J‑LAB · ARGUS Defence Network
A laboratory for investigating disinformation and influence networks.
Every case makes you rebuild your workflow from scratch: fake websites this month, account networks the next, influencers after that — and the data gets harder to reach every year. Here you bring the problem and the laboratory brings the tools: sixteen agents behind one command, on a journalist's laptop. No cloud, no API budget, no vendor.
Collection feeds an archive. The archive feeds five families of analysis. Everything they produce goes through the control test before it is allowed to become a finding.
Most of us investigating disinformation look at the same signals and reach for the same tools. What we lose is time.
What it costs today
A different toolkit per case. One set for impostor websites, another for account networks, another for influencers — each with its own export format, its own gaps, its own way of failing. You spend the investigation assembling the workshop.
What replaces it
One place to go. You describe the problem; the laboratory answers with whatever it has — accounts, domains, images, targets, amplification, timing — under a single method, so the work is comparable from one case to the next.
Why you can trust the answer
Before anything is published, every clue is measured against a comparison group of real accounts exposed to the same material. Of eleven we tested, four turned out to distinguish nothing. That record is public.
Anyone can take apart an influence operation once it has gone viral. By then the data is everywhere and the pattern is obvious — and the damage is done. The moment that is actually worth something is the one before: forty accounts in their first week, a handful of sites that just went up, an audience that has not arrived yet.
That moment is also where there is almost nothing to measure. Which is precisely why the clues have to be ones you already tested. You cannot read faint signals with clues you never checked — you will either miss the network or accuse the wrong people.
The same logic that produced prebunking applies here: warning people while a campaign is still assembling is worth more than documenting it afterwards. A validated ledger of behaviours is what makes that call possible at all.
Sixteen roles, twenty-eight modules. They are named for the job, not the file.
01 · capture
Profiles accounts, pulls complete timelines including replies, collects every reply to a given post, and searches by term. Works in batches of three with pauses, because a “0 tweets” is an exhausted quota, not a block.
recolectar · bajar_timelines · replies_a · buscar · bajar_red · relleno · cookies · importar_archivo
02 · identity
Reads “About this account”: country of operation, how many times it was renamed and when, where it was registered. The most discriminating signal, and the only categorical one.
about · firma
03 · signals
Looks for date cohorts — creation, first post, rename — measures recipient overlap and groups hashtag portfolios. Calendar coincidences carry the most weight.
nucleo → cohortes · primer_post · solapamiento · hashtags
04 · discipline
Builds a control group from whoever replied to the same posts and measures every signal in both groups. If it does not discriminate, the signal is retired however good it looked.
pool_control · control_profundo · perfilar
05 · expansion
Finds new accounts by the routes that actually work: co-reply to the same posts, date cohort, geographic record. Reports how many it discarded for correctly resolving to the expected country.
caso.py expandir <case>
06 · persistence
Every six hours it checks status, renames and country changes, and recaptures new content. A live rename usually announces that the network is being reconfigured.
vigilar · launchd, every 6 h
07 · harm
Measures pressure on each target relative to that target's own size. Separates a source being redistributed from a person being attacked — a distinction the raw counts get wrong.
victimologo
08 · adversary
Builds an operational portrait on four axes — proximity, expertise, motivation, resources — plus modus operandi and signature. Who operates the network, never who funds it.
perfilador
09 · access
Detects an actor publishing an official action before the institution announces it. A proxy for privileged access, and deliberately narrow: it only counts concrete actions, not matching names.
anticipacion
10 · time
Before-and-after comparison against a cutoff declared in the case file before the data is examined, with the confounders printed next to the result.
temporal
11 · image
Triage and content hashing. The platform assigns a different URL to the same image on every post, so real reuse is only visible by hashing the content itself.
imagenes
Partial — a human still reads
12 · reach
Separates authentic reach from internal echo. In the pilot farm, 62.7% of all quoting was the network quoting itself. It characterises amplification; it never filters on it.
impacto
13 · laundering
Follows the jump from a disposable account to a much larger amplifier — the same content moving from a seed with no audience to one that has one.
lavado
14 · cost
Estimates the effort invested, normalised to minutes per account per day. These are effort proxies, not money: without ad-library access no price can be attached.
tasador
15 · infrastructure
Pulls every domain out of the corpus and fingerprints what they share underneath: resolution, name servers, whether they still exist at all.
infraestructura
16 · evidence
Consolidates every CSV into a queryable store and inventories each file with its SHA-256, so a finding can be traced back to the exact bytes it came from.
consolidar · consultar · manifiesto
Coordination indicators circulate as folklore — widely repeated, rarely tested. Ours were contrasted against 256 control accounts matched on exposure: real, organically active accounts that had replied to the same posts. Same conversation, same incentive to reply, same platform conditions.
| Signal that held | Strength | What backs it |
|---|---|---|
| Country mismatch | MAX | Categorical, not distributional. Authentic accounts from the country resolve to it; the suspected ones did not. |
| Rename cohort | MAX | Several accounts renamed on the same day. |
| First-post cohort | MAX | Accounts registered years apart that publish for the first time on the same day. |
| Recipient overlap | HIGH | 80–98% across the case core. |
| Identical metrics | HIGH | Volume and follower counts nearly equal between accounts that share no stated relationship. |
| Zero followers | MED | 42.9% of the network against 5.9% of the control. |
| Signal that died | Control | Network | Why it falls |
|---|---|---|---|
| Numbers in the handle | 25.4% | 21.4% | One in four politically active users has one. The network has fewer. |
| Follower / following ratio | 0.34 | 0.21 | The normal median is already below 1 — almost everyone who replies to news outlets follows more people than follow them. |
| Single posting client | 99.9% | 99.1% | The control is more concentrated. Posting from one client is ordinary. |
| Median reply latency | 3 days | 2 days | Effectively identical. |
| Dormancy over a year | 11.1% | 33.3% | Weak rather than dead. It occurs in ordinary accounts — the control maximum was 4.9 years — and n=12 will not carry a statistic. |
The editorial consequence: do not write “accounts with auto-generated names” or “they all post from the same client”. Both are false, and anyone who repeats the analysis will dismantle them.
Two investigations in Guatemala, on two kinds of actor that could not be more different: a farm of recycled accounts that cost almost nothing to run, and a single professional operator with a following. The point of running both was not the size of either. It was to find out whether the same clues work on both.
They do not, entirely — and that is the most useful thing the laboratory has produced so far. The next surfaces in line are impostor news sites and paid influencers, where the collection changes but the method does not.
Listed plainly, because a tool that hides its limits is worse than no tool.
There is no onboarding and nothing to sign. Three ways to be useful, in descending order of effort:
And if none of that is for you, that is completely fine. The ledger above is public either way.