False flag

As pretexts for war

Russo-Swedish War

In 1788, the head tailor at the Royal Swedish Opera received an order to sew a number of Russian military uniforms. These were then used by Swedes to stage an attack on Puumala, a Swedish outpost on the Russo-Swedish border, on 27 June 1788. This caused an outrage in Stockholm and persuaded the Riksdag of the Estates, the Swedish national assembly, who until then had refused to agree to an offensive war against Russia. The Puumala incident allowed King Gustav III of Sweden, who lacked the constitutional authority to initiate unprovoked hostilities without the Estates' consent, to launch the Russo-Swedish War (1788–1790).

Franco-Prussian War

On 13 July 1870, Otto von Bismarck published the Ems Dispatch, an internal message from King Wilhelm I to Bismarck regarding certain demands made by the French ambassador. In the version purposefully released to the public, Bismarck instead made it sound like the King had gravely disrespected the ambassador – a ploy to trick Emperor Napoleon III into declaring war on the North German Confederation, with the end goal of unifying the northern and southern German states. This ploy would be successful, as Napoleon III would declare war six days later; and six months later, the Confederation would win and unify the German states.

Second Sino-Japanese War

In September 1931, Seishirō Itagaki and other Japanese mid- to junior-grade officers, without the knowledge of the Tokyo government, fabricated a pretext for invading Manchuria by blowing up a section of railway. Though the explosion was too weak to disrupt operations on the rail line, the Japanese nevertheless used the Mukden incident to seize Manchuria and create a puppet government in the form of the nominally independent state of Manchukuo.

World War II

Gleiwitz incident

The Gleiwitz incident in 1939 involved Reinhard Heydrich fabricating evidence of a Polish attack against Germany to mobilize German public opinion for war and to justify the war against Poland. Alfred Naujocks was a key organiser of the operation under orders from Heydrich. It led to the deaths of Nazi concentration camp victims who were dressed as German soldiers and then shot by the Gestapo to make it seem that they had been shot by Polish soldiers. This, along with other false flag operations in Operation Himmler, would be used to mobilize support from the German population for the start of World War II in Europe.

The operation failed to convince international public opinion of the German claims, and both Britain and France – Poland's allies – declared war two days after Germany invaded Poland.

Winter War

On 26 November 1939, the Soviet army shelled Mainila, a Russian village near the Finnish border. Soviet authorities blamed Finland for the attack and used the incident as a pretext to invade Finland, starting the Winter War, four days later.

Cuban regime change

Operation Northwoods

Operation Northwoods, a 1962 plot proposed but never executed by the U.S. Department of Defense for a war with Cuba, involved scenarios such as fabricating the hijacking or shooting down of passenger and military planes, sinking a U.S. ship in the vicinity of Cuba, burning crops, sinking a boat filled with Cuban refugees, attacks by alleged Cuban infiltrators inside the United States, and harassment of U.S. aircraft and shipping, and the destruction of aerial drones by aircraft disguised as Cuban MiGs. These actions would be blamed on Cuba, and would be a pretext for an invasion of Cuba and the overthrow of Fidel Castro's communist government. It was authorised by the Joint Chiefs of Staff, but then rejected by President John F. Kennedy. The surprise discovery of the documents relating to Operation Northwoods was a result of the comprehensive search for records related to the assassination of President John F. Kennedy by the Assassination Records Review Board in the mid-1990s. Information about Operation Northwoods was later publicized by James Bamford.

Russian invasion of Ukraine

In January and February 2022, U.S. officials warned that Russian operatives were planning a false flag operation in Ukraine in order to justify a military intervention. In the days leading up to the Russian invasion of Ukraine on 24 February, the Russian government intensified its disinformation campaign, with Russian state media promoting false flags on a nearly hourly basis purporting to show Ukrainian forces attacking Russia, in a bid to justify an invasion of Ukraine. Many of the disinformation videos were poor and amateur in quality, with mismatching metadata showing incorrect dates, and evidence from Bellingcat researchers and other independent journalists showed that the claimed attacks, explosions, and evacuations in Donbas were staged by Russia.

Operation Southern Spear

During Operation Southern Spear, Venezuela claimed to have prevented several false flag attacks planned by the United States and the Venezuelan opposition. On 7 October 2025, the American embassy in Caracas was reinforced following tips concerning a bomb plot, while on 26 October, four allegedly CIA-backed mercenaries that had planned to attack the USS Gravely while it was docked in Trinidad and Tobago were captured.

As a tactic to undermine political opponents

Lermontov detachment

During the Caucasus War a Russian imperial army special unit named "Lermontov detachment" (for a few months it was headed by Mikhail Lermontov) operated behind enemy lines disguised as the insurgents. An insider account reported that "they shaved their heads, grew beards, dressed them Circassian style, and armed them with double-barreled shotguns with bayonets".

Soviet covert operations on German-occupied territories during World War II

During World War II Soviet airborne units, operating on enemy-occupied territory, posed as German Wehrmacht personnel using Wehrmacht uniform.

Soviet covert operations in Ukraine

In the post-World War II Ukraine, Soviet NKVD employed units dressed as Ukrainian Insurgent Army fighters. They committed a number of well-documented atrocities against civilian population posing as the insurgents.

Operation TPAJAX

On 4 April 1953, the CIA was ordered to undermine the government of Iran over a four-month period, as a precursor to overthrowing Prime Minister Mohammad Mosaddegh. One tactic used to undermine Mosaddegh was to carry out false flag attacks "on mosques and key public figures", to be blamed on Iranian communists loyal to the government.

The CIA operation was code-named TPAJAX. The tactic of a "directed campaign of bombings by Iranians posing as members of the Communist party" involved the bombing of "at least one" well known Muslim's house by CIA agents posing as Communists. The CIA determined that the tactic of false flag attacks added to the "positive outcome" of TPAJAX.

However, as "the C.I.A. burned nearly all of its files on its role in the 1953 coup in Iran", the true extent of the tactic has been difficult for historians to discern.

Operation Susannah

In the summer of 1954, a group of Egyptian Jews – recruited by Israel's Militant Intelligence Directorate Aman – planned to bomb American, British, and Egyptian civil targets in Egypt. The bombings were to be blamed on the Muslim Brotherhood, Egyptian Communists, "unspecified malcontents", or "local nationalists", with the aim of creating a climate of sufficient violence and instability to induce the British government to refrain from evacuating its troops occupying the Suez Canal.

Only two bombs were successfully detonated before the plot was discovered. Unknown to Israel Prime Minister Moshe Sharet, the exposé caused a scandal in Israel, with Israeli officials blaming one another for the operation and the Israeli defense minister, Pinhas Lavon, resigning under pressure. Later, two investigative committees found that Lavon was unaware of the operation.

Failed operations

Due to its deceptive nature a false flag operation can fail in such a manner as to implicate the perpetrator rather than the intended victim.

A notable example is an April 2022 FSB operation where Ukrainian would-be assassins of Russian propagandist Vladimir Solovyov were filmed while being arrested. The footage published by the FSB was, however, found to implicate the FSB as having staged the arrest. Together with weapons, drugs, Ukrainian passports, and Nazi memorabilia the footage also prominently showed three expansion packs for The Sims 3 video game. Investigative journalist Eliot Higgins interpreted this to mean that the arrest was in fact staged, with its organizers misunderstanding an instruction "to get 3 SIMs". Further lending credence to the arrest being staged was footage of a note with a Russian phrase, which in fact read signature unclear. This was again interpreted as a misunderstood instruction, this time taken too literally. The FSB subsequently published a version of the footage with the Sims games blurred out.

Pseudo-operations

Pseudo-operations are those in which forces of one power disguise themselves as enemy forces. For example, a state power may disguise teams of operatives as insurgents and, with the aid of defectors, infiltrate insurgent areas. The aim of such pseudo-operations may be to gather short- or long-term intelligence or to engage in active operations, in particular assassinations of important enemies. However, they usually involve both, as the risks of exposure rapidly increase with time and intelligence gathering eventually leads to violent confrontation. Pseudo-operations may be directed by military or police forces, or both. Police forces are usually best suited to intelligence tasks; however, military provide the structure needed to back up such pseudo-ops with military response forces. According to US military expert Lawrence Cline (2005), "the teams typically have been controlled by police services, but this largely was due to the weaknesses in the respective military intelligence systems".

The State Political Directorate (OGPU) of the Soviet Union set up such an operation from 1921 to 1926. During Operation Trust, they used loose networks of White Army supporters and extended them, creating the pseudo-"Monarchist Union of Central Russia" (MUCR) in order to help the OGPU identify real monarchists and anti-Bolsheviks.

An example of a successful assassination was United States Marine Sergeant Herman H. Hanneken leading a patrol of his Haitian Gendarmerie disguised as enemy guerrillas in 1919. The patrol successfully passed several enemy checkpoints in order to assassinate the guerilla leader Charlemagne Péralte near Grande-Rivière-du-Nord. Hanneken was awarded the Medal of Honor and was commissioned a Second Lieutenant for his deed.

During the Mau Mau uprising in the 1950s, captured Mau Mau members who switched sides and specially trained British troops initiated the pseudo-gang concept to successfully counter Mau Mau. In 1960, Frank Kitson, who was later involved in the Northern Irish conflict, published Gangs and Counter-gangs, an account of his experiences with the technique in Kenya. Information included how to counter gangs and measures of deception, including the use of defectors, which brought the issue a wider audience.

Another example of combined police and military oversight of pseudo-operations include the Selous Scouts in the former country Rhodesia (now Zimbabwe), governed by white minority rule until 1980. The Selous Scouts were formed at the beginning of Operation Hurricane, in November 1973, by Major (later Lieutenant Colonel) Ronald Reid-Daly. As with all Special Forces in Rhodesia, by 1977, they were controlled by COMOPS (Commander, Combined Operations) Commander Lieutenant General Peter Walls. The Selous Scouts were originally composed of 120 members, with all officers being white and the highest rank initially available for black soldiers being colour sergeant. They succeeded in turning approximately 800 insurgents who were then paid by Special Branch, ultimately reaching the number of 1,500 members. Engaging mainly in long-range reconnaissance and surveillance missions, they increasingly turned to offensive actions, including the attempted assassination of Zimbabwe People's Revolutionary Army leader Joshua Nkomo in Zambia. This mission was finally aborted by the Selous Scouts, and attempted again, unsuccessfully, by the Rhodesian Special Air Service.

Some offensive operations attracted international condemnation, in particular the Selous Scouts' raid on a Zimbabwe African National Liberation Army (ZANLA) camp at Nyadzonya Pungwe, Mozambique in August 1976. ZANLA was then led by Josiah Tongogara. Using Rhodesian trucks and armored cars disguised as Mozambique military vehicles, 84 scouts killed 1,284 people in the camp, registered as a refugee camp by the United Nations (UN). Even according to Reid-Daly, most of those killed were unarmed guerrillas standing in formation for a parade. The camp hospital was also set ablaze by the rounds fired by the Scouts, killing all patients. According to David Martin and Phyllis Johnson, who visited the camp shortly before the raid, it was only a refugee camp that did not host any guerrillas. It was staged for UN approval.

According to a 1978 study by the Directorate of Military Intelligence, 68% of all insurgent deaths inside Rhodesia could be attributed to the Selous Scouts, who were disbanded in 1980.

If the action is a police action, then these tactics would fall within the laws of the state initiating the pseudo, but if such actions are taken in a civil war or during a belligerent military occupation then those who participate in such actions would not be privileged belligerents. The principle of plausible deniability is usually applied for pseudo-teams. Some false flag operations have been described by Lawrence E. Cline, a retired US Army intelligence officer, as pseudo-operations, or "the use of organized teams which are disguised as guerrilla groups for long- or short-term penetration of insurgent-controlled areas".

"Pseudo-operations should be distinguished", notes Cline, "from the more common police or intelligence infiltration of guerrilla or criminal organizations. In the latter case, infiltration is normally done by individuals. Pseudo teams, on the other hand, are formed as needed from organized units, usually military or paramilitary. The use of pseudo teams has been a hallmark of a number of foreign counterinsurgency campaigns."

Similar false flag tactics were also employed during the Algerian Civil War, starting in the middle of 1994. Death squads composed of Département du Renseignement et de la Sécurité (DRS) security forces disguised themselves as Islamist terrorists and committed false flag terror attacks. Such groups included the Organisation of Young Free Algerians (OJAL) or the Secret Organisation for the Safeguard of the Algerian Republic (OSSRA). According to Roger Faligot and Pascal Kropp (1999), the OJAL was reminiscent of "the Organization of the French Algerian Resistance (ORAF), a group of counter-terrorists created in December 1956 by the Direction de la surveillance du territoire (Territorial Surveillance Directorate, or DST) whose mission was to carry out terrorist attacks with the aim of quashing any hopes of political compromise".

Espionage

In espionage, the term "false flag" describes the recruiting of agents by operatives posing as representatives of a cause the prospective agents are sympathetic to, or even the agents' own government. For example, during the Cold War, several female West German civil servants were tricked into stealing classified documents by agents of the East German Stasi intelligence service pretending to be members of West German peace advocacy groups (the Stasi agents were also described as "Romeos", indicating that they also used their sex appeal to manipulate their targets, making this operation a combination of the false flag and "honey trap" techniques).

According to ex-KGB defector Jack Barsky, "Many a right-wing radical had given information to the Soviets under a 'false flag', thinking they were working with a Western ally, such as Israel, when in fact their contact was a KGB operative."

Militant usage

False flag operations are also utilized by non-state actors and terrorist organizations. During the Indian security forces siege prior to the storming of the Golden Temple, Babbar Khalsa militants allegedly infiltrated buildings between CRPF lines and the positions of pro-Bhindranwale militants and fired in both directions in the hope of provoking firefights. This was allegedly done as a result of Babbar Khalsa leader Bibi Amarjit Kaur blaming Bhindranwale for the death of her husband, Fauja Singh, during the 1978 Sikh–Nirankari clash.

On 5 October 1987, LTTE fighters infiltrated between IPKF and Sri Lankan army positions in the Kankesanturai area and provoked a firefight between the two forces as part of the revenge operations in retaliation for the suicide in custody of 15 LTTE leaders who were about to be handed into Sri Lankan custody.

Civilian usage

The term is popular among conspiracy theory promoters in referring to covert operations of various governments and claimed cabals. According to Columbia Journalism Review, this usage mostly "migrated to the right". However, because some historical false flag incidents occurred, historians should not fully cede the usage of the term to conspiracy theorists. Perlman says "The real danger is if we use the nonattributive 'false flags' as shorthand for conspiracy theories, without explaining what they are and who is promoting them." At the same time, Perlman writes that "people yelling that any attack attributed to someone on 'their side' was committed by 'the other side' drown out the voices of reason".

Political campaigning

Political campaigning has a long history of this tactic in various forms, including in person, print media and electronically in recent years. This can involve when supporters of one candidate pose as supporters of another, or act as "straw men" for their preferred candidate to debate against. This can happen with or without the candidate's knowledge. The Canuck letter is an example of one candidate's creating a false document and attributing it as coming from another candidate in order to discredit that candidate.

In 2006, individuals practicing false flag behavior were discovered and "outed" in New Hampshire and New Jersey after blog comments claiming to be from supporters of a political candidate were traced to the IP address of paid staffers for that candidate's opponent.

On 19 February 2011, Indiana Deputy Prosecutor Carlos Lam sent a private email to Wisconsin Governor Scott Walker suggesting that he run a "'false flag' operation" to counter the protests against Walker's proposed restrictions on public employees' collective bargaining rights:

If you could employ an associate who pretends to be sympathetic to the unions' cause to physically attack you (or even use a firearm against you), you could discredit the unions ... Employing a false flag operation would assist in undercutting any support the media may be creating in favor of the unions.

The press had acquired a court order to access all of Walker's emails and Lam's email was exposed. At first, Lam vehemently denied sending the email, but eventually admitted it and resigned.

Some conservative commentators suggested that pipe bombs that were sent to prominent Democrats prior to the 2018 mid-term elections were part of a false flag effort to discredit Republicans and supporters of then-President Donald Trump. Cesar Sayoc, motivated by his belief that Democrats were "evil", was later convicted of mailing the devices to Trump's critics.

On the internet, a concern troll is a false flag pseudonym created by a user whose actual point of view is opposed to the one that the troll claims to hold. The concern troll posts in web forums devoted to its declared point of view and attempts to sway the group's actions or opinions while claiming to share their goals, but with professed "concerns". The goal is to sow fear, uncertainty, and doubt within the group often by appealing to outrage culture. This is a particular case of sockpuppeting and safe-baiting.

During the 2025 Canadian federal election campaign, Liberal Party of Canada strategists were exposed after their false flag operation failed. A CBC News journalist who was speaking with Liberal staff at a bar in Ottawa learned how "Stop the Steal" buttons were placed at a Conservative Party of Canada event. The operatives hoped attendees would wear them, which would allow Liberals to publicly conflate Conservative supporters and leader Pierre Poilievre with Donald Trump. After the false flag mission was reported by the journalist, Liberal leader Mark Carney reassigned those involved.

Ideological

Proponents of political or religious ideologies will sometimes use false flag tactics. This can be done to discredit or implicate rival groups, create the appearance of enemies when none exist, or create the illusion of organized and directed persecution. This can be used to gain attention and sympathy from outsiders, in particular the media, or to convince others within the group that their beliefs are under attack and in need of protection.

In retaliation for writing The Scandal of Scientology, some members of the Church of Scientology stole stationery from author Paulette Cooper's home and then used that stationery to forge bomb threats and have them mailed to a Scientology office. The Guardian's Office also had a plan for further operations to discredit Cooper known as Operation Freakout, but several Scientology operatives were arrested in a separate investigation and the plan was exposed.

According to PolitiFact, some false flag conspiracy theories (such as claims that mass shootings are hoaxes) are themselves spread by astroturfing, which is an attempt to create false impression of popularity in a belief.