Verify the claim and investigate its spread as two separate questions. Check the underlying evidence to determine whether the claim is accurate, false, misleading, or unverified; then look for corroborated patterns linking the accounts that spread it. A post’s popularity, repeated wording, or synchronized burst can justify closer scrutiny, but none proves coordination or deceptive intent on its own.
What does “coordinated disinformation” mean in an investigation?
The phrase combines several judgments that should not be collapsed into one. A claim can be false without evidence that its spread was coordinated. Accounts can coordinate to share a true claim, while a misleading post can spread widely through ordinary sharing. To assess a particular case, distinguish the claim’s accuracy, the behavior of the accounts spreading it, and the evidence—if any—about who controls them or why.
EU DisinfoLab’s updated Coordinated Inauthentic Behaviour detection tree (8 August 2024) treats coordination, source, impact, and authenticity as connected but separate dimensions. Its approach also cautions that diagnosis takes evidence over time. Definitions of coordinated inauthentic behavior vary by platform, so use a clear, evidence-based description of the behavior you observed rather than assuming one universal definition.
How should you investigate a viral claim?
1. Preserve the post and define the claim
Before a post is deleted or edited, record its exact wording, URL or post identifier, account name, platform, timestamp and timezone. Save the attached image, video, document, or quote, and note the surrounding context. Separate checkable factual assertions from opinion, prediction, and calls to action. If a post makes several factual claims, assess them individually rather than giving the entire post one broad verdict.
Recommended Free Tools
#1 Best Overall
2. Trace its evidence to the original source
Follow the post’s citations and links. Look for the underlying record, full statement, dataset, complete video, or named institution, and check whether it supports the claim as presented. A link to a credible source is not enough if the linked material says something different or is missing important context. CISA’s Disinformation Stops With You (PDF dated 17 August 2020) advises checking whether an article’s sources support its story and comparing coverage from other legitimate outlets. CISA identifies some materials on its website as archived or outdated, so treat this as public-awareness guidance rather than a statement of current agency policy.
3. Seek independent corroboration
Search the exact wording and distinctive phrases. Compare reporting from reputable outlets with coverage by established fact-checkers, and look for independent evidence that supports or contradicts the claim. Several posts or articles repeating the same original source are not several independent confirmations. EEAS guidance recommends checking whether others have reported the story and whether independent fact-checkers have debunked it.
Rank #2
4. Check the origin and context of media
For a photo, use reverse image search to look for earlier appearances, then compare the image’s date, location, and event with the viral caption. For video or audio, seek a full-length version, inspect edits and context, and check whether other sources corroborate what it depicts. CISA’s Tools of Disinformation: Inauthentic Content describes “cheapfakes”—genuine clips that may be sped up, slowed down, or taken out of context—and fabricated media such as deepfakes. A reverse search that finds no match does not authenticate an image or recording.
5. Define the group before assessing coordination
State which accounts, pages, sources, or posts you are examining and why they belong in the same set. Use comparable public evidence, such as posts about the same claim during a defined period. Keep records of the observations and their timestamps. Without a bounded group and a basis for comparison, it is easy to mistake a few conspicuous posts for a connected network.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
Rank #3
6. Compare timing, content, and connections
Look for multiple indicators, not just one. EU DisinfoLab’s 2021 first-branch guidance identifies synchronized activity and similar material as possible coordination signals while warning that ordinary online coordination is common. Its 2021 second-branch guidance discusses source assessment and content similarity. EEAS’s OSINT Guidelines (November 2024) includes shared technical configurations and centralized content production among stronger indicators of coordination.
- Timing: Did accounts post unusually close together, or show repeated synchronized behavior beyond what the event or a shared announcement might explain?
- Content: Are posts identical or unusually similar, including distinctive wording, errors, images, or link choices? Common slogans or copied public statements can also arise through ordinary sharing.
- Account behavior: Did several accounts change profiles or begin posting in a similar way at about the same time? Treat this as a lead, not proof of common control.
- Connections: Is there evidence linking accounts, sources, infrastructure, or content production? A meaningful connection is stronger than a resemblance between posts.
For each observation, record what you saw and what alternative explanations remain. Similarity and timing can prompt further investigation; they do not establish that accounts are inauthentic or that a campaign is deceptive.
7. Assess source, authenticity, and impact
Ask who appears to control the relevant sources, whether account identities and histories make sense, what evidence connects accounts, and how widely the content actually spread. Distinguish documented connections from assumptions based on names, political viewpoints, or repeated content. Impact is a separate question from coordination: a coordinated pattern does not by itself show that the content reached many people or changed anyone’s views.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.How do you report what the evidence shows?
Keep the conclusion calibrated to the evidence. Separate what you verified about the claim from what you observed about its circulation. State the indicators that support a coordination hypothesis, any counter-evidence or ordinary explanations, and what remains unknown. Attribute a campaign to a state, organization, or individual only if evidence supports that attribution; coordinated-looking activity alone does not establish a sponsor or intent.
Do these 3 things before closing this tab:
1Scan for outdated or missing drivers - takes under a minute2Repair Windows errors before they cause bigger problems3Fix the driver behind crashes, sound loss and screen glitches| Question | What a finding can establish | What it does not establish by itself |
|---|---|---|
| Is the claim accurate? | Whether primary evidence and independent corroboration support, contradict, or fail to resolve the specific factual assertion. | Whether the spread was coordinated or who caused it. |
| Is there coordination? | Whether multiple accounts show a pattern of linked or synchronized behavior, supported by comparable evidence. | That the accounts are inauthentic, that their content is false, or that they share a deceptive purpose. |
| Are sources or accounts inauthentic? | Whether available evidence supports concerns about identity, control, or authenticity. | Who sponsored the activity or why, unless separate evidence establishes that. |
| What was the impact? | What evidence shows about the content’s reach or effects. | Whether coordination or disinformation caused those effects. |
Useful verdicts may be mixed: for example, the factual claim could be false while coordination remains unproven, or coordination could be supported while the claim itself is accurate. The conclusion should reflect those distinctions rather than force a single label onto every part of the case.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
