National security researchers studying foreign influence operations face a fundamental timing problem: by the time a campaign is documented in open-source reporting, it has already achieved its primary objective of reaching mainstream media. Research that documents what happened after the fact has limited policy value. Research that can characterize a campaign as it unfolds — before media pickup — is the intelligence product policymakers actually need.
The institute's team was tracking a pattern of coordinated activity targeting U.S. defense policy narratives across multiple platforms. They had behavioral indicators consistent with a foreign-origin campaign but needed cross-platform network analysis, velocity data, and authenticity scoring to build a defensible characterization they could bring to a policy briefing.
Rolli IQ was activated on the defense policy topic cluster. Platform-level behavioral analysis identified an anomalous velocity spike in content promoting a specific policy framing — a framing with no significant organic history in the U.S. defense policy discourse space. Account network analysis revealed a cluster of accounts with creation dates within a 6-week window, consistent posting cadence patterns, and cross-platform posting timing within narrow synchronization windows.
Topic Tree analysis isolated the campaign's primary narrative vehicle: a series of synthetic 'expert commentary' posts amplifying a specific policy position, originating from accounts with no authentic academic or policy credentials despite the persona construction. The campaign's cross-platform architecture — seeding on lower-moderation platforms followed by bridging to mainstream networks — matched documented patterns from previous foreign influence operations.
A full network characterization report, including account network maps, behavioral signatures, platform divergence data, and authenticity scoring, was delivered 6 hours before the first press coverage of the campaign appeared. The report was used as the basis for a policymaker briefing that included specific platform enforcement referrals.
“The ability to bring a fully characterized campaign to a policy briefing while it was still active — before the press had named it — is exactly the kind of intelligence product that changes what policymakers can do in response.”
