Case study liveApril 2026
Mayor of London
Three years. One fightback. Proof that it works.
Phase 1 — The ULEZ Operation
Ariadne detected bot farms targeting the Ultra Low Emission Zone (ULEZ) expansion debate. Account creation spikes were timed to the policy announcement and launch — not organic protest. £168K estimated minimum spend on X amplification proven. Paid operation confirmed.
The campaign began in 2022 with the announcement of London’s Ultra Low Emission Zone expansion. Ariadne detected a coordinated network of accounts — not organic public opposition, but infrastructure. Bot farms timed their account creation to ULEZ policy dates. The amplification was paid. The dissent was manufactured.
Ariadne calculated a minimum spend of £168,000 on X amplification alone. That figure wasn’t an estimate — it was derived from platform pricing models applied to the tracked amplification volume. For the first time, the Mayor’s team had a number they could put in front of a regulator.
The accounts didn’t disappear after the ULEZ vote. They went dormant. Ariadne kept tracking them.
Bot farms timed to ULEZ policy dates. A paid operation, not organic public dissent.
Phase 2 — Zombie Infrastructure
Ariadne detected 32 Facebook pages — each posing as a local community group for one London borough — all simultaneously switching their content focus from ULEZ to broader anti-Khan material on the same day. A genuine community network does not coordinate like that. Zombie infrastructure exposed.
The day after the 2024 Mayoral election, 32 Facebook pages simultaneously rebranded. Same day. Same hour. Content pivots, name changes, audience redirects — all coordinated. This wasn’t coincidence. It was pre-built infrastructure waiting for a political trigger.
Ariadne had been monitoring the behavioural signals for months. The simultaneous rebrand had been anticipated. When it happened, the evidence was already assembled. The Mayor’s communications team had a documented timeline before the press did.
This was the moment the operation moved from financial fraud — selling fake outrage — to something more structurally serious. The infrastructure was being repurposed. It would be used again.
32 Facebook pages simultaneously rebranding the day after the Mayoral election. Zombie infrastructure — pre-built and waiting.
Phase 3 — The Vietnam Network
Cambridge Disinformation Summit. Mayor publicly names the Vietnam AI farm, zombie infrastructure, and the outrage economy — all sourced from Ariadne. 7 major outlets. The evidence trail becomes the story.
The third discovery was the most significant. Ariadne traced a Vietnam-based AI content farm operating 42 pages with a combined following of 1.25 million. The farm was producing content targeting London — crime narratives, immigration narratives, anti-Mayor narratives — at scale, using AI-generated copy and coordinated posting schedules.
Meta confirmed Coordinated Inauthentic Behaviour. The network was taken down. Ariadne’s evidence went to Ofcom as part of a broader briefing framing disinformation as an Online Safety Act market failure — not just a platform moderation problem, but a regulatory one.
In April 2026, the Mayor named the network publicly at the Cambridge Disinformation Summit. He named Vietnam. He named the outrage economy. He named the 32-page rebrand. The speech was covered by seven major outlets. It was the first time a sitting politician had used AI-verified disinformation intelligence to make a public attribution at that level of specificity.
Ariadne gave him the evidence to do it.
A Vietnam-based AI content farm: 42 pages, 1.25 million followers, CIB confirmed.
The scale of the attack
Rise in narratives describing London as dangerous — March 2024 to March 2026. Not opinion shifts. Manufactured.
Rise in content blaming immigrants for a crime surge — same window. Ariadne tracked both from their first seed event.
What Ariadne made possible
London became the first city in the world to mount a public, AI-powered fightback against coordinated disinformation infrastructure. Ariadne gave the Mayor the evidence to name what he was seeing — not speculation, but documented, platform-referred proof.
Naming the outrage economy — publicly, with evidence
Ariadne’s monetisation analysis gave the Mayor specific, documented language: the “outrage economy” and the “division dividend.” When the Mayor used these terms at Cambridge, he had the data behind them. Named infrastructure is harder to deny than a political grievance.
Prebunking zombie infrastructure before it could be reused
The 32-page simultaneous content switch gave the communications team enough evidence to publicly call out the network as pre-existing infrastructure — before it could simulate genuine grassroots activism in future campaigns. Naming it publicly was the response.
Vietnam AI farm: named in a major speech, reported globally
Ariadne traced a Vietnam-based operation — 42 Facebook pages, 1.25 million followers, AI-generated content used as an audience hook then injected with far-right material. The Mayor cited it directly at Cambridge. The Guardian and FT led on it. That attribution only held because the underlying evidence was solid.
The coverage
Three years. Eleven major outlets. Ariadne data in every story.
- Guardian
- Bloomberg
- Vice
- Politico
- FT
- Times
- Independent
- Spectator
- Telegraph
- Channel News Asia
- Cambridge Summit coverage
“The same people attacking the capital have already started targeting other cities around the world. And in a few years’ time I think we’ll look back on London as the canary in the coalmine. But I hope we’ll also see it as the place where the fightback began.”
Sadiq Khan — Mayor of London, Cambridge Disinformation Summit, April 2026
Detect. Predict. Respond.
This case proves all three.
- Mapped account creation spikes to ULEZ policy dates — months before press pickup
- £168K estimated minimum spend on X amplification calculated and attributed. Proved the operation was paid, not organic dissent
- Vietnam AI content farm traced from account-level behavioural signals. 42 pages, 1.25M followers, CIB confirmed
- All 15 UK disinformation networks identified and held in continuous scope from January 2026
- ULEZ accounts tracked through 12 months of dormancy — when they repurposed, the pattern had already been flagged
- The 32-page simultaneous content switch anticipated from post-election account behaviour. Coordinated infrastructure signals its intentions
- Monetisation model identified and documented before the Mayor named it publicly
- Counter-narrative intelligence packages built for the Mayor’s communications team — evidence to name networks publicly, not make political accusations
- Ofcom briefed with monetisation data, framing disinformation as an Online Safety Act market failure — a regulatory lever beyond voluntary compliance
- Zombie infrastructure prebunked before it could simulate grassroots activism in future campaigns
- Attribution evidence that let the Mayor name Vietnam, the outrage economy, and the 32-page network at Cambridge — reported by 7 major outlets