Taken from Mthokozisi Mabhena‘s substack check him out here for more https://substack.com/@officialmabhena
I think by this time we all know this: every day, a ubiquitous digital surveillance system logs your location data, search queries, purchasing history, reading duration on specific articles, social connections, political leanings, health-related searches, and even your audio conversations. It assembles these inputs into a comprehensive psychological profile that is bought, sold/stolen, and deployed to advertisers, nation-states, and private companies which may or may not be malign actors.
In June 2013, Edward Snowden, a 29-year-old National Security Agency (NSA) contractor employed by Booz Allen Hamilton at a facility in Hawaii, copied a set of classified NSA documents onto a USB drive, flew to Hong Kong, and handed them to journalists Glenn Greenwald and Laura Poitras, who published them simultaneously in the Guardian and the Washington Post. Those documents revealed that the NSA was running two programs of a scale that had not been publicly acknowledged. The first, PRISM, it gave NSA analysts direct access to the servers of Microsoft, Google, Yahoo, Facebook, Apple, and Skype without individual warrants, under a classified reinterpretation of Section 702 of the Foreign Intelligence Surveillance Act so secret that the technology companies being compelled to comply were legally prohibited from acknowledging the program’s existence. The second, XKeyscore, allowed any analyst to retrieve the complete internet activity of any person on earth in real time using nothing more than an email address, with the collected data stored indefinitely and accessible to thousands of analysts operating under minimal oversight. Snowden described XKeyscore in his 2019 memoir, Permanent Record, (which you should all read) as the closest thing to omniscience he had encountered: a live, searchable record of what hundreds of millions of ordinary people were reading, writing, and saying to each other, none of whom had any idea it existed. That was 2013, the approach was rudimentary by today’s standards, and the collection infrastructure has only expanded since, while the AI systems now processing that data have transformed what collection produces, it moved from merely documentation of past behaviour into predictive models of future behaviour, susceptibility, and psychological vulnerability.
In 2014, Aleksandr Kogan, a psychology researcher at Cambridge University, built a Facebook personality quiz app called “This Is Your Digital Life” that harvested psychological data from its 270,000 users and, through a Facebook API loophole that permitted apps to collect data on users’ friends without those friends’ consent, harvested the data of approximately 87 million additional people who had never interacted with the app. Kogan passed this data to Cambridge Analytica, a political consulting firm backed by hedge fund billionaire Robert Mercer and run by Steve Bannon, which used it to build psychographic profiles organized around the OCEAN model, a cousin of Myers-Briggs Type Indicator, which is a psychometric framework scoring individuals on openness, conscientiousness, extraversion, agreeableness, and neuroticism. Cambridge Analytica claimed to hold an average of 5,000 individual data points per American voter. Cambridge Analytica sold these profiling services to the Donald Trump presidential campaign and to Leave.EU (a pro-Brexit lobbyist group) during the Brexit referendum, both in 2016. They both used the profiles to deliver individualized political advertising calibrated to specific psychological vulnerabilities: voters scoring high on neuroticism received content designed to activate fear and threat responses, while voters identified as persuadable received content engineered around entirely different psychological levers. The real-world outcomes of both campaigns were decided by margins so thin that targeted psychological operations at this scale almost certainly determined the result. Trump won the 2016 presidential election by approximately 77,000 votes spread across Pennsylvania, Michigan, and Wisconsin, whose states that Cambridge Analytica had specifically identified and targeted using psychographic modelling. Brexit passed by 3.8 percentage points, 51.9% to 48.1%, with Leave.EU having deployed Cambridge Analytica’s profiling tools throughout its digital campaign. Facebook knew about the data transfer by 2015 and did not disclose it publicly until 2018, when the Guardian, the New York Times, and Channel 4 News published simultaneous investigations based on documents provided by Cambridge Analytica’s research director Christopher Wylie, who had by then become a whistleblower.
Cambridge Analytica was a relatively early and crude application of behavioural data at political scale. What the current new AI-powered recommendation algorithms produce is structurally more significant because it operates continuously, across billions of users, without any single actor directing it. In 2021, Frances Haugen, a former Facebook product manager, copied thousands of pages of internal Facebook research before leaving the company and provided them to the Wall Street Journal and the SEC simultaneously. Those documents showed that Facebook’s own data scientists had established by 2016 a direct causal relationship between its recommendation systems and radicalization, specifically, that 64% of people who joined extremist groups on Facebook did so because the algorithm had recommended those groups to them, and that a separate internal study had shown the feed algorithm systematically amplified outrage-producing content because outrage generated more comments, shares, and time on platform than any other emotional response, a pattern that was known internally, documented internally, and not corrected. The same Haugen documents revealed that Facebook’s internal research had found that 13% of British teenage girls and 6% of American teenage girls traced suicidal thoughts directly to their use of Instagram: that the platform’s recommendation systems were actively showing vulnerable adolescents self-harm and eating disorder content in sequences that escalated in severity, and that this finding had been suppressed internally to avoid regulatory attention. In 2022, it was ruled that Instagram’s content recommendation systems had directly contributed to the 2017 death of Molly Russell, a 14-year-old who died by suicide after the platform had served her thousands of posts related to depression, self-harm, and suicide over a period of months, with the algorithm identifying her psychological vulnerability and using it as an engagement signal to deepen her exposure to content that ultimately killed her.
The aggregate effect of these systems running simultaneously across billions of users is what is called “epistemic fragmentation”, a condition in which people sharing the same geography and the same nominal access to information inhabit entirely different factual realities because the personalization layer of their information environment optimizes for emotional arousal rather than accuracy.
Between 2014 and 2016, the Internet Research Agency, a Russian state-backed troll farm based in St. Petersburg and financed through Yevgeny Prigozhin’s catering conglomerate Concord Management at a monthly budget of approximately $1.25 million at its peak, ran a systematic influence operation across Facebook, Instagram, Twitter, and YouTube targeting the American electorate. The operation was later documented in Special Counsel Robert Mueller’s February 2018 indictment of Russian actors (13 Russian nationals and 3 Russian entities). It worked by identifying the specific demographic and psychological fault lines that Facebook’s own behavioural data had already mapped through its platform’s recommendation algorithm, and then hiring approximately 80 full-time employees organized into specialized departments for content production, data analysis, and search engine optimization to exploit those fault lines from both sides simultaneously. The agency’s Facebook had a page called Blacktivist, which pretended to be an organic Black American civil rights account, which ironically accumulated more followers than the official Black Lives Matter page by mid-2016; the page was used to deepen Black American political disengagement and distrust of electoral institutions in order to suppress voter turnout. Simultaneously, the agency had another page called Heart of Texas page, with over 250,000 followers, and another page called Being Patriotic page, with over 200,000 followers, which were pushing secessionism, anti-immigrant sentiment, and aggressive nationalism to conservative white Americans in order to increase voter turnout. Additionally, on May 21, 2016, the agency used its “Stop Islamization of Texas” account to organize a real anti-Islam rally outside the Islamic Da’wah Center in Houston, and its “United Muslims of America” account to organize a counter-protest at the same location at the same time. The (USA) Senate Intelligence Committee’s 2019 bipartisan report confirmed that the operation reached approximately 126 million Americans on Facebook alone, 20 million on Instagram, 1.4 million on Twitter, and an estimated 309 million on YouTube. Its primary outcome/operational success was not necessarily the promotion of any specific candidate but the acceleration of political polarization, mutual distrust between demographic groups, and the erosion of confidence in democratic institutions In America, which remains so today even after the operation ended.
This could also happen to you, or your country – and it probably is.
On of the most studied case of social media behavioural data being used to facilitate mass atrocity is in Myanmar between 2013 and 2018. Facebook was the primary internet platform in Myanmar, used by the majority of the population as their sole source of news and information. The platform’s recommendation algorithm identified that anti-Rohingya content produced high engagement among Buddhist Burmese users and amplified it accordingly, surfacing and recommending content from accounts spreading fabricated atrocity stories, incitement to violence, and dehumanizing characterizations of the Rohingya Muslim minority. Military-affiliated accounts operated coordinated networks producing this content at scale, and the algorithm treated their output as high-performing content deserving wider distribution. The UN Fact-Finding Mission on Myanmar concluded in its 2018 report that Facebook had played a “determining role” in spreading hate speech that contributed directly to the genocide of the Rohingya people, in which approximately 10,000 people were killed, 700,000 were displaced, and systematic mass rape was deployed as a military instrument. Facebook was warned about this malign influence operation by both researchers and civil society organizations from as early as 2013 and did not hire a single Burmese-language content moderator until 2015, by which point the incitement infrastructure was fully operational.
Another example is the American January 6 “insurrection”. On January 6, 2021, a crowd of approximately 2,000 people breached the U.S. Capitol building in an attempt to prevent the certification of the 2020 presidential election result where Donald Trump lost to Joe Biden. The mobilization had been organized primarily through Facebook groups, Twitter, YouTube, and the platforms Parler and Gab, with the Stop the Steal Facebook group accumulating 300,000 members within 24 hours of its creation before Facebook removed it. Internal Facebook research shared with the Wall Street Journal in October 2021 showed that company employees had identified the platform’s own recommendation systems as a significant driver of the radicalization pipeline leading to January 6th and had proposed interventions that were not implemented. The behavioural data infrastructure had identified, profiled, and connected hundreds of thousands of individuals with specific psychological susceptibility to election fraud narratives, recommended them into communities that reinforced and escalated those beliefs, and delivered them to a real-world violent event. The sequence that unfolded were due to the ordinary operation of engagement optimization, without requiring any foreign operation or coordinated manipulation beyond what the algorithm was already doing by design.
This could also happen to you, or your country – and it probably is.
The cases that I have discussed, Cambridge Analytica, Myanmar, January 6th, and Molly Russell, were all still fundamentally human operations using digital infrastructure as a delivery mechanism, where a person wrote the content, created the account, and decided the target. AI agent systems like OpenClaw have removed the human from every one of those steps. In 2026, a single operator can deploy thousands of autonomous AI personas that independently identify targets from behavioural profiles, construct localised identities calibrated to each target’s social trust signals (native name, profile picture and references), initiate and sustain personalised relationships over weeks or months, and introduce specific messaging at the moment of maximum psychological receptiveness, all without any further human instruction, running continuously at a cost that any moderately funded private actor, corporation, or nation-state can sustain.
In 2024, Stanford Internet Observatory researchers documented a network of over 800 AI-generated personas operating across X, Facebook, and Instagram during the Taiwanese presidential election. Each persona had a locally plausible profile: Taiwanese names, profile photographs generated by GANs calibrated to regional demographic appearance, posting histories in Mandarin reflecting local cultural references, and follower networks seeded with real Taiwanese accounts to establish apparent social legitimacy. The network’s operational behaviour was not to broadcast content to large audiences but to perform targeted social validation, that is, liking, replying to, and amplifying the posts of specific real users identified through behavioural profiling as politically persuadable, creating the experience for those users of organic local social agreement with specific political positions. The network was identified only because researchers were specifically looking for it, and its detection required months of computational analysis, which means a person encountering it in their timeline would have had no mechanism for distinguishing its interactions from those of their real neighbours.
This is exactly the operational model that behavioural data makes possible at scale, and it is categorically different from the broadcast propaganda model (mass/generic message to mass/generic people) that dominated previous eras of influence warfare. Even so, the most of the capable of individual psychographic-targeting examples I used, such as The Internet Research Agency in 2016 was broadcasting, that is, producing content and pushing it toward large audiences, hoping some percentage would engage. The AI agent model revolutionises this entirely, in the truest sense of the word. It begins with the behavioural profile of a specific individual, constructs personas calibrated to that individual’s demonstrated social trust signals, that is, their locality, their existing social connections, the cultural references that appear in their own posts, the accounts they have historically engaged with, and then deploys those personas to perform targeted one-to-one social interaction with that individual at a volume and consistency that no human operation could sustain. The goal is to make a specific person feel that people like them, in their community, with their values, hold a particular view: manufacturing local social consensus as a psychological fact in the mind of a targeted individual, at scale, simultaneously, across millions of targeted individuals.
This could also happen to you, or your country – and it probably is.
OpenAI’s 2025 release of operator-accessible agent frameworks, Google’s Gemini agent infrastructure, and Anthropic’s Claude agent API have made the automation of this model dramatically more accessible, with a single instruction such as “target registered voters in X community/city who engage with local school board content and have demonstrated cultural conservative signals, build rapport over four to six weeks through interaction on local community topics”, and then introduce specific messaging about school curriculum is now executable autonomously across thousands of simultaneously managed AI personas without further human involvement. The cost of running such an operation using commercially available API access is now measured in thousands of dollars rather than millions, meaning that the Internet Research Agency’s $1.25 million monthly budget in 2016 bought 80 human employees producing content for broad audiences, applied to AI agent infrastructure of 2026 goes a long way in buying targeted one-to-one social manipulation of hundreds of thousands of specifically profiled individuals simultaneously, with each interaction calibrated in real time to the behavioural responses of that specific person.
What makes this precise rather than approximate is the behavioural data layer. A system that knows a specific person engages most with content about local crime statistics between 7pm and 9pm on weekdays, responds emotionally to content framed around family safety, has three Facebook friends who regularly share content from a specific local news source, and has shown declining engagement with mainstream political content over the past six months, can construct a persona that presents as a local parent, references the same local news source, initiates contact through a mutual connection’s post, and begins a relationship calibrated specifically to that person’s demonstrated psychological profile. This is beyond tradition demographic-targeting, it is now individualized AI-aided psychographic targeting based on the map of your psychology that you built yourself through years of ordinary online behaviour, without knowing it was being recorded.
This could also happen to you, or your country – and it probably is.
The military applications of this model are already documented at operational level. In 2023, the U.S. government indicted a network of Iranian military intelligence operatives who had used AI-generated personas to conduct targeted influence operations against U.S. defence contractors, approaching individual engineers and analysts through LinkedIn with synthetic identities calibrated to their professional backgrounds and research interests, building relationships over months before attempting to extract information or influence decisions, with the operation effective enough that several targets engaged substantively before it was identified. In 2024, Microsoft’s Threat Intelligence division documented a Chinese state-linked operation designated Spamouflage Dragon running a network of AI-generated personas across 50 platforms simultaneously, with each persona maintaining internally consistent posting histories, social connections, and apparent personal lives going back years, the synthetic biographical depth was so good that it could to pass any casual scrutiny a real person might apply when deciding whether an account they were interacting with was authentic.
The non-political targeting real-world application of this same capability deployed by private actors rather than nation-states, is already operating in some limited contexts. In 2023, the FTC documented a network of AI-generated relationship personas, synthetic romantic partners constructed from behavioural profile data purchased from data brokers, that had extracted over $650 million from American adults over an 18-month period, with each synthetic persona calibrated to the specific emotional vulnerabilities, loneliness indicators, and financial profile of its target through ongoing real-time conversations calibrated to the behavioural responses of specific people who had been identified through their data profiles as susceptible to this specific form of manipulation.
Now, the cognitive security implication, the ability to guard your mind against malign influence, of all of this is startling: the social reality you experience online is an illusion specifically designed for you.
The apparent distribution of opinion among people like you, the apparent consensus in your community, the apparent authenticity of the accounts engaging with your content, is no longer a reliable signal of what people actually think, because the algorithms have made it technically and economically feasible for any sufficiently resourced actor to manufacture that social reality for you specifically, calibrated to your specific psychological profile, at a cost that nation-states, large corporations, and increasingly well-funded private actors can all sustain. This is the context and environment in which your data profile is the instrument of your own manipulation, and it is the environment that exists now.
Your social media and generative AI enabled attack on your cognitive security has known causes and implications in the real world. In around 2016, it was starting to be hypothesised on Reddit, through what was referred to as the “dead internet theory”, that the majority of internet social users are not humans but bots. Almost fifty percent of all global internet traffic is now generated by bots. On Twitter (I refuse to call it “X”), the majority of accounts are likely bots or bot-run based on activity patterns and posting consistency. This means that every time you scroll through the internet you are navigating an environment where a significant percentage of the accounts you encounter are not human and you have no reliable way of distinguishing real-world discourse and manufactured discourse.
On top of bot-infestation on the internet, in the same year of increase in bots polluting the internet, around 2016, the social media companies decided to move from chronological feeds to interest-based timeline. This means that every single person online now experiences a unique version of the internet constructed specifically for them. A one of one media front page. Two people sitting next to each other, same age, same job, same friend lists, will see completely different Facebook feeds, Twitter timelines, TikTok Reels, and Instagram explore pages because their feeds are optimized separately based on their psychological profiles. The chronological timeline disappeared when platforms determined that showing people what happened most recently generated less engagement than showing them what would make them feel strongly. The interest timeline that replaced it sequences information based on predicted emotional response. In practise, if your data profile shows susceptibility to anxiety about crime you see more crime content. If your profile shows susceptibility to outrage about politics, you see more political outrage. If your profile shows loneliness, you see more content about relationships and community. Your feed is not telling you what happened in the world, but what the algorithm has determined will keep you scrolling based on years of behavioural data collected from your activity. You and your neighbour are not looking at the same reality because your realities were built separately from your data profiles.
This bot-infestation and interest-based internet creates “thought bubbles” or “echo chambers” that isolate each person from any shared material-reality understanding of the world. The bubble is reinforced by exploitation of heuristics where the synthetic accounts populating your feed validate your existing views (confirmation bias) and gradually push them toward more extreme positions of their already held belief (a well-meaning feminist can move to a misandrist, and a man seeking validation against societal pressures into a misogynist). Researchers at the Alan Turing Institute documented in 2025 that people regularly report their social circles becoming more extreme on specific issues when in fact their actual human social circles have remained stable and the apparent shift comes from synthetic accounts inserted into their feeds. You have no way to distinguish manufactured consensus from organic reality because the manufactured consensus is designed specifically for you based on your data profile. The result is fragmented societies where populations sharing the same geography and nominal access to information inhabit completely different factual and social realities.
This could also happen to you, or your country – and it probably is.
This echo chamber enabled fragmentation manifests in real-world societal shift. This is seen through the escalation of “culture wars” along every demographic datapoint the algorithm can identify, with each fracture point documented by specific data. In the gender war, men are fed content framing men’s difficulties as the fault of women, for example, Andrew Tate in the West/America whose content was viewed over 6 billion times across platforms and Shadaya Tawona (self-named “knight”) in Africa; while women are simultaneously fed content framing all male behaviour as either weakness or inherently threatening/subhuman. In the case of the American/Western political context, conservatives are fed content framing liberals as attempting to destroy the country through open borders, while liberals are fed content framing conservatives as fascists attempting to impose authoritarian rule. Similarly, in the migration dimension, whether in South Africa, UK, or America, native populations are fed anti-migrant content, which whilst the concern is legitimate, the framing and context is more nuanced than that. More important to guard against is that the algorithm normalizes behaviours previously stigmatized such as targeted of surfacing of divorce content, gambling content, and heavy drinking content to malleable users.
This is where data poisoning steps in and is important.
Data poisoning is the deliberate introduction of false, inconsistent, and misleading behavioural signals into the social media and AI systems that build profiles on individuals, making the resulting profile an unreliable map of a real person and therefore an unreliable instrument for targeting, manipulation, or prediction.
I think all of us need to poison our online data.
This is why. Firstly, there is no reliable way to regulate these bad actors from using the data in a malign way. Regulations that are designed to protect individuals from behavioural surveillance consistently arrive after the damage is done. For example, the EU’s GDPR passed in 2018, two years after Cambridge Analytica had already completed its operations. And even when regulations do exist, they are ignored or their loopholes exploited. For example, Facebook suppressed its own internal research showing Instagram was driving teenage girls toward suicide to avoid regulatory scrutiny, and the NSA reinterpreted Section 702 of FISA to authorize bulk collection it was never designed to permit.
Secondly, data poisoning works directly on the data itself at the point of collection, making it effective regardless of what any regulator or platform decides to do.
Thirdly, AI agent influence operations depend entirely on the accuracy of the behavioral profile underneath them, if/when we poison that profile and the entire operation fails, constructing personas and manufacturing social consensus targeted at a person who does not exist.
Data poisoning has already produced measurable results at scale. In 2023, University of Chicago SAND Lab researchers found that just 300 adversarial poisoned images in a commercial-scale training dataset produced significant and compounding degradation in the model’s ability to generate targeted visual categories accurately. Therefore, I think it can be done.
So, this is how we are going to poison our data. Poisoning behavioural data works at four layers and knowing which layer you are targeting matters more than which tool you use, because platforms continuously update their detection while the principle remains the same.
The first layer is your advertising and interest profile, the model of you that is of interest to data brokers and political targeting operations. The goal is to create systematic behavioural incoherence, that is, generating pretend engagement signals across such a contradictory range of interests and political orientations that the profile describes no coherent person. You can use a tool such as AdNauseam which clicks every advertisement you encounter automatically in the background, and TrackMeNot, a tool that generates randomized search queries continuously alongside your real ones, flooding the advertising and search layer with signals too contradictory to model.
The second layer is identity correlation, that is, how data brokers link your records across platforms into one unified profile. The method is providing different personal details across non-essential service signups. Always write different birthdays, different cities, and different name variations when signing up on social media. If this distributed across enough records, any attempt to merge them hits contradictions that cannot be resolved. A tool like SimpleLogin or Apple’s Hide My Email gives you a unique relay address for each signup, so that when one address receives spam, you know with certainty which company sold it. Or what I do, when I signup for services, add “+whateveryouwanttoput” on your email address. Lets say your email is ananoynous@gmail.com, when you sign up on Facebook use “ananoymous+facebook@gmail.com” and it will work just fine.
The third layer is your behavioural profile, that is, the psychological map that AI agent systems use to construct personas and calibrate targeting to you specifically. The method work by behavioural segregation. I recommend that you conduct all genuine activity through a dedicated browser (such as Ecosia or Firefox with VPN) with strict tracking protection while a separate environment accumulates browsing behaviour with no relationship to your real interests, producing two incompatible records that no profiling system can merge coherently. A tool you can use is OpenWPM, developed at Princeton’s Center for Information Technology Policy, which automates the noise layer, running continuous background browsing across unrelated topics at a volume that buries genuine behaviour inside it.
The fourth layer is AI training data, that is, that determines the capability of the influence operation systems being built right now. Lie online about who you are AND for the love of privacy, desist from uploading your pictures to an AI.
Also, on selecting a VPN, use the one with an independently audited no-logs policy such as Mullvad and ProtonVPN because contrary to popular belief, VPNs do not inherently hide your online identity. Other tools you can use are DeleteMe and Privacy Bee which automate deletion requests to hundreds of data brokers simultaneously, forcing them to rebuild their profiles of you from whatever incomplete and noisy inputs remain. Lastly, use a DNS resolver like Cloudflare’s 1.1.1.1 routes your DNS queries through servers that do not log them commercially, closing off one of the least discussed but most comprehensive sources of behavioural data available to anyone with DNS infrastructure access. Apologies that I cannot provide a tutorial, but you can learn and apply these tools in 10 or so minutes.
I know none of this dismantles the infrastructure that Snowden documented in 2013, the political targeting apparatus that has been repeatedly demonstrated, or AI agent influence capability architecture that is operational now. It just raises the cost of maintaining accurate profiles on a population that has decided to be uncooperative, and that cost increases by an order of magnitude when enough people maintain it simultaneously.
If we do not poison our data now, then we become cooperative enablers of the very system designed around the assumption that the population it observes will continue to supply accurate, coherent, and cooperative data indefinitely. This system has already been used to swing elections decided by tens of thousands of votes, to facilitate genocide, to radicalize a crowd into subverting democratic system, to walk vulnerable people toward suicide, and to deploy thousands of AI personas manufacturing personalized social realities for millions of specifically profiled individuals simultaneously.
We have tried other things and failed, so on second thought, our only hope is to poison the input into that system, because the only direct control we have as digital natives is the accuracy of what they supply to the system, and the accuracy of what we willingly supply to it.
So let us choose to degrade the supply, starting today.