Let’s be honest: disinformation rarely feels real. We scroll past suspicious memes, skim headlines that make our blood boil, and assume the bots are someone else’s problem. But the UK has just made a very public statement that it is no longer treating online manipulation as a side-show. Andy Burnham recently announced the creation of a National Centre for Information Defence, a new body designed to disrupt coordinated disinformation campaigns from hostile states. It will bring together security services, police, technology firms and government departments, acknowledging what experts have warned for years: this is not a problem any single institution can solve alone. The scale of the threat is hard to overstate. Russia reportedly spends around $2.15 billion a year on information manipulation, while China’s estimated budget is a staggering $10 billion. Add in AI-generated deepfakes, covert digital operations and armies of trolls working around the clock, and you begin to see why a new centre is necessary. State-backed adversaries are using every tool they can find to destabilise democratic governments, and they are doing it simultaneously. Russia, China and Iran are all running operations aimed at the UK and its allies, often coordinating themes and techniques even when their goals differ. The UK’s new agency, if it is to have any real chance, will have to bridge the gaps between government departments, hold the tech giants’ feet to the fire, and still find a way to cooperate with the very platforms that often host the harm. It is a tough brief, and it starts against the clock.
To understand why this matters, you only need to look at recent political history. In a podcast interview, Burnham said there had been clear Russian interference in the UK’s 2016 Brexit referendum, and he later repeated the claim in the House of Commons. That might sound like a throwaway remark, but it was a rare admission from a senior figure. For years, the notion that Russia tried to shape Britain’s most consequential vote in decades was treated as a conspiracy theory in some quarters, even though allegations had been circulating in the media for a long time. Across the Atlantic, the Mueller Report found that Russia interfered in the 2016 US presidential election in a “sweeping and systematic fashion.” In the UK, the Intelligence and Security Committee criticised the government for failing to properly investigate Russian interference in British politics. Meanwhile, the head of MI5, Sir Ken McCallum, said that the UK is dealing with more threats from other states than during the Cold War, and described Russia as “aggressor number one”—though he later clarified that Russia had not succeeded in influencing the Brexit referendum result. This careful dance is typical of the secret state: acknowledging the threat without accepting defeat. But for ordinary citizens, the effect has been confusing. We are told hostile powers are trying to manipulate us, yet we are also told they didn’t succeed. The new centre needs to clear up that confusion, not add to it. People deserve a straight answer about what is happening, what has already happened, and what can still be done.
Disinformation itself is as old as the hills. Trickery has always been a fundamental instrument of geopolitical conflict, and election interference is nothing new. But in the age of artificial intelligence, something has changed. Modern disinformation operates with unprecedented speed, precision and creativity. It can produce fake videos of politicians saying things they never said, fabricate entire news articles, and target individual voters with messages designed to exploit their anger, fear or hope. It is deliberately designed to operate in the shadows and to fall just beneath the threshold for war. That is the whole point. Why bother lobbing weapons at an adversary if you can destroy their morale, erode their trust in democracy, and make them question their own institutions? A hostile state will happily spend more on disinformation if it means spending less on costlier conventional weapons. And there is an even more attractive benefit: states are far less likely to be held accountable for damage caused by a fake account or a manipulated video than for damage caused by bombs. This is asymmetrical warfare in the truest sense. The UK and its allies are being tested not on the battlefield, but in the messy, emotional, information-saturated space where citizens decide who to trust and what to believe. That makes the challenge personal for everyone, not just for intelligence agencies.
So who exactly is doing this? The primary threats to UK democracy come from Russia, China and Iran, with North Korea playing a smaller but still worrying role. Russia relies on a strategy called “reflexive control.” The idea is to manipulate citizens in target countries into behaving in ways that benefit Moscow—whether that means voting for a particular candidate, losing faith in a leader, or turning against an alliance like Nato or the EU. The goal is to paralyse political decision-making and fracture alliances from within. China takes a different approach through its “three warfares” strategy: psychological, public opinion and legal domains. Beijing might try to shape narratives around trade, Taiwan or the origins of COVID, or use digital deception and intimidation to win support in disputes over borders and the South China Sea. The aim is to break resistance without ever firing a shot. Iran, meanwhile, invests heavily in cyber-influence operations. It has sought to stoke dissent over Scottish independence, leak information on Iranian dissident journalists, and attack critical infrastructure such as power plants. These actions are designed to undermine regional stability, radicalise target groups and manipulate public debate. North Korea uses similar tactics, but with a sharper focus on espionage, disruption and theft. The infamous WannaCry ransomware attack in 2017, which crippled 61 NHS organisations including hospitals, is widely believed to be North Korea’s work. These are not abstract threats. They have disrupted real lives, real institutions and real elections.
The UK is particularly vulnerable because its main adversaries target the democratic process itself. They see democratic institutions, election campaigns and referendums as the country’s “centre of gravity.” If you can disrupt an election, you can shake the very foundations of a democratic nation. The UK’s vulnerability was laid bare in a 2021 report by the Intelligence and Security Committee. That report revealed that Russian interference in British politics was far more widespread than previously admitted. Social media manipulation, illicit financial flows and cyber-operations were all listed as tactics. The committee concluded that the UK had seriously underestimated the Russian threat. Even more troubling, the intelligence services were accused of not investigating credible allegations of foreign interference during the 2014 Scottish independence referendum and the 2016 Brexit vote. This reluctance to scrutinise foreign interference created space for hostile adversaries to exploit. Since the UK showed support for Ukraine, the threat has only worsened. Former national security adviser Lord Ricketts recently warned that the UK faces the threat of cyber-attacks on its banking systems, energy grids or water supplies as the Kremlin tries to undermine public support for Ukraine. We are no longer talking about a distant problem. This is about the security of the systems that keep the country running and the trust that keeps society together. The new centre will have to act with a sense of urgency that previous responses have lacked.
What should the National Centre for Information Defence actually do? It has to do more than simply rebut disinformation after it has already spread. It needs to expose people to the manipulation tactics they will encounter, so they can recognise them before they fall for them. Public awareness campaigns, built on the model of initiatives like Project Servator or See It, Say It, Sorted, could teach citizens to spot suspicious behaviour online just as they are taught to spot suspicious behaviour in train stations. But resilience requires more than awareness. It requires stronger media ecosystems and digital platforms that are willing to take responsibility for their own algorithms. Social media companies need to enforce stricter rules, make algorithms more transparent, and remove fake accounts much more quickly. Governments also have tools at their disposal. Sanctions against individual perpetrators could include naming and shaming, freezing assets or imposing travel bans. The 2023 National Security Act criminalised covert foreign interference, but legislation is only useful if it is enforced robustly. Fines could encourage digital platforms to comply, but governments must also do more to freeze hostile states out of diplomatic relations and coordinate condemnation through alliances such as Nato, the EU and the G7. Above all, the new centre needs to be properly resourced—in funding, capability, human resources and the freedom to act. And it should not be purely defensive. Boxers don’t simply parry their opponents’ punches; they have to land their own. If the UK wants to win the information war, it cannot afford to sit back and wait for the next attack. It has to go on the front foot, expose the manipulators, and protect the public before the damage is done.