Methodology

Scope

Vigia is a research prototype for examining repeated coordination in online activity. It brings together observable relationships between posts, timing and accounts so that an analyst can inspect the underlying evidence. Coordination, automation and malicious intent are separate questions. People can coordinate openly; automated services can be useful; misleading content can spread without orchestration. A behavioural alert therefore does not establish that an account is a bot, that a statement is false, or that a foreign actor is responsible.

Observable signals

The detection protocol considers near-duplicate text, shared links, co-posting, co-reposting and recurring pairs of accounts acting on different targets. Lexical similarity and multilingual embeddings help identify related messages. Repeated activity across several targets carries more weight than a single viral post. Account cadence and identity age provide limited context for an automation indicator. Handles, languages, political positions and cross-network bridge suffixes are not evidence of malicious conduct.

Decisions and uncertainty

The initial protocol uses a lower score threshold of 0.35 and an upper threshold of 0.75. These are engineering defaults, not validated probabilities. A strong coordination alert also requires minimum account, activity, target and temporal support, repeated relationships, and an eligible timing test. The active detector configuration defines the exact gates and is part of the evaluation record.

The uncertain outcome covers intermediate scores, insufficient observations, unresolved timing problems and failed eligibility gates. Organic means that the observed sample provides insufficient evidence of repeated coordination under the detector's criteria. It does not certify that every participant is human or that the wider conversation is uncoordinated.

Evidence against a hypothesis

A useful report explains what weakens its interpretation. Examples include a single shared news event, attributed quotations, independently varied reactions, missing history, or bridge delivery that compresses arrival times. Older identities and diverse activity can weaken a simple automation hypothesis, but do not rule out coordination. A plausible alternative explanation is labelled as such; it becomes a confirmed explanation only when supporting evidence is available.

A temporal null model

The hackathon protocol uses 50 independent circular time shifts to compare the observed pattern with a simple temporal baseline. Shifts preserve individual activity sequences while changing their alignment; candidate discovery must be repeated for each comparison. The resulting empirical tail statistic is exploratory. It is not a probability of malice, and 50 repetitions provide coarse resolution. Shared events, scheduled announcements and transport artefacts can violate the model's assumptions. Statistical surprise alone is insufficient for an alert about people.

Evaluation and provenance

Results must distinguish historical observations, synthetic injections, synthetic hard negatives and adversarial red-team cases. The IRA archive is a separate historical case study: attribution of accounts does not label every message or episode as coordinated. Without comparable negatives and defensible episode labels, it cannot supply a credible false-positive rate.

Controlled evaluation inserts known synthetic campaigns into captured traffic. The injected activity has known provenance; the surrounding traffic is not automatically verified organic. Synthetic hard negatives exercise plausible benign explanations and remain labelled synthetic. They are not evidence of performance on a representative real-world population.

Development and held-out test data are grouped by campaign, account, background snapshot and paraphrase family where applicable. Threshold choices belong to development, before opening the test results. Hackathon scores remain uncalibrated. Precision, recall, F1, false-positive rate, confusion counts, sample sizes and abstentions must be reported together. Positive episodes receiving no alert, including uncertain outcomes, remain misses in the binary alert evaluation. Undefined metrics are unavailable rather than invented. Unrun evaluations must be displayed as unrun.

Known limits and responsible use

Longer timing jitter, multilingual paraphrases and partial participation can defeat this detector, particularly in level-three red-team scenarios. Sampling, reconnect gaps, missing repost context and incomplete account histories reduce coverage. Client timestamps can be misleading; observed arrival can reflect batching rather than publication. Language-specific results require adequate samples and reviewed translations. Small, related test sets support limited conclusions, and synthetic prevalence changes the meaning of precision.

Vigia provides signals, not verdicts on people. Human review should precede publication of allegations or consequential decisions. Public evidence should minimise personal data and mask network identifiers; collection gaps and exclusions should remain visible. DISARM provides a common vocabulary for describing supported observations. A technique code is an analytical annotation, not proof of an operator's identity or intent. Reproducible configurations, traceable evidence and candid failure reports are the standard for this prototype.