Criminal Justice & the Rule of Law Cybersecurity & Tech Foreign Relations & International Law

Sanctions as a Surgical Tool Against Online Foreign Influence

Gabriel Band
Thursday, September 15, 2022, 8:31 AM

Sanctions are sometimes perceived as blunt tools with delayed effects. In the world of online influence, they can have precise and immediate effects, hitting malign actors and operations at their core.

The United States Department of the Treasury Building. (Wally Gobetz,; CC BY-NC-ND 2.0,

Published by The Lawfare Institute
in Cooperation With

Russia’s expanded invasion of Ukraine has once again brought to the fore the role of online influence—both overt and covert—in modern warfare. Much has been said about the United States and allied governments’ strategy of tailored exposure to get ahead of Russia’s false-pretext narratives. While strategic exposure remains one of the most critical tools for warfare in the information space, the United States has wielded another major tool to fight against adversaries in the information sphere: sanctions.

Sanctions have been criticized as blunt tools that may not result in the desired deterrence within the desired time frame, while sometimes also punishing a largely innocent population alongside the regime engaging in unacceptable behavior. But in the world of online influence, sanctions are a tactical tool that surgically degrades potential threats with immediate effect.

A previous exploration of the types of online foreign threats and successful countermeasures explained the role of sanctions as a valuable ingredient in a campaign against a threat actor. Instead of targeting an entire country or government, tailored sanctions can target specific organizations, individuals, and operations—such as websites—that seek to covertly manipulate audiences toward certain viewpoints. 

In recent years, the U.S. government has creatively applied these tools of state power against online influence threats stemming primarily from Russia and Iran. In April 2021, the U.S. Treasury Department took its first significant and deliberate step toward imposing sanctions on numerous Russian “covert influence platforms”—such as websites—under the control of the Russian government, using authorities to target malicious cyber-enabled tools of Russian intelligence services and actors involved in election meddling. While this was the United States’ first tranche of sanctions dedicated to this specific type of adversarial online behavior, the Treasury Department had also previously sanctioned a Russian influence actor involved in 2020 election meddling, including the adversary’s online influence tools. In the wake of Russia’s expanded invasion of Ukraine, the Treasury Department in March 2022 sanctioned additional Russian covert influence platforms, and the specific individuals involved with running them, under wide-ranging authorities to target Russian threats. Additionally, in April 2022 the Treasury Department imposed sanctions on websites that serviced a Russian oligarch’s global influence campaign. Such punitive measures are not reserved solely for Russia. In the wake of Iranian attempts to meddle in the 2020 elections, the Treasury Department sanctioned an Iranian company and numerous Iranian individuals for online covert influence operations targeting American audiences.

Sanctions against online influence actors target what makes these operations successful with surgical precision, and they work with speed and negligible collateral damage.

First, sanctions block financial transactions that online influence operations rely on for both funding and, if applicable, maintaining a contributor base. This may seem irrelevant for an adversary’s operation because they could receive state funding. But covert influence operations are often designed to appear as independent, legitimate entities, thus painting a veneer of credibility by soliciting online donations to fund their activities, or generating revenue through advertisements. Indeed, the operation may rely on such funding, depending on the relationship with the adversary, or it may rely on the perception of such funding. Without the cash flow, the operation may be unsustainable—an employee base must still be paid. Additionally, many of these operations—such as websites—rely on a pool of “contributors” to produce content that pushes the adversary’s desired narratives to target audiences. For example, a Russian influence actor established a website to push Russia’s desired narratives to U.S. audiences, relying on a pool of independent contributors to appear authentic. Sanctions can block the adversary’s ability to pay contributors, effectively cutting off the lifeblood of a covert influence operation. With fewer financial resources to fund the operation, and with fewer contributors to produce content, the operation is significantly weakened and likely unsustainable.

Second, sanctions can disrupt the narrative-laundering ecosystem that online operations may rely on to effectively reach target audiences. Websites that adversaries run as covert influence operations may achieve significant reach by coordinating with a network of “like-minded” or “fringe” sites to republish each other’s content or push each other’s narratives. Some of the actors in these ecosystems may have much higher readership, thus allowing an otherwise inconsequential actor to reach target audiences. Sanctions can dissuade other sites and contributors from cooperating with the punished entity to avoid being tarnished or risk being sanctioned themselves, thus cutting off the sanctioned actor from potential audience reach and sustained content generation. With decreased reach to target audiences and decreased content, an operation’s capacity to influence audiences is significantly lessened.

Third, sanctions can be tailored to hit directly at the threat actor and its operation. Sanctions against a state actor involved in influence operations may indeed be of questionable value because adversaries will likely determine other ways to fund key institutions. However, directly targeting personnel—including state actors—involved in influence operations comes with numerous advantages. The sanctions may have a disruptive enough effect on an individual’s life to deter them from continuing to engage in the influence activity, and may dissuade others from engaging in such activity. Indeed, if an influence operation is intended to be covert, then sanctions and the accompanying exposure targeting personnel may block them from future activity, as their participation may put covert activity at risk of being easily exposed. Successful influence operations rely on the right skilled people to be involved. By removing those pieces from the chessboard, the influence operation may falter.

Fourth, sanctions against online influence threats work swiftly. Discourse about sanctions as punitive measures often highlight delayed impact. It may take months or years for a targeted economy, for instance, to feel the pain of sanctions. As such, the coercive or deterrent effect on the targeted adversary may be significantly delayed. The pain inflicted on an online influence actor and operation, however, is immediate: The operation may lose funding and contributors, amplifiers may distance themselves, and audience reach may be immediately impacted, effectively dismantling the operation.

While sanctions hold a uniquely constructive position in the counterinfluence toolkit, they can also be easily designed to mitigate the legitimate—though usually overblown—concerns about driving attention to influence operations.

Sanctions can focus the exposure and punitive measures on the actor behind the operation, rather than on the broader operation itself. For the most effective disruption, the actual covert influence operation must be sanctioned and included in the press release announcing the sanctions, but the focus of the exposure should be the individual actors, providing detailed attribution of the personnel involved. For example, when sanctioning multiple Russian intelligence-affiliated covert influence platforms, the Treasury Department exposed and sanctioned a range of personnel involved in running the operations, rather than just focusing on the intelligence service or country of origin. This strategy deflects attention away from the operation and its influence narratives. Sanctions can also be imposed on multiple actors and operations at one time, further diluting attention gained from the exposure and thus deflating the threat of any individual operation or actor.

In American foreign policy and national security, sanctions are often a first stop in a strategy to impose costs on an adversary in a world of military restraint. As rhetoric surrounding the scourge of disinformation and its impact on society increases, equal energy should be applied to tactical means of disruption. It may not seem exciting to turn once again to sanctions as a first stop. But in the world of countering online influence, sanctions bring uniquely constructive benefits tailored to this specific adversary behavior and should feature prominently in the United States’s counterinfluence toolkit.

Gabriel Band worked on 2020 election security at the U.S. Department of Defense. All views and opinions expressed are his own and do not necessarily represent the views of the Department of Defense or the U.S. government.

Subscribe to Lawfare