER Project [2024-1-RO01-KA220-HED-000245038]
01
disinformationdrivers
POWER Project [2024-1-RO01-KA220-HED-000245038]
03
technological dimension of disinformation
Technology has fundamentally transformed the disinformation landscape by dramatically lowering the cost of production, increasing the realism of fake content, and enabling personalised targeting at scale. Deepfakes AI / LLM Bots Domain Spoofing Generative AI text Algorithmic targeting LLM Grooming
Technology has fundamentally transformed the disinformation landscape by dramatically lowering the cost of production, increasing the realism of fake content, and enabling personalised targeting at scale.
The Deepfake escalation
POWER Project [2024-1-RO01-KA220-HED-000245038]
01
disinformationdrivers
POWER Project [2024-1-RO01-KA220-HED-000245038]
04
Connection to SDGs & European Green Deal
The EEAS infrastructure map shows that attributed channels are only the tip of the iceberg. Covert networks, including Doppelgänger, African Initiative, Portal Kombat and False Façade operate with hidden connections across multiple platforms:Overt layer Covert layer Amplification layer
POWER Project [2024-1-RO01-KA220-HED-000245038]
POWER Project [2024-1-RO01-KA220-HED-000245038]
Test your knowledge
POWER Project [2024-1-RO01-KA220-HED-000245038]
Test your knowledge
POWER Project [2024-1-RO01-KA220-HED-000245038]
Test your knowledge
POWER Project [2024-1-RO01-KA220-HED-000245038]
Well
Done
POWERInformation that drives the energy of tomorrow
power.ciberimaginario.es
This publicactuin has been funded by the Erasmus+ Programme of the European Union under the project POWER - Prevention Of Weaponization and Enhancing Resilience against Security-related Disinformation on Clean Energy (Reference: 2024-1-RO01-KA220-HED-000245038). Views and opinions expressed are however those of the author(s) only and do not necessarily reflect those of the European Union or the European Education and Culture Executive Agency (EACEA). Neither the European Union nor EACEA can be held responsible for them.
POWER Project [2024-1-RO01-KA220-HED-000245038]
Domain spoofing is the practice of creating fake websites that visually and nominally mimic legitimate, trusted news outlets. It is one of the most effective tools for laundering disinformation into the mainstream information ecosystem. The technique exploits the fact that audiences rarely verify URLs beyond a superficial glance, and that search engines and social media platforms often index or amplify these sites before they are detected. A report by Newtral and Science Feedback revealed how various actors weaponised the 2024 European farmers' protests to spread disinformation about climate and undermine climate action, with far-right politicians behind 81.6% of the most popular anti-climate action posts, which included false claims about the EU promoting lab-grown meat and destroying water infrastructure. The operational architecture of domain spoofing in the energy disinformation space follows a clear pattern: fabricated articles are published on cloned or lookalike sites mimicking credible European outlets, then shared across social media before fact-checkers can intervene. Documented Russian spoofing campaigns have systematically cloned major European media outlets.
The overt layer of disinformation infrastructure consists of state-controlled media outlets, official government social media accounts, and sanctioned spokespeople that operate openly, providing both a broadcasting platform and a layer of plausible deniability for the covert operations that run in parallel.The HEAT project - a cross-border investigation by Logically and EU DisinfoLab covering Germany, France, and the Netherlands between October 2024 and April 2025 identified 3,424 climate-related posts across 115 hostile state-affiliated websites and accounts, with RT.com contributing 430 posts despite its EU ban since 2022, operating through mirror domains such as RT.de to continue disseminating climate disinformation. These overt channels systematically push narratives that reframing decarbonisation as economic recklessness, rehabilitate fossil fuels as "rational" energy policy, and exploit moments of public frustration over energy prices, all while providing the narrative scaffolding that covert networks then amplify.
Algorithmic targeting is the mechanism by which false or misleading content is not merely published but systematically delivered to the audiences most psychologically susceptible to it. Platform algorithms optimise for engagement, and emotionally charged content, such as fear, outrage, and identity threat, consistently outperforms factual reporting. False information about the Valencia flooding disaster in October 2024, which killed 237 people and was Europe's most catastrophic flooding event since 1967, was seen over 21 million times on YouTube and TikTok in the month following the disaster, with YouTube and TikTok algorithmically amplifying falsehoods that "sowed confusion." Research by Maldita and AI Forensics found significantly higher engagement with content that contains or discusses climate disinformation than with factual information about the flooding, suggesting that disinformation was "derailing" the public information environment during an active climate emergency.
This lecture aims at presenting the fundamental clean energy sources and supporting technologies that are central to Europe's energy transition, providing learners with the scientific and technical foundations needed to identify and counter energy-related disinformation. Within the general architecture of the POWER educational platform, this lecture equips the target group with a solid understanding of how clean energy works in practice, enabling them to critically evaluate claims about renewable energy and recognise when factual information is being distorted or misrepresented. Therefore, the lecture is structured into four main parts: (1) an overview of the five main clean energy sources — solar, wind, hydro, geothermal, and biomass — and their key characteristics; (2) an introduction to the supporting technologies that make the energy transition viable, including smart grids, battery storage systems, and energy efficiency measures; (3) an exploration of emerging solutions such as electric vehicles and green hydrogen and their role in decarbonising hard-to-electrify sectors; and (4) an explanation of how these technologies connect to broader policy frameworks, namely the UN Sustainable Development Goals and the European Green Deal.
Main learning questions addressed:
The amplification layer is the mechanism through which state-seeded disinformation achieves the visibility and apparent legitimacy of organic public debate. This layer operates through coordinated inauthentic behaviour (CIB): synchronised posting, hashtag flooding, bot-driven engagement inflation, and cross-platform distribution, which create the illusion of widespread public concern where none organically exists. At COP29 in November 2024, hosted by Azerbaijan, Global Witness exposed coordinated inauthentic accounts on X that radically shifted the nature of climate conversations on the platform in the months leading up to the summit, amplifying pro-petrostate narratives and suppressing scrutiny of fossil fuel interests.
Coordinated inauthentic behaviour (bot networks, sockpuppet accounts, influencer networks) amplifies content. At least 38,000 accounts are involved in FIMI activities in 2024, across 25 platforms.
Deepfakes are AI-generated video and audio content that make real people appear to say or do things they never did. In recent years, they have undergone an exponential expansion in scale and realism. In the energy and climate domain, deepfakes could be used to falsely demonstrate commitment to renewable energy, carbon capture, and sustainable development, in what the World Economic Forum has termed "deepfake greenwashing." A documented early example occurred in March 2023, when a think tank (Texas Public Policy Foundation) was accused of using a doctored AI image of a dead whale positioned near wind turbines to argue against offshore wind projects. The fake image was leveraged by conservative think tanks and anti-wind advocacy groups to push the unfounded claim that renewable energy projects pose a lethal threat to marine wildlife.
Generative AI text is the practice of using LLMs to generate content that previously required teams of human writers at an industrial scale, in multiple languages, at minimal cost, with a grammatical fluency and persuasive sophistication that is increasingly indistinguishable from legitimate journalism. Studies show that AI-generated messages can be as persuasive as human ones and, in some cases, are perceived as even more persuasive (e.g., considered more factual and logical), particularly on polarised policy issues, while individuals often fail to distinguish between AI- and human-generated text. According to an EU report published in March 2026, 27% of attempts by foreign powers to manipulate information globally involved the use of AI in 2025, an almost threefold increase over 2024, with climate and energy policy consistently among the targeted issue areas.For example, in April 2025, NewsGuard found that AI chatbots repeated false narratives about France sourced from Russian influence operation Storm-1516. Leading AI chatbots repeated Storm-1516 linked disinformation narratives 32% of the time as a result of strategic information laundering through fake local news sites and fake "whistleblower" YouTube videos.
False or misleading narratives are crafted to exploit existing tensions, such as migration, climate, economic anxiety, war. Narratives are often built on a kernel of truth, making them harder to refute.
AI/ LLM Bots, more specifically, "sleeper social bots" represent a qualitative leap beyond the original automated accounts of previous years. Unlike earlier bots that simply posted easily identifiable automated messages, LLM-powered bots can pass themselves off as authentic humans, befriend other users, and over days, weeks, or months engage in dialogue attuned to the sentiments, attitudes, and ways of speaking of each user, in order to convert, radicalise, or otherwise influence them. An analysis by Brown University revealed that 25% of all tweets about the climate crisis during the period when Donald Trump announced the US withdrawal from the Paris Agreement were generated by bots, which overwhelmingly supported anti-climate policies. Bot activity was especially high in topics such as "fake science" (38%) and discussions about petroleum giant Exxon (28%). Similarly, investigations during COP28 and COP29 exposed coordinated bot networks that amplified pro-petrostate narratives and suppressed criticism. In 2024, researchers uncovered a major network of Chinese-run AI accounts, dubbed "Green Cicada," posting about contentious issues including nuclear energy.
The covert layer operates through networks of fake accounts, sockpuppets, influencer-for-hire schemes, and domain-cloned websites that carry no visible connection to state actors, making attribution difficult and enforcement slower. In the climate and energy domain, this layer has been directly and repeatedly exposed. A 2025 investigation by The American Sunlight Project uncovered a sprawling Russian disinformation network dubbed "EcoBoost," in which over 600 fake X accounts posted more than 245,000 messages since June 2024, using AI-generated personas posing as grassroots environmental activists to infiltrate left-leaning movements and subtly push disinformation about climate and energy policy in Western democracies. Similarly, the Russian Doppelgänger campaign cloned at least 17 authentic European media outlets, including German, French, and Italian titles that regularly cover EU energy and climate legislation, using lookalike domains to publish fabricated articles attacking EU energy sanctions and the European Green Deal before being detected and seized.
Campaigns adapt in near real-time based on audience response. AI tools allow rapid modification of messaging. The Doppelgänger campaign has been running since 2022 and continues to evolve.
LLM Grooming is a form of "data poisoning", which involves flooding the internet with large volumes of AI-generated false content, often on fake news websites, manipulated Wikipedia entries, and content farms, with the specific intent that this material will be scraped and ingested into the training datasets of large language models.Attackers publish millions of articles across hundreds of websites (often using AI themselves to generate the volume). When AI companies scrape the web for training data, this coordinated narrative statistically outweighs factual information, leading the model to repeat the disinformation as fact. Attackers often target topics with little existing reputable information (data voids), making it easier for their fabricated narrative to become the dominant source for an AI. The Pravda Network: Researchers identified a network of nearly 50 domains that generated over 3.6 million pro-Russia articles in a single year. This high volume was designed to "contaminate" the datasets of Western LLMs so they would reproduce Kremlin viewpoints. This is directly relevant to EU energy policy given that Kremlin disinformation narratives systematically conflate EU energy sanctions, Russian gas dependency, and renewable energy transition.
Material produced as fake news articles, memes, deepfake videos, and manipulated images. AI now enables mass production at low cost. Russian and Chinese actors use AI to "accelerate content production
Content is first seeded on fringe or fake platforms, then "laundered" through fake local news sites, fake whistleblower videos, and pseudo-academic sources to appear credible.
Content crosses into mainstream media through organic sharing or by being picked up by politicians or media outlets, achieving legitimacy and massive reach.
Disinformation is increasingly used as a tool of hybrid warfare. The European Parliament (2022) identified Russia and China as the primary state actors targeting EU institutions through disinformation. Key motivations include:
- Undermining support for Ukraine: Campaigns target public backing for EU sanctions and military aid
- Electoral interference: FIMI actors systematically target electoral processes (e.g. 33 incidents analysed by EEAS in recent elections)
- Eroding trust in institutions: Attacks on democratic values, EU institutions, and political leaders (66% of FIMI attacks target politicians)
- Polarisation: Amplifying societal divisions on migration, climate, COVID-19
Example: The Storm-1516 operation used AI to create over 100 fake websites pushing deepfakes targeting German politicians Annalena Baerbock and Robert Habeck before the 2025 federal electionsDisinformation exploits fundamental features of human cognition. The EEAS has noted that threat actors deliberately target cognitive biases to reach and influence audiences.
- Illusory Truth Effect: Repeated exposure to false information increases perceived truthfulness, even when people know better.
- Emotional Amplification: Content evoking fear, anger, or outrage spreads faster and wider. Disinformation campaigns deliberately engineer emotional triggers.
- In-group Identity: People more readily accept disinformation that confirms their group identity or attacks out-groups. Partisan identity overrides fact-checking.
- Liar's Dividend: Growing awareness of deepfakes enables bad actors to dismiss authentic evidence as fake; the paradox of better technology increasing doubt.
EU Policy Lab research identifies the following persuasion techniques used in disinformation: emotional language, scapegoating, black-and-white fallacies, and discrediting sources.The architecture of digital platforms creates structural incentives for the spread of disinformation:
Disinformation is not only politically motivated. A significant portion is commercially driven:
Actors linked to Russia systematically cloned or mimicked legitimate European media outlets using domain lookalikes and spoofed website layouts to amplify disinformation undermining EU support for Ukraine and manipulating public opinion across Member States. The operation includes sub-networks: RRN (Reliable Recent News), WarOnFakes, and Matriochka. A living timeline maintained by EU DisinfoLab tracks its evolution. The EU responded with sanctions, platform takedowns, and regulatory measures under the DSA.
Deepfakes have now eliminated earlier telltale glitches and are accessible to anyone with a smartphone. With the technology widely accessible, experts warn that manual "eyeballing" of deepfakes is no longer reliable. Instead, security is moving toward on-device detection, or cryptographic watermarking.Deepfakes in numbers: