Case Study: Detecting a Cross-Platform Narrative Campaign Against Energy Policy

Engagement Context

A Central European government ministry responsible for energy policy engaged Retelnist six weeks before a scheduled parliamentary vote on a long-term national energy strategy. Public polling had shown unexpectedly high opposition to a policy option that held broad expert support, and the commissioning minister wanted to understand whether the polling reflected organic public concern or externally amplified messaging.

Note: Client and country identifiers are anonymised in accordance with our engagement confidentiality policy. All methodological details and outcomes are presented accurately.

Initial Assessment

Retelnist configured monitoring across five platforms (Telegram, Facebook, X, national news RSS feeds, YouTube) with a keyword set covering the energy strategy, the minister's name, and the primary policy options under parliamentary consideration.

Within 72 hours of monitoring commencement, Layer A detection flagged an anomaly: a cluster of Telegram channels with coordinated forwarding behaviour was amplifying a specific narrative framing — that the preferred policy option would make the country "dependent on foreign infrastructure" and "surrender energy sovereignty."

The sovereignty framing was not organic. It did not appear in mainstream media coverage, expert commentary, or opposition political discourse. It was being injected via a network of 23 identified Telegram channels, all with creation dates within an 8-week window approximately four months prior to our engagement start.

Network Analysis

Network graph analysis of the 23 channels revealed a clear hub-and-spoke structure: three originating channels (low subscriber counts, no verifiable ownership, creation dates clustered in a 14-day window) were sourcing content that five mid-tier channels were amplifying, which in turn was forwarded by 15 larger channels with established audiences.

The larger amplifying channels were not necessarily witting participants. Several were general political commentary channels whose operators were forwarding content that aligned with their existing political orientation without apparent awareness that they were part of a coordinated network.

DISARM tagging for the operation:

• T0007 — Identify Target Audience (policy-attentive citizens, energy policy adjacent)
• T0023 — Distort Facts (sovereignty framing misrepresenting technical infrastructure details)
• T0049.001 — Flooding: Coordinated Inauthentic Behaviour
• T0084 — Exploit Existing Narratives (sovereignty concerns are a legitimate and persistent political theme in the target country)
• T0086.001 — Amplification: Cross-Platform Laundering (content originated on Telegram, migrated to Facebook pages, appeared in comment sections of mainstream news sites)

Effect Measurement

V(x,t) scoring for the sovereignty narrative at the time of detection:

• Frequency score: 0.61 (elevated but not dominant)
• Sentiment polarity: –0.78 (strongly negative framing)
• Identity coupling: 0.82 (HIGH — sovereignty is a strong identity marker in this context)
• Amplification asymmetry: 0.91 (VERY HIGH — organic-to-coordinated ratio strongly skewed toward coordinated)
• V(x,t) composite: 0.74 ± 0.09 (95% CI)

The high identity coupling score was the most alarming finding. Sovereignty framing had successfully attached to existing in-group identity structures, meaning that factual counter-arguments alone would be insufficient and potentially counterproductive.

CWPI at Engagement Start

Baseline CWPI for the monitored information environment: 67/100 — elevated, indicating significant coordinated pressure, primarily driven by the energy policy narrative cluster.

95% confidence interval: 61–73. This interval excluded the lower half of the scale, confirming the signal was above noise threshold with high statistical confidence.

Recommendations and Counter-Narrative Design

Given the high identity coupling score, Retelnist recommended against direct factual rebuttal of the sovereignty narrative as a primary counter-measure. The recommended approach:

1. Immediate: Brief trusted independent voices (not government spokespeople) on the factual basis of the policy, with specific language guidance to avoid inadvertently reinforcing the sovereignty frame by repeating it in rebuttals
2. Short-term (2–3 weeks): Commission independently-branded explainer content addressing the underlying sovereignty concern as legitimate while providing accurate technical context — "your concern is valid; here is what the policy actually means for it"
3. Parallel: Flag the three originating hub channels to the national cybersecurity authority for investigation as potential foreign-interference infrastructure
4. Pre-bunking: Deploy Talantir inoculation scenarios targeting the artificial-social-consensus technique (the sovereignty narrative was using false consensus signals: "most experts agree this would undermine sovereignty" — factually false, but presented as consensus)

Outcomes

Four weeks after counter-narrative deployment and originating channel referral:

• V(x,t) for the sovereignty narrative: 0.31 ± 0.07 — reduced by 58% from detection baseline
• Identity coupling score declined from 0.82 to 0.54 — still elevated but no longer in the high-risk range
• Two of the three originating hub channels were taken down following the national authority investigation
• CWPI at engagement close: 42/100 — within normal range, down from 67

The parliamentary vote proceeded. The policy option passed with 61% support — broadly consistent with pre-operation polling baselines from earlier in the year, before the coordinated amplification campaign had begun.

Key Lessons

This engagement illustrates several principles that we observe consistently across deployments:

• Early detection (pre-scale) enables much more cost-effective counter-narrative work than response after wide saturation
• High identity coupling changes the counter-narrative strategy entirely — direct rebuttal frequently backfires
• Attribution to witting vs. unwitting amplifiers matters for response design; not all amplifiers are adversarial actors
• CWPI as a composite metric enables executive-level communication that does not require the decision-maker to understand the underlying technical methodology