The Liar's Tax - Decipon Insights

The First 48 Hours

On February 28, 2026, the United States and Israel launched Operation Epic Fury — airstrikes targeting Iran’s nuclear sites, military infrastructure, and leadership. Supreme Leader Ayatollah Ali Khamenei was killed. Within hours, the information environment surrounding the conflict was flooded with content claiming an entirely different story.

Iranian ballistic missiles had struck and sunk the USS Abraham Lincoln. Six hundred and fifty American personnel were dead or wounded. Israeli cities were burning. Iranian strikes had destroyed radar installations in Qatar. The Burj Khalifa had collapsed.

CENTCOM issued a denial within the news cycle: “The missiles launched didn’t even come close.” U.S. military officials confirmed six deaths as of early March, not 650. The carrier was not sunk. The Burj Khalifa was standing.

The gap between the circulating claims and the verified facts was not a minor discrepancy. It was fabricated reality, produced at industrial scale, running before the first smoke had cleared.

The Architecture

A Cyabra research report published March 9 documented the infrastructure behind it: 37,000 content units carrying pro-Iran messaging, accumulating over 145 million views and 9.4 million engagements. The New York Times independently identified more than 110 unique deepfakes in the conflict’s first two weeks. The content clustered around five recognizable narrative types.

Destruction in Israel — AI-generated imagery showing Israeli infrastructure destroyed by Iranian strikes. One set of widely circulated images depicted what appeared to be the Burj Khalifa collapsing; Hive Moderation’s AI detection tool rated them 99.8% likely artificially generated.

Ridicule of enemy leadership — content pairing real images of Israeli and American officials with fabricated contexts and humiliating outcomes.

Iranian military dominance — footage of missile launches and military preparations, mixing genuine archival footage of Iranian exercises with AI-generated outcomes: the explosion at the target, the fire, the confirmed hit.

Daily strike fakes — a continuous stream presenting Iranian strikes as daily operational facts. One post showing “Saudi Arabia burning” — recycled from 2024 Yemeni port footage — accumulated 4.6 million views before its origin was identified.

Fabricated aftermath of the Supreme Leader’s death — after Khamenei’s killing on February 28, AI-generated images circulated showing his body under rubble, apparently designed to reframe the manner of his death as chaotic rather than precise. AFP, Reuters, and BBC Verify confirmed the images were artificially generated. Several carried visible Meta AI watermarks. At least one showed the characteristic deformed hands that mark unretouched AI image output.

The carrier claim worked hardest. The assertion that Iranian missiles had sunk or severely damaged the USS Abraham Lincoln reached approximately 8 million views. Multiple AI-generated images circulated showing the carrier burning — some produced fresh, some recycled from the June 2025 conflict. CENTCOM’s denial competed in the same information environment as content that was visually compelling and emotionally satisfying to a specific audience. The denial is a text statement. The fabricated footage is fire on the ocean.

The recycling pattern deserves separate examination. The operation did not rely solely on fresh AI-generated imagery, which carries the risk of detection by automated tools. It borrowed:

2015 Syrian airstrike footage, captioned as Iranian attacks on Haifa
2015 footage of the Tianjin port explosions in China, captioned as Iranian strikes on Tel Aviv
2024 Yemeni port footage, captioned as Iranian strikes on Saudi bases
A 2017 Ukrainian ammunition depot fire, claimed as a nuclear facility strike

Real footage from a different conflict is not detectable as AI-generated because it is not. The manipulation lies entirely in the caption — an older, lower-technology deception that no AI detection tool is built to catch. The tactic is not sophisticated. It is effective.

The Short-Term Logic

Why build this?

The operational context is specific. Operation Epic Fury’s strikes on the first day killed Iran’s supreme leader, hit its nuclear program, and struck military infrastructure. The information environment in the first 48 hours was critical: domestic audiences needed a narrative of resistance and defiance rather than collapse; regional audiences needed uncertainty about real outcomes; international audiences opposed to U.S. military action needed amplifiable content.

The false carrier strike serves all three purposes simultaneously. For domestic consumption: we hit them where it hurt. For regional audiences: U.S. military power is not invincible. For international antiwar audiences: here is a symbol of imperial overreach under fire.

None of this required audiences to fully believe the content. It required them to be uncertain — to feel that the outcome was contested, that the official U.S. narrative of precision military success against an outgunned adversary was not the only available frame. Disinformation in this context is not primarily about belief. It is about doubt.

Platform structures accelerated it. In the conflict’s first days, X’s Creator Revenue Sharing program financially incentivized high-engagement posts — and fabricated war footage generates engagement. A post showing a carrier on fire, regardless of its factual basis, accumulates views, shares, and emotional responses that translate to creator revenue. X restricted AI-generated conflict content from revenue programs on March 4 — approximately four days into the conflict, four days in which the incentive structure pointed in the wrong direction.

Grok, X’s integrated AI assistant, failed as an arbiter. The tool provided contradictory assessments of the same video within minutes — sometimes rating footage “likely real,” sometimes “likely not authentic” — demonstrating that automated fact-checking during fast-moving information conflicts is not yet reliable. In the absence of reliable automated arbitration and the presence of financial incentives for engagement, the system’s emergent behavior was to amplify.

The Contamination

The war was not a two-party information conflict.

Citizen Lab documented PRISONBREAK, an Israeli government-linked influence operation deploying more than 50 inauthentic X accounts with AI-generated synthetic profile pictures. The operation’s most notable artifact: a deepfake video of the Evin Prison being bombed appeared within approximately one hour of an actual Israeli airstrike on the facility. The timing implies either foreknowledge of the strike or a pre-staged production pipeline built to deploy matching disinformation content within minutes of operational actions. Either explanation represents a significant evolution — disinformation infrastructure integrated into military planning rather than deployed reactively after the fact.

U.S. government communications contributed to the degradation on their own terms. In June 2025, Trump had declared Iran’s nuclear facilities “obliterated.” By March 2026, Operation Epic Fury was launched citing an “imminent nuclear threat” — a direct contradiction of the prior claim. When asked about a U.S. strike on a girls’ elementary school in Minab that killed approximately 165 people, Press Secretary Karoline Leavitt said “Not that we know of.” A PBS NewsHour report subsequently confirmed a U.S. official called the strike “likely American.”

FCC Chair Brendan Carr warned broadcasters that covering stories Trump characterized as “hoaxes” risked license revocation. Treason charges were threatened against critical journalists.

The sum total of these operations — Iranian, Israeli, and American — was an information environment in which no actor’s claims carried default credibility, in which weeks of demonstrated fabrication had trained audiences to apply skepticism to footage regardless of origin, and in which authentic documentation of real events competed on equal footing with manufactured fictions.

The Inversion

This created a specific operational problem for Iran.

When the Minab school bombing occurred — a real event, with real deaths, with authentic footage — Iranian state media and Iranian-affiliated networks attempted to circulate the evidence. A confirmed U.S. airstrike on a girls’ school killing 165 people is, in principle, powerful documentation for an audience skeptical of U.S. military conduct. It requires no fabrication. The event happened. The footage exists.

The reception was contaminated.

Audiences who had spent weeks watching Iranian networks circulate recycled Tianjin explosions as military victories and AI-generated carrier fires with visible artifact errors applied the same skepticism to authentic Minab footage. The prior contamination of the information environment created a condition in which real events — events that genuinely served Iran’s rhetorical interests — were harder to document credibly than they would have been without the preceding fabrication campaign.

Researchers working in this space have a name for this dynamic: the Liar’s Dividend. It was initially framed as a benefit available to bad actors: in a world where audiences know deepfakes exist and disinformation is pervasive, anyone with incriminating footage against them can simply say it is fake. Generalized doubt serves those who want to deny.

The Iran conflict illustrated the liability side of the same coin. When an actor has invested heavily in aggressive fabrication — built the machine for it, run it at scale, established their networks as reliable sources of disinformation — they also destroy their own credibility for future authentic claims. The machine that makes enemy victories look like defeats makes the operator’s own genuine suffering harder to report.

The dividend is real in one direction. It runs as a tax in the other. The invoice arrives when it matters most.

Influence Tactics Breakdown

AI Victory Fabrication. Using generative AI to produce compelling imagery of military outcomes that did not occur — carrier strikes, destroyed installations, burning cities — to project military effectiveness for domestic and international audiences. The goal is not universal belief but sufficient uncertainty: ensuring that the adversary’s victory narrative does not dominate unchallenged in the critical first news cycle.

Recycled Footage Attribution Laundering. Using authentic archival footage from unrelated prior conflicts and misattributing it via caption. Real footage is structurally undetectable as fake because it is not — the manipulation is entirely in the label, not the content. AI detection tools are irrelevant. The method is older than the internet. It is still working.

Casualty Inflation. Claiming 650 U.S. casualties against a confirmed six is not exaggeration — it is a claim designed to operate in the window before verification is possible. Most audiences who encountered the 650 figure never encountered the correction. The inflation serves its purpose in the first hours; the correction exists in a later news cycle with a smaller audience.

Meta-disinformation. Labeling credible evidence as propaganda pre-contaminates audiences before they encounter authentic content. When every piece of footage has been primed for dismissal as fabricated, authentic footage must overcome a skepticism threshold that the fabricated footage never faced — because the fabricated footage arrived first and set the terms of reception.

Pre-Staged Production Pipelines. The Evin Prison deepfake deployed within one hour of the actual strike demonstrates an evolution beyond reactive disinformation. Pre-staged content built to match anticipated military operations creates a capability for narrative pre-emption — the fake story exists before authentic documentation can be gathered and distributed, ensuring the fake version of the event establishes itself in the information environment before the real one.

Platform Incentive Exploitation. Using platform monetization structures to generate creator revenue from high-engagement fabricated war footage, ensuring that financial incentives align with maximizing spread. The restriction that followed X’s March 4 policy change is evidence the exploitation was real; the four-day window was operationally significant.

What the Lifecycle Shows

What distinguishes the 2026 Iran conflict’s information environment is the visibility of the complete lifecycle — the full arc from fabrication to blowback, compressed into weeks rather than the years it typically takes researchers to reconstruct.

The downstream effect was observable in real time: the degradation of Iran’s ability to communicate authentic events as a direct consequence of its own fabrication infrastructure. The same networks that ran the USS Abraham Lincoln claim to 8 million views were the networks audiences had learned, by early March, to disbelieve. When those networks circulated genuine evidence of genuine atrocities, the skepticism earned through fabrication was applied equally.

This is not a unique vulnerability of the Iranian state. Any actor that builds aggressive disinformation infrastructure in a visible information environment — one with active researchers, documented takedowns, and fact-checkers publishing in real time — is building both a weapon and a structural tax on its own future credibility. The weapon is real. The tax is structural. And unlike most taxes, it is not paid at the moment of the action. It is paid later, when the authentic claim most needs to be believed.

Iran fabricated a carrier strike for 8 million viewers. Weeks later, the network that delivered it could not get an authentic girls’ school bombing acknowledged by the same audience.

The machine worked. The invoice came due.

This article is part of Decipon’s Manipulation Breakdowns series, examining specific influence operations through the Influence Tactics Protocol.

Sources: