Towards a New Typology for ‘Coordinated Inauthentic Behaviour’

The next speaker in this AoIR 2024 conference session is Richard Rogers, whose interest is in the concept of ‘coordinated inauthentic behaviour’ on Facebook. The term was introduced by Facebook’s Head of Cybersecurity Policy Nathaniel Gleicher in 2018, and has evolved substantially since then: from a generic definition of groups of pages or people working together to mislead others it was sharpened to a more narrow focus on the spread of ‘fake news’ for strategic purposes.

Richard illustrates this through an analysis (using Fabio Giglietto’s CooRNet tool) of coordinated activity on Facebook, and asks how Facebook’s redefinition of CIB might now enable it to retain coordinated content on Facebook that is dodgy but does not fall under the new and more narrow definition of the concept. As it turns out, actual influence operations and the activities of major media organisations can have the same activity signatures, in fact.

Key here are two terms. First, coordination: this was defined at first as false amplification through rapidly repeated posting, but after 2022 was subsumed under the narrower category of adversarial threats. Second, authenticity: at first, there was a strong focus on ‘fake’ accounts or the spread of ‘fake’ or ‘false’ news, but again this was narrowed substantially to the fake accounts operated by adversarial actors. By contrast, the nature of the content as ‘fake’ or not no longer matters in current definitions.

To classify currently observable operations under these definitions we need clearer typologies: these might ask whether all actors in a network publish the same content; whether they relied on ordinary content in public groups, or on Facebook advertising affordances; etc.

Using such typologies, we might examine networks of coordinated activity as run for instance by the U.S. far-right publication Daily Wire, which operates a range of Facebook pages all pushing the same content but without obvious adversarial intent, and is therefore allowed to continue is activities.

Also, of course, the demise of CrowdTangle makes all of this much harder to observe and report on.