Loading signal...
Signal
Submitted
Nov 12, 2026, 19:09 UTC
NewsGuard Reality Check describes a September 24, 2024 leak by U.S.-born fugitive in Russia John Mark Dougan, who claims to have hacked a Signal group called "Counter-Disinfo Ops" used by Western government-linked contractors. The leaked chats allegedly show coordinated efforts to influence AI systems, training data, and online reference sources to steer narratives on Russia, Ukraine, and other geopolitical topics, framed as part of Western information warfare in the hybrid conflict with Russia.
Article on NewsGuard Reality Check titled "Dougan Leak Exposes Concerted Effort to Infect AI" reports on alleged internal communications from former U.S. Marine and Palm Beach County deputy sheriff John Mark Dougan, who is described as a fugitive in Russia accused of hacking and doxxing law-enforcement personnel. The piece states that on September 24, 2024, Dougan published encrypted chat logs on his website, claimed to be extracted from a Signal group called "Counter-Disinfo Ops," which he allegedly hacked in July 2024. According to the article, the Signal group purportedly includes contractors and employees of U.S. government agencies and allied organizations working on counter-disinformation. The leaked messages allegedly show participants discussing how to manipulate large language models and other AI systems by seeding them with curated content and shaping training data to steer outputs on contentious geopolitical questions, including narratives favorable to Ukraine and critical of Russia. The article claims that participants discuss targeting English-language, Russian-language, and other non‑English information ecosystems; working with fact-checking and media-rating outfits; and designing coordinated campaigns across social media and open-source platforms.
NewsGuard Reality Check presents the leak as evidence of a "concerted effort" by Western-aligned information-warfare professionals to influence AI systems as part of a broader hybrid conflict with Russia. The article notes that Newsguard itself has previously been criticized for alleged bias, and it frames the Dougan leak as reinforcing concerns that Western counter-disinformation infrastructures operate as de facto propaganda networks. The article highlights specific excerpts in which group members allegedly discuss: (1) identifying key AI vendors and models to target; (2) crafting knowledge-base entries and reference articles that could be ingested into these models; (3) coordinating with Wikipedia editors and other open repositories to ensure that “authoritative sources” reflect preferred narratives; and (4) using NGO and academic partners as ostensibly independent validators. The piece argues that these tactics amount to an attempt to weaponize AI information environments in support of Western narrative objectives in the Russia–Ukraine war and other theaters.
The article further asserts that some participants are tied to defense or intelligence contracts and that the group name "Counter-Disinfo Ops" suggests an operational, not purely academic, purpose. It suggests this activity blurs lines between legitimate counter-disinformation and offensive information operations, potentially undermining trust in AI tools used by global audiences. It notes that because Signal messages are end‑to‑end encrypted, the leak—if authentic—would likely require device-level compromise or insider access, and that Dougan provides only limited technical details about his claimed July 2024 hack. The article does not provide independent forensic verification of the logs but publishes screenshots of chat excerpts and a photograph of Dougan holding what appears to be printed material related to the leak. The tone is critical of the alleged Western actors and portrays their work as part of a broader hybrid-warfare contest, with AI as a new domain for influence operations.
The piece is published on a Substack-like platform, with options to share via email, Twitter/X, and other social platforms, and a comment section beneath the article. It contains embedded image callouts of selected chat excerpts inside blue-bordered boxes, emphasizing claims that participants explicitly discuss “seeding” training data and coordinating messaging about Ukraine, Russia, and NATO. No precise institutional affiliations or full participant lists are clearly visible in the screenshot beyond general references to "contractors" and "government-linked" individuals. No publication timestamp is legible in the screenshot, though the body text explicitly references Dougan’s leak as occurring on "September 24, 2024" and the alleged hack as occurring in "July" (context indicates July 2024). The article positions the leak within ongoing debates on AI safety, censorship, and information control in the context of the Russia–Ukraine conflict and Western–Russian hybrid confrontation.
Confidence: Medium
The primary subject is an alleged covert information operation by Western-aligned, government-linked contractors to shape AI outputs and online narratives on geopolitical issues. This fits the "Propaganda & disinformation campaigns" incident type within Cyber & Information Warfare. However, the underlying material is a single-source leak from a partisan actor (Dougan) with no independent technical verification, which lowers confidence in the factual accuracy of the claims, though the article ...
Source URL
https://www.newsguardrealitycheck.com/p/dougan-leak-exposes-concerted-effort
Published as a hybrid-warfare signal with a public source and reviewer-approved assessment bands. See the methodology for how records are assessed.
{
"id": "677860f4-b826-49b9-94cb-2cc04e37f1c4",
"url": "https://www.newsguardrealitycheck.com/p/dougan-leak-exposes-concerted-effort",
"source": "extension",
"status": "processed",
"category": "Cyber & Information Warfare",
"subcategory": "Information Operations",
"incident_type": "Propaganda & disinformation campaigns",
"country": "Russian Federation",
"source_reliability": "D",
"info_credibility": "4",
"tags": [
"AI manipulation",
"large language models",
"Signal leak",
"Counter-Disinfo Ops",
"russia–ukraine war",
"Western information operations",
"propaganda",
"disinformation",
"hybrid warfare",
"Dougan",
"encrypted chats",
"online influence"
],
"nodes": [],
"countries": [
"Russian Federation",
"United States of America"
],
"where_text": "Cyberspace",
"headline": null,
"description": "Article on NewsGuard Reality Check titled \"Dougan Leak Exposes Concerted Effort to Infect AI\" reports on alleged internal communications from former U.S. Marine and Palm Beach County deputy sheriff John Mark Dougan, who is described as a fugitive in Russia accused of hacking and doxxing law-enforcement personnel. The piece states that on September 24, 2024, Dougan published encrypted chat logs on his website, claimed to be extracted from a Signal group called \"Counter-Disinfo Ops,\" which he allegedly hacked in July 2024. According to the article, the Signal group purportedly includes contractors and employees of U.S. government agencies and allied organizations working on counter-disinformation. The leaked messages allegedly show participants discussing how to manipulate large language models and other AI systems by seeding them with curated content and shaping training data to steer outputs on contentious geopolitical questions, including narratives favorable to Ukraine and critical of Russia. The article claims that participants discuss targeting English-language, Russian-language, and other non‑English information ecosystems; working with fact-checking and media-rating outfits; and designing coordinated campaigns across social media and open-source platforms.\n\nNewsGuard Reality Check presents the leak as evidence of a \"concerted effort\" by Western-aligned information-warfare professionals to influence AI systems as part of a broader hybrid conflict with Russia. The article notes that Newsguard itself has previously been criticized for alleged bias, and it frames the Dougan leak as reinforcing concerns that Western counter-disinformation infrastructures operate as de facto propaganda networks. The article highlights specific excerpts in which group members allegedly discuss: (1) identifying key AI vendors and models to target; (2) crafting knowledge-base entries and reference articles that could be ingested into these models; (3) coordinating with Wikipedia editors and other open repositories to ensure that “authoritative sources” reflect preferred narratives; and (4) using NGO and academic partners as ostensibly independent validators. The piece argues that these tactics amount to an attempt to weaponize AI information environments in support of Western narrative objectives in the Russia–Ukraine war and other theaters.\n\nThe article further asserts that some participants are tied to defense or intelligence contracts and that the group name \"Counter-Disinfo Ops\" suggests an operational, not purely academic, purpose. It suggests this activity blurs lines between legitimate counter-disinformation and offensive information operations, potentially undermining trust in AI tools used by global audiences. It notes that because Signal messages are end‑to‑end encrypted, the leak—if authentic—would likely require device-level compromise or insider access, and that Dougan provides only limited technical details about his claimed July 2024 hack. The article does not provide independent forensic verification of the logs but publishes screenshots of chat excerpts and a photograph of Dougan holding what appears to be printed material related to the leak. The tone is critical of the alleged Western actors and portrays their work as part of a broader hybrid-warfare contest, with AI as a new domain for influence operations.\n\nThe piece is published on a Substack-like platform, with options to share via email, Twitter/X, and other social platforms, and a comment section beneath the article. It contains embedded image callouts of selected chat excerpts inside blue-bordered boxes, emphasizing claims that participants explicitly discuss “seeding” training data and coordinating messaging about Ukraine, Russia, and NATO. No precise institutional affiliations or full participant lists are clearly visible in the screenshot beyond general references to \"contractors\" and \"government-linked\" individuals. No publication timestamp is legible in the screenshot, though the body text explicitly references Dougan’s leak as occurring on \"September 24, 2024\" and the alleged hack as occurring in \"July\" (context indicates July 2024). The article positions the leak within ongoing debates on AI safety, censorship, and information control in the context of the Russia–Ukraine conflict and Western–Russian hybrid confrontation.",
"summary_short": "NewsGuard Reality Check describes a September 24, 2024 leak by U.S.-born fugitive in Russia John Mark Dougan, who claims to have hacked a Signal group called \"Counter-Disinfo Ops\" used by Western government-linked contractors. The leaked chats allegedly show coordinated efforts to influence AI systems, training data, and online reference sources to steer narratives on Russia, Ukraine, and other geopolitical topics, framed as part of Western information warfare in the hybrid conflict with Russia.",
"summary_extended": null,
"actor_primary": "John Mark Dougan",
"target_primary": null,
"location_text": "Signal group \"Counter-Disinfo Ops\"",
"location_region": "Russian Federation",
"location_coordinates_lat": 61.52401,
"location_coordinates_lon": 105.318756,
"location_precision": "Approximate",
"is_aggressor_signal": true,
"signal_type": "HYBRID_SIGNAL",
"is_hybrid_war_signal": true,
"classification_complete": true,
"hybrid_signal_complete": true,
"classification_confidence": "Medium",
"classification_rationale": "The primary subject is an alleged covert information operation by Western-aligned, government-linked contractors to shape AI outputs and online narratives on geopolitical issues. This fits the \"Propaganda & disinformation campaigns\" incident type within Cyber & Information Warfare. However, the underlying material is a single-source leak from a partisan actor (Dougan) with no independent technical verification, which lowers confidence in the factual accuracy of the claims, though the article ...",
"event_time_utc": "2024-09-24T00:00:00.000Z",
"end_time_utc": null,
"event_time_confidence": "pm24h",
"created_at": "2026-11-12T19:09:00.051Z",
"updated_at": "2026-11-12T19:24:58.718Z",
"reliability_band": "pattern",
"location_precision_band": "approximate",
"time_precision_band": "within_24h",
"severity_band": "moderate",
"attribution_confidence_band": "medium"
}Source reliability
D
Info credibility
4
Event time
Sep 24, 2024, 00:00 UTC
Event time confidence
pm24h
Location
Signal group "Counter-Disinfo Ops"
Region
Russian Federation
Primary actor
John Mark Dougan
Country
Russian Federation
Countries
Russian Federation, United States of America
Tags
AI manipulation, large language models, Signal leak, Counter-Disinfo Ops, russia–ukraine war, Western information operations, propaganda, disinformation, hybrid warfare, Dougan, encrypted chats, online influence
Signal
Submitted
Nov 12, 2026, 19:09 UTC
NewsGuard Reality Check describes a September 24, 2024 leak by U.S.-born fugitive in Russia John Mark Dougan, who claims to have hacked a Signal group called "Counter-Disinfo Ops" used by Western government-linked contractors. The leaked chats allegedly show coordinated efforts to influence AI systems, training data, and online reference sources to steer narratives on Russia, Ukraine, and other geopolitical topics, framed as part of Western information warfare in the hybrid conflict with Russia.
Article on NewsGuard Reality Check titled "Dougan Leak Exposes Concerted Effort to Infect AI" reports on alleged internal communications from former U.S. Marine and Palm Beach County deputy sheriff John Mark Dougan, who is described as a fugitive in Russia accused of hacking and doxxing law-enforcement personnel. The piece states that on September 24, 2024, Dougan published encrypted chat logs on his website, claimed to be extracted from a Signal group called "Counter-Disinfo Ops," which he allegedly hacked in July 2024. According to the article, the Signal group purportedly includes contractors and employees of U.S. government agencies and allied organizations working on counter-disinformation. The leaked messages allegedly show participants discussing how to manipulate large language models and other AI systems by seeding them with curated content and shaping training data to steer outputs on contentious geopolitical questions, including narratives favorable to Ukraine and critical of Russia. The article claims that participants discuss targeting English-language, Russian-language, and other non‑English information ecosystems; working with fact-checking and media-rating outfits; and designing coordinated campaigns across social media and open-source platforms.
NewsGuard Reality Check presents the leak as evidence of a "concerted effort" by Western-aligned information-warfare professionals to influence AI systems as part of a broader hybrid conflict with Russia. The article notes that Newsguard itself has previously been criticized for alleged bias, and it frames the Dougan leak as reinforcing concerns that Western counter-disinformation infrastructures operate as de facto propaganda networks. The article highlights specific excerpts in which group members allegedly discuss: (1) identifying key AI vendors and models to target; (2) crafting knowledge-base entries and reference articles that could be ingested into these models; (3) coordinating with Wikipedia editors and other open repositories to ensure that “authoritative sources” reflect preferred narratives; and (4) using NGO and academic partners as ostensibly independent validators. The piece argues that these tactics amount to an attempt to weaponize AI information environments in support of Western narrative objectives in the Russia–Ukraine war and other theaters.
The article further asserts that some participants are tied to defense or intelligence contracts and that the group name "Counter-Disinfo Ops" suggests an operational, not purely academic, purpose. It suggests this activity blurs lines between legitimate counter-disinformation and offensive information operations, potentially undermining trust in AI tools used by global audiences. It notes that because Signal messages are end‑to‑end encrypted, the leak—if authentic—would likely require device-level compromise or insider access, and that Dougan provides only limited technical details about his claimed July 2024 hack. The article does not provide independent forensic verification of the logs but publishes screenshots of chat excerpts and a photograph of Dougan holding what appears to be printed material related to the leak. The tone is critical of the alleged Western actors and portrays their work as part of a broader hybrid-warfare contest, with AI as a new domain for influence operations.
The piece is published on a Substack-like platform, with options to share via email, Twitter/X, and other social platforms, and a comment section beneath the article. It contains embedded image callouts of selected chat excerpts inside blue-bordered boxes, emphasizing claims that participants explicitly discuss “seeding” training data and coordinating messaging about Ukraine, Russia, and NATO. No precise institutional affiliations or full participant lists are clearly visible in the screenshot beyond general references to "contractors" and "government-linked" individuals. No publication timestamp is legible in the screenshot, though the body text explicitly references Dougan’s leak as occurring on "September 24, 2024" and the alleged hack as occurring in "July" (context indicates July 2024). The article positions the leak within ongoing debates on AI safety, censorship, and information control in the context of the Russia–Ukraine conflict and Western–Russian hybrid confrontation.
Confidence: Medium
The primary subject is an alleged covert information operation by Western-aligned, government-linked contractors to shape AI outputs and online narratives on geopolitical issues. This fits the "Propaganda & disinformation campaigns" incident type within Cyber & Information Warfare. However, the underlying material is a single-source leak from a partisan actor (Dougan) with no independent technical verification, which lowers confidence in the factual accuracy of the claims, though the article ...
Source URL
https://www.newsguardrealitycheck.com/p/dougan-leak-exposes-concerted-effort
Published as a hybrid-warfare signal with a public source and reviewer-approved assessment bands. See the methodology for how records are assessed.
{
"id": "677860f4-b826-49b9-94cb-2cc04e37f1c4",
"url": "https://www.newsguardrealitycheck.com/p/dougan-leak-exposes-concerted-effort",
"source": "extension",
"status": "processed",
"category": "Cyber & Information Warfare",
"subcategory": "Information Operations",
"incident_type": "Propaganda & disinformation campaigns",
"country": "Russian Federation",
"source_reliability": "D",
"info_credibility": "4",
"tags": [
"AI manipulation",
"large language models",
"Signal leak",
"Counter-Disinfo Ops",
"russia–ukraine war",
"Western information operations",
"propaganda",
"disinformation",
"hybrid warfare",
"Dougan",
"encrypted chats",
"online influence"
],
"nodes": [],
"countries": [
"Russian Federation",
"United States of America"
],
"where_text": "Cyberspace",
"headline": null,
"description": "Article on NewsGuard Reality Check titled \"Dougan Leak Exposes Concerted Effort to Infect AI\" reports on alleged internal communications from former U.S. Marine and Palm Beach County deputy sheriff John Mark Dougan, who is described as a fugitive in Russia accused of hacking and doxxing law-enforcement personnel. The piece states that on September 24, 2024, Dougan published encrypted chat logs on his website, claimed to be extracted from a Signal group called \"Counter-Disinfo Ops,\" which he allegedly hacked in July 2024. According to the article, the Signal group purportedly includes contractors and employees of U.S. government agencies and allied organizations working on counter-disinformation. The leaked messages allegedly show participants discussing how to manipulate large language models and other AI systems by seeding them with curated content and shaping training data to steer outputs on contentious geopolitical questions, including narratives favorable to Ukraine and critical of Russia. The article claims that participants discuss targeting English-language, Russian-language, and other non‑English information ecosystems; working with fact-checking and media-rating outfits; and designing coordinated campaigns across social media and open-source platforms.\n\nNewsGuard Reality Check presents the leak as evidence of a \"concerted effort\" by Western-aligned information-warfare professionals to influence AI systems as part of a broader hybrid conflict with Russia. The article notes that Newsguard itself has previously been criticized for alleged bias, and it frames the Dougan leak as reinforcing concerns that Western counter-disinformation infrastructures operate as de facto propaganda networks. The article highlights specific excerpts in which group members allegedly discuss: (1) identifying key AI vendors and models to target; (2) crafting knowledge-base entries and reference articles that could be ingested into these models; (3) coordinating with Wikipedia editors and other open repositories to ensure that “authoritative sources” reflect preferred narratives; and (4) using NGO and academic partners as ostensibly independent validators. The piece argues that these tactics amount to an attempt to weaponize AI information environments in support of Western narrative objectives in the Russia–Ukraine war and other theaters.\n\nThe article further asserts that some participants are tied to defense or intelligence contracts and that the group name \"Counter-Disinfo Ops\" suggests an operational, not purely academic, purpose. It suggests this activity blurs lines between legitimate counter-disinformation and offensive information operations, potentially undermining trust in AI tools used by global audiences. It notes that because Signal messages are end‑to‑end encrypted, the leak—if authentic—would likely require device-level compromise or insider access, and that Dougan provides only limited technical details about his claimed July 2024 hack. The article does not provide independent forensic verification of the logs but publishes screenshots of chat excerpts and a photograph of Dougan holding what appears to be printed material related to the leak. The tone is critical of the alleged Western actors and portrays their work as part of a broader hybrid-warfare contest, with AI as a new domain for influence operations.\n\nThe piece is published on a Substack-like platform, with options to share via email, Twitter/X, and other social platforms, and a comment section beneath the article. It contains embedded image callouts of selected chat excerpts inside blue-bordered boxes, emphasizing claims that participants explicitly discuss “seeding” training data and coordinating messaging about Ukraine, Russia, and NATO. No precise institutional affiliations or full participant lists are clearly visible in the screenshot beyond general references to \"contractors\" and \"government-linked\" individuals. No publication timestamp is legible in the screenshot, though the body text explicitly references Dougan’s leak as occurring on \"September 24, 2024\" and the alleged hack as occurring in \"July\" (context indicates July 2024). The article positions the leak within ongoing debates on AI safety, censorship, and information control in the context of the Russia–Ukraine conflict and Western–Russian hybrid confrontation.",
"summary_short": "NewsGuard Reality Check describes a September 24, 2024 leak by U.S.-born fugitive in Russia John Mark Dougan, who claims to have hacked a Signal group called \"Counter-Disinfo Ops\" used by Western government-linked contractors. The leaked chats allegedly show coordinated efforts to influence AI systems, training data, and online reference sources to steer narratives on Russia, Ukraine, and other geopolitical topics, framed as part of Western information warfare in the hybrid conflict with Russia.",
"summary_extended": null,
"actor_primary": "John Mark Dougan",
"target_primary": null,
"location_text": "Signal group \"Counter-Disinfo Ops\"",
"location_region": "Russian Federation",
"location_coordinates_lat": 61.52401,
"location_coordinates_lon": 105.318756,
"location_precision": "Approximate",
"is_aggressor_signal": true,
"signal_type": "HYBRID_SIGNAL",
"is_hybrid_war_signal": true,
"classification_complete": true,
"hybrid_signal_complete": true,
"classification_confidence": "Medium",
"classification_rationale": "The primary subject is an alleged covert information operation by Western-aligned, government-linked contractors to shape AI outputs and online narratives on geopolitical issues. This fits the \"Propaganda & disinformation campaigns\" incident type within Cyber & Information Warfare. However, the underlying material is a single-source leak from a partisan actor (Dougan) with no independent technical verification, which lowers confidence in the factual accuracy of the claims, though the article ...",
"event_time_utc": "2024-09-24T00:00:00.000Z",
"end_time_utc": null,
"event_time_confidence": "pm24h",
"created_at": "2026-11-12T19:09:00.051Z",
"updated_at": "2026-11-12T19:24:58.718Z",
"reliability_band": "pattern",
"location_precision_band": "approximate",
"time_precision_band": "within_24h",
"severity_band": "moderate",
"attribution_confidence_band": "medium"
}Source reliability
D
Info credibility
4
Event time
Sep 24, 2024, 00:00 UTC
Event time confidence
pm24h
Location
Signal group "Counter-Disinfo Ops"
Region
Russian Federation
Primary actor
John Mark Dougan
Country
Russian Federation
Countries
Russian Federation, United States of America
Tags
AI manipulation, large language models, Signal leak, Counter-Disinfo Ops, russia–ukraine war, Western information operations, propaganda, disinformation, hybrid warfare, Dougan, encrypted chats, online influence