Coordination is not the same as inauthenticity. Activists coordinate. Fans coordinate. Campaigns ask supporters to post at the same time with the same hashtag. What makes an operation inauthentic is deception about who is speaking and how many of them there are.
That distinction matters because the cost of error runs in both directions. Miss a real operation and a fabricated consensus shapes a vote, a market or a crisis response. Mislabel a genuine movement as fake and you silence real people while handing the operators a talking point. Every signal below is evaluated against what organic behavior looks like, and no single signal is ever enough on its own.
Start with a baseline, not a suspicion
Before we score any account, we build a baseline from a comparison set: accounts discussing the same topic, in the same language, over the same period, that have no apparent connection to the suspected network. Breaking news makes real people post in bursts. Popular slogans get copied word for word. Without a baseline, every one of the signals below will produce false positives during exactly the moments that matter most.
Each signal is then measured as a deviation from that baseline, not as an absolute. A cluster of accounts created in the same month means little on a platform that gained millions of users that month. The same cluster created in the same nine days, during a quiet period, means a great deal more.
Signal 1: synchronized creation
Operations need accounts, and accounts are usually made in batches. We plot creation dates for every account in a suspected network against the baseline. In the national-vote campaign described in our case study, 1,140 of the 1,900 accounts, 60 percent, were created inside two nine-day windows eighteen months apart, long before they became politically active. The baseline for the same topic showed no comparable spike.
Batch creation leaves other traces too: sequential or templated handles, identical default settings, profile fields completed in the same order, and early activity that consists of following the same small set of seed accounts.
Signal 2: temporal coordination
Real crowds react to events. Operations react to schedules. We look at posting times at the level of seconds and minutes, measuring how often accounts post within short windows of each other compared with the baseline. Coordinated networks show repeated co-posting by the same pairs of accounts across many unrelated moments, not just around a single news event.
The daily rhythm matters as well. Paid operators tend to work shifts. When the activity of accounts claiming to be local voters fits a working day several time zones away, drops sharply at weekends and pauses for public holidays that are not observed where the accounts claim to live, the network is telling you where its staff sit.
Signal 3: content reuse
Operators work from briefs and templates. That produces identical or near-identical posts with small variations designed to evade duplicate detection: swapped synonyms, reordered sentences, different emoji placement. We measure text similarity with techniques built for near-duplicate detection, such as shingling and similarity hashing, rather than exact matching.
Shared mistakes are especially telling. The same unusual misspelling, the same incorrect local idiom or the same leftover placeholder text across dozens of accounts is hard to explain as organic copying, because real people correct, adapt and personalize the slogans they share.
Signal 4: fabricated identities
Fake people need faces. Older operations recycle photographs taken from real people elsewhere online, which reverse image searching usually exposes. Newer ones use synthetic faces. These have their own tells: eyes placed at nearly identical positions across different images, mismatched earrings or glasses frames, warped backgrounds, malformed teeth and hair that merges into clothing.
Names and biographies follow patterns too. Networks often draw first and last names from short lists, pair them with generic biographies and stock interests, and reuse the same handful of cover photos. Individually, none of this proves anything. Across a cluster, it adds up quickly.
Signal 5: network structure
Organic communities are messy. Their members follow and amplify a wide spread of accounts, many of them outside the community. Operations tend to be tidy. Accounts amplify each other densely, interact with few outsiders and route attention to a small number of seed accounts whose content the network exists to spread.
We build interaction graphs from reposts, replies and mentions, then look for clusters that are both unusually dense internally and unusually isolated externally. Star-shaped structures, in which many accounts point at a few hubs but rarely at each other, are a common signature of amplification networks.
Signal 6: shared off-platform infrastructure
The strongest evidence often sits outside the platform entirely. Operations drive traffic somewhere: to websites, payment pages, petition sites or "news" outlets. Those destinations have infrastructure, and infrastructure can be pivoted on. Shared link shorteners, identical tracking parameters, common analytics identifiers and the same hosting and certificate patterns can connect accounts that never interacted on the platform.
This is also where detection becomes attribution. In the national-vote case, shortened links in the network's posts resolved through a link-tracking account that was also used by other clients of a commercial content agency, whose public portfolio openly advertised "audience growth" services. That link moved the finding from "this is a coordinated network" to "this is who is running it".
Signal 7: lifecycle anomalies
Accounts used in operations live unusual lives. They sit dormant for months, then activate together. They change handles and display names in batches, often switching identity entirely between campaigns. They pivot topics en masse, from cryptocurrency promotion to consumer reviews to politics. When an operation is exposed, they are deleted or set to private in waves.
Lifecycle signals require history, which is one reason preservation matters. Handles change, but the underlying account identifiers that platforms assign usually do not. We record those identifiers at capture so that an account cannot escape scrutiny simply by renaming itself.
Combining signals: why one is never enough
Every signal above has innocent explanations. People sign up when a topic trends. Supporters share prepared slogans. Activists follow each other. What organic behavior rarely does is produce several independent signals at once, across different categories, for the same set of accounts.
| Signal | What an organic crowd looks like | What coordination looks like |
|---|---|---|
| Creation | Account ages spread widely, with spikes that match platform-wide growth | Tight creation windows unrelated to platform growth or events |
| Timing | Bursts around events, local daily rhythms | Repeated co-posting by the same accounts; shift-work rhythms in a foreign time zone |
| Content | Shared slogans adapted and personalized | Templated variants with shared errors and leftover placeholders |
| Identity | Varied, idiosyncratic profiles with real histories | Recycled or synthetic faces, patterned names and biographies |
| Structure | Loose ties reaching far outside the community | Dense, isolated clusters and star-shaped amplification |
| Infrastructure | Links to many unrelated destinations | Shared shorteners, tracking parameters and analytics identifiers |
| Lifecycle | Gradual, individual changes over time | Synchronized dormancy, activation, renaming and deletion |
Our working rule is that an account is assessed as part of a coordinated inauthentic network only when it shows signals from at least three of the seven categories, at least one of which is not purely behavioral. Behavioral signals can be imitated or coincidental. Shared infrastructure and fabricated identities are much harder to explain away.
We report confidence separately for the network and for individual accounts. A network can be assessed with high confidence while some accounts at its edges are only moderate, because they may be genuine users who were drawn into amplifying it. Takedown recommendations cover only accounts that meet the full threshold.
From detection to attribution
Detecting coordination tells a platform or a government that a network exists. It does not say who runs it or why. Attribution requires the same standard we apply to any other investigation: independent lines of evidence from different source types, a red-team review and reproducible preserved evidence. In practice the decisive evidence is usually off-platform, in the infrastructure and commercial footprint of the operator.
We are also careful about the claims we make on the operator's motives and sponsors. Identifying the content agency that ran a network is a factual finding. Identifying who paid the content agency is a separate question that often needs different evidence, and we label it accordingly. Our approach to grading those judgments is set out in Attribution is a standard of proof.
Building a package platforms can act on
Trust and safety teams receive many reports. The ones that lead to action share a few features:
- Stable account identifiers for every account, not just handles that can change.
- Clear evidence for each signal, with captures and timestamps.
- A precise statement of which policy the behavior violates.
- Separation between core network accounts and genuine users who amplified them.
- A concise summary that an enforcement reviewer can verify in minutes.
In the national-vote case, our referral covered 1,900 mapped accounts. Platforms removed 1,640 of them within 72 hours of referral. The remainder were either already inactive or did not meet the platforms' own thresholds, and we had flagged most of those as moderate-confidence edges in advance.
The goal is not to find as many fake accounts as possible. It is to be right about every account we name.