Coordinated inauthentic behavior

How it works

“Coordinated inauthentic behavior” is a clunky phrase Facebook started using in 2018, and it is worth learning because it is precise. Take it apart.

Inauthentic means the accounts lie about who they are: a Russian office posing as Texans, a party’s staff posing as independent “local news”, a company posing as concerned customers. Coordinated means they work together while pretending not to: the same content, the same minute, the same targets, from accounts that claim to be strangers. Together, it is the digital version of hiring fifty people to stand in a square in different hats and all shout the same slogan “spontaneously”.

The important part is what CIB is not about: the opinion. Platforms, at least on paper, remove these networks whatever they argue, for a government or against it, for a vaccine or against it. Meta’s threat reports have listed takedowns of networks linked to Russia, Iran, China, people associated with the US military, political parties in dozens of countries and plain commercial PR firms. The violation is the deception about identity and scale, because that deception is what makes the content work. You weigh “the ministry says” very differently from “local news in fifty towns says”.

Why does this matter to you? Because “coordinated” and “inauthentic” are the two questions that cut through almost every spread technique on this site. Bots are automated inauthenticity. Troll farms are paid inauthenticity. Astroturfing is inauthentic grassroots. Sockpuppets are one-person inauthenticity. Ask “are these accounts who they say they are, and are they really acting alone?” and most of the magic disappears.

The EU’s Code of Practice on Disinformation, signed by the big platforms, commits them to report on exactly these networks. The reports are public, dull and worth skimming once.

Example

Three “local news” pages, three towns, one minute:

@szeged_today_news, 9h Finally a candidate who says the hospital crisis out loud. The government has ignored us for years. Read and share.

@debrecen_daily_hu, 9h Finally a candidate who says the hospital crisis out loud. The government has ignored us for years. Read and share.

@miskolc_voice, 9h Finally a candidate who says the hospital crisis out loud. The goverment has ignored us for years. Read and share.

@gabor.l, 7h Page transparency on all three: created the same week, admins in one city, and it isn’t any of the towns in the names. The “local news” is one agency.

The hospital problem may be real. The three towns’ “independent voices” are not, and the shared typo gives it away.

Why it works on you

• Many sources feel like verification. Hearing something from three places is how you normally check a story. The network fakes the three places.
• Local feels honest. “Your town’s news” carries a trust that a party’s own page never would, so the party borrows the costume. See authority bias.
• You judge the message, not the messenger. Which is reasonable, right up until the messenger is the message.

What to do

When a page seems off: open its transparency section (most platforms have one). Creation date, name changes, admin countries, whether it runs ads and who pays for them. Then check whether its “exclusive” content exists anywhere else, and who posted it first.

When you catch yourself trusting a chorus: ask whether these voices would say the same thing on a different day about a different topic. Real local pages are mostly potholes and lost dogs.

In a comment section: keep the point narrow. “I’m not debating the hospital, I’m pointing out these three pages share an admin” is hard to argue with and easy to check.

Don’t confuse it with

• Open coordination. A party asking its supporters to share a post is a campaign. The supporters are who they say they are.
• People agreeing. Thousands of real accounts saying the same thing after a scandal is public opinion, not CIB. Look for fake identities, not for agreement.
• Cloned news sites are one specific tool often used inside such networks. See cloned news sites.