How to read a takedown report

The parts of a Meta network entry

Meta defines coordinated inauthentic behaviour as coordinated efforts to manipulate public debate for a strategic goal, in which fake accounts are central ¹. It says it focuses on behaviour, not content, no matter who is behind an operation or whether it is foreign or domestic ¹.

Each network summary in the Q1 2024 report uses headings such as "Presence on Facebook and Instagram" and "Followers", and some add ad spend ¹. The appendix sorts indicators by stages of Meta's Online Operations Kill Chain, such as acquiring assets, disguising assets and evading detection ¹.

• Origin: the country where Meta found the network originated ¹
• Targets: the audiences the content was aimed at ¹
• Presence: counts of Facebook accounts, Pages, Groups and Instagram accounts removed ¹
• Followers and ad spend: approximate figures written as "about" ¹

Reading follower and size figures

Follower counts measure accounts that followed a Page or account, not people reached. Meta said one network in its Q2 2024 report had about 32,000 Page followers, including inauthentic accounts in Brazil that suggest purchased engagement ². In the same report Meta urged that these threats be reported with caution ².

Figures can differ inside one report. Meta's Q1 2025 report gives about 40 Instagram followers for a Romania network in the main text and about 35 in the appendix ³. When two figures differ, cite both with their location.

Impact scores

The Breakout Scale was published by the Brookings Institution in September 2020 as a model for comparing influence operations ⁶. Category One is spread in one community on one platform. Category Four is breakout to mainstream media. Category Six is a policy response or a call for violence ⁶.

OpenAI uses the scale in its reports. In May 2024 it said none of five operations scored above Category Two ⁵.

Google bulletins and EEAS counts

Google's TAG bulletins list coordinated influence operation campaigns terminated on its platforms each quarter, month by month ⁷. Entries give an origin, such as "Russia" or "a Russian consulting firm", and counts of YouTube channels, Blogger blogs, ad accounts or domains ⁷. A blocked domain loses eligibility to appear on Google News surfaces and Discover, which is a restriction rather than an account termination ⁷.

EEAS reports count incidents, not removed accounts. The 3rd report classes channels from state official to state-aligned and says its data is a limited subset that should not be used to draw conclusions about general trends ⁸.

Threat indicators and attribution

Meta publishes threat indicators, such as domains and account identifiers, in its GitHub repository under the MIT License ⁴. It says sharing an operation's links or interacting with them would not be enough to attribute accounts to a campaign without corroborating evidence ^4,1.