Investigating disinformation is less about fact-checking individual posts and more about understanding behaviour and provenance — how a campaign operates and who is behind it. This methodology focuses on coordinated inauthentic behaviour rather than adjudicating the truth of every claim, and it treats not amplifying the campaign as a core requirement, not an afterthought.
It assumes familiarity with the concepts in information integrity and pairs naturally with investigating political advertising.
Step 1 — Scope carefully
Define the narrative, accounts, or event under investigation before you touch anything. A tight scope keeps the work tractable and reduces the risk of amplification. Decide in advance what would count as evidence of coordination.
Step 2 — Collect and preserve
Gather posts, accounts, and links, and archive them immediately — influence operations are frequently taken down. Record account creation dates, handles, cross-posting patterns, and shared domains. Prefer archived copies to live links so your research does not drive traffic to the content.
Step 3 — Look for coordination signals
No single account tells you much. Patterns across many accounts do:
- Synchronised posting at machine-like intervals or identical timestamps.
- Reused assets — the same images, phrasing, or hashtags.
- Batch-created accounts registered in the same short window.
- Shared infrastructure — common link shorteners, domains, or hosting.
These are the hallmarks of bot networks and astroturfing.
Step 4 — Map the network
Use graph analysis to visualise connections between accounts, domains, and content and to surface clusters. Tools such as those in OSINTGuide's general-frameworks category help reveal the structure that individual posts hide. Look for tightly interconnected clusters, bridge accounts, and content that flows in one direction.
Step 5 — Establish provenance
Trace infrastructure — shared domains, registration details, reposting chains — to understand origin, always within legal limits and with respect for privacy. Distinguish clearly between what the evidence shows (coordination) and what it merely suggests (who is responsible).
Step 6 — Report responsibly
- Separate verified facts from analysis in your write-up.
- Explain your method so others can reproduce it.
- Weigh the impact on named individuals, and avoid exposing bystanders.
- Do not overclaim attribution on public evidence alone.
Organisations such as the Digital Forensic Research Lab and Bellingcat model this transparent, reproducible approach.
Common mistakes
- Labelling ordinary disagreement or organic communities as "bots."
- Amplifying the campaign while reporting on it.
- Jumping from coordination to attribution without proportionate evidence.
Key takeaways
- Investigate behaviour and provenance, not the truth of each post.
- Coordination is observable; attribution usually is not.
- Work from archives to avoid amplification.
- Publish a reproducible method and disclose uncertainty.
Next steps
Ground your terminology with the Information Disorder report, and see how synthetic media factors in via AI and Elections.
Frequently asked questions
How do you prove a disinformation campaign is coordinated?
Coordination is shown through behavioural evidence — synchronised posting times, reused images and text, accounts created in the same window, and shared infrastructure — visualised with network analysis. Coordination is observable; attribution to a specific actor usually is not, and the two should be reported separately.
How do I investigate disinformation without amplifying it?
Work from archived copies rather than live posts, avoid quote-tweeting or embedding the original content, aggregate rather than spotlight individual accounts, and delay publication until you can add context. The goal is to explain the operation, not extend its reach.
What is the difference between coordination and attribution?
Coordination describes accounts acting together in an inauthentic way, which public evidence can often demonstrate. Attribution names who is behind it, which usually requires non-public evidence. Overclaiming attribution on public data alone is a common and damaging error.