Following a claim through the information environment

What the current evidence does and does not show

The EEAS Fourth FIMI Threat Report, published in March 2026, documents information-manipulation activity examined through its monitoring and open-source research. Its disclaimer matters: the findings are not claimed to be exhaustive or representative of overall activity, and the judgments may be revised.[1] A company website should not turn that selected record into a measurement of all manipulation, all public opinion, or the effectiveness of a detection system.

For teams studying narrative conflict and cognitive warfare defensively, the practical task is more specific. Which account is circulating? Where did it originate? What supports or contradicts it? What evidence, if any, connects the observed distribution to a particular actor? Keeping those questions separate makes an assessment more useful to the next reviewer.

Three publications may still be one account

Consider a fictional report that an aid depot has closed. A social post cites an unnamed witness. A local article quotes the post. A widely shared summary cites the article and says the closure is confirmed. There are three publications, but the visible chain still leads to one unverified account. An official notice or an independent observation could change the assessment; another summary of the same article would not do the same evidential work.

The Berkeley Protocol recommends tracing online material to its original source where possible, evaluating source credibility and reliability, verifying content, and protecting people who may be affected by an investigation.[2] Independence should be assessed at the claim level. Two otherwise unrelated outlets can rely on the same witness or agency dispatch.

Ask a different question at each level

Whether a video depicts the claimed place and time is a content-verification question. Whether several accounts show a meaningful pattern of shared behavior is a coordination question. Whether that behavior can be linked to an organization is an attribution question. Whether people believed the story or changed their behavior is an impact question. An answer at one level does not automatically answer the others.

Our proposed record would keep the claim, source passage, publication and collection times, known dependencies, and verification work together. It would distinguish an observed pattern from an analyst’s explanation. Similar wording, simultaneous posting, or a shared political position may prompt investigation, but each can have explanations other than coordinated manipulation.

Preserve the evidence without overstating it

A source’s reputation is relevant, but it is not a universal reliability score. An official statement can be strong evidence of the institution’s stated position while remaining insufficient evidence that the described event occurred. A witness can accurately report an observation and misunderstand its cause. Collection conditions, access, translation, and later corrections belong in the record.

W3C PROV-O offers a vocabulary for recording entities, activities, agents, and derivation.[3] That helps express that a summary came from an article or that an analyst reviewed a passage. It does not authenticate the event described. Screenshots, hashes, and collection logs can preserve an artifact and its history; their role should not be confused with proving the artifact’s claims.

A useful evaluation would try to fool the workflow

We would build a clearly synthetic test set containing copied reports, independent observations, altered dates, mistranslations, corrections, and unsupported attribution. Reviewers would assess whether a draft distinguishes the origin of a claim from later amplification and whether a changed source updates the conclusion. False accusations of coordination deserve a separate error count, not concealment inside an overall accuracy score.

The proposed TACITUS path uses DIALECTICA to organize candidates for review and PRAXIS to work with reviewed capsules. AGON and KAIROS contribute research directions for claim and temporal analysis; they are not live monitoring services. Evaluations would also test access limits and source text that tries to issue instructions to an agent. The goal is a defensible analytical record. No detection rate, coverage guarantee, or institutional endorsement is claimed.

Trace three mentions back to one original account

The fictional 09:10 post is quoted by a 09:35 news report, which is repeated in a 10:20 summary. That path represents one circulated account, not three independent observations. Keep origin known/unknown, publication/correction times, quotation status, translation, audience and framing. A shared phrase may have several explanations; it does not establish coordinated manipulation or private motive. Synthetic modeled responses are not observed population beliefs. [4]