Israel-Hamas War on X: A Case Study of Coordinated Campaigns and Information Integrity

Abstract: Coordinated campaigns on social media play a critical role in shaping crisis information environments, particularly during the onset of conflicts when uncertainty is high and verified information is scarce. We study the interplay between coordinated campaigns and information integrity through a case study of the 2023 Israel-Hamas War on Twitter (X). We analyze 4.5~million tweets and employ established coordination detection methods to identify 11 coordinated groups involving 541 accounts. We characterize these groups through a multimodal analysis that includes topics, account amplification, toxicity, emotional tone, visual themes, and misleading claims. Our analysis reveal that coordinated campaigns rely predominantly on low-complexity tactics, such as retweet amplification and copy-paste diffusion, and promote distinct narratives consistent with a fragmented manipulation landscape, without centralized control. Widely amplified misleading claims concentrate within just three of the identified coordinated groups; the remaining groups primarily engage in advocacy, religious solidarity, or humanitarian mobilization. Claim-level integrity, toxicity, and emotional signals are mutually uncorrelated: no single behavioral signal is a reliable proxy for the others. Targeting the most prolific spreaders of misleading content for moderation would be effective in reducing such content. However, targeting prolific amplifiers in general would not achieve the same mitigation effect. These findings suggest that evaluating coordination structures jointly with their specific content footprints is needed to effectively prioritize moderation interventions.

• The paper reveals that coordinated campaigns on X predominantly rely on retweet-based amplification, often exceeding 95% activity.
• The study employs a multimodal detection pipeline combining network analysis and claim-level assessments to identify 11 coordinated groups.
• Findings show that behavioral proxies like toxicity and emotion are insufficient, necessitating integrated approaches for effective moderation.

Coordinated Campaigns and Information Integrity During the 2023 Israel-Hamas War on X

Introduction

The study "Israel-Hamas War on X: A Case Study of Coordinated Campaigns and Information Integrity" (2604.10566) presents an extensive analysis of coordinated information operations on Twitter (now X) during the onset of the 2023 Israel-Hamas war. The authors perform a multimodal characterization of 4.5 million tweets, focusing on the detection, structure, and content of coordinated campaigns and their relationship with information integrity. Integrating coordination network analysis with claim-level assessment and behavioral signals, the paper elucidates the disconnect between coordination structure and misinformation risk, providing actionable implications for online moderation and integrity interventions.

Methodology: Multimodal Coordination Detection Pipeline

The analysis leverages a large dataset of tweets related to both Israeli and Palestinian topics, spanning September to December 2023. Coordination detection employs the framework in [pacheco2021uncovering], targeting five indicator types: co-retweet, co-hashtag, co-URL, co-token, and co-image sharing. Account similarity networks are constructed via TF-IDF-based cosine similarity of indicator engagement, with stringent edge-retention to isolate meaningful behavioral overlaps.

Figure 1: Overview of the multi-indicator coordination detection pipeline, identifying user groups via co-amplification and content similarity.

Near-duplicate images are grouped using BLIP-2 embeddings and a manual Euclidean distance threshold for high-precision deduplication, yielding 0.98 precision at a threshold of 10.

Figure 2: Precision versus Euclidean distance threshold in BLIP-2 embedding space, showing high accuracy for duplicate image identification.

The five similarity networks are merged, and connected components with at least six nodes are retained, resulting in 11 coordinated groups (n=541 accounts). Components primarily manifest as either co-retweet or co-token (copy-paste) networks, reflecting dominant low-complexity coordination tactics.

Structural and Content Characterization of Coordinated Components

Each detected component is interrogated along multiple modalities: dominant narratives (log-odds keyword analysis), retweet targets, tweet type distribution, toxicity (Perspective API), emotion (Ekman/BERT model), and image themes (BLIP-2 cluster KL divergence).

Behavioral Signatures

The vast majority of activity within coordinated groups is retweet-based, often exceeding 95%, with original content or reply activity being minimal and group-specific.

Figure 3: Distribution of tweet types in each coordinated component, highlighting retweet dominance in most groups.

Retweet concentration analysis reveals that each group amplifies a narrow, largely non-overlapping cluster of accounts, with little penetration into organic user engagement networks.

Figure 4: Most retweeted accounts in each component, with coordination reliance capturing the amplification's dependence on coordinated accounts.

Image cluster analysis indicates strategic use of visual symbols: leader portraits, humanitarian graphics, political memes, and protest imagery are variably emphasized across groups.

Figure 5: KL-divergence-based image cluster distributions for large coordinated components, evidencing divergent visual narratives and symbolic repertoire.

Topic and Narrative Differentiation

Topical log-odds analysis and manual synthesis reveal strong narrative compartmentalization across components. Some—e.g., the largest "Khamenei" group—are anti-Zionist, retweeting Iranian elites with high frequency. Others represent advocacy (e.g., humanitarian ceasefire, NGOs), or localized misinformation clusters (e.g., Indonesian language aggregator, anti-Iran security, Hindi fact-checking).

Assessment of Misleading Content

Claim-level analysis targets the 191 highest-amplified posts, using GPT-5.2 classification and human verification. Only 12 are classified as misleading, forming three thematic claim families:

• C1: Hospital explosion attribution and "deleted evidence"
• C2: False survival of Shani Louk
• C3: Mis-captioned “staged” Al Jazeera footage

Critically, 100% of misleading claims are concentrated in only 3 of 11 coordinated groups, with the rest largely focused on advocacy, humanitarian, or community solidarity narratives.

Correlation Analysis: Toxicity, Emotions, and Misinformation

Toxicity (Perspective API) and emotion (multilingual BERT, Ekman scheme) are computed at the user level for each group and baseline. Components stratify into:

• High-toxicity/inflammatory (e.g., "Khamenei", "SoftWarNews", "HuT")
• Low-toxicity/neutral (e.g., "DFRAC" fact-checking—even with high misinformation output)

No significant monotonic correlation is observed between the presence of misleading claims and aggregated toxicity or emotional intensity at the component level ($r_s \approx 0$). Notably, high-integrity-risk components are not reliably detected via toxicity or emotion-based proxies, and vice versa—a key negative result.

Moderation Efficacy: Targeted Takedown Simulation

A targeted removal analysis simulates two moderation scenarios: (1) perfect oracle knowledge of misleading content spreaders, and (2) heuristic removal of top amplifiers by volume.

Figure 6: Top-$k$ amplifier removal; coordinated misleading retweet action removals plateau unless retweeters of known-misleading posts are precisely targeted.

Between 5–30 selected accounts, up to 37% of misleading retweet actions (and full suppression of 5/12 misleading posts) are mitigated under scenario 1, but zero misleading posts are entirely suppressed under heuristic-driven account removal. This demonstrates that intervention based on activity alone is grossly insufficient for integrity preservation.

Theoretical and Practical Implications

Fragmentation of the coordination network precludes one-size-fits-all countermeasures. Integrity risk (i.e., the actual spread of misinformation) is structurally compartmentalized and not strictly associated with coordination, toxicity, or affect. This finding further divorces network structure-based detection from integrity-intervention relevance.

For platform trust and safety, resource allocation should focus at the intersection of coordination and content-level risk, only targeting groups with convergent evidence of amplification and misinformation. Retweet and copy-paste-based coordination continues to be the principal vector for the diffusion of both legitimate advocacy and risk content, but neither network structure nor behavioral proxies suffice for integrity triage.

For the AI/DS research community, the study exemplifies the necessity of joint network-content frameworks for operational moderation, and the need for continuous improvements in claim-level integrity assessment—preferably automatable, but with human verification loops.

Future Directions

• Expansion beyond single-platform (X/Twitter) and single-conflict windows to assess generalizability of fragmentation and decorrelation phenomena.
• Advancement of automated claim-level maliciousness detection and explainable moderation algorithms, informed by narrative, language, and visual signal fusion.
• Cross-modal and cross-platform spillover tracking at the coordinated-group resolution.

Conclusion

This work provides a systematic, data-rich empirical examination of coordinated campaigns during crisis-driven information disorder. The decoupling of network structure, behavioral toxicity/emotion, and content integrity risk is robustly validated. Effective moderation efficacy is contingent on integrating coordination structure with claim-level forensic evidence, rather than relying on structural or behavioral proxies alone. These insights refine both operational moderation pipelines and methodological approaches for studying adversarial information environments in digital conflict.

(2604.10566)