Channels and messengers: who is really speaking?
Who is really speaking, and how did this reach me?
This chapter covers the messengers an influence operation uses: inauthentic accounts, front media, cloned sites, cut-outs, and the real people who pass material on without knowing where it came from. It gives a quick provenance routine anyone can run on a headline, and it keeps the question of a hidden source separate from the question of who is behind it.
All stages
Content can be accurate and the messenger false
This stage asks who is really speaking and how the message reached you. That is a separate question from whether the content is accurate. The old classification of propaganda by colour is still the clearest guide: white material is openly attributed to its real source, grey material hides or blurs its source, and black material claims to come from someone else. Platform enforcement follows similar logic. Francois's ABC framework notes that deceptive actors and deceptive behaviour can be acted on even when the content is unremarkable, and takedowns for coordinated inauthentic behaviour concern conduct, not viewpoint.
For a reader the practical consequence is simple. A message deserves less trust when its source is hidden or borrowed, whatever it says, because you have lost the ability to weigh who is telling you and why.
The cast, seen from outside
Inauthentic accounts present invented people as ordinary members of the public. Front media are outlets set up to look independent while speaking for an undisclosed sponsor; researchers examining the pro-Western network removed in 2022 described sham news brands alongside personas with computer-generated faces. Cloned sites copy a real outlet's design at a slightly different address. In Doppelganger, every forged article sat on a domain a few characters away from the genuine one. Cut-outs are intermediaries, invented or real, who hand material onward so that its origin stays out of view.
A genuine address is not a complete guarantee either. In the Ghostwriter campaign, fabricated articles appeared on real news sites that had been compromised, and individual incidents were caught when the bodies and officials supposedly quoted publicly denied them. Confirmation from the named source, through its own channel, is what settles the matter.
Unwitting amplifiers
Most of the distance a message travels is covered by real people. Starbird, Arif and Wilson describe disinformation as collaborative work in which sincere participants, who are not coordinating with anyone, do much of the spreading. That makes the amplifier a poor guide to the origin, and it makes blaming amplifiers both unfair and counterproductive.
Journalists and influencers are sought-after amplifiers because their repetition confers standing. Lukito and colleagues found tweets from Internet Research Agency accounts quoted in news stories as the voice of ordinary citizens. An account embedded in an article as public reaction is a source like any other and needs the same checking. So does a tip, a document, or a story idea that arrives unusually well packaged.
Provenance at headline level
Wineburg and McGrew observed that professional fact-checkers judged unfamiliar websites faster and more accurately than historians or students, and did so by leaving the site: they opened new tabs to see what others said about the source before reading it closely. They called this lateral reading. It takes a minute and needs no special tools.
Read the address bar character by character before you read the masthead. If a story claims to come from a known outlet, go to that outlet directly and look for it there. Look for named staff, a contact address and a history. A public registration lookup shows when a web address was first registered. Treat the date as one modest fact. An outlet claiming decades of history at an address registered last month has something to explain. A new address alone is ordinary, and private registration is the norm for honest sites as well.
Techniques you will meet here, and the tell
The source is either obscured (grey) or falsely assigned to someone else (black). This is the defining feature of the stage.
The tell: You cannot find out who published this, or the publisher it names says it did not.
A web address is chosen to pass for a trusted one at a glance, with a doubled letter, a swapped character or an unusual ending.
The tell: The masthead is familiar and the address, read slowly, is not the one you would type.
One operator speaks through several invented identities so that a single voice looks like several independent ones.
The tell: A set of accounts agree with and amplify one another and have little existence outside that conversation.
An invented intermediary, such as a leaker, a concerned insider or a small activist group, delivers material so that the origin is one step removed.
The tell: The persona exists only to hand over this one item and has no history before it and no activity after.
An organisation with a civic-sounding name speaks for a sponsor it does not disclose.
The tell: The group has a name and a logo but no named officers, no members you can find, and no record before the current dispute.
Material is placed with small outlets or influencers in the hope that larger ones will pick it up from them and lend it standing.
The tell: A reporter or prominent account is being offered a ready-made story whose only sources are other recent posts.
Sincere members of the audience adopt and spread the material, which gives it real voices and makes the origin harder to see.
The tell: The people you can identify are plainly genuine, and none of them can say where the claim first came from.
Sites that look like news outlets are filled with machine-written articles, sometimes for advertising revenue and sometimes as cover for placed stories.
The tell: A large volume of generic articles with no bylines or reporting, among which a few pointed local stories stand out.
Worked example
Priya turns to the site styled as an Alder Bay newspaper, the one that tops the search results and that the cost claim traces back to. She wants to know what it shows about itself and what it hides, and how its stories are reaching residents.
- 1She reads the address bar. The site uses the Courier's name, a near-identical masthead and the same shade of blue. The address differs from the Courier's by one doubled letter.
- 2She reads laterally. The site names no reporters, gives no office or phone number, and says it has served the Bay since 1987, which is the Courier's own founding year. A registration lookup shows the address was first registered eleven weeks ago. She notes that a new address alone means little; the mismatch with the claimed history is what she records.
- 3The community group cited in the cost story has a page with a logo, no named officers, and a creation date in the same month. She notes beside it that real residents' groups are often informal and unnamed.
- 4Tomasz, who runs a popular local fishing page and whom she has known for years, has shared two of the site's stories. She phones him. He thought he was sharing the Courier. She tells him the address fooled other people too and asks nothing more of him than to look twice next time.
- 5A regional radio reporter calls asking for comment on the Courier's story about the hidden cost. Priya explains that the Courier published no such story and asks the reporter to read the address aloud.
- 6She writes down what she can state: a site imitating the Courier's name and appearance exists at a similar address and is the earliest source she can find for the cost claim. She does not know who runs it.
Outcome. Priya has established that the messenger is borrowing her paper's identity, which is a fact about conduct she can show to anyone. She has also found that the people spreading the stories locally are real and acted in good faith. The question of who operates the site remains open and she leaves it open.
Messenger check
Fill this in for one source you are actually looking at: a site, a page, an account or a document that has been passed to you. Saved in this browser only.
Copy it out character by character instead of relying on the name displayed.
Record what the source claims about itself: name, history, location, staff.
Choose the best description after you have looked beyond the page itself.
Tick each check you actually completed.
Summarise what you found by leaving the page and searching for the source itself.
List who passed it on, step by step, as far back as you can see.
Note which links in the chain are identifiable people who most likely shared in good faith.
Write down the ordinary readings: a new but honest outlet, a parody, a volunteer page, a private person who prefers not to be named.
Decision check: do I know who is speaking?
0/7If any of these is not true: Treat the item as unsourced. Do not pass it on, and if you are a journalist do not quote it or the accounts reacting to it. Complete the lateral reading first. If someone you know has shared it, tell them privately what you found about the address and leave it there. If the source imitates your own organisation, record the evidence and move to the response stage.
Common mistakes
- ×Trusting the masthead, the logo or a verification mark over the address and the outlet's own channel.
- ×Treating anonymity as guilt. Many honest sites, small groups and private individuals do not publish their names, and private domain registration is standard.
- ×Shaming the people who shared in good faith. They are the audience you most need to keep, and they were deceived, not complicit.
- ×Over-attribution: assuming a look-alike site or a cluster of thin accounts must be a state operation. Advertising-revenue schemes, pranksters, commercial firms and local rivals produce the same appearance.
- ×Assuming a genuine address guarantees a genuine article. Compromised sites and hijacked accounts exist, so a surprising story still needs confirmation from the outlet or the person quoted.
Where and through whom will the message travel, with the source visible?
Related
References
- Francois, C. (2019). Actors, Behaviors, Content: A Disinformation ABC. Transatlantic Working GroupDeceptive actors and deceptive behaviour as grounds for action independent of the content.
- Wineburg, S., & McGrew, S. (2019). Lateral Reading and the Nature of Expertise: Reading Less and Learning More When Evaluating Digital Information. Teachers College RecordFact-checkers evaluate an unfamiliar source by leaving it and consulting others, and outperform other expert readers by doing so.
- Starbird, K., Arif, A., & Wilson, T. (2019). Disinformation as Collaborative Work: Surfacing the Participatory Nature of Strategic Information Operations. Proceedings of the ACM on Human-Computer Interaction (CSCW)Sincere, uncoordinated participants carry much of an operation's material.
- Alaphilippe, A., Machado, G., Miguel, R., & Poldi, F. (2022). Doppelganger: Media clones serving Russian propaganda. EU DisinfoLabCloned news sites at look-alike addresses, identified through open sources.
- Lukito, J., Suk, J., Zhang, Y., Doroshenko, L., Kim, S. J., Su, M.-H., Xia, Y., Freelon, D., & Wells, C. (2020). The Wolves in Sheep's Clothing: How Russia's Internet Research Agency Tweets Appeared in U.S. News as Vox Populi. The International Journal of Press/PoliticsInauthentic accounts were quoted by news outlets as ordinary public opinion.
- Donovan, J., & Friedberg, B. (2019). Source Hacking: Media Manipulation in Practice. Data & SocietyTechniques aimed at getting journalists and prominent accounts to carry material whose origin is hidden.