Test the Claim
Menu

Influence & attribution

Analyse the message.
Observe the behaviour.
Attribute only what the evidence earns.

A misleading claim is not automatically an operation. Suspicious activity is not automatically foreign. And resemblance to a known tactic is not proof of origin.

Test an attribution →See the ladder ↓
01MessageCONTENT

Accuracy · context · framing

02DistributionBEHAVIOUR

Coordination · concealment · amplification

03ResponsibilityATTRIBUTION

Linkage · direction · corroboration

The central distinction

Three questions. Three evidence burdens.

CONTENT

Is the message reliable?

Test claims, omissions, framing and context. A truthful message can still be used manipulatively; a false one can spread organically.

BEHAVIOUR

How is it being distributed?

Look for concealment, impersonation, coordinated assets and artificial amplification. Compare with a credible baseline.

ATTRIBUTION

Who is responsible?

Build a separate case connecting the activity to a specific actor, direction and operation. Keep alternatives alive.

Influence lifecycle

Follow the movement, not just the message.

These stages organise observation. Finding the sequence does not establish that one hidden actor controlled every stage.

01

Seed

Introduce a claim, frame or asset into a receptive community.

02

Frame

Select the conflict, identity or emotion through which it should be understood.

03

Amplify

Increase visibility through repetition, networks, paid reach or authentic sharing.

04

Legitimise

Move the message through intermediaries that lend status or apparent independence.

05

Mobilise

Turn attention into sharing, withdrawal, pressure, protest, purchase or policy support.

Attribution ladder

Do not skip the missing rung.

Each step supports a different statement. Higher rungs normally require better source access, alternative-hypothesis testing and independent corroboration.

  1. 0
    Content finding

    What is true, false, selective or unresolved in the message?

  2. 1
    Distribution anomaly

    What differs from a credible organic baseline?

  3. 2
    Coordination indicators

    What repeated behaviour suggests common planning?

  4. 3
    Network linkage

    What shared assets or infrastructure connect the activity?

  5. 4
    Actor-linked hypothesis

    What distinguishes one capable actor from plausible alternatives?

  6. 5
    Operational evidence

    What connects the actor to direction, access or execution?

  7. 6
    Public or legal attribution

    What standard, authority and evidence access support a formal finding?

Signals and limits

Useful clues are not finished conclusions.

Phrase the observation at the level the evidence supports. Then name what remains unproved.

False contentdoes not establisha foreign operation
Many accountsdo not establishautomation or common control
Similar timingdoes not establishshared instructions
A beneficiaryis not necessarilythe author
A familiar tacticdoes not identifythis actor
A platform removalis not by itselfindependent proof

Attribution workbench

What is the highest defensible statement?

Mark evidence as absent, an investigative lead or corroborated. The workbench uses gates rather than a numerical score, because attribution is not arithmetic.

Content findingThe message has been assessed for accuracy, context and framing.
Distribution anomalyReach, timing or repetition differs from a credible organic baseline.
Coordination indicatorsAccounts share timing, assets, instructions or an observable campaign pattern.
Concealed identityEvidence shows impersonation, fake personas or hidden control—not merely anonymity.
Shared infrastructureDomains, hosting, administrators, payment paths or technical assets link activity.
Actor-specific linkThe evidence distinguishes a named actor from others with similar motives or methods.
Operational evidenceOrders, access, internal records or forensic evidence connect the actor to execution.
Independent corroborationA genuinely independent evidence line supports the actor-specific case.

This exercise stays in your browser. Nothing is submitted or stored.

Apply the distinction

Cases where attribution is the hard part.

These examples show why content assessment, coordination and responsibility must not collapse into one conclusion.

Coordination

“The media take the same orders.”

Convergence can arise from shared incentives, sourcing and professional routines. What would distinguish those from command?

Open the case →

Responsibility

“Russia certainly destroyed Nord Stream.”

Capability, motive and benefit do not complete the operational chain. The public record must tolerate unresolved attribution.

Open the case →

Wartime narrative

“The Ghost of Kyiv was verified.”

A morale-building story can spread through sincere sharing without every participant belonging to a coordinated operation.

Open the case →

Reasoning patterns

Recognise the attribution shortcuts.

Method sources

Frameworks worth inspecting directly.

The structure draws on behaviour-first analysis and the warning against over-attribution in the EEAS FIMI methodology, alongside Meta’s distinction between content and coordinated inauthentic behaviour. These are analytical references, not authorities that should be accepted without scrutiny.