Hero image: Google DeepMind / Pexels

Unrestricted Warfare: How Adversaries Exploit Liberal Democracies

Adversarial information operations are evolving beyond traditional espionage and propaganda, weaponizing social platforms, media ecosystems, and institutional trust to destabilize liberal democracies. This investigation examines how unrestricted warfare tactics exploit open societies, and what can be done to counter them.

Liberal democracies rely on open discourse, free press, and institutional transparency—features that adversaries increasingly target not through direct military confrontation, but through coordinated information warfare. The concept of “unrestricted warfare,” as articulated in a 1999 treatise by Chinese strategists Qiao Liang and Wang Xiangsui, has evolved from a theoretical framework into a practical playbook for state and non-state actors seeking to undermine democratic cohesion. These operations do not merely spread disinformation; they exploit the very architecture of democratic societies—social media algorithms, journalistic norms, and public trust—to amplify division, erode legitimacy, and manipulate policy outcomes. This article examines how adversarial information operations function within liberal democracies, identifies their mechanisms, and assesses responses and defenses.

The Rise of Unrestricted Warfare in the 21st Century

Unrestricted warfare represents a departure from Clausewitzian notions of war as a continuation of politics by other means. Instead, it reframes conflict as a continuous, multi-domain struggle where economic, cultural, legal, and informational instruments are deployed simultaneously and without clear declaration. According to the Small Wars Journal analysis, this approach emerged in response to the overwhelming conventional military superiority of the United States and its allies, prompting adversaries to seek asymmetric advantages through non-kinetic means. The strategy is not confined to nation-states; transnational groups, criminal syndicates, and even individual actors can participate in such operations, leveraging digital platforms to amplify their reach and impact.

The evolution of unrestricted warfare has been accelerated by the digital revolution. Social media platforms, once celebrated as tools of democratization, now serve as vectors for coordinated inauthentic behavior. Adversaries exploit the speed of information dissemination, the opacity of recommendation algorithms, and the emotional reactivity of online audiences to inject narratives that bypass traditional gatekeepers. The result is a persistent, low-intensity conflict environment where truth becomes contested terrain and public consensus is fragile. This shift has blurred the line between war and peace, making it difficult for democratic institutions to recognize, attribute, or respond effectively to ongoing campaigns.

Critically, unrestricted warfare is not bound by geographic borders. Information operations launched from one jurisdiction can have cascading effects across multiple democracies, particularly when amplified by automated networks and algorithmic amplification. The Small Wars Journal article emphasizes that this globalized nature of information warfare demands a coordinated, international response—one that recognizes the interconnectedness of digital ecosystems and the shared vulnerability of open societies.

How Adversarial Information Operations Target Liberal Democracies

Liberal democracies are uniquely susceptible to adversarial information operations due to their commitment to free speech, open debate, and institutional accountability. These values, while foundational to democracy, can be weaponized. Adversaries exploit the expectation of transparency by seeding disinformation through seemingly credible channels—leaked documents, manipulated footage, or doctored transcripts—then amplifying them through networks of automated accounts and partisan media outlets. The goal is not always to deceive the entire public, but to create sufficient doubt and division to paralyze policymaking, erode trust in institutions, and fracture social cohesion.

Another key vulnerability lies in the media ecosystem’s reliance on speed and engagement. Adversaries exploit this by fabricating events or recycling old content with new context, ensuring that false or misleading narratives achieve viral reach before fact-checkers or journalists can intervene. The Small Wars Journal analysis notes that this “firehose of falsehood” model, pioneered by Russian operations during the 2016 U.S. election, does not prioritize accuracy but rather overwhelms audiences with competing narratives, making it difficult to discern truth from fabrication. This tactic is particularly effective in polarized environments where audiences are predisposed to accept information that aligns with their existing beliefs.

Institutions within liberal democracies—government agencies, political parties, and civil society organizations—are also targeted not just as victims, but as unwitting amplifiers. Adversaries use hack-and-leak operations to release sensitive or embarrassing information at strategic moments, knowing that mainstream media will cover the story, thereby lending legitimacy to the narrative. The resulting cycle of scandal and response diverts attention from the original disinformation campaign and entrenches partisan divisions. This form of exploitation turns democratic institutions against themselves, using their own norms and procedures to undermine their legitimacy.

Subversion Through Legal and Economic Channels

Beyond the digital sphere, adversaries employ legal and economic pressure to shape information environments. Strategic lawsuits against public participation (SLAPPs) are used to intimidate journalists and critics, while state-aligned economic entities purchase or influence media outlets to ensure favorable coverage. The Small Wars Journal highlights how such tactics are integrated into broader information campaigns, creating a feedback loop where financial incentives and political narratives reinforce each other. In some cases, adversaries exploit gaps in transparency laws to fund think tanks, research centers, or cultural institutions that promote narratives aligned with their strategic interests.

Mechanisms of Exploitation: Tactics and Tools Used

Adversarial information operations rely on a layered toolkit that combines human-driven manipulation with automated amplification. At the core are coordinated inauthentic networks—groups of accounts, often controlled by humans or bots, that work in concert to push specific narratives. These networks mimic organic behavior by engaging with real users, sharing content across multiple platforms, and adapting their messaging based on trending topics or audience responses. The Small Wars Journal notes that such networks are frequently repurposed across different campaigns, making attribution challenging and enabling persistent influence operations.

Another central mechanism is the use of deepfakes and synthetic media. While early deepfakes were crude and easily detectable, advances in generative AI have made it possible to create highly realistic audio and video content that can impersonate public figures or fabricate events. These tools are often deployed in targeted disinformation campaigns aimed at discrediting leaders, inciting unrest, or manufacturing evidence to support false narratives. The speed at which synthetic content can be produced and distributed outpaces the ability of platforms and fact-checkers to debunk it, allowing falsehoods to take root before corrective action can be taken.

Platform Exploitation and Algorithmic Amplification

Social media platforms play a critical role in the dissemination of adversarial narratives. Their recommendation algorithms prioritize content that generates high engagement, regardless of veracity. Adversaries exploit this by crafting emotionally charged narratives—often centered on identity, grievance, or perceived injustice—that are designed to provoke outrage or fear. These narratives are then amplified through coordinated sharing, cross-posting, and the use of trending hashtags. The Small Wars Journal emphasizes that the opacity of these algorithms makes it difficult for external observers to predict or counteract such amplification, particularly when adversaries use multiple accounts and platforms in tandem.

In addition to organic amplification, adversaries increasingly rely on paid promotion to ensure their content reaches target audiences. Microtargeting tools allow for precise audience segmentation based on demographics, interests, and online behavior. This enables adversaries to tailor disinformation to specific communities, increasing its perceived relevance and credibility. While platforms have introduced transparency requirements for political advertising, enforcement remains inconsistent, and adversaries often exploit loopholes or use intermediaries to obscure their involvement.

Case Studies: Real-World Instances of Information Warfare

One of the most documented instances of unrestricted warfare occurred during the 2016 U.S. presidential election. According to the Small Wars Journal analysis, Russian military intelligence operatives used a combination of hacking, leaking, and social media manipulation to influence the electoral process. They breached the email systems of the Democratic National Committee and individuals associated with the Hillary Clinton campaign, then leaked stolen materials through intermediaries such as WikiLeaks. These leaks were timed to maximize political impact and were accompanied by a sustained disinformation campaign on platforms like Facebook, Twitter, and Instagram. The operation sought not only to damage one candidate but to deepen societal divisions and undermine confidence in the electoral system itself.

Another illustrative case is the 2017 French presidential election, where a hack-and-leak operation targeted the campaign of Emmanuel Macron. Adversaries released thousands of internal documents and emails just days before the vote, aiming to create the impression of impropriety and corruption. While the timing and scale of the operation suggested state involvement, the source of the leak was never definitively attributed. French authorities and cybersecurity firms later identified patterns consistent with previous Russian operations, including the use of phishing emails and the recycling of authentic documents with misleading context. The incident demonstrated how adversaries exploit the 24-hour news cycle and the pressure on journalists to verify and report on leaked material quickly, often without full context.

Ongoing Campaigns in Central and Eastern Europe

In countries such as Ukraine, Georgia, and the Baltic states, adversarial information operations have become a persistent feature of the political landscape. Russian-affiliated media outlets and online troll farms routinely amplify narratives that question the legitimacy of local governments, portray NATO as a hostile force, and depict Western institutions as corrupt or decadent. These campaigns often blend disinformation with legitimate criticism, making it difficult for audiences to distinguish between the two. The Small Wars Journal notes that such operations are particularly effective in environments where historical grievances and ethnic divisions already exist, providing fertile ground for external manipulation.

In Ukraine, for example, adversaries have used fabricated videos and manipulated images to spread claims of Ukrainian military atrocities or government incompetence. These narratives are amplified through social media and local media outlets that rely on sensational content for revenue. The result is a distorted information environment where citizens struggle to discern truth, and public trust in institutions erodes. The conflict in Ukraine has thus become a laboratory for unrestricted warfare, where information operations are waged alongside kinetic attacks, blurring the boundaries between peace and war.

Who Is Affected and How These Operations Spread

Adversarial information operations do not discriminate by geography or ideology. While state actors such as Russia, China, and Iran are frequently cited as primary sources of such campaigns, the tools and tactics are accessible to a wide range of non-state actors, including terrorist organizations, criminal networks, and even individuals with ideological agendas. The Small Wars Journal highlights that the democratization of disinformation tools—cheap AI services, bot networks, and encrypted communication platforms—has lowered the barrier to entry, enabling smaller groups to conduct operations that once required significant resources.

Within liberal democracies, the impact is uneven but pervasive. Marginalized communities, already distrustful of mainstream institutions, are often targeted with narratives that reinforce their grievances and isolate them from broader civic discourse. Conversely, highly polarized segments of the population are more susceptible to disinformation that aligns with their existing beliefs, creating echo chambers where falsehoods can flourish unchallenged. The spread of adversarial narratives is further accelerated by the viral nature of social media, where content that elicits strong emotional responses—fear, anger, or moral outrage—is prioritized by algorithms and shared by users seeking validation.

Institutions are also affected, not just as targets but as vectors. Political parties, advocacy groups, and even government agencies may unknowingly amplify disinformation by repeating false claims in press releases, speeches, or social media posts. This creates a feedback loop where the original disinformation campaign gains legitimacy through repetition, and the institution’s credibility is undermined in the process. The Small Wars Journal warns that such institutional capture is one of the most insidious effects of unrestricted warfare, as it corrodes the very foundations of democratic governance.

Red Flags: Identifying Disinformation and Propaganda Campaigns

Recognizing adversarial information operations requires a combination of technical literacy, media literacy, and institutional vigilance. While no single indicator guarantees malicious intent, certain patterns and behaviors should raise suspicion. The following checklist outlines actionable warning signs that individuals, journalists, and institutions can use to assess the credibility of online content and the integrity of information ecosystems.

• Sudden Surge in Activity: A coordinated spike in posts, shares, or mentions of a specific topic, particularly one tied to a political or social issue, may indicate an inauthentic campaign.
• Account Inauthenticity: Accounts with recently created profiles, default avatars, or nonsensical usernames that suddenly begin posting on trending topics are often part of coordinated networks.
• Repetition Without Context: Content that is repeatedly shared across multiple platforms without additional context, analysis, or source attribution may be part of a disinformation campaign.
• Emotional Manipulation: Posts that rely on fear, outrage, or moral indignation—especially when paired with calls to action or sharing—are common in adversarial narratives.
• Unverified or Anomalous Sources: Claims attributed to anonymous or obscure sources, or those that contradict established reporting from reputable outlets, warrant scrutiny.
• Cross-Platform Synchronization: Identical or near-identical messages appearing simultaneously across unrelated accounts or platforms may indicate orchestrated amplification.
• Algorithmic Artifacts: Content that appears to exploit trending hashtags, memes, or viral challenges in an unnatural way may be part of a coordinated effort.
• Institutional Echoing: When official statements, press releases, or media reports repeat claims later debunked as false, it may signal institutional capture by disinformation.
• Deepfake or Synthetic Media: Audio or video content that appears too polished, contains unnatural artifacts, or contradicts known facts should be treated with caution.
• Behavioral Inconsistencies: Accounts that switch between unrelated topics, languages, or political affiliations may be part of a multi-purpose network.

Expert and Institutional Responses to the Threat

Governments and civil society organizations have begun to develop responses to adversarial information operations, though these efforts remain fragmented and often reactive. The Small Wars Journal notes that the United States, European Union, and NATO have established dedicated units to monitor and counter disinformation, including the U.S. State Department’s Global Engagement Center and the EU’s East StratCom Task Force. These units focus on identifying and exposing foreign disinformation campaigns, supporting independent media, and promoting media literacy. However, their effectiveness is limited by resource constraints, jurisdictional challenges, and the rapid evolution of adversarial tactics.

At the institutional level, social media platforms have introduced policies and tools to detect and mitigate inauthentic behavior. Facebook, Twitter (now X), and YouTube now publish regular transparency reports detailing their efforts to remove coordinated inauthentic networks and reduce the spread of false information. They have also partnered with third-party fact-checkers to label or downrank misleading content. While these measures have had some success, critics argue that platforms remain reactive rather than proactive, often acting only after public pressure or regulatory threats. The Small Wars Journal highlights that the business incentives of social media companies—engagement and growth—are often misaligned with the goal of reducing disinformation, creating inherent conflicts of interest.

Media and Civil Society Responses

Independent media organizations and civil society groups play a critical role in countering adversarial information operations by providing fact-based reporting and context. Investigative journalism outlets, such as Bellingcat and the Atlantic Council’s Digital Forensic Research Lab, specialize in tracing the origins of disinformation campaigns, attributing them to specific actors, and exposing their methods. These efforts are complemented by media literacy initiatives that teach audiences how to evaluate sources, identify manipulation techniques, and recognize coordinated behavior. Organizations such as the News Literacy Project and MediaWise provide resources for students, educators, and the general public to build resilience against disinformation.

However, the effectiveness of these responses is constrained by the scale of the problem. The Small Wars Journal emphasizes that the sheer volume of disinformation, combined with the speed of digital communication, makes it impossible for any single actor to fully counter adversarial campaigns. This has led to calls for a more collaborative approach, where governments, platforms, media organizations, and civil society work together to share intelligence, develop best practices, and coordinate responses. Such collaboration must balance the need for transparency with the protection of democratic norms, avoiding censorship while ensuring that malign actors cannot exploit open systems to spread harm.

Mitigation Strategies: Protecting Democratic Institutions

Protecting liberal democracies from unrestricted warfare requires a multi-layered defense strategy that addresses both the supply and demand sides of disinformation. On the supply side, governments and platforms must work to disrupt the infrastructure of adversarial operations—identifying and dismantling coordinated networks, removing inauthentic accounts, and reducing the reach of malicious content. On the demand side, institutions must invest in resilience-building measures that reduce public susceptibility to disinformation, such as media literacy education, civic engagement, and transparent governance.

One promising approach is the development of early warning systems that can detect coordinated disinformation campaigns before they gain significant traction. These systems rely on network analysis, machine learning, and cross-platform monitoring to identify patterns of behavior indicative of inauthentic activity. The Small Wars Journal highlights that such systems are most effective when they combine technical detection with human expertise, allowing analysts to distinguish between genuine grassroots movements and orchestrated campaigns. Governments and platforms are increasingly sharing data and best practices to improve the accuracy and timeliness of these warnings.

Institutional Resilience and Transparency

Democratic institutions can reduce their vulnerability to adversarial information operations by increasing transparency and accountability. This includes adopting clear policies for handling leaks, ensuring robust cybersecurity measures to prevent hacking, and providing timely, accurate information to the public. The Small Wars Journal notes that institutions that communicate proactively—rather than reactively—are better positioned to counter disinformation campaigns. For example, during crises or elections, transparent briefings and regular updates can preempt the spread of rumors and false narratives.

Another critical strategy is the promotion of media literacy and critical thinking skills across all segments of society. Educational institutions, from primary schools to universities, should integrate media literacy into their curricula, teaching students how to evaluate sources, identify bias, and recognize manipulation techniques. Civil society organizations can complement these efforts by hosting workshops, publishing guides, and developing tools that help individuals navigate the digital information landscape. The goal is not to shield audiences from challenging ideas, but to equip them with the skills to assess information critically and resist manipulation.

Regulatory and Technological Solutions

Regulation plays a dual role in mitigating adversarial information operations: it can deter bad actors and set standards for transparency and accountability. The European Union’s Digital Services Act (DSA) and the Code of Practice on Disinformation represent efforts to hold platforms accountable for the spread of harmful content while preserving free expression. These regulations require platforms to be more transparent about their algorithms, advertising practices, and content moderation policies. They also mandate the removal of illegal content, including hate speech and incitement to violence, while providing avenues for appeal and redress.

Technological solutions, such as content provenance standards and digital watermarking, offer additional layers of protection. Projects like the Coalition for Content Provenance and Authenticity (C2PA) aim to create standards for tracking the origin and modification history of digital content, making it easier to detect deepfakes and manipulated media. While these technologies are still evolving, they represent a promising direction for restoring trust in digital content. However, their effectiveness depends on widespread adoption by platforms, media organizations, and content creators.

FAQ

What is unrestricted warfare, and how does it differ from traditional warfare?

Unrestricted warfare is a strategic approach that uses non-military instruments—such as disinformation, economic pressure, legal action, and cyber operations—to achieve political objectives without declaring war. Unlike traditional warfare, which relies on kinetic force and clear battlefields, unrestricted warfare operates continuously across multiple domains and often without attribution, making it difficult for targeted states to respond effectively.

Who are the primary actors behind adversarial information operations?

State actors such as Russia, China, and Iran are frequently cited as primary sources, but the landscape also includes non-state actors like criminal networks, terrorist organizations, and ideological groups. The democratization of disinformation tools has lowered barriers to entry, enabling smaller groups to conduct sophisticated operations.

How do adversaries use social media to spread disinformation?

Adversaries exploit social media platforms by creating coordinated networks of inauthentic accounts that mimic organic behavior, using algorithms to amplify emotionally charged content, and leveraging microtargeting to tailor messages to specific audiences. They also repurpose authentic content with misleading context and time leaks or fabricated materials to maximize impact.

Can disinformation campaigns be stopped entirely?

No. Given the scale, speed, and adaptability of disinformation, no single actor or institution can stop such campaigns entirely. However, a combination of technical detection, institutional resilience, media literacy, and international cooperation can significantly reduce their impact and limit their ability to destabilize democratic societies.

What role do social media platforms play in countering disinformation?

Platforms are central to both the spread and mitigation of disinformation. They implement policies to detect and remove inauthentic networks, label misleading content, and promote authoritative sources. However, their effectiveness is constrained by business incentives, opacity of algorithms, and the rapid evolution of adversarial tactics. Regulatory frameworks, such as the EU’s Digital Services Act, aim to hold platforms accountable while preserving free expression.

Sources & References

• Small Wars Journal — Unrestricted Warfare: How Adversarial Information Operations Exploit Liberal Democracies