Disinformation Intelligence (DISINFOINT): Intelligence Discipline Guide

The finding is rarely that a claim is false. It is that a set of accounts, sites and outlets behaved in a way that authentic actors do not, at a time that authentic behaviour does not explain.

What Disinformation Intelligence is as a discipline

Disinformation intelligence is the study of manipulated information environments: identifying false or misleading content, characterising the behaviour that distributes it, and attributing the operation where evidence supports it. The discipline deliberately separates three questions that are usually collapsed into one: is the content false, is the distribution inauthentic, and who is behind it. Practitioners work behaviour and infrastructure first, because falsity alone is common and lawful, while coordinated inauthentic behaviour is observable, describable and considerably harder to fake.

Sub-methods include content verification through reverse image search, media forensics and provenance checks, narrative tracking across languages and platforms, coordination detection using timing and content similarity, infrastructure analysis of the sites and domains behind a campaign, and effect assessment that distinguishes reach from actual persuasion. In the cycle it fuses social media, news and technical disciplines, producing both incident reporting and longitudinal tracking of persistent campaigns.

Why it matters

Disinformation intelligence answers whether what looks like public opinion is manufactured, how a false claim entered mainstream coverage and through which intermediaries, and whether an operation is targeting your organisation, staff, customers or market. It also answers the defensive question that matters most in practice: which narratives are actually gaining traction, and what a proportionate response looks like given that response itself amplifies.

What analysts actually look for

These are the concrete, observable signals that carry weight in this area of work:

• Synchronised posting inside narrow time windows across accounts with no plausible organic connection.
• Identical or near-identical wording and media reused across accounts, sites and translated languages.
• Newly registered domains sharing hosting, analytics identifiers or templates across supposedly independent outlets.
• Laundering chains where a claim moves from an anonymous origin through a fringe site into mainstream citation.
• Media forensic indicators: recycled stock imagery, edited frames, synthetic media artefacts and inconsistent metadata.
• Sockpuppet indicators including creation-date clustering, thin posting history and generated profile imagery.
• Targeting patterns focused on specific journalists, officials, companies, regulators or minority communities rather than broad audiences.
• Platform enforcement actions and transparency reporting confirming takedowns of the same network.

Where the data comes from

Authoritative and openly available collection points. Always confirm licensing and terms before operational or commercial use:

• EUvsDisinfo database — Catalogued pro-Kremlin disinformation cases with narratives, outlets, dates and debunks
• EU DSA Transparency Database — Platform moderation decisions at scale, useful for detecting enforcement waves against networks
• Platform adversarial threat reports — Published investigations into coordinated inauthentic behaviour with indicators and methodology
• GDELT Project — Cross-language media event and tone data for tracking how a narrative propagates through outlets
• Observatory on Social Media (OSoMe) tools — Academic tools for diffusion visualisation and coordination analysis on public social data
• InVID-WeVerify plugin — Open verification toolkit for reverse image search, video keyframes and metadata inspection
• Internet Archive Wayback Machine — Captures of articles and posts that were quietly edited, retracted or removed
• RDAP, DNS and Certificate Transparency — Registration dates, hosting and certificate patterns linking front sites to shared infrastructure

A working method

A repeatable sequence beats ad-hoc searching. This is a practical starting workflow:

1. Define the target and window — Specify the narrative, entity or event under study, the languages and platforms in scope, and the period of interest.
2. Capture and archive — Preserve content with metadata, timestamps and hashes immediately, because operations delete and edit aggressively once noticed.
3. Verify the content claim — Establish independently whether the underlying claim is false, misleading or simply contested, and record which it is.
4. Analyse distribution — Examine posting timing, sequence and network structure to test whether spread is organic, amplified or coordinated.
5. Map the infrastructure — Trace domains, registration dates, hosting, analytics identifiers and publishing templates connecting outlets that present themselves as independent.
6. Attribute conservatively — Tier your conclusions from observed behaviour, through infrastructure linkage, to actor attribution, and stop where evidence stops.
7. Report in three layers — Publish content, behaviour and actor findings separately, so a challenge to one does not collapse the entire assessment.

How this connects across the intelligence taxonomy

Intelligence work does not respect neat boundaries. The mission domain you are working, the disciplines you practise, and the data points you pivot on are one connected system. These are the direct relationships for this entry — every link is also a tag, so you can follow any thread across the whole library.

Applied in these mission domains

• Nation State
• Emerging Technology & AI Security
• Extremism & Radicalization
• Transnational Repression
• Election Security & PSYOP
• Disinformation / IO

Operates on these data points

• Event / Incident — A discrete real-world occurrence — protest, strike, breach, seizure — with time, place, and actors.
• Keyword / Narrative — A search term, topic, hashtag, or narrative tracked across media and platforms.
• Social Profile — A social media profile or online account page tied to a persona or identity.
• Domain Name — Human-readable address that maps to IP infrastructure via DNS.
• Username / Handle — Screen name or handle used across online platforms and services.
• Messaging Handle — An identity on a messaging platform (Telegram, Signal, Discord) used for coordination and sales.
• Video — A video file or stream — the core artifact for incident verification and chronolocation.
• Image / Photograph — A still image — carries EXIF metadata and is the primary artifact for visual verification.
• Person / Name — A named individual — the subject of identity resolution and profiling.
• URL — Uniform Resource Locator pointing to a web resource.

Related disciplines

• News Intelligence — Media Reporting as an Intelligence Source

Inside the platform: where Disinformation Intelligence lives

The Quantus platform is 204 pages behind a 147-item sidebar organised into six working groups: Command (24 items), Dashboards (15), Threat Theaters (14), Intelligence Domains (15), Investigate (34), and Administration (45). This entry is not a page in isolation — it is a thread running through several of them.

The modules that matter most here:

• discipline.php?d=DISINFOINT — Discipline hub
• source-catalog.php?disc=DISINFOINT — Source catalogue filtered to this discipline
• url-profile.php — Domain Name profile
• search.php — Advanced search, filter and pivot
• correlate.php — Correlation graph
• cases.php — Case management

Each dashboard is local-first: it renders from the platform’s own database rather than depending on a live third-party call, so it still works when an upstream API is unreachable or rate-limited. Heavy aggregates are cached with a hard query time cap and degrade to the last good value instead of hanging the page.

Automation, playbooks and AI skills

Analysis that only happens when someone remembers to run it is not a capability. The platform ships a 30-step automation pipeline (cron.php) that collects, ingests, resolves, enriches, correlates and scores on a schedule — 25 seeders, 11 resolvers and 7 enrichment runners, all idempotent and cursor-based so a run can be interrupted and resumed without duplicating or losing work.

AI skills that apply

The 16 one-click operations in ai-skills.php are deterministic jobs, not free-text generation. The ones that matter here:

• Threat Hunt
• Auto-Collect Feeds
• Enrichment → Local
• Summarise (Copilot)
• Generate Report

Alerting closes the loop: rules in alerts.php fire on new indicators matching a saved query, so a first sighting in this area raises a notification rather than waiting to be noticed at the next review.

Feeds, data sources and the API

The collection layer runs a feed registry of free, machine-readable sources — bulk blocklists and trackers (Maltrail, IPsum, FireHOL, the full abuse.ch corpora, phishing databases, Emerging Threats, Spamhaus, DigitalSide, ThreatView), authoritative government feeds (CISA KEV, OFAC, UN and EU sanctions lists), and reference datasets (RIR allocations, ip-to-ASN and geolocation tables, MITRE ATT&CK, EPSS). collect.php pulls them server-side on a schedule; feeds.php and source-catalog.php show what is registered, what it covers and when it last ran.

Anything the platform holds is reachable programmatically. The REST API in api.php exposes 11 endpoints — status, stats, search, lookup, recent, export, bulk_check, top_threats, by_category, categories, check — and export.php streams 18 formats in bounded chunks, so a million-row export neither exhausts memory nor times out:

STIX 2.1, MISP, OpenIOC 1.1, CEF (ArcSight), LEEF 2.0 (QRadar), Zeek/Bro intel, Snort/Suricata rules, Palo Alto EDL, BIND RPZ, hosts blackhole, iptables, CSV, JSON, NDJSON/JSONL, XML.

That covers the CTI standards (STIX 2.1, MISP, OpenIOC), SIEM ingestion (CEF, LEEF, Zeek), detection engines (Snort/Suricata), and direct enforcement (Palo Alto EDL, BIND RPZ, hosts, iptables) — so intelligence developed here can be actioned in the tools you already run, without a manual reformatting step. A TAXII 2.1 server and a MISP/RSS feed are also served for pull-based sharing.

Use cases

Three ways this entry earns its keep in day-to-day work:

1. Triage under time pressure. An artifact or report lands and you need a defensible read in minutes, not days. Define the target and window is the first move; the platform pre-computes the enrichment so the analyst spends the time on judgement rather than lookups.
2. Building the picture. A single indicator is rarely the story. Verify the content claim turns one artifact into a network — shared infrastructure, repeated selectors, the same operator behind different names — via the correlation graph and the cross-entity link engine.
3. Producing something actionable. Analysis that ends in a document nobody can use is wasted. Report in three layers feeds the case file, the detection rule, the block list or the referral — with sourcing attached so the recipient can verify it.

Case management (cases.php), watchlists, saved searches and scheduled reports mean the work persists between sessions and survives an analyst leaving the team.

How each sector uses Disinformation Intelligence

The same entry is worked very differently depending on who you are, what authority you hold, and what you are ultimately producing. A military analyst is supporting a commander’s decision; a journalist is meeting a publication standard; an NGO caseworker is protecting a person. The underlying artifacts are shared — the constraints, outputs and thresholds are not.

🎖 Military and defence

Defence interest is in adversary information activity affecting operations: narratives targeting force presence and legitimacy, fabricated incident claims designed to constrain freedom of action, and manipulation aimed at host-nation populations or partner forces. Analysts characterise behaviour and infrastructure, assess likely effect on the operating environment, and feed the information environment assessment and force protection reporting. Constraints are significant: analysis of speech engages fundamental rights, monitoring of domestic populations is generally prohibited, and the line between studying an information operation and conducting one is a legal and policy boundary requiring entirely separate authorities.

🕵 National intelligence

Agencies address foreign influence operations as a state behaviour problem: identifying campaigns, attributing them where evidence supports it, and assessing intent and effect. The analytic discipline separates three questions that are routinely collapsed, namely whether content is false, whether distribution is inauthentic, and who is responsible. Behaviour and infrastructure carry attribution weight; content alone almost never does. Handling is sensitive because public attribution has diplomatic consequences and because the underlying evidence often cannot be released. Products should state confidence separately for the operation, the sponsor and the effect, since these are usually known to very different degrees.

👮 Law enforcement

Law enforcement involvement arises where conduct crosses into criminal offences: fraud, impersonation, incitement to violence, harassment campaigns, foreign interference offences where they exist, or breaches of electoral law. Evidential standards require preserved originals with hashes, platform records obtained under production order or MLAT, and financial records tracing payment for amplification services. Lawful speech, however false or offensive, is generally not an offence, and investigations must be scoped to the conduct rather than the viewpoint. Overreach here carries serious civil liberties consequences and undermines the legitimacy of genuine cases.

🔍 Private investigation and corporate security

Corporate teams handle disinformation as a risk to brand, executives, market position and physical safety, including coordinated defamation, fabricated documents and short-selling narratives. Legitimate work covers monitoring public content, documenting coordination and infrastructure, preserving evidence for litigation or platform escalation, and advising on response. A private actor must not build profiles of ordinary users who shared content, must not create fake personas to infiltrate communities where prohibited, and must be careful that counter-disinformation work does not become undisclosed reputation management, which is itself a recognised harm.

📰 Journalism and OSINT media

Newsrooms both report on disinformation and are targeted by it. Verification standards require establishing whether a claim is false, whether distribution shows coordination, and whether attribution is supportable, keeping the three separate in the copy. Naming individuals as operatives carries defamation and personal safety risk and demands a documented evidentiary standard plus right of reply. Reporting also risks amplification: covering a low-reach falsehood can spread it, so the decision to report is itself an editorial judgement. Source protection matters because researchers and whistleblowers in this space face coordinated harassment.

🌍 NGO, humanitarian and human rights

Civil society organisations monitor disinformation affecting elections, public health, minority communities and humanitarian operations, and are frequently themselves the target of coordinated campaigns. Practice must be rights-respecting: study behaviour and infrastructure rather than profiling individuals expressing lawful opinions, and be alert that counter-disinformation frameworks are used in some states to suppress dissent. Do-no-harm requires protecting targeted individuals, particularly women and minority activists who face gendered and racialised abuse. Duty of care includes support for staff exposed to sustained abuse and graphic content as an occupational hazard.

🎓 University and research

Researchers study propagation, coordination detection, effect measurement and intervention efficacy. Reproducibility is constrained by narrowing platform data access, so publish collection specifications, code, sampling frames and identifiers rather than content, and use lawful research access routes. Ethics approval is required even for public data concerning identifiable individuals. Effect claims require particular rigour, since exposure is not persuasion and most published reach figures measure neither; experimental or quasi-experimental designs are needed for causal claims. Avoid research designs that themselves spread the material being studied.

Playbook: working Disinformation Intelligence end to end

A repeatable sequence, from the moment the requirement lands to the moment a product is delivered and the case is closed out. Each phase states what you are trying to establish, not merely what to click — the point is a defensible chain of reasoning, not a checklist.

Phase 1 — Separate the three questions

Before collecting, commit to answering separately whether the content is false, whether the distribution is inauthentic, and who is responsible. Collapsing them is the central failure of the discipline, because falsity is common and lawful, coordination can be organic, and attribution requires evidence that content never carries. Write down which of the three the requirement actually needs. A good output is a scoped question naming the target of analysis. Stop when the scope excludes profiling of ordinary users expressing lawful opinions.

Phase 2 — Establish the lawful and ethical frame

Confirm the legal basis for collection, the platform terms that apply, and the data protection obligations attaching to any personal data. Note where counter-disinformation activity is itself regulated or politically constrained, and where studying speech risks chilling lawful expression. Decide in advance what you will not do, including creating fake personas where prohibited and monitoring individuals rather than behaviour. A good output is a documented frame agreed before collection. Stop if the requirement cannot be met within it.

Phase 3 — Baseline the information environment

Characterise normal discourse on the topic in the relevant languages and platforms: which outlets and accounts habitually cover it, what volume and sentiment look like ordinarily, and which narratives are long-standing. Without a baseline, ordinary partisan argument reads as a campaign. A good output is a documented baseline with volume ranges and recurring themes. Stop when you can describe an unremarkable week, so anomalies later stand out against something.

Phase 4 — Verify the content claim

Where falsity is in question, verify to a documented standard: locate the original assertion and its earliest appearance, check media provenance through reverse search and metadata, test verifiable specifics such as location, time, named entities and figures against independent records, and consult subject experts where technical. Record what is false, what is misleading in context, and what is simply contested. A good output is a claim-level verification note. Stop before labelling contested interpretation as disinformation.

Phase 5 — Preserve everything early

Archive posts, accounts, articles and media immediately and to more than one location, capturing original files, identifiers, timestamps and hashes. Campaign material is deleted, edited and moderated quickly, and infrastructure is taken down. Preservation before analysis is the difference between an evidenced finding and an assertion. A good output is a preserved corpus that survives takedown. Stop when everything load-bearing exists independently of the platform and the originating site.

Phase 6 — Analyse distribution behaviour

Map how the content moved: who posted first, who amplified, in what sequence and over what period, and across which platforms. Look for evidence requiring explanation such as near-simultaneous identical posting by unrelated accounts, shared idiosyncratic artefacts, clustered account creation, and coordinated topic switching. Define edges and the time window explicitly. A good output is a propagation account with the coordination evidence itemised. Stop before treating volume as evidence of coordination.

Phase 7 — Test the mundane explanations

For every coordination indicator, address why the pattern is not simply a campaign, a fandom, a wire pickup, a news event or a scheduled publication workflow. Organic enthusiasm produces synchrony, and legitimate political organising produces coordination that is neither covert nor inauthentic. Document the alternatives you considered and why they were excluded. A good output is a finding whose alternative explanations are addressed in writing. Stop before publishing a coordination claim that has not survived this test.

Phase 8 — Work the infrastructure

Move from accounts to infrastructure: domains behind promoted sites, registration dates and registrars through RDAP, hosting and name servers, certificate issuance patterns, analytics and advertising identifiers shared across sites, and content management fingerprints. Infrastructure links are harder to fabricate than behavioural ones and often survive account takedowns. A good output is an infrastructure cluster with dated evidence per link. Stop when the cluster rests on technical artefacts rather than thematic similarity.

Phase 9 — Assess funding and amplification

Where paid amplification is involved, use advertising transparency repositories to identify advertisers, spend and creatives, and look for commercial amplification services, influencer contracting and undisclosed sponsorship. Money is often the most attributable element of an operation and the most amenable to lawful documentation. A good output is a funding picture with sourced advertiser identities and amounts where published. Stop when the paid element is documented or shown to be absent.

Phase 10 — Grade attribution honestly

Distinguish attribution of content to an account, of accounts to an operation, of an operation to an organisation, and of an organisation to a state. Each step requires separate evidence and each is progressively harder. Naming an individual carries defamation and personal safety risk requiring a documented evidentiary standard and legal review. A good output is a layered attribution statement with a confidence level at each layer. Stop at the layer the evidence supports rather than the one the audience wants.

Phase 11 — Assess effect, not reach

Distinguish exposure, engagement and actual belief or behaviour change. Reach figures are frequently inflated by bot traffic and platform metrics that count impressions, and high engagement often reflects a small, already-convinced audience. Look for downstream indicators: pickup by mainstream outlets, adoption by political figures, offline mobilisation, or measurable behaviour change. A good output is an effect assessment that states what is measurable and what is not. Stop before presenting reach as impact.

Phase 12 — Decide response with harm in mind

Weigh whether to publish at all, since reporting a low-reach falsehood can amplify it, and consider debunking design that leads with the truth rather than repeating the false claim. Consider platform escalation, notification of targeted individuals, and support for those facing coordinated abuse. Assess the safety risk to named researchers and to accused individuals. A good output is a documented response decision including the amplification assessment. Stop when the response is proportionate to the demonstrated effect.

The platform ships this as a step-checked workflow in playbooks.php, so progress is recorded against a case rather than held in someone’s head.

Source register: what to collect from, and how

Sources are listed with their access model so you can plan around cost and licensing before you build a dependency on them. Open means no account required; registration means a free account or API key; licensed means paid or institutional access. Always confirm current terms — licensing changes, and a source that was free for research may not be free for commercial or evidential use.

Source	Access	What it gives you	How it is used here
EUvsDisinfo	Open	Database of documented pro-Kremlin disinformation cases with source, date, narrative summary and disproof.	Reference corpus of previously documented narratives, preventing rediscovery and establishing narrative persistence over time.
DSA Transparency Database	Open	Statements of reasons for content moderation actions by very large online platforms serving the European Union.	Structured evidence of enforcement against specific content categories without requiring platform scraping.
Google Ads Transparency Center	Open	Searchable repository of advertisers, creatives and spend information including political and issue advertising.	Identifies paid amplification and the advertiser behind it, which is often the most attributable element of a campaign.
Meta transparency and ad library resources	Open	Advertising archives, enforcement reporting and coordinated inauthentic behaviour takedown disclosures.	Documents previously removed networks and provides advertiser records for campaigns running paid amplification.
InVID-WeVerify verification plugin	Open	Toolkit for keyframe extraction, multi-engine reverse image search, metadata inspection and image forensics filters.	First-line verification of whether media in a campaign is fabricated, recontextualised or recirculated from an older event.
GDELT Project	Open	Machine-coded global news event and tone dataset with wide language coverage and public query interfaces.	Tracks narrative propagation across outlets and languages and identifies the earliest reporting of a claim.
Media Cloud	Registration	Open platform for analysing online news content across large source collections with topic and source tools.	Measures how far a narrative penetrated mainstream media, which is a better effect indicator than platform reach.
RDAP registration data services	Open	Structured domain registration data including registrar, creation dates and status codes from registries.	Dates campaign infrastructure and links sites through registration patterns that outlast account takedowns.
Certificate transparency logs	Open	Public append-only logs of issued TLS certificates including subject hostnames and issuance timestamps.	Connects campaign domains through shared certificate provisioning and reveals hostnames not otherwise visible.
European Digital Media Observatory	Open	Network of fact-checking and research organisations publishing investigations, methodology and country-level analysis.	Prior documented findings on European campaigns and methodological guidance for detection and effect assessment.
DFRLab publications	Open	Open source investigations into information operations, coordinated inauthentic behaviour and platform manipulation.	Worked examples of the behavioural and infrastructure evidence standards required for defensible attribution.
International Fact-Checking Network signatories	Open	Directory and code of principles for fact-checking organisations, with published verification methodologies.	Locates credible local fact-checking capacity in the relevant language and provides verification standards to align with.
Internet Archive Wayback Machine (archived)	Open	Historic web snapshots including sites and pages later edited, deleted or taken down.	Preserves campaign sites and articles and evidences what a page said before it was altered or removed.
C2PA content provenance specification	Open	Open standard for cryptographically signed capture and edit provenance embedded in media files.	Where provenance data is present it strongly supports authenticity claims; absence is uninformative rather than suspicious.

Prefer sources that publish a methodology and a revision history. A dataset that changes silently is a liability in any product that has to survive challenge.

Tooling

Tools commonly used against Disinformation Intelligence. None of these replace judgement, and each carries its own failure modes — know what a tool infers versus what it observes.

• Web archiving and capture tooling — Preserves campaign sites, posts and media with timestamps and hashes before takedown. Limitation: dynamically loaded and login-gated content archives poorly, and some sites actively block archiving.
• InVID-WeVerify plugin — Extracts keyframes and runs multi-engine reverse image search with forensic filters. Limitation: forensic filters produce suggestive artefacts on compressed media that are frequently misread as manipulation.
• Network and propagation analysis software — Maps who posted, who amplified and in what sequence across a defined window. Limitation: results are extremely sensitive to the collection window and edge definition, making overstatement easy.
• Temporal synchrony detection — Surfaces near-simultaneous posting and burst patterns across account sets. Limitation: news events and shared time zones produce identical signatures, so it flags rather than establishes coordination.
• Domain and infrastructure pivot tooling — Links sites through registration, hosting, certificates and shared analytics identifiers. Limitation: shared hosting and common providers create false links unless the shared artefact is genuinely idiosyncratic.
• Advertising transparency search — Retrieves advertiser identity, spend bands and creatives for paid amplification. Limitation: definitions of political advertising and coverage vary by platform and country, leaving large blind spots.
• Synthetic media detection services — Score media for likelihood of generative or manipulative processing. Limitation: unreliable on recompressed or screen-captured files, with both false positives and false negatives common enough to preclude reliance.
• Multilingual monitoring with human review — Tracks narratives across the languages in which a campaign actually operates. Limitation: coded language, irony and dialect are precisely what matters here and are what machine translation handles worst.
• Evidence management with hashing — Maintains provenance and chain of custody for preserved campaign material. Limitation: value depends on capture discipline at collection, which degrades under time pressure during fast-moving events.

AI skills and automation in detail

These are deterministic jobs with defined inputs and outputs, not open-ended prompting. Each is idempotent and cursor-based: interrupt one and it resumes where it stopped rather than duplicating work or losing progress.

• Threat Hunt — Runs saved hypotheses against the corpus and surfaces what matches, with the query preserved as a versioned artifact.
• Auto-Collect Feeds — Pulls the registered feed set server-side on a schedule, recording per-feed status so a silently dead feed is visible.
• Enrichment → Local — Materialises enrichment into the local store so dashboards render from your own database instead of a live third-party call.
• Summarise (Copilot) — Produces a narrative summary beside the underlying records. It explains; it never creates indicators or assigns attribution.
• Generate Report — Assembles a sourced product from the current case or query, with provenance attached to each element.

A note on the boundary: the only skill that involves a language model is Summarise (Copilot), and it writes prose about records that already exist. Nothing else on this list involves generation of any kind. No indicator, relationship or attribution in the platform originates from a model. See the full skill list.

Tradecraft notes

The distinctions that separate a competent analyst from a fast one:

• Work behaviour and infrastructure before content. Falsity is common and lawful, whereas coordinated inauthentic behaviour is observable, describable and considerably harder to fake, which is why it carries the attribution weight.
• Coordination is not inauthenticity, and inauthenticity is not state sponsorship. Treating these as one question produces the false attributions that discredit the field and expose the practitioner to defamation claims.
• Reach is not effect. Impression counts are inflated by automated traffic and platform accounting, and high engagement usually reflects a small pre-convinced audience rather than persuasion of anyone new.
• Mainstream pickup is the effect indicator that matters most. A narrative that stays inside a closed community is a very different problem from one adopted by a national outlet or a senior political figure.
• Reporting can amplify. Covering a falsehood that reached almost nobody spreads it to a much larger audience, so the decision to publish is itself an intervention requiring justification.
• Preserve before analysing, always. Campaign material and infrastructure are removed faster than any other class of content, and the version you built your finding on will not be there next week.
• Avoid profiling ordinary users who merely shared something. They are not the operation, studying them engages fundamental rights, and it produces nothing analytically useful about who is responsible.
• Name individuals only against a documented evidentiary standard with legal review. Public attribution to a person carries defamation exposure and real safety consequences, and it is rarely necessary to the finding.
• Be alert that counter-disinformation frameworks are used in some states to suppress dissent. A methodology that cannot distinguish a state influence operation from an inconvenient civil society campaign is dangerous regardless of intent.

Measuring whether it is working

Capability claims should be falsifiable. These are the measures that show whether work on Disinformation Intelligence is producing anything, and they are worth baselining before you change process or tooling.

• Proportion of published findings where falsity, coordination and attribution are separately stated with individual confidence levels rather than merged into a single claim.
• Preservation completeness for investigated campaigns, measured as the share of load-bearing artefacts archived independently before takedown occurred.
• Rate at which coordination findings survive documented testing against organic explanations, and the retraction rate for those that did not.
• Median time from campaign emergence to evidenced characterisation, tracked alongside accuracy rather than speed alone.
• Effect measurement quality, tracked as the proportion of assessments citing mainstream pickup or offline indicators rather than platform reach figures.
• Number of publication decisions where amplification risk was assessed and led to withholding or reframing, recorded with reasons.
• Safety outcomes for named researchers and for individuals identified in products, tracked as harassment incidents following publication.

Beware of measuring volume alone. Indicator counts and report counts rise easily and say little; time-to-attribution, proportion of findings that survive review, and how often a product changed a decision say a great deal.

Common pitfalls

• Attributing to a state because the narrative suits its interests, which is alignment rather than evidence.
• Mistaking authentic partisan organising, fandom coordination or newsletter syndication for an inauthentic operation.
• Measuring reach and calling it influence, when exposure and persuasion are entirely different quantities.
• Amplifying the false claim by reporting it, particularly where the original reach was negligible.
• Citing automated bot-likelihood scores as fact when they are probabilistic and easily gamed.
• Framing the problem as foreign by default, and missing domestic political and commercial operators.

Legal and ethical considerations

Analysis of speech engages fundamental rights. Keep the object of study behaviour and infrastructure rather than lawful opinion, and avoid profiling ordinary users who merely shared content. Naming individuals as operatives carries defamation and personal safety risk, so hold public attribution to a documented evidentiary standard. Platform terms govern collection, data-protection law governs retention and profiling, and in some jurisdictions counter-disinformation activity by private parties is itself regulated or politically constrained.

Data integrity: no fabrication, no drift, no hallucination

Intelligence that cannot be traced back to a source is not intelligence, it is assertion. Everything in this entry — and everything in the platform behind it — is built on a small number of non-negotiable rules.

Provenance on every record

Every indicator carries the source that supplied it, a first-seen and last-seen timestamp, and a sighting count. Where several feeds report the same artifact, each contribution is recorded separately rather than collapsed, so you can see whether a finding rests on one source or twelve. Source attribution travels with the data into every export, so a recipient can audit a claim without asking you for the working.

Nothing is invented to fill a gap

If the platform has no data for Disinformation Intelligence, it says so. Empty is displayed as empty — never padded with plausible-looking placeholder values, sample records or illustrative examples that a reader might mistake for observations. A dashboard with no rows is a true statement about collection coverage, and it is treated as a gap to close, not a blemish to hide.

Scoring is deterministic and reproducible

Threat scores, reputation grades and risk tiers are computed from stated inputs with fixed weights, not estimated. The same inputs always produce the same output, and the formula is visible rather than a black box. Aggregates are cached with an explicit time-to-live so a figure on screen is never silently stale — and when a heavy query exceeds its time budget the platform serves the last known-good value and labels it, rather than inventing a fresh number or hanging.

Where AI is used, and where it is not

Language models summarise and explain. They do not create indicators, assign attribution or manufacture relationships. No IP address, wallet, hash or identity in the platform originates from a model — every one is ingested from a named feed, resolved from a reference dataset, or entered by an analyst with a source recorded. Copilot output is presented as narrative alongside the underlying records, never in place of them, so a reader can always check the summary against the evidence.

Guarding against drift

Enrichment is additive and timestamped rather than overwriting. Reference data — sanctions lists, allocations, taxonomies — is re-synchronised from the authority on a schedule instead of being edited in place, so local copies cannot quietly diverge from the source of truth. Attribution is recorded with a confidence level and the reporting it rests on, and inferred relationships are labelled as inferred. When a source retracts or corrects, the correction propagates rather than leaving a stale assertion behind.

What this means for you

You can put a finding from this platform in front of a regulator, a court, a board or a partner agency and show where each element came from. That is the standard the tooling is built to — because in this work, being confidently wrong is more damaging than being usefully uncertain.

By the numbers

The taxonomy this entry belongs to is not a marketing list — it is the actual structure of the platform: 52 mission domains, 52 intelligence disciplines and 65 data points, each with a live dashboard behind it. Supporting that: 18 indicator types, 14 playbooks, 16 AI skills, 18 export formats and a 30-step automated pipeline.

This particular entry connects directly to 10 data points, 6 mission domains, 1 closely related entries — every one of them a tag you can follow, and a dashboard you can open.

Questions analysts actually ask

Where is the line between disinformation and lawful opinion?

Falsity plus deceptive distribution, not disagreement. Lawful opinion, partisan argument, satire and sincerely held but mistaken belief are all protected expression and are not the object of this discipline. What distinguishes an information operation is the deceptive behaviour around the content: accounts misrepresenting who they are, coordinated amplification designed to simulate organic support, and infrastructure built to conceal a common origin. Study that behaviour. If your method cannot distinguish a covert influence operation from a loud but honest political campaign, it will eventually be used to suppress legitimate speech, whatever the intent behind it.

How much evidence is needed to attribute a campaign to a state?

Considerably more than most published attributions carry. Attribution proceeds in layers: content to accounts, accounts to a coordinated operation, operation to an organisation, organisation to a state. Each layer needs its own evidence. Behavioural and infrastructure overlap with previously documented networks, shared idiosyncratic technical artefacts, payment trails and consistent operational tradecraft can support the middle layers. Linking to a state usually requires evidence private analysts do not have. State confidence at each layer separately, stop at the layer your evidence supports, and be explicit that thematic alignment with a state's interests is not attribution.

Does high engagement mean a campaign worked?

No, and the assumption drives most overstated reporting in the field. Engagement metrics are inflated by automated accounts, by platform counting rules, and by the campaign's own amplification. High engagement within a closed, already-convinced community indicates circulation, not persuasion. The meaningful indicators are downstream: pickup by mainstream outlets, adoption of the framing by political figures or officials, measurable shifts in survey data, and offline mobilisation. Where none of these are present, report circulation honestly and say that effect is unmeasured, rather than presenting reach figures as impact.

Should a falsehood be debunked publicly?

Only after weighing amplification. Reporting on a claim that reached a small audience can introduce it to a much larger one, and the correction is remembered less well than the claim. Where publication is justified, structure it to lead with the accurate information, state the false claim once and clearly labelled, and explain the manipulation technique rather than repeating the content in detail. Consider whether platform escalation, private notification of affected parties, or briefing rather than publication achieves more. Record the amplification assessment as part of the decision.

How do you detect coordination without accusing ordinary users?

Focus the analysis on structure rather than on individuals. Look for near-simultaneous identical posting across accounts with no organic relationship, shared idiosyncratic artefacts such as the same uniquely cropped image or a private link shortener, clustered creation dates, and coordinated switching between unrelated topics. Report at the level of the network and the infrastructure, not the level of the person who shared something they believed. Ordinary users who amplified content are the audience of an operation, not its perpetrators, and profiling them is both disproportionate and analytically empty.

What weight should synthetic media detection carry?

Very little on its own, in either direction. Detection tools misfire on recompressed, resized and screen-captured media, and high-quality generations frequently evade them. Treat a detector score as one weak input and work provenance instead: earliest appearance, the highest quality original available, internal physical consistency such as lighting and shadow geometry, and whether the depicted place and time survive independent verification. Content provenance signatures, where present, carry real weight; their absence carries none. Report inconsistencies rather than declaring fabrication, because the inconsistency is what you can actually evidence.

Is it acceptable to use fake accounts to study a closed community?

Rarely, and only under a framework you can defend publicly. Platform terms almost always prohibit it, several jurisdictions regulate covert identity use as a form of undercover activity requiring authorisation, and research ethics bodies apply strict scrutiny to deception. For journalists, NGOs and private practitioners the defensible position is normally open collection of publicly accessible material with a documented attribution posture. Where the requirement genuinely needs covert access, the correct answer is referral to authorities who hold that power, not a workaround that would be indefensible if disclosed.

Standards, frameworks and further reading

Work that references a recognised framework is easier to defend, easier to hand over, and easier for a partner to consume:

• EU Digital Services Act, governing platform systemic risk assessment, advertising transparency, moderation reporting and vetted researcher data access.
• EU Code of Practice on Disinformation, setting commitments on demonetisation, political advertising transparency and empowerment of researchers and fact-checkers.
• International Covenant on Civil and Political Rights Article 19, governing freedom of expression and the strict conditions under which restrictions are permissible.
• International Fact-Checking Network Code of Principles, governing non-partisanship, transparency of sources and funding, and correction policy.
• Berkeley Protocol on Digital Open Source Investigations, setting collection, preservation and verification standards for online material used in accountability contexts.
• C2PA content provenance and authenticity specification, defining signed capture and edit history for media files.
• GDPR and equivalent regimes, constraining profiling of individuals and the retention of personal data gathered during campaign analysis.
• Santa Clara Principles on transparency and accountability in content moderation, framing expectations for platform enforcement records.

References

Primary sources and authoritative references for this entry. Publishers revise and retire material, so treat the retrieval date as part of the citation and re-check before relying on any of it in a formal product.

1. EUvsDisinfo database — EEAS East StratCom Task Force. Documented cases of pro-Kremlin disinformation with sources and disproof
2. DSA Transparency Database — European Commission. Structured record of platform content moderation decisions
3. Ads Transparency Center — Google. Repository of advertisers and creatives including political advertising
4. Transparency reporting and ad library — Meta. Advertising archives and coordinated inauthentic behaviour disclosures
5. European Digital Media Observatory — EDMO. Research and fact-checking network publishing methodology and findings
6. Digital Forensic Research Lab — Atlantic Council. Open source investigations into information operations
7. International Fact-Checking Network Code of Principles — Poynter Institute. Standards for non-partisanship, transparency and corrections in fact-checking
8. InVID-WeVerify verification tools — WeVerify project consortium. Toolkit for verifying media provenance and detecting recirculation
9. C2PA specification — Coalition for Content Provenance and Authenticity. Open standard for signed media capture and edit provenance
10. GDELT Project — GDELT. Global news event and tone dataset used for narrative propagation analysis

Link integrity: every reference above was verified with a live request when this page was generated. Where a publisher had moved or withdrawn a document, the link was repointed at a preserved copy in the Internet Archive and marked as archived. Anything with no reachable copy anywhere had its link removed rather than left to rot — the source is still credited, it simply cannot be linked.

Put it into practice

The Quantus Intel threat intelligence platform operationalises this entry: narrative tracking, coordination detection and archived evidence packages for every campaign you monitor. Explore the platform, or browse the rest of the library by following any tag above.