Cyber operations have traditionally been evaluated by their ability to penetrate networks, steal information, or destroy/disrupt information systems. But how does the same approach apply when the goal is not to control or impact the computer, but to influence the person sitting behind it? More importantly, what if the measure of success is not stolen or manipulated data, but if a decision is changed, confidence is undermined, or partnerships weakened. This is the significance of cognitive warfare.

Cognitive warfare has garnered much attention and with good reason. It extends beyond conventional propaganda and disinformation, seeking to sway how individuals and groups perceive information, interpret events, make decisions, and ultimately behave. The Institute for the Study of Wardescribes it as a means of shaping an opponent’s reasoning and actions to achieve strategic objectives, potentially without the costs associated with direct military confrontation.

For states competing in today’s interconnected environment, cyber operations and cognitive warfare are fast becoming complementary tools of influence. The former can compromise the systems through which information streams; the latter can exploit the end user and how that information is perceived. Given the numerous channels available to individuals and organizations through which they consume news, the implications for U.S. national security are significant.

It’s important to state up front that cognitive warfare is not just another term for a disinformation campaign. Its strategic objective can be much broader: to shape the decision-making environment in which a target audience operates. In a digitally driven age, cyber operations provide the perfect vehicle to accomplish that goal. Threat actors can steal sensitive communications, leak and manipulate documents, compromise trusted websites, impersonate individuals/organizations, especially during key geopolitical moments. A properly executed influence campaign can amplify the impact, exploit uncertainty and advance competing interpretations. The value is from the combination of both cyber and cognitive efforts.

A cyber intrusion might yield the type of information whose selective release could be used or crafted to create a deceptive impression of an issue. A coordinated network of online personas can help push a position, and make it appear widely accepted. Hampering network functionality is a temporary disruption while shaping public perception that favors a particular narrative can promote government incompetence, sway electorates, and cause enough friction to destabilize or at least purposefully fracture public sentiment.

The Council on Foreign Relations has observed that cyber operations targeting Taiwan have frequently overlapped with information operations, showing how such activity can serve a broader effort to affect perceptions rather than simply compromise a network. The objective is not necessarily to convince an entire population of a particular fiction. A well-manufactured effort just needs to generate doubt, deepen existing divisions, call into question typically authoritative information, or make leaders think twice before making a decision. That is an attractive option for adversaries seeking to achieve strategic effects at relatively low cost.

The threat is not theoretical, and there have been several documented examples that show how cyber-enabled influence operations go beyond the compromise of a targeted network.

• Russia’s Doppelganger Campaign. Operation Doppelganger is an example of cognitive warfare supported by cyber infrastructure. Doppelganger was a Russian threat actor-linked operation that created false versions of legitimate news websites, including recognizable European media brands. These sites distributed misleading articles and promoted pro-Kremlin stories, including claims designed to weaken support for Ukraine and portray Western sanctions as harmful to European populations. Notably, this activity also used fake social media accounts to expand its content. By exploiting known European media brands, the campaign intentionally exploited the credibility associated with established news outlets, blurring the lines of real reporting and fabricated stories. A public unable or unwilling to verify content further helps weaken confidence in the information and the sources providing it.

• Iran’s 2024 U.S. Election Hack and Leak. In August and September 2024, the FBI, Office of the Director of National Intelligence, and CISA publicly attributed influence operations targeting U.S. elections to Iranian operators. Per their joint statement, these threat actors compromised accounts affiliated with a presidential campaign, attempting to distribute stolen data to individuals connected with another campaign, as well as media outlets. Ultimately, the Department of Justice indicted three Islamic Revolutionary Guard Corps cyber actors tied to the operation. This campaign showed stolen information can become an instrument of influence, with data being selectively leaked without additional context to encourage public controversy and social friction. What’s more, it shows that information doesn’t have to be fabricated to accomplish this, and authentic documents can be weaponized when stripped of context.

• Russia’s Cyber Operations Against Ukraine. Russia’s invasion of Ukraine demonstrated how destructive cyber operations factor into military strikes, as well as information warfare. According to Microsoft reporting, Russian actors conducting cyber intrusions and destructive attacks alongside kinetic operations, targeting government networks and critical infrastructure. These activities threatened essential services further promulgating an already messy information environment. Notably, the goal was not to persuade every Ukrainian of a specific message. Rather, the combination of service disruption, questionable information, and creating uncertainty about the government’s ability to protect its citizens compounded the pressure on Ukrainian leadership, and public sentiment. In essence, the conflict has shown how technical disruption coupled with cognitive effects can reinforce each other.

Recommendations for U.S. Policymakers

Cognitive warfare requires a coordinated response that connects cybersecurity, intelligence, diplomacy, public communication, and democratic resilience. It cannot be addressed in a vacuum or just as a content moderation problem. What’s more, generative artificial intelligence (AI) is only going to expand this problem at scale, requiring policymakers to look out at how cognitive warfare will ostensibly evolve and quickly. Things to consider:

• Integrate Cognitive Threats into Cyber Threat Intelligence. Agencies need to strengthen the incorporation of influence operation indicators into cyber threat intelligence processes. Technical and narrative patterns need to be weighed in tandem with one another with the idea of understanding the entirety of an activity/campaign, not just the malware or message tied to it. Attribution should be based on corroborated evidence, with uncertainty clearly communicated.

• Ramp Up Public-Private Information Sharing. As evidenced in the Doppelganger

investigations, the value of collaboration among civil society, researchers, platforms, and authorities can be crucial in identifying and responding to coordinated campaigns. All facets in our digital society have different pieces of the threat picture that need to be amalgamated and contextualized. Established channels for sharing threat and behavioral indicators can help identify cyber-enabled influence campaigns earlier.

• Public Education is Essential. Public commitment to verifying sources and media accountability are critical in identifying manipulated content before it can take hold. The digital space is too vast to moderate effectively. An aware and educated populace can aid in recognizing influence campaigns early.

• Establish Measurable Indicators of Impact. Impact assessments should not rely on the number of posts removed or sock puppet accounts disabled. Understanding the reach, persistence, and observable effects of decision making or public behavior are far more meaningful measurables that can be leveraged to understand psychological and/or political results. This can help provide countermeasures for future efforts.

Cognitive warfare will likely become more tightly integrated with cyber operations particularly as more threat actors adopt AI, which can increase the scale and diversity of these activities. Divisions in the larger geopolitical environment will offer real events and incidents that will undoubtedly be mined for content that will drive future campaigns. The extent to which adversaries can sustain a large volume of credible looking material will likely rest in how they can effectively use AI, and how the same technology can detect such campaigns.

Because the results of cognitive warfare may be sufficient to make the truth difficult to establish, this puts the public front and center. They are the main target and therefore the first line of defense. The public’s ability to reclaim its cognitive sovereignty will be instrumental in lessening the impact of cognitive warfare. But it will require rigorous ongoing stewardship and for individuals to be responsible consumers of information. That means they will have to be judicious in how they approach news and be willing to corroborate it independently. Because in a time where states are competing in the cognitive space, critical thinking is no longer just a virtue; it is a civic duty.

For more on Cognitive Warfare see:

• Decision Intelligence and Establishing an Intelligent Enterprise
• America’s Most Critical Infrastructure is also Our Most Neglected Infrastructure
• C-Suite Considerations Regarding Current Geopolitical Tensions
• National Cognitive Infrastructure Protection:  What Can We Learn from the Swedish Psychological Defence Authority? 
• Unlocking Intelligence Analyst Excellence: New Frontiers in Neuroscience for Cognitive Performance
• Weaponizing Perception: China and Russia’s Cognitive Warfare Against Democracies
• Beyond the Ballot: Network States as Strategic Experiments and the Challenge to State Power
• DHS National Terrorism Advisory System Bulletin: Summary of Terrorism Threat to the United States (November 2022- March 2023)
• OODA CEO Matt Devost and OODA Network Members Review the OODA Almanac 2023 – Jagged Transitions
• How Accelerationism, Stochastic Terrorism, and Networked Power Challenge the Nation-State
• Look to Sweden for Innovative Offensive and Defensive Signals from Europe
• John Robb on the Early Internet, Frameworks to Drive Decision Making, Network Tribalism and Emerging Threats (1 of 2)
• An Introductory Q&A with OODA Senior Advisor and Network Member Chris Ward
• Open-Source Intelligence Resources: The EU Disinformation Lab’s Ukraine Conflict Resource Hub
• What You Need To Know About Hostile Social Manipulation
• FBI AND CISA Public Service Announcement: Malicious Cyber Activity Against Election Infrastructure Unlikely to Disrupt or Prevent Voting
• Sweden’s Psychological Defense Framework for Resilience and Strategic Communication