The Hidden Truth About NATO’s Fight Against Disinformation

In a remarkably candid moment of self-reflection, NATO’s own research arm has admitted what many security experts have long suspected but few dared to state publicly. The NATO Strategic Communications Centre of Excellence, headquartered in Riga, Latvia, has published a report that essentially concedes the Alliance’s favorite weapons against foreign disinformation might not be working as intended. The document, written by researcher Thomas Colley and released in July, carries the weighty title “Counter-FIMI: The Case for Disrupting Hostile Actors,” but its message is surprisingly humble. For all the sanctions imposed, accounts closed, and criminal cases filed against Russian and Chinese information operations, NATO acknowledges it simply lacks solid evidence that any of these measures actually deter these countries from continuing their manipulation campaigns. It’s a confession that cuts to the heart of how Western democracies have approached the information war, suggesting that the tools we’ve been wielding with such confidence may be blunter than we’ve believed.

The report draws a crucial distinction between what it calls “tactical” and “strategic” disruption, and this distinction reveals why our current approach may be fundamentally flawed. Tactical disruption is what social media platforms do every day: removing content, closing accounts, and taking down posts that violate their policies. This is the visible, measurable work that produces satisfying statistics and impressive quarterly reports from tech companies. Strategic disruption, by contrast, is the heavier artillery: sanctioning individuals and organizations, prosecuting them in courts, and publicly exposing their operations, all with the goal of making their activities too costly and risky to continue. While tactical measures can be counted in closed accounts and deleted posts, strategic disruption is what should actually change behavior at the highest levels. Yet here’s the uncomfortable truth the report acknowledges: there is almost no evidence that strategic disruption has convinced anyone to stop what they’re doing. Despite years of sanctions, indictments, and public exposés, the disinformation campaigns haven’t stopped, and the actors behind them haven’t been meaningfully deterred.

The case of RT, formerly known as Russia Today, provides perhaps the most painful illustration of this problem. When the European Union banned the channel in March 2022, the immediate results looked spectacular: search traffic dropped by 100%, social media engagement fell by 70%, and even global traffic declined by 18%. Any communications department would have framed these numbers as a resounding victory. But within months, RT had rebuilt its reach using mirror websites and intermediary channels that circumvented the bans. The report itself reluctantly acknowledges that these measures achieve what it diplomatically calls “slowdowns, not shutdowns.” Even the more recent case of Tenet Media, where U.S. justice officials shut down an operation in which RT paid ten million dollars to American influencers who had no idea about the money’s origin, hasn’t stopped Moscow from funding similar ventures. The pattern is consistent and discouraging: Western governments score impressive legal and regulatory victories on paper, but the disinformation machinery keeps operating, adapts its methods, and finds new avenues for reaching audiences.

Other examples reinforce this sobering conclusion, each with its own particular lessons about the limits of sanctions. Take Evrazia, a Russian network operated on behalf of oligarch Ilan Shor, which was sanctioned by the EU in October 2024 and by the UK in April 2025 after channeling roughly fifteen million dollars to 130,000 Moldovan voters before the EU accession referendum. Then consider the Social Design Agency and its partner Structura National Technologies, sanctioned by the UK in October 2024 for running Doppelgänger, the campaign of cloned websites that has targeted France, Germany, Ukraine, the UK, and the United States since 2022. An EU DisinfoLab investigation in January 2026 found that months after being formally sanctioned, the Social Design Agency still maintained functional access to intermediaries in Estonia, cover services in Germany, hosting in the Netherlands, and advertising in Ireland. Two different targets, but the same troubling lesson: sanctions exist on paper, but the business continues to operate and bill its clients as if nothing happened.

Perhaps the most provocative element of the report is its uncomfortable historical comparison. Colley suggests that the current approach to measuring success in countering disinformation resembles the “body count” doctrine that the United States applied during the Vietnam War. In that conflict, military commanders counted destroyed enemy vehicles and estimated enemy casualties as proof of progress, even as the underlying political situation deteriorated. The parallel is striking: counting eliminated accounts, exposed campaigns, and signed sanctions may feel like progress, but it doesn’t necessarily prevent the underlying information war from being lost. Identifying and taking down content is worthwhile, Colley argues, but reducing disinformation to a technical exercise of “killing” publications confuses the thermometer with the cure. It’s a way of measuring activity rather than impact, of celebrating outputs rather than outcomes. The metrics look good in reports and press releases, but they don’t capture the real question: are we actually changing the strategic calculus of those who wage these campaigns?

As an alternative, the report proposes a framework called PERSISTENCE, which consists of twelve factors ranging from political and economic considerations to escalation risks and international cooperation. This framework is designed to help governments decide, case by case, whether sanctioning or exposing a specific actor is worth the potential costs, or whether the risk of retaliation outweighs any likely benefit. It represents a fundamental shift in thinking, acknowledging that there is no universal button against disinformation, no one-size-fits-all solution that can be applied mechanically to every situation. Each decision to “attack” a foreign information manipulation operator requires careful weighing of context, not the rote application of a protocol. This is a more mature, more nuanced approach, but it also demands something that many governments lack: the patience, expertise, and political courage to make difficult judgment calls rather than reaching for the nearest available tool.

Yet for all its insight, the report also reveals a troubling geographic narrowness in its perspective. Every case it cites involves the same familiar capitals: Brussels, London, Washington, and Taipei. Small and medium European states appear nowhere on this list, neither as countries that impose sanctions nor as countries whose courts open cases against foreign disinformation operators. This absence doesn’t mean that Russia and China have left these nations alone, because foreign information manipulation rarely respects borders. A country that doesn’t appear on sanctions lists may simply have chosen not to act, or may lack the capacity to do so effectively. The report makes clear that strategic disruption requires resources that few European governments currently possess: the evidentiary infrastructure to build a legal case, the judicial framework to sustain sanctions through courts, and the political will to accept the risks of retaliation that come with publicly accusing a state actor of hostile activities. Until more European capitals close this capacity gap, stopping foreign disinformation will remain something that others do on their behalf for much of the continent.