About This Field Guide
Experienced trust-desk analysts develop, through extended practice, an intuitive sense of when something looks off. The challenge with intuition is that it is difficult to transfer, hard to audit, and inconsistent under cognitive load. This field guide attempts to make some of that accumulated knowledge explicit: not as a checklist that replaces analyst judgment, but as a structured vocabulary for what experienced analysts are actually looking for when they assess whether content is spreading organically or being artificially amplified.
The eleven signals below are not equally reliable individually. Their value comes from combination. When several align on the same story, the confidence that artificial amplification is occurring rises substantially. When they conflict, that conflict itself carries information: either the campaign is unusually sophisticated, or what looks suspicious has a legitimate explanation worth investigating.
Signals in Account Behaviour
1. Posting Cadence Regularity
Genuine human posting behaviour is irregular. People post when something prompts them: a news event, a thought, a reaction to something they read. The gaps between posts follow a roughly random distribution. Accounts operated as part of a coordinated network often show statistically improbable regularity: posts at near-identical time intervals, activity concentrated in narrow daily windows, or bursts of posting that start and stop with mechanical precision. The signal is not high frequency per se; it is the pattern of that frequency relative to what individual human behaviour produces.
2. Account Creation Date Clustering
When multiple accounts amplifying the same story were created within a narrow time window, particularly if that window is recent relative to the story, the cluster warrants scrutiny. Account creation dates are not individually meaningful: many new accounts are legitimate. What matters is whether the accounts amplifying a specific piece of content disproportionately share creation dates from the same narrow period. A story being amplified by twenty accounts, fifteen of which were created within the same six-week window three months ago, is exhibiting a structural anomaly.
3. Follower-to-Engagement Ratio Anomalies
Authentic accounts tend to receive engagement (replies, retweets, likes) at rates that correspond roughly to their follower base. Coordinated accounts often show engagement patterns that do not fit this relationship: accounts with few followers but disproportionate engagement from a specific cluster of other accounts, or accounts with substantial follower counts but almost no genuine engagement outside of mutual interactions within a small cluster. Both patterns suggest that the engagement profile has been shaped by coordinated action rather than reflecting genuine audience interest.
4. Cross-Account Interaction Density
Accounts within coordinated networks tend to interact with each other at rates that are statistically anomalous for their stated interests and follower profiles. If twenty accounts amplifying a story about consumer product safety all follow each other and consistently engage with each other's content across a range of topics, the interaction density within this cluster is a strong signal. Independent accounts sharing an interest in a topic will interact with a wide range of other accounts in that space; a closed cluster that primarily reinforces itself is a structural anomaly.
Signals in Content Characteristics
5. Argument Structure Template Similarity
Content from coordinated campaigns frequently shares an underlying argument template even where surface vocabulary varies. The same claim sequence, the same rhetorical structure, the same call to action expressed in different words across multiple accounts: this structural similarity is harder to detect than exact phrase matching but is a reliable indicator of centralised authorship. Analysts reading many posts from different accounts should ask: does the underlying logic follow the same steps in every case, even where the specific words differ?
6. Unusual Specificity in Vague Stories
Manufactured content often contains specific details that lend apparent credibility to claims that are otherwise unverifiable. Exact dates, precise percentages, named but unverifiable sources, and specific regulatory reference numbers attached to claims that do not match the actual regulation: these signals suggest that the content was constructed to appear credible rather than emerging from genuine reporting or firsthand experience. Genuine organic content about a product failure or regulatory concern will typically lack this specific-but-unverifiable quality.
7. Cross-Language Template Consistency
For campaigns operating across multiple language communities, translated content frequently retains the argument structure of the source material even where the surface vocabulary is appropriate for the target language. Native speakers of the target language will often notice that the register or argument framing feels slightly imported. Comparing the logical structure of multilingual content about the same topic, rather than the specific language, can reveal common authorship across what appears to be independent reporting in different regions.
Signals in Spread Dynamics
8. Burst-Seeding Spread Pattern
Organic content spreads along social graphs in a branching cascade: early adopters share with their followers, some of whom share with their followers, and so on. The spread pattern is uneven and roughly follows the relationship structure of the network. Coordinated content is frequently seeded simultaneously at multiple points in the network, creating a spread pattern with multiple simultaneous origin points rather than a single branching cascade. Analysing the earliest amplification points for a story to see whether they are structurally connected (which suggests organic sharing) or structurally independent (which suggests simultaneous seeding) distinguishes these patterns.
9. Platform Velocity Mismatch
Stories spreading through coordinated amplification often achieve a velocity that is implausible for their starting account characteristics. A story generating thousands of engagements within an hour, originating from an account with minimal genuine following, has spread faster than the network topology of that account's followers could produce organically. The mismatch between starting-point network reach and achieved spread velocity is a velocity anomaly signal. It does not prove coordination on its own, but it indicates that amplification beyond the natural reach of the origin account has occurred.
10. Amplification Without Engagement
Coordinated amplification frequently shows a pattern of reposting without substantive engagement. Content being amplified by a coordinated network tends to be reshared at high volume with very limited original commentary, questions, or responses of the kind that genuine human engagement produces. A story that has been retweeted or reshared thousands of times but generates very few replies, questions, or substantive responses is exhibiting an amplification pattern that does not match what organic human interest looks like. Genuine resonant content generates conversation, not just reposting.
Signal Eleven: The Overall Pattern
11. Signal Convergence
No single signal from this list warrants high confidence in a coordinated behaviour conclusion. What warrants high confidence is the convergence of multiple signals pointing in the same direction. A story where the amplifying accounts show creation date clustering, cross-account interaction density, template similarity in their content, and a burst-seeding spread pattern simultaneously is exhibiting the kind of multi-signal convergence that experienced analysts recognise as the overall gestalt of coordinated behaviour.
Conversely, a story where one or two signals are present but the others are absent, or where some signals are present and others actively contradict a coordinated behaviour hypothesis, should be treated with more caution. Reaching for a coordinated explanation when the signals are ambiguous carries the same risk as missing genuine coordination: it produces misclassification with real consequences.
The field guide exists to make the analytical framework explicit. It does not replace the judgment that comes from extended practice with these signals in your specific monitoring context. What it provides is a shared vocabulary that makes analyst decisions more consistent, more auditable, and easier to communicate to stakeholders who need to understand why a particular story was escalated or cleared.