Describe the observed behavior first
Start with what can be checked: which accounts published, what content was repeated, when it appeared and which sources were shared. Keep the claim about behavior separate from an explanation of why it occurred.
Use the same evidence questions when you compare narrative intelligence tools, including how each service handles competing explanations and uncertain attribution.
Record the collection window and source boundaries. A pattern visible in a narrow sample can look different when ordinary campaign activity or news syndication is included.
Look for converging evidence
| Evidence type | Question | Alternative to consider |
|---|---|---|
| Timing | Does a pattern recur across several events? | Shared response to a public announcement |
| Text or media | Are unusual elements repeated consistently? | Quotation, templates or syndicated content |
| Relationships | What links the participating accounts? | Public affiliation or a real community |
| Behavior over time | Is the pattern sustained and selective? | Ordinary organized advocacy |
Test a plausible competing explanation
If the hypothesis is a directed amplification effort, ask what observations would also be expected from a genuine community reacting to an event. Look for evidence that helps distinguish the explanations rather than only collecting examples that fit the first theory.
Keep contrary observations in the working file. For example, varied discussion, disagreement within the group or an openly published campaign call may change how the activity should be described.
Use a shared vocabulary carefully
The DISARM Red Framework provides a common language for documenting influence-operation behaviors. It can help teams describe observations consistently; assigning a label does not independently prove the underlying allegation. Framework reference ↗
Choose the narrowest description the evidence supports. Explain whether a behavior was directly observed, inferred from a pattern or remains a hypothesis.
Separate the findings in the report
One finding can concern observable synchronization; another can assess whether identities are authentic; a third can address possible direction or sponsorship. Give each its own supporting evidence, confidence and unresolved questions.
This separation makes the report more useful to decision-makers. It also prevents an uncertain attribution from obscuring a well-documented public pattern that still merits attention.
Questions for the brief
Does identical wording across many accounts prove a bot network?
No. It can result from copied text, a public campaign template, quotation or other activity. Test behavior and identity evidence together, and report what the available record actually establishes.
Can an openly organized campaign still be coordinated?
Yes. Coordination describes a relationship between actions; it does not automatically imply deception or wrongdoing. The report should identify whether the activity is transparent, authentic and relevant to the approved question.
How should I write a conclusion if coordination is plausible but the directing actor is unknown?
State the observed pattern and the support for coordination, then leave direction or sponsorship unresolved. Explain what further evidence would be needed for a stronger attribution.