Narrative
Threat
Assessment

From early 2026, the Trump administration intensified diplomatic and military pressure on Iran, creating a cascading effect on NATO's internal cohesion. European allies faced simultaneous pressure from Washington on burden-sharing obligations and the prospect of being drawn into a conflict outside the alliance's traditional geographic scope.

The information environment around this crisis became a contested terrain where competing narrative frames circulated at scale — some challenging the legitimacy of NATO's role, others contesting the legal basis of allied military participation, and several directly targeting the reliability of the United States as a security guarantor. The dominant narrative family (N18, 362 texts) framed Trump as exerting coercive pressure to force European allies into a conflict they considered illegal under international law.

• 20 FEB 2026
  Trump publicly targets Iran — first discourse activation (+30% volume)
• 28 FEB 2026
  US-Israeli strikes begin — volume surge +135%, first major cluster activation
• 16 MAR 2026
  Escalation phase — European NATO framing intensifies (+148%)
• 25 MAR 2026
  Trump publicly attacks NATO — 120 posts, +215% single-day surge
• 31 MAR 2026
  Infrastructure ultimatum — 328 posts, continued escalation toward peak
• 01 APR 2026
  Trump threatens NATO withdrawal — 485 posts (absolute peak), 26.5M views in a single day, amplification ×49 vs. baseline

The study focuses exclusively on English-language content on Twitter/X with a minimum engagement threshold of 5 retweets. This filter retains only content that achieved measurable amplification, eliminating noise while preserving the organic dynamics of narrative dissemination. The resulting corpus captures the visible, amplified layer of the information environment — not its full volume, but its most consequential signal.

This study applies a sequential, multi-modal analytical pipeline. Each phase builds directly on the previous, moving from raw corpus characterisation through semantic clustering, narrative coding, and finally coordinated visual signal detection. The pipeline combines natural language processing with computer vision, treating the information environment as both a textual and visual phenomenon.

• Phase 1
  Descriptive Analysis — Corpus mapping, temporal dynamics, source and account distribution. Identifies peak events, engagement concentration, and the top amplification nodes in the network. Establishes the structural baseline against which narrative analyses are interpreted.
• Phase 2
  Topic Modeling — Semantic clustering using UMAP dimensionality reduction and HDBSCAN unsupervised clustering (min_cluster_size = 15). 36 clusters identified from 3,510 posts. 69.4% classified; 30.6% noise — a rate that reflects genuine narrative complexity, not a methodological artefact.
• Phase 3
  Narrative Analysis — 21 canonical narratives coded and mapped to a two-axis threat matrix (internal fracture vs. external threat × legitimacy vs. cohesion targeting). Temporal trajectories analysed over 7 periods. Five mirror-narrative pairs identified. Similarity threshold: 0.70 cosine (observed average: 0.730).
• Phase 4
  Visual Analysis — Image clustering and visual coordination detection. 13 visual clusters identified. 9 significant coordination groups (score ≥ 0.90, 5+ posts). 82 accounts profiled across groups. Final score = visual similarity × temporal score. Priority group G04: 2 accounts, 7 posts, score 0.98–1.00.

The corpus is restricted to English-language content and excludes sub-threshold engagement. Visual analysis covers image-bearing posts only. The 30.6% noise rate in Phase 2 reflects the genuine heterogeneity of the information environment. No claim is made about the intentionality of individual actors unless explicitly supported by multi-signal convergence.