Mobilizing Manufactured Reality: How Participatory Disinformation Shaped Deep Stories to Catalyze Action during the 2020 U.S. Presidential Election

Claims of election fraud throughout the 2020 U.S. Presidential Election and during the lead up to the January 6, 2021 insurrection attempt have drawn attention to the urgent need to better understand how people interpret and act on disinformation. In this work, we present three primary contributions: (1) a framework for understanding the interaction between participatory disinformation and informal and tactical mobilization; (2) three case studies from the 2020 U.S. election analyzed using detailed temporal, content, and thematic analysis; and (3) a qualitative coding scheme for understanding how digital disinformation functions to mobilize online audiences. We combine resource mobilization theory with previous work examining participatory disinformation campaigns and "deep stories" to show how false or misleading information functioned to mobilize online audiences before, during, and after election day. Our analysis highlights how users on Twitter collaboratively construct and amplify alleged evidence of fraud that is used to facilitate action, both online and off. We find that mobilization is dependent on the selective amplification of false or misleading tweets by influencers, the framing around those claims, as well as the perceived credibility of their source. These processes are a self-reinforcing cycle where audiences collaborate in the construction of a misleading version of reality, which in turn leads to offline actions that are used to further reinforce a manufactured reality. Through this work, we hope to better inform future interventions.


INTRODUCTION
Claims of widespread election fraud are nothing new to U.S. political conversation [32]. Although troubling, previous iterations of these claims did not lead to widespread action in the same way they did following the 2020 presidential election when on January 6, 2021 supporters of former President Donald Trump took part in an insurrection attempt at the U.S. Capitol. In response, the U.S. House Select Committee to Investigate the January 6th Attack on the United States Capitol (hereafter referred to as the January 6th Committee) was established to understand the events that led to the insurrection attempt. Although the committee's work is still ongoing, they have interviewed over 1,000 people and obtained over 125,000 records to understand the events of January 6th and the months preceding the insurrection [4]. As the investigation has progressed, research has illuminated the role of election related mis-and disinformation in mobilizing audiences for the January 6th insurrection attempt. Among other findings, the investigation has indicated that at least some of the participants were convinced to go to Washington D.C. on January 6th because of the mis-and disinformation they had seen on social media [45,47].
Critically, claims that motivated attendance were numerous and diverse, yet also consistent in accusations of widespread fraud. Witnesses and participants in the insurrection attempt cited mistrust in voting machines (covered in one of our case studies) as well as a belief that votes were counted from unregistered and even deceased people [47]. In the lead up to the election, Pro-Trump media outlets, political elites, and online influencers framed the use of mail-in ballots as a ploy meant to undermine the integrity of the election, rather than a response to the extraordinary circumstances of a global pandemic [10]. Claims of mail-in ballot fraud did not exist in isolation, but rather as one piece of a much larger milieu of mis-and disinformation made up of hundreds of different false and misleading claims. These claims worked together to first erode trust in electoral systems and then to dispute the outcome of the election in the form of the #StopTheSteal campaign and the January 6 insurrection attempt [24].
The events of January 6th were not just the result of mis-and disinformation however -something needed to be done to catalyze action before audiences would be willing to act on the mix of false and misleading information they were seeing. Witness testimony from the January 6th Committee suggests that actions taken by Trump and his allies were directed towards mobilizing his supporters for the January 6th insurrection attempt, exemplified when, at the height of the #StoptheSteal campaign and despite receiving information that there was no evidence in support of his claims, Trump posted the following tweet at 1:42 a.m. ET, December 18th [45]: "Statistically impossible to have lost the 2020 election. Big protest in D.C. on January 6th. Be there, will be wild!" At the time of writing, it is not clear if the above tweet was enough to catalyze the events of January 6th, or what additional evidence the January 6th Committee will reveal. However, the findings thus far suggest a connection between digital mis-and disinformation and subsequent mobilization around the 2020 Election, a connection this paper explores.
Although there is a large body of preexisting work that seeks to understand political mobilization in a diverse range of contexts [5,36,59,69], very little exists specifically focused on understanding how people mobilize around information that has been shown to be false or misleading. Exacerbating this problem is the difficulty in understanding the relationship between online and offline behaviors, something that researchers have only an incomplete understanding of [7,38,69]. This is of particular importance to CSCW researchers because of the digitally mediated, collaborative processes shared by both social movement mobilization and participatory disinformation. By better understanding how mobilization and disinformation intersect, we will be better equipped to understand how to mitigate and potentially interrupt mobilization based on harmful disinformation.
To further our understanding of how digital platforms are leveraged to mobilize geographically diverse populations through disinformation, this paper focuses on three specific incidents of disinformation during the 2020 U.S. election cycle: • Sonoma Ballot Dumping: The claim that ballots were illicitly disposed of in Sonoma County, California. • SharpieGate: The claim that Sharpies invalidated ballots in Maricopa County, Arizona.
• Dominion: The claim that Dominion Voting Systems' election software intentionally changed votes in Antrim County, Michigan.
This paper explores conversations on Twitter surrounding each of the above incidents of electoral disinformation. We use a grounded, interpretive, approach (similar to [43]), and develop a categorization scheme to understand mobilization based on disinformation in each incident. We analyze tweets related to each incident and supplement our content, thematic, and temporal analyses with contextual details of offline events that influenced digital conversations. Our analysis pays particular attention to the interaction between organic participants of conversations and political elites and influencers (individuals with large audiences/follower counts or who hold a position of power that gives them perceived credibility) -and how those interactions shape and are shaped by mobilization rhetoric. Within this analysis, we explore how specific disinformed/disinforming claims evolved over time and how those claims were used to manufacture grievances and legitimacy for underlying deep stories of fraud that were leveraged for both online and offline action.
Our analysis highlights how users collaboratively construct and amplify alleged evidence of fraud that is used to motivate and facilitate offline actions. We find that mobilization is dependent on the selective amplification of false or misleading tweets by influencers, the framing of the claim, as well as the perceived credibility of the source of the claim -where people's first hand experiences and "evidence" from legal processes were widely spread to present the illusion of legitimacy. These processes work together in a self-reinforcing cycle of mobilization on top of and through disinformation where audiences collaborate in the construction of a misleading version of reality which in turn leads to offline actions that are used to further reinforce the manufactured reality ( Figure 1, with detailed figures of each process visualized in Figures 7 and 8 in the discussion). Finally, we demonstrate how social movements based on disinformation share some of the same tactics and strategies as social movements not based on disinformation. These include framing tactics, resource mobilization, and opportunity structures. The primary difference between the two is that social movements based on disinformation are not beholden to any form of objective reality as long as the messaging is perceived as plausible. This means that, when successful, participatory disinformation enables mobilization based on a manufactured reality that is inherently flexible and beholden to the motives of those guiding the disinformation campaign instead of a less flexible version of reality based in verifiable evidence.

BACKGROUND
Before continuing, it is helpful to define what we mean by disinformation in this paper. Generally speaking, misinformation is information that is unintentionally false or misleading, while disinformation is information that is intentionally false or misleading [35,66]. However, the distinctions High-level view of how participatory disinformation mobilized support based on a self-reinforcing process driven by informal (see Figure 7) and tactical mobilization (see Figure 8). The generation and propagation of participatory disinformation mediates the process by which events are interpreted, discussed online, and integrated into a manufactured version of reality that is both predicated on and supported by the disinformation. This version of reality constructs the lens or frame through which many members of online audiences interpret emergent events, and shapes the process of informal mobilization. Once online audiences are invested in the constructed version of reality facilitated through participatory disinformation, they are primed for specific tactical mobilization organized by cultivators, influencers, and other members of the online audience. The results of tactical mobilization (e.g. events at protests, affidavits for lawsuits, etc.) are then amplified as new, seemingly emergent events that are in reality often motivated by the disinformation campaign and provide additional fodder for continued informal mobilization and reinforcing "evidence" for the deep stories that motivated participation to begin with.
can quickly become blurry, as many people who spread (and in some cases even produce) disinformation are "unwitting agents", i.e. sincere believers of the content [57]. A disinformation campaign consists of the strategic generation and/or distribution of a complex combination of false claims, true claims, and misleading claims for some motivated goal, including political or financial gain [13,58]. Additionally, although individual pieces of information may be able to be shown to be true or false, the reality is that social communication often involves pieces of information that are difficult or impossible to classify as simply true or false. Because of this, we use disinformation in this paper to refer to many pieces of information that, when taken together as an intentional campaign, function to create a false or distorted perception of reality even if on their own they are difficult to classify in terms of veracity and a specific actor's intent.
We categorize the case studies we examine as components of a broader disinformation campaign by relying on the revelations of the January 6th Committee combined with the work of Benkler et al. [10] that describes President Donald Trump and his allies' manipulation of rhetoric around mail-in voting as a "disinformation campaign, " rhetoric that continued to be visible in our case studies (that included claims about in-person voting as well). The findings of the January 6th Committee also describe how Trump and his allies continued to promote claims of election fraud and rouse support for the #StoptheSteal movement despite being told by internal teams that there was no support for the claims being touted [45]. If true, this fits the definition of disinformation.
In the following background sections we review literature relevant to mobilization and social movements, participatory disinformation, and storytelling as a preparatory strategy prior to more explicit organizing and mobilizing.

Social Movements and Resource Mobilization Theory
Social movement literature has historically examined what processes function to mobilize widespread audiences, recent iterations of which have focused heavily on the role of social media in facilitating collective action. This body of work includes studies of how pro-democratic movements such as Occupy Wall Street, the Arab Spring, and the Indignados Movement have mobilized resources to further their causes [28,33,53,63,69]. According to these conceptions of the interaction between social movements and internet communication technologies (ICTs), the internet often serves as a democratizing force that allows for widespread participation in movements that would otherwise be impossible to mobilize around.
One weakness of digitally distributed social movements is that they suffer from an inability to easily create and maintain organizational structure [9,12]. Recent work from CSCW researchers has examined how digital technologies may compensate for this lack of structure, and has examined the role of hashtags in aggregating online discussions, showing solidarity, promoting individual and group identities, and to support or challenge framings of events [56,62]. Additionally, CSCW research has attended to how digital media facilitated on-the-ground action in Sidi Bouzidm, the town where the Arab Spring began [69], as well as the role sharing stories online plays in shifting audiences' perceptions towards their own experiences, facilitating further action in social movements (a theme we discuss in more detail in Section 2.3) [21].
The above CSCW work complements research describing the role of framing processes, opportunity structures, and resource mobilization in catalyzing action in support of social movements. Opportunity structures are the socially structured avenues available for a social group/movement to achieve its goals and largely determine the options available for a group or movement to act [8,25]. Much of the recent work on social movements has focused on the framing processes that lead to action. Benford and Snow discuss how framing processes and collective action frames motivate group actions, emphasizing how collective action frames help overcome the problems inherent in getting individuals to contribute to a collective endeavor [8]. For example, Flores-Saviaga et al. [27] show how opportunity structures and framing processes facilitated previous mobilization between 2015 and 2017 in the trolling subreddit /r/The Donald, demonstrating earlier iterations of themes we discuss in the current study. In particular, they identify the power how collective action combined with false and misleading information can both bring a community together, and disrupt the work of those who are not members of their community.
Bennett and Segerberg introduce the concept of connective action and discuss the individualized role in digital social movement participation of personal action frames that are inclusive of different personal reasons for participation [12]. For them, online participation in a social movement working towards a perceived common good is an act of networked personal expression achieved by sharing ideas -ideas that are, critically, already internalized, meaning that many participants are selfmotivated, a theme present in the case studies we examine [12].
Translating connective action to collective action then is a key goal for those hoping to motivate widespread action, a process that can be illuminated by resource mobilization theory. Resource mobilization theory was initially developed to understand how traditional social movements form and accomplish their goals, focusing on tangible resources like money and organizational structures. A more recent version of the theory however, as described by Edwards & McCarthy [22], sees social movements as succeeding or failing based on their ability to leverage resources of the following types: (1) Moral resources: Moral resources are the abstract, often religious or ideological, resources that create a foundation for social movements to enact more tangible action. These resources include legitimacy, solidarity support, sympathetic support, and celebrity.
(2) Cultural resources: Cultural resources are related to primarily culturally specific forms of knowledge, including conceptual tools and specialized knowledge such as how to organize a protest or a news conference, or how to form an organization. (3) Socio-organizational resources: Socio-organizational resources are generated or gathered by leveraging social networks, organizations, and infrastructures for activities such as recruiting volunteers or disseminating information through social connections, including casual and professional channels. (4) Human resources: Human resources are related to the value that an individual adds to a movement and includes labor, expertise, skills, experience, and leadership. Central to a resource mobilization approach is a recognition that resources are inequitably distributed -the social movements that successfully mobilize their supporters and resources are those that "reflect the social-change preferences of [society's] better resourced constituencies" [22, p. 120]. Not all types of resources are always needed for successful mobilization, and some can be used to gain resources of another type. For example, a movement with many volunteers (human resources) but little money (material resources) could utilize their volunteers to raise money. Similarly, other resource types could be used to either create or fill the gap of organizational structure missing in many digital social movements. However, the use of material resources in a mobilizing context is theoretically constrained by moral resources. This is the reason that widespread social movements tend not to form around themes that lack moral legitimacy. It is difficult to raise support for an issue that people either don't care about or is perceived to have malicious or selfish motives.

Participatory Disinformation
To better understand the intersection between social movement mobilization and disinformation, it is important to recognize that they are both collaborative endeavors. There is an increasingly large body of literature that describes the participatory relationships that develop between the originators/organizers of a disinformation campaign and supporters who unwittingly spread and even generate disinformation [48,51,58]. From this perspective, members of the general public participate in the production and propagation of disinformation without necessarily realizing that they are participating in a larger information operation. Many of these unwitting agents are true believers of the disinformation that they help spread, which makes it difficult to tell where a disinformation campaign ends and a genuine social movement begins. Critically, the unwitting agents are not merely peripheral actors in the proliferation of claims making up a campaign. Indeed, historical descriptions of disinformation describe the often significant role that unwitting agents play in the success of disinformation campaigns by actively participating in conversation and action [13,58]. In the context of the U.S. in 2020, it is even more difficult to tell the difference between a genuine social movement and a disinformation campaign because, as Benkler et al. [9] point out, the current iteration of disinformation that the U.S. is experiencing is the result of decades of rhetoric from traditional media sources that have continuously been attempting to influence public perceptions.
Within a participatory disinformation framework, several studies have identified an emerging structure common to political disinformation campaigns. Nemer [48] observed three important tiers of actors essential to the spread of political disinformation on WhatsApp in Brazil. Average Brazilians made up the largest and least individually-influential of the tiers, followed by the "Bolsoarmy" at the second tier, a fanatical group of Bolsonaro supporters who rapidly shut down opposing viewpoints. The Bolso-army also disseminated messages provided by the Influencers, the third tier that consisted of a smaller number of highly influential people that are less active than the Bolso-army, but who have an outsized influence on conversations.
Similarly, Ong and Cabañes identify a four tiered system with "Architects" at the highest tier [51]. For Ong and Cabañes, Architects are people who strategically plan and execute a disinformation campaign. Below them are the digital influencers, a group similar to the Influencers who are responsible for the coordinated distribution of messages in [48]. Fake accounts make up the second tied followed by grassroots participants in the first, and lowest tier.
In these studies, online audiences collaborate, often unwittingly, with those who are invested in the spread of disinformation. Additionally, disinformation has historically targeted journalists and the media to either spread the disinformation through deception or to delegitimize and disrupt opposing views [13]. This has been observed in previous CSCW research examining information operations in the U.S. and Syria [58,67]. Furthermore, disinformation often weaponizes the openness of liberal democracies against them, taking advantage of rights such as the freedom of speech in order to appear like genuine advocates [6,57] and disrupt genuine sensemaking processesprocesses that are often already susceptible to misinformation [34].

Cultivators
The seeders of a disinformation campaign who strategically seed disinformed messages and opportunistically capitalize on resulting doubt or confusion. They have the most to gain from the disinformation they spread. This group is often difficult to identify due to the covert nature of disinformation and the mix of unplanned, organic actions and strategic actions that often result from participatory disinformation.

Influencers
This group encompasses digital influencers as well as political elites who aren't the cultivators of a disinformation campaign, but utilize their visibility to spread disinforming messaging to large audiences. Inauthentic accounts Inauthentic accounts either run by humans intending to mislead audiences, or groups of bots/troll accounts that work together to give the appearance of widespread sentiment (often called astroturf accounts). Grassroots participants Members of the general public, including low-influence unwitting agents as well as motivated amplifiers of disinformation. Ong and Cabañes' framework for characterizing stakeholders emerges from work on more coordinated disinformation campaigns. Here, we adapt that framework to the participatory process we observed around the 2020 U.S. election, visualized in Table 1 above, which provides brief summaries of four stakeholder groups. Instead of "Architects" as the highest level group, we use the term "Cultivators" to more accurately describe the participatory and often decentralized nature of disinformation we observed in our analysis. President Trump and his allies appeared to strategically sow doubt and opportunistically capitalize on resulting online and offline events, but (as far as we can determine based on publicly available information at this time) demonstrated less strategic organization than is implied by the "Architects" label discussed by Ong and Cabañes. In addition, we group political elites and other influential social media accounts together under the "Influencers" category. This encompasses political and media elites who use their influence to spread disinforming messages, but may not be the central cultivators of a disinformation campaign.

Storytelling and Preparatory Media
To better understand why the framing of electoral disinformation in 2020 was so compelling, Polleta and Callahan's discussion [52] of storytelling is instructive. Polleta and Callahan apply the concept of storytelling as being a core component in the spread of mis-and disinformation by Trump and his allies. To them, stories have two important features that describe their effectiveness at persuasion: allusiveness and storytelling as a social activity. By allusiveness, they refer to the ability of stories to be flexible in their meaning and interpretation. Most stories do not explicitly tell audiences the point of the story, instead they demonstrate a "moral" through the content and form of the story itself. Importantly, the most powerful stories don't need to be told, only referenced. They describe sociologist Arlie Hochschild's concept of a "deep story, " the idea that there is a broad, underlying story beyond everyday stories that many Americans believe applies to them (p. 55): "In that story, hardworking citizens were struggling to get by while being bilked in taxes by a grasping federal government. They were told to feel sorry for the parade of claimants who were cutting in line for the American Dream and scorned as "white trash" and "rednecks" if they did not. It was a story that traded in feelings more than confirmable facts. . . " Polletta and Callahan's [52] conception of storytelling as a social activity is also useful in understanding the spread of electoral disinformation. They emphasize the importance of storytelling as often being about building collective identity, a driving force we identify in the construction of moral legitimacy. In order for any movement to form, there must be a cohesive group with some shared characteristic or ideology that brings them together. In the case of U.S. claims of electoral fraud, a group was relatively naturally available due to the dual party nature of American politics. What remained, then, for those interested in building moral legitimacy, was to utilize the pre-existing deep stories and identities of their constituencies to construct a grievance that people would mobilize around, something that is described, at least in part, by Munn's conception of preparatory media [46].
Munn examined posts on the social media platform Parler (whose primary value statement is a focus on "free speech" that translates to little to no moderation) in the leadup to the January 6, 2021 insurrection attempt. Among other findings, this work identified the use of the platform in mobilizing, inciting, and legitimizing action (primarily violence) around January 6th. The construction of preparatory media is summarized as media that "frames events, establishes targets, and sets agendas, providing a degree of order and working against disaggregation online" [46]. Within this construction, storytelling is apparent at every stage, but particularly the mobilizing and legitimizing stages. Here, participants in online conversations share stories that provide legitimacy to their movement and structure their subsequent calls to action based on the stories they share once perceived legitimacy has been reached. Parler is an extreme, albeit instructive, example of how preparatory media functions to facilitate offline action, but alone it does not provide a full picture of how mobilization occurs based on disinformation.
Ultimately, genuine social movements and those that are created by disinformation campaigns both rely on mobilizing diverse resources to support their goals. What is not well understood is what specific strategies facilitate mobilization based on disinformation and whether those strategies are significantly different from strategies used in social movements not founded on disinformation. This paper seeks to fill that gap.

METHODS
In this work we employ a grounded, interpretive approach to the analysis of three specific casestudies of "incidents" (i.e. distinct information cascades bounded by time and topic) of false and misleading information. We develop and apply a qualitative coding scheme to examine tweets in each incident and combine coding with an interpretive analysis of visual and temporal artifacts, similar to Maddock et al [43]. Drawing from a massive Twitter dataset of election-and voting-related tweets, and our team's experiences tracking misleading claims in real-time, we curated subsets of tweets for three specific incidents of misleading claims and then performed a predominantly qualitative analysis of those tweets, relying upon both inductive and deductive coding, and drawing upon social movement and mobilization literature to inform our codes. We chose Twitter as a data source because previous literature has identified Twitter as a source for both political mobilization and disinformation [58,63]. In tandem to the coding we visualized the trajectory of each incident online through temporal plots to understand how each narrative began, spread, and changed over time. We contextualized the data collected from Twitter within the broader disinformation campaign online as well as relevant offline events that situate the data within its broader socio-political context. The result is findings for each case study which integrate content analysis of our coded Twitter data with a broader, interpretive analysis of the events of each case. We further interpret our results using the concept of deep stories [52] in conjunction with resource mobilization theory [22].

Incidents
As described by Kennedy et al. [39] and the Election Integrity Partnership [24], the 2020 US presidential election was characterized by hundreds of false and misleading claims, many of which can be sorted into unique incidents where, while multiple claims or conspiracies may exist, a common event or theory is central. The incidents we study were selected from those curated by Kennedy et al. [39] and reflect that structure; while each is made up of multiple components, we have defined each by their central story. We selected three incidents of false, misleading, or unsubstantiated claims about the 2020 elections that (1) functioned to undermine trust in election processes or results (i.e. were part of "the Big Lie"); (2) were relatively prominent in social media conversations (>25,000 tweets) but also varied significantly in size; (3) and took place during each of the three distinct stages -one before, one during (and immediately following), and one several days after the election. Furthermore, for the Sharpiegate and Dominion incidents we already knew that some level of mobilization occurred given prior knowledge of offline gatherings that seemed to be motivated at least in part by the narratives we analyzed (e.g. voting machine conspiracy theories as a motivating force behind the January 6th insurrection attempt). We briefly define them below: • Sonoma Ballot Dumping involved false allegations that mail-in ballots from Sonoma County, California, had been intentionally and illegally dumped in a central landfill. The research team collected keywords related to Sonoma for the period between 09/25/2020 and 09/27/2020. This incident was comprised of 29,825 tweets in our dataset, of which we coded 300 unique tweets. • SharpieGate involved false claims that Sharpies given to voters at polling places in Maricopa County, Arizona were bleeding through ballots (true), rendering the ballots unreadable by voting machines (misleading), and that this was an intentional effort to disenfranchise specific voters (false). The research team collected keywords related to SharpieGate for the period between 11/01/2020 and 11/15/2020. This incident was comprised of 452,971 tweets in our dataset, of which we coded 329 unique tweets. • Dominion centered on Dominion Voting Systems, a company that sells electronic voting software and hardware, and its purported connection to voting irregularities in multiple states. For the purposes of this study, the research team focused on narratives about Dominion related to events in Antrim County in Michigan, where a clerical error initially causing votes to be incorrectly reported (despite being correctly tabulated) spurred false claims of a major glitch affecting all Dominion voting machines. The research team collected keywords related to the Dominion incident in Antrim for the period between 11/01/2020 and 12/15/2020. This incident was comprised of 2,215,126 tweets in our dataset, of which we coded 324 unique tweets.

Data Collection
The data for this study 1 were drawn from a broader collection of tweets about the 2020 U.S. election described in [39] 2 . Using Twitter's streaming API, tweets related to election procedures as well as claims of election fraud were collected by tracking a large number of general terms such as election, ballot, vote, mail-in, fraud, as well as specific location terms and hashtags (like Maricopa and #SharpieGate) that emerged as salient as the election progressed. The real-time collection ran from August 2020 through December 2020 and resulted in over a billion tweets. From this broader dataset, we curated subsets of tweets that were related to the three selected incidents by constructing tailored keyword and time-bounded queries. The keywords were developed iteratively to capture as much of the incident content as possible without introducing noise through unrelated tweets -resulting in comprehensive, low-noise data subsets for each incident.
Next, we defined three samples from each of the three incident-related data subsets in order to (1) develop our qualitative coding scheme and (2) code samples of tweets from each incident. First we defined the Early subset, to capture the origins and early spread of each incident, we randomly sampled original tweets from the first few hours or day of the incident. This ensured that the early (often low volume) spread was not drowned out by the high volume spread that often came later. Second is the Random subset, which was created to capture the broader themes in each incident and see how it developed over time. For this set we randomly sampled original tweets from across the entire timeline of the incident. Third is the Most Retweeted subset, to capture and explore the role of viral tweets and influential accounts. For this, we sampled from the tweets with the most retweets from each incident. For all three subsets we exclude retweets and only sample on tweets, replies, and quote tweets. For each original tweet in our sample that quoted another tweet (formerly known as retweet-with-comment), we also coded the root "quoted" tweet (QT) embedded in that tweet. Doing this allowed us to examine how quote tweets often built upon or shifted the frame of the underlying tweet. Furthermore, we only fully coded the tweet if it was clearly related to the incident and was not refuting or debunking the claims (results for relevance coding are present in 2). For most of the subsets, the majority of tweets returned by our queries were found to be related to the corresponding incident. However, for the Sonoma incident similarities with other online narratives around the same time led to a larger proportion of noise. Additionally, we discarded the Early subset for Sonoma entirely as the incident lacked relevant early tweets besides the viral tweets which started the incident and are included in the Most Retweeted subset. The size of the Early and Most Retweeted samples were around 50 and 100 respectively, while the Random sample was dependent on the size of the incident in order to capture more data for the larger, more complex narratives. Totals are reported in Table 2.

Developing the Coding Scheme
To develop the coding scheme, our research team used a grounded approach -iterating over samples of data as we developed and refined our coding scheme. As we progressed, we also drew insight from previous literature, particularly around mobilizing, information communication Total Related Total Related Total Related  SharpieGate  50  37  179  141  100  78  Sonoma  50  0  150  69  100  45  Dominion  51  49  174  154  99  99  Table 2. Total tweets coded for each of the three reported case studies technologies, and social movements [22,28,33,53,61,63]. The resulting coding scheme is therefore both inductive and deductive, emerging from a combination of both approaches.
Our initial coding scheme was developed through manual investigation of tweets from two of the incidents: SharpieGate and Sonoma. Through several rounds of open coding, the first and final authors developed an initial coding scheme. These included the action that the tweet fulfilled (e.g. sensemaking vs, providing evidence), the framing of the tweet as sowing doubt or claiming voter fraud, and the source of the information in the tweet. The source offers insight into where potentially false or misleading claims came from and why they might be perceived as credible. Afterwards, a team of four researchers applied the coding scheme to additional samples of data, adapting the scheme to accommodate new insights.

Category
Code Description Spreading Action

Sensemaking
Intent is to seek answers in good faith surrounding the incident Provides Evidence Intent is to share or spread evidence of the incident, or using the incident as evidence for larger issues with the election Frame Sows Doubt Sows or reflects doubt about the legitimacy of the election or is insinuating voter fraud without being explicit.

Claims Voter Fraud
Directly alleges that fraudulent behavior, cheating, or crimes have occurred regarding the election. Source First Person Attributes information to a first hand experience.

TP -Close Contact
Attributes information to a close contact such as a family member TP -Vague Attributes information to a vague source, e.g. "someone said". Or the tweet is referencing a video that is not from a media outlet. TP -Named Attributes information to a named individual.

TP -Official
Attributes information to any kind of official person or document e.g. country recorder, elections department officer etc.

TP -Vague Numerous
Attributes information to multiple unnamed sources. e.g. "a lot of people are saying. . . " Media Outlet Shares content from a media outlet No Source Listed Shares information that warrants a source but does not provide one Not Applicable Does not contain information that warrants a source. e.g. sharing an opinion After identifying mobilizing rhetoric as a salient theme, we supplemented the coding scheme with insights from existing literature around mobilization and used axial coding [17] to organize and refine the coding scheme. In particular, we created two broad categories to capture mobilization activity: informal mobilization and tactical mobilization. The majority of codes are described in Table  3, bu here we explain in more depth the informal and tactical mobilization codes. In the framework discussed by Garrett (2006) [28], the author adapts McAdam et al. 's three categories of mobilization structures, opportunity structures, and framing processes to explain how social movements come into being and affect the world [44]. In the current work, we applied this framework to misleading tweets and created the coding groups as seen in Figure 2. In particular, Garrett [28] identifies a difference in mobilization structures between social structures and tactical repertoires, i.e. the types of collective action that participants of a movement recognize and are able to utilize to further the goals of the movement. Among social structures, [28] Garret differentiates between formal organizations and informal groups such as friend and activist networks. Based on this, we considered two dimensions of mobilizing for each tweet: Informal Mobilization and Tactical Mobilization.
The code of "Informal Mobilization" is intended to capture the activity of group formation whether that is in the form of identifying the in-group (e.g. Trump-supporters), villainizing an outgroup (e.g. Democrats or poll workers), or otherwise functions to increase group cohesion or prime the audience for future calls to mobilization. This may take the form of building anticipation by promising more details in the future, using emotion to engage the audience, or presenting imperatives that don't lead to direct action (e.g. "don't trust the media"). In our coding scheme, these calls function to prime online audiences to act (by increasing familiarity with available tactical repertoires) and to distrust outgroups while trusting in-groups, but do not provide any avenue for further action.
The "Tactical Mobilization" code includes specific calls to action that provide an avenue for increased participation by online audiences. This can be done in three primary ways: 1) "directing up" a tweet by intentionally tagging or replying to a figure with influence or authority and asking them to perform an action, 2) directing down is the inverse of directing up and captures when a user directs an action to their audience more generally, and 3) specific election-related calls to mobilize and avenues to act. For example, in SharpieGate, many tweets prompted users to report anything they had seen related to sharpies and ballots and provided numbers for people to call.
Once the coding scheme had stabilized on tweets from the first two incidents, we applied it to similar samples from the third incident, Dominion. Only a few small adjustments were needed, suggesting that the scheme could be usable for examining mobilization within a range of disinformation incidents related to the 2020 U.S. Presidential election. Before final coding, several codes were combined or dropped from use if sufficient inter-annotator agreement could not be reached with the more fine grained codes. Throughout the process, the researchers retained memos and met on a weekly basis to discuss emerging themes and challenges with existing codes, resulting in a final consensus-based document outlining guidelines for the usage of the coding scheme. The final coding scheme (see Figure 2) consists of 17 codes divided into 5 categories that capture varying aspects of tweet content around electoral misinformation, disinformation, and mobilization.

Applying the Qualitative Coding Scheme
We next applied the coding scheme to the three samples of tweets (Early, Random, Most Retweeted) from each of the three incidents. Final coding was conducted by the first two authors who are each well versed in election misinformation as well as social media analysis. Each coder independently coded each subset of tweets, with inter-rater reliability reported in Table 4. Following independent coding, the two researchers met and discussed disagreements to arrive upon consensus for each code.
In addition to coding samples of tweets, analysis was conducted on each incident by observing and investigating the temporal trend of the topic as well as seeking out important contextual information such as the release of relevant news articles, or offline impacts such as when protests occurred or when lawsuits were filed. We then integrated those analyses into a broader, qualitative analysis of the three case studies -one that included our content analysis of tweets as well as the analysis of additional contextual information and digital artifacts related to each incident.   Table 4. Inter-rater reliability for all coded tweets using Gwet's AC1 for two raters [31].
Throughout this study we include detailed examples of tweets that exemplify salient behaviors in our analysis. Being associated with a disinformation campaign has the potential to cause harm to a person's reputation, and even without potential harm, privacy is important to protect in instances where a person's identity is peripheral to the focus of a study. To protect the privacy of account holders whose tweets we use as examples and who would have had a reasonable expectation of privacy, we anonymized their Twitter handles, zeroed the end of timestamps, and rephrased tweets so they are not easily searchable, but still contain the same meaning of their original tweet. This was done, primarily, for accounts who fall into the "Grassroots participant" or "Astroturf Activist" stakeholder groups, because those accounts tended to belong to non-public figures and it was beyond the scope of our study to determine the authenticity of every account we examined. Instead we chose to err on the side of privacy and anonymize accounts in both groups. Influential accounts belonging to public figures, political elites, or digital influencers (with large audiences) remain identified because A) we consider them public figures; and B) it's important to understand the interaction between their online activities, their professional roles, and the mobilization we are studying.

FINDINGS
Our analysis reveals the complex mix of genuine concern and selective amplification of false and misleading claims that mobilized citizens during the 2020 election. In reviewing each case study, it is important to recall that each incident we analyzed did not occur in isolation but rather as part of a larger disinformation campaign that spanned several months [10,11,45,47,64]. Eventually, the campaign and its claims evolved into the #StopTheSteal movement, a shift that was already becoming apparent in our current dataset and that culminated in the January 6 insurrection attempt [24].  Initially, this incident spread almost entirely through retweets of Schaffer's tweet, which was the most retweeted tweet in our dataset (8,098 retweets). About five hours after @ElijahSchaffer's tweet, the major vector of spread shifted and the misleading claim surged (see Figure 4, yellow area) -after hyper-partisan, right-wing news blog The Gateway Pundit (GWP) posted a tweet linking to an article on their website featuring the same photos. Their tweet claimed that a "California man <had found> THOUSANDS of unopened ballots in a garbage dumpster" and that workers were trying to "to cover them up. " The article explained that GWP had been sent the photos by a "reader" whose father had witnessed the ballots being covered. Eventually, the GWP's article would dominate the spread of this incident, with 15,637 tweets linking to it and its headline cited by 29 of the 100 most-retweeted tweets in our data. About half an hour after his original tweet, Schaffer appeared to start doubting the validity of the photos and the story behind them (Figure 3), though he did not explicitly correct his earlier claim. Instead, he tweeted the above series of tweets -as he realized that it was impossible for the alleged ballot dumping to have occurred, due to the fact that ballots hadn't yet been sent out in California, which were scheduled to be sent out on October 5, 2020 at the very earliest.
Interestingly, though he stepped away from his initial claim, Schaffer did not try to undo the damage it had caused and instead doubled down on the sentiments underneath it -distrust in the mail-in voting process.
On September 26, local Sonoma newspaper The Press Democrat published an interview with the County of Sonoma's Clerk-Recorder-Assessor and Registrar of Voters in which she corrects the misinformation, stating that the photos show mail-in envelopes from a 2018 election that were recently and properly disposed of by her office per state law [41]. Along with this correction, the County of Sonoma's official Twitter account posted a correction on September 25 at 9:21 PM UTC including a plea for help in stopping the spread of the narrative. After the County of Sonoma issued its correction, The Gateway Pundit updated their article in a similar way to Schaffer, noting the corrective information in the title by adding "County Says Returned Ballots from 2018?" after the initial claim as well as at the bottom of the article in a way that still reinforced their original sentiment of distrust in the process: "UPDATE: The County of Sonoma put out a statement saying the ballots were from 2018. The county says the ballots were already opened. You can judge for yourself".

A "
Top-Down" Incident Catalyzed by Online Influencers. On Twitter, the Sonoma incident was primarily defined by a single story spread by Elijah Schaffer and The Gateway Pundit (GWP). As reported in Table 6, 67.54% of coded tweets were referencing a media outlet, a larger share than for either of the other incidents and none claimed a first-person account.
Though it was initially seeded by a "reader" who emailed the photos to right-wing media personalities, the online spread of this incident was primarily driven by online influencers (individuals who operated social media accounts and/or websites with large audiences). So to a large extent, the spread of misleading information in this case was "top-down" in that a small number of influential accounts were the primary vectors for the incident. Importantly, Schaffer and GWP received the evidence from an outside entity, implying that while they were the primary vectors of transmission,  Table 5. Frequency of Codes in Sonoma (percent of coded tweets). There were no relevant tweets in the Early set that preceded the first influencer tweet, we have therefore excluded it from analysis. they were not necessarily the originators of the claims. This fits theorized structures of disinformation as described by Nemer (2021) [48] and Ong and Cabanes (2018) [51], where they identify mid-level influencers who function to disseminate messages to wider audiences.

Constructing Moral
Legitimacy by Amplifying Evidence of "Voter Fraud". As can be seen in Table 5, less than 3% of the tweets in each dataset performed any sensemaking while upwards of 94% of tweets engaged in either providing or amplifying "evidence" of perceived fraud. This illustrates how many of those who participated in the narrative seemed to readily accept the narrative and spread it to their audience, rather than grappling with it as a rumor. Similar to the "reader" who initially shared the photo, participants' role was primarily to identify and disseminate evidence that supported the (false) underlying deep story that mail in voting fraud was rampant.
The following tweet is an example of how the story from the media aligned with the expectations set up by Trump and others and was leveraged as evidence.

Tweets Initially
Framed to Sow Doubt Were Reframed as "Evidence" of Fraud. The story as shared by Schaffer and GWP did not directly claim voter fraud, but rather posed the story as sowing doubt on the voting process as reflected in the 73.91% of Random tweets sowing doubt and 62.22% of Most Retweeted tweets sowing doubt. However, while about 26% of tweets in Sonoma's Random set framed their discussion as voter fraud, almost 38% of the Most Retweeted tweets reframed the story as fraud. This suggests that in the Sonoma incident, while participants in the online discussion were primarily amplifying the original frames of doubt, a smaller number of accounts reframed Schaffer's and GWP's original claims as evidence of fraud.
Our observations of the Sonoma incident suggest a strategy for disseminating electoral disinformation by high-and mid-level influencers: to present evidence in a way that allowed them to distance themselves from it -often by strategically adding uncertainty. For example, Schaffer appended the words "Big, if true" to his original tweet, and the GWP included "We are working to verify" in the first iteration of their article's headline that spread on Twitter. These linguistic hedges shielded their authors from potential reputational damage in the case of the information being false [60], but also enable their followers to make stronger, more explicit claims. For Schaffer and GWP, even their corrections served to sow doubt as they referenced the deep story of fraud: "However this seems to be happening quite often" (Schaffer) and "The county says the ballots were already opened. You can judge for yourself" (GWP).
In contrast to the tweets worded to avoid direct accusations by Schaffer and GWP, several accounts based their information off of the same claim but spun it into claims of voter fraud and strategic interference by Democrats: The reframing of the story as a purposeful move by Democrats earned its authors the reward of becoming relatively highly retweeted, suggesting that either influential tweeters in the conversation were more likely to frame the event as fraud or that tweets claiming fraud were more likely to be retweeted -or both. Table 5, we show the relative frequency of informal mobilization (ranging from about 85% to 93% across samples) compared to tactical mobilization (0% in both samples) in Sonoma. Informal mobilization was dominant in this incident, primarily functioning to lay the groundwork for moral legitimacy through the construction of perceived injustices perpetrated by both specific and ambiguous villains, e.g.: 2020-09-25 14:00:00 @[Anonymized]: As expected. The terrible postal union <Quoted tweet: @ElijahSchaffer: SHOCKING: 1,000+ mail-in-ballots found in a dumpster in California They were allegedly discovered in the Republic Services of Sonoma County central landfill The zip code "94928" on the ballots matches the county These are original photos sent to me. Big if true.> In the tweet above the tweeter explicitly ties the Schaffer tweet to a preexisting narrative of unionized postal workers as villains, both referencing the deep story and adding more "evidence" to the story by implying that the story is somehow the fault of the postal union. Importantly, this view of postal union workers is supported by multiple stories framed or reframed as evidence. GWP had published another story centering postal workers as villains just days prior to the Sonoma incident [24]. Critically, most of the tweets in our data do not expressly reference the details of the deeper story of mail in ballot fraud. Instead, similarly to the above tweet, they assume the reader is in the know about whatever they are referencing; in this case the perceived corruption of the postal union and its workers.

Laying Foundation for Future Tactical Mobilization. In
Although tactical mobilization was not present in the Sonoma incident, there were informal calls to action that were illustrative of how online audiences begin to mobilize even as the deep story is being defined. While these calls to action were made by a variety of different accounts, grassroots participants and now-suspended accounts that may have been inauthentic both had significant participation in making informal calls to action. The most frequent call involved encouragement to show up in person to vote, often taking a form similar to the below tweet: 2020-09-25 15:00:00 @[Anonymized]: This is why it's important to vote in person. For your children's future. California Man Finds THOUSANDS of What Appear to be Unopened Ballots in Garbage Dumpster #VoteTrump2020ToSaveAmerica @POTUS Importantly, this particular call to action, along with almost every example of informal calls to action and tactical mobilization we identified in our other incidents, would not make any sense unless readers were aware of the deeper story being told.

Case Study 2: SharpieGate
The SharpieGate incident emerged from reports that Sharpie pens given to voters at polling places were bleeding through ballots, leaving voters concerned about whether their votes would be counted. On Election Day (November 3, 2020), the first posts about Sharpies appeared in social media posts from voters as well as a conservative media personality in Chicago and occurred in other locations as the day progressed. The narrative began to take off in relation to reports from Arizona not long after that state was "called" for candidate Joe Biden at 9:20 p.m. Arizona time on election night. Early spread for the rumors was driven, at least in part, by grassroots accounts as members of the general public grappled with whether or not they should use Sharpies on their ballots. Though initial claims often had the tone of concern, later framings included suspicion and even outright accusation of systematic voter fraud. Those spreading the claims eventually converged around the term #SharpieGate, implicitly characterizing the incident as a scandalous conspiracy.
Officials in Maricopa County, Arizona, attempted to address the rumors as early as 1:54 p.m. Arizona time on Election Day. Through social media posts and website updates, they explained that the ballots were designed with a layout such that any bleed through on one side would not affect the votes on the other side. However, the corrections did little to mitigate the false claims.
The spread of this claim online was marked by a number of events which are shown in Figure  5. The first that gave rise to the initial growth in attention was a video posted by a local political activist, in which he interviews two women claiming they saw ballots being invalidated due to the use of Sharpies outside of a polling place in Maricopa County [14]. This video was first posted on Facebook in the evening on Election Day and went viral across several platforms including Twitter, YouTube, Facebook, and alternative social media site Rumble.
The next notable surge began the morning of November 4th in Arizona. This surge came in the wake of several large-follower, pro-Trump influencers amplifying the bleed-through claims and framing the problem as potentially disenfranchising conservative voters ( Figure 5). Much of that spike consists of efforts to gather statements about first-hand experiences using Sharpies to vote (and having them bleed through). Several tweets gained traction directing anyone who had received a Sharpie pen to call a phone number provided in the tweet to report their experience. The numbers provided were associated with several different organizations, including hotlines run by Arizona GOP offices, the Department of Justice, the FBI, the Maricopa County Recorder's Office, Kolodin Law Group, and the American Center for Law and Justice (a conservative, Christian activist organization). By far the most widespread were instructions for calling Kolodin Law Group, whose phone number appears in nearly 30,000 tweets (in our dataset). Kolodin Law Group went on to file one of the several lawsuits based on claims of election fraud in Maricopa County , including a voterdriven lawsuit that referenced Sharpies specifically [26]. This lawsuit was ultimately withdrawn and a later effort to continue litigation was rejected by a Maricopa County Superior Court Judge [29]. Also present in this story are tweets directing Arizona voters to an online form to check the status of their vote, primarily to see if the Sharpie bleed-through had affected them. Many reported (via social media) that their ballots had been "canceled". However, in reality, the website was designed exclusively to provide information about whether a voter's mail-in ballot had been used and was being misinterpreted by voters as the status of their in-person ballot [2].
Maricopa was also the site of several physical protests, including one that started at the State Capitol and ended up in front of the Maricopa County Recorder's Office on the evening of November 4. That first protest seemed to primarily be organized on Facebook by AZ Patriots, a conservative group associated with extremism [20]. While livestreaming during the protest one of the leading members of AZ Patriots echoed rumors of ballots being canceled, which coincided with renewed interest in the rumor on Twitter. Later that evening, a now-suspended account posted a video showing a leader of the AZ Patriots and several other protesters pressuring an employee at the Recorder's Office to make a comment about Sharpie pens. This quote was then reframed as an admission that Sharpies impacted the vote and subsqeuently spread widely on Twitter. The final large spike in Twitter activity around the SharpieGate claim came about a day later when Fox personality Maria Bartiromo (amplified minutes later by Eric Trump at 16:28 UTC) shared a tweet that aggregated several different false and misleading claims about the election, including sharpie rumors, to imply widespread and systematic fraud. Subsequent protests on November 5 and 6 -which were organized, at least in part, on social media -featured the "StopTheSteal" mantra, another term that had gone viral on Election Day while accompanying claims of voter fraud. The SharpieGate narrative would eventually get wrapped up into the StopTheSteal movement, which took shape through social media as well as a number of physical demonstrations and culminated in the January 6 insurrection attempt at the U.S. Capitol.

Organic Participation Catalyzed by Amplification from Influencers.
A defining feature of the SharpieGate narrative was the way that it originated from genuine concern and curiosity from voters and was then redirected into a narrative of voter fraud by influential accounts that engaged with the tweets of smaller, grassroots accounts. Shown in Table 7, the Early dataset contains 40.54% sensemaking tweets, reflecting the process of genuine sensemaking that occurred early on but was not prominent long term as sensemaking only comprises 3.38% and 6.38% of the Most Retweeted and Random sets respectively. Additionally, we see that claims of fraud were much less frequent at the beginning of this claim (16.66%) than in the content that came later and reached the largest audiences (33.33%).
The following tweet exemplifies the content posted by voters who were concerned about Sharpies bleeding through their ballots: 2020-11-03 00:00:00: @[Anonymized] I voted but I wonder why we were given sharpies to fill in our two sided ballots. It was bleeding through the paper a little.
This narrative originated from everyday people's on-the-ground experiences of voting -and in some cases from sincere concerns of disenfranchisement. However, the narrative of SharpieGate quickly evolved from questioning if Sharpies impacted ballots, to asserting that Sharpies invalidate ballots, to claiming that Sharpies were intentionally distributed to invalidate the ballots of conservative voters. This metamorphosis was largely brought about by mid-and high-follower accounts that amplified the claims and then (falsely) framed them as part of a concerted effort to disenfranchise voters.
The frame changed in earnest as the rumors gained momentum in Arizona. Between 6:00 and 16:20 UTC, November 4th, SharpieGate slowly began to gain steam as a number of mid-sized accounts (with follower counts between 50K and 500K) tweeted and retweeted claims about the pens bleeding through -often connecting the story to a larger narrative about systematic voter fraud. The first widely shared tweet in SharpieGate came from a mid-sized account that was retweeted 1595 times and immediately changed the frame of online discourse from one of sensemaking to one of claiming fraud: Notably, this tweet was amplified by Charlie Kirk, the founder and president of Turning Point USA when he quoted the above tweet at 08:14 UTC, adding "What's going on here?" in his tweet as he amplified the original. Kirk continued to use his influence (1.8M followers) to amplify other tweets from small to mid-sized accounts (including members of the "grassroots participants" stakeholder group) that spread misleading claims about Sharpie pens prior to other larger influencers joining the conversation and making it go "viral". For example, Kirk retweeted the following tweet (from an account with less than 500 followers), which was in turn amplifying the video of two women outside the polling station: 2020-11-04 15:24 @charliekirk11 <Retweeted tweet: @[Anonymized] : Breaking news AZ. Voters were purposefully given Sharpie markers in order to void their votes in Queen Creek and Gilbert. @PressSec I've said many times that AZ has a massive voter fraud problem every time an election occurs. SOMEBODY LISTEN!!!! Quoted tweet: @[Anonymized]:

They gave Trump voters sharpie pens and now votes for Trump are being invalidated! WTF! [embedded video]>
Kirk's efforts to shape and amplify the SharpieGate narrative occur just as it begins to surge, both early on as the first influential video gained traction and then directly prior to other large influencers, such as Eric Trump, taking notice.
Matt Schlapp, a conservative activist and lobbyist, also appears to have played an important role in facilitating the exponential growth of Sharpie rumors. Interestingly, Schlapp was previously involved in contesting the 2000 election between George H.W. Bush and Al Gore. In 2000, he attended the "Brooks Brothers riot" that successfully stopped the recount effort in Florida, ultimately resulting in the state being called for Bush and leading to him being the 41st President of the U.S. [37].
These examples provide a view into the interplay between everyday people and mid-and highlevel influencers in the SharpieGate discourse -something that was much more prominent in this incident than in the Sonoma or Dominion cases. Small and mid-sized grassroots accounts seeded initial tweets and rumors that influencers like Kirk and Schlapp were able to successfully amplify to their larger audiences.

Constructing Credibility through Amplification of Personal Experience.
The SharpieGate narrative relied upon claims of personal experience to lend credibility to claims that provided "evidence" of alleged fraud. This is visible in Table 6, where there are more first-person accounts of perceived evidence around SharpieGate than any other incident (16.02%). Additionally, the claims that started as first-hand accounts were referenced by others -10.55% of our coded tweets cited a vague account of someone else while 18.36% of the dataset was coded as referencing multiple sources (third person -vague numerous), as seen in Table 6.
This prevalence of personal experience created a core of plausibility for claims that were intended to delegitimize the election: people were seeing with their own eyes that Sharpies were being used, and that they were bleeding through ballots. What most people seemed to be unaware of is that ballots are designed to allow for bleed-through in a way that does not affect the machine counting of ballots. This caused a knowledge gap that was effectively exploited by politically-motivated disinformation that functioned to disrupt and hijack the sensemaking process. The aggregation of first person claims was used to support an overall sense of election fraud using a "where there's smoke, there's fire" model of logic. This process is exemplified in the below tweet where Kirk amplified Evan Kilgore, a Turning Point USA "Ambassador": 2020-11-04 16:55: @charliekirk11: What's going on here? <Quoted tweet: @EvanAKilgore: I'm seeing an uncomfortable amount of tweets that voters were given Sharpies to fill in their paper ballots yesterday and their vote was likely rejected by machines.> This demonstrates one of the most difficult hurdles to mitigating online disinformation: the mere existence of a rumor can be used as evidence of that rumor's validity if it is spread by enough people. This is especially true if the rumor mutates enough in its spread to look as though each permutation is its own piece of evidence -instead of simply a different version of the original rumor. This is particularly challenging due to the nature of genuine collective sensemaking: as people attempt to understand events in digital spaces there is increased uncertainty and speculation [34], but this natural speculation can be disrupted and hijacked, as it was in SharpieGate, for political or material gain simply by framing the uncertainty as evidence of nefarious intent. For example, Tyler Bowyer (@conservatyler), the Chief Operating Officer of Turning Point USA and Turning Point Action (both founded by Charlie Kirk), sowed doubt about the Arizona election by extrapolating from "reports" of Sharpie uncertainty: 2020-11-04 16:57: @conservatyler: In Maricopa Co there are reports of Sharpie bleeds preventing ballots from being accepted at voting machines and allegations that poll workers placed ballots into piles to remark new ballots with ballpoint pens for voters If this happened, entire AZ election is in question Importantly, the consolidation of people's experiences into a frame of doubt built upon the pre-existing relationship between the influencers and their audiences. This further amplified and shaped the deep story of fraud/conservative oppression, while also ensuring that any legitimate sensemaking was quickly wrapped into influencers' desired frame.

Capitalize on Momentum from Informal Mobilization for Tactical
Organization. The Sharpie-Gate incident included far more tactical mobilization than other incidents with 24.44%, 12.34%, and 18.8% of tweets from the Early, Random, and Most Retweeted sets containing tactical mobilization language (Table 7). These calls to action did not come out of nowhere but rather were the result of prior and simultaneous informal mobilization. Some high profile, nationally known accounts engaged mainly in informal mobilizing. For example, Fox News personality Maria Bartiromo tweeted out an aggregation of unsubstantiated events that cast doubt on the election and included the SharpieGate claims that was retweeted over 30,000 times: This tweet was retweeted by Eric Trump and other high-follower accounts. Bartiromo, Trump, and other similar influencers amplified and helped frame existent rumors. In this way, their primary role was to further amplify the rumors and connect them to the evolving construction of a deep story of widespread election fraud and oppression of conservative voters.
In contrast, a smaller number of national-level influencers appear to have used their high profile to not only informally mobilize, but to tactically mobilize audiences around SharpieGate. Notable amongst this group is Charlie Kirk, who, along with others associated with Turning Point organizations, facilitated moral legitimacy (building the moral resources that were missing when genuine sensemaking was the primary discussion) by reframing events and creating the illusion of widespread impact, and then helped organize protests.
Several examples of Kirk's involvement are shared in sections 4.2.2 and 4.2.3 in which he establishes moral legitimacy by amplifying rumors that ballots were being invalidated. Kirk/Turning Point then shifted toward tactical mobilizing by soliciting further evidence and support for an upcoming protest, and potentially for the court cases that were being filed (retweeted 3,993 times): 2020-11-04 17:20: @charliekirk11: ARIZONA this entire election is in YOUR HANDS. Stand up and fight back! Make sure EVERY legal vote is counted! RT! <Quoted tweet: @conservatyler: If you have info about your ballot not being accepted by the machine or Maricopa County poll workers suggesting to remark your ballot or to leave it behindâ = C" please DM me your detailed statement and contact information.
We are planning a protest rally at the recorders office!> Shortly after amplifying these tweets, Kirk tweeted a banner advertising the now-planned protest in the following tweet (retweeted 3,057 times): The above tweet was retweeted 777 times and connects SharpieGate to the #StopTheSteal campaign which would later become an essential calling card for those who participated in the January 6, 2021 insurrection attempt at the United States Capitol. After participating in the construction of moral legitimacy by manufacturing a misleading grievance, Schlapp then directed online audiences to check the status of their ballots online (retweeted 1,584 times): Importantly, as mentioned above, the online form Schlapp linked to was only designed to provide information about whether a voter's mail-in ballot had been used -which would have been "canceled" when they voted in person. It did not provide information about the status of their in-person ballot.
Additionally, as mentioned in 4.2.1, local organizations and individuals called for legal action -predominantly by sharing phone numbers soliciting participation to support lawsuits, as seen here (the number here is Kolodin Law Group's, the law firm responsible for filing the voter-driven lawsuit): The above tweet was posted by a now-suspended account, suggesting that it may have been one of, or supported by, the acounts in our "inauthentic accounts" stakeholder group, although it is difficult to make a determination without more information available. Regardless of its authenticity, soliciting tweets similar to the one above were spread in addition to numerous tweets calling for other actions to be taken, such as for voters to bring their own pens, and check the status of their ballots online. In SharpieGate, on-the-ground organizations seemed to play a pivotal role in what became one of the most contentious battlegrounds on and after election day. High level influencers played an organizing, albeit primarily informal, role through the construction of a deep story of widespread, systematic fraud, which was then capitalized on for tactical mobilization. In addition to the efforts of Kirk and Schlapp, local political activists, the Arizona GOP, and Kolodin Law Group mobilized audiences by leveraging their pre-existing socio-organizational, human, and material resources to either organize protests, spread tweets with links and phone numbers, field the calls of mobilized voters, and/or file lawsuits.

Dominion background.
The incident that we define as Dominion surrounds a brief error in vote reporting that occurred in Antrim County, Michigan that was erroneously used to claim that the voting software provided by Dominion Voting Systems (DVS) led to widespread issues and fraud. We primarily focus on the aftermath of this event in Antrim County, though the story eventually became tied to a larger conspiracy theory surrounding Dominion software in which the company is falsely accused of switching votes to thwart Trump's chances, having connections to Venezuela, and a myriad of other claims [1]. We include events important to the Dominion incident below.
On November 4, 2020, election officials in Antrim County paused vote counting operations after unofficial results were posted showing Biden with an almost 3,000 vote lead -something that was very unlikely in historically conservative Antrim County. The source of this error was that an employee had failed to properly update the voting software provided by DVS, causing the unofficial results to display different numbers than the official tabulator tape [18,23]. On November 6th, Antrim County's official Facebook page posted corrected results and a statement explaining that the cause of the display transposition was human error and was resolved [19]. Despite the correction, rumors and conspiracy theories continued to circulate about the error. Later that day at a joint press conference, Republican National Committee chairwoman Ronna McDaniel and then Michigan Republican Party chairwoman Laura Cox used the transposition error to falsely extrapolate that a voting machine glitch switched Republican votes to Democrat votes in 47 Michigan counties [15]. These claims were amplified on Twitter by Kayleigh Mcenany, former White House Press Secretary, causing the first spike in activity visible in Figure 6.
The Michigan Department of State [50] corrected the false claims from the press conference, stating that a clerk's failure to properly update the machine's software caused the discrepancy and that correct vote totals were still tabulated. Although the Michigan Board of State Canvassers certified the state's election results on November 23, former President Donald Trump and his allies continued to fight to delegitimize the results [68].
On November 23rd the Trump Campaign filed several lawsuits, including one attempting to halt vote certification in Michigan. On the same day, Michigan attorney Matthew DePerno filed a lawsuit on behalf of a Michigan resident who alleged that Antrim County's election machines were unreliable, citing the transposition that occurred on November 4 [15]. On December 4, the judge in the case issued an order allowing "forensic imaging" of 22 Dominion machines that was touted by conservative influencers and political elites as a success (purple in Figure 6). The examination was conducted on December 6 by Allied Security Operations Group (ASOG), a conservative-interest "cybersecurity" group. On December 9 the judge granted Secretary of State Jocelyn Benson's motion to intervene in the case and prevent the release of the ASOG report [15]. The prevent of the release was quickly met with a large number of tweets sowing doubt about Benson and Michigan's Attorney General's motives, claiming that they were hiding the truth (red in Figure 6).
Around the same time, Matthew DePerno spoke with media and built anticipation for the results of ASOG's forensic audit (orange prior to report release in Figure 6). In the wake of the Twitter campaign questioning Benson's integrity as well as DePerno's claims to the media, Benson withdrew her objection and allowed the release of ASOG's report. Michigan's Assistant Attorney General explained the logic of allowing the release of the report: given DePerno's media interviews in which he stated that Benson lied and that Antrim County's official election results were wrong, any attempt to suppress the report now would only incorrectly be seen as an attempted coverup [23].
On December 14, ASOG published their report alleging "irrefutable" proof of purposeful election manipulation by DVS and Michigan's election officials, notably a 68.05% error rate in Antrim County's tabulation logs. The claims from the ASOG report were widely discredited by experts, including the alleged 68.05% error rate, which had come about by dividing the number of perceived errors in the audit logs by the total number of lines in the audit log -a calculation that is meaningless not least because there are multiple lines per ballot in the logs and most of the errors were "benign warnings or errors" [16]). In response to the report and subsequent claims of fraud, Michigan election officials certified Antrim County's results on December 17, 2020 after a hand audit proved the original totals were accurate [3].
Notably, the Trump campaign commissioned its own internal researchers to look into conspiracy theories around Dominion software and another voting company called Smartmatic [65]. The researchers did not find any evidence of fraud related to Dominion, Smartmatic, or the claims connecting Dominion software and Smartmatic to Venezuela [65]. Despite this known lack of evidence, the conspiracy theories continued to be pushed and evidence sought to support them.
It is important to note that our data collection for the Dominion incident ended on December 15th, 2020, though the incident was clearly ongoing at that time. While our findings indicate very little tactical mobilization within the incident (prior to December 15th), the January 6th Committee has begun to reveal what appears to be extensive tactical mobilization that was based, in part, on the Dominion conspiracy that began as early as December 18th. This mobilization seems to have begun after a meeting where Rudy Giuliani, Donald Trump's personal lawyer, Trump himself, and Sidney Powell, a (temporary but influential) member of Trump's legal team, among others, argued with White House Counsel about the lack of evidence for election conspiracies. After the meeting, Trump tweeted his tweet calling for audiences to be at the capitol on January 6th (see introduction for full text). According to the January 6th Committee, this tweet functioned as a rallying cry for Trump supporters, including extremist groups, who subsequently began to tactically organize [45] [49].

Audiences Reframed Tweets Sowing Doubt as Fraud. Similarly to Sonoma (section 4.1.4) and
SharpieGate, online audiences in the Dominion incident consistently interpreted and reframed tweets that were either neutral or sowing doubt into evidence of fraud. Initially, tweets about the transposition were a mix of neutral reporting and commentary (24.49% neither claiming fraud nor sowing doubt in the Early sample, see Table 8) along with accounts that immediately interpreted the transposition as evidence of fraud (about 43% claiming fraud), leveraging the deep story that had been co-constructed over the previous months.
For example, the below tweet takes an initially neutral toned report from conservative, antiabortion news outlet @LifeNewsHQ about the transposition and interprets it through a frame of fraud: 2020-11-04 16:00:00: @[Suspended account]: I need a stronger stomach. The steal is so blatant I feel sick. <Quoted tweet: @LifeNewsHQ: BREAKING: County clerk in Antrim County in Michigan may have accidentally transposed the numbers for Trump and Biden (and John James) and is investigating. Trump and James will see a gain of about 6,000 votes once corrected.> @LifeNewsHQ's tweet was retweeted 3,298 times and although the tone of the tweet was fairly neutral, every tweet that quoted them in our coded sample (9 in total) interpreted the report as evidence of fraud. This suggests that even though the language in the tweet was accurate, their conservative audience was already primed to interpret reports using a frame rooted in the co-constructed deep story of widespread election fraud targeting conservative voters.

"Top Down" Conspiracy Legitimization by Political Elites.
The Dominion incident was defined by political elites generating support for conspiracy theories about election fraud, primarily timed and framed to manufacture support for the numerous lawsuits contesting election results in Michigan. The majority of these tweets served to sow doubt about the vote count transposition and provide evidence of its connection to the larger Dominion conspiracy theory. We found that 60.61% of our sample tweets were sowing doubt while 31.31% claimed fraud and 87.88% provided/amplified evidence in the Most Retweeted set (see Table 8).
On Twitter, the transposition of votes in Antrim County was consistently brought back into public awareness based on events in ongoing lawsuits in Michigan that were later widely dismissed. Updates from the lawsuits provided perceived evidence that supported the false and misleading claims of fraud. The case in Antrim was unique because the truth that an error had been made added a core of plausibility to further, baseless, claims that extrapolated first to claims that glitches were rampant in other counties, and then towards conspiracy in the form of the Dominion conspiracy theory. The above tweet specifically amplified a claim from the press conference that extrapolates from the initial error, sowing doubt not just about Antrim County, but about the entire Michigan election. Two hours later, conservative journalist/media personality Kyle Becker posted the following tweet explicitly connecting the transposition to Dominion Voting Systems: Becker's tweet (retweeted 37,636 times) launched the Antrim story narrative to virality on Twitter, but more than that he sowed doubt about the connection between the transposition, Dominion software, and highly contested swing states where vote counts were being contested.
Once the Antrim connection to Dominion software and the larger Dominion conspiracy was spread widely on Twitter, users amplified and added to the conspiracy theory over the next several weeks until November 14, when Rudy Giuliani added more fuel to the fire and used his influence to mobilize audiences to look into the already spreading Dominion conspiracy (retweeted 40,960 times): From this tweet two primary mobilizing strategies visible throughout our dataset are apparent. First, the tweet connects the Dominion conspiracy theory to underlying elements of a deep story of American conservatism. Second, the tweet identifies certain states that used Dominion software, implying that people should question the results of elections in those states specifically (not unlike Becker's tweet earlier in the incident). Interestingly, though 28 states use Dominion software, the tweet only mentions states that were highly contested swing states [54]. Together, these themes demonstrate the type of informal mobilizing that was prevalent in the incident (ranging from 51% to 72% across incidents, see Table 8).
Additionally, the tweet directs supporters to "look up Smartmatic" and provide Giuliani with their findings -a tactical call not unrelated to calls to "do your own research" widely seen in the QAnon conspiracy theory community. One important difference, of course, is that Giuliani had a direct line to the then-President of the United States, and was actively promoting and soliciting evidence for a conspiracy theory, and by doing so, provided institutional and moral credibility to the theory.

Leveraging Legal Systems to Construct
Credibility. The content of the Dominion incident revolved around amplification of offline legal events. The perceived legitimacy of legal proceedings helped construct credibility for the continuous digital conspiracy theorizing present in the incident. Visible in Table 8, the primary activity in the Dominion incident was the providing and amplification of "evidence" of fraud (ranging from 79% to 90% across our datasets). Looking at the source of the alleged evidence, 20.53% of the tweets coded in the Dominion dataset were labeled as coming from an official source and 41.72% came from media outlets ( Table 6). In this case, tweets and media were referring to "expert witnesses" or the forensic audit report. Of the tweets that were labeled as coming from a media outlet, 82% were amplifying legal proceedings covered in different articles (all with frames of doubt or fraud).
An instructive example comes in the form of former President Trump's tweet amplifying an Epoch Times tweet quoting a witness from one of the several ongoing (and later dismissed) lawsuits: 2020-12-01 13:59: @realDonaldTrump: We won Michigan by a lot! <Quoted tweet: @EpochTimes: "Dominion alone is responsible for the injection, or fabrication, of 290,000 illegal votes in Michigan, that must be disregarded." #Michigan: An expert witness for @SidneyPowell1 says there were 4 "physically impossible" spikes of about 385,000 #Ballots.> Interestingly, the witness in question was Russell J. Ramsland, the founder of ASOG, the same company that days later performed the "forensic imaging" of Dominion machines in Antrim County.
Importantly, the construction of credibility within the Dominion incident occurred over an extended period of time where political elites and influencers continuously amplified legal updates favorable to them and delegitimized updates that were unfavorable. This trend is visible in Figure 6 throughout the timeline -particularly after December 1st. First through the amplification of the Judge's order in the Antrim case to allow "forensic imaging, " then through the pressure campaign against Secretary of State Benson, and then through the subsequent release of the results of the ASOG report. The first event is exemplified by a tweet from Guiliani who lent his influence, along with other mega-influencers like Eric Trump who appear to exemplify our "Cultivator" category, to amplify and frame the Judge's order (retweeted 34,569 times): Here, Guiliani implicitly referenced the Dominion conspiracy theory through the use of the signal word "untrustworthy" and further emphasized, falsely, that the transposition was not an isolated incident.
The second event occurred days later, December 9, when the same Judge granted Secretary of State Benson's motion to intervene, preventing the release of the report conducted by ASOG. In response, a slew of conservative elites and influencers tweeted and mobilized their online audiences in an effort to pressure Benson into releasing the results. Of these, conservative influencer Candace Owens' tweet was the most popular, with 24,401 retweets: 2020-12-11 22:41: @RealCandaceO: This needs to go VIRAL. Michigan has completed a forensic audit of the Dominion voting machines to see if they were rigged-the Attorney General of the state is now BLOCKING the disclosure of the audit results? WHY??!! What is Michigan hiding?! #STOPTHESTEAL <Quoted tweet: @LouDobbs: Secret Audit: @pjcolbeck slams efforts by Michigan's AG and the courts to hide a forensic audit of Dominon's voting machines in a county where 6,000 votes were flipped from @realDonaldTrump to Biden. #MAGA #AmericaFirst #Dobbs> The above tweet exemplifies the tone present during this campaign, which effectively functioned to frame Benson's intervention as proof of fraud. It also shows what tactical mobilization looked like in the Dominion incident on Twitter: it was primarily focused on digital actions to support the lawsuits. Although the proportion of tactical mobilizing tweets in our sample were small (only 8.49% in Most Retweeted, see Table 8), they came exclusively from influential accounts such as Owens and Guiliani and appeared to be successful in their outcomes given the result of the pressure campaign and wide spread of the Dominion conspiracy.
Finally, following the pressure campaign, the release of the report was greeted with mass amplification from accounts of all sizes, the most retweeted version (39, Trump's reaction was not dissimilar to most tweets in our dataset, the general interpretation of the report was that it was hard evidence of fraud (which it was not). In particular, the (debunked) statistic of a 68.05% error rate was highly cited, interpreted by many accounts to validate the Dominion conspiracy theory.

Informal and Tactical Mobilization are Intertwined and Self Reinforcing
Our findings show how disinformation can be used to manufacture grievances and the illusion of moral legitimacy that fulfill the role of the moral resources required to mobilize a social movement according to resource mobilization theory. The informal mobilization of a disinformation campaign is effective in producing support for an issue needed to grow the movement as well as distribute material resources that were previously constrained by moral resources.
Our coding and analysis reveals a strong self-reinforcing connection between informal and tactical mobilization based on participatory disinformation, visible in Figure 1. We observed a process by which disinformation enabled the collaborative construction of a misleading reality along with the moral resources need to mobilize, discussed in Section 5.2 below. Once a critical mass of moral resources was reached, and the timing was right for organizers, support was mobilized for physical events such as protests and lawsuits, snapshots of which were in turn disseminated to further reinforce the deep stories founded in disinformation, a cycle visible in Section 5.3 below. For example, as SharpieGate was going viral due in part to the efforts of Schlapp and Kirk, the AZ Patriots were motivated to catalyze the first protest (on November 4). At that protest, members of AZ Patriots and other protesters hassled an elections employee for a comment on Sharpies while filming, the recording of which was immediately taken out of context, mis-represented, and amplified to further build legitimacy around the Sharpie claims, and fraud claims more generally.

Informal Mobilization Manufactured Reality
Our analysis demonstrates that reality was co-constructed by those who genuinely believed the election was stolen and those who strategically pushed misleading information (see Sections Figure 7), participatory disinformation functioned to manufacture a reality based on deep stories of widespread fraud, including defining the heroes and villains, specifics of manufactured grievances and injustices, and the perceived evidence legitimizing the stories. Once audiences were fully invested in this version of reality, in which widespread, strategic voter fraud was facilitated by Democrats and their alleged allies, the foundation was laid to tactically mobilize online audiences for protests, pressure campaigns, and other specific actions that organizers directed attention towards. Fig. 7. Process by which informal mobilization was facilitated through participatory disinformation to manufacture reality, which then became a lens or frame through which audiences interpreted subsequent information/events. Emergent events, including organically occurring events and those specifically motivated by the disinformation campaign, spark interest online, leading to initial sensemaking by online audiences at the same time that disinformation cultivators and influential accounts selectively amplify events and frames of those events that align with disinformation messaging. Even if unmotivated sensemaking is given space to occur at scale (which is not always the case, indicated by the dotted line) that sensemaking is disrupted by strategic framing of events amplified by disinformation cultivators, influential accounts, and cultivated members of the online audience. Online audiences interpret events based in their understandings of underlying deep stories related to the event, resulting in the collaborative construction of perceived "evidence" of fraud and informal calls to action based on that perceived evidence. Disinformation cultivators and influential accounts wrap individual claims and events into meta-narratives of fraud, often framing the event as one example of many and in the process eliminating the context surrounding individual claims, as well as important specifics such as the source or reliability of the claim -including sources influenced or seeded by the cultivators themselves. Inherent throughout this process is the further construction and solidification of underlying deep stories, as online audiences continue to create in-group boundaries and villainize out groups at the same time as integrating the novel event and associated manufactured grievances and constructed legitimacy into the relevant deep story. Taken together, this process generates a manufactured version of reality that in turn further influences perceptions of future events.
A key finding is that genuine sensemaking was disrupted by disinformation in order to confuse or redirect conversations (see Section 4.2.2). In most cases audiences interpreted events through the deep story of fraud. However, in some cases, most visible in SharpieGate, there was genuine confusion before disinformation solidified the narrative to one of voter fraud. In these cases, we observed how political influencers like Charlie Kirk amplified unwitting agents (or other in-group members like his colleagues at Turning Point USA/Action) who interpreted events through a frame of fraud, or reframed audiences' personal experiences as evidence of fraud (Section 4.2.3).

Specific Tactics Visible within Informal Mobilization.
The digital conversations we examined demonstrated several tactics that were utilized in one or more of our case studies to informally mobilize audiences. First and foremost, influential accounts often shifted the tone of discussions through selective amplification, often for political aims. In the cases of SharpieGate and Dominion, influencers amplified specific tweets or offline events, often removing important context in the process (see Sections 4. 2.2 and 4.3.4). This complements previous work that identifies the use of visual evidence collages to generate the illusion of authenticity in a way that often removes the context of the original "evidence" [42]. Although visuals were not always used in the data we examined, the decontextualization of specific claims was a primary driver of the disinformation we examined.
Although many claims of fraud were provided and/or amplified by influential accounts, less influential, grassroots members of online conversations were critical to the process (see Sections 4.1.4, 4.2.2, 4.2.3, and 4.3.2). These audiences played an essential role in the interpretation, framing, and amplification of different claims as well as a source for new claims. Participation was both organic, in that many grassroots accounts posted or amplified evidence without prompting, and solicited, in that influential figures provided direction for what to look for or what to do. Dominion provides an illustrative example in the form of Giuliani's call to look up Dominion and Smartmatic and tweet him their thoughts. This call facilitated a further search for (conspiratorial) evidence that was already widely proliferated online as part of the broader Dominion conspiracy theory, as well as a potential source of new "evidence" to amplify.
Second, conversations were focused on the co-construction and amplification of alleged evidence of fraud to present the appearance of legitimacy. However, not all "evidence" is created equal and personal experience along with evidence associated with legal processes was prioritized, helping to construct the appearance of credibility (Sections 4.3.4 and 4.2.3). Relatedly, in cases where the experience was not personal to the reader, in-group experiences were prioritized as seen in Sonoma where an unnamed man, framed as a concerned citizen, was the alleged source of photos shared by Schaffer and GWP.
Third, influential accounts often created the illusion of widespread fraud through two primary mechanisms: 1) the consolidation of multiple specific alleged stories of fraud into single tweets (see Sections 4.2.4), and 2) the extrapolation from one event to the potential that the event referenced was occuring everywhere, usually contested swing states (see Section 4.3.3).
Lastly, influential accounts that disseminated or amplified specific "evidence" of fraud often did so using a frame of sowing doubt, hedging as to the verifiability of the claim, but implying its veracity (e.g. Section 4.1.4). Importantly, they did not need to explicitly make claims, as their audiences quickly seized on the "evidence" and interpreted it through the lens of the reality they had collaboratively shaped. Hedging behavior is well exemplified by Schaffer and the GWP in Sonoma, Kirk and Schlapp in SharpieGate, and, prior to the ASOG report, Trump and Giuliani in Dominion. Hedging posts often leveraged the deep story of fraud to imply that even if the specific amplified claim isn't true, the deep story as a whole is true. Using this strategy, the deep story was used as implied evidence for the claim at the same time as the claim being presented was added as evidence for the deep story, creating a self-reinforcing construction of moral legitimacy.

Tactical Mobilization was Driven by Manufactured Reality
Once moral legitimacy had been constructed and audiences were primed to see fraud in even seemingly mundane events, tactical mobilization occurred (visible in Figure 8). Depending on the incident and the specific goals of organizers, tactical mobilization involved both physical and digital calls to action, such as calls to protest, to investigate potential fraud (e.g. look into cancellation of mail-in ballots, Section 4.2.4), to amplify tweets, or to call numbers to report experiences. For example, in SharpieGate, a mix of more localized groups, such as AZ Patriots, and nationally known accounts, such as Kirk and Turning Point USA/Action, mobilized audiences for specific actions. Critically, this mobilization served to support other initiatives such as ongoing lawsuits (as seen with the spread of Kolodin Law Group's number) and more general claims of "widespread" voter fraud (Section 4.2.4).
Another telling example exists in the case of Dominion, which is an incident defined by the amplification of offline activity. Most of the virality around Dominion functioned to informally mobilize audiences, manufacturing grievances around claims in Dominion that were notably debunked by an internal team, [65] suggesting that the continued proliferation of the conspiracy theory was clear disinformation in a way most disinformation campaigns manage to avoid. Our analysis shows that witness statements, exhibits, and other forms of evidence granted perceived credibility by the legal system were soliticed and amplified whenever an update seemed favorable to the conspiracy theory, further building moral legitimacy, seen in Section 4.3.4.
What is interesting in the case of Dominion is that the tactical mobilization visible in our data was primarily digital (e.g. Candace Owens' call to retweet her tweet sowing doubt about Jocylen Benson's intentions, Section 4.3.4), if it existed at all. While it was not directly visible in our sample, the January 6th Committee has begun to reveal what appears to be extensive tactical mobilization that was based, in part, on the Dominion conspiracy theory that began as early as December 18th (three days after the end of our sample). After meeting with Giuliani and Powell, Trump tweeted a call for audiences to be at the capitol on January 6th: Fig. 8. Process by which tactical mobilization occurred, leveraging a critical mass of moral resources that was generated through participatory disinformation. For tactical mobilization to occur, audiences must first be primed (informal mobilization, see Figure 7), and mobilizing resources made available. During the 2020 Presidential election, once those conditions were met, disinformation cultivators and influential accounts as well as grassroots participants and some inauthentic accounts (only somewhat visible in our data) mobilized audiences for both online and offline actions depending on the incident. The mobilizing was context dependent; for example, if the goal was simply to spread doubt and discontent, the main calls to action were to amplify false or misleading frames of events or digitally target specific individuals. As audiences were mobilized, resulting events often generated further fodder to digitally amplify for continued informal mobilization, which in turn motivated audiences to participate in future tactical mobilization.
spreading the misleading content featured in our case studies were also present and/or played a role in organizing the events of January 6th. For example, Elijah Schaffer, a primary catalyst in the Sonoma Incident, tweeted from inside of Nancy Pelosi's office during the violent attack there, saying "I am inside Nancy Pelosi's office with the thousands of revolutionaries who have stormed the building" [55] and Charlie Kirk, a key figure in the SharpieGate Incident, tweeted that "...The team at @TrumpStudents & Turning Point Action are honored to help make this happen, sending 80+ buses full of patriots to DC to fight for this president" [40].
Regardless of the level of tactical mobilization in our sample, the lawsuits taking place in Michigan managed to successfully weaponize the legal system to strategically amplify decontextualized aspects of the lawsuits in order to spread the Dominion conspiracy theory, undermine public trust in electoral systems, and ultimately try to overturn the election. Although it is tempting to look to the fact that the bulk of the lawsuits were dismissed, it is important to recognize that in many ways the disinformation campaign succeeded: the level of consistent virality in Dominion was immense and public trust in electoral systems dropped heavily among many conservative audiences -a drop starkly visible by looking to the events of the January 6th insurrection attempt and number of people who still believe the election was stolen [30].

Implications
Recent research explores the role of personal action frames in connective action [12] and CSCW researchers have examined how digital social movements translate online support into offline, collective action [69]. CSCW research has also explored how disinformation is a participatory process [6,58,67]. Our work builds on this work, and suggests that participatory disinformation played a pivotal role in mobilizing audiences in 2020 through a complex, self-perpetuating process guided by political elites and influencers in both online and offline spaces. Although the process was heavily participatory, our work adds to an emerging body of literature suggesting that a small number of individuals are responsible for facilitating the spread of a large proportion of disinformation [39].
A key finding of our work is that many of these influential figures amplified specific pieces of alleged evidence in a way that allowed themselves to be distanced from having to take responsibility for the spreading of falsehoods. Additionally, their audiences interpreted their ambiguous tweets using a frame of fraud, making it so that influential figures rarely, if ever, had to make specific claims to imply the existence of widespread fraud. Using this strategy, the deep story was used as implied evidence for the claim at the same time as the claim being presented was added as evidence for the deep story, creating a self-reinforcing construction of moral legitimacy.
This effect illuminates why thinking of disinformation as simply a matter of facticity has not proven effective for mitigating its spread. Any given fact-check can only correct a relatively small number of claims and even those claims remain useful in supporting the underlying deep story. Crucially, the deep story of voter fraud also delegitimizes the media and fact checkers. Consequently, those who already believe the deep story are unlikely to believe corrections of false claims.
This suggests that in order to disrupt the mobilization of audiences based on disinformation, moderation and mitigation efforts need to attend to more than the specifics of any individual post. Instead, they need to recognize the long term, often subtle strategies used by specific individuals and organizations and consider moderating based on patterns of behavior instead of specific claims.
Additionally, our work suggests that the primary difference between social movements based on disinformation and social movements not based on disinformation is the malleability of the underlying story and its accompanying narratives: because those who generate disinformation are motivated primarily by ends outside of the stories they spread (e.g. power, financial gain, etc.) they are more free to disregard facticity, as spreading the content of their message was never their primary goal. The very structure of a participatory disinformation campaign functions to muddy the lines between genuine engagement and motivated propaganda in such a way that the result looks and sounds like a traditional social movement, when in fact it is a deliberate effort whose goals are known mainly by those who strategically disseminate (and even opportunistically come to believe) the misleading claims.

Limitations
In attempting to understand the relationship between online and offline behaviors, data availability is a major barrier, and our study was no exception. Although Twitter acts as a useful starting point because of the number of users and its relative accessibility, it is only a piece of the full picture needed to understand how audiences are mobilized based on disinformation. Moreover, our incidents are only glimpses of disinformation that we know existed on Twitter. One outcome of our work was the realization that mobilization didn't always occur in the same tweet as those spreading disinformation, meaning that our sampling method limited the amount of mobilization rhetoric we were able to see.
Additionally, we identified that much of the mobilizing occurred by referencing an implicit deep story. Due to the nature of deep stories, they may only be fully understood by those in the in-group. As observers we often had to piece together stories over many tweets, with some tweets (especially quote tweets) that acted as "translators" and described what more ambiguous tweets were referencing. Even with our analysis, there are elements of the stories being spread that we do not fully understand that seem to stretch back far beyond the 2020 election.

Future Work
Based on our study, there are several important avenues for future work that may prove fruitful in better understanding how mobilizing disinformation has, and continues to, affect our digital and physical communities. First and foremost, looking at communities on platforms outside of Twitter is crucial. We know that disinformation campaigns are cross-platform, a fact underscored by the prevalence of tweets in our data that referenced content on other social media platforms. Additionally, researchers should continue to explore the different roles played within disinformation campaigns. Our work suggests that participatory disinformation campaigns may rely on entities that play slightly different roles than more top-down campaigns. And finally, more deliberate work should be done in understanding the interaction between offline and online events in spreading disinformation, as deliberate offline efforts had an immense impact on online conversations in our case studies.
Another area that is vital to explore, but fraught with complexity, is how to mitigate the negative impacts of participatory disinformation, particularly with regards to its mobilizing potential. One of the findings of our work is that there is very little difference between activism motivated by disinformation and activism motivated by genuine grievances. It is therefore important to recognize that many efforts to mitigate mobilization surrounding disinformation would also have negative impacts on mobilizing online audiences to, for example, resist oppressive regimes. Traditional mitigation approaches such as platform moderation that utilize labels or limit the reach of organizers who spread false claims would be incredibly difficult to implement, particularly because of the often ambiguous nature of claims within a disinformation campaign. It is without a doubt important to pursue mitigation efforts, but those efforts must attend not just to their success at limiting disinformation, but also to the inevitable side effects that may prevent online discourse and collective action based on legitimate grievances.