Investigative Methodology for Disinformation Campaigns

Through this concise guide, ARIJ seeks to establish a clear and precise definition of investigative journalism that exposes disinformation and media-deception operations—not merely by debunking them, but by identifying the parties behind them, demonstrating the scale of the deception, and, where possible, holding those parties accountable when laws have been violated or when the campaigns have caused human or material losses.

ARIJ, through its network of editors and in partnership with the Arab Fact-Checkers Network (AFCN), organized working sessions to define the standards and methodology for such investigations. Given the scale of disinformation campaigns and their complexity in form, content, and impact, it has become necessary to establish horizontal collaboration between specialized journalists and fact-checkers experienced in monitoring and tracking, using open sources, processing large datasets, and working with tools and applications that are continually updated in this field.

This concise guide is intended for journalists and fact-checkers. It seeks to clarify the concept of investigations into disinformation campaigns from an investigative perspective that differs from standard media reports exposing false information without deeply examining the identities of those behind them or their funding sources. Investigative reports that address corruption involving disinformation or dissemination to broad audiences—such as attempts to influence elections through manipulation of social media platforms, account forgery, or breaches of data or email—fall outside this specific definition because, under ARIJ’s methodology, they already meet the broader definition of investigative journalism.

Disinformation: Information created and promoted by actors seeking to cause harm, whether financial, political, material, or reputational, to a person or group.

The guide sets out standards and a methodology for conducting investigative journalism on disinformation. It is intended to help journalists develop a clear, structured work plan for carrying out this type of investigation.

First: Definition

An investigation monitors and analyzes changes, or attempts to change, collective behavior through systematic communicative (media) pressure—through endorsement, exclusion, opposition, or incitement to violence—exerted across different media platforms, with the involvement of specialized experts and opinion-polling institutions. It also reveals how these operations are managed by actors with financial, technical, and human capabilities to control or steer public opinion. The investigation demonstrates how disinformation campaigns spread by tracing them from their inception, identifies the coordinating actors and their objectives, and identifies and documents legal and ethical violations committed during or before the disinformation campaign.

Second: Key Aspects of the Definition

The definition establishes the working criteria and the core elements of the methodology.

1. Criteria:

• Who is behind the disinformation? The actors involved, such as governments, political parties, companies, and influencers.
• How is the disinformation carried out? Through media platforms, experts’ publications, and opinion-polling institutions, with the investigation revealing how these operations are managed.
• Funding and its scale: Through actors with financial, technical, and human capabilities.
• Impact: Changes, or attempts to change, collective behavior through systematic communicative pressure—through endorsement, exclusion, opposition, or incitement to violence—and efforts to control or alter public-opinion trends.
• Legal violations: Identifying and documenting legal and ethical publication violations during the operation.

When a fact-checker or journalist conducts an investigative report to uncover disinformation campaigns, the following questions should be addressed. Each investigation has its own characteristics, which determine the questions the journalist needs to answer in order to expose the disinformation:

The primary actor who manages the campaign or provides its main support. This actor is the party to whom a right-of-reply request should be addressed. An investigation cannot be complete without identifying the responsible party or parties and giving them an opportunity to respond to the findings and allegations.

Sub-actors, or the supporting network of beneficiaries and supporters, should be identified along with the relationships or links between them and the main actor. This should not be limited to connections in the virtual world, such as social media accounts; it should also examine the real-world relationships linking the individuals and institutions behind the campaign. Revealing the campaign’s source of funding is essential to identifying who is behind the disinformation. The funding source should be established, especially when it is connected to governments, companies, organizations, or a combination of these. This may also help provide evidence about the campaign’s objective.

The scale of funding may reflect the size of the campaign and the influence of the actor or actors behind the disinformation. It may also indicate potential impact. For online disinformation campaigns launched on social media platforms, the scale of funding can be investigated by examining digital advertising.

One example is the “Story Killers” project, which exposed the shadow economy of the disinformation industry in several countries. The investigation documented deals between officials and people convicted of criminal activity and “reputation-laundering” or public-relations companies that spread disinformation on behalf of clients.

The economic returns generated by actors that spread disinformation can also be tracked. One example is a Bellingcat investigation into Indian websites that profited from Google advertising despite publishing misleading information.

Disinformation campaigns are not launched in a vacuum; their initiators seek to achieve specific objectives. Journalists and fact-checkers should therefore ask: Why was the disinformation campaign launched? The answer is often linked to a particular time or event. Climate disinformation, for example, may coincide with relevant international conferences in an effort to reduce their influence or undermine outcomes aimed at addressing climate change.

ARIJ’s “The Cyberstorm” investigation, produced in cooperation with Code for Africa, exposed climate-change disinformation campaigns that coincided with regional and international climate conferences.

These are the channels used to disseminate disinformation, including social media platforms, different media outlets, opinion-polling centers, and other channels.

Identifying the methods helps determine the scope of the harm. Detecting more than one method may also help produce a more accurate map of the actors involved, which in turn may reveal more about funding sources. Methods include, but are not limited to, forgeries, proxy or fake websites, manipulated content, cyber-enabled disinformation, and the creation and promotion of false personas, which may be presented as “experts,” as noted in the definition.

One example is an investigation into methods used by Russian actors to spread disinformation in Africa.
Fake accounts were also used to post identical comments on posts by Moroccan opposition figures and parties, either attacking them or supporting the government, ahead of the 2021 elections.

The DISARM Foundation developed a structured methodology for describing and analyzing disinformation behavior. It includes two main frameworks: DISARM Red, which describes the behavior of disinformation creators from campaign planning, identification of target audiences and channels, and use of disinformation techniques—such as creating social media pages for false personas—through campaign execution designed to ensure wide distribution and continued funding, and finally evaluation of the campaign’s impact on its target audience; and DISARM Blue, which describes potential response behaviors and focuses on how such campaigns can be countered by platforms, journalists, and the general public.

An ARIJ report documented a common disinformation technique—the creation of false personas—by exposing an account created for a fictitious Israeli figure that was subsequently cited by numerous Arab media outlets.

Reach and engagement can be measured by communicating directly with audiences or assessing their perceptions, as well as by analyzing audience responses on social media through sentiment-analysis tools and comment analysis.

Impact can be assessed by identifying actions taken following disinformation campaigns or practices experienced by the groups targeted by disinformation. Disinformation may contribute to disputes, wars, and conflicts. For example, disinformation about refugees may create pressure on governments to deport them or may culminate in violence against them by local residents. Election-related disinformation can affect voter preferences and who ultimately reaches elected bodies.

One example is a Documented investigation that exposed a network of smugglers using TikTok to mislead audiences and encourage irregular migration to the United States. The videos can also affect migrants’ lives even after they arrive in the United States.

ARIJ’s investigation “ Hidden Committees ” also documented the impact of a network of fake accounts operating in Morocco since 2021 to target political opponents with disinformation and influence elections and public opinion.

Another ARIJ investigation documented disinformation and incitement campaigns targeting women working in Yemeni civil-society organizations. The campaigns created a “social stigma” that followed the women and negatively affected their personal and professional lives, sometimes escalating into security pursuit and arrests, amid an absence of serious legal accountability for those promoting the campaigns.

Most disinformation campaigns on social media platforms violate platform rules in one way or another by promoting deliberate disinformation and/or racist speech and/or hate speech. Some countries have also enacted laws against disinformation, so any violation of those laws should be explained in the context of the investigation. Ethical violations may also arise through the promotion of disinformation, hate speech, or racist narratives intended to harm others.

Online political advertisements are also subject to laws and internal platform regulations, and compliance with those rules should be monitored. When disinformation is disseminated through media outlets, the content is likewise subject to rules and laws governing adherence to professional and ethical standards. Accordingly, the investigation should identify and document legal violations and ethical breaches.

One example is the BBC investigation “Racism for Sale,” which exposed the exploitation of African children by a Chinese man to produce racist content for social media.

Third: Steps

• Track the path and analyze networks: Trace the spread of disinformation campaigns.
• Analyze relationships and links among the elements: Identify coordinating actors, their objectives, and the mechanisms through which the campaign spreads.

Tracking the path and analyzing networks
Path tracing is a core element of monitoring and analysis and includes:

• Identifying how information spreads across different platforms. Information may be published through multiple accounts or platforms linked to one actor or coordinating with one another.
• Studying the relationships between the campaign and the accounts promoting its misleading content.
• Tracing relationship networks managed by one or several actors, which may require following multiple, branching paths.
• Identifying the campaign’s initiators and those contributing to its amplification through network analysis.
  One example is a Bellingcat investigation into the relationships among accounts leading a campaign against World Health Organization Director-General Tedros Adhanom Ghebreyesus. The investigator conducted a network analysis that revealed connections among accounts active against Ghebreyesus during the emergence and spread of COVID-19, in what appeared to be a coordinated campaign targeting him.

Analyzing relationships and links among the elements:

• Identify the targeted groups or segments.
• Identify the beneficiary or beneficiaries.
• Identify the party or parties that manage or primarily support the campaign; these may not be the same as the funder.

Studying patterns:
Patterns should be studied at two levels: the content itself and the target audience’s response. This includes:

• Tracking patterns of change in the content and analyzing how it evolves.
• Studying patterns in the target audience’s interaction with the campaign by monitoring and analyzing engagement with the content. This helps identify the objective and assess whether an impact occurred.

Digital documentation:
Save copies of content before it is deleted and document changes to it over time.

ARIJ’s methodology for investigative journalism differs from the workflow used specifically for investigations into disinformation campaigns. The workflow does not follow the conventional three-part structure of action, actor, and affected party. Instead, it is based on different criteria that require answering the questions of “who” and “how,” measuring impact, and documenting legal violations and ethical breaches. The methodology is also multidimensional and branching, as illustrated in the diagram.

To learn more about fact-checking, visit the Arab Fact-Checkers Network (AFCN) Library.

When assessing an investigation idea, the journalist or fact-checker should try to answer the following questions:

• What misleading claims have you identified?
• What evidence shows that they are misleading? You must establish that the claims are misleading and are being disseminated deliberately with the aim of deceiving others or harming a group of people.
• When were the claims first launched, and have they recurred at repeated intervals? You must establish that the claims are linked to specific time contexts and are not being disseminated randomly.
• What narrative are the promoters of the claim trying to advance?
• Who launched the claims, and who promoted them?
• Is there a relationship among those promoting the claims?
• How and where do the promoters disseminate their claims?

First: Using Tools to Detect Coordinated Disinformation Campaigns

• Support campaigns: predominantly positive.
• Attack campaigns: predominantly negative.
• Mixed campaigns: defend one party and mention it positively while attacking another and mentioning it negatively.
• Neutral campaigns: There are no truly neutral campaigns, but the use of artificial-intelligence services has complicated discourse analysis and made the language appear more neutral.

Arabic-language analysis still contains errors and ambiguities and therefore requires human review.

Social-media monitoring tools typically include a section listing posts that mention the selected keywords or hashtags, ordered from oldest to newest. This can identify the first post in the campaign. The next step is to examine the account owner to determine whether the account has launched other campaigns in the past and whether it may be linked to actors associated with the campaign, using people-tracing and face-analysis tools where appropriate.

Identify the accounts that post and engage most heavily with the campaign, analyze their orientations, and examine their relationships with one another. Also monitor the accounts that interact most through reposts, likes, quotes, or comments on campaign posts. Social-media monitoring tools such as Talkwalker provide this functionality, as do other advanced tools such as Meltgo and Fedica.

Build a network by downloading a dataset containing the accounts that published the original posts, which are fewer in number, and the accounts that interacted with them, which are more numerous. Social-media monitoring tools such as Talkwalker allow users to download posting data as well as data on publishing and interacting accounts.

The most influential accounts in the campaign appear at the center of the network, surrounded by accounts interacting with the campaign. These accounts act as amplifiers and promoters of the campaign’s content, helping it reach the largest possible audience and influence public opinion.

The network can be built in Gephi after cleaning the campaign’s posting dataset and retaining only publishing and interacting accounts. Gephi allows statistical analysis of network centrality; greater centralization can be an indicator of coordinated mobilization around the campaign.

Account activity patterns can be studied to identify unusual behavior or possible indicators of automation or coordinated management. Indicators that can be examined include posting frequency, intervals between posts, repeated content, absence of geographic-location information, the ratio of original to reposted content, interaction patterns with particular accounts, account-creation date, and sudden changes in activity levels.

No single indicator is sufficient to conclude that an account is automated, fake, or part of a coordinated operation. Any conclusion should be based on a combination of behavioral and network evidence.

Some tools can extract the timing of posts or reposts from an account and analyze them statistically to determine whether posting is regular or irregular. The account itself should also be examined, including its creation date and recency, the absence of a biography or profile photo, and the use of AI-generated images.

Second: Some Tools Used in Campaign Analysis

Third: Social Media Ad Libraries

Note: These tools are continually updated, and some may stop working depending on the policies of social media platforms and companies.