Inside a Disinformation Campaign: How Rolli IQ Mapped the Narrative Arc

At 7:14 a.m. on a Tuesday morning in the days following a contested state-level electoral certification, Rolli IQ's monitoring infrastructure recorded an anomalous velocity spike in a narrative cluster that had been dormant for eleven days. The cluster centered on a specific allegation about vote-counting software — an allegation that had circulated briefly after the election, failed to gain traction, and appeared to have dissipated. The renewed spike was not driven by new evidence or a news event; there was no triggering story in major outlets. What Rolli IQ's platform detected was the signature of a coordinated reinjection: a set of accounts posting near-identical content within a 22-minute window, reactivating a narrative frame that organic dynamics had allowed to fade. Within 90 minutes, the research team assigned to the account had flagged the cluster for full analysis.

The authenticity scoring process revealed a pattern that analysts described as textbook coordination. Of the 847 accounts driving the initial surge, 612 — approximately 72% — received authenticity confidence scores below 28 out of 100, placing them in the high-confidence inauthentic range. Account-level analysis showed the hallmarks: creation dates clustered in a six-week window eighteen months prior, follower-to-following ratios consistent with bulk-reciprocal inflation, posting frequencies that spiked simultaneously rather than staggering organically, and language fingerprints showing less than 8% vocabulary variance across posts that appeared superficially distinct. The 28% of accounts with higher authenticity scores were largely real users who had been drawn into amplifying the narrative without awareness of the coordinated layer beneath it — a common pattern in which inauthentic networks use genuine amplification as social proof to extend their reach.

The research team's most significant contribution was tracking the narrative's trajectory across the media ecosystem in real time. By hour three, the coordinated cluster had achieved sufficient volume on X to begin appearing in algorithmic trending signals. By hour four, political commentary sites with large newsletter audiences had picked up the claim as a 'social media story worth watching' — without noting that the social media activity driving the story was predominantly inauthentic. By hour five, two regional television stations had referenced the social media volume in broadcast segments. At each stage, Rolli IQ's timeline documentation captured the source data, the authenticity scores, and the network topology — building a complete evidentiary record of how a manufactured narrative moved from coordinated injection to mainstream media reference.

“When a coordinated narrative emerged around a contested electoral certification, a Rolli IQ research team tracked the si…”

The research team delivered a fully documented brief to the account's decision-makers at the 5 hour 47 minute mark — eleven hours before the narrative achieved any sustained national cable coverage. The brief documented the injection event, the authenticity breakdown, the amplification pathway, and a set of recommended talking points calibrated to address the narrative without amplifying it further. Decision-makers chose to issue a preemptive factual statement through established credibility channels rather than waiting for the mainstream media cycle to force a reactive response. The narrative did not reach the national cable tier. Whether the preemptive communication was the determining factor is impossible to establish with certainty — but the brief gave decision-makers an informed choice rather than a reactive posture, which is precisely the operational value narrative intelligence is designed to deliver.