What Makes an Influence Operation Covert?

A post can be accurate and still mislead you about who is speaking. A broadcaster can be easy to find while its financial sponsor remains concealed. These are different problems from an incorrect statistic or a fabricated photograph. Facebook’s 2019 explanation of coordinated inauthentic behavior focused on concealed identities and misleading appearances of popularity; a declassified U.S. memorandum documents the separate problem of hidden broadcasting finance. Facebook policy explanation; 1969 memorandum.

For this explainer, covert influence means an organized attempt to influence an audience while concealing or misrepresenting a consequential relationship behind it: who is speaking, paying, directing or participating. This is a working analytical definition. It is a starting point for asking better questions, rather than a verdict about a person or organization.

Keep six questions separate: source, funding, control, intent, accuracy and effects. Evidence that answers one may leave the others open. Also specify what was hidden, from whom, and when. A relationship might be unknown to an audience but familiar to officials, or publicly suspected without being acknowledged.

1. Source: who does the audience think is speaking?

Start with the identity being presented. Does an account claim to be a local resident, an independent news outlet, a customer or an unaffiliated civic group? Then ask what evidence establishes the operator behind that identity. The gap between those two answers is more informative than whether the account expresses a position you dislike.

In its 2019 investigation, the U.S. Senate Intelligence Committee reported that the Internet Research Agency, or IRA, posed as U.S. political activists and enlisted unwitting Americans in offline activities. The committee also described original content distributed as apparently authentic user activity. Those findings concern deceptive representation and organization. They do not make every person who encountered or shared the material a knowing participant. Senate report, Findings 5–6, p.7.

Do not treat a pseudonym, foreign language, ancestry or disagreement as evidence of a hidden sponsor. Those observations do not establish who controls an account. If the operator cannot be verified, the responsible answer may remain unknown.

2. Funding: who pays, and what was disclosed?

A January 27, 1969 memorandum for the U.S. 303 Committee described Radio Free Europe and Radio Liberty as operating through ostensibly privately financed nonprofit corporations while receiving most of their funding from the CIA. It recommended resuming covert CIA support without public admission. The document also acknowledged widespread assumptions about CIA financing. This illustrates why concealment and complete public ignorance are different questions. 1969 memorandum, §§3.B, 3.D.1 and 5.

This is a historical example, not a description of the broadcasters’ present arrangements. The memo documents sponsorship and officials’ reasoning; it does not independently establish the accuracy of every broadcast or the effect on every listener. A funding record answers a funding question. Other conclusions require their own evidence.

For any contemporary case, look for a specific payment, grant, ownership interest or contract, then identify the disclosure available to the relevant audience. Avoid replacing that work with the observation that two organizations support similar causes.

3. Control: who can direct the work?

Funding and control deserve separate entries in an investigation. Ask who selected the message, approved the work, operated the accounts or could require changes. Distinguish an employee carrying out instructions from an independent supporter who happens to repeat the same argument. Evidence should connect the particular person or organization to the particular activity under discussion.

Behavioral research offers ways to investigate relationships without assuming that every account is automated. Pacheco and colleagues’ 2021 study examined shared behavioral traces, including images, retweets and timing, to identify likely coordinated account networks. Such patterns are a reason to examine how accounts relate to one another. They do not, by themselves, identify the ultimate sponsor. Pacheco et al., Abstract.

Report the strongest supported relationship in plain language. Shared activity, common administration, a payment and an instruction are different findings. If the available record demonstrates only the first, do not silently upgrade it to the last.

4. Intent: what was the effort trying to achieve?

The Senate committee concluded that the IRA sought to help Donald Trump and harm Hillary Clinton in the 2016 presidential election at the Kremlin’s direction. It also identified broader objectives beyond that election. These are attributed findings about an effort’s purpose; they are not measurements of how many people changed their minds. Senate report, Finding 1, p.4.

An investigator should separate documented instructions from an interpretation of public content. State whose assessment is being reported and what supports it. The European External Action Service’s FIMI framework emphasizes intentional, coordinated, manipulative behavior and explicitly recognizes that much of it is not illegal. Its framework is useful context, not a substitute for jurisdiction-specific legal analysis. EEAS, The threat landscape.

5. Accuracy: is the particular claim true?

Check the message itself even after uncovering deception about its source. In its 2019 policy explanation, Facebook said much of the content in coordinated manipulation campaigns was not provably false and could be acceptable political discussion when shared by authentic participants. The company’s distinction helps explain why content verification and investigation of deceptive behavior need separate evidence. Facebook, What is Inauthentic Behavior?.

Apply that distinction in both directions. An accurate statistic cannot authenticate an invented identity. A concealed sponsor does not automatically disprove the statistic. Find the original dataset, document or recording, examine its context, and evaluate the factual claim on those grounds. Keep any demonstrated deception about sponsorship in the account as well.

6. Effects: what actually changed?

Potential reach, actual attention and changed beliefs are different outcomes. Eady and colleagues linked surveys to Twitter timelines to study exposure to IRA content during the 2016 U.S. election. Their 2023 paper found no meaningful relationship between that exposure and changes in the measured attitudes, polarization or voting behavior. The design was observational, and its exposure measure represented posts potentially appearing in timelines, not confirmed reading. Eady et al., Abstract and Methods.

The authors cautioned against extending the result to other platforms or other forms of interference. The appropriate conclusion stays within those limits. A failure to detect an effect in this setting does not prove that every influence operation is harmless; documented activity or large view counts do not, on their own, prove persuasion. Eady et al., Discussion.

A conclusion that leaves room for evidence

A useful assessment should let a reader reconstruct the reasoning: this identity was presented; this relationship was concealed; these records establish the connection; these outcomes were measured; these questions remain unresolved. Put dates and source links beside consequential claims. Attribute allegations, institutional findings and research results accurately.

Apply the same standard when you agree with the message. The purpose of identifying covert influence is to improve the evidence available for judgment. Suspicion should begin an inquiry. It should not supply the missing answers.