The Intelligence Playbook.
Coordinated comment campaigns are not new and they are not improvised. They are written down — in government training slides, leaked documents, declassified files, and decades of academic research. This is a document bank: the primary sources, the named tactics, and how to read them. Self-directed. No account, no opinion, no permission required.
JTRIG: revealed through the Snowden leaks (2013–2014)
In February 2014, Glenn Greenwald published a classified GCHQ training presentation from the Snowden archive in The Intercept. It was called “The Art of Deception: Training for a New Generation of Online Covert Operations” and it was classified SECRET//SI//REL TO USA, FVEY — shared across the Five Eyes intelligence alliance: the UK, US, Canada, Australia, and New Zealand.
What the unit was for, in its own words
VerifiedThe presentation came from a GCHQ unit called the Joint Threat Research Intelligence Group, or JTRIG. According to its own slides, JTRIG had two core purposes: injecting false material onto the internet to destroy the reputation of targets, and using social sciences to manipulate online conversations and activism to produce outcomes the government considered desirable. That is GCHQ’s own description of what they were doing.
The slides laid out what they called a “Disruption Operational Playbook” — infiltration operations, ruse operations, set piece operations, false flag operations, false rescue operations, disruption operations, and sting operations. They also named tools: UNDERPASS manipulated online polls; SLIPSTREAM inflated page-view counts; GESTATOR amplified approved YouTube content; SILVERLORD censored videos flagged as extremist; SPRING BISHOP found private Facebook photos; CHANGELING spoofed email addresses so messages appeared to come from someone else.
By early 2013, over 150 JTRIG staff were fully trained, and a separate initiative was rolling out a reduced version of the tradecraft to more than 500 other GCHQ analysts. “Targets” in these documents does not just mean terrorists or hostile nations: Greenwald pointed out that many techniques were discussed in the context of using them against people suspected but not charged with ordinary crimes, or engaged in online protest — people who had never been arrested or convicted of anything.
COINTELPRO: the FBI’s programme (1956–1971)
In 1956, the FBI set up COINTELPRO — Counter Intelligence Program. It was aimed at civil rights organisers, anti-war groups, and communist-affiliated organisations inside the United States. The Church Committee, the US Senate investigation that uncovered it, found the FBI started it partly out of frustration that the Supreme Court kept limiting what they could legally do to these groups. So they stopped doing things legally.
What it did, and how it surfaced
VerifiedFor fifteen years, COINTELPRO ran operations to damage people’s public image through surveillance and leaking personal information, manufacture conflicts between members of the same organisations, plant forged documents and anonymous letters to create distrust, and send agents into groups to encourage illegal activity that could then be used to discredit everyone involved.
Nobody outside the FBI knew any of this until 8 March 1971, when a group of activists broke into an FBI field office in Media, Pennsylvania, took the files, and posted them to journalists. The Senate formed the Church Committee to investigate. They spent sixteen months on it — 800 witnesses, 110,000 documents. The final report came out in April 1976 across six volumes and found that FBI domestic intelligence had violated both specific laws and constitutional rights.
Cass Sunstein’s “cognitive infiltration” (2008)
In 2008, Cass Sunstein — who later became an adviser in the Obama administration — co-authored a paper proposing that governments should “cognitively infiltrate” groups that produce conspiracy theories by placing covert agents and people who appear to be independent advocates into online forums, chat rooms, and social networks.
The argument, and the obvious problem
VerifiedThe argument was that conspiracy theorists suffer from a “crippled epistemology” — they only hear one set of voices — and the fix was to introduce “informational diversity” from the inside. Not by publicly debating them. By secretly placing people among them.
The obvious issue, which critics raised straight away, is that if people in those groups ever discovered the infiltration, it would confirm the exact conspiracy they already suspected. A paper proposing the government secretly place agents in people’s conversations to change what they think is a difficult thing to walk back once people find out about it.
The 10 Principles of Influence
The JTRIG “Art of Deception” presentation lists ten principles for manipulating targets online. These are what GCHQ trained its staff to use. The keystone is Flattery — and it maps directly onto the “I usually love your work, but…” pattern. Select any principle to read what the slides say it does.
The Manufactured Doubt playbook
The comment patterns on political-education content follow the same logic as a strategy well-documented in the tobacco, fossil fuel, and pharmaceutical industries. It is called manufactured doubt, and it has four steps. The goal is never to win the argument — it is to create just enough hesitation in a casual viewer that they scroll on.
Deny
“That is not what really happened.”
Delay
“Where is your source for that?” — where the point is not to learn but to slow everything down.
Dilute
“It is more nuanced than you are making it.”
Discredit
“You are usually good, but this one is off.”
The Center for International Environmental Law traced this strategy from the tobacco industry’s response to cancer research in the 1950s through to the fossil fuel industry’s handling of climate science, and found the approach barely changed across decades and industries. You do not need to refute the content. You just need to make the audience hesitate.
The tactics, and how to spot them
Five named tactics. Tap any one to open it. Each carries its own primary sources.
Concern Trolling
Opposing an idea while pretending to support it.
Concern trolling sounds sympathetic. “I just worry this could give people the wrong idea.” “I love your work, but this one might hurt your credibility.” “I am on your side, but you should know people are saying…”
The intent is to plant doubt while maintaining the appearance of being a friend. It creates emotional confusion for the creator and uncertainty for the audience, which is the whole point — someone reading the comments cannot easily tell whether this person is a supporter with a genuine concern or an operator running a script.
Sealioning
Relentless, polite demands for evidence designed to exhaust.
In September 2014, cartoonist David Malki published a strip on Wondermark called “The Terrible Sea Lion.” A character says she does not like sea lions and a sea lion immediately appears, following her everywhere — into her home, into her bedroom — politely but relentlessly demanding she justify her opinion. It never stops. It never accepts an answer. The comic went viral and “sealioning” became the word for this kind of trolling. Merriam-Webster tracks it now, describing it as pursuing people with persistent requests for evidence while pretending to be sincere and civil.
The trap has three parts. If the target ignores the questions, the sealioner tells the audience the target cannot defend their position. If the target engages, they get gradually worn down, and if they eventually lose patience, the sealioner presents themselves as the calm and reasonable one. And if the target makes even a small error under that sustained pressure, the sealioner uses it as proof the entire position is wrong.
The “Both Sides” / “You Are Biased” Reframe
Shifting from “here is evidence” to “why are you not balanced?”
This one turns up in nearly every comment section on political-education content. The commenter says other issues are more important, or both sides are equally bad, or the creator is biased. The goal is to shift the conversation from “here is evidence” to “why are you not being balanced?” — which turns political education into a performance where you have to prove you are fair rather than prove you are accurate.
The Institute for the Future studied state-sponsored trolling across multiple countries — Azerbaijan, Bahrain, Ecuador, the Philippines, Turkey, the United States, and Venezuela — and found this pattern everywhere. They also found that trolls frequently accuse their targets of the very behaviour the operation is engaged in. If you are exposing propaganda, they call you the propagandist. If you are presenting evidence, they say you are spreading misinformation.
Swarm and Replace
Block one account, another appears — manufactured consensus.
When one account gets blocked, another appears using similar language, sometimes referencing the block directly — “she is deleting comments, what is she hiding?” A study published in PLOS ONE in 2022 found that coordinated inauthentic behaviour campaigns consistently leave similar traces no matter which country they operate in. The “swarm” effect makes it look like many different people independently disagree when it is actually a small number of operators cycling through accounts.
False Flag Operations
Posting material and falsely attributing it to someone else.
JTRIG listed false flag operations as a core tactic in its training slides — posting material to the internet and falsely attributing it to someone else; creating content that appears to come from within a movement to discredit it; impersonating supporters to make them look extreme. Greenwald reported in The Intercept that JTRIG described using false flag operations, fake victim blog posts, and posting negative information on forums as established methods.
Why some topics draw more
Some political topics — particularly communism, socialism, and anti-capitalist analysis — attract more coordinated hostility than others. There are structural reasons, and they are on the record.
The historical frame
VerifiedCOINTELPRO was created in 1956 specifically to target communist-affiliated groups; the Church Committee confirmed this. Anti-communist disruption is where US domestic intelligence began, and a lot of the infrastructure built during the Cold War never fully dismantled. US international broadcasting, for instance, was explicitly designed to counter communist ideology — not just through news reporting but through direct ideological challenge — and that framing shaped institutions and professional cultures that are still around.
The current framework: the Bondi / NSPM-7 memo
VerifiedIn December 2025, US Attorney General Pam Bondi issued a memorandum directing the FBI and all federal prosecutors to compile lists of groups engaged in what the administration defines as domestic terrorism. The memo was leaked by investigative journalist Ken Klippenstein and subsequently confirmed by the Department of Justice to Snopes. It identifies “anti-capitalism” and “anti-Americanism” as indicators of potential domestic terrorism, alongside opposition to immigration enforcement, “radical gender ideology,” and “hostility towards traditional views on family, religion, and morality.”
The memo directs the FBI to compile and update a list of these groups every 30 days, establish a cash reward system for tips from the public, and create cooperators to testify against members of targeted organisations. In February 2026, The Intercept reported that Attorney General Bondi confirmed to Congress that the list exists, while refusing to share it. There is now a formal framework within the US government under which discussing communism favourably sits alongside other views classified as indicators of potential domestic terrorism.
The industrial scale of it
VerifiedOn the platform side, research from the Oxford Internet Institute found that social media manipulation by political actors has become an industrial-scale problem. Their 2020 survey found organised manipulation campaigns in all 81 countries studied, up from 70 the previous year. Governments, PR firms, and political parties are producing misinformation at scale. The researchers found more than 65 private firms offering disinformation as a paid service, and documented nearly $60 million spent on hiring them since 2009.
How it works in comment sections
The tactics above rarely appear alone. In practice they assemble into a sequence.
A seed account builds credibility first — normal posts, normal follows, a profile that looks like a real person. On Instagram this tends to be more developed than on TikTok, where the accounts are often blank. The account sits quietly until the creator publishes something about a sensitive topic.
Then the Flattery principle comes out: “I usually love your content, but…” — which, if you have read the JTRIG slides, is a trained influence technique designed to construct credibility for the commenter before they deliver the doubt. If the creator responds, the commenter shifts to sealioning — endless requests for sources, insistence on balance, reframing away from the original point. If the creator blocks instead, new accounts arrive, sometimes directly referencing the block. And throughout, coordinated engagement from other accounts in the network pushes the doubt-sowing comment higher in the algorithm so more casual viewers see it.
The operation does not need to convince anyone that the creator is wrong. It just needs enough casual scrollers to hesitate for a second before they move on.
How to spot it, as an audience member
These operations rely on audiences not knowing what they are looking at — which means that once you do know, a lot of the effect disappears.
Check the commenter’s profile
Does the account have a life? Any pictures of their dog, complaints about the weather, opinions about food — or does it only appear in comment sections on specific political topics?
Look for the template
“I usually love your work, but…” is a script. Genuine disagreement tends to be specific. Real people who disagree will usually say what they disagree with and bring their own evidence rather than offering vague doubt.
Check whether the comment engages with actual evidence
Does the commenter reference a specific claim and offer counter-evidence — or do they say “this is not accurate” or “you need to do more research” without ever saying what is inaccurate or what research they mean?
Notice the swarm
If blocking one account leads to another immediately saying “she is deleting comments,” that is coordination. Keep blocking them. Hold the line; let the debate occur elsewhere, among real adults who are respectful and genuine.
Do not engage the sealion
Responding with evidence gives the troll more material to work with. The point is not to learn. Name the tactic if you want, and move on.
Screenshot and document
Save comment patterns, account names, and timestamps. A single suspicious comment could be anything. Twenty using the same phrasing across different posts, from accounts created around the same time — that is a pattern, and patterns are evidence.
The primary sources, in full
The documents the playbook is built on. Read each one in place, or open the original. These are the actual files — government training slides, the Senate’s own report, the academic paper — not summaries of them.
The Art of Deception — GCHQ / JTRIG training presentation
The training slides themselves. The “Disruption Operational Playbook,” the named tools, and the 10 Principles of Influence — including Flattery — in GCHQ’s own words.
JTRIG Tools and Techniques
The companion document listing the named tools — UNDERPASS, GESTATOR, SILVERLORD and the rest — and what each was built to do.
Church Committee — Book III, COINTELPRO
The Senate’s own findings on the FBI’s domestic disruption programme — surveillance, forged documents, manufactured conflict, and the violation of constitutional rights.
Sunstein & Vermeule — Conspiracy Theories / Cognitive Infiltration
The paper proposing governments “cognitively infiltrate” groups by placing covert agents and apparent independent advocates into online forums and networks.
The “I usually love your work, but…” comment is a documented intelligence technique called the Flattery Principle. It is one of ten named principles for online influence and deception in classified GCHQ training. The flattery exists to make the doubt that follows feel credible — and once you know that, it stops working the same way.
This page is a reference compilation of primary and named sources. Verification chips reflect the status of each claim against the public record: VERIFIED indicates a primary or first-party source is linked. Documents in the Document Bank are the original files, linked at source; on-site hosted copies will replace these links once uploaded. Compiled from “The Intelligence Playbook,” alimcforever, March 2026. Read alongside the rest of Media & Mind.