At eight in the evening on 31 August 1939, a small team in Polish uniforms seized a radio transmitter at Gleiwitz in Upper Silesia and broadcast a few minutes of anti-German agitation. By the following morning the event had a name, an author, and a consequence: a Polish provocation, answered by the invasion that began the Second World War in Europe. The name held for six years. The finding out took until December 1945, when the sworn affidavit of the SS officer who ran the operation was read into the record at Nuremberg, complete with the code name for the murdered prisoner left at the scene.
That gap, between the naming and the finding out, is the subject here. Recognising a false flag in hindsight is easy; the archive does the work. Recognising one in the moment appears to be among the hardest problems in conflict analysis, and the record is humbling about how rarely it has been done. But the record also has a shape, and the shape is instructive. Confirmation, when it came, came through the same narrow set of channels: a perpetrator testifying under legal or moral pressure, an archive opening after a regime changed, a declassification decades later, an operational failure at the scene, a judicial investigation grinding on for years. None, on that record, was confirmed by someone reading the event correctly at the time. Contemporary sceptics existed, and some guessed right, but they guessed alongside people who guessed wrong for identical reasons, and being right for weak reasons is not detection.
What those channels share, in the vocabulary of an earlier essay in this series, is that they are all substrate channels. The story of a false flag is by construction self-consistent; it is the fabricated part, built to survive scrutiny of exactly the kind a story invites. What eventually gives it away is the material and institutional residue the story cannot fully control: the range of a gun, the chemistry of an explosive, the paper trail of a mobilisation, the memory of a man who drove the car. A false flag is arguably the limit case of the pattern that essay describes. Not a story that under-reads its substrate, but a story manufactured precisely because the substrate cannot be admitted. The substrate essay’s Iran section described a motive too useful to name, dressed in a rotating wardrobe of announceable reasons. A false flag goes one step further: the costume is not merely worn over the substrate but cut to point away from it.
Which suggests a method, or at least a discipline: two questions per event, asked in order. Where is the meaning being made, and what is the residue saying? The first question locates the room: the broadcast, the diplomatic note, the anonymous phone call, the press briefing, the venue where the event acquires its author and its significance. The second question ignores that room entirely and reads the enabling conditions on both sides: whether the accused party had the capability, access, and trajectory the story requires, and whether the accuser’s material preparations predate the trigger they are supposedly responding to. When the two layers agree, the event is probably what it claims to be. When they diverge, the divergence is worth more attention than the story. What follows walks the confirmed cases with those two questions, then asks what the method is worth in a sensor-saturated present, and ends where this series keeps ending, in a strait.
Gleiwitz: a war waiting for its incident
Where the meaning was made: a transmitter, then a podium. The broadcast itself was the first act of naming, agitation in Polish from a German station, designed to be overheard. The second act came the next morning in the Reichstag, where Hitler folded Gleiwitz into a catalogue of border incidents, three of them described as quite serious, as the justification for the invasion already underway. The significance was assigned before most Germans had finished breakfast. It is worth noting how little effort went into making the story durable. Hitler had told his generals on 22 August that he would provide a propagandistic casus belli and that the victor would not be asked whether he told the truth. The meaning only needed to hold for a news cycle, because the meaning was not the cause of anything. It was the garment.
What the residue was saying: everything, to anyone positioned to read it. The invasion it justified, Fall Weiss, had been planned for months and was scheduled before the transmitter was seized; armies of that size do not assemble overnight in response to a radio broadcast. On the accused side, the substrate was silent in the way that is itself informative. Poland in August 1939 had no mobilisation posture, no strategic interest, and no operational logic consistent with raiding a German provincial radio station on the eve of a war it was desperate to avoid. The story supplied an intention; the substrate could not supply a capability or a reason. And the scene itself over-explained. A body was left behind, a Polish-sympathising Silesian farmer drugged unconscious by a man in a doctor’s coat, then shot, the operation’s cold term for such props preserved in the Naujocks affidavit. Genuine scenes tend to be underdetermined. This one came with its conclusion attached.
The confirmation took regime collapse, then a tribunal with subpoena power. A substrate channel, six years late.
Mainila: guns withdrawn out of range
Where the meaning was made: a diplomatic note and a front page. On the evening of 26 November 1939, Molotov handed the Finnish ambassador a note stating that Finnish artillery had killed four Soviet soldiers near the border village of Mainila, and Pravda carried the casualties the next day. The note came with a demand attached, the withdrawal of Finnish forces from the border, and the demand came with a deadline. Within four days the Soviet Union had renounced the non-aggression pact and launched the Winter War. The venue of meaning-making was diplomatic and journalistic, and it was airtight in the way a closed system is airtight: Finland proposed a neutral joint investigation, and the Soviet Union refused it and broke relations instead. Refusing the investigation was, in retrospect, the loudest sentence in the whole exchange.
What the residue was saying: the case is almost embarrassingly clean, which is why it repays study. On the accused side, the commander of the Finnish artillery confirmed that no battery could reach across the border, Mannerheim having ordered the guns held well back, and the border guards who watched the shells fall saw a Soviet party come up to inspect the damage and promptly leave. On the beneficiary side, the preparations predated the trigger by an implausible margin: Soviet war games in 1938 and 1939 had rehearsed a war sparked by border incidents at Mainila specifically, invasion plans were complete by late November, and a later Russian historian working through declassified unit records found no personnel losses reported in the area during the period in question. The dead soldiers of the diplomatic note did not exist in the substrate. The scriptedness even extended to the choreography of restraint: the note stressed that Soviet troops, under strict orders, had not returned fire. It is a detail a study of the incident’s propaganda framing treats as systematic: innocence established in advance of an invasion.
The confirmation came from archives and memoirs: Khrushchev’s recollections, crediting the incident to a marshal of artillery; Zhdanov’s private papers; and eventually a Russian president conceding in 1994 that the Winter War had been Stalin’s aggression. Substrate channels again, half a century late.
Cairo: the device that told on its owner
Where the meaning was supposed to be made: nowhere, which was the design. Operation Susannah, the 1954 Israeli military intelligence operation that became the Lavon Affair, planted devices across Cairo and Alexandria, in British-, American-, and Egyptian-associated civilian sites, timed to detonate after closing. The attacks were meant to be attributed to the Muslim Brotherhood, communists, or unspecified local nationalists, with the aim of persuading London that Egypt was too unstable to leave. The meaning-making venue here was the rumour mill and the foreign desk: no broadcast, no note, just a pattern of incidents inviting the obvious wrong inference. It is perhaps the quietest variant of the form, and in some ways the purest, because the intended significance was to be assigned by the victims’ own analysts.
What the residue did instead: it misbehaved. One of the devices ignited prematurely in an operative’s pocket on the way to a cinema, the operative was arrested, and the network unravelled from the scene outward. This is the operational-failure channel in its most literal form, the substrate refusing to keep to the script at the level of chemistry. What followed inside Israel is a study in the afterlife of a failed fabrication: a decade of inquiries and counter-inquiries over who had authorised the operation, a defence minister forced out, a document later found to be doctored, and fifty-one years of official denial ending only in 2005, when the surviving operatives were publicly honoured. The naming of the affair itself is instructive: it carries the name of the minister blamed, not the country bombed, because the meaning-fight the institution cared about was internal.
Northwoods: the pretext as a design document
One case in the record involves no event at all, and it may be the most clarifying of the set. In March 1962 the US Joint Chiefs of Staff signed and forwarded to the Secretary of Defense a memorandum proposing pretexts that could be manufactured to justify an invasion of Cuba, including a staged shootdown of a civilian airliner and a fabricated attack on the Guantanamo base. Kennedy rejected it; nothing in the document was executed; the papers surfaced in the 1990s through the JFK Assassination Records Review Board and were published in full by the National Security Archive.
Where the meaning was to be made: that is what the document specifies, and the specification is the value of the case. Northwoods is a false flag with the event removed and only the meaning-making machinery left visible: casualty lists to be published, funerals to be staged, a wave of national indignation to be produced on schedule. Reading it is like reading the stage directions without the play. The document demonstrates, from the inside, that the naming of an event and the event itself are separable engineering problems, and that a planning staff can work on the first without reference to the second. It also demonstrates the ordering the confirmed cases keep repeating: the desired end state, invasion, came first, and the incident was to be reverse-engineered from it. A pretext is a dependency of a plan, not a cause of one.
Celle: evidence that over-explains
Where the meaning was made: the manhunt apparatus and the evening news. On 25 July 1978 an explosion opened a hole about forty centimetres across in the outer wall of Celle prison in Lower Saxony, and the event was immediately legible as a Red Army Faction attempt to free the prisoner Sigurd Debus. The legibility had been manufactured with some care: a stolen Mercedes found nearby containing forged passports, one bearing Debus’s photograph, plus ammunition; escape tools planted in Debus’s own cell to be discovered in the search; a suspect from the criminal milieu presented to the media. The meaning held for eight years and did real work in the world. Debus’s conditions of detention were tightened, the high-security wing was upgraded, and Debus himself, denied relief with the supposed escape attempt cited against him, joined a hunger strike in 1981 that killed him.
What the residue was saying: the scene suffered from the professional deformation of planted evidence, which is completeness. A genuine escape attempt tends to leave gaps and improvisation; this one left a car conveniently intercepted with documents conveniently identifying the desired beneficiary, forged on blanks whose serial numbers traced to German authorities, next to a hole too small for anyone to have escaped through. And the attack that was supposed to inaugurate a series never acquired a sequel. The story was revealed in 1986 not by any of this being read at the time, but by a journalist at the Hannoversche Allgemeine Zeitung receiving leaks showing that the state’s own domestic intelligence service and GSG 9 had staged the bombing, nominally to build cover for informants. A parliamentary committee followed. The German press coined a durable phrase for the affair’s monument, the preserved chunk of wall with its hole, and the case settled into its role as the Federal Republic’s standing reminder that false flag is not always paranoia in German political argument.
Peteano: the forensic report as part of the crime scene
Where the meaning was made: an anonymous phone call and a laboratory. On 31 May 1972 a car bomb at Peteano killed three Carabinieri who had been lured to the vehicle; two days later an anonymous call implicated the Red Brigades, and the police response rounded up some two hundred people on the left. The forensic layer was then bent to match the naming: the explosives expert consulted by the investigation, himself a member of the neo-fascist Ordine Nuovo, certified the explosive as consistent with Red Brigades usage. This is the case where the meaning-making room and the evidence room turn out to be the same room, which is worth sitting with. Substrate reading assumes the residue is at least neutral. Peteano shows the residue can be captured, for a while, by whoever controls the chain of custody.
What the residue was saying underneath: the explosive was in fact C4, and an arms cache containing identical C4 had been stumbled on near Trieste earlier the same year, one of what proved to be more than a hundred buried NATO stay-behind caches. When the magistrate Felice Casson reopened the dormant case in 1984, the chemistry was the thread: the fraudulent expertise, the matching cache, and eventually the confession of Vincenzo Vinciguerra, the Ordine Nuovo member who had planted the bomb and who testified that after the attack an entire mechanism of state protection had come into action to cover him. His trial statements described the purpose with unusual candour, a campaign to attack civilians so the public would turn to the state for protection. What such a campaign buys is a flow, not a stock: the turning-to-the-state drains unless renewed, which is why strategies of tension run to series, and why the series needs hands. That testimony, plus Casson’s later access to the military intelligence archives in 1990, forced the prime minister’s public acknowledgement of the Gladio network. The confirmation took twelve years of judicial attrition and one perpetrator who decided that being abandoned by his protectors dissolved his obligations to them. Perpetrator testimony and archives: the same two channels, again.
Ryazan: the case where the channels never ran
The set so far might suggest the substrate always testifies eventually. Ryazan is the standing counter-example, and its structure explains why it remains contested rather than confirmed. On the night of 22 September 1999, during the wave of apartment bombings that killed some three hundred people across Russia, residents of a building in Ryazan reported men unloading sacks into the basement from a car with doctored plates. The local bomb squad found sacks wired to a detonator and timer, with a field test indicating the military explosive hexogen, the substance used in the other bombings. The building was evacuated. The three suspects were traced, partly through an intercepted call to FSB headquarters in Moscow, and arrested by local police. They were FSB officers.
Where the meaning was made: a press centre, twice, in opposite directions. For roughly two days the event was officially an attempted terrorist attack; a criminal case was opened, sketches were broadcast, Putin praised the vigilance of Ryazan’s residents and ordered the bombing of Grozny that opened the second Chechen war. Then the FSB director announced that the whole affair had been a training exercise and the sacks had contained sugar, and the arrested officers were released. The significance of the event was reassigned in a single televised sentence, after the war it had helped justify was already in motion.
What the residue was saying, and what happened to it: the local police who ran the field test stood by their reading; the interior minister who had publicly praised the thwarting of a terrorist act had evidently not been told of any exercise; a Novaya Gazeta investigation found a soldier who had sampled sacks labelled sugar at a military depot near Ryazan, the contents of which turned out to be hexogen. And then the channels that confirmed every other case were closed, deliberately and durably: the sacks, the detonator, the exercise records, and the identities of the officers were sealed as state secrets, and successive Duma motions to investigate were voted down. The journalists and legislators who kept pulling at the case had a notable actuarial profile in the years that followed. An honest conclusion is not that the case is proven, but that the impounding is itself part of the record. Access behaviour is evidence, and even on the official account, secrecy of that degree is an unusual institutional choice.
What the residue keeps saying
Walking the cases in a row, the patterns are few and consistent, which is some comfort, since a method with forty indicators is a method for confirming whatever one already believed.
The first is the speed differential. Meaning arrives in hours; residue accumulates on the timescale of investigations, archives, and careers. The asymmetry is not incidental: a narrative is socially produced and can be assembled at the speed of a press conference, while residue is physically and institutionally produced and accumulates at the speed of the world. In each of these cases the naming was essentially instantaneous, and the significance was assigned with a completeness real investigations rarely manage on day one. Attribution that arrives fully formed, with the culprit, the motive, and the required response all in the same breath, looks more like a script than a finding. Real events tend to spend their first days being confusing.
The second is the mismatch on the accused side. A genuine attack usually has enabling conditions: capability, access, logistics, an escalation trajectory, some material history preceding the bang. The fabricated culprit is chosen for legibility rather than capability, the way labels in the Sahel travel because they are fundable and announceable, and legibility leaves no residue. A frame’s fit is supplied, not found, and fit alone is close to no evidence; a false flag is supplied fit, industrialised, a culprit arriving pre-shaped to a frame the audience already holds. Poland had no posture for Gleiwitz; the Finnish guns were out of range; the RAF prisoners knew nothing of the plan to free them; the Red Brigades had no C4.
The third is the beneficiary’s lead times. Wars and crackdowns run on logistics measured in weeks and months, and the material preparations cannot wait for the pretext, because they are what the pretext exists to launch. Fall Weiss was scheduled before Gleiwitz; the Winter War was planned and even war-gamed at Mainila before Mainila; Grozny was bombed before the Ryazan story had settled on a version. The incident is the garment; the mobilisation is the body it was cut for, and bodies of that size are increasingly hard to hide.
The fourth is over-complete evidence. Planted scenes tend to over-explain, because the planter’s incentive runs opposite to reality’s: the passport that identifies the desired culprit, the escape kit in the right cell, the forensic certificate that names the right group. Genuine scenes can stay underdetermined for a long while.
The fifth is access behaviour. Finland proposed a neutral investigation and the Soviet Union refused; Ryazan’s residue was sequestered; by contrast, failed fabrications like Cairo and Celle came apart where the perpetrator lost control of access, to a scene, to a leak, to a suspect in custody. Delay, refusal, and sealing are what a scene-editor would do, and while they are not proof, they are never nothing.
The last is insider surface. Operations of this kind require hands, and hands remember. Naujocks, Vinciguerra, the drivers and V-Männer and warehouse guards who appear throughout these cases: the leak rate of a conspiracy appears to scale with its headcount and its age, which is presumably why the durable uncertainty attaches to the operation with the smallest and best-disciplined surface. It is also, one suspects, why the form has been evolving towards variants that need fewer hands.
The sensor-saturated present
The environment these patterns now operate in has changed in ways that cut both directions, and it seems worth being precise about which direction each change cuts.
For the reader of residue, the world has become involuntarily instrumented. MH17 was not a false flag, and it appears here for a different reason: it may be the clearest demonstration that residue can now be reconstructed independently of any official narrative. A Buk launcher’s journey from a base in Kursk into eastern Ukraine and back was reconstructed from dashcam clips, roadside photographs, and soldiers’ social media posts, first by volunteers at Bellingcat and then, independently and to a criminal standard, by the Dutch-led Joint Investigation Team, down to the identifying dents on one vehicle. Commercial satellite imagery, radar-based sensing that ignores cloud and darkness, ship and aircraft transponders, and the reflex of bystanders to upload everything have together made the beneficiary’s lead times, the third pattern, close to unhideable at scale. A related development is that evidence now ages against the fabricator. A staged scene is a snapshot answering the forensic questions of its own day; the questions keep improving, and the scene cannot be updated. The fabricator has to anticipate every test that will ever be applied, including tests that do not yet exist, which is a losing position held indefinitely.
The same asymmetry has reproduced itself in the domain where the form seems to be migrating. Cyber operations were supposed to solve the attribution problem for the perpetrator, and planted artefacts are cheap there: the malware that disrupted the 2018 Winter Olympics carried a forged build fingerprint matching North Korea’s Lazarus group so exactly that several firms initially attributed it to Pyongyang, alongside other clues pointing at China and Russia simultaneously. What undid it was residue: the forged fingerprint failed a deep consistency check against the code it claimed to describe, infrastructure overlapped with known Russian operations, and the operation eventually appeared, with named officers, in a US indictment of the GRU’s Unit 74455. The Guccifer 2.0 persona, a manufactured Romanian hacktivist wrapped around the GRU’s 2016 DNC operation, was undone by a single operational slip, one login without the VPN, leaving a Moscow address that resolved to GRU headquarters. The general principle seems to be that fabricated evidence is internally consistent but externally shallow. It matches the story; it does not match the world at the depth the world can now be queried.
Synthetic media was supposed to be the next solvent, and so far the record is more modest than the anxiety. The deepfake of Zelensky ordering surrender, pushed through a hacked news site three weeks into the invasion, was debunked within hours, partly because the Ukrainian government had warned two weeks earlier that exactly this fake was coming. The deeper cost of the technology appears to be the one researchers call the liar’s dividend: the existence of convincing fakes licences the denial of real evidence, and studies of the war’s first months found people dismissing authentic footage as deepfaked. The fabricator’s best product may turn out to be not the fake event but the general fog in which no event can be pinned to anyone.
The Zelensky case also points at a genuinely new defensive move, which is prebuttal. Through late 2021 and early 2022 the US and UK repeatedly declassified claims that Russia was preparing staged provocations, including, three weeks before the invasion, a fabricated atrocity video complete with corpses and actors, publicised, in the State Department’s words, to dissuade Moscow and to lay the groundwork bare in advance. The tactic spends intelligence to close the window a false flag depends on, that brief interval of unchallenged narrative. Whether any specific claim was accurate is beside the structural point, and the structural point cuts both ways: a government that has learned it can pre-attribute has also learned it can pre-accuse, and the accusation of a false flag is itself now a standard disinformation move, deployed reflexively after real atrocities. The vocabulary has been democratised faster than the discipline.
That is an honest limit of the whole method. Confirmed false flags are rare; accusations are constant; and substrate mismatch also occurs in genuine events, since proxies, lone actors, and deniable irregulars all produce real attacks with thin material trails, and a real adversary can time a real attack to coincide with an opponent’s pre-existing mobilisation. These patterns are indicators, not verdicts, and a defensible posture is asymmetric: the hypothesis earns consideration only from specific anomalies, never from mere benefit or mere distrust of the accused. Most of the people who called Gleiwitz correctly in September 1939 would have called a dozen real events false by the same reasoning. Being calibrated is harder than being suspicious, and considerably less popular.
The strait, again
Which brings the method home to the case that closed the substrate essay. That essay argued that the American strikes on Iran were narrated through a rotating set of announceable reasons, obliteration, resolve, a nuclear programme by turns destroyed and in need of destroying, while the substrate that had the shape of a motive, the strait carrying roughly a quarter of global oil trade and a rival’s supply downstream of it, stayed unnamed because it could not be said from a podium. That was written when the pattern was a reading. Five months of war have made it a description. The war that began in February has, by this week, collapsed onto its substrate: the fighting is now literally about tanker transit through Hormuz, the negotiations that stall and resume are negotiations about maritime traffic through the strait, and an oil-sales waiver is switched off as an instrument of escalation in the same news cycle as the airstrikes. The unnameable motive became the battlefield. The narrative layer eventually ran out of costumes, and the substrate was standing there underneath, exactly where it had been.
Epilogue: an eye on the strait
Events have not waited for the ink to dry. The latest exchange began with attacks on three commercial tankers in the strait, which Washington attributes to Iran and which Iran has not claimed, its state television saying only that a vessel ignored warnings. The configuration has a precedent: in June 2019, tankers in the same waters were damaged in an incident where the US presented video of a limpet mine being removed while the Japanese owner of one vessel insisted his crew had seen a flying object strike above the waterline, and the attribution never fully settled in public. Nothing here asserts fabrication, in either year; deniable attacks by a capable party are the likelier reading, and deniability and fabrication are neighbours on the same spectrum rather than the same point.
But an incident in a chokepoint that licences one side’s strikes and demonstrates the other side’s throttle without formal ownership is an incident whose ambiguity serves everyone armed and no one reading. It is the class of event the two questions were built for, and both are currently unanswerable from open sources: where the meaning is being made is visible enough, a CENTCOM statement, a Revolutionary Guard communiqué, a presidential post from a NATO summit; what the residue says, hull metallurgy, blast direction, the lead times of the response measures on each side, has not yet been read by anyone independent, and may not be soon. The record suggests the residue will testify eventually, on its usual delay, to whoever is still paying attention. In the meantime the discipline is unglamorous: holding the naming and the residue apart, refusing to let the first stand in for the second, and keeping an eye on the strait, which has been saying the same thing in its own vocabulary all along.