Investigating disinformation focuses on behavior and provenance — how a campaign operates and who is behind it — rather than adjudicating the truth of every individual post.
Step 1 — Scope carefully
Define the narrative, accounts, or event you are investigating. Avoid amplifying the very content you study; work from archives where possible.
Step 2 — Collect and preserve
Gather posts, accounts, and links, and archive them immediately. Record creation dates, handles, and cross-posting patterns.
Step 3 — Look for coordination
Signals of coordinated inauthentic behavior include synchronized posting, reused assets, accounts created together, and identical text across many accounts.
Step 4 — Map the network
Use graph analysis (for example, with Gephi) to visualize connections between accounts, domains, and content and to surface clusters.
Step 5 — Establish provenance
Trace infrastructure — shared domains, registration details, and reposting chains — to understand origin, while respecting privacy and legal limits.
Step 6 — Report responsibly
Distinguish verified facts from analysis. Explain your method so others can reproduce it. Consider the impact on named individuals.
Common mistakes
- Labeling ordinary disagreement as a "bot"
- Amplifying the campaign while reporting on it
- Overclaiming attribution without strong evidence