Define the hypothesis in observable terms
“These accounts are connected” is incomplete. Specify the behavior you want to examine: repeated links, a synchronized sequence of posts, shared assets or another pattern in a bounded period. Write what evidence would support the hypothesis and what could weaken it.
When comparing narrative threat intelligence tools, bring that hypothesis to the demo. Ask how a reviewer moves from a flag or network view to the original observations and how the product represents uncertainty.
Keep coordination, deception and attribution separate. Accounts can coordinate around a legitimate public campaign. A coordination finding by itself does not establish hidden control, a sponsor or harmful intent.
Combine evidence rather than counting one signal twice
Repeated wording can result from copying, a common source or quoting the same news event. Similar timing can follow a scheduled announcement. Examine what the combination of observations adds, and avoid treating several views of the same underlying fact as independent support.
| Observation | Question for review |
|---|---|
| Shared wording | Is it quotation, a common template or another explanation? |
| Close timing | Does a public event or schedule account for it? |
| Repeated links or assets | How specific is the shared material and how is it distributed? |
| Interaction pattern | What relationship is observed and over which period? |
Keep the time window, sampling conditions and collection limits attached to each observation. A pattern can change when the source set or comparison baseline changes.
Use a shared vocabulary carefully
The DISARM Red Framework provides a common language for documenting influence operations. It can help organize observed behaviors and communicate a finding consistently across teams.
A framework label is an analytical aid. It does not validate an attribution or prove that a behavior occurred in your case. Attach the relevant observation and explain why the term applies. Record uncertainty where the evidence supports more than one reading.
Ask a vendor how framework labels, automated classifications and analyst conclusions relate to one another. A useful demonstration makes that relationship visible rather than offering a label with no review path.
Investigate competing explanations
Write at least one plausible alternative to the main interpretation. A shared interest, common publisher, public organizing effort or copied news item may account for part of the observed pattern. Then identify the additional evidence that could distinguish the explanations.
Include counterexamples and contradictory material in the review. They can reveal an overbroad cluster or a source gap. If a consequential classification changes after analyst review, retain the reason for the revision.
A finding about observable behavior and a conclusion about who directed it require different supporting evidence.
Escalate the finding with its limits
The briefing should state the observed pattern, supporting records, interpretation, alternatives, confidence and the decision it informs. Name the owner of further investigation and the condition that would change the assessment.
In a pilot, test a deliberately ambiguous example. Record whether the provider explains the ambiguity, changes the classification when evidence warrants it and exports the reasoning in a form your reviewers can inspect.
Questions for the brief
How many matching posts prove coordination?
There is no universal count that proves coordination. Evaluate the specificity of the behavior, the time window, relevant relationships, source limits and alternative explanations. Ask what additional evidence makes the inference stronger.
Can a bot or authenticity label establish who operates an account?
A behavioral or authenticity classification is different from identity or operator attribution. Ask for the supporting observations, the limits of the method and the additional evidence required for a stronger identity conclusion.
Our team needs a quick warning while attribution is unresolved. What should the alert say?
Describe the observed activity and why it matters, state that attribution remains unresolved and name the reviewer. The team can prioritize a relevant signal without presenting an unsupported conclusion as established fact.