AI war disinformation: why certified evidence beats detection

Modern conflicts generate unprecedented volumes of digital content from the field. Smartphones, drones, body cameras: every operator on the ground produces hundreds of files daily, documenting events, war crimes, and human rights violations. For investigative journalists, NGOs, OSINT analysts, and international tribunals, this data is irreplaceable raw material.

Then came generative AI. In the Iran 2026 conflict, fully fabricated satellite imagery, deepfake videos with millions of views, and systematically false claims proved that the technology to create visual evidence indistinguishable from reality is now available to anyone. The problem is no longer theoretical. AI-generated disinformation in war is an operational weapon, and no detection tool can keep pace.

The answer is not hunting fakes after publication. It is certifying authentic content at the source, at the moment of capture. A fundamental shift: from detection to digital provenance, from chasing falsehoods to preventing them structurally.

The Iran 2026 conflict: an unprecedented AI disinformation case study

AI disinformation in armed conflicts. Unlike traditional propaganda, AI-generated content can be produced at industrial scale, customized for different audiences, and distributed in real time. During the Iran 2026 conflict, NewsGuard documented 18 verified false claims in just three weeks. A single deepfake video of Tel Aviv in flames reached 14 million views before being debunked. Production and distribution speed now structurally exceeds verification capacity, both human and automated.

AI-generated disinformation during the Iran-US conflict of 2026 is the first documented case of systematic weaponization of generative AI in a war context. Not isolated incidents: a coordinated campaign that exploited every available channel to contaminate the global information ecosystem.

According to France24, the Tehran Times published a "before vs after" comparison showing a US military base in Qatar "completely destroyed." The image was an AI manipulation of a Google Earth satellite photo of a base in Bahrain. The story reached millions before any correction was available. CNN documented the massive circulation of AI-generated fake images and videos during the first weeks of the conflict.

Fake satellite imagery and viral deepfakes

The most striking case remains the deepfake video of Tel Aviv in flames: over 14 million views across social platforms. A city devastated by bombings that never happened, with a level of realism that fooled not only the general public but also several professional media outlets in the first hours of circulation. As Rolling Stone reported, generative AI has become "the latest weapon" in the conflict, capable of producing propaganda content at near-zero cost and industrial speed.

18 false claims in three weeks: the NewsGuard monitoring

The number that best captures the scale of the phenomenon comes from NewsGuard: 18 verified false Iranian claims in just three weeks. Not journalistic errors or ambiguous interpretations, but content deliberately fabricated and distributed through official and semi-official channels. The Foundation for Defense of Democracies (FDD) analyzed Iran's AI disinformation campaign, documenting how deepfakes were deployed as operational tools on the front lines, not merely as propaganda.

UNODC and INTERPOL dedicated their March 2026 Global Fraud Summit to AI weaponization, officially recognizing the threat as an international security priority.

And the phenomenon does not stay confined to war zones. The same techniques are being adapted for disinformation security campaigns targeting companies, institutions, and democratic processes. Generating fake visual evidence on demand is now a commercial service, no longer the exclusive domain of state actors.

Why AI detection fails in conflict zones

The lab-to-field gap. Commercial AI detectors achieve over 90% accuracy on controlled datasets, but performance drops sharply when applied to compressed content, files shared via messaging apps, cross-platform re-shares, or captures made in variable lighting and resolution conditions. This gap between ideal conditions and operational reality is the structural weakness of detection as a defense strategy against wartime disinformation.

The instinctive response to AI disinformation is building more sophisticated detection tools. Understandable, but inadequate. Detection works in the lab. In the field, conditions are different in ways no software update can bridge.

Generation improves faster than detection

There is a fundamental asymmetry between those creating fake content and those trying to identify it. Each new generative model renders obsolete the detectors trained on the previous generation. State-of-the-art diffusion models produce images that systematically beat authenticity tests based on artifact analysis. A detector calibrated on one model's "fingerprints" misses the next model's output entirely. This is a race detection cannot win.

The problem compounds over time. As each conflict produces its own flood of AI-generated content, detector models need retraining on new data that may not be available until weeks after the disinformation has already done its damage. By the time a detector learns to identify a particular type of fake, the next generation of generative tools has already moved on. In the Iran 2026 conflict, analysts reported that detection tools flagged legitimate combat footage as AI-generated more often than they correctly identified actual fakes, creating a secondary credibility crisis around the detection tools themselves.

There are no forensic labs in the field

A journalist in Tehran, an NGO worker in Iraqi Kurdistan, an ICC investigator in an active combat zone. None of them have access to GPU workstations, stable connectivity, or forensic analysis software. Detection requires infrastructure that simply does not exist in the field. Content is produced, transmitted, and consumed in real time, on unreliable networks, often under direct threat. Any system requiring post-hoc analysis is too slow and too fragile for this context.

Detection vs provenance: a structural comparison

Criterion	AI detection	Content provenance
Approach	Analyzes content after creation	Certifies content at the moment of capture
Reliability over time	Degrades with each new AI generation	Stable: based on cryptography and international standards
Infrastructure requirements	GPU, connectivity, specialized software	Smartphone with app, minimal connectivity
Legal standing	Expert opinion, contestable	Legally valid evidence (eIDAS, ISO 27037)
Field scalability	Limited: case-by-case analysis	High: each operator certifies independently
Response speed	Hours or days for reliable analysis	Instant: certification happens at capture
Coverage	Only formats with an existing detector	Any digital file (photo, video, document, audio)

From detection to provenance: the paradigm shift

Reversing the verification logic. Content provenance does not ask "is this content fake?" but "was this content certified at the source?" The international legal framework already supports this approach: the Budapest Convention for cross-border cooperation in digital evidence collection, ISO/IEC 27037 for chain of custody requirements, and the EU E-Evidence Regulation (applicable from August 2026) for cross-border access to electronic evidence. The legal infrastructure exists. What is missing is operational adoption at scale.

The failure of detection in operational contexts has forced the international community to rethink the entire approach to digital content verification. The core idea behind content provenance is straightforward: instead of analyzing content to determine whether it is authentic, you certify authentic content at the moment it is created.

Content provenance: certify at the source instead of analyzing after

Digital provenance shifts the point of intervention from post-hoc analysis to preventive certification. If an image, video, or document is captured through a process that immediately certifies its integrity, origin, and timestamp, any subsequent manipulation becomes detectable by comparison. The question changes: from "is this content fake?" to "was this content certified at the source?".

This approach eliminates the asymmetry problem. No matter how sophisticated generative AI becomes, content certified at the source carries a digital chain of custody that no deepfake can replicate. The TrueScreen platform operates on this principle, ensuring data authenticity through forensic acquisition and certification with a digital seal.

International standards for digital evidence: Budapest Convention and ISO 27037

The shift from detection to provenance is not just a technology question: it rests on increasingly solid international legal foundations. The Budapest Convention on Cybercrime establishes the legal framework for cross-border collection and preservation of digital evidence, including interstate cooperation for acquiring electronic evidence. ISO/IEC 27037 defines guidelines for identification, collection, acquisition, and preservation of digital evidence, specifying integrity and chain of custody requirements that make evidence admissible in international legal proceedings.

The EU E-Evidence Regulation, applicable from August 2026, adds a normative layer that facilitates cross-border access to electronic evidence held by service providers. These frameworks converge on one point: digital evidence has legal standing when its integrity is verifiable from source to courtroom, without breaks in the chain of custody.

For organizations operating in conflict zones, the practical implication is clear: content captured and certified according to these standards today will be admissible as evidence in proceedings that may take years to reach trial. The forensic certification creates a time-stamped, tamper-proof record that retains its legal value regardless of how many times the file is copied, stored, or transferred between jurisdictions. This is especially relevant for NGOs and investigative journalists building evidence portfolios over the course of extended conflicts.

Forensic content certification from the field: how it works

From smartphone to courtroom. Mobile forensic certification turns any smartphone into an evidence acquisition tool. Three layers of assurance: cryptographic content integrity (any post-capture modification is detectable), qualified timestamp issued by an international QTSP, and certified geolocation. Evidence produced this way meets the admissibility requirements of the International Criminal Court (ICC) and the International Court of Justice (ICJ), with an unbroken digital chain of custody from the field to the courtroom.

Content provenance translates into practice through forensic certification platforms designed for real-world field conditions. TrueScreen has developed a patented Data Authenticity system that combines acquisition and certification in a single process, compliant with ISO/IEC 27037, ISO/IEC 27001, the Budapest Convention, eIDAS, and GDPR.

The certified acquisition process

Certified acquisition is fundamentally different from simply taking a photo or recording a video. When a field operator uses the TrueScreen platform, the forensic process begins before the capture: the system verifies device integrity, records environmental metadata (GPS, timestamp, network parameters), and initiates a digital chain of custody that will follow the file from creation to its eventual use in court.

Each captured file is immediately subjected to a cryptographic process that "freezes" its original state. Any subsequent modification, even a single pixel, becomes detectable and documentable. In practice, an ordinary smartphone becomes a forensic acquisition tool, with no need for specialized equipment in the field.

Digital seal, qualified timestamp, and verified geolocation

After capture, each file is sealed with a digital seal and timestamp issued by an international Qualified Trust Service Provider (QTSP), in compliance with the eIDAS regulation. The digital seal guarantees content integrity: any subsequent alteration invalidates the seal and is immediately detected. The qualified timestamp certifies the exact moment of capture with internationally recognized legal standing.

Verified geolocation adds another layer of proof. The content is not only authentic and timestamped, but also anchored to precise, verifiable geographic coordinates. For evidence from a conflict zone, being able to prove that a video was recorded in a specific place, at a specific time, and has not been altered: that is the difference between contestable content and legally valid evidence.

Admissibility in international courts: ICC and ICJ

Evidence certified to these standards has a direct path to admissibility in international court proceedings, from the International Criminal Court (ICC) to the International Court of Justice (ICJ). The historical problem with digital evidence in international tribunals has always been chain of custody: how to prove that an image presented as evidence was not manipulated between capture and presentation in court. Forensic certification at the source solves this problem at its root.

Compliance with ISO/IEC 27037 and the Budapest Convention is not a technical detail: it is the requirement that transforms a digital file from contestable material into admissible evidence. In a context where the liar's dividend allows anyone to cast doubt on the authenticity of any digital content, forensic certification is the only credible defense.