DigitalMANIPULATIVE

Leak Forgery

What it is

Inserting forged or altered documents into a genuine leak, or fabricating a leak outright, so that the authenticity of the real material vouches for the fake and the forgery reaches the public with the credibility of a disclosure.

How it works

Leaks carry a presumption of authenticity that ordinary claims do not: the material was not meant to be seen, so it is assumed to be unguarded truth. Leak forgery spends that presumption. Donovan and Friedberg (2019) list it among the four source-hacking tactics, and the Citizen Lab's 2017 report Tainted Leaks documented the mechanism in detail: emails stolen from the journalist David Satter were altered and released alongside untouched files, so that verification of the archive as a whole validated the insertion. The lever is that journalists and readers authenticate archives, not documents; once a few items check out, the rest inherit their credibility. A second variant fabricates the entire leak, relying on the format of an exposure to do the work. Thomas Rid notes that a forged insert is most effective when it confirms what the target audience already suspects, because suspicion supplies the motive to believe and discourages the checking that would expose it. The tell is a single document that is more explosive than everything around it and cannot be independently sourced.

Real-world examples

•The Zinoviev letter, published by the Daily Mail four days before the 1924 British general election, purported to show the Comintern directing British communists; the Foreign Office's 1999 historical review concluded it was almost certainly a forgery that reached the press through intelligence contacts.
•In September 2004, CBS News aired memos said to be from George W. Bush's National Guard commander; typographic analysis by bloggers and experts showed they were likely produced with modern word-processing software, CBS retracted the story, and an independent panel faulted the network's verification.
•The 2017 MacronLeaks dump released hours before the French presidential runoff mixed genuine campaign emails with fabricated documents, and the Citizen Lab's Tainted Leaks report the same month showed doctored documents inserted into the stolen emails of a critic of the Kremlin.
•Graphika's 2020 Secondary Infektion report documented a six-year Russian operation that repeatedly planted forged letters and documents attributed to Western officials on blogs and forums across more than 300 platforms, most of which gained little traction — a reminder that the technique fails more often than it succeeds.

Historical case studies

The Zinoviev letter

1924UK Politics

Four days before the October 1924 British general election, the Daily Mail published a letter, supposedly from Comintern head Grigory Zinoviev, urging British communists toward sedition. It was presented as a leaked intelligence document and used to attack the Labour government's policy of treaties with Soviet Russia; Labour lost the election, although historians dispute how much the letter changed the result. A 1999 study by the Foreign Office's chief historian, commissioned by the government, concluded the letter was almost certainly a forgery and was leaked by people in or close to the intelligence services.

Source →

The Protocols of the Elders of Zion

1903Antisemitic Propaganda

First serialized in a St. Petersburg newspaper in 1903, the Protocols purports to be the leaked minutes of a secret Jewish plan for world domination. In 1921 The Times of London showed it to be a forgery, with large sections copied from Maurice Joly's 1864 French satire, which has nothing to do with Jews. Exposure did not stop it: Henry Ford's newspaper popularized it in the United States, and the Nazi regime used it in schools and propaganda. It remains the clearest case of a fabricated "secret document" outliving its own debunking.

Source →

Ethical guidelines

●Altering a leaked document is fabrication of evidence, and releasing it alongside genuine material adds a second deception about the whole.
●Newsrooms that receive leaked archives owe readers document-level verification — provenance, metadata, and corroboration for each item quoted — not a judgment about the archive.
●Publishing an explosive document on election eve, when it cannot be checked before votes are cast, is itself a choice that serves the forger.

How to defend against it

►Verify the specific document, not the dump: ask whether the item being quoted has been authenticated by someone independent of the leaker, and treat authenticated neighbors as no evidence about it.
►Look for the outlier — the one document that is dramatically more damaging than everything around it, mentions names the rest do not, or exists only in image form — and demand its provenance first.
►Check metadata and typography where files are available; the Killian memos and several Secondary Infektion forgeries failed on fonts, formatting, and file histories.
►Apply Rid's warning to yourself: a leaked document that confirms exactly what you suspected deserves more scrutiny, not less, because you are the audience the forgery was built for.
►Wait for the second source: genuine leaks are usually corroborated by other reporting within days, while forgeries depend on the first hours.

References

Hulcoop, A., Scott-Railton, J., Tanchak, P., Brooks, M., & Deibert, R. (2017). Tainted Leaks: Disinformation and Phishing With a Russian Nexus. Citizen Lab, Munk School of Global Affairs, University of Toronto
The documented alteration of stolen documents and their release among genuine files.
Donovan, J., & Friedberg, B. (2019). Source Hacking: Media Manipulation in Practice. Data & Society Research Institute · link
Leak forgery as one of the four source-hacking tactics.
Bennett, G. (1999). A most extraordinary and mysterious business: The Zinoviev Letter of 1924. Foreign and Commonwealth Office, Historians, History Notes No. 14
The official historical review concluding the Zinoviev letter was almost certainly forged.
Nimmo, B., François, C., Eib, C. S., Ronzaud, L., et al. (Graphika) (2020). Secondary Infektion. Graphika
The six-year forged-document operation across hundreds of platforms and its generally low traction.
Jeangène Vilmer, J.-B. (2019). The Macron Leaks Operation: A Post-Mortem. Atlantic Council and IRSEM
The mixing of forged and genuine documents in the 2017 dump.

Last reviewed 2026-09-07

Suggest a correction

Detect Leak Forgery in any text

Paste any message, email, or article into our free Manipulation Detector to see if Leak Forgery or other techniques are being used on you.

Try the Detector Free Create Free Account

Dark Patterns in UX: How Apps Manipulate Your Behavior

Subscription traps, misleading interfaces, and engineered addiction. Understanding the persuasion techniques built into the apps you use every day.

7 min read

OSINT for Beginners: Open Source Intelligence Explained

Open Source Intelligence (OSINT) uses publicly available data to gather actionable insights. Here is a beginner-friendly guide to what OSINT is and how it is used.

10 min read