In the lead up to the Russian invasion of Ukraine in February 2022, several intelligence agencies and diplomatic sources of the United States of America accused the Russian Federation of preparing several “false flag attacks” on Ukrainian territory in order to justify its invasion [source]. After this accusation, Russian state media sources and government aligned groups would flood the internet with accusations and falsified imagery of the Ukrainian government deploying chemical weapons on civilians [source]. False flag operations are often the tool of governments justifying military or other forms of armed action, and understanding their use is key to spotting falsified casus belli or aggressive action.
1.0. What are false flag operations?
False flag operations are tradecraft operations with the intended goal of pinning responsibility for an act on a separate actor than oneself. Actors conduct false flag operations in all domains of war:
- Ground: Violent Extremist Organisations (VEOs) have conducted terror attacks in uniforms of national armed forces to start wars.
- Air: customary international law requires aircraft to be marked with national origin, as well as designations of military use in order to safeguard civilian aircraft.
- Naval: Vessels are flagged with national origin and military character by international law.
- Cyber: The Russian Main Directorate of the General Staff of the Armed Forces of the Russian Federation (GRU) has previously conducted cyberattacks and attempted to disguise these attacks as being North Korean in nature [source].
- Space: There are no known attacks of this nature, however, the ability to utilise cyberwarfare under disguise against satellite networks remains a serious threat.
1.1. Historic origins
The terminology of the false flag operation originates from the 16th century, to the Golden Age of Piracy as global powers found their shipping lines often under attack. Pirates utilised national flags in the 16th century in order to approach unsuspecting merchant ships [source]. However, historically ships at sea had no compulsion against utilising false flags, with even state ships using the technique to get closer to enemy vessels [source]. With limited ability to see flags at sea in the distance, especially in times of poor weather, sailors could not reliably determine even correctly flagged ships, and as a result, false flags were generally very effective.
However, vessels generally removed their false colours before firing upon other vessels, out of a code of honour. Even pirates did so [source].
2.0. Why are false flag operations important?
States have utilised false flag operations to justify and precede countless acts of hostilities, to little or to great effect. The difference between a properly executed false flag and a poorly executed one can mean the difference between an internationally legitimate war and an internationally condemned war. For example, in a successful case, the Gulf of Tonkin incident allowed US President Lyndon B. Johnson to escalate American involvement in attacking North Vietnam, despite much of the incident never actually occurring [source].
In addition to justifying wars, these operations can undermine opponents credibility and other attributes on a national or international stage, convincing others of culpability for an action they did not commit. Success of such operations can drastically change a tactical or strategic situation, whether it be in economic conflicts between trading powers or even opponents campaigning against each other in an election.
3.0. How is a false flag operation conducted?
The sensitive nature of these operations cannot be understated, as their maximum impact is delivered only if the ability to retain the disguise lasts for as long as possible. By keeping responsibility pinned to a target, repercussions against the actual perpetrator can be prevented, and additional damage to reputation or even other attributes through responses from others can be expected.
Though some level of success can be achieved even through a failed operation, the consequences of failure can outweigh these benefits, as false flag operations are viewed as dishonourable or even illegal in certain circumstances. For example, the use of the Red Cross or Red Crescent marking in an attack violates widely agreed upon international laws such as the Geneva Conventions.
The conduct of such an operation also remains specific to its domain and theatre. Strategies and tactics in one domain or theatre may not carry over to another. Impersonating the agents of another state, for example, becomes much easier when conducting an operation in an environment with low surveillance capacity, and while impersonating agents of a state with little ability to provide an alibi. Furthermore, one’s own agents become a liability in this case, as their responsibility must be unknown or silenced through other methods.
4.0. Tips and tricks for false flags
A false flag operation will generally also benefit from the continued maintenance of the escalation ladder. A state avoiding escalation beyond proportional response can mitigate or avoid the consequences of failure or inevitable detection. Indeed, the more limited the scope of the operation in terms of achieving a concrete objective, the better.
For example, Russia’s “little green men” did not organise mass violence. By using existing local forces that were already present in Ukraine, Russian conventional forces were able to walk into Crimea in 2014, creating mass confusion and delaying any response from being effective. Within days, Russia had occupied the region and faced little to no resistance in doing so. A paralyzed Ukraine could only watch helplessly, while powers such as the United States were only able to respond with sanctions. The scope of the false flag operation remained only to conceal the movements of the first moving Russian forces. States disbelieving the validity of the Russian account did not matter nearly as much after the success of the operation [source].
4.1. Alternative executions
Additionally, the use of force itself may not be necessary. Achieving concrete political, strategic, or tactical achievements through a false flag operation may only require the threat of force, rather than its actual use. This can occur through forcing response measures to such a threat and the imminent danger of an attack or espionage operation, such as precautionary evacuations or even preemptive strikes. For example, Belarusian authorities utilised false bomb threats against Ryanair flights in order to force a landing in Belarus and arrest a dissident journalist aboard the plane [source]. Without committing an act of war, or the use of any force, Belarusian officials achieved political objectives, albeit at great cost to Belarusian economic, diplomatic and aviation standing, as the European Union and the United States responded with heavy sanctions and the avoidance of Belarus in all approved flight paths.
Another consideration should be whether it is necessary to conduct the operation against another target, when conducting one against one’s own state may produce similar justifications or results As minimising external view of the operation is paramount, conducting false flag operations against one’s own assets can allow greater control over all conditions of the operation, and still allow different actors to be blamed. An organisation proving that its assets were not involved can be difficult to prove in time for the operation’s political, strategic or tactical goals to complete.
5.0. Common mistakes to avoid
States have also organised a number of failed false flag operations over the centuries, and many of them have become footnotes to history as a result of the failures. Even failed operations, however, can provide strategic and tactical value to grander strategy.
For example, Nazi Germany justified its invasion of Poland in 1939 on the value of self defence, after fabricating a Polish raid on a German radio installation the night before the invasion [source]. Germany failure to convince Western sources of this attack, leading to this incident being relegated. The truth remained that German aggression and buildup at the border had occurred beforehand unprovoked. However, its immediate effect of creating confusion for the cabinets of France and Britain did delay a response, achieving at least part of its objective as German planes bombed Polish civilians the morning after.
6.0. Tools and resources
The International Spy Museum’s instructive video on the People’s Republic of China’s cyberwarfare operations demonstrates the tactics and strategies used by actors who benefit most from false flag operations, and rely a great deal on disguising operations as non-state operations.
7.0. Frequently Asked Questions
Due to the nature of false flag operations, many of them have been critical moments in history, and as a result many questions have occurred.
1. Are false flag operations common today?
Depending on the theatre, they may be. While they are not common on ground and certainly not common in the naval, air or space domains, it is extremely common for cybercrime and cyberwar to disguise themselves as other actors to pin blame and avoid one’s own culpability.
2. Are false flag operations impossible in the age of social media?
Despite the difficulty of now conducting a false flag attack due to the ease with which information flows to states, the effect of a false flag operation on the general public is likely stronger than ever due to the ability of an actor to disseminate false information.
3. Are there specific downsides to conducting a failed false flag operation?
Absolutely. By failing, an actor can seriously jeopardise their position in the international community and delegitimize further action. For example, many states within the international community use the Gulf of Tonkin incident as a point of order against American military strategic priorities.
8.0. Advanced techniques
Conducting a false flag operation with the design of accepting even a failure will be key to a strategy, as a number of factors can go wrong, and one should assume that the disguise will not last long. Few false flag attacks in the 20th century were able to hide the truth for longer than a matter of weeks or months, and those that were able to are infamous to this day. Furthermore, those conducting this operation should reinforce it with vast information dissemination campaigns in order to control the tide of information. This will create confusion in electorates and decision makers alike.
9.0. Case studies
Human history is full of false flag operations, but some standout cases are:
- Most famously, the Gulf of Tonkin incident. American naval vessels off the coast of North Vietnam in the Gulf of Tonkin reported attacks from North Vietnamese coast guard vessels. However, the US’ National Security Agency published documentation confirming the first attack to have been likely an attempt to recover personnel, and the second attack is unlikely to have occurred at all. NSA officials provided the then administration of President Lyndon B. Johnson with reports indicating that North Vietnamese vessels had attacked US destroyers in the Gulf, beginning the largest section of US involvement in Vietnam [source].
- The Soviet Union shelled its own territory of the village of Mainila, and used the damage to justify the start of the Russo-Finnish War of 1939, by blaming Finnish military units for the artillery bombardment. Though it is now clear that members of the Soviet Union’s People’s Commissariat for Internal Affairs conducted the attack, the false flag provided the Soviet Union with domestic support for the war and diminished global response to the war [source].
10.0. Conclusion
Identifying a false flag operation without the intelligence available to states can be difficult, but it’s important to keep in mind that many false flag operations conducted by states in the past have not been advanced. By investigating deeply into acts of hostility or incriminating actions and keeping in mind the possible missing links, spotting a false flag can be easier than expected, as they do not necessarily have to be foolproof to be successful.
