Distribution: is this volume organic or manufactured?
Is this volume and timing organic, or manufactured?
This chapter explains the behavioural signals that distinguish manufactured volume from real popularity: copied text, synchronised timing, batch-created accounts, link pushing and amplification loops. It shows how to check them with the Coordination Analyzer, how to weigh the innocent explanations, and how to report a pattern without accusing anyone.
All stages
Volume is not popularity
A count of posts, likes, shares or signatures measures activity. It does not measure how many people hold a view. One operator with many accounts, or one advertiser with a budget, can produce numbers that look like a movement. Doppelganger pushed its forged pages through paid advertisements and large numbers of short-lived accounts. The lesson is that an item in your feed tells you someone put it there and tells you nothing about how many people agree with it.
Apparent popularity is faked because it works. Paul and Matthews note that a message arriving from many sources, in volume, is more persuasive than the same message from one, and people in every community take cues from what they think their neighbours believe. The stage question, organic or manufactured, is worth asking carefully for that reason.
Coordination signals
Analysts look at behaviour, which is harder to disguise than content. The recurring signals are identical or near-identical text across many accounts; posting in tight, synchronised bursts; accounts created in batches within days of one another; many accounts pushing the same link; and amplification loops, in which a set of accounts mostly repost each other. Reused profile images and accounts that abruptly change language and subject are further signs.
These traces are what exposed real networks. Platform teams linked Spamouflage clusters through reused content and synchronised timing, and a working-hours posting pattern suggested staff on shifts. Researchers given data on the pro-Western network removed in 2022 found shared posting schedules and duplicated text and images. Keller and colleagues, studying a documented astroturfing campaign, found that centrally directed accounts gave themselves away through the same traces, because people following instructions behave more alike than people who merely agree.
Innocent coordination
Every signal has a legitimate cause. Campaigns and unions send supporters a template and ask them to post it. Fans organise. A breaking event makes thousands of strangers post in the same minute. A membership drive or a news story brings a wave of new accounts in one week. Jokes and slogans are copied word for word by people who have never met.
This is why the evidence ladder in the attribution guide limits what behaviour can support: a finding that activity is coordinated and possibly inauthentic, stated about the network as a whole. Behaviour cannot say who is coordinating, and it cannot establish that any one account is fake. Open organising by a named group is ordinary politics. The concern is coordination that hides itself.
The Coordination Analyzer and reporting
The Coordination Analyzer on this site takes a set of posts you have collected and reports the behavioural signals present, each alongside the innocent explanations for it. It never attributes activity to anyone. It can only see the sample you give it, so record how you collected the posts and what you left out. Look for two or more independent signals before you describe a pattern.
Then report, and do not publish a list. Platforms hold registration and login data that outsiders lack, and their rules on impersonation, spam and inauthentic behaviour concern conduct, whatever the viewpoint. Give dated examples and describe the pattern in neutral terms. Moderators can act on conduct in their own space, such as duplicate posting and link dumping, without ruling on who anyone is.
Techniques you will meet here, and the tell
Accounts work together while concealing that they are connected, in order to mislead people about who is speaking and how many agree.
The tell: Two or more independent signals coincide across the same set of accounts: shared text, shared timing, shared creation dates, shared links.
Automated or semi-automated accounts repost and like content to inflate its counts and push it into recommendation systems.
The tell: Shares vastly outnumber replies, and the sharing accounts show little activity of any other kind.
A centrally organised effort is dressed as spontaneous public feeling.
The tell: A supposed groundswell has no named organisers, no offline presence, and members who appeared together and speak in the same phrases.
A group descends on a thread, poll, review page or individual at an agreed moment to swamp it.
The tell: A quiet space receives a sudden wave of near-simultaneous posts from accounts that have never taken part in it before.
An existing tag or community label is flooded with unrelated or opposing material to redirect its audience.
The tell: A tag used by a real community abruptly fills with posts on a different message, many carrying the same link.
High volume across many channels, repeated fast, with no concern for consistency. Distribution is the strategy.
The tell: The same claims arrive from many directions at once and are replaced with new ones as soon as they are challenged.
Early bursts of engagement are used to trigger recommendation systems, which then show the content to real users without further effort.
The tell: An item with a suspicious early spike is now reaching you through a recommended or trending feed, not through anyone you follow.
Inflated counts are meant to make a position look like the majority view so that real people fall in behind it.
The tell: The main argument offered is the number itself: everyone is saying it, thousands have signed.
Worked example
Two nights before the council vote, posts about the Alder Bay footbridge surge. A petition against the bridge shows six thousand signatures in a town of about nine thousand people. Priya wants to know how much of this is the town.
- 1She collects 140 public posts from the two local groups over forty-eight hours and notes for each the text, the time, the link, and the account's creation month where it is shown. She writes down how she chose them.
- 2She runs the set through the Coordination Analyzer. It flags four things: sixty-one posts use one of four near-identical texts; most of those were posted in three bursts of under ten minutes; a cluster of the accounts were created in the same fortnight; and more than half the posts link to the look-alike site. Each flag comes with its innocent explanations, and she reads them.
- 3She tests the innocent explanations. The Harbourside Traders Association is a real body with a named chair, and the chair confirms that one of the four texts is theirs, emailed to members with a request to post it. That is open organising, so Priya removes those posts from the pattern. Three texts remain that nobody claims.
- 4She looks at the petition. The hosting site does not verify signers, and long runs of entries share the same minute. She cannot say who signed. She can say the figure is not a count of residents.
- 5She compares the online picture with the room. The public meeting drew about eighty people, split roughly evenly, which is normal for a planning dispute in the town.
- 6She reports the pattern to the platform through its impersonation and inauthentic-behaviour routes, with dated examples, and tells the two group administrators about the duplicate posts and link dumping so that they can apply their own rules. She does not publish the list of accounts.
Outcome. Priya can state three things: part of the online volume is coordinated and drives readers to a site imitating the Courier; part of the opposition is real and openly organised; and the petition total is unreliable. She does not know who is coordinating the unexplained part, and no individual account has been called fake.
Coordination check
Fill this in about a set of posts you have actually collected. The aim is a statement about the pattern as a whole, with the innocent explanations tested. Saved in this browser only.
Say how many posts, from where, over what dates, how you chose them, and what you left out.
Tick each signal you observed in the sample.
Summarise the flags it raised and the innocent explanations it listed for each.
For each signal, write the ordinary explanation and what you did to check it.
Ask the genuine groups involved whether they circulated a template or a call to post.
Compare the online volume with what you can see by other means: meetings, letters, calls, a verified vote.
Write one or two neutral sentences about the set as a whole, with counts, naming no account and no actor.
Tick each place you have reported the pattern.
Decision check: organic, organised, or manufactured?
0/7If any of these is not true: Describe what you see as high volume of unknown origin and stop there. Widen or document your sample, test the innocent explanations you skipped, and ask the real groups involved what they organised. If only one signal is present, treat the activity as ordinary until more appears. Do not post screenshots of accounts.
Common mistakes
- ×Reading volume as popularity, in either direction: being swayed by a large number, or assuming a large number must be fake.
- ×Treating a single signal as proof. Copied text alone, or a burst alone, is what ordinary campaigns and breaking news look like.
- ×Confusing open organising with astroturf. A named group asking its members to post is participating in public life.
- ×Over-attribution and naming accounts. Behavioural evidence describes a network; it does not identify an operator, and it has repeatedly put real people in the frame as bots.
- ×Forgetting the limits of the sample. The Coordination Analyzer and every other tool can only describe the posts you gave it, and a biased collection produces a biased pattern.
How do you put it in front of people at a pace and volume you could defend in public?
Related
References
- Francois, C. (2019). Actors, Behaviors, Content: A Disinformation ABC. Transatlantic Working GroupDeceptive behaviour as a distinct vector, and the basis for acting on conduct instead of viewpoint.
- Keller, F. B., Schoch, D., Stier, S., & Yang, J. (2020). Political Astroturfing on Twitter: How to Coordinate a Disinformation Campaign. Political CommunicationCentrally directed accounts are distinguishable by coordination traces such as shared text and timing.
- Paul, C., & Matthews, M. (2016). The Russian "Firehose of Falsehood" Propaganda Model: Why It Might Work and Options to Counter It. RAND CorporationVolume and multiplicity of sources as persuasive in themselves.
- Weedon, J., Nuland, W., & Stamos, A. (2017). Information Operations and Facebook. FacebookFalse amplification through coordinated inauthentic accounts, described by a platform security team.
- Graphika & Stanford Internet Observatory (2022). Unheard Voice: Evaluating Five Years of Pro-Western Covert Influence OperationsA covert network identified through shared posting patterns, duplicated content and generated profile images.
- Rauchfleisch, A., & Kaiser, J. (2020). The False positive problem of automatic bot detection in social science research. PLOS ONEAutomated classification mislabels real people, so behavioural scores should not be used against individual accounts.