Measuring Coordinated Online Behavior

01

Executive summary

Coordination in digital communication ecosystems is an analytical inference, not a raw observable fact. In high-velocity information environments such as Telegram, analysts frequently label message bursts as coordinated campaigns based solely on surface timing or duplicate text.

This method note outlines a defensible multi-indicator framework designed to quantify coordinated behavior while actively guarding against overclaiming, combining text similarity, burst dynamics, attribution integrity, and longitudinal co-participation.

02

Key findings

• Synchronised timing alone is never proof of coordination.
• Recurrent co-participation across unrelated narratives is the decisive behavioral indicator.
• Source attribution analysis filters out legitimate news syndication.
• Multi-indicator convergence across text, timing, and topology is required for high confidence.
• Strict boundaries prevent speculative attribution to individuals, intent, or covert financing.

03

Conceptual framework

Disinformation research requires epistemic discipline. We enforce three core distinctions: Topic (broad subject domain) vs Narrative (interpretive framework) vs Claim (testable factual assertion). Deliberate coordination operates at the level of specific narratives and uniform claims, whereas organic debate clusters around topics.

Synchrony is an observable descriptive feature of dataset timing. Coordination is an inferential hypothesis that must be demonstrated by excluding competing organic explanations.

04

Indicator matrix

Candidate clusters are evaluated across a transparent multi-factor scoring model rather than an uninterpretable machine learning classifier.

• Textual similarity: MinHash shingling and cosine similarity on normalized lexical tokens.
• Temporal compression: exponential decay function measuring propagation latency across channels.
• Rare phrase overlap: shared typographical errors, tracking parameters, and verbatim boilerplate.
• Source attribution absence: penalizes undisclosed copying and rewards open quotation or native forward links.
• Media fingerprints: perceptual hash matches distributed without native forward links.
• Recurrent co-participation: longitudinal co-occurrence of channel groups across unrelated topics.

05

Confidence rubric

• High confidence: multi-factor convergence, anomalous compression, media reuse, and verified recurrent co-participation.
• Moderate confidence: strong synchrony with proprietary framing, but awaiting longitudinal depth.
• Low or inconclusive: synchrony indistinguishable from breaking news, syndication, or viral diffusion.

06

Counter-hypotheses

Before confirming coordination, analysts must test five competing null hypotheses: official press statements, news agency syndication, breaking event shocks, viral organic forwarding, and shared automated machine translations.

07

Limitations and boundaries

Intellectual honesty requires defining boundaries: computational analysis does not prove real-world individual identity, covert financial payments, or subjective administrative intent. Analysis evaluates the information artifact and network behavior, not human psychology.

08

Data provenance

All findings link to immutable records: message identifiers, UTC timestamps, SHA-256 content hashes, metric parameter weights, and reproducible dataset snapshots.