Selected Papers of #AoIR2020: The 22nd Annual Conference of the Association of Internet Researchers Virtual Event / 13-16 Oct 2021 COORNET: AN INTEGRATED APPROACH TO SURFACE PROBLEMATIC CONTENT, MALICIOUS ACTORS, AND COORDINATED NETWORKS Fabio Giglietto University of Urbino Carlo Bo Nicola Righetti University of Vienna Luca Rossi IT University of Copenhagen Giada Marino University of Sassari With a specific reference to Facebook, a recent study (Giglietto et al., 2019) has spotlighted patterns of coordinated activity called by the authors “Coordinated Link Sharing Behavior” (CLSB). CLSB refers to the coordinated shares of the same news article in a very short timeframe by networks of pages, groups, and verified public profiles. CLSB is a strategy used to boost the reach of content by gaming algorithms that govern the distribution of posts (Giglietto et al., 2019). Additionally, this coordinated activity has been proven to be consistently associated with the spread of problematic information before the 2018 and 2019 Italian elections (Giglietto et al., 2019; Giglietto et al., 2020; Giglietto et al., 2020). This paper presents a study on Coordinated Link Sharing Behaviour (CLSB) during the first and second waves of the COVID-19 pandemic in Italy. Specific attention is devoted to critically present the methodology and tool employed in the context of existing literature on mis/disinformation. CooRnet and the A-B-C framework As much as the field of mis/disinformation studies flourished during the last few years (Freelon & Wells, 2020), the efforts to measure its prevalence and effects (Benkler, 2019) are often hindered or significantly limited by the fuzziness of the phenomenon under study (Jack, 2017). Deeply influenced by the idea that “fake news” was the sole vector of disinformation aimed at influencing the public debate online, content-based approaches have been Suggested Citation (APA): Giglietto, F., Righetti, N., Rossi, L., and Marino, G., (2021, October). Coornet: An Integrated Approach to Surface Problematic Content, Malicious Actors, and Coordinated Networks. Paper presented at AoIR 2021: The 22nd Annual Conference of the Association of Internet Researchers. Virtual Event: AoIR. Retrieved from http://spir.aoir.org. longly seen as the most effective response to this mounting concern. However, the debunking activity is time-consuming, not always possible, and sometimes inevitably ineffective (Zollo et al., 2017). Furthermore, both fabricated and legitimate news content are circulated by malicious actors with the aim of influencing public opinion (Phillips, 2018). Given the amount of time and resources needed to check on a single content, researchers relied instead on lists of malicious actors. Compiled and pre-existing lists of problematic domains have been employed to estimate the prevalence of “fake news” (Allcott & Gentzkow, 2017; Guess et al., 2019). The main shortcoming of this approach lies in its inability to take into account the dynamic of information operations that often changes over time the sources, new outlets, internet domains, and social media accounts they rely on. Differently from approaches based on sole content or actors, an integrated approach, such as the François A-B-C framework (2019), highlights how we need to understand the interplay between manipulative Actors, deceptive Behaviour, and harmful Content, to fully recognize these activities. CooRnet (Giglietto et al., 2019; Giglietto et al., 2020; Giglietto et al., 2020) implements this framework as a cycle: by starting with harmful content, it detects deceptive behavior to identify manipulative actors. Once a list of such actors has been identified, the next cycle uses the content produced by these actors to initiate a new iteration of deceptive behavior detection that, in turn, leads to identifying an updated set of manipulative actors. COVID-19 case study The study on circulation of problematic information around COVID-19 in Italy relied on the CoronaVirus Alliance database of news flagged as false or misleading by the International Fact-Checking Network (IFCN). This database provided a list of 212 false and misleading Italian claims that surfaced between January 22, 2020 and August 26, 2020. Then, we used the CrowdTangle (CrowdTangle Team, 2019) ‘Search’ feature to identify a dataset of related news stories, finding a total of 1,258 URLs. Using CooRnet::get_ctshares() function we collected all the CrowdTangle-tracked Facebook posts that shared these URLs up to one week from the story publication date (N=13,271). Fig. 1 CooRnet A-B-C cycle flowchart By using CooRnet::get_coord_shares() function we define which shares were performed in a coordinated way, where coordination means two actors sharing the same link within an unusually short period of time. Moreover, in order to avoid false positives created by shares performed at approximately the same time by chance, CooRnet allows setting a threshold on how many times coordination between two entities needs to happen in order to be counted. CooRnet::get_outputs()function returns several R objects: 1. a list of coordinated entities detected with summary statistics (highly_connected_coordinated_entities); 2. a data frame of all the URLs shared containing a variable identifying the presence of coordination (ct_shares_marked.df); 3. highly_connected_g, i.e. a projected graph of the Facebook entities that shared the URLs in a coordinated way; 4. a data frame summarizing metrics of each coordinated component detected in the network, e.g. the average subscribers of the accounts, the proportion of coordinated shares over the total shares, the top 5 coordinately shared domains (component_summary); 5. a data frame of the most engaging posts containing the URLs shared in a coordinated way (top_shares); 6. another including the top URLs shared in a coordinated way (top_urls). This first iteration of the A-B-C cycle led to the identification of 152 actors. We then gathered all the posts with links shared by these accounts over a period of one month (October 2020, due to the resurgence of the coronavirus outbreak). The resulting dataset of 59,346 URLs has been used as the input of the second iteration of the A-B-C cycle. CooRnet::get_ctshares() resulted in 364,400 Facebook shares and CooRnet::get_coord_shares() identified 344 entities. Finally, CooRnet::draw_url_timeline_chart() creates an interactive visualization that displays the cumulative shares over time received by a single URL along with the entities that shared it in both a coordinated and non-coordinated manner (fig. 2). Fig. 2 Output of the draw_url_timeline_chart() for the news story with most shares emerged in iteration 2. Various types of COVID-19 skepticism, anti-vaxx, and anti-mask are prominently featured in the list of coordinated news stories (top_urls) shared by these networks. Results of the case study will be presented at a macro, meso, and micro level. More general implications will be also discussed. References Allcott, H., & Gentzkow, M. (2017). Social Media and Fake News in the 2016 Election. The Journal of Economic Perspectives: A Journal of the American Economic Association, 31(2), 211–236. Benkler, Y. (2019). Cautionary Notes on Disinformation and the Origins of Distrust. Social Science Research Council. CrowdTangle Team. (2019). CrowdTangle [Data set]. François, C. (2019). Actors, Behaviors, Content: A Disinformation ABC Highlighting Three Vectors of Viral Deception to Guide Industry & Regulatory Responses (One). Transatlantic High Level Working Group on Content Moderation Online and Freedom of Expression. Freelon, D., & Wells, C. (2020). Disinformation as Political Communication. Political Communication, 37(2), 145–156. Giglietto, F., Righetti, N., & Marino, G. (2019). Understanding Coordinated and Inauthentic Link Sharing Behavior on Facebook in the Run-up to 2018 General Election and 2019 European Election in Italy. Giglietto, F., Righetti, N., & Rossi, L. (2020). CooRnet. Detect coordinated link sharing behavior on social media. Giglietto, F., Righetti, N., Rossi, L., & Marino, G. (2020). It takes a village to manipulate the media: coordinated link sharing behavior during 2018 and 2019 Italian elections. Information, Communication and Society, 23(6), 867–891. Guess, A., Nagler, J., & Tucker, J. (2019). Less than you think: Prevalence and predictors of fake news dissemination on Facebook. Science Advances, 5(1), eaau4586. Jack, C. (2017). Lexicon of Lies: Terms for Problematic Information. Data & Society. https://datasociety.net/output/lexicon-of-lies/ Phillips, W. (2018). The oxygen of amplification. Data & Society, 22, 1–128. Zollo, F., Bessi, A., Del Vicario, M., Scala, A., Caldarelli, G., Shekhtman, L., Havlin, S., & Quattrociocchi, W. (2017). Debunking in a world of tribes. PloS One, 12(7), e0181821.