Contributions
-
Theoretical framework: Reconceptualizes strategic information operations as sociomaterial phenomena requiring a CSCW lens to account for both orchestrated and organic elements.
-
Participatory model: Demonstrates that information operations involve diverse actors with different levels of coordination, including unwitting participants whose authentic actions support broader disinformation campaigns.
-
Case study diversity: Presents three complementary case studies spanning state-sponsored operations, multi-platform coordinated campaigns, and emergent conspiracy theorizing, showing variation in orchestration levels.
-
Platform policy implications: Highlights the challenge that platform policies designed around "coordinated inauthentic behavior" cannot easily distinguish between orchestrated campaigns and self-sustaining organic activity shaped by platform affordances.
-
Methodological approach: Integrates qualitative ethnographic analysis, network visualization, digital trace analysis, and domain network mapping to study information operations at multiple scales.
Method
The paper employs a mixed-methods sociomaterial approach integrating qualitative and quantitative analysis across three distinct case studies:
Case 1: RU-IRA operations in #BlackLivesMatter discourse (2015-2016). Analysis of Twitter datasets including account-level data, retweet networks, and content archaeology. Used Internet Archive to reconstruct deleted accounts and profile history.
Case 2: White Helmets disinformation campaign (ongoing since ~2017). Multi-platform analysis spanning Twitter, YouTube, and the broader media ecosystem. Qualitative content analysis of tweet coordination patterns and network analysis of domain linking across conspiracy-theorizing websites.
Case 3: Conspiracy theorizing about crisis events (2013-2016). Tweet-level analysis of crisis-actor and false-flag narratives following Boston Marathon bombing, San Bernardino shooting, and other events. Network analysis of domain linking and comparison of "conspiracy" vs. "straight news" domains.
All cases employ triangulation across micro-level engagement data, meso-level network structures, and macro-level media ecosystem analysis. The team used Twitter's released datasets of IRA accounts and complemented them with Internet Archive snapshots for historical reconstruction.
Results
Case 1 findings: RU-IRA accounts embedded themselves across both pro-BLM and anti-BLM clusters, creating appearance of grassroots division. While accounting for only 89K tweets in a larger dataset, their strategic positioning amplified conflict across opposing communities. Accounts used persona construction, coordinated retweeting across clusters, and content adaptation to maintain false authenticity.
Case 2 findings: The White Helmets campaign showed evidence of orchestrated elements (consistent narrative messaging, coordinated amplification by state-sponsored outlets like RT and Sputnik) alongside organic amplification by authentic activists, "western journalists" (sometimes impostors), and conspiracy-theorizing communities. The echo-system analysis revealed a domain network mixing explicitly state-aligned sites, self-described "alternative media," and genuine activist platforms, all sharing anti-White Helmets content. This mixing makes attribution difficult and enables information operations to hijack pre-existing ideological communities.
Case 3 findings: Conspiracy theorizing about crisis events is largely organic and self-sustaining. Participants lack evidence of explicit orchestration but are shaped by platform affordances (algorithmic recommendation, retweet amplification) and shared epistemology (distrust of mainstream institutions). The community collectively produces and circulates conspiracy narratives without needing top-down direction. However, domains supporting these narratives (Alex Jones' InfoWars, Russia-aligned outlets, Iranian state media) suggest some external actors benefit from and possibly strategically feed this ecosystem.
Notes
Strengths: The paper makes a significant theoretical contribution by moving beyond the binary "bots vs. humans" framing to examine information operations as complex sociotechnical systems. The three case studies illustrate genuine variation: Case 1 is highly orchestrated, Case 2 is mixed, Case 3 is largely organic. This nuance better reflects how real information operations function. The CSCW lens—examining operations as collaborative work—is generative and connects social media operations to decades of research on how groups coordinate. The paper's honest acknowledgment of the reflexivity problem (researchers' own situated positionality affecting interpretation) is methodologically mature.
Limitations: The case studies are largely descriptive rather than mechanistic—the paper shows that different coordination models occur but offers limited analysis of why some communities are susceptible to infiltration while others are self-sustaining. The paper does not provide quantitative comparison of effectiveness across orchestrated vs. organic campaigns. Attribution remains difficult, particularly in Case 2 and 3 where state actors may benefit from organic activity without engineering it. The temporal scope of Case 1 is limited by Twitter's released dataset boundaries.
Impact: This work has been influential in shifting how researchers and platform designers think about coordinated inauthentic behavior. It complicates simple detection approaches and highlights the need for context-dependent policy design. The finding that information operations leverage emergent crowd behavior—rather than simply replacing it with bots—has informed subsequent research on how platform affordances enable information operations. The paper's emphasis on participatory dimensions has motivated work on understanding how authentic users become vectors for disinformation without explicit coordination.