Detecting Election Disinformation with OSINT

Elections are prime targets for information operations. Malicious actors, both foreign and domestic, use social media to amplify divisive narratives, spread falsehoods, and undermine trust in the democratic process.

Identifying Coordinated Inauthentic Behavior (CIB)

The focus of disinformation analysis has shifted from debunking individual claims to exposing the networks that amplify them. CIB involves groups of accounts working together to mislead others about their identity or purpose.

• •Creation Dates: Batches of accounts created on the same day or week are highly suspicious.
• •Amplification Patterns: Accounts that solely retweet or share content from a few central nodes, often within seconds of the original post.
• •Profile Similarities: Using AI-generated profile pictures (GANs) or stealing images from legitimate users across different platforms.

Analyzing Content and Narrative

Disinformation often relies on emotional manipulation. Analysts track the spread of specific narratives, looking for patient zero—the initial source of the fabricated claim.

Media Manipulation

Detecting synthetic media (deepfakes) and cheapfakes (miscontextualized media) is critical.

OSINT analysts use reverse image searching to find older, original versions of videos and rely on digital forensics to detect subtle inconsistencies in audio and video files.

Following the Funding

Disinformation networks require resources to operate. Tracing the infrastructure—who registered the domains hosting fake news sites, who pays for the hosting—can often reveal the actors behind the operation.

Increasingly, investigators are using blockchain forensics to track cryptocurrency payments to influencers or content farms that promote disinformation.