Coordinated Inauthentic Behavior

Coordinated inauthentic behavior (CIB) describes organized efforts by networks of accounts to mislead people about who is behind a campaign and what they are doing. The term was popularized by major social-media platforms to describe the influence operations they act against, and it has become a standard concept in information integrity research.

The three defining signals

CIB is present when three characteristics appear together:

• Coordination — accounts act in concert, often on a schedule or from shared infrastructure.
• Inauthenticity — accounts misrepresent their identity, location, or purpose.
• Deception — the operation conceals its true origin or sponsor.

Any one of these alone is not CIB. Real communities coordinate; anonymous accounts are not inherently deceptive. It is the combination that matters.

Why it matters in elections

CIB can amplify narratives, manufacture the appearance of grassroots support, and drown out authentic debate. Because it targets the information environment rather than the vote count directly, it is investigated through network analysis, metadata, and timeline reconstruction — examining behaviour across many accounts rather than judging the content of any single post. See investigating disinformation campaigns for the method.

Related concepts

CIB is frequently built from bot networks and manual sock puppets, and it is a common engine of astroturfing. For the broader OSINT vocabulary around fake accounts and attribution, see the OSINTGuide glossary.