S.M.M.

Stop Manipulating Me · A Field Guide to Psychological Influence

ENTRY No. T25.28
CATEGORY Advanced Influence
CLEARANCE Public / Essential
EDITION 01
Dossier · Manipulation Tactic

Coordinated Inauthentic Behavior

Information Operation · Inauthentic Networks · Widespread Online
High Alert
How It WorksSEC 01

Coordinated inauthentic behavior (CIB) is the use of networks of fake or inauthentic accounts, acting in concert, to simulate organic public activity — making a message, candidate, product, or narrative appear far more popular and widely supported than it is. The term, adopted by major platforms and analyzed by researchers such as Renée DiResta and the Stanford Internet Observatory, names the operational layer beneath manufactured consensus: the machinery of sock-puppets and automation that fabricates the appearance of a public in order to bend the opinion of the real one.

CIB is powerful because it exploits social proof at scale. People reasonably treat apparent consensus as information — if everyone seems to believe something, it is probably worth taking seriously — so a fabricated majority recruits genuine participants who, seeing the artificial signal, adopt and spread it themselves. This laundering of manufactured opinion into authentic belief is the operation’s real payoff. Because it is defined by coordination, however, CIB leaves detectable signatures: synchronized posting windows, clusters of new or empty accounts, shared images and near-identical phrasing across supposedly independent voices, and online volume wildly out of proportion to any verifiable real-world footprint.

The defense is to weight coordinated and inauthentic voices near zero and to refuse to let apparent volume drive assessment. Looking for coordination signatures — timing, shared assets, copied wording — distinguishes orchestration from genuine agreement; checking account authenticity discounts the amplifier network; and comparing online intensity to a verifiable offline footprint exposes the mismatch that fabrication produces. Reporting suspected networks to the platform and consciously declining to update your beliefs on the strength of manufactured consensus closes the loop the operation is built to exploit. This entry catalogs detection indicators only, not any means of building or operating such a network.

Warning SignsSEC 02
  • Synchronized posting. Many accounts pushing the same message in the same window, faster than organic spread.
  • New or empty accounts. Amplifiers with little history, generic profiles, or stock/AI-generated profile images.
  • Shared assets and phrasing. Identical images, links, hashtags, or near-copied wording across supposedly independent voices.
  • Volume out of proportion to reality. An issue appears overwhelmingly popular online but has little footprint anywhere verifiable.
Frequently Paired WithSEC 03
  • Manufactured Consensus · T25.15
    The goal CIB is built to produce
  • Sockpuppets · T12.13
    The individual fake-identity building block
  • Perception Management · T25.25
    CIB as the machinery of coordinated messaging
How the Operation Is RecognizedSEC 04
  • Stage 01 · Build the network
    A pool of fake or co-opted accounts is created or acquired, seeded with just enough history to appear real.
  • Stage 02 · Coordinate
    The accounts post, amplify, and reply in concert to make a message look organically popular.
  • Stage 03 · Recruit the real
    Genuine users, seeing apparent consensus, join in — laundering the manufactured signal into real belief.
Counter-ProtocolSEC 05
Defense: Discount coordinated voices and check for authenticity signals.
  • Look for coordination signatures. Synchronized timing, shared assets, and near-identical phrasing across accounts indicate orchestration, not agreement.
  • Check account authenticity. New, empty, or generic accounts amplifying a message should be weighted near zero.
  • Seek the offline footprint. Compare online intensity to verifiable real-world presence; a mismatch signals fabrication.
  • Report and disengage. Use platform reporting for suspected networks and refuse to let apparent volume change your assessment.