An influence operation is coordination, not content
The instinct when people hear "influence operation" is to look for a single dramatic lie — one viral post that fooled everyone. That is almost never how they work, and looking for it misses the point. An influence operation is defined not by any individual message but by two things underneath the messages: coordination (many accounts acting as one) and concealment (hiding who is really behind them).
This is why a piece of content, on its own, can rarely be labelled "an influence operation." A true statement can be part of one; a false statement can just be someone being wrong. What makes it an operation is the hidden machinery — a network pretending to be unconnected, independent voices when it is in fact a single actor pulling many strings. The content is the output; the deception is the thing itself.
That distinction is the same one that separates interference from fraud: the harm lives in the manipulation of the environment, not in a changed vote total.
The anatomy: assets, personas, narratives
Almost every operation is assembled from the same parts:
| Layer | What it is | Example |
|---|---|---|
| Assets | The accounts, pages, groups, domains it controls | Hundreds of fake profiles; cloned news sites |
| Personas | The fake identities those assets wear | "Local" activists; invented journalists |
| Front media | Sites built to look like independent outlets | Spoofed or fabricated news brands |
| Narratives | The messages pushed across the network | A recurring claim, seeded everywhere at once |
| Amplification | Coordinated sharing to fake momentum | The same post, many "unrelated" accounts |
Read from the bottom up, it looks like a groundswell. Read from the top down — which is how investigators reconstruct it — it is one actor wearing many masks.
Authentic vs inauthentic: where the line is
The single most useful concept here is coordinated inauthentic behaviour (CIB), the standard platforms use to police this. Meta defines it as networks of fake accounts working together to mislead people about who is behind them. Crucially, the judgement is made on the behaviour, not the content or the politics: the violation is the deception about identity and coordination, applied the same way regardless of ideology.
That gives a clean test. Ask: is the actor lying about who they are? A campaign advertising under its own name is ordinary politics. A foreign agency running a thousand accounts impersonating local citizens is an influence operation — even if some of what those accounts post is true.
Four operations, four methods
The database catalogues operations that between them cover the main techniques:
- The troll farm. The Internet Research Agency ran large-scale persona-based activity — thousands of fake American voices posting in concert, later named in a U.S. indictment. This is the classic model: manufactured personas at scale.
- The spoofed outlet. Doppelganger cloned the domains and layouts of real Western news brands to publish fabricated articles under a borrowed masthead — deception aimed at the source, so readers trust a familiar name.
- The forgery blend. Ghostwriter mixed hacking with fabrication, planting invented content via compromised sites and spoofed identities across Poland, the Baltics, and Germany.
- The contractor. Operations are often run by firms, not just states: the Social Design Agency was the commercial outfit behind Doppelganger — a reminder that influence is a service that can be bought.
What an influence operation can and cannot do
Holding the machinery in view keeps expectations honest:
- It can flood a news cycle, make a fringe view look mainstream, launder a narrative into trusted-looking outlets, and sharpen existing divisions.
- It cannot easily change a vote count — that is a different attack against different defences — and its persuasive effect on actual votes is usually far smaller than the alarm around it suggests.
Overstating operations is its own trap: it hands the operator a free win by making them look more powerful than they are, and it feeds the liar's dividend — the reflex to dismiss any inconvenient real thing as "probably a bot campaign."
How to recognise one
You do not need forensic tools to spot the pattern. The signatures are behavioural:
- Coordination. The same message, phrasing, or link appearing across many supposedly unrelated accounts at once.
- Concealment. Accounts that hide or fake their origin — stock-photo avatars, no real history, sudden creation dates.
- Sameness across platforms. An identical narrative surfacing simultaneously on several networks, as if released on a schedule.
- A network, not a person. When you pull one thread and dozens of near-identical accounts come with it.
Find those, and you are likely looking at an operation. Find one angry but real person, and you are just looking at politics. Keeping the two apart is the whole discipline — and the rest of this track breaks the individual techniques, from deepfakes onward, down one at a time.