Influence Operations
Expose the operators behind the outrage.
Coordinated campaigns borrow the look of organic opinion. We separate networks from crowds, measure what a campaign actually achieved and attribute it to the people and companies running it, with evidence that platforms, regulators and the public can verify.
- Typical duration
- 3 to 8 weeks
- Urgent tasking
- Rapid network assessment within 72 hours
- Team
- Influence operations lead, network analysts and native-language specialists
- Deliverable
- Network map, attribution report and platform takedown packages
- Pricing
- Fixed fee, or retained through elections and crises
When to call us
When the conversation is being manufactured.
Influence operations target elections, markets, companies and communities. Our clients come to us when they need to know whether a wave of activity is real, who is behind it and what to do next.
Elections and referendums
Inauthentic networks posing as local voters, impersonation of candidates and officials, and campaigns to suppress turnout.
Attacks on your organization
Smear and boycott campaigns, fabricated scandals and coordinated pressure on your leadership, partners or customers.
Market manipulation
Promotion schemes, coordinated short attacks and rumor campaigns timed around trading, listings or transactions.
Foreign interference
Cross-border campaigns that launder narratives through local voices, fringe outlets and paid intermediaries.
Fake engagement and reviews
Engagement farms, review rings and account sellers inflating or attacking products, causes and public figures.
Platform integrity
Trust and safety teams who need independent investigation and attribution of coordinated abuse on their services.
What you receive
Evidence a platform can enforce on.
We document coordination at the level of individual accounts, so that every enforcement decision, briefing or public statement rests on evidence that can be checked.
- A network map of accounts, pages, channels and domains, with the evidence linking them
- Behavioral analysis of coordination: timing, content reuse and creation patterns
- An impact assessment of genuine reach, separated from inauthentic engagement
- Attribution to operators, vendors or sponsors, each with a stated confidence level
- Takedown packages formatted for platform policy and enforcement teams
- A public version of the report when disclosure is the goal
How it runs
From seed accounts to a public attribution.
Most engagements start with a handful of suspicious accounts. We expand from those seeds using behavior, not keywords, until the network's edges are clear.
-
01 / Scope
Days 1 to 3
We agree the narratives, platforms, languages and time window in scope, and the decision the findings need to support.
-
02 / Detect
Days 2 to 14
Seed accounts are expanded through co-posting, shared content and creation patterns, and every account is captured as it is found.
-
03 / Attribute
Days 10 to 30
Infrastructure, payment and vendor links connect the network to its operators. Each attribution is red-teamed before it is reported.
-
04 / Act
Days 25 to 45
Takedown packages go to platforms, briefings go to decision makers and, where agreed, a public report is released.
Tradecraft
We assess behavior, not opinions.
A view is not inauthentic because it is unpopular or wrong. A network is inauthentic because of how it behaves. Our analysis is built on signals that can be measured and shown.
- Coordination signalsCreation-date clustering, synchronized posting bursts and accounts that act together far more often than chance allows.
- Content reusePerceptual hashing of images and video, and copy-paste text that carries the same typos and formatting across accounts.
- Synthetic persona detectionGenerated faces, recycled stock photos, borrowed biographies and handles produced from the same naming template.
- Time-zone analysisActivity patterns that follow an office working day somewhere other than where the accounts claim to be.
- Infrastructure linksShared domains, analytics identifiers, link shorteners and hosting that tie fringe outlets and accounts to one operator.
- Amplification economicsEngagement sellers, advertising accounts and payment trails that show who paid for reach and how much.
- Narrative trackingHow a story moves from seeding to amplification, across languages and platforms, and where it first appeared.
- Impact measurementGenuine reach and engagement separated from the network's own activity, so you respond in proportion to real effect.
Results
Networks exposed, accounts removed.
The test of influence operations work is whether platforms, regulators and the public can act on it. Ours is built to be acted on.
Government
Mapping a 1,900-account network before a national vote
Creation-date clustering, recycled images and a shared posting schedule exposed a commercial influence operation posing as local voters.
Most outside reports tell us something is happening. Aldervane's package told us exactly which accounts were involved, why they were linked and who ran them. We enforced the same day.
Questions
Influence operations FAQ
Is this just labeling views you disagree with as disinformation?
No. We do not judge opinions. We assess whether accounts are who they claim to be and whether they act independently. A network is reported because of coordinated, deceptive behavior that we can evidence, not because of what it says.
Can you attribute a campaign to a government?
We attribute to the operators the evidence supports: accounts, companies, vendors and individuals. We state sponsorship only when it meets our high-confidence standard, and our reports say plainly when it does not.
Do platforms act on your reports?
Usually, because our packages are built for them. Each one sets out the accounts involved, the behavior observed and the evidence for coordination, in the form enforcement teams need to make a decision quickly.
Do you work for political parties or campaigns?
No. We work for electoral bodies, public institutions, platforms, researchers and organizations that are the target of campaigns. We do not work for parties, candidates or anyone seeking to run an influence operation of their own.
Can findings be published?
Yes, if you choose. We can prepare a public report alongside the confidential version, with personal data of uninvolved people removed and evidence presented so that others can verify it.
Start an engagement
Bring us the question nobody else could answer.
Tell us what you need to know and why. A senior investigator will scope it with you, tell you candidly what open sources can and cannot establish, and propose a plan with a fixed fee and a firm timeline.