Skip to content
Don't Feed the TrollsGet help

Coordinated inauthentic behaviour

Also written: coordinated inauthentic behavior, CIB

A platform's own category for coordinated activity that relies on fake accounts to mislead people about who is really behind it.

Escalation:
Ideological / campaign
Type:
Identity & coordination

Where the term comes from

Not lexicographic. This one belongs to a company: it is the name Meta gave to a category in its own rules, quoted below, and it entered general use from there.

Whose definition this is

The one-line summary above is ours. The definition it compresses comes from a named source, quoted in full and linked below — where the two differ, the source is what counts. Everything else on this page that states a fact is sourced.

Contested usage: Because the definition is a company's, it means what that company currently says it means, and it has been revised repeatedly. Treat it as the name of an enforcement category rather than as a neutral description — useful when you are filling in a report form, less useful as a way of describing something you have seen.

This term is unusual on this site, because it is not a word people coined and a dictionary later recorded. It is a category in one company's rulebook: Meta writes that where adversarial threat actors use false identities to engage in sophisticated forms of inauthentic behaviour, they engage in what it has defined as coordinated inauthentic behaviour. [1]

That matters more than it sounds. It means the definition is owned, it can be revised without notice, and other platforms use adjacent phrases for adjacent things.

Why the wording is doing careful work

The category turns on inauthentic, not on coordinated. People coordinating in the open — a campaign, a fan community, a union — are not doing this, however organised or effective they are.

The reason a platform draws the line there is that account provenance is the one thing it can actually see and you cannot. It knows what was created when, from where, and by whom. From outside, all you ever have is the output, and the output of a genuine movement and a manufactured one can be identical.

That asymmetry is the whole practical lesson of this page. The judgement rests on evidence that is structurally unavailable to a reader.

Recognising it

Signals, none of them evidence on their own:

  • Accounts created in a cluster, active on one topic and nothing else
  • Identical or near-identical phrasing across supposedly unconnected voices
  • Posting rhythms that fit one working day rather than many separate lives
  • Profiles with no history that predates the campaign
  • The same handful of accounts appearing wherever a subject comes up

Every one of these has an ordinary explanation. New accounts are new for mundane reasons; people who read the same sources sound alike; enthusiasts really do turn up wherever their subject appears. Nothing in that list can establish who is behind an account, and treating it as though it can is how real people get accused of being fake.

The honest difficulty

There is no version of this you can confirm from where you are standing, and that is not a limitation of your effort.

The temptation is to reason backwards: the argument feels coordinated, therefore the accounts are inauthentic. That inference is unavailable. Coordination you can sometimes infer; inauthenticity you cannot, because it is a fact about who holds the accounts.

Which makes the accusation cheap and hard to answer. Anyone accused of being part of a network has no way to disprove it, and the accusation reads to onlookers as though it has been established. If you find yourself about to state it as settled, say the honest thing instead: it looks that way, and you cannot know.

What to do

Do not accuse. You cannot establish it, and being wrong does to somebody else exactly what was being done to you.

Describe the pattern, once, for the people reading. Not who these accounts are, but what you have noticed: the same phrasing, the same arrival, the same absence of history.

Send it to the people who can see the metadata. Platforms have reporting categories for this, and it is the one route where the invisible evidence is actually visible. How to report, and what a report does.

Then stop. You are not the audience — the wider readership is — and replying to each account individually spends your evening on the one thing that cannot work. The reasons disengaging works differently at scale apply here more than anywhere.

Not the same as

People organising openly
Campaigns, unions, fandoms and political parties coordinate constantly and say who they are. The word doing the work is inauthentic, not coordinated.
Astroturfing
Astroturfing conceals whose interest is being served and can be done with real, named people. This category turns specifically on the accounts being fake, which is why a platform can act on it and often cannot act on the other.
A view you think is too popular
A position holding up better than you expected is not evidence of anything. This is a claim about account provenance, and account provenance is exactly what is invisible from outside.

Responding at this level

Individual response is close to irrelevant at this scale. Understanding is the point: the useful reader here is a moderator, journalist or researcher.

Sources

Last checked . Each quote below is verified against an archived copy of its source every time the site is built.

  1. [1] Community Standards: Inauthentic Behavior, Meta Platforms [archived]
    they engage in what we've defined as coordinated inauthentic behavior (cib)
    ; Community Standards: Inauthentic Behavior, Meta Platforms [archived]
    where adversarial threat actors use false identities to engage in sophisticated forms of inauthentic behavior