Fewer Bots, More Ads: The Pentagon’s Evolving Online Influence Campaigns

In August 2022, Stanford Internet Observatory and Graphika published “Unheard Voice,” a report analyzing pro-Western influence operations linked to the Pentagon, which involved well over 100 accounts that Twitter and Meta had taken down for violating their rules against manipulation and coordinated inauthentic behavior. I was a co-author on the report.

The tactics documented in the report were common to state-run influence operations: AI-generated profile photos, front media outlets, and coordinated tweeting. The content advanced familiar strategic narratives in the Middle East, Central Asia, Iran, and Afghanistan—occasionally mixing in wild rumors (such as claims that Afghan refugees’ bodies were returned from Iran with missing organs). In some cases, fake personas shared URLs from domains containing the disclaimer “sponsored by the U.S. Central Command (CENTCOM)” in the website footer. They tried, mostly unsuccessfully, to make propaganda seem organic. There was almost no audience engagement.

The “Unheard Voice” report was embarrassing enough that, a month later, the Washington Post reported that the Pentagon had ordered a broad review of its clandestine psychological operations. Colin Kahl, then undersecretary of defense for policy, reportedly directed military commands to review their online influence activities. The concern was not simply that some claims were false. It was that the methods themselves—fake personas and platform manipulation—risked undermining U.S. credibility even when the information being spread was true.

Four years later, the model appears to have evolved. Sam Biddle at The Intercept recently identified two newer Pentagon-linked sites, Al-Fassel and Pishtaz News, both of which launched in 2023. His reporting noted that the new sites weakened the disclosure language (it no longer mentions CENTCOM), had no disclosures on their social profiles, and in at least one case had an AI-generated newscaster reporting content on Instagram; it’s worth a read. Because I’d been a lead on the “Unheard Voice” analysis, he reached out to me for comment, and I did a bit of digging.

Pulling on threads around the two sites The Intercept found led me to six more.

This piece and the accompanying technical analysis report cover what appears to be a new, third generation of Pentagon information operations. This network of websites is less clearly attributed, but it also doesn’t appear to rely on fake personas or bot farms for promotion. Much of its content appears to be factually supportable—and, interestingly, users encountering its X accounts have asked Grok “is this true” a few dozen times. At least one post was Community Note-d, meaning that X users flagged it as misleading and provided additional contextualizing information. Its reach appears to come not from coordinated inauthentic amplification, but from paid advertising on major platforms—leading to tens of millions of views.

From TRWI to gc_

The story begins with the Trans-Regional Web Initiative (TRWI), a U.S. Special Operations Command program launched around 2008. TRWI produced a first generation of foreign-language websites aimed at audiences across the Middle East, Central Asia, and South Asia. Early sites such as al-shorfa.com, mawtani.com, and centralasiaonline.com openly acknowledged their U.S. military sponsorship. The question of whether this kind of influence mattered was hotly debated at the time, and Congress nominally defunded the program in 2014 (at least one terminated Pentagon contractor who had run TRWI sites was then hired by Sputnik).

Despite the purported defunding, the sites did not vanish. They appeared to rebrand into what Stanford Internet Observatory researchers saw as a second generation of websites in the “Unheard Voice” report; while doing that research, we encountered both overtly attributed and covert accounts, which we reported on separately (we could not concretely determine which contractors ran what). Al-shorfa became Al-Mashareq. Mawtani became Diyaruna. Central Asia Online split into regional outlets: Caravanserai, Salaam Times, and Pakistan Forward. These second-generation sites still acknowledged CENTCOM sponsorship, but the attribution was quieter and usually located on About pages rather than in the social media posts through which most readers encountered the content. “Unheard Voice” observed covert personas sharing links to some of those CENTCOM-sponsored domains—including Al-Mashareq.

The platforms removed the accounts; researchers described the tactics; the Pentagon reportedly reviewed its practices.

In April 2026, Biddle wrote about Al-Fassel and Pishtaz News, Arabic- and Farsi-language outlets that carried a new generic U.S.-government funding disclosure identifying the sites as “a product of an international media organization publicly funded from the budget of the United States Government”—no mention of CENTCOM. After his inquiry, I began examining the surrounding infrastructure, which revealed a broader network.

This network appears to be a third generation of TRWI-style semi-overt propaganda sites. In this report I’ll call it the “gc_ generation” because the sites contain /gc_#/ in their URLs and embed internal version tags in their HTML—gc1_2.7.0, gc3_2.7.0, gc4_1.6.0, and so on—that appear to mark them as members of a numbered network. Seven sites are confirmed:

• Al-Fassel News (gc_1) publishes in Arabic, with coverage centered on Iran, the Houthis, Hamas, Gaza, and U.S. and Gulf regional security narratives.
• Pishtaz News (gc_3) publishes in Farsi, focusing on Iran’s military, economy, internal repression, internet shutdowns, and regime vulnerability.
• Entorno Diario (gc_4) published in English and Spanish for Latin American audiences, with heavy emphasis on China’s role in the region: infrastructure, mining, technology, organized crime, narcotrafficking, and security. It appears to be the first Pentagon-linked pseudo-news site targeting Latin America, and it was later taken offline after just over two years of operation.
• Kontur Novosti (gc_6) publishes in Russian, with anti-Kremlin and pro-Ukraine coverage aimed at Russian-speaking audiences, including Ukrainians near the front lines.
• GlobalWatch (gc_7) publishes security- and defense-oriented coverage in several languages including Ukrainian, Tagalog, and Korean.
• BlueShift News (gc_8) publishes in English, with a focus on space.
• Focus News (gc_9) publishes for an Indo-Pacific audience across several languages, focusing on regional security, economics, diplomacy, and China-relevant themes.

Two site codes, gc2 and gc5, remain unidentified.

The sites appear to share a common codebase. Biddle reported several visible overlaps between Al-Fassel, Pishtaz News, and earlier TRWI and CENTCOM-linked publications, including article pages ending with the same “Do you like this article?” thumbs-up/thumbs-down poll. Al-Fassel and Pishtaz’s design closely mirrored an overt CENTCOM publication, CENTCOM Citadel, in page layout, 404 graphic, and legal language.

The infrastructure link to earlier generations also includes a shared Google Tag Manager container, GTM-M6PCSRF. It appears on Al-Mashareq—a second-generation site, evolved from a TRWI site, promoted by a fake persona, that explicitly named CENTCOM as its sponsor. The container also appears on four gc_ sites: Pishtaz, Kontur, BlueShift, and Focus. That container is a forensic bridge between the acknowledged CENTCOM-linked ecosystem and the newer, more generically attributed sites.

The advertising trail connects the gc_ generation back to TRWI through its original operator: General Dynamics Information Technology. As I was attempting to understand why the X accounts had such high views despite such low engagement and low follower counts, I went looking for indicators of paid promotion. X does not have a comprehensive ads library. But Google does, and General Dynamics Information Technology (GDIT), the contractor for the original 2008 TRWI contract, is a verified advertiser in Google’s Ads Transparency Center. It is currently running ads for all seven gc_ sites, as well as for CENTCOM Citadel.

That does not, by itself, prove tasking, editorial control, or command authority. The exact contract vehicle and approval chain remain open questions. But it establishes a public, verifiable link between GDIT’s advertising activity, the gc_ sites, the last generation of sites, and an overt CENTCOM media property.

The New Distribution Model

The most important change from the 2022 operation is how the websites appear to reach people.

The older operations studied in “Unheard Voice” relied on fake personas and inauthentic social media behavior—and mostly failed to build real audiences. Average engagement was miniscule. The fake accounts were often talking to themselves, or to almost no one (hence the title of the report).

The gc_ network appears to solve that problem by buying reach. Posts by the main X accounts for the sites exceeded a combined 67 million views on X. Entorno Diario alone generated more than 56 million views across 227 tweets. The small outlet-branded accounts on X with tiny follower counts were producing posts with hundreds of thousands—sometimes millions—of views, then collapsing back to near-zero views when what appeared to be paid promotion stopped. Entorno Diario was the clearest example of this: The Spanish-language account repeatedly broke into six- and seven-figure view counts, while its English mirror, posting similar content, remained almost invisible (attracting 2,426 views over 135 tweets).

That contrast suggests that the audience was not built through community, virality, or coordinated sharing. It was purchased.

On X, the evidence of promotion is inferential because the platform does not maintain a comprehensive searchable ad archive. But the view patterns are difficult to explain as organic growth. When I searched for X accounts sharing gc_ network content, I found several dozen external accounts posting its URLs across the full period of operation. The millions of views were not coming from a large sharing network, a swarm of sympathetic influencers, or an obvious botnet.

As mentioned, GDIT’s verified advertiser Google account is running ads for the sites. I also found active advertising for five of the seven gc_ sites on Meta’s ad transparency platform, along with some visibility into audience targeting: Al-Fassel, for instance, ran country-segmented campaigns targeting audiences in Lebanon, Yemen, and Egypt. Several ads were flagged by Meta for running without a required disclaimer. Kontur Novosti, a Russian-language site, targeted Ukrainian oblasts—including Dnipropetrovsk, Odessa, Kyiv, and Kharkiv—suggesting anti-Kremlin messaging aimed at Russian-speaking Ukrainians near the front lines (Facebook is banned in Russia). Several Kontur ads were also flagged for missing required disclaimers. Pishtaz, BlueShift, and GlobalWatch also had active Meta ads in May 2026: Pishtaz on internet shutdowns and economic distress in Iran, BlueShift on Indian lunar traditions, and GlobalWatch on self-promotional Ukrainian military and naval imagery.

Paid advertising is not fake or inauthentic engagement. The X accounts that liked, replied, challenged, or shared the promoted posts appear to be real people. The reach was artificial, but the reactions were often authentic. In that respect, the model the Pentagon contractors appear to be using now is more akin to a media-buy strategy: distributing state-funded journalism-like content through the same ad infrastructure that commercial publishers, political campaigns, and brands use every day.

Entorno Diario and the Politics of True Facts

Entorno Diario, the Spanish, English, and Portuguese-language “gc_” site that targeted Latin America, offers a clear view of how the model works. The site is interesting because it appears to be the first Pentagon-linked propaganda effort of this type targeting Latin America, and because it ceased operations after a little over two years. The live site is gone, but many of its articles and social posts remained recoverable through archives and on X.

Using the Wayback Machine API, I recovered the text of 553 Entorno Diario URLs published between July 2023 and September 2025. The site’s editorial agenda is strikingly consistent. Approximately 70 percent of the recovered articles mention China or Chinese entities. Coverage focuses heavily on Chinese investment, infrastructure, mining, surveillance technology, organized crime, narcotrafficking, Venezuela, and regional security. None of the articles appeared to portray Chinese engagement in Latin America favorably.

But Entorno Diario also was not a lie machine. Supplemented by two different large language models (LLMs), I reviewed a subset of 42 Entorno articles that had been amplified on X, extracting quotes and claims and evaluating headline framing. Both audits and my manual review found that the corpus largely featured real events, policy debates, official actions, and traceable sources. The statistics and quotes were usually corroborated elsewhere; the events had happened; the sources were almost all verifiable. The audits identified only one major factual error: An article had confused Colombia’s Gulf Clan with Mexico’s Gulf Cartel.

The propaganda elements were primarily in the topic selection, or in rhetorical sleights of hand: The stories focused on danger, corruption, exploitation, surveillance, and strategic encroachment. Headlines and core theses were partially accurate, or materially overstated, not because of specific factual inaccuracy but because their framing pushed beyond what the evidence supported. Facts were placed next to each other in ways that implied causal relationships not supported by the reporting. In one notable example, the murder of a woman in Bogota was editorially connected to the fact that PowerChina is more than two years late on constructing the Hospital de Usme; the stabbing victim was transported to a hospital that was further away. Both facts are true—the murder happened and the hospital is delayed. But there are significant leaps here.

A supply chain story, in which FARC-originated coltan was seized in transit through a chain of intermediaries where it “was destined” for export, eventually, to a presumably Chinese buyer, was given the headline “La incautación de minerales extraídos ilegalmente arroja luz sobre los vínculos entre disidentes de las FARC y China.”[1] [2]  (“Seizure of Illegally Mined Minerals Sheds Light on Links Between FARC Dissidents and China”) Evidence of malfeasance is offered in a few stories without the reader being made aware that one event actually occurred years before. Inflated attribution, temporal conflation, and misleading causal proximity are not uncommon tricks of the trade in influence operations; Russian and Chinese propagandists also leverage adversarial story curation and assemble fragments of truth into over-totalized indictments. But Latin America scholars may find the archive enlightening.

The authorship picture complicates the story further. Roughly a third of the recovered Entorno corpus was Agence France-Presse wire content (depending on how syndicated and co-bylined items are counted). Just over half were bylined by named journalists.

The bylines, however, raise questions. Across the seven gc_ sites, I catalogued 55 unique byline names. Some were real journalists with independent publication histories; several others belonged to the U.S.-government-funded media orbit, contributing to Voice of America, Radio Free Europe/Radio Liberty, Radio Free Asia, and earlier CENTCOM-funded outlets. Two Entorno writers appear connected to Colombia Belleza Pura, a Barranquilla-based content marketing shop. Six names appeared across multiple gc_ sites, suggesting shared editorial production behind outlets presented as separate regional publications. But I could not verify 31 of the 55 named bylines. This isn’t to say that they’re necessarily fake; some may be real people with no publication history or social media presence. Several did appear to be likely pseudonyms (e.g. the Chinese transliteration of Garfield the cat) or pop culture references (“Aurora Lane,” which is the name of Jennifer Lawrence’s journalist character in the movie “Passengers”).

A reporter could dig more deeply into the authorship. What appears likely is a hybrid staffing model: some wire copy, some real freelancers or content marketers, some writers from the U.S.-funded media ecosystem, and then perhaps some opportunism. Perhaps some local writers have to use pseudonyms for safety reasons; it’s unclear. But the result is a newsroom aesthetic without the standard transparency that lets readers understand who is actually reporting, editing, or commissioning the work

Audiences Are Not Passive

One of the most interesting parts of the dataset surrounding these new sites is that some users who saw the posts challenged the content.

Entorno Diario’s promoted posts generated repeated attempts by ordinary users to interrogate the content. Some asked Grok, X’s artificial intelligence assistant, to fact-check specific claims. Others challenged the framing. One user asked directly, in Spanish, who was paying to advertise the tweet. A Farsi-speaking user noted that Pishtaz seemed to be “strangely promoted.”

A Community Note appeared on at least one Entorno post, with users attributing the activity to “bodegas”—bot farms—belonging to government defenders, even though they did not identify the actual sponsor.

This exchange is important because it complicates the usual picture of propaganda as one-way injection into a passive audience. The audience did something interesting: It interpreted what it had been shown and informed others of what it found lacking.

Discussions between X users and Grok about the gc_ content are also fascinating for this reason. Entorno Diario attracted roughly 31 Grok fact-check replies from 24 unique users. The questions ranged across the site’s China-focused agenda: mining, soy-driven deforestation, China-Cuba espionage, malware, fighter jets, and U.S. military presence in Colombia. One user mounted a four-tweet thread using Grok to challenge Entorno’s framing of Bolivian deforestation as China driven, eventually concluding that livestock—not Chinese demand specifically—was the main driver. In other words, the audience was not simply absorbing the message. It was trying to audit the frame.

Al-Fassel also attracted Grok fact checks. One user asked Grok three times whether the site was “Zionist,” calling it blatantly biased. The user sensed propaganda but attributed it to Israel rather than the United States. Across the network, only one user I found correctly identified U.S. government funding.

In the Grok replies I reviewed, the chatbot never identified the gc_ sites as U.S.-government-funded outlets. It treated the content as discrete factual claims to assess rather than as artifacts from a state-funded media network promoted through paid advertising.

That is not a failure of Grok so much as an illustration of the limit of the question “Is this true?” when dealing with propaganda. Grok can assess claims, which is useful, but also often incomplete. If the grain of truth is sufficient, the system may answer correctly while still missing the important context: Who is speaking? Who is paying? What pattern of editorial selection does this post belong to? Why am I seeing it?

The audience sensed that something was off. It asked the available tools the questions those tools were built to answer. But propaganda that works through provenance, agenda setting, and omission cannot be fully evaluated one claim at a time—regardless of who is producing it.

Beyond Coordinated Inauthentic Behavior

There is at least one other site out there that isn’t part of the gc_ network; it’s built on a different architecture and is an investigation story for another time.

If the post-2022 Pentagon review following the “Unheard Voice” report did indeed change the playbook for information operations, this gc_ generation may give us insight into what the new approach looks like: fewer fake people (when it comes to promotion, at least), more real ads, and propaganda that works not through fabrication but through story selection, omission, and attenuated provenance.