This illustrative case study demonstrates how network analysis surfaces coordination. It focuses on method and does not attribute activity to any specific real actor.
Summary
A cluster of accounts appears to push an identical narrative around an election. The task is to assess whether the activity is coordinated and inauthentic.
Research question
Are these accounts acting independently, or are they coordinated?
Methodology
- Scope — a defined narrative and account list are gathered from archives to avoid amplification.
- Collect — post text, timestamps, and shared links are recorded.
- Graph — accounts, domains, and content are loaded into Gephi to visualize connections.
- Pattern analysis — synchronized posting times, reused images, and accounts created in the same window emerge as clusters.
Findings
The evidence is consistent with coordinated inauthentic behavior: dense interconnection, shared assets, and synchronized timing. Attribution of who is behind it remains unproven on public evidence alone.
Limitations
Coordination is not the same as attribution. Similar posting can also arise from organic communities; the investigation reports patterns, not certainties.
Lessons learned
- Work from archives to avoid amplifying the campaign.
- Distinguish coordination (observable) from attribution (often not).
- Publish the method so the analysis is reproducible.
#disinformation#social-media#osint