Coordinated inauthentic behavior

Meta introduced "coordinated inauthentic behavior" as an enforcement category in 2018 and describes it as coordinated efforts to manipulate public debate for a strategic goal in which fake accounts are central to the operation. Other platforms use different labels for similar violations, such as platform manipulation, but the phrase has spread beyond its origin and is now widely used by researchers and journalists.

Two features define it. The behavior is coordinated, meaning multiple accounts act together on a plan. And it is inauthentic, meaning the actors misrepresent their identity, location or purpose. The content itself may be true or false, popular or obscure. Enforcement targets the deception about who is speaking, not the viewpoint.

Platform investigators and outside researchers look for behavioral signatures rather than judging posts one at a time. Typical signals include groups of accounts created close together, shared profile images or reused biographies, synchronized posting times, identical or lightly rewritten text, links to the same set of domains, and connections to the same infrastructure, such as common hosting or advertising accounts.

Network analysis then maps who amplifies whom. A real conversation tends to have an uneven, organic shape with many independent participants. A coordinated network often shows dense mutual amplification among a small set of accounts and few genuine interactions from outside it.

Public reporting from platforms and independent research groups is one input. Another is direct analysis of the open-web and social data itself, which is where OSINT methods come in.

Platform transparency reports periodically describe networks removed for this behavior, such as clusters of fake personas posing as local news outlets or as citizens of a country they are not in. The operators can be governments, commercial firms or private groups. Because attribution claims vary in strength, careful reporting distinguishes what was observed from who is alleged to be responsible.

Organizations get pulled into these networks as targets, as unwitting amplifiers, or through impersonation of their brand or executives. A team needs to know whether the accounts driving a story are independent. If a claim about your company is being carried mostly by a coordinated cluster, that changes the risk assessment and the escalation path, from a communications problem to one that may involve the platform, legal counsel or security.

It also matters for measurement. Volume, reach and engagement figures that include inauthentic accounts overstate real attention.

CIB is not the same as misinformation. A network can spread accurate content and still qualify, and false content spread by real, uncoordinated people does not. The related concept of an information operation is broader and may include open, attributed activity.

Nor is every fake account part of a coordinated network. Isolated spam or a single sockpuppet is a different, smaller problem. And having many accounts share a talking point is not proof of coordination on its own, since real communities repeat slogans too. Analysts look for corroborating behavioral evidence before concluding.