Spotting Coordinated Fake Campaigns by Their Clock Patterns

A plain guide to timing analysis for U.S. security, finance, and data teams

By Md. Tauhid Hossain Rubel
Doctoral Candidate and Researcher | Artificial Intelligence, Data Analytics, Cybersecurity & Financial Intelligence
United States
This is a summary of my full article on Medium. Read the full article here: https://mdtauhidhossainrubel.medium.com/catching-false-campaigns-before-they-spread-2dc3de00886b?sharedUserId=mdtauhidhossainrubel

Summary

Fake online campaigns spread fast, and most defenses start late. This post shows a simple way to catch them earlier. Look at when accounts act, not only what they say. Groups that post and share together, again and again, leave a pattern in time. A team can find that pattern with basic network tools, language checks, and clustering.

Keywords: Misinformation; Temporal Analysis; Network Analysis; Cybersecurity; Data Analytics; U.S. Economy

Why Developers and Analysts Should Care

If you build or run data systems, you may think false news is someone else’s job. It is not. False campaigns hit brands, banks, health systems, and public agencies. They also look a lot like other attacks. A burst of linked accounts is a lot like a burst of linked logins. The same habits that help in security work can help here.

The numbers show why this is urgent. A Pew Research Center survey of 5,153 U.S. adults, taken in August 2025, found that about nine in ten at least sometimes see news they think is inaccurate. Forty two percent see it often or extremely often. The Reuters Institute found that 73 percent of Americans were worried about what is real and what is fake online in 2025. Its 2026 report found that worry about fake news reached 62 percent worldwide.

The money at risk is real as well. In 2013, a hacked news account posted a false claim about explosions at the White House. The World Economic Forum, citing Reuters, reported that the S&P 500 briefly lost about $136 billion in value within three minutes. A 2019 study by a University of Baltimore economist and the firm CHEQ estimated that fake news costs the world about $78 billion each year. That figure is a rough estimate for the whole world, not only the United States.

The Measurement Problem

Here is the core issue. Most tools check one post at a time. They ask if the post is true. That is slow, and people often disagree on the answer. It also misses the bigger picture. A single post may look harmless, yet it may be one of two hundred posts from one group.

So we change the question. Instead of asking if a post is true, we ask if a group of accounts is acting as one. That is a question about behavior, and behavior can be measured.

How Timing Analysis Works

Real people post at uneven times. Coordinated groups often do not. They may post within seconds of each other, share the same link in the same minute, or use hashtags in the same order.

A team at Indiana University built an open method for this. Pacheco and colleagues create a network from shared behavior traces. Two accounts are linked when they act alike, such as sharing the same item or posting in the same short window. Tightly linked accounts form clusters. The team tested the idea on five case studies, including U.S. elections, protests in Hong Kong, the war in Syria, and cryptocurrency manipulation.

Here is a plain version of the steps.

1. Collect the time and type of each action.
2. Cut the timeline into short windows, such as ten seconds or one minute.
3. Link accounts that act on the same item in the same window, again and again.
4. Draw the accounts as a network and find the tight clusters.
5. Send each cluster to a human analyst. The word “again and again” matters. One shared link at one moment proves nothing. Dozens of matches across many accounts is a strong signal.

Adding Language and Clustering

Timing tells you who moves together. Language tools tell you what they say. With natural language processing, you can check if the linked accounts use near identical words. With clustering, you can group accounts by behavior, such as account age, posting rhythm, and shared links. When timing, language, and account traits all point the same way, your confidence goes up and your false alarms go down.

Limits You Should State Out Loud
Data access. Platforms hold most timing data. Outside teams often cannot get it, so results are hard to repeat.

Privacy. Timing records can reveal when a person is online. Use grouped or de-identified data, keep only what you need, and protect it like any sensitive record.

False alarms. Honest groups also act together. Fans and activists may post at the same moment. An alert should lead to human review, not an automatic takedown.

Adaptation. Bad actors will add random delays, and artificial intelligence makes that easier. Meta’s 2026 threat report said AI tools now appear in almost every coordinated network it removes. So mix timing with other clues, such as shared images and account age.

What the Latest News Tells Us

Meta’s report also described an Iranian network aimed at U.S. audiences. It used only a few dozen accounts, yet it reached more than 79,000 followers. Meta said Russia remains the most common source of covert influence it sees. These findings show that small, well timed groups can have a large reach.

The research side is under strain too. In 2024, news outlets reported that the Stanford Internet Observatory was winding down. Stanford disputed that it was being dismantled. Either way, the field needs steady and open support.

What Teams Can Do

Start small. Pick one platform you already watch. Log timestamps and shares. Build a simple coordination score. Review the top clusters by hand each week. Track how many alerts were real and how many were not. Then improve.

For policy leaders, the call is to fund safe data access and clear sharing rules. For industry, it is to add timing checks to existing security monitoring. For researchers, it is to test methods against honest groups and share code.

Why It Is in the National Interest

Trust in what we see online supports markets, elections, and public health. Early warning helps protect all three. It also gives the United States a way to spot foreign influence without judging speech, and it builds skills that the country needs.

Conclusion

Coordination is hard to hide on a timeline. If we watch how accounts behave, we can often spot a false campaign before it spreads far. The method is not perfect, and it needs privacy care and human judgment. Still, it is a practical step that teams can start today.

Declaration of Original Work
This is my own work. I collected facts from the public sources listed below and wrote the text with the help of AI. Estimates are labeled as estimates.

References

Cavazos, R., & CHEQ. (2019). The economic cost of bad actors on the internet: Fake news in 2019. University of Baltimore. https://ubalt.edu/news/news-releases.cfm?id=3425
Meta. (2026). Adversarial threat report, second half of 2026. https://transparency.meta.com/reports/integrity-reports-h2-2026/
Pacheco, D., Hui, P.-M., Torres-Lugo, C., Truong, B. T., Flammini, A., & Menczer, F. (2021). Uncovering coordinated networks on social media: Methods and case studies. Proceedings of the International AAAI Conference on Web and Social Media, 15(1), 455 to 466. https://doi.org/10.1609/icwsm.v15i1.18075
Pew Research Center. (2025). Many Americans say they often come across inaccurate news and have a hard time knowing what is true. https://www.pewresearch.org (summary: https://ssrs.com/news/many-americans-say-they-often-come-across-inaccurate-news-and-have-a-hard-time-knowing-whats-true/)
Platformer. (2024, June 14). The Stanford Internet Observatory is being dismantled. https://platformer.news/stanford-internet-observatory-shutdown-stamos-diresta-sio
Reuters Institute for the Study of Journalism. (2025). Digital news report 2025. University of Oxford. https://reutersinstitute.politics.ox.ac.uk/digital-news-report/2025/dnr-executive-summary
Reuters Institute for the Study of Journalism. (2026). Digital news report 2026. University of Oxford. https://reutersinstitute.politics.ox.ac.uk/digital-news-report/2026/dnr-executive-summary
World Economic Forum. (2025). What is the real cost of disinformation for corporations? https://www.weforum.org/stories/all/financial-impact-of-disinformation-on-corporations/
U.S. General Services Administration. (n.d.). Data.gov. https://data.gov