This is a live investigation, documented at the moment of threat. It was presented at the Cambridge Disinformation Summit on 10 April 2026 as a real-time demonstration of Ariadne’s detection and prediction capabilities.

As delegates gathered in Cambridge, a coordinated false narrative was active in the UK information space. Ariadne had tracked it from its first seed weeks earlier — through three weeks of dormancy, through relaunch on a news hook, and into Phase 3: a 70% probability of national press coverage within days.

What Ariadne found

The target was a senior British public figure. The narrative: that they had betrayed the nation and its values. The source artefact was a fringe podcast — something that could be pointed to, that didn’t need to be believed, that just needed to exist.

Ariadne was monitoring 15 coordinated networks in the UK information space, with a combined regular reach of 6 million people. Eight of those 15 networks were active on this specific narrative. Four were running in violation of Meta’s own policies on coordinated inauthentic behaviour. In a single weekend, the narrative generated 220,000 engagements — the second most active UK disinformation narrative that month, behind a simultaneous pro-Iran campaign running on the same actor infrastructure.

The eight-step playbook

What makes this investigation significant beyond the individual case is what it reveals about methodology. Ariadne has tracked enough coordinated campaigns to identify a repeating operational pattern. Eight steps, consistent across targets and timescales, that separates a coordinated campaign from an organic one.

Steps one through three: a low-credibility source artefact is produced, pushed through domestic amplification networks, and the response is measured. Step four — dormancy — is the critical diagnostic tell. Organic narratives that fail simply die. Coordinated ones wait, sometimes for weeks or months, for conditions to improve. Step five is the hook: a real event that allows the stored narrative to be relaunched. In this case, the target did not perform a symbolic public act expected of their role. The networks didn’t create that absence. They waited for it, then weaponised it.

Steps six and seven follow: simultaneous multi-network relaunch, then international bot infrastructure to add volume and BJP-aligned Hindu nationalist accounts to add apparent authenticity. Step eight — press coverage — is where manufactured credibility becomes institutional credibility. This investigation was documented at the threshold of that step.

Three actor types, one campaign

Tommy Robinson and Reform Party networks provided direction and initial framing. Commercial bot farms, likely Vietnam-based, provided scale no organic campaign can generate. BJP-aligned Hindu nationalist accounts provided apparent authenticity — genuinely motivated participants whose ideological frame makes their coordination look organic. Each layer solves a different problem. Together, they produce something that looks like a genuine public mood.

The response window

At Phase 3, the window for response was open. That window closes at Phase 4, when press coverage converts manufactured credibility into institutional credibility. This investigation was documented to demonstrate exactly that interval: the gap between when Ariadne detects a threat and when it becomes irreversible.

Ariadne’s response capabilities at this phase included: formal platform referrals to Meta with documented evidence of the four networks violating coordinated inauthentic behaviour policies; evidence packages for legal and regulatory action; pre-emptive journalist briefings reaching the outlets most statistically likely to run the story; and actor attribution analysis using open-source methods to identify the specific individuals behind the coordination.

The full interactive report — including real-time network data, phase timeline, actor classification, and the seven-day outlook — is embedded below.