AUTHORS: Álvaro Rodríguez & Santiago Sainz	Published by: International Sustainable Development Observatory (ISDO), Security and Intelligence Department | isdo.ch | DOI: 10.5281/zenodo.23592176
Scope: Hybrid threats, deniable operations and strategic attribution	Date: October 16, 2026 (second edition, corrected October 22, 2026)

False-Flag Operations and Hybrid Warfare

Evidence Assessment, Strategic Attribution, and Defensive Countermeasures

False-flag operations and Hybrid Warfare pose significant challenges for security analysts. Policymakers, journalists, and institutions assessing contemporary security threats face similar difficulty. Determining who was responsible requires careful analysis. It also shows whether an operation was designed to mislead and what the evidence can substantiate.

Additionally, Published by the International Sustainable Development Observatory (ISDO), the Manual on False-Flag Operations and Hybrid Warfare examines these challenges.

Moreover, the work outlines a framework covering asymmetric warfare, hybrid threats, strategic attribution, international law, documented cases, and defensive countermeasures.

Evidence Assessment and Strategic Attribution

The manual introduces a three-tier evidence framework distinguishing declared doctrine, verified practice, and unconfirmed narratives. It also assesses attribution claims against three criteria:

• Technical traceability: Whether available evidence connects an incident to the actor being identified.
• Multi-source convergence: Whether independent sources corroborate the same attribution.
• Evidence of intent: Whether records, communications, tasking, payments, or other material indicate that an actor directed or intended the operation.

This framework distinguishes the occurrence of an incident from the attribution of responsibility and from the more demanding determination that an incident constitutes a false-flag operation. The manual reserves that classification for cases supported by evidence of deliberate deception, while disputed or insufficiently substantiated claims remain explicitly qualified.

Key Findings on False-Flag Operations and Hybrid Warfare

The review identifies several important patterns in the available public evidence.

First, strictly documented false-flag operations are less common than the broad use of the term in political and public debate might suggest. Many contemporary cases involve proxies, contractors, concealed identities, or deniable activity without necessarily meeting the manual’s threshold for a false-flag operation.

Second, strategic attribution remains uneven and frequently incomplete. Among 38 contemporary incidents assessed in the manual’s register, only one meets all three attribution tests under the strictest scoring rule, while six meet at least two. These figures represent the authors’ assessment of the available public record, not a representative statistical sample of all hybrid operations. The results also change substantially when partially met criteria are counted, demonstrating how analytical thresholds can influence conclusions.

Third, legal frameworks address different elements of deniable operations but do not eliminate the political and evidentiary difficulties involved in attributing responsibility to a state. The manual examines the relationship between deception, armed conflict, state responsibility, proxy actors, and institutional decision-making, distinguishing binding legal instruments from nonbinding guidance and analytical frameworks.

Fourth, the report examines how unverified narratives and the misuse of the false-flag label can undermine public understanding. Across a selected set of 15 claims drawn from four narrative groups, eight are classified as refuted following examination by an institution, court, or inquiry, while seven remain alleged. This is a selected set rather than a representative sample of public claims.

Finally, the manual identifies a gap between the existence of analytical standards and evidence that defensive measures actually improve outcomes. It therefore emphasizes transparent evidence standards, alternative hypotheses, calibrated language, and systematic evaluation rather than assuming that new procedures or policy instruments will automatically improve attribution.

Defensive Countermeasures and Practical Applications

Beyond its conceptual and legal analysis, the manual provides a two-sided procedure for assessing attribution claims, a register of contemporary incidents, a source-verification log, and proposed defensive protocols for digital and open-source evidence. Its recommendations include a verification framework for the first 24 hours, 72 hours, and 30 days following an incident, alongside parallel response pathways.

These protocols are proposals developed by the authors and have not been validated through live-incident testing. Their purpose is to support consistent assessment, preserve evidentiary discipline, and help analysts distinguish confirmed information from inference and unresolved questions.

The report also considers the strategic costs of deniability. Delayed attribution, uncertainty, and the political cost of publicly identifying an actor can complicate responses to hybrid threats. The manual consequently emphasizes shared terminology, measurable outcome indicators, and the systematic evaluation of existing countermeasures.

Conclusion: Improving the Analysis of Hybrid Threats

False-flag operations and Hybrid Warfare cannot be understood through allegations alone. Reliable assessment requires evidence that is traceable, independently corroborated where possible, and evaluated against defined criteria. It also requires recognizing the limits of public information and distinguishing analytical confidence from political certainty.

ISDO’s manual brings together evidence assessment, strategic attribution, legal analysis, and documented cases. It offers a structured resource for researchers and practitioners examining deniable operations and Hybrid Warfare threats. Its central contribution is methodological. It improves how claims are assessed, how uncertainty is communicated, and how defensive responses can be evaluated.

Publication Details

Title: Manual on False-Flag Operations and Hybrid Warfare in the Context of Asymmetric Warfare. It covers Concepts, Evidence Tiers, Legal Framework, Tactical Anatomy and Defensive Countermeasures.

Authors: Álvaro Rodríguez and Santiago Sainz

Publisher: International Sustainable Development Observatory (ISDO), Security and Intelligence Department

Edition: Second, corrected edition, October 22, 2026

DOI: https://doi.org/10.5281/zenodo.23592176

License: CC BY-NC 4.0

Publisher website: International Sustainable Development Observatory

Keywords: false-flag operations, hybrid warfare, strategic attribution, asymmetric warfare, intelligence analysis, disinformation, open-source intelligence (OSINT), international law, hybrid threats, evidence assessment, and defensive countermeasures.