SJUK hears exclusively from Thomas Drohan, Co-Founder and CSO at Clue Software about how the National Centre for Information Defence can target and disrupt coordinated disinformation campaigns, tackle AI-driven information manipulation and strengthen the UK’s resilience against hostile influence operations.

The World Economic Forum identifies disinformation as one of the world’s most significant risks.

Advances in AI and synthetic media are making it easier and cheaper for threat actors to identify, target and influence specific audiences at scale, using tailored content to manipulate perceptions, deepen divisions and undermine trust

The newly announced National Centre for Information Defence (NCID) has been established to protect web users from coordinated hostile information operations.

Its stated goal is to detect, attribute and disrupt these campaigns; the critical test will be whether it can translate that ambition into effective action against the actors, infrastructure and methods behind them.

The weaponisation of opinions around the 2024 Southport incident, for example, resulted in extreme social unrest and violence.

High profile figures utilised now deleted social media posts to push unverified and unsubstantiated messages, resulting in social division, riots and targeted harassment of vulnerable groups.

The planned centre’s intent is to overhaul how agencies respond to these threats.

This means moving beyond rebutting harmful or inaccurate content.

Rather to identify the coordinated activity, infrastructure and actors that use it to obfuscate malicious activity, create division and manipulate public debate.

This means detecting, attributing and disrupting hostile information operations by treating individual narratives and posts as evidence of a wider coordinated campaign, rather than as the primary target.

The challenge, however, is whether it becomes operationally effective and network-focused, rather than simply a monitoring and reporting function.

How coordinated influence networks operate

Hostile information operations often rely on distributed networks whose activity appears fragmented but functions as a connected system.

Different actors, accounts and channels can perform distinct roles, spreading operational risk and complicating attribution.

Removing one part of the network therefore does not prevent the wider campaign from continuing.

The Doppelgänger campaign demonstrates the potential scale of the issue, where Russian-backed actors undermined public support for Ukraine by imitating global media organisations and public institution websites.

These included NATO, the French Ministry of Public Affairs and the German Ministry of the Interior.

These networks can divide activity across multiple actors: some create or amplify misleading narratives, while others manage infrastructure, target audiences or coordinate cyber-enabled activity.

Obfuscation and hiding in plain sight are central to this model. By distributing activity across apparently separate accounts, platforms and intermediaries, hostile actors can divert attention, obscure coordination and increase the likelihood that manipulative campaigns achieve their intended effect.

Where AI fits into the picture

New, innovative AI tools increase the potency of this risk.

They can boost the rate at which disinformation campaigns can be executed and their sophistication in socially engineering opinions or even democratic processes.

They can also be used to push messaging the use of synthetic media.

Take, for example, the widespread use of generative AI and deepfake technology for political gain.

These tools can weaponise opinion against minority or vulnerable communities while giving opportunists plausible deniability to obscure the truth.

They also expand the scope of social media manipulation, enabling campaigns to operate faster and in some cases, autonomously.

How the NCID can dismantle disinformation networks

Fundamentally, for the NCID to succeed, it must become operationally effective and network-focused rather than another monitoring and reporting function.

That requires investigative capabilities that connect individual posts to the actors, infrastructure and coordinated activity behind them, enabling the centre and its partners to attribute campaigns and identify opportunities for disruption.

Those investigations can also reveal which platforms, audiences and systems are being exploited, allowing the NCID to strengthen resilience against future campaigns.

In the right hands, AI can strengthen these investigative capabilities by analysing fragmented information at scale, identifying patterns across accounts and platforms, and revealing links between content, infrastructure and actors that investigators might otherwise miss.

Used alongside human analysis and shared intelligence, it can help the NCID and its law-enforcement partners build a clearer picture of each network and identify where disruption will have the greatest effect.

Removing one part of a network does not stop the wider flow of manipulative content.

The NCID must therefore trace the infrastructure and people behind each campaign and foster closer collaboration between international intelligence agencies and law enforcement.

The Five Eyes alliance demonstrates the value of cross-border intelligence cooperation when threats span jurisdictions.

Better information sharing and stronger long-term partnerships will enable authorities to disrupt emerging threats more quickly and proactively.

International models point in the same direction.

France’s VIGINUM, Sweden’s Psychological Defence Agency and the EU’s framework for addressing foreign information manipulation and interference focus on understanding coordinated hostile activity, exposing the networks behind it and strengthening societal resilience.

In this approach, a misleading narrative or individual piece of content is treated as a symptom of an operation rather than the sole target.

For the NCID, this means tailoring its response to the environments in which disinformation networks operate.

For example, high mobile adoption may create different vulnerabilities from those found in mature digital economies, where AI-enabled deepfake impersonation is more prevalent.

Recognising these variations will help the centre anticipate how campaigns may evolve across jurisdictions and work with collaborative agencies.

What operational effectiveness should look like

Ultimately, the NCID’s success will depend on whether it can translate its stated ambition into sustained operational capability: identifying coordinated hostile activity, mapping the networks and infrastructure behind it and working with partners to disrupt them.

AI can support this work by consolidating fragmented information for intelligence and policing agencies, even as threat actors use the same technology to increase the scale and effectiveness of their campaigns.

The NCID cannot deliver meaningful change in isolation.

Hostile information operations cross borders, and fragmented investigations will struggle to identify or disrupt the networks behind them.

The centre must therefore build strong partnerships with international agencies to share intelligence, learn new strategies and coordinate efforts to identify, track and dismantle these campaigns.

Thomas Drohan is Co-Founder and Chief Strategy Officer at Clue Software. He is a senior leader with a background in technology and deep experience shaping intelligence and investigation software alongside real-world users. Thomas works closely with customers and the market to understand evolving challenges, ensuring Clue’s products and services remain practical, trusted, and effective in complex, high‑stakes environments.