DigitalMANIPULATIVE

Cutout Personas

What it is

Invented intermediaries — a lone hacker, a hacktivist collective, a leak site, a concerned insider — that stand between a sponsor and the public so that material can be released or claims made with a false, deniable origin story.

How it works

Cutout is a tradecraft term for an intermediary who insulates a principal from exposure. Online, the cutout is a character. It supplies what raw stolen files lack: a narrator with a motive the audience finds sympathetic or at least plausible, such as the idealistic hacker, the patriotic whistleblower, or the anonymous collective. The persona handles journalists, gives interviews by direct message, and takes credit, so the question of who did this appears already answered. It also buys time. Even a thin cover story forces investigators to spend effort disproving it while coverage proceeds. Personas fail on details that are hard to sustain: language that does not match the claimed nationality, metadata in released files, login records that platforms or governments can see, and reuse of infrastructure across supposedly unrelated characters. The defender's difficulty is that outsiders rarely have that data, so public debunking often leans on content cues, which are suggestive and not proof. The solid attributions in this area have come from platform records and legal process.

Real-world examples

  • •The Mueller report describes how GRU officers created DCLeaks, presented as the work of American hacktivists, and Guccifer 2.0, presented as a lone Romanian hacker, to release material stolen in 2016. Reporters noted at the time that Guccifer 2.0 struggled to write Romanian; the firm attribution rested on server and account records described in the 2018 indictment.
  • •The CyberCaliphate persona that claimed the 2015 TV5Monde attack and the takeover of U.S. Central Command social media accounts presented itself as aligned with the Islamic State; Western officials and security firms later linked it to APT28.
  • •The group calling itself Guardians of Peace claimed the 2014 Sony Pictures intrusion, which the FBI attributed to North Korea.
  • •Commercial and domestic actors use the same device: Meta and other investigators have documented marketing firms that built fake local news outlets and fake grassroots spokespeople to front for political clients in Latin America, Africa, and the Middle East.

Ethical guidelines

  • ●Journalists dealing with an anonymous source who supplies hacked material should treat the source's self-description as a claim to be tested and reported as unverified.
  • ●Do not grant a persona the credibility of its cover story by repeating the story in a headline.
  • ●Analysts should say which parts of a debunking rest on content cues and which on harder data.
  • ●Inventing a front to hide the true sponsor of political communication is deception regardless of cause.

How to defend against it

  • ►Treat any new, anonymous figure who appears with newsworthy documents and a ready-made backstory as unverified, however sympathetic the story.
  • ►Ask how the persona benefits from being believed, and who would benefit if the persona is a front.
  • ►Look for independent authentication of both the material and the messenger, and note when only the material has been checked.
  • ►Notice brand-new leak sites and accounts created shortly before a release, with professional presentation and no history.
  • ►Expect firm attribution to take months and to come from indictments, platform disclosures, or multi-source technical reports, not from the first week's commentary.

References

  1. Mueller, R. S. (U.S. Department of Justice) (2019). Report On The Investigation Into Russian Interference In The 2016 Presidential Election, Volume I. U.S. Department of Justice · link
    The creation and operation of the DCLeaks and Guccifer 2.0 personas by GRU officers.
  2. U.S. Department of Justice (2018). United States v. Netyksho et al., Indictment, Case 1:18-cr-00215 (D.D.C.). U.S. District Court for the District of Columbia, July 13, 2018
    The infrastructure and account evidence tying the personas to named GRU officers.
  3. Rid, T. (2020). Active Measures: The Secret History of Disinformation and Political Warfare. Farrar, Straus and Giroux
    The history of fronts and cutouts in leak operations and the account of the 2016 personas.
Last reviewed
Suggest a correction

Detect Cutout Personas in any text

Paste any message, email, or article into our free Manipulation Detector to see if Cutout Personas or other techniques are being used on you.

Try the Detector FreeCreate Free Account

Related Articles

Dark Patterns in UX: How Apps Manipulate Your Behavior

Subscription traps, misleading interfaces, and engineered addiction. Understanding the persuasion techniques built into the apps you use every day.

7 min read

OSINT for Beginners: Open Source Intelligence Explained

Open Source Intelligence (OSINT) uses publicly available data to gather actionable insights. Here is a beginner-friendly guide to what OSINT is and how it is used.

10 min read