Fake News Detection and Cognitive Warfare Monitoring System

An edited image, a spliced video clip, or a set of similar posts appearing at the same time may be relayed across platforms and messaging app groups. The InfoMiner fake news detection and cognitive warfare monitoring system continuously collects public cross-platform content and flags suspicious signals based on narratives, account behavior and spread leads, as a reference for analysts' verification. Whether something can be detected in the early stage of spread depends on the scope of data access and analysis conditions.

Three dimensions for assessing monitoring needs

If your unit currently finds, verifies and clarifies items one by one, you can use the following three dimensions to assess whether narrative and spread analysis needs to be added.

1. Speed of spread: response timing depends on how the spread actually unfolds

False information may spread quickly across platforms, or it may circulate within a small circle for a long time, so how quickly to respond should depend on how it is actually spreading. If suspicious leads can be seen while the spread curve is still flat, case officers keep more options to observe, prepare or respond; whether something can be detected early depends on data access and analysis conditions.

2. Cross-platform relay: spread leads may be scattered across different platforms

The same narrative may travel across platforms in different forms, such as forum posts, image cards and short videos. Cross-platform data may add spread leads that a single platform cannot show, such as where it appeared earlier in the observable data; but temporal order does not imply causation, and whether amplification relationships exist between nodes still needs to be verified separately.

3. Manipulation does not always rely on false content

The Information Disorder report, written in 2017 by Wardle and Derakhshan for the Council of Europe, divides information disorder into three types: misinformation, disinformation and malinformation, the last being genuine information used to cause harm. It also argues that the term fake news is inadequate to describe these phenomena. Selective amplification, quoting out of context and emotional mobilization cannot always be handled by checking whether something is true, so monitoring has to look at content, account behavior and spread structure together.

Common approaches each answer a different question, and they can be used together:

The table above sets out where each approach applies; none is better than the others. You can choose based on the questions your unit needs to answer and the data available to it. Whichever you use, a degree of suspicion is not a determination of truth or an attribution conclusion. Whether to respond publicly can be weighed together with the scale of the issue, the spread trend, the public interest and the form of response.

How to review suspicious narratives

Monitoring tools provide leads; judgment still rests with people. The following are general practices you can refer to when reviewing suspicious narratives and accounts.

Merge similar claims while keeping the original sources

The same claim may be reposted with a new headline, a redesigned graphic or a different opening. Grouping semantically similar content together reduces duplicate review, but merging is probabilistic, and similar claims with opposite positions may be grouped together, so reviewers should go back to the original source of each item to confirm.

Look at behavior, not just content

Coordinated inauthentic behavior (CIB) is a term Facebook (later renamed Meta) has used in its policy explanations and reports. Its 2020 CIB report defines it as coordinated efforts to manipulate public debate for a strategic goal, with fake accounts at the core of the operation, and explains that such networks are taken down based on their behavior, not the content of their posts. When assessing it, note that spontaneous mobilization by fans, synchronized publishing by media outlets and PR campaigns can also show similar timing and content patterns; a degree of suspicion is not a finding of manipulation. For the definition and how to identify it, see What is coordinated inauthentic behavior? Troll farms, paid posters and bots explained.

Verification and response are decided by the responsible staff

Verification can start by checking the original source, confirming facts with the relevant business unit, and referring to results already published by fact-checking organizations. Whether and how to respond is decided by the responsible staff based on the scale of the issue and the public interest; where legal proceedings are involved, separately confirm the evidence preservation and forensic methods required.

Corresponding InfoMiner capabilities

InfoMiner continuously collects public data, performs real-time intelligence assessment and produces suspicious leads for human verification. Below is an overview of its capabilities, each with prerequisites and limitations; actual coverage depends on the plan and licensing.

The adoption timeline is assessed based on data scope, deployment environment and customization requirements. For the full feature set, see InfoMiner Social Listening.

Capability limits and contract considerations

In procurement, avoid listing a determination of truth or attribution of actors as a deliverable that has not been agreed on. Monitoring can show that a claim is heating up and on which platforms it appears, but it cannot determine whether the claim is true or false. Assessment of coordinated behavior relies on data that is publicly visible on platforms, and spontaneous mobilization by fans or synchronized publishing by media outlets may show similar characteristics. Assessment of video and deepfakes may be affected by re-encoding, compression and screen recording. Private messages and non-public groups are out of scope. Custom requirements, applicable conditions and feasibility must be assessed separately.

We recommend stating explicitly in the contract that the system makes no final determination of truth and provides no final attribution conclusion. In the FIMI threat reports it has published since 2023, the EEAS (European External Action Service) describes foreign information manipulation and interference as an intentional and coordinated pattern of behavior, whose actors may be state or non-state actors and their proxies; attribution requires a separate assessment of the strength of the evidence and of alternative explanations.

Deployment and data governance

Disinformation monitoring involves two kinds of data: publicly posted content collected by web crawlers, and the unit's internal assessment records and verification conclusions. Both may contain personal data or sensitive information, so access permissions, retention periods and deployment location should be set separately according to content and purpose.

• Data hosting location：InfoMiner data servers are located in Taiwan.
• On-Premise：Assessment records, internal knowledge and report generation can use an on-premise RAGi deployment; whether any data is transmitted externally must be confirmed based on the chosen model and integration configuration.
• Procurement channels：InfoMiner can be procured through the government Joint Supply Contract, with eligible items confirmed against the current contract; custom items are assessed separately according to requirements.

RAGi Enterprise AI Retrieval-Augmented Generation Engine

The limits of monitoring: freedom of speech and personal data

Monitoring aimed at analyzing narratives and behavior patterns may still process data that can identify individuals; being publicly visible does not mean personal data is not involved. Before adoption, the legal and business units can confirm the legal basis and necessary scope of collection, processing and use, as well as retention and deletion periods, and restrict results to purposes defined in advance. Monitoring looks at messages and behavior patterns; it does not pass judgment on speech for the positions it takes.

Laws that may be involved in handling

If a verification conclusion is to be referred or reported, the provisions on spreading rumors in the Social Order Maintenance Act, the Disaster Prevention and Protection Act and the Civil Servants Election and Recall Act may be involved; for a summary of the provisions, see What is cognitive warfare? How it differs from fake news, information manipulation and FIMI. Each of these laws has different elements of the offense: whether content is true or false is judged by fact-checkers based on evidence, and whether it is unlawful is determined by the competent authority in accordance with the law; being judged false does not mean being unlawful.

Use Cases

Scenario 1: government agency spokesperson and public sentiment units

Agencies can watch for suspicious narratives involving public rights and interests, public services and policy explanations. Suspicious leads can serve as a reference for human verification; whether and when to respond is decided by the responsible staff based on the scale of the issue and the public interest. After a clarification is issued, you can observe whether public discussion changes: if the clarification is only reposted within official accounts while the original narrative keeps growing on other platforms, consider changing the publishing channel or the way it is explained.

Scenario 2: critical infrastructure operators

Operators of power, water, transportation and communications can watch for suspicious claims about service outages, quality or contamination. Such messages relate to actual operating status, so suspicious service information must be verified by the responsible staff before deciding whether to issue an explanation. For general crisis communication practice, see Public sentiment crisis SOP: a 7-step PR crisis guide.

Scenario 3: election authorities and local governments

During elections, you can watch for suspicious content about the voting and vote-counting process, election operations, and content that impersonates candidates' words and actions. Voting day for Taiwan's 2026 local elections is November 28. Monitoring must be politically neutral and focus only on the types of messages that affect election procedures, and suspicious content must be verified by people. To gauge the overall level of public discussion, LargitData also offers 2026 Taiwan Election Lab, a public volume dashboard covering all 22 counties and cities in Taiwan. For a pre-election task checklist, see How to monitor election disinformation: a task checklist for the 60 days before the election.

Evaluation and acceptance

Before comparing metrics such as accuracy, align the datasets, labeling criteria and sample distribution. For evaluation, you can backtest several public incidents that have already concluded, compare when different methods detected them, and record cases that could not be detected early or where data could not be obtained, then use this to identify which items need tuning. Adoption scope, timeline and evaluation method must be confirmed separately.

10 questions to ask when evaluating vendors

The evaluation should confirm data scope, assessment workflow and interface operation together. We recommend asking vendors to answer in writing:

1. Source list: which platforms can be monitored? Which are collected in-house and which are obtained under license?
2. Gap notification: when a platform changes its layout, how will we know which segment of data is incomplete?
3. Cross-platform merging: when the same narrative is rewritten and reposted, how is it deduplicated and merged?
4. Narrative clustering evaluation: which datasets and labeling criteria are used? When clustering is wrong, can analysts split or merge clusters?
5. Basis for coordination assessment: which fields are used when flagging suspected coordination? Can they be shown to analysts?
6. Handling false alarms: how is normal coordinated behavior excluded? Can false alarms be fed back to adjust the system?
7. Multimodal scope: what are the conditions and limitations for image, video and deepfake detection?
8. Explainability: can the reason each suspicious lead was flagged be explained?
9. Evidence retention: can original links and capture times be preserved? How is this handled once the original post is deleted?
10. Attribution stance: does the vendor claim it can determine truth or identify actors? On what basis?

We recommend writing the tenth question into the contract: suspicious signals should not be presented directly as verification or attribution conclusions, and the basis for any use in public statements or legal matters must be confirmed separately.