The Attack That Doesn’t Need to Break In
Most of us picture a cyberattack a certain way. Someone in a hoodie, lines of code scrolling past, a firewall finally giving way at 3am. That image is comforting in its own strange way, because it suggests a fight you could, in theory, win with better defenses. Patch the system. Train the staff. Hire the right people.
But some of the most damaging operations of the last ten years never touched a server at all. They touched what people believed was true. A state actor doesn’t need to steal your data if it can simply convince enough of your population that an election was stolen, that a vaccine is a bioweapon, that a neighboring country deserves to be invaded for its own protection. No firewall stops a belief that was never under attack in the first place, because nobody built a wall around it.
This is the uncomfortable part. Information operations, disinformation campaigns, coordinated inauthentic behavior, whatever label you want to use, they are social engineering. The exact same psychological mechanics a scammer uses to convince your grandmother to wire money, scaled up and aimed at tens of millions of people at once. Different budget, same toolkit.
Borrowing the Con Artist’s Playbook
Robert Cialdini spent decades cataloguing why people say yes to things they shouldn’t, and almost every principle he identified shows up, intact, in state-level influence operations.
Take social proof. A scammer doesn’t need to convince you directly that an investment is safe. He just needs you to see five other people who seem convinced already. A state-backed influence campaign does the same thing with bot networks and coordinated accounts, flooding a hashtag or a comment section until a fringe opinion looks like the obvious consensus. You’re not being argued into a position. You’re being shown a crowd and trusting the crowd is real.
Or take authority. Cialdini found that people will defer to a lab coat, a title, a badge, almost reflexively. Russian operations during the 2016 US election didn’t just post opinions, they built fake local news outlets with names that sounded trustworthy and regional, borrowing the authority of local journalism without doing any of the actual reporting. The Internet Research Agency in St. Petersburg ran an entire operation structured like a newsroom, shifts and quotas and performance reviews, producing content designed to look like it came from ordinary Americans on both sides of every divide.
And then there’s urgency, the oldest trick in the manipulation book. Create a crisis, real or invented, and people stop thinking slowly. Kahneman’s System 1 takes over, the fast, intuitive, emotionally driven part of the mind, because System 2, the slow deliberate part that actually checks facts, is too tired or too scared to engage. Disinformation campaigns are frequently timed to moments of genuine uncertainty, a pandemic, an election, a war, precisely because that’s when a population’s collective System 2 is already running low.
None of this is new psychology. What’s new is the delivery mechanism. A con artist used to need to find you one at a time. Now the con finds an entire country at once, and it does it automatically, while you sleep.
The Architecture Behind the Noise
It helps to understand that these operations usually follow a structure, even when the content looks chaotic. Researchers who study disinformation, people like Renee DiResta, who has tracked these networks closely, describe a pattern that shows up again and again regardless of which country is running it.
First comes the seed, a small cluster of accounts, sometimes genuinely run by people in the target country who’ve been recruited or paid, sometimes entirely synthetic, planting a narrative in a low-visibility corner of the internet. A fringe forum, a Telegram channel, a comment thread nobody important is reading yet.
Then comes amplification. Bot networks and coordinated accounts pick the narrative up and repeat it, not to convince anyone directly, but to manufacture the appearance of organic spread. This is the part platforms are theoretically best equipped to catch, and also the part that’s gotten dramatically harder to catch as the accounts doing it have gotten better at mimicking real behavior, posting at human hours, arguing with each other, occasionally admitting they’re wrong about something small to seem credible.
Finally comes laundering, the moment the narrative crosses from the fringe into something that looks mainstream. A real influencer picks it up without realizing where it came from. A cable news segment references “online discourse” without checking its source. By the time it reaches most people, the manufactured origin is invisible. It just looks like something everyone is already talking about.
What makes this architecture effective isn’t any single piece of it. It’s that each stage is deniable on its own. A seed account can claim to be one confused person. An amplification bot can hide in a sea of real traffic. By the time the idea is laundered into the mainstream, there’s no clean line back to where it started, which is exactly the point.
Why Democracies Are Easier to Social Engineer Than Autocracies
This part tends to surprise people, but it follows directly from the mechanics involved. Open societies are, structurally, softer targets for this kind of operation than closed ones, and not because their populations are gullible.
A democracy depends on contested information. Debate is the feature, not the bug. Citizens are supposed to encounter disagreement, weigh competing claims, and arrive at their own conclusions, and that entire process requires an open information environment where lots of different, sometimes false, claims can circulate freely enough to be argued about. An autocracy doesn’t need any of that. It can simply control the information environment directly, which is a cruder and in some ways less subtle tool, but one that doesn’t rely on exploiting openness because there isn’t any openness to exploit.
This creates a strange asymmetry. An authoritarian government running an influence operation against an open society is using a tool built for exploiting trust and openness, against a society that has structurally built itself around trust and openness. Meanwhile, trying to run the same kind of covert psychological operation against a tightly controlled information space is much harder, because there’s less organic conversation to seed it into and because the state already owns the loudest channels.
This is not an argument for closing anything down. It’s an observation about why the attack surface looks the way it does. The parts of a democracy that make it worth living in, the free press, the open platforms, the right to argue in public, are the same parts that give a hostile actor something to work with. Hannah Arendt wrote about how totalitarian movements don’t need people to believe their lies exactly, they need people to stop being sure that truth is even knowable, to retreat into a kind of exhausted cynicism where every claim feels equally unverifiable. That exhaustion is itself a goal, maybe the real goal, more durable than convincing anyone of any single false claim.
The Target Was Never the System
Here’s the thing that gets missed when these operations get covered mainly as a cybersecurity story. The goal usually isn’t to make you believe a specific false thing. It’s to make you stop trusting anything, including the true things.
Researchers studying Russian disinformation strategy have described this as a “firehose of falsehood,” a deliberate flooding of channels with high volume, multi-source, often contradictory content. The contradictions aren’t a flaw in the operation. They’re the mechanism. If three different stories about an event are circulating and they all contradict each other, a tired, busy, distracted population doesn’t carefully sort through them to find the truth. Most people just disengage from the whole topic, deciding it’s unknowable, which accomplishes something a single convincing lie never could. It doesn’t win an argument. It cancels the argument entirely.
This matches something Foucault observed about power more broadly, that the most effective forms of control don’t need to forbid anything. They just need to shape what feels like a normal, obvious, unquestionable way of seeing the world, so thoroughly that people stop noticing there was ever a choice involved. A population that has quietly concluded nothing can be trusted is not a population in open rebellion. It’s a population that has been talked out of the energy required to resist anything at all, which is, from the perspective of whoever launched the operation, a cleaner outcome than persuasion ever could have been.
What Actually Builds Resistance
None of this means the fight is unwinnable, but the solutions that work tend to look less like firewalls and more like the kind of media literacy work that feels almost embarrassingly basic until you watch it actually hold up under pressure.
Prebunking, the practice of exposing people to a weakened version of a manipulation technique before they encounter the real thing, has shown real results in research out of Cambridge and elsewhere. It works roughly the same way a vaccine does, a small controlled exposure that builds recognition without requiring anyone to be an expert in geopolitics. You don’t need to know who’s behind a given campaign to recognize the shape of urgency-plus-outrage-plus-crowd-consensus when you see it coming.
The other piece, harder to manufacture but more durable, is simply slowing down. Every single mechanism described here, social proof, authority, urgency, the firehose, depends on speed. They work because people react before they think. The single most disruptive thing an ordinary person can do, with no technical skill required, is build in a pause before sharing something that made them feel a strong emotion fast. Not because the content is necessarily false, but because the feeling of urgency is, itself, often the actual payload.
States have learned to weaponize the fast, intuitive, emotional parts of how humans process information, because that’s where the leverage always was. The counter to that was never going to be a better algorithm. It’s a population that’s gotten just a little harder to rush.
