A platform takedown report is powerful evidence.
It is also a spotlight, not a census.
When a company such as Meta publishes details about a coordinated inauthentic network it removed, researchers get something unusually valuable: linked accounts, attributed operators, tactics, geographic targets, fake entities, and sometimes cross-platform behavior.
That is far stronger than staring at suspicious posts and guessing.
The mistake is assuming the published cases represent everything that exists.
Takedown reports show detected operations
Meta’s adversarial-threat reports describe networks the company investigated and removed for behavior such as coordinated inauthentic activity, cyber espionage, or coordinated abusive reporting.
In its Q1 2023 report, Meta described six coordinated inauthentic behavior networks and noted that some ran fictitious media organizations, NGOs, and other entities across multiple platforms. See Meta’s Q1 2023 Adversarial Threat Report.
That is useful evidence about those specific networks.
Meta also states in the report itself that its public threat reporting is not meant to reflect the entirety of its security enforcements. The published material emphasizes notable investigations and trends. See the full Q1 2023 report.
That sentence matters enormously.
Detection creates a selection effect
A campaign that gets caught is observable.
A campaign that is never detected is missing from the dataset.
A campaign that is detected but not publicly described may also be missing.
Platforms differ in what they investigate, what data they possess, which policies they use, how much detail they publish, and how often they release reports.
So counts such as twelve networks removed this year cannot safely be translated into there were twelve networks this year.
The first number is an enforcement statistic.
The second is a prevalence claim.
They are not interchangeable.
Reports are strongest for tactics and attribution
Researchers can use takedown reports to study:
- fake personas and fictitious organizations,
- shared account administration,
- cross-platform expansion,
- purchased engagement,
- coordinated reporting,
- geographic targeting,
- links to companies, governments, PR firms, or other operators when the platform documents them.
They are much weaker for estimating how much manipulation remains undetected.
A 2026 IISS analysis compiled hundreds of disclosed takedowns across Meta, Google, and TikTok and used them to study persistent patterns in inauthentic activity. That kind of aggregation can reveal recurring tactics, but it still begins from platform disclosures rather than an omniscient view of the internet. See IISS’s analysis of platform disclosures.
The absence of a takedown proves very little
If a platform never reports a campaign, several explanations remain possible.
The campaign may not exist.
It may exist but remain undetected.
It may have been detected under a different policy.
It may have been handled quietly.
Or it may operate mostly somewhere else.
Manufactured Consensus research needs platform reports because they provide rare, documented cases with internal evidence.
It also needs humility about the dark space around them.
A takedown report tells us what the platform found.
It does not tell us everything that was there.