DigitalMANIPULATIVE

Coordinated Inauthentic Behavior

What it is

Groups of accounts, pages, or sites that work together to mislead people about who is behind a message or how much support it has, concealing coordination and identity rather than simply expressing a view.

How it works

The lever is the audience's reasonable assumption that many independent voices saying the same thing constitute evidence. Meta's 2018 definition, which most platforms have since borrowed, hinges on two elements: coordination and inauthenticity. Coordination alone is ordinary politics — parties, unions, and advocacy groups organize supporters all the time. Inauthenticity alone is a fake profile. The combination is what deceives: a network that hides that it is a network, that its personas are not who they claim, or that a single sponsor is paying for the chorus. The DISARM framework catalogs the moves in stages (plan, prepare, execute, assess) so investigators can describe an operation without guessing at intent. Detection usually rests on behavioral fingerprints rather than content: accounts created in batches, identical posting times, shared infrastructure, copy-pasted text, and cross-amplification among personas that never interact with anyone else. Content can be entirely true and the behavior still inauthentic, because the deception is about source and scale, not about the claim.

Real-world examples

  • •The Russian Internet Research Agency ran thousands of personas across Facebook, Instagram, and Twitter in 2014–2017, posing as American activists on the left (Blacktivist) and right (Heart of Texas), as documented in the 2019 Mueller Report and the two reports commissioned by the U.S. Senate Intelligence Committee.
  • •Domestic examples span the spectrum: in 2017, a small group of Democratic-aligned operatives ran the Project Birmingham experiment in the Alabama Senate race, creating a fake conservative page and following Roy Moore with Russian-looking bot accounts (reported by the New York Times in December 2018); in 2020, Turning Point Action paid teenagers in Arizona to post identical pro-Trump talking points from their own accounts, and Facebook removed the network (Washington Post, September 2020).
  • •The Spamouflage network attributed to the People's Republic of China, first described by Graphika in 2019, has posted across YouTube, Twitter, and Facebook for years, initially attacking Hong Kong protesters and later the U.S. and Taiwan, and is notable for how little engagement it earns despite its size.
  • •Facebook removed a network linked to The BL and the Epoch Media Group in December 2019 that used AI-generated profile photos to run pro-Trump pages, and in 2018 Facebook and Twitter removed a large Iranian network posing as independent news outlets and American liberals identified by FireEye.

Historical case studies

"Unheard Voice": a pro-Western covert network

2017–2022Platform Takedown

In 2022 Twitter and Meta removed a set of interlinked accounts that for almost five years had promoted pro-United States narratives and criticized Russia, China and Iran to audiences in the Middle East and Central Asia, using fake personas with computer-generated profile photographs, sham independent news outlets and copied content. Meta later said the people behind it were associated with the US military. Analysts at Graphika and the Stanford Internet Observatory, who were given the data, found that the great majority of posts received no more than a handful of likes or retweets, and that the network's overt, openly attributed accounts reached far more people than the covert ones.

Source →

The "Spamouflage" takedown

2023Platform Takedown

In August 2023 Meta removed 7,704 Facebook accounts, 954 pages and 15 groups belonging to what it called the largest known cross-platform covert influence operation, active on more than fifty platforms and forums, which it linked to individuals associated with Chinese law enforcement. The network posted praise of China and its policy in Xinjiang and attacks on the United States, Western governments and critics of Beijing, including journalists. Meta reported that despite its size the operation had failed to build a real audience, with many of its followers being purchased fake accounts from other countries. As with the pro-Western network removed a year earlier, volume did not produce engagement.

Source →

The 2019 India takedowns: networks on both sides of an election

2019Platform Takedown

On April 1, 2019, ten days before voting began in India's general election, Facebook announced two unrelated removals for coordinated inauthentic behavior. One network, 687 pages and accounts, used fake accounts to post local news and criticism of the governing Bharatiya Janata Party, and the company linked it to individuals associated with the IT cell of the opposition Indian National Congress. The other, 15 pages, groups and accounts linked to individuals associated with the Indian IT firm Silver Touch, posted about the government, the BJP and alleged misconduct by its opponents; it was far smaller in number, but its main page had about 2.6 million followers. Both parties run official social media operations. What the company removed in each case was the use of fake identities to conceal who was behind the pages, not the partisan content.

Source →

Ethical guidelines

  • ●Organizing real supporters to speak is legitimate; hiding that they were organized, or inventing them, is not. The distinction is disclosure, not enthusiasm.
  • ●Operators who run persona networks bear responsibility for the specific communities they impersonate — fake Black activists or fake veterans harm the real groups whose voice they counterfeit.
  • ●Researchers and platforms should attribute networks by evidence, not by which side benefits; misattribution is itself a form of information operation.
  • ●A claim that an opponent's movement is inauthentic needs the same standard of proof as any other factual accusation — organic movements are routinely smeared as bots.

How to defend against it

  • ►Before reacting to a wave of agreement, sample the accounts: check creation dates, follower-to-following ratios, whether the bio is a stock phrase, and whether the profile photo returns matches in a reverse-image search (TinEye, Google Lens, Yandex).
  • ►Look for the coordination tells that content cannot hide: near-identical wording across accounts, posts landing within the same minute, and personas that only ever amplify one another.
  • ►Ask who benefits from you believing this is a groundswell, then read laterally — leave the page and search for the group or outlet by name to see what independent sources say about it (Wineburg & McGrew).
  • ►Treat platform takedown reports (Meta Adversarial Threat Reports, Graphika, the Stanford Internet Observatory, DFRLab) as a starting point for recognizing recurring network signatures.
  • ►Hold the accusation to the same standard as the claim: if someone tells you a movement is fake, ask for the behavioral evidence, not the assertion.

From the Defense Playbook

The Accuracy Promptseconds

Before sharing anything, ask yourself one question, "Is this accurate?", because most sharing of false content comes not from belief but from inattention to accuracy, and the question alone measurably improves what people pass on.

The Two Independent Sources Ruleminutes

Do not treat a consequential claim as established until two sources that obtained the information separately both support it, and check that they really are separate, because ten outlets repeating one origin are still one source.

Account Forensicsminutes

Before taking an online account's word, or taking a crowd of accounts as public opinion, spend a minute on the profile itself: its age, history, posting rhythm, network, and photo, which together show whether you are looking at a person, a persona, or a coordinated operation.

Sunlight Against Astroturftakes practice

When a "grassroots" campaign, citizens' coalition, or flood of public comments appears, establish who organized and paid for it and make that public, because manufactured support loses most of its force once the audience knows it is manufactured.

Disclosure Checklistminutes

Before publishing sponsored, affiliated, incentivized, or endorsed content, check that every material connection between the speaker and the brand or cause is disclosed clearly, conspicuously, in plain language, and in the same place and format as the claim it qualifies.

Every playbook entry states how strong its evidence is and when not to use it. Browse the full playbook.

References

  1. Gleicher, N. (Meta Newsroom) (2018). Coordinated Inauthentic Behavior Explained. Meta Newsroom, December 6, 2018
    The platform definition that inauthenticity plus coordination, not content, is the violation.
  2. Mueller, R. S. (U.S. Department of Justice) (2019). Report On The Investigation Into Russian Interference In The 2016 Presidential Election, Volume I. U.S. Department of Justice · link
    The Internet Research Agency persona network and its cross-spectrum impersonation of American activists.
  3. DiResta, R., Shaffer, K., Ruppel, B., Sullivan, D., Matney, R., Fox, R., Albright, J., & Johnson, B. (2018). The Tactics & Tropes of the Internet Research Agency. New Knowledge report prepared for the U.S. Senate Select Committee on Intelligence
    Detailed description of IRA page names, audiences targeted, and cross-platform coordination.
  4. DISARM Foundation (2022). DISARM Framework (Disinformation Analysis and Risk Management). DISARM Foundation, successor to the AMITT framework (Terp & Breuer, 2019)
    The staged, technique-level taxonomy investigators use to describe influence operations.
Last reviewed
Suggest a correction

Detect Coordinated Inauthentic Behavior in any text

Paste any message, email, or article into our free Manipulation Detector to see if Coordinated Inauthentic Behavior or other techniques are being used on you.

Try the Detector FreeCreate Free Account

Related Articles

Dark Patterns in UX: How Apps Manipulate Your Behavior

Subscription traps, misleading interfaces, and engineered addiction. Understanding the persuasion techniques built into the apps you use every day.

7 min read

OSINT for Beginners: Open Source Intelligence Explained

Open Source Intelligence (OSINT) uses publicly available data to gather actionable insights. Here is a beginner-friendly guide to what OSINT is and how it is used.

10 min read