Three weeks before Slovakia's parliamentary election, a two-minute audio clip spread rapidly across Facebook and Telegram. In the recording, a voice that sounded unmistakably like Michal Ε imeΔka β the leader of the liberal Progressive Slovakia party β appeared to be discussing how to rig the election by buying votes from Slovakia's Roma minority.
Ε imeΔka said immediately that the recording was fake. Fact-checkers at AFP and other organizations confirmed within days that the audio showed telltale signs of AI voice cloning β unnatural pauses, slightly robotic cadences in certain consonants, and a metadata trail pointing to software manipulation. But the clip had already been seen by hundreds of thousands of people. Progressive Slovakia lost the election to the nationalist Smer party by a narrow margin. Whether the deepfake changed the outcome, nobody can prove. But someone made that audio on purpose, with a specific goal, two weeks before a vote.
That is the thing most people never ask when they see a suspicious image or hear a strange recording: Why does this exist right now?
When a photograph is taken, a camera records light. When a painting is made, a person holds a brush. Both of these processes have a creator β and that creator always had a reason. The same is true for AI-generated images, audio, and video. Nothing synthetic appears by accident. Someone chose to make it, chose what it would show, and chose where to release it.
This sounds obvious. But most people consume media as if content appears from nowhere β as if images just float up out of the internet. They ask "Is this real?" but almost never ask "Who needed this to exist?"
Understanding motivation β the reason something was made β is one of the most powerful tools for evaluating any piece of media. In the Slovakia case, the motivation was clear in retrospect: suppress a political party's vote right before an election. The timing was a fingerprint. The content was a fingerprint. The distribution channel (Telegram, which is harder to moderate) was a fingerprint.
Motivation does not prove something is fake. But it raises your probability estimate significantly. When you encounter any suspicious content, the second question you should always ask β after "Does this look real?" β is: Who benefits if people believe this?
Researchers who study disinformation β the deliberate spread of false information β have mapped out the main reasons people create fake or manipulated media. They are not random. They cluster into four categories.
1. Political influence. The Slovakia example fits here. Synthetic media is used to damage a candidate's reputation, suppress turnout in certain communities, or make a government look weak or aggressive. This type of fake tends to appear close to election dates, during protests, or during military conflicts. The 2022 deepfake video of Ukrainian President Volodymyr Zelensky "ordering troops to surrender" β released via a hacked Ukrainian news channel in March 2022 β is another documented case of political synthetic media.
2. Financial fraud. In 2019, the CEO of a UK energy company received a phone call from someone he believed was the CEO of the German parent company. The voice β AI-generated β directed him to wire β¬220,000 to a Hungarian supplier "immediately." He did. The money was gone within hours. The scam used commercially available voice-cloning technology. As AI voices improve, this type of fraud is growing rapidly.
3. Harassment and humiliation. A 2023 study by the Stanford Internet Observatory found that the vast majority of deepfake videos online β more than 90% at the time of their research β were non-consensual intimate imagery targeting women, particularly celebrities and public figures. The motivation here is not political or financial but personal: to degrade, control, or punish someone. This category is under-discussed because it is uncomfortable, but it is statistically the dominant use of deepfake technology.
4. Entertainment and satire. Not all synthetic media is malicious. Filmmakers, comedians, and artists use AI to create content that is clearly labeled as fictional or satirical. The issue is when entertainment-style production techniques are applied to content designed to deceive β the production values of entertainment, the intent of disinformation.
So far we've covered one real example and four reasons people make fakes. If you need to stop here, remember this: every fake image was made by someone who wanted something. What they wanted tells you a lot about whether and why they made it fake.
One of the most underrated tools for evaluating suspicious content is simply asking: Why is this appearing right now? Synthetic media that is designed to deceive rarely appears randomly. It is timed. The Slovakia audio appeared three weeks before a vote. The Zelensky "surrender" video appeared during the chaos of the early weeks of an invasion. The UK CEO fraud call happened on a Friday afternoon β a time when it is harder to verify things quickly.
Timing is not proof of fabrication. But it is a red flag that should immediately trigger deeper scrutiny. When you see alarming content about a public figure, a conflict, or an election, and it appears during a period of high tension, your first move should not be to share it. It should be to freeze and ask: does the timing of this content serve someone's agenda?
Researchers at the Harvard Shorenstein Center call this concept strategic timing β the deliberate release of disinformation at moments when people are emotionally activated and less likely to slow down and verify. Anger, fear, and excitement all reduce critical thinking. Disinformation creators know this. They aim for the emotional peak.
You now understand something that most adults scroll past without noticing: the moment a piece of alarming content appears is part of the content itself. Timing is data.
You can now read a suspicious piece of media the way an investigator does β not just "does this look real?" but "why does this exist right now, who benefits, and what emotion is it designed to trigger?" Most people never make it past the first question. You have.
If a deepfake audio of a politician is convincing enough that millions of people believe it β even after it is debunked β does the debunking actually fix the harm? Who is responsible: the person who made it, the platform that spread it, or the people who shared it without checking? There is no consensus answer to this. Governments, tech companies, and legal scholars disagree. Sit with that.
Where a piece of content first appears is almost as revealing as what it shows. The Slovakia audio was seeded on Telegram β a platform with minimal content moderation and a large Slovak-language political community. The Zelensky video was placed on a hacked news channel β to give it an air of legitimacy before anyone noticed the hack. The UK CEO fraud was delivered by phone β a medium people instinctively trust more than text.
Legitimate images from real events are usually traceable: they appear on news wire services like Reuters, AP, or AFP with timestamps, photographer credits, and GPS metadata. Synthetic media often lacks this paper trail. It tends to appear on platforms where verification is slow, in communities where the content confirms what people already believe (making them less likely to question it), and at a moment designed to maximize emotional impact before fact-checkers can respond.
The distribution path β where something first appears, how it spreads, and who amplifies it β is part of your evidence kit. A suspicious image that appears first on an anonymous account, spreads through politically extreme communities, and is then picked up by mainstream media is showing you exactly how a disinformation campaign operates.
Next lesson, we will look at the creators themselves β not just their motivation, but who they actually are: governments, companies, anonymous trolls, and well-meaning people who accidentally spread fakes. Each type of creator leaves different fingerprints.
You have been handed three brief case descriptions of suspicious media incidents. Your job is to identify what motivation category each one fits, explain your reasoning, and flag what additional information you would want before making a final call. Your lab partner will push back on your reasoning β that is the point.
In 2016, a building at 55 Savushkina Street in St. Petersburg, Russia, housed what looked like an ordinary tech office. Inside, several hundred employees worked shifts around the clock. Their job: create fake American social media personas, post politically divisive content across Facebook, Twitter, Instagram, and YouTube, and, where possible, organize real-world political rallies in the United States β without any of the participants knowing the organizer was a Russian government-linked operation.
This was the Internet Research Agency (IRA), later indicted by the United States Department of Justice in February 2018. The IRA spent an estimated $1.25 million per month on this operation. They created more than 3,500 Facebook ads, managed accounts that reached an estimated 126 million Americans, and, according to the Senate Intelligence Committee report, successfully organized actual protests β sometimes getting opposing groups to show up at the same location simultaneously.
The IRA did not rely heavily on deepfakes β the technology was not yet sophisticated enough in 2016. They used fake personas, stolen photographs of real Americans, and manufactured outrage. But their operation set the template for what state-sponsored influence campaigns look like. And as synthetic media technology improved, operations like theirs began incorporating AI-generated faces, voices, and video.
Not everyone who makes a synthetic media fake is a government spy agency with a $1.25 million monthly budget. The creators of misleading synthetic media span a wide spectrum, and understanding where a piece of content likely falls on that spectrum changes how you interpret it.
State-sponsored operations are the most resourced and the most sophisticated. They have professional staff, long timelines, and strategic goals aligned with government policy. The IRA is one example. In 2019, researchers at the Stanford Internet Observatory identified a similar operation run from Iran, using AI-generated faces as profile pictures for a network of fake political accounts targeting audiences in the US, UK, and elsewhere. State operations tend to be patient β they build credibility over months before deploying their most damaging content.
Organized non-state groups include political campaigns operating in legal grey zones, activist networks, and for-profit "disinformation farms" β companies that sell influence services to whoever pays. In 2020, Facebook took down coordinated networks tied to political operatives in multiple countries running influence campaigns that were not quite illegal but deliberately deceptive. These operations are smaller than state operations but can still reach millions.
Individual bad actors are often the hardest to stop because they are so unpredictable. A single person with a consumer AI tool and a grudge can create a convincing deepfake of a teacher, a classmate, or a local politician. The 2023 case of a Pennsylvania high school student who created AI-manipulated audio of a principal was created by one person with widely available software β and it still led to national news coverage and charges.
Accidental spreaders are not creators at all β they are real people who encounter synthetic media and share it because they believe it is real. They are often the largest group of people involved in any disinformation event. The IRA understood this: they did not need to reach 126 million Americans directly. They needed to reach a few million who would amplify their content to everyone else.
Large organized operations β whether state-sponsored or commercial β tend to leave detectable patterns that individual creators do not. Researchers at the Stanford Internet Observatory, the Atlantic Council's Digital Forensic Research Lab, and Meta's own security team have developed methods for identifying these patterns.
The first pattern is coordinated inauthentic behavior β a technical term for a group of accounts acting together in ways that no genuine community would. They post at identical times, amplify each other's content within seconds, use similar phrasing, and often share infrastructure (same IP addresses, same device signatures). When Meta announces it has taken down a "coordinated network," this is what they found.
The second pattern is content recycling. Organized operations reuse images, phrases, and narratives across multiple platforms and accounts. A photograph manipulated for one story will appear in a slightly different context on another platform six weeks later. Reverse image searches and cross-platform tracking can catch this.
The third pattern is template faces β AI-generated profile pictures used to make fake accounts look like real people. Since 2019, researchers have documented hundreds of networks using GAN-generated faces (GAN stands for Generative Adversarial Network β an AI system that creates realistic-looking human faces that belong to nobody). These faces have specific visual tells, including strange ear symmetry, background blurring near hair, and inconsistent eye highlights.
We have covered the spectrum of who makes fakes β from governments to individuals β and three patterns that big organized operations leave behind. Those patterns are: accounts acting together, content being reused, and fake profile photos. If you are pausing here, those are the three things to remember.
If a piece of synthetic media was made by a state-sponsored operation, the appropriate response is different from if it was made by a misguided teenager. This matters at an institutional level β for governments, platforms, and newsrooms β but it also matters for you personally.
Content produced by a state operation is part of a strategic campaign. It is designed to persist, to evolve in response to debunking, and to have multiple entry points. Debunking one piece of it does not dismantle the operation. In fact, state-level disinformation often anticipates debunking and uses it β when fact-checkers call something false, the operation can argue that the "mainstream media is suppressing the truth," converting the debunking into more fuel.
Content produced by an individual bad actor is more likely to be a one-off, more likely to be caught quickly, and more likely to be effectively addressed by platform takedowns or legal action. The harm is often localized β one person, one community, one moment β rather than nationwide.
This distinction is something most people do not make. They see a fake and react to the fake. Knowing who made it, and why, and at what scale, lets you calibrate your response. This is one of the skills that separate analysts from audiences. You are now in the analyst category.
You now see what most people miss: a fake image is not just a false picture β it is the output of a specific kind of creator, with specific resources, operating at a specific scale. Knowing the difference changes how you respond and who you hold responsible.
When platforms like Meta or Twitter/X take down coordinated fake networks, they sometimes remove accounts that belong to real activists who just happened to look like bot networks to the algorithm. Who decides the difference between "coordinated inauthentic behavior" and an organic grassroots movement that happens to be organized? No authority has a clean answer. This is an active policy debate with real consequences for political speech.
You have been given three intelligence briefs β each describes a disinformation incident with some forensic details. Your job is to profile the most likely type of creator and recommend an appropriate response. Your lab partner will challenge your reasoning and ask you to defend your confidence level.
In 2020, EU DisinfoLab and the Atlantic Council's Digital Forensic Research Lab published a joint investigation into a multi-year Russian disinformation operation they called Secondary Infektion. The operation had been running since at least 2014 and had planted fabricated documents, fake quotes, and manipulated images in at least 30 countries across 300 different platforms.
What made Secondary Infektion unusual was not its scale β it was its targeting precision. Each piece of content was specifically designed for a particular audience. In Germany, it spread stories about NATO troops committing crimes. In Ukraine, it fabricated evidence of Ukrainian politicians collaborating with Western intelligence. In the UK, it planted fake documents timed to Brexit debates. In Sweden, it created forged letters purportedly from government officials on immigration policy.
The same operation produced completely different content for completely different audiences β because the operation's architects understood that what makes a community believe something false is not just the fakeness of the content. It is whether the content confirms something that community already suspects. They were not randomly spraying disinformation. They were sniper-scoping specific communities at specific moments of vulnerability.
The Secondary Infektion operation exploited a well-documented psychological principle: confirmation bias. This is the human tendency to believe information that confirms what you already think and to reject information that contradicts it β often without consciously deciding to do so. We all have it. It is not a flaw you can eliminate. But understanding it makes you harder to exploit.
Confirmation bias means that a piece of disinformation does not need to be convincing to a general audience. It only needs to be convincing to the specific audience that already wants to believe it. A fake video of a Ukrainian politician "betraying" Ukraine would be immediately rejected by most Western Europeans β but accepted instantly by Russians who already believe Ukrainian politicians are corrupt. The same content; completely different audiences; wildly different effectiveness.
This is why sophisticated disinformation operations invest heavily in audience research. They study what specific communities already believe, what grievances they carry, what news they already consume, and what evidence format they find most credible. Then they produce content that slots perfectly into those pre-existing beliefs. It is not unlike how commercial advertisers target ads β except instead of selling products, they are selling false realities.
Secondary Infektion researchers did the audience targeting manually β studying communities and crafting content by hand. Modern disinformation operations have a more powerful tool: the recommendation algorithms of social media platforms themselves.
In 2021, Facebook's own internal research (leaked by whistleblower Frances Haugen and published by the Wall Street Journal in September 2021) showed that the platform's algorithm was boosting emotionally activating content β particularly content that made people angry or afraid β because it drove more engagement. Facebook's own researchers described this as creating a "more angry" version of the platform. Instagram's internal research in the same leak showed the platform was aware that its recommendation algorithm pushed some teenage users toward increasingly extreme body image content.
What this means for disinformation is significant: platform algorithms effectively do the targeting work for disinformation creators. A creator posts inflammatory synthetic media; the algorithm identifies users who engage with similar content; it serves the fake to those users; those users β who are already primed to believe it β engage; the algorithm reads that engagement as a signal to push it further. The disinformation creator did not need to personally identify their target audience. The platform did it for them.
This is what makes modern synthetic media disinformation structurally different from propaganda of the past. A pamphleteer in 1940 had to physically distribute their content. A disinformation creator in 2024 can upload one piece of content and let the platform's commercial incentives distribute it to exactly the most receptive audience automatically.
We have covered two ideas: confirmation bias (believing what you already think) and how platforms help spread fakes by automatically showing them to the people most likely to believe them. If you stop here, remember: fakes are aimed at specific people, not everyone β and the internet helps aim them better.
This is the part that matters personally. Every person reading this has a set of beliefs, fears, and identities that make them a specific kind of audience. You care about certain things. You distrust certain institutions. You feel strongly about certain communities. All of that is information β and all of it is available, through your digital behavior, to both algorithms and to adversarial actors who study platform data.
The question is not whether you are susceptible to confirmation bias. You are. Everyone is. The question is: can you recognize the moment when your sense that "this must be true" is being triggered β and pause before acting on it?
Researchers at MIT Media Lab published a study in 2018 (in the journal Science) that found false news spreads six times faster than true news on Twitter, and that the primary driver of that spread is human emotion, not bots. Bots spread both true and false information at similar rates. Humans spread false information faster β particularly when it is novel and emotionally activating.
That finding is uncomfortable. It means that most disinformation spreads because real people β not bots, not Russian servers β choose to share it, without verifying it, because it made them feel something strongly. The targeting works because human psychology cooperates with it.
Knowing this is not a reason to trust nothing. It is a reason to notice the specific feeling that makes you want to share something immediately β and to treat that urgency as a signal to slow down, not speed up.
Most people who share disinformation think they are sharing truth. You now understand why β and you understand the mechanism that makes you vulnerable to the same thing. That knowledge is not comfortable, but it is the single most effective protection you have.
If platform algorithms are genuinely amplifying disinformation because it drives engagement β and if those companies know this from their own internal research β who is responsible for the harm that results? The creator of the fake? The platform? The people who engage? Should platforms be legally required to fix their algorithms, even if doing so reduces revenue? These are live policy debates. There is no agreement. But decisions are being made right now that affect billions of people β including you.
Instead of analyzing content for authenticity, you will analyze it for audience design β figuring out who the creator intended to reach and what existing beliefs they were targeting. Your lab partner will push you to be more specific and challenge you when your reasoning is vague.
In August 2013, as the Syrian civil war entered one of its most brutal phases, a photograph began circulating on Twitter, Facebook, and news websites showing an elderly man kneeling on the ground, surrounded by armed men, apparently about to be executed. The image was captioned as evidence of Syrian government atrocities. It was shared by human rights advocates, journalists, and politicians.
The photograph was real β but the caption was completely wrong. A BBC journalist named Rami Rayan traced the image through reverse image search and found that it had originally been taken in Iraq in 2003, in an entirely different conflict, with an entirely different context. The people who shared it were not liars. They were activists who believed the image was real and matched what they already knew to be true about the Syrian war. Their genuine outrage made them skip verification.
The BBC subsequently published a report identifying dozens of photographs circulating about the Syrian conflict that were misattributed β real images from other wars, natural disasters, even video games, all being used as "evidence" of current events. The people spreading them were not disinformation operations. They were real people who cared deeply and moved too fast.
The Syrian photograph case illustrates one of the most important and least discussed dynamics in disinformation: the person who genuinely cares about truth can be more effective at spreading falsehood than a cynical bot farm.
Why? Because credibility is contagious. When a bot shares a fake image, people who see it β if they notice it came from a new, low-follower account β apply skepticism. But when a trusted human being β a teacher, a journalist, a well-known activist β shares the same image, their credibility transfers. Followers who would have questioned the source now accept the content. The human amplifier has effectively laundered the disinformation through their own social trust.
This is not a bug in human social systems. It is a feature β we evolved to trust the judgment of people we trust. But disinformation operations have learned to exploit it. The final step of a sophisticated disinformation campaign is often not getting bots to amplify content. It is getting real, credible, well-intentioned people to do it instead.
A 2021 paper in the journal Nature Human Behaviour studied how misinformation about COVID-19 spread and found that a small number of highly credible "super-spreaders" β influencers, academics, journalists β were responsible for a disproportionate share of false content reaching mainstream audiences. Most of them were not malicious. They were wrong, and they were trusted.
Credibility laundering is a documented pattern in how disinformation moves from fringe sources to mainstream acceptance. It typically follows this chain:
Step 1: Seeding. A piece of synthetic or manipulated content is placed in a community where it confirms existing beliefs. It is shared within that community but does not yet have mainstream attention. The source at this stage is often anonymous or fringe.
Step 2: Cross-platform migration. Someone from the fringe community shares it to a slightly larger, slightly more mainstream space. A fringe political forum posts it; a mid-size ideological influencer picks it up.
Step 3: The credibility handoff. A genuinely respected person β a journalist, a politician, a scientist β encounters the content in its new, slightly more polished context and shares it. At this stage, the original source has been washed away. What audiences see is a credible person sharing what looks like newsworthy content.
Step 4: Mainstream arrival. Major news organizations, seeing the content being discussed by credible people, either cover it directly or amplify it in their own social media channels. At this point, debunking becomes extremely difficult because the content is now associated with credible institutions rather than its original anonymous source.
This chain took approximately 72 hours in the Syrian photograph case. Modern operations, with optimized distribution, can run the same chain in under 24 hours.
The main idea so far is that fakes often get spread by well-meaning people, not just bad actors. This happens in a chain: a fake starts small, then a credible person shares it, and suddenly everyone treats it as real. If you stop here, remember: the chain of who shared something matters as much as where it started.
You now understand every link in the chain: the motivation for creating synthetic content, the type of actor who creates it, the audience it is targeting, and the credibility laundering process that brings it to mainstream attention. This is the full architecture. And knowing the full architecture gives you exactly one practical tool: you can decide not to be a link in it.
This sounds simple. It is not. The chain works precisely because each person in it believes they are doing the right thing. The activist in 2013 believed they were exposing Syrian government crimes. The mid-size influencer who boosted it believed they were amplifying an important story. The journalist who shared it believed it was newsworthy. All of them were wrong, and none of them were malicious.
The practical behaviors that break the chain are well-established: reverse image search to check if a photo has been used in other contexts; check the original source before the person who shared it; look for coverage from multiple independent newsrooms before accepting a story as verified; and β the most important one β notice when something makes you feel an urgent need to share and treat that urgency as a reason to wait, not act.
One study by researchers at the University of Regina in 2021 found that simply prompting social media users to think about whether content was accurate before sharing reduced the sharing of misinformation by approximately 50%, without reducing sharing of accurate content. Accuracy prompts are now used by Twitter/X and Facebook during certain high-risk periods. But you do not need the platform to prompt you. You can do it yourself, every time.
You have spent this module learning who makes synthetic media, why they make it, who they aim it at, and how it travels. That knowledge is not passive. Every time you are about to share something alarming, you can run the full checklist in about thirty seconds β and choose to be the person who stopped the chain, rather than the person who extended it.
The most dangerous participants in any disinformation campaign are not the creators. They are the well-intentioned people who spread it. You now know this β and you know the specific moment in your own reaction when that chain tries to use you. That awareness is not nothing. It is, according to the University of Regina research, measurably effective. You are now harder to use.
If a journalist, acting in good faith, shares a fake image to 500,000 followers before realizing it is fake β and the debunking reaches only 50,000 of them β are they responsible for the remaining 450,000 who never saw the correction? What obligation does a person with a large platform have to verify before sharing? Should the standard be higher for credible people than for anonymous accounts β and if so, who enforces that? These questions are debated in media ethics classrooms, newsrooms, and courts. No consensus exists.
In each scenario below, you are a person with genuine credibility in your community β a student journalist, a popular school account manager, or a trusted community leader. You have just received alarming content that others are already sharing. Your decision will determine whether the chain continues or breaks. Your lab partner will pressure-test your reasoning before you commit to any action.