Paper deep dive

Ctrl-F-Resist. Practices, Challenges, and Technical Needs of Civil Society Organizations Monitoring the Far-Right Online

Elisabeth Steffen, Helena Mihaljević

Year: 2026Venue: arXiv preprintArea: cs.HCType: PreprintEmbeddings: 130

Intelligence

Status: succeeded | Model: Gemma-4-26B-A4B | Prompt: intel-v1 | Confidence: 91%

Last extracted: 9/5/2026, 3:26:06 AM

Summary

This paper investigates the practices, challenges, and technical needs of Civil Society Organizations (CSOs) in Germany that monitor far-right online activity. Through qualitative interviews with 15 practitioners, the study reveals that monitoring is predominantly manual due to a lack of tailored tools, legal uncertainties, and underfunding. While CSOs are open to AI for media processing (e.g., OCR, transcription), they remain skeptical of automated content classification due to trust and legal concerns. The authors introduce the 'manual labor trap' concept and present an open-source Telegram monitoring prototype designed to support flexible, human-centered workflows.

Entities (7)

Germany · location · 99%Civil Society Organizations · organization · 98%Far-Right Actors · group · 95%Enhanced Search Capabilities · technical-need · 93%Telegram · platform · 92%Manual Labor Trap · concept · 90%Automated Content Classification · technology · 88%

Relation Signals (8)

Civil Society Organizations → performs → Online Monitoring

confidence 95% · CSOs engage in long-term, contextualized analysis... monitoring antidemocratic dynamics online.

Civil Society Organizations → uses → Manual Methods

confidence 94% · monitoring remains largely manual due to the lack of tailored tools

Civil Society Organizations → requires → Enhanced Search Capabilities

confidence 93% · enhanced search capabilities emerging as the most pressing technical need.

Civil Society Organizations → facesbarriers → Chronic Underfunding

confidence 92% · CSOs face significant barriers... including legal uncertainty, limited platform access, and chronic underfunding.

Civil Society Organizations → facesbarriers → Legal Uncertainty

confidence 90% · CSOs face significant barriers... including legal uncertainty...

Telegram → istargetof → Monitoring Prototype

confidence 90% · implementation in an open-source Telegram monitoring prototype

Civil Society Organizations → isskepticalof → Automated Content Classification

confidence 88% · many remain skeptical of automated classification, citing concerns around trust, legal usability, and professional credibility.

Civil Society Organizations → isopento → AI-Supported Media Processing

Cypher Suggestions (0)

No Cypher suggestions yet.

Abstract

Abstract:As far-right actors increasingly exploit online platforms to disseminate ideology and mobilize supporters, civil society organizations (CSOs) play a vital yet underrecognized role in monitoring antidemocratic dynamics online. Unlike fact-checkers or content moderators, CSOs engage in long-term, contextualized analysis, often in resource-constrained settings and under precarious conditions. Despite their critical societal role, CSOs face significant barriers to adopting or co-developing technical solutions, including legal uncertainty, limited platform access, and chronic underfunding. Existing research and tool development efforts have largely overlooked these actors in favor of more institutionally embedded stakeholders. This paper addresses this gap through a qualitative study with 15 practitioners from 12 Germany-based CSOs engaged in online monitoring, positioning them as key yet overlooked stakeholders in the governance of digital spaces. We explore their current practices, challenges, and expectations regarding technological support. Our findings show that monitoring remains largely manual due to the lack of tailored tools, with enhanced search capabilities emerging as the most pressing technical need. While participants express openness to AI-supported features such as media processing and content discovery, many remain skeptical of automated classification, citing concerns around trust, legal usability, and professional credibility. Grounded in these findings, we introduce a conceptual monitoring workflow and describe its implementation in an open-source Telegram monitoring prototype designed to flexibly support diverse monitoring goals. We outline concrete design, policy, and research recommendatios, and introduce the manual labor trap as an empirically grounded concept that explains why monitoring CSOs tend to remain locked into labor-intensive, low-capacity arrangements.

PDF

Open source PDF →Open local PDF →

Trouble viewing inline? Open PDF directly →

Full Text

126,738 characters extracted from source content.

Expand or collapse full text

Ctrl-F-Resist. Practices, Challenges, and Technical Needs of Civil Society Organizations Monitoring the Far-Right Online Journal: PACMHCIVolume: 106CSCW06810DOI: 10.1145/3816916CCS: Human-centered computing Empirical studies in collaborative and social computingCCS: Human-centered computing Open source softwareCCS: Human-centered computing HCI design and evaluation methodsCCS: Computing methodologies Search methodologiesCCS: Computing methodologies Information extractionCCS: Applied computing Document searchingCCS: Information systems Information extraction Elisabeth Steffen email: steffen@htw-berlin.de Affiliation: Hochschule für Technik und Wirtschaft, University of Applied Science, Berlin, Germany Affiliation: Technische Universität, Technical University, Berlin, Germany and Helena Mihaljević email: helena.mihaljevic@htw-berlin.de Affiliation: Hochschule für Technik und Wirtschaft, University of Applied Science, Berlin, Germany Received April 9, 2026 Abstract. As far-right actors increasingly exploit online platforms to disseminate ideology and mobilize supporters, civil society organizations (CSOs) play a vital yet under-recognized role in monitoring antidemocratic dynamics online. Unlike fact-checkers or content moderators, CSOs engage in long-term, contextualized analysis, often in resource-constrained settings and under precarious working conditions. Despite their critical societal role, CSOs face significant barriers to adopting or co-developing technical solutions, including legal uncertainty, limited platform access, and chronic underfunding. Existing research and tool development efforts have largely overlooked these actors in favor of more institutionally embedded stakeholders. This paper addresses this gap through a qualitative study with 15 practitioners from 12 Germany-based CSOs engaged in online monitoring, positioning them as key yet overlooked stakeholders in the governance of digital spaces. We explore their current practices, challenges, and expectations regarding technological support. Our findings show that monitoring remains largely manual due to the lack of tailored tools, with enhanced search capabilities emerging as the most pressing technical need. While participants express openness to AI-supported features such as media processing and content discovery, many remain skeptical of automated classification, citing concerns around trust, legal usability, and professional credibility. Grounded in these findings, we introduce a conceptual monitoring workflow and describe its implementation in an open-source Telegram monitoring prototype designed to flexibly support diverse monitoring goals. To account for the sociotechnical character of CSO monitoring, we outline concrete design recommendations as well as recommendations for policymakers and academic research. In addition, we introduce the manual labor trap as an empirically grounded concept that explains why monitoring CSOs tend to remain locked into labor-intensive, low-capacity arrangements, and propose to develop a CSCW-grounded theory of collaborative sociotechnical scaling to better understand both the promise and challenges of collaboration as a pathway beyond fragmented, labor-intensive monitoring work. Keywords: Online monitoring, Social media monitoring, Civil society organizations, Far-right mobilization, Content moderation, Human-centered AI, Telegram, Civic technology, Open source software, User research, Expert interviews, Thematic analysis †c-license: by 1. Introduction Over the past decades, antidemocratic behavior in online spaces has become increasingly visible, normalized and strategically organized (Immenkamp et al., 2024; ADL Center for Technology & Society, 2023). Far-right actors have developed considerable media literacy (Conway et al., 2019), strategically utilizing discussion forums (Åkerlund, 2021), mainstream platforms like TikTok (Widholm et al., 2024; Classen et al., 2024) and Instagram (Mellea, 2024; Beauduin, 2025), as well as ‘alternative’, largely unmoderated spaces like Telegram (Rothut et al., 2024; Guhl et al., 2020; Schulze, 2020) to mobilize supporters and disseminate ideology. These developments intensify during crises and significant policy changes, e. g. during the COVID-19 pandemic or in the context of elections (Institute for Strategic Dialogue, 2024). In the context of these events, right-wing and conspiratorial groups amplified their narratives and mobilization efforts via online platforms (Darius and Stephany, 2022; Buehling and Heft, 2023; BBC News, 2024) which function not only as spaces for coordination and mobilization but also as arenas for performative self-promotion, including live video streams of demonstrations (democ, 2023), visual documentations of criminal acts (Karimi, 2021) or violent attacks against individual political opponents (Geiler and Fröhlich, 2024). Monitoring of respective dynamics is key to understanding and mitigating potential harms for individuals and society. Computational research is increasingly addressing the needs of practical stakeholders, especially by developing algorithmic methods and tools to detect, analyze, or mitigate online harm (Fortuna and Nunes, 2018; Yang et al., 2022; Guo et al., 2022). However, much of this research has focused on fact-checking (FC) and content moderation (CM), both in application scenarios and in the design of user studies, while the specific needs, constraints, and workflows of civil society organizations (CSOs), remain underexplored (Bäumler et al., 2025). In particular, the design of technical tools tailored to CSOs’ monitoring requirements remains an open challenge. To address this gap, this paper examines how CSOs monitor and analyze antidemocratic dynamics on social media, based on a qualitative study with 15 practitioners from 12 Germany-based organizations engaged in online monitoring. Our contribution is threefold: first, we provide an in-depth empirical account of CSO monitoring practices under complex organizational and political conditions; second, we derive design implications and integrate them into an ongoing co-creation process to develop a durable open-source tool; and third, we introduce the manual labor trap as an empirically grounded concept and propose to develop a CSCW-grounded theory of collaborative sociotechnical scaling that helps to understand how collaborative infrastructures might enable alternative scaling trajectories. Our investigation is guided by the following three research questions: • RQ1: What are the current practices and workflows employed by civil society organizations to monitor social media for antidemocratic content and actors? • RQ2: What technical, ethical, and legal challenges do these organizations encounter in their monitoring efforts? • RQ3: What are their needs and expectations regarding technological support? Our findings show that online monitoring by CSOs remains largely manual, primarily due to the lack of tailored technical tools. Persistent ethical and regulatory challenges hinder cross-organizational collaboration – both in terms of data sharing and coordination of content-related efforts – which, in turn, limit the potential for resource-efficient, collaborative technical innovation. The most frequently articulated technical need is for improved search capabilities across a broad range of content types and modalities, including audio, images, and video. AI-based automation is perceived as potentially useful for media processing tasks such as transcription or optical character recognition (OCR). However, participants expressed substantial skepticism toward automated content classification, highlighting a gap between current research trends and the practical realities faced by CSOs. Trust plays a central role: AI is often viewed not only as unreliable, but also as a potential threat to legal validity, professional credibility, and the value of human expertise. We introduce a conceptual monitoring workflow grounded in our empirical findings and demonstrate its implementation in a monitoring software prototype through eight new components which are designed to flexibly support the diverse thematic interests of monitoring CSOs and to be configurable through lightweight default settings that accommodate their varying and often limited technical capacities. This study contributes to the CSCW community by foregrounding civil society actors as key yet often overlooked stakeholders in the governance of digital spaces, and by showing how grassroots monitoring operates under precarious, adversarial, and politically charged conditions, reflecting CSCW research on invisible work and articulation work (Star and Strauss, 1999; Schmidt, 2011). Moreover, this work contributes to HCI research on human-centered AI (Auernhammer, 2020; Bingley et al., 2023) within the context of civil society online monitoring. Our empirical and design-oriented insights identify what is needed to enable sustainable civic technologies that align with the values and working conditions of those on the front lines of defending democracy online. We provide six directions for future CSCW research that could deepen engagement with civil society needs, advance responsible technology integration, and foster more inclusive forms of digital governance. We further make three recommendations for policy makers and ten recommendations for the design and development of monitoring tools. Finally, we extend CSCW scholarship on sociotechnical infrastructuring (Star and Ruhleder, 1994; Neumann and Star, 1996; Karasti, 2014) and heterogeneous, collaborative knowledge production (Ackerman et al., 2013; Star and work(s):, 1989) by introducing the empirically grounded concept of the manual labor trap, and suggest the development theory of collaborative sociotechnical scaling, which positions collaboration as a pathway beyond fragmented, labor-intensive workflows while also foregrounding the challenges inherent in inter-organizational collaboration among CSOs. 2. Related Work This section situates our work at the intersection of civil society studies and research on online monitoring by positioning CSOs as distinct monitoring actors, reviewing the structural conditions shaping their work, and summarizing what is known and unknown about monitoring practices and workflows. 2.1. CSOs as Distinct Actors in Online Monitoring Civil society organizations (CSOs) are non-state, non-profit actors pursuing normative political, social, or human rights goals, often under politically sensitive conditions (Organization for Security and Co-operation in Europe, 2018; Capacity4dev, ). When observing online discourse, they operate alongside actors from academia, journalism, fact-checking (FC), and content moderation (CM), but their roles, practices, and constraints differ substantially. CSOs engage in long-term monitoring, evidence gathering, contextual analysis, reporting, as well as advisory and educational work. Further, their work can address local or rural contexts where far-right dynamics tend to be stronger (Franz et al., 2018) but are often underreported by national media or neglected by academia. CSOs focus on sustained, contextual observation of sociopolitical dynamics; their profound knowledge of local dynamics, trends, and actors enables them to function as early warning mechanisms and provide timely, context-specific responses, while also connecting to regional and international CSO networks (Organization for Security and Co-operation in Europe, 2018; Ihler, 2025). This role becomes particularly salient as platforms and public institutions scale back regulation under the banner of free speech (Benavidez, 2023; Kayyali, 2025). In this context, CSOs increasingly serve as both a supplement to and a corrective of institutional responses (Smidt et al., 2025), challenging official narratives that may trivialize right-wing activity, ignore political motivations of violent acts, or deny broader authoritarian or racist undercurrents in society (Bernhard et al., 2019; Ihler, 2025). 2.2. Challenges Shaping the Working Conditions of CSOs Existing literature suggests that CSO monitoring practices are shaped by a combination of structural, political, and technological challenges. However, much of this knowledge stems from grey literature, including NGO self-reports (Hulshof-Schmidt, 2024; TechSoup, 2025), policy documents (European Union Agency for Fundamental Rights, 2018; European Union Agency for Fundamental Rights, 2023), and practitioner-oriented publications (Ihler, 2025), rather than from systematic academic research. Across national contexts, CSOs face chronic financial uncertainty, largely due to reliance on short-term project funding (Hulshof-Schmidt, 2024; Romanian Center for European Policies, 2023; Hummel et al., 2022). This limits their capacity to invest in digital infrastructure, monitoring-specific tools, and dedicated technical staff (Hulshof-Schmidt, 2024; Hummel et al., 2022; TechSoup, 2025). However, the consequences of these funding structures are not evenly distributed across CSOs. Larger, better-funded or digitally native organizations are better positioned to develop in-house monitoring tools (Institute for Strategic Dialogue, 2025; CeMAS, 2025), which are typically tailored to organizational needs and resources and not openly shared with others. This reflects the precarious situation on the ‘CSO-market’, where organizations compete for highly limited funding (Hummel et al., 2022; Romanian Center for European Policies, 2023; Priemer et al., 2015), creating incentives to emphasize differentiation over sustained collaboration, even in the presence of overlapping goals and values. At the same time, CSOs often operate in politically precarious environments, exposing them to harassment, intimidation, legal uncertainty, and targeted attacks by extremist groups, radicalized individuals, or state actors (European Union Agency for Fundamental Rights, 2018; European Union Agency for Fundamental Rights, 2023; Smidt et al., 2025). Survey-based work highlights vulnerabilities related to security and privacy (Samarin et al., 2020), but also illustrates the difficulty of capturing CSO practices through standardized instruments. Differences in political focus, organizational structure, terminology, and regional context suggest that these challenges are highly situated and best addressed through qualitative, interactive, in-depth approaches, as we apply in our work. CSCW research on invisible work conceptualizes essential labor that remains hidden and informal (Star and Strauss, 1999). This lens helps situate civil society monitoring as a form of collaborative work outside institutionalized settings and often deliberately invisible due to legal and security concerns. 2.3. Monitoring Practices and Workflows in CSOs and Adjacent Domains Despite the important and distinct role of CSOs in online monitoring, direct empirical research on how they conduct their work remains scarce, with Bäumler et al.’s study (Bäumler et al., 2025) providing the most related work to ours, offering important insights into the challenges of CSOs focused on processing user-submitted incident reports. To situate CSO monitoring practices, we draw on additional research from adjacent domains which provides a conceptual understanding for studying their monitoring work. This literature conceptualizes monitoring efforts as a “pipeline of practices” (Micallef et al., 2022) involving proactive searching, filtering, interpretation, documentation, and prioritization of content (Zachlod and Peter, 2021; Evangelista et al., 2021). Studies of fact-checkers and journalists show that these pipelines are typically characterized by fragmented workflows, reliance on ad-hoc tools and substantial manual and repetitive effort (Micallef et al., 2022; Juneja and Mitra, 2022; Beers et al., 2020; NORDIS, 2022b; NORDIS, 2022a) Moreover, the access to tools is often limited while usability is described as rather low (Bäumler et al., 2025). The widespread lack of dedicated, monitoring-specific tools often forces practitioners to rely on makeshift solutions like spreadsheets, generic platforms (Beers et al., 2020) or Open Source Intelligence (OSINT) tools, initially developed for military and intelligence purposes, and therefore not necessarily aligned with the ethical values of CSOs (NORDIS, 2022b). This proactive and investigative type of work is particularly labor-intensive, as emphasized in OSINT (Décary-Hétu and Aldridge, 2015; Glassman and Kang, 2012; Evangelista et al., 2021) and FC research (Juneja and Mitra, 2022; Micallef et al., 2022). At the same time, this stage remains relatively under-examined in research (Hrckova et al., 2025), in contrast to later stages in workflows such as claim verification (Hrckova et al., 2025; Nakov et al., 2021) or dissemination of insights (Hrckova et al., 2025; Skopik et al., 2024). This gap is consequential because it suggests that existing tools and system designs are often built on an incomplete account of this activity. Further, current research provides limited insight into how monitoring workflows are enacted within CSOs’ everyday practices, under conditions of fragmented tooling and sustained manual effort, or how these conditions shape their expectations toward technological support. Within CSCW, such tool ecologies are understood as relational sociotechnical infrastructures sustained through ongoing maintenance rather than stable systems (Star and Ruhleder, 1994). Relatedly, CSCW research on bricolage highlights how actors improvise with heterogeneous resources to sustain work in constrained environments (Büscher et al., 2001; Karanasios et al., 2022). 2.4. Technological Support in Monitoring Practices An early and fundamental step in monitoring work is data collection, which is increasingly constrained by limited and fragile access to data due to the termination of affordable access to major platforms, the discontinuation of social media analytics tools (Ortutay, 2024), and the restricted and opaque access to messaging platforms – despite their growing relevance for the dissemination of harmful content (Barbosa and Milan, 2019; NORDIS, 2022a; Hrckova et al., 2025). These developments underscore the structural vulnerability of platform-dependent data access (NORDIS, 2022a). Although legal exemptions have enabled the professionalization of academic data infrastructures (Gangopadhyay, 2025), CSOs rarely benefit because they lack comparable research privileges. Monitoring systems developed by established German CSOs (CeMAS, 2025; Institute for Strategic Dialogue, 2025) are also not (per se) accessible to others. Meanwhile, open-access data collection and analysis tools (Primig and Fröschl, 2024; Silva, 2024; Ruscica et al., 2025; Peeters and Hagen, 2022) are often technically inaccessible, poorly maintained (Schinas et al., 2017), and rarely informed by systematic engagement with practitioners. CSCW research on infrastructuring emphasizes that systems evolve through and against an “installed base ” (Neumann and Star, 1996) and are continuously maintained rather than ever completed (Karasti, 2014). Research has confirmed the importance of supporting what has been described as “low-tech needs” in investigative and monitoring work (Hancock et al., 2024), including steps such as reviewing search results, identifying relevant material, and extracting key information (McKeown et al., 2014). At the same time, recent research has increasingly focused on developing ‘cutting-edge’ machine learning-based systems, such as tools for detecting, classifying, and organizing harmful online material in CM (Seering et al., 2024; Schluger et al., 2022) and FC contexts (Liu et al., 2024; Hrckova et al., 2025; Das et al., 2023; Guo et al., 2024). In principle, such systems appear potentially relevant for CSO-based monitoring, as they promise support for identifying large volumes of potentially relevant material. In investigative and OSINT settings, tools combining NLP techniques, such as named entity recognition, search, filtering, and AI-assisted reporting, have been shown to support early-stage analysis and content triage (Skopik et al., 2024). Monitoring workflows may further require tools to process and analyze multimodal data, such as images or audio, as suggested by research in adjacent domains (Cifliku and Heuer, 2025; Wolfe and Mitra, 2025). However, the practical utility of current learning-based systems for CSO monitoring remains uncertain. Many moderation tools and training datasets are proprietary and inaccessible, and it is often unclear whether existing tools align with the concepts, categories, and contextual sensitivities of CSOs. Locally embedded and evolving phenomena – such as neo-fascist youth rhetoric in rural Germany – are unlikely to be captured by general-purpose hate speech classifiers built around platform policies or legal thresholds. From a CSCW perspective, this highlights the difficulty of translating locally embedded monitoring practices into standardized computational categories, echoing CSCW work on (heterogenous) knowledge production and boundary objects (Star and work(s):, 1989; Star and Ruhleder, 1994; Ackerman et al., 2013). Technical limitations persist, including degraded performance outside high-resource languages and standard settings (Koenecke et al., 2020; NORDIS, 2022a). Even widely used tools under-detect implicit hate speech, over-moderate counterspeech (Hartmann et al., 2025), and fail to capture language- and context-specific patterns (Nozza, 2021; Kovács et al., 2021). Moreover, even effective systems require substantial human correction and careful workflow integration, including appropriate interfaces (Skopik et al., 2024). Despite these limitations, practitioners in FC and CM have generally expressed openness toward AI-based tools primarily for narrow, well-defined tasks rather than for complex interpretive or evaluative work (Liu et al., 2024; NORDIS, 2022a; Hrckova et al., 2025). In these interventionist contexts, where tools are designed to support enforcement, removal, or feedback through detection and flagging (Schluger et al., 2022; Seering et al., 2024; Bozarth et al., 2023), human-AI collaboration is often framed as a way to address the limitations of automated detection, for example via conditional delegation (Lai et al., 2022). Monitoring, by contrast, can be understood as a form of epistemic work that prioritizes observation and sensemaking over intervention, suggesting different expectations toward automation and a stronger emphasis on assistive rather than decision-making tools. Prior research highlights a preference for human-in-the-loop systems that balance algorithmic scale with human control, especially in high-stakes or interpretive contexts (Demartini et al., 2020; Liu et al., 2024; Nakov et al., 2021). Practitioners often exhibit “algorithm aversion” (Liu et al., 2024), driven by concerns about trust, transparency, and reliability (Nguyen et al., 2018; Hrckova et al., 2025). As a result, recent work emphasizes participatory design (Hancock et al., 2024) and flexible, modular tools that support transparency, adjustability, and user control (Nakov et al., 2021; NORDIS, 2022b; Das et al., 2023; Wolfe and Mitra, 2025; Bäumler et al., 2025; Schöpke-Gonzalez et al., 2025), framing AI as collaborative support rather than automation (Morris et al., 2024). Existing CSCW research suggests positioning CSO monitoring as a form of collaborative, infrastructural, and epistemic work. Despite this, existing accounts of monitoring practices largely derive from journalism, FC, or intelligence settings and offer limited insight into how such work is enacted in long-term, locally embedded, and normatively driven civil society contexts. While fragmented tools and high manual effort are well documented, less is known about how CSOs navigate technical, ethical, and legal constraints or how these shape expectations for technological support. This study addresses these gaps by examining CSOs’ monitoring practices (RQ1), challenges (RQ2), and needs for technological support (RQ3). 3. Methodology This study was conducted as part of a research-to-practice project in collaboration with a partner CSO.11 1 https://arai-telegram.github.io/ In parallel to the empirical work, an open-source prototype was developed and iteratively adapted over the course of the project. The project sought to integrate CSOs’ requirements into the design and development process, and this study provides the groundwork for defining and prioritizing key software features. While the technical focus of the software is on Telegram, a key platform for far-right actors in Germany and beyond (Baumgartner et al., 2020; Urman and Katz, 2022), the aim of the study is broader: to gain a realistic understanding of the workflows, challenges, and requirements of CSOs engaged in online monitoring. This includes gathering insights that are transferable to other social media platforms, services, and communication modalities. In the interviews, we therefore asked participants to reflect on other platforms and services as well. 3.1. Participants To gain in-depth and contextual insights, we conducted qualitative interviews without offering financial incentives (see Section 3.3). Access to participants was facilitated through existing contacts in civil society, including connections established via the project’s partner CSO. Participants were selected through non-probability sampling, combining purposive (expert-based) (Palinkas et al., 2015) and snowball methods (Etikan et al., 2015; Galloway, 2005). We spoke with individuals and representatives from 12 CSOs engaged in monitoring, education, archiving, analysis and publication of insights, as well as communication- and security-related consulting including threat assessment for individuals and other civil society organizations. Their activities can be broadly categorized into three primary foci: Archiving – systematically collecting material to preserve insights into far-right activities, creating resources for researchers and journalists. Monitoring – documenting incidents, tracking narratives, symbols, and emerging events, and providing both qualitative and quantitative analysis of trends and threats. Counseling/Advisory – offering threat assessments and guidance to individuals or groups targeted by far-right actors, helping communities respond to potential risks. Three participants had educational backgrounds in technology, which in some cases influenced how they articulated ideas about potential tool functionalities, demonstrating greater awareness of technological possibilities. Table 1 provides an overview of the participants’ organizational focus, main activities, and technical backgrounds. Participant-level information is available in the Appendix (Table 5). Table 1. Overview of interviewed CSOs and participant roles (n=15). Dimension Distribution Organizational focus Far-right (8), Antisemitism (2), Conspiracy theories (3), Racism (1), Human rights violations (1), Various phenomena (3) Main activity Monitoring (7), Consulting (5), Archiving (2), Analysis (2), Education (1), Software development (1) Technical education Yes (3), No (12) 3.2. Interviews Between October 2024 and January 2025, we conducted 13 interviews with a total of 15 participants. These took place remotely via a video-conferencing tool, allowing for more flexible scheduling and participation from different regions. Most interviews were conducted with one person; in two cases, two participants from the same organization took part together. Interviews lasted between 30 minutes and one hour and were led by one of the authors using a semi-structured guideline. A translated version of the interview guide is included in the Appendix (A.2). Each interview began with an introductory question inviting participants to describe themselves and their organization’s work. The conversation moved through thematic areas such as current practices and challenges in their monitoring work, relevant platforms and content types, tools used for monitoring, perceptions of current technologies, including AI, and their potential for enhancing monitoring work. Follow-up questions were adapted to each conversation. Since participants had varied levels of technical knowledge, interviewers sometimes introduced specific examples – such as topic modeling, clustering, network analysis, or video summarization – to help illustrate possible technological support and spark discussion. Interviews were audio-recorded when possible. In two cases where participants preferred not to be recorded, a second researcher attended and produced a detailed written protocol, occasionally asking clarifying follow-up questions. 3.3. Research Ethics and Anonymization Studying CSOs that conduct monitoring of antidemocratic content and actors poses a distinctive ethical challenge with the risk of increasing the exposure of these organizations to the very actors they monitor, and careful consideration must be taken to avoid revealing identifiable details about their identity, methods, and vulnerabilities. We therefore drew on guidelines for Internet Research Ethics (Franzke et al., 2020) and research on online terrorism, extremism, and far-right actors (Conway, 2021; Massanari, 2018). Prior to the interviews, the participants received detailed information about the study’s objectives, data collection procedures and data handling practices. All participants provided informed consent to participate in the study. Consent to audio recording was obtained separately and was not a requirement for participation. Participants were assured of strict confidentiality, and all shared information was anonymized to protect both individual and organizational identities. Moreover, because relatively few organizations engage in this work, even indirect identifiers, such as the region in which an organization operates, the specific groups they monitor, or their founding date, could inadvertently reveal their identity. Therefore, we refrained from describing participants or their CSOs in detail. Interviews were automatically transcribed using WhisperAI (2022) operated locally. Following manual proofreading of the transcripts, all audio and video files were securely deleted in accordance with the consent information provided to participants. Any identifiable details, such as the names of participants and organizations, were removed from the transcripts. Anonymized transcripts were encrypted and stored with password protection to ensure secure data management. Participants were not financially compensated for their participation. Most took part as part of their regular job responsibilities during working hours. Additionally, participants expressed interest in shaping the software tool being developed through the research project, aligning their involvement with their professional goals. The online format of the interviews also eliminated any potential out-of-pocket expenses, such as travel costs. 3.4. Researcher Positionality The mediated access to interview partners through the partner CSO fostered trust and supported an open interview atmosphere, particularly given the sensitivity of the topic and the precarious position of many CSOs. At the same time, participants were aware of the researchers’ involvement in the development of AI-based tools for the automated detection of hateful content. This awareness may have shaped how certain issues were framed, emphasized, or problematized during the interviews. Importantly, however, participants frequently articulated critical and skeptical views toward automated detection systems, suggesting that responses were not primarily oriented toward affirming the interviewer’s assumed research agenda, but realistically reflected participants’ situated practices and concerns. 3.5. Data Analysis We employed Thematic Analysis (Braun and Clarke, 2006), an established approach in CSCW (e. g. (Seering et al., 2024; Schluger et al., 2022; Mukhopadhyay et al., 2024)), which allows for the identification of key patterns and themes within qualitative data, providing a rich understanding of participants’ perspectives and experiences. While the research questions structured the interview guidelines and thus also the data collection, the data analysis itself was inductive, data-driven. Familiarization with the data, the first step of the thematic analysis, was conducted by the first author. While reviewing generated transcripts against the audio recordings, notes from interviews that were not audio-recorded were integrated and initial analytic notes added. Transcripts were organized in a table format to support annotation at the level of individual statements. For the initial coding phase we employed an open coding approach. Meaningful chunks of data – ranging from single sentences to short passages – were assigned codes that stayed close to participants’ wording and focused primarily on content. To establish a shared understanding of the data and the coding approach, the first and second author independently coded two interviews. The resulting codes showed strong correspondence and were discussed to align interpretations. Subsequently, the first author coded all remaining interviews and developed a preliminary code tree. In a process resembling axial coding, the first author grouped low-level codes into higher-level categories and themes, moving toward more interpretive abstractions. For example, statements describing the time-consuming and non-scalable nature of manual monitoring practices were initially coded descriptively (e. g., as labor-intensive monitoring) and later grouped into broader themes capturing the initial situation of monitoring work. This process resulted in a preliminary thematic map comprising 714 codes organized in 25 themes. The process of searching for and reviewing themes was iterative and collaborative. Both authors reviewed and discussed the themes and subthemes, reconsidering their naming and reassigning certain codes where necessary. These discussions informed the revision of the first thematic map, yielding 21 themes and 497 codes. Throughout this process, a shared digital platform was used to collaboratively organize and visualize codes and themes, supporting the identification of overlaps and conceptual relationships. The process was continued until the final themes were “deemed internally coherent, consistent and distinctive” (Braun and Clarke, 2006), reflecting the analytical depth and clarity of the thematic map. Finally, the stabilized themes were mapped onto the research questions to support structured reporting of the findings. Some themes spanned multiple clusters and were relevant to more than one research question. For example, the manual effort involved in monitoring practices relates both to current workflows and to demands for enhanced technological support, and therefore informs multiple research questions. For reporting purposes, such themes were assigned to the section where they were most salient, based on the authors’ judgement. Importantly, this mapping occurred after the thematic structure had been established and should be understood as an analytic organization of results rather than a predefined coding scheme. The data analysis ultimately consolidated into four meta-themes, 21 themes, 80 subthemes, and 329 codes that were finally translated into English. Four meta-themes form the structural backbone of the Findings section: Current Practices and Workflows (4.1), Technical, Ethical and Legal Challenges (4.2), Needs and Expectations Regarding Technological Support (4.3), and Perspectives on the Role of AI and Human-AI Collaboration (4.4). For the presentation of the findings, we selected vivid and representative examples from the transcripts to illustrate the identified themes and subthemes. 3.6. Workshops In addition to the interviews, we conducted two one-day participatory workshops with interview participants as a formative co-design and exploratory evaluation step. The goals were to ground the conceptual monitoring workflow in practitioners’ everyday monitoring practices and to gather situated feedback on an early prototype of the Telegram monitoring tool. Prior to each workshop, participants were invited to submit Telegram channels relevant to their ongoing work. These were pre-integrated into the system to support realistic hands-on exploration. Each workshop combined a presentation of key findings from the interviews and the emerging monitoring workflow, hands-on tool use centered on participants’ own thematic interests, and moderated group discussions. During the hands-on sessions, participants registered user accounts, tested lexical and semantic search, inspected automatically generated audio transcripts, and explored a “conspiracy score” on message level provided by an automated classifier. We documented the session through notes, which informed the iterative refinement of the workflow and the prototype. 4. Findings Participants report working under constrained financial, personnel, and technical conditions, consistent with prior research on CSOs (Samarin et al., 2020; Bäumler et al., 2025). Limited technical expertise constrains their use of digital tools. At the same time, they stress that online spaces are central to their work, as antidemocratic actors increasingly exploit digital platforms and online harms translate into real-world consequences, reinforcing existing research (Immenkamp et al., 2024; ADL Center for Technology & Society, 2023; Conway et al., 2019). Across interviews, this underscores the urgency of effective online monitoring, improved workflows, and more accessible tools. In the following, we address our research questions in detail and situate our findings within existing research. We include figures to show the relevant themes and subthemes per section. While codes are largely collapsed for readability, node labels indicate the number of codes. A full code list is available via Zenodo.22 2 https://zenodo.org/records/20447764 4.1. Current Practices and Workflows (RQ 1) Figure 1 illustrates the themes and subthemes characterizing current CSO monitoring practices and workflows. Figure 1. Thematic map section of CSO monitoring practices and workflows. Themes (blue nodes), subthemes (light blue nodes), and code counts (collapsed for space) are shown. White labels indicate individual codes not assigned to a subtheme.Thematic map section of CSO monitoring practices and workflows. Themes (blue nodes), subthemes (light blue nodes), and code counts (collapsed for space) are shown. White labels indicate individual codes not assigned to a subtheme. The map was created based on qualitative coding of 15 interviews with CSO practitioners working for German-speaking organizations. 4.1.1. Monitoring as a Manual Effort Consistent with Bäumler et al. (2025), participants describe online monitoring as largely manual, carried out routinely or in response to offline events. They rely e. g. on the Telegram desktop client or mobile app to follow channels and search content, and have to“trigger the full-text search manually every time” (P4). Automation via the Telegram API is rarely used, and documentation is likewise done by hand – typically through screenshots and notes – making the process “very time-consuming and ineffective” (P11). This mirrors findings from research on investigative journalism and FC workflows (Beers et al., 2020; Das et al., 2023; Juneja and Mitra, 2022). 4.1.2. Documentation of Monitoring Insights Participants rely on largely low-tech methods to document insights, most commonly screenshots, manual media downloads, and written notes. As P6 explains, documentation often “starts with screenshots – and then, if necessary, we write it down separately.” For longer discussion threads, scrollshots are used, though participants note the lack of convenient desktop tools, especially for Telegram comment threads, where “you end up with a hundred photos” (P6). Some participants also use the Telegram desktop client’s export function to archive entire channels, which is seen as “very helpful,” particularly when filtering by date or media type (P6). Screenshots are described as essential evidence in cases involving criminal content, where “the incitement to violence and the account must be identifiable” (P9). This aligns with prior work identifying screenshots as a standard OSINT documentation practice (McKeown et al., 2014; Bäumler et al., 2025). Notably, only one participant raises concerns about evidence manipulation. To ensure authenticity, they employ cryptographic hashing and independent web archiving e. g. via the Internet Archive (Internet Archive, 2025) to establish a “chain of evidence” and “prove that things weren’t tinkered with afterwards” (P13), reflecting a level of technical rigor rarely noted in prior research. 4.1.3. Technical Infrastructure Participants report varied data storage practices, most commonly relying on local file storage for screenshots, links, and text files. These practices are often ad hoc and unsystematic, particularly for newer content formats. Few organizations maintain databases, which are typically manual and text-only, and only two participants report using in-house scraping scripts. Overall, this points to a lack of technical infrastructure for systematic data management, echoing findings from journalism research (Beers et al., 2020) and reflecting what CSCW describes as relational infrastructures sustained through ongoing local maintenance rather than stable systems (Star and Ruhleder, 1994) and evolving through an installed base (Neumann and Star, 1996; Star and Ruhleder, 1994). 4.1.4. Relevant Platforms and Services Participants identify mainstream platforms (Instagram, TikTok, Facebook, YouTube, X) and Telegram as most relevant, with some also monitoring VKontakte, right-wing forums, imageboards, and comment sections of media outlets. Platform relevance shifts over time: as P7 notes, “Facebook [was relevant] in the past” , while Telegram “is still relevant to a certain extent, but there is not so much going on publicly anymore”. Newer platforms can disrupt established workflows – TikTok, for instance, lacks channel structures that can be easily archived (P8). Participants also describe platform-specific differences in the prominence of various phenomena: Instagram and TikTok as particularly important for right-wing extremism among younger audiences (P11), while “stalking takes place on Instagram, and hate campaigns take place on X” (P4). In line with prior research (Rogers, 2023), participants emphasize the importance of cross-platform analysis to obtain a “seriously complex picture” (P4). 4.1.5. Formats and Modalities of Monitored Content Participants stress that effective monitoring must address the increasingly multimodal nature of harmful content, in line with FC and journalism research (NORDIS, 2022b; Cifliku and Heuer, 2025). Text remains the primary focus, as it yields substantial insight while being comparatively efficient and reliable to analyze (P14). Visual content is considered more resource-intensive to store and process, but also important: Participants mention sharepics, videos from demonstrations, and emojis used as coded signals. The relevance of audio formats varies: while voice messages have declined in relevance, podcasts and long-form livestreams – often recorded on video – remain valuable, particularly for identifying actors and documenting statements made at events (P9). 4.1.6. Tools Used in Monitoring While monitoring is largely manual, some participants use tools to support specific tasks, often repurposing services from commercial social media listening or OSINT. For search and discovery, web search and Google Alerts are commonly mentioned. Web search and OSINT tools reflect practices observed in FC (NORDIS, 2022b). Use of social media platform APIs is rare, as access is limited or no longer available (Ortutay, 2024). To analyze audio content, participants rely on existing podcast or YouTube transcripts or experiment with the open-source ASR model Whisper (AI, 2022). For image content, free and easy-to-use tools such as PDF readers are used to search screenshot-based PDFs. For documentation, some CSOs rely on web archives, a practice also noted in FC (McKeown et al., 2014; NORDIS, 2022a). Telegram-specific (paid) features include built-in translation, channel recommendations, analytics services (e. g., telemetr.io), and custom bots for keyword alerts. A small number of participants use or plan to use a paid Telegram monitoring service or automated hate speech detection tools. Monitoring is primarily conducted in German, with translation needs handled via built-in tools and seen as helpful but not essential, unlike in reporting-focused CSOs (Bäumler et al., 2025). This may reflect that monitoring-focused CSOs actively select content, whereas reporting-focused CSOs process user submissions. Taken together, these practices reflect a form of bricolage (Büscher et al., 2001; Karanasios et al., 2022), in which monitoring work is assembled through the opportunistic recombination of heterogeneous tools rather than through integrated systems, producing what CSCW describes as relational infrastructures sustained through local configuration and ongoing maintenance (Star and Ruhleder, 1994). 4.1.7. Limitations of Tools in Use Participants report multiple tool-related limitations, including the cost of subscription services and technical issues such as API limits and errors. Workflows are often cumbersome, for example requiring manual audio downloads followed by self-scripted ASR processing. Proprietary tools are criticized for limited transparency and configurability, reducing their value for research and investigative work. Participants also express concern about error rates in AI-based classification – particularly for threat assessment, where a high recall is critical. Finally, some highlight biases linked to commercial business models that prioritize easily prosecutable cases and specific platforms, especially Facebook. P4 criticizes that such services “place their bet on the winning horse and, as a result, become kind of one-dimensional”. Platform biases have been observed in FC workflows as well, which are shaped by platform-provided infrastructure and funding (NORDIS, 2022a; Bélair-Gagnon et al., 2023; Beers et al., 2020). 4.2. Technical, Ethical, and Legal Challenges (RQ 2) Figure 2. Thematic map section of technical, ethical and legal challenges of CSOs in monitoring work. Themes (red nodes), subthemes (light red nodes), and code counts (collapsed for space) are shown. White labels indicate individual codes not assigned to a subtheme.Thematic map section of technical, ethical and legal challenges of CSOs in monitoring work. Themes (red nodes), subthemes (light red nodes), and code counts (collapsed for space) are shown. White labels indicate individual codes not assigned to a subtheme. The map was created based on qualitative coding of 15 interviews with CSO practitioners working for German-speaking organizations. Figure 2 summarizes the key challenges practitioners face in monitoring, along with the associated themes and subthemes. 4.2.1. Data Access and Handling Participants report major challenges related to limited data access due to platform policies. While Telegram data is described as relatively accessible, access to Instagram or Facebook is “way more difficult” (P6). Participants also highlight changes in API access at Meta and X, noting that previously accessible data has become unavailable or prohibitively expensive for research (P13, P14). Similar dependencies and disruptions have been widely documented across sectors, as key tools and APIs have been discontinued or monetized (Bäumler et al., 2025; Hancock et al., 2024; Hrckova et al., 2025; Juneja and Mitra, 2022; NORDIS, 2022b; Beers et al., 2020). Beyond access restrictions, participants struggle with data volume. Social media is described as a “bottomless pit” (P8), where large-scale collection becomes unmanageable without adequate analytical tools. Some participants report compute limits, with large datasets overwhelming local resources and causing crashes. Monitoring-focused CSOs thus face greater constraints than FC or CM workers, or reporting-oriented CSOs, who benefit from more established infrastructures or curated inputs (Juneja and Mitra, 2022; Hrckova et al., 2025; Bélair-Gagnon et al., 2023; Bäumler et al., 2025). 4.2.2. Multimodality of Content Another major challenge stems from the multimodal nature of monitored content. Audio and video are described as especially time-consuming, as they cannot be keyword-searched and require full manual review: “you have to look through it completely to find the relevant parts” (P2). While such formats can yield important insights, participants lack the time and tools to analyze hours-long recordings. Accordingly, almost all participants highlight the value of transcription tools for audio and video, echoing prior research (Cifliku and Heuer, 2025; Juneja and Mitra, 2022; Liu et al., 2024). Beyond this, participants point to ephemeral formats such as livestreams and stories as a distinct challenge due to their limited availability. Some suggest that malicious actors deliberately use these formats, which are “difficult to capture” and thus less likely to be monitored or archived effectively (P14). 4.2.3. Legal Challenges Many participants describe their monitoring work as shaped by substantial legal uncertainty, particularly because they operate “like journalists, but are not journalists” (P15). This creates a dilemma: they must retain evidence to substantiate their public statements and defend themselves against potential legal challenges, while data protection and GDPR limit what they are permitted to store. Similar challenges have been noted for reporting CSOs lacking a formal monitoring mandate (Bäumler et al., 2025). From a CSCW perspective, this positions monitoring as a form of invisible work (Star and Strauss, 1999), where essential evidentiary and protective labor remains institutionally unsupported and largely hidden from public view. Compliance with data protection law is often difficult and, in some cases, leads organizations to scale back or stop monitoring altogether. Others restrict themselves to public content only. However, this limits insight, as threats and plans for violence often emerge in non-public spaces, a tension also discussed in prior research (Conway, 2021). Finally, copyright restrictions further constrain collaboration, as collected material often cannot be shared across organizations and may only be shown indirectly. 4.2.4. Security Concerns Beyond legal challenges, participants report significant security risks at both individual and organizational levels. Monitoring far-right actors can make practitioners and their organizations targets of harassment or attack. At the individual level, participants describe using disposable or mock accounts for monitoring due to personal safety concerns, allowing profiles to be abandoned if exposed, a practice also noted in OSINT research (McKeown et al., 2014). Personal security concerns were also evident during interview preparation, as some participants declined recording or emphasized the need to remain unidentifiable. Similar risks have been documented for academic researchers studying far-right actors online (Massanari, 2018; Conway, 2021), though few studies address these issues for CSOs, which are often particularly vulnerable due to limited resources and frequent targeting (Samarin et al., 2020). Participants further stress that monitoring can endanger entire organizations. As P1 notes, they are “also being attacked,” (P9) often through coordinated campaigns. Some report strategic misuse of legal instruments, such as calls to “flood projects like us with GDPR requests,” (P15) while others point out that “far-right actors are very eager to sue” (P3). These tactics mirror reports from reporting-focused CSOs, who describe deliberate attempts to overload their capacity (Bäumler et al., 2025). Finally, participants express concern that a shifting political climate may heighten the risk of legal persecution. In this context, secure data storage is seen as critical, as monitoring work could be reframed by authorities as illegal data collection or the creation of “enemy lists” (P9). 4.2.5. Collaboration and Data Sharing Legal constraints also hinder inter-organizational collaboration. As P2 explains, organizations cannot share direct database access “for data protection reasons” and must rely on anonymized material – “enormous amount of work” that must be done manually by trained staff. A lack of standardization and limited resources further impede collaboration; national attempts at uniform documentation have “regularly failed” (P15) due to the excessive effort required. From a CSCW perspective, these proposals point to infrastructuring challenges – building shared arrangements and boundary objects that can be maintained and governed across organizations (Karasti, 2014; Star and work(s):, 1989). Despite these barriers, participants strongly emphasize the value of collaboration. Successful partnerships – such as with reporting-focused CSOs – are described as effective due to a clear division of labor. Others note that collaboration could reduce redundant work, though implementation remains challenging. Suggested solutions include shared infrastructures, such as a collaborative database, or partnerships where one organization “captures the online context” (P2) while others contribute complementary expertise. This hints at collaboration as a key asset beyond technical tools (Juneja and Mitra, 2022), while echoing prior work that also documents its challenges (Bäumler et al., 2025). 4.3. Needs and Expectations Regarding Technological Support (RQ 3) Figure 3. Thematic map section of CSO needs and expectations regarding technological monitoring support. Themes (green nodes), subthemes (light green nodes), and code counts (collapsed for space) are shown. White labels indicate individual codes not assigned to a subtheme.Thematic map section of CSO needs and expectations regarding technological monitoring support. Themes (green nodes), subthemes (light green nodes), and code counts (collapsed for space) are shown. White labels indicate individual codes not assigned to a subtheme. The map was created based on qualitative coding of 15 interviews with CSO practitioners working for German-speaking organizations. Figure 3 presents participants’ technical needs for monitoring, clustered into four areas: search, interfaces and dashboards, analytical insights, and documentation. A fifth category addresses adoption factors such as usability, data protection, and local deployment. 4.3.1. Enhanced Search and Discovery Most participants identified advanced search capabilities as a central requirement for effective monitoring. A key demand was the ability to search beyond already known or subscribed channels. As P4 explains, they need “a global search […] not just looking in the groups we already know,” ideally including “full-text search in the entire Telegram”. Participants envision alert-based systems similar to Google Alerts, enabling highly targeted queries using advanced search techniques or “Dorks” (P4). This emphasis on search and discovery aligns with prior research on OSINT analysts, investigative journalists, and fact-checkers, for whom search constitutes a core activity (Mukhopadhyay et al., 2024; McKeown et al., 2014; Beers et al., 2020; Juneja and Mitra, 2022). Participants further stress the need to make multimodal content searchable, particularly audio and video. Access to transcripts is seen as critical, as “a lot happens there that we don’t really have on our radar yet” (P14). From a technical perspective, this highlights the relevance of integrating automated speech recognition (ASR) and optical character recognition (OCR) as pre-processing steps. Beyond expanding searchable content, participants emphasize automation, including saved queries and continuous monitoring. P4 describes the need for “an automated search that runs […] 24/7,” while alerts are viewed as essential for surfacing relevant findings in real time, echoing similar demands in journalism (Cifliku and Heuer, 2025). Search is also used to track mentions of known individuals or organizations that may become targets of attacks, for example through automated keyword searches across channels. Finally, participants extend the notion of search to exploratory discovery, noting that “sometimes you don’t even know what you’re looking for” (P14). Suggested features include similarity-based search as well as tools for identifying new and locally relevant channels as ecosystems shift over time. While Telegram’s existing ‘Similar Channels’ feature was seen as limited and repetitive, participants expressed interest in more transparent and context-sensitive channel recommendation mechanisms. These ideas provide novel insights and extend existing knowledge on search strategies in online monitoring by moving beyond keyword-driven approaches and highlighting the importance of channel discovery alongside content discovery. 4.3.2. User Dashboard Participants propose a dashboard-centric interface for viewing and interacting with monitored content. Core requirements include a feed-based presentation of results with sorting and filtering option, alongside simple, accessible statistics, e. g. basic post-level metrics to identify the most-viewed posts within a channel. Suggested metrics at channel level include channel growth and forwarding patterns, which, as P14 notes, can signal newly emerging channels and support exploratory monitoring. These dynamics are also linked to offline events, as demonstrations often coincide with spikes in follower numbers, helping to “keep an eye on followers in the dynamics” (P14). Participants further envision the dashboard as a workspace for documentation and collaboration. P4 describes quickly saving relevant posts “by clicking on a post and then it is immediately stored” for later review or reporting. Dedicated user accounts could support standardized workflows and collaborative work, enabling users to scroll, flag items, and generate reports. 4.3.3. Generating Insights Alongside search and dashboard-based work, the generation of insights occupies a substantial part of the thematic map. A central theme is automated content classification, which participants view as useful for pre-filtering and prioritizing large data volumes. P12, for instance, suggests distinguishing between “unclear” and “clearly threatening or criminally relevant” posts, enabling a graded risk-ranking that could reduce workload when combined with manual review. Others propose using multiple classifiers to detect different forms of discriminatory content, reflecting organizational differences in categorization schemes (Bäumler et al., 2025). Participants also highlight the value of information extraction, such as identifying names, dates, and locations, particularly for tracking mobilization efforts. Automated detection of calls for action, also in images, is seen as especially helpful, as relevant content can easily be missed across numerous groups – “a tool that tells you ‘here’s a sharepic’ would help a lot.” (P8). However, limitations remain, for example in recognizing names in audio transcripts, a known challenge in current ASR systems (Ayache et al., 2024). Other techniques such as facial recognition are considered problematic due to data protection regulation. Beyond content-level analysis, participants express interest in user- and network-level insights, including tracking key actors, content origins, and forwarding patterns to reveal coordination. While such analyses are seen as valuable for understanding dissemination dynamics, they also raise ethical and legal concerns related to privacy and surveillance (Conway, 2021; Massanari, 2018). A smaller number of participants mention advanced analytical methods such as video summarization, topic modeling, and burst detection to support triage and early warning. Across these discussions, participants repeatedly emphasize both the potential and the limitations of AI-based analysis, underscoring the need for cautious human-AI collaboration – a theme we return to in Section 4.4. 4.3.4. Output and Documentation Participants emphasize the need for automated saving of content and the generation of legally compliant documentation. A central concern is the ability to capture content before it is deleted, as relevant posts, such as incitements to violence or invitations to illegal events are often removed after a certain time. Participants therefore stress that collection intervals should be configurable, ranging from minutes to longer periodic snapshots. P14 further suggests integrating report creation directly into the tool, allowing users to flag content and “output a report at the end” for a specific topic. Proper digital evidence handling is another key requirement. Existing tools are described as inadequate – “you can’t save videos with it at all” (P5) – prompting calls for solutions that reliably archive multimedia content with timestamps for potential court use. As P5 notes, this is critical “because the evidence is captured when it’s first discovered.” Finally, participants highlight the potential to streamline criminal complaint processing, which currently involves manually transferring information from spreadsheets into reporting forms, a process described as highly inefficient. 4.3.5. Acceptance of New Tools Tool acceptance depends on usability, a clear reduction in workload, and compliance with data protection requirements, ideally supported through certification. These criteria align with prior work calling for user-friendly reporting technologies that meet data security and evidentiary standards (Bäumler et al., 2025). Participants further stress technical requirements such as open source, local deployment, and reliable data storage, motivated by both security and cost concerns. However, these demands often conflict with state-of-the-art AI methods, particularly due to their computational demands and restrictive licensing. Overall, participants emphasize that non-technical factors – organizational practices, legal requirements, and trust – strongly shape tool adoption. 4.4. Perspectives on the Role of AI and Human-AI Collaboration (RQ 3) Figure 4. Thematic map section of CSO perspectives on the role of AI and human-AI collaboration in monitoring. Themes (purple nodes), subthemes (light purple nodes), and code counts (collapsed for space) are shown. White labels indicate individual codes not assigned to a subtheme.Thematic map section of CSO perspectives on the role of AI and human-AI collaboration in monitoring. Themes (purple nodes), subthemes (light purple nodes), and code counts (collapsed for space) are shown. White labels indicate individual codes not assigned to a subtheme.The thematic map was created based on qualitative coding of 15 interviews with CSO practitioners working for German-speaking organizations. During the interviews, participants discussed the role and limits of AI support and human-AI collaboration. The corresponding themes and subthemes are shown in Figure 4. 4.4.1. Potentials of AI Despite some noting organizational mistrust toward AI, participants highlight its potential to support monitoring work by pre-filtering and prioritizing large volumes of data. As P4 notes, “automation would help us really massively.” Such uses align with prior work on claim detection and case prioritization (Hrckova et al., 2025; Bäumler et al., 2025). Participants also see promise in generative AI for assisting analysis and reporting, for example by identify far-right ideological traits in texts, or by summarizing insights across multiple sources, echoing findings from journalism and FC research (Liu et al., 2024; Wolfe and Mitra, 2025; Cifliku and Heuer, 2025; Procter et al., 2023). 4.4.2. Limitations of AI However, participants also question the use of AI, e. g. by citing misclassification risks that could produce a “watered-down picture” (P4) and expressing significant doubt that AI can adequately grasp the nuanced, context-dependent nature of harmful content in its varied expressions. These concerns mirror findings from OSINT, FC, and reporting CSOs (Juneja and Mitra, 2022; Hrckova et al., 2025; Mukhopadhyay et al., 2024; Skopik et al., 2024; Bäumler et al., 2025). Further, existing models are not well suited to the linguistic and contextual demands of the domain. Participants note shortcomings for German-language content and phenomena such as antisemitism, which often “works between the lines” (P14). In CSCW terms, these concerns reflect challenges in heterogenous knowledge production regarding the translation of locally grounded concepts into standardized models (Star and work(s):, 1989; Ackerman et al., 2013). P14 further highlights the substantial effort involved in training custom AI classifiers, alongside a lack of model sharing across CSOs, as “those who train their own model often keep it to themselves due to the effort involved”. 4.4.3. Use of Generative AI by the Far-Right Participants report mixed views on the relevance of generative AI used by far-right actors. Most believe it is primarily used for propagandistic material such as images or sharepics, while traditional disinformation strategies such as taking information out of context remain dominant. Others highlight the circulation of apparently AI-generated war imagery, which is seen as particularly concerning due to its potential to distort public perception. 4.4.4. Significance of Human Expertise Across interviews, participants emphasize the central role of human expertise. AI is framed as a human-in-the-loop support tool rather than a replacement, aligning with established approaches to human-AI collaboration (Demartini et al., 2020). Some question whether AI is necessary at all: P15 emphasizes that human expertise is trusted by clients and perceived as more credible than AI-based classifications: “We do a good job and I think it’s easier for people to believe us.” Others point to legal contexts where reliance on AI may complicate proceedings, as models would need to be explained in court. As P13 explains, “human expertise is still considered more valuable than relying on AI,” because if AI is involved “you’d have to explain the model in court, which adds complexity”. These insights emphasize the role of trust in the adoption of new technologies, at organizational and at societal level. 4.5. Conceptual Monitoring Workflow Based on our interview findings, we developed a conceptual monitoring workflow for CSO monitoring, shown in Figure 5. This workflow synthesizes practitioners’ described practices, constraints, and needs into a structured pipeline and instantiates the “pipeline of practices” discussed in prior work (Micallef et al., 2022). The resulting framework serves both as a guide for implementation of the prototype and as a bridge between technical development and real-world monitoring practices. Each stage of the workflow is aligned with specific design principles: • Data collection and storage integrates privacy by design and legal usability (4.2.3), ensuring that scraping modules capture metadata in a legally robust way while respecting data protection requirements (Bäumler et al., 2025; Hancock et al., 2024; Lakomy, 2024). • Preprocessing and indexing implement both multimodal data preprocessing (4.2.2) and robust information extraction (4.3.3), making diverse content searchable and transforming noisy, unstructured data into structured formats (Cifliku and Heuer, 2025; Juneja and Mitra, 2022; Liu et al., 2024; Ayache et al., 2024). • Search and retrieval reflects the centrality of advanced and flexible search functionality (4.3.1), enabling multilingual and multimodal content discovery through both lexical and semantic methods (Mukhopadhyay et al., 2024; Beers et al., 2020; Juneja and Mitra, 2022). • Dashboard and reporting operationalize usability and workflow integration (4.3.2), providing intuitive interfaces for tagging, saving searches, collaborative work, and generating reports (Cifliku and Heuer, 2025; Bäumler et al., 2025; Liu et al., 2024). • Deployment and scalability correspond to low-resource deployment and configurability (4.2.1), ensuring that all modules are lightweight, open, and adaptable to diverse CSO infrastructures (Bäumler et al., 2025; Hummel et al., 2022; Hulshof-Schmidt, 2024; Hancock et al., 2024). Figure 5. Conceptual overview of CSO monitoring workflow, aligned with technical, legal, and socio-technical requirements.A diagram showing the different steps of the derived pipeline alongside contextual aspects such as human-AI collaboration, legal and technical constraints Based on these insights, the monitoring prototype was extended in collaboration with the partner CSO, to include the functionalities shown in Table 2. Table 2. Overview of the extended prototype’s features. Component Description Data collection Robust collection of historical and live Telegram messages with configurable time ranges and selectable attachment types. Audio transcription Automatic transcription of audio messages using the open-source Whisper model (medium version by default; other model sizes configurable). Lexical and semantic search Support for both keyword-based and embedding-based search across text and images, using Elasticsearch together with multilingual Sentence Transformer and CLIP models. Channel recommendation Recommendation of related channels based on Telegram’s built-in “Similar channels” feature, used as an initial pragmatic default despite participant-reported limitations. Automatic classification Fine-tuned BERT-based classifier for conspiracy-theory detection, deployable on CPU infrastructure, with integrated user feedback and data annotation support. Interactive dashboard Web-based interface supporting saved searches, post-level statistics, manual content tagging, and collaborative use without advanced technical expertise. Configurable system settings Environment-file configuration for data collection and retention policies, model selection (transcription, embeddings, classification), hardware utilization, and storage endpoints. Modular containerized deployment Docker-based, modular architecture enabling flexible deployment and full system customization, with associated technical setup requirements. 4.6. Findings from Workshops The workshops provided an opportunity to observe how the conceptual workflow and prototype features aligned with practitioners’ monitoring practices. Participants extensively explored search functionality around their own thematic interests and emphasized the centrality of search for early-stage investigation. Features supporting the saving and organization of results – such as tagging and saved searches – were particularly valued. Several participants additionally requested export functions to support downstream analysis and reporting. The sessions also surfaced organizational and infrastructural considerations. When multiple participants used the system simultaneously, the server reached its performance limits, revealing concrete bottlenecks and optimization needs. Beyond technical issues, participants repeatedly raised data protection concerns and exchanged organizational strategies for legally compliant monitoring, highlighting the importance of embedding legal and ethical considerations into tool design. Beyond tool testing, the workshops also functioned as sites of exchange between CSOs. Participants used the sessions to discuss investigative practices, constraints, and collaboration opportunities. We position these workshops as an initial co-design and formative engagement rather than a summative evaluation. They functioned as sites of mutual learning, where monitoring practices, constraints, and tool affordances could be collectively explored. In addition, a longer-term test with two civil society projects is currently underway to explore how the tool can be integrated into real-world monitoring work. 5. Discussion and Recommendations Our findings highlight how the precarious operating conditions of CSOs – limited resources, restricted platform access, and legal uncertainty – systematically shape and constrain their engagement with technology. They lack direct platform access, tailored tools, and ongoing technical support, relying instead on labor-intensive, largely manual processes to identify and collect relevant content from the outside. While automation is seen as potentially useful, particularly for expanding access to audio, image, and video data, participants express reservations about automated classification, which is often perceived as misaligned with CSO workflows. Instead, CSOs prioritize tools that support discovery, analysis and documentation across heterogeneous content formats. These findings foreground a gap between prevailing technological paradigms and the situated realities of civil society monitoring. Across interviews, workflow conceptualization, and participatory workshops, we engaged this gap through an iterative process in which monitoring practices were translated into design concepts and a software prototype. The following discussion synthesizes our empirical findings and derives design recommendations for CSO-oriented monitoring tools. The design recommendations aim at addressing the structural and infrastructural barriers that shape what technologies are realistically usable in CSO monitoring practice. Further, we outline stakeholder-specific recommendations for academic research and policymakers. Finally, we introduce the concept of a manual labor trap as an empirically grounded entry point for the development of a theory of collaborative sociotechnical scaling. 5.1. Design Recommendations Our findings highlight the need for monitoring tools that balance automation with human oversight, support multimodal content, ensure legal and ethical compliance, and remain realistically deployable in low-resource environments. Table 3 synthesizes these insights by linking CSO practices and challenges with related work, core technical requirements, and resulting design recommendations. An important challenge lies in the tension between privacy requirements and evidentiary needs. Monitoring tools must comply with data protection regulations, such as data minimization and secure deletion, while also preserving forensic-quality, legally admissible evidence. This requires careful trade-offs in data retention and export, and constraints the use of external services due to concerns around trust and compliance (rows 1, 2, 10 in Table 3). Fragmented and largely manual workflows further shape monitoring practice, limiting both intra- and inter-organizational collaboration. This underscores the need for integrated, user-friendly dashboards that support end-to-end processes, from data collection and analysis to report generation (row 3). Enabling effective collaboration additionally requires user management and integration with existing workflows (row 4). The growing importance of multimodal and multilingual data constrasts with a limited availability of tools, highlighting the need to integrate ASR and OCR pipelines into search and analysis components (row 5). At the same time, the large volume of data encountered in online monitoring creates demand for automated filtering, ranking, and information extraction (row 8), and suggests the integration of automated content classification. However, the latter is met with notable skepticism due to concerns about reliability and transparency, reinforcing the importance of human-in-the-loop designs (row 6). Search emerges as a core functionality, requiring multimodal, and multilingual capabilities supported by both lexical and semantic methods (row 7). Finally, resource and legal constraints strongly shape design decisions. Concerns related to privacy, security, cost, and trust in external services emphasize the importance of secure, cost-efficient local deployment models (rows 9, 10). Table 3. Design synthesis mapping empirical findings to core technical needs and design recommendations. Empirical Finding Related Work Core Technical Need Design Recommendation 1 Legal and ethical constraints of data collection and processing Legal risks and constraints (Bäumler et al., 2025; Hancock et al., 2024; Lakomy, 2024) Privacy-preserving data handling Privacy-by-design architectures for data minimization and deletion 2 Need for legally usable evidence OSINT tools and digital evidence (McKeown et al., 2014; Cifliku and Heuer, 2025; Bäumler et al., 2025; Skopik et al., 2024) Evidentiary robustness of collected content Forensic-quality capture with logged metadata (timestamps, URLs, IDs); export in standardized formats (e. g., PDF/A, WARC) suitable for legal review 3 Fragmented, manual workflows Monitoring as manual effort (Beers et al., 2020; Das et al., 2023; Juneja and Mitra, 2022) Integrated, workflow-aware interfaces Intuitive dashboards supporting content flagging, reporting 4 Intra-organizational collaborative monitoring practices CSOs as distinct actors, fragmented tooling (Juneja and Mitra, 2022; Bäumler et al., 2025; Micallef et al., 2022) User account management and seamless integration into existing CSO workflows User accounts to control for private and shared monitoring insights, shared labels and tags, data export functionalities into common formats (e. g. csv, PDF) 5 Difficulty searching and analyzing multimodal content Lack of multimodal tools (Cifliku and Heuer, 2025; Juneja and Mitra, 2022; Liu et al., 2024; Ayache et al., 2024) Searchable representations of rich media content Integrated ASR and OCR pipelines to preprocess multimodal data 6 Skepticism toward automation Algorithm aversion and human-in-the-loop (Juneja and Mitra, 2022; Hrckova et al., 2025; Mukhopadhyay et al., 2024; Skopik et al., 2024; Bäumler et al., 2025) Human-AI collaboration with transparency and controllability Transparent communication of model limitations and errors to users (e. g., confidence cues, rationale surfaces, error reporting, feedback mechanisms) 7 Centrality of search in monitoring work Proactive and investigative work (Mukhopadhyay et al., 2024; Beers et al., 2020; Juneja and Mitra, 2022) Advanced, flexible search across multilingual and multimodal data Robust lexical and semantic search across modalities using language-appropriate embedding models 8 Large volumes of unstructured, noisy platform data Filtering and ranking in FC and CM, information extraction in OSINT (Hrckova et al., 2025; Bäumler et al., 2025; Mukhopadhyay et al., 2024) Automated extraction of actionable information Named Entity Recognition and information extraction models optimized for informal, real-world content (e. g., Telegram) 9 Limited computational resources and technical infrastructure Resource constraints (Bäumler et al., 2025; Hummel et al., 2022; Hulshof-Schmidt, 2024; Romanian Center for European Policies, 2023; Hancock et al., 2024) Lightweight, adaptable, and maintainable systems Architectures with opinionated defaults; lightweight or distilled models deployable without GPU hardware 10 Privacy, security, and cost concerns with external services Legal constraints and CSO autonomy; trust and adoption concerns (Wolfe and Mitra, 2025; Cifliku and Heuer, 2025; Hancock et al., 2024; Hrckova et al., 2025) Secure and cost-efficient local deployment Minimized reliance on third-party APIs; prioritization of smaller, locally deployable models balancing performance, cost, and compliance 5.2. Policy and Research Recommendations Our findings show that CSO monitoring is fundamentally sociotechnical and politically embedded, and cannot be addressed through tool design alone. We therefore outline empirically grounded policy and research recommendations in Table 4 that complement our design recommendations. Theme Recommendation Policy Legitimacy & role Formally recognize and mandate CSO online monitoring to strengthen legitimacy, trust, and inter-organizational collaboration. Legal clarity Develop purpose-specific legal guidance for CSO monitoring and related activities (e. g., archiving, counseling), coordinated by national or federal data protection authorities, to reduce legal uncertainty and collaboration barriers. Infrastructure & funding Shift from short-term project funding to sustained public support for CSO infrastructure, collaboration, and open-source tool development, extending successful pilots into long-term operational funding. Research Core pipelines Prioritize robust preprocessing pipelines (e. g., ASR, NER), especially for non-English and noisy real-world data, over (multimodal) classifiers, to enable scalable multimodal analysis and insight generation. Discovery Support exploratory search and information discovery by studying CSO search practices and developing CSO-oriented tools (e. g., channel recommenders). Domain models Develop CSO-oriented, domain-specific models (e. g., for threats, antisemitism, racist mobilization) rather than generic toxicity or offensiveness classifiers. Interfaces Investigate prompt-based LLM interfaces and flexible configurations to support adaptable, CSO-oriented workflows and non-expert querying. Human-AI collaboration Design lightweight, in-task human-in-the-loop feedback mechanisms to integrate practitioner expertise into iterative system improvement. Inter-organizational collaboration Strengthen interdisciplinary and cross-sector research (e. g., law, political science, communication) and examine inter-CSO collaboration and networks. Table 4. Policy and research recommendations for supporting CSO online monitoring. On the policy side, a core challenge is structural misalignment: existing legal frameworks, funding models, and institutional arrangements do not reflect the long-term nature of CSO monitoring outside platform infrastructures or recognized professional workflows. We suggest three directions to address this. First, formal recognition of CSOs’ societal role and clear institutional mandates could help to strengthen legitimacy, trust, and inter-organization collaboration, while enabling standardization, assurance of quality standards, and capacity-building. Second, legal uncertainty must be reduced through purpose-specific legal guidance for monitoring CSOs. This is particularly important given the risk of lawsuits or strategic information requests from antidemocratic actors, and the limited access to legal expertise among smaller organizations. Data protection authorities could play a coordinating role in producing accessible, sector-wide guidelines. Third, funding models should move beyond one-off project funding, which is structurally misaligned with the long-term nature of monitoring and coordination work. Governments and public institutions should instead invest in durable infrastructure -- including open-source tools co-developed with CSOs -- alongside sustained operational funding that enables gradual capacity-building.33 3 Ironically, at the time of writing, Germany’s main federal funding programme for civil society, Demokratie leben!, is undergoing significant restructuring, leaving several democracy-focused CSOs in an existential funding crisis (Beham and Soennichsen, 2026). This development coincides with growing right-wing and far-right influence in Germany and across Europe – a confluence of reduced civic support and democratic backsliding. Academic research should better recognize CSOs as underresearched stakeholders in digital governance and address the mismatch between current research priorities (e. g., hate speech classification) and practitioners’ needs. To this end, greater emphasis should be placed on foundational capabilities rather than new task formulations, with increased investments in robust preprocessing pipelines (e. g., NER, ASR), especially for noisy, real-world, and non-English data. Further work is also needed to understand how CSOs search and explore unfamiliar spaces and discover emerging narratives. Given skepticism toward generic, English-centric AI models, research should support context-specific models tailored to CSO needs, such as detecting e. g., threats, antisemitism, or coordinated mobilization. This also includes exploring prompt-based LLM workflows through non-expert user studies. In this context, we suggest that interactive systems with lightweight human feedback loops can enable continuous improvement and trust, provided they integrate seamlessly into everyday workflows and do not significantly increase the workload for CSOs. Finally, as CSO challenges span legal, political, and technical domains, research should foster interdisciplinary collaborations including, e. g., organizational studies, law, communication, and political science to better understand hindrances to inter-organizational cooperation, and how CSOs navigate adversarial environments. 5.3. The Manual Labor Trap and Inter-organizational Collaboration Our findings show that monitoring CSOs operate under precarious infrastructural conditions marked by limited funding, restricted platform access, and legal uncertainty. Participants consistently described a sociotechnical gap between what they aim to accomplish – long-term, collaborative, and thematically diverse monitoring – and what they can realistically support with limited IT capacity, unstable resources, and a lack of sustained infrastructure. Monitoring practices center on simple tools and ad-hoc workflows that are difficult to extend or maintain. From a CSCW perspective, CSOs rely on a fragmented installed base (Star and Ruhleder, 1994; Neumann and Star, 1996) held together through ongoing articulation work (Schmidt, 2011). Efforts to extend this base often take the form of bricolage (Büscher et al., 2001; Karanasios et al., 2022), creatively recombining available tools to overcome local constraints. Under the described adversarial and resource-scarce conditions, however, bricolage hardens into what we conceptualize as a manual labor trap: labor-intensive and brittle arrangements consume the very resources needed to build more durable infrastructures. Over time, this self-reinforcing loop stabilizes low-capacity sociotechnical regimes increasingly misaligned with the scale and dynamism of far-right online activity. Being caught in this trap also prolongs exposure of individuals conducting monitoring to harmful content, with likely long-term impacts on psychological wellbeing, e. g., by increasing fear, mistrust, or resignation among individuals. Scaling infrastructures is therefore not only a matter of efficiency, but also of protection. Importantly, the limitations producing the manual labor trap are not primarily technical; financial and legal constraints fundamentally shape which infrastructural choices are available. Under these conditions, purely individual approaches to technological development leave little room for meaningful scaling. Chronic underfunding, legal uncertainty, restricted platform access, and ongoing maintenance demands make it unlikely that single CSOs can independently build and sustain the infrastructures their work increasingly requires. In this sense, the manual labor trap appears not as a temporary phase but a structurally reproduced outcome of isolated operation. From this perspective, inter-organizational collaboration becomes a plausible horizon for sociotechnical scaling. To synthesize these dynamics, we propose the development of a theory of collaborative sociotechnical scaling in CSO monitoring – a theory that situates CSO infrastructures within their structural and technological constraints, contrasting the manual labour trap with collaborative arrangements that could support the development and maintenance of shared infrastructures. Respective theorizing could also help to address the tension between demands for flexible and configurable infrastructure that account for diverse and evolving monitoring interests, and usability requirements of non-technical users: Under collaborative sociotechnical scaling, CSOs with limited technical expertise could benefit from shared knowledge, pooled development capacity, and the longer-term creation of user-friendly configuration interfaces. The concept of the manual labor trap offers an entry point for theorizing sociotechnical scaling in civil society monitoring. However, collaboration is not a neutral solution: pooling resources raises questions of governance, ownership, and power, and risks reproducing asymmetries between better- and less-resourced actors. A fuller account of collaborative sociotechnical scaling would need to treat collaboration as a contested transformation shaped by economic, legal, and political conditions and uneven agency. Developing such an account calls for methodological approaches beyond tool-focused design research. Ethnographic, organizational, or even historical studies of existing or past collaborative settings -- examining when and why they succeed or fail -- would help surface the conditions under which shared infrastructures become sustainable. Trust, competition for resources, and the unequal capacity to contribute to and benefit from collaboration are likely central dynamics. Tech collectives that work across multiple CSOs as intermediary hubs, for example the CSO Tactical Tech,44 4 https://tacticaltech.org/ represent a promising site for such inquiry, as they concentrate collaboration processes and make their tensions visible. Historical accounts of sociotechnical scaling in analogous civil society contexts could further illuminate the structural and political conditions that enable or foreclose such transitions. Throughout, attention to invisible labor and articulation work (Star and Strauss, 1999; Schmidt, 2011) will be essential: collaborative infrastructures do not maintain themselves, and the work of sustaining them is easily obscured, inequitably distributed, and rarely funded. We take this as an important direction for future CSCW work. 6. Limitations Our study focuses on German-speaking organizations. Although diverse, they represent a limited sample of CSOs engaged in monitoring across Europe. The transferability of our findings thus requires caution. Constraints such as limited data access and scarce resources likely extend across political and socio-economic contexts – and may be more severe in lower-income settings where limited connectivity and technological infrastructure restrict access to computational and AI-based tools. On the other hand, legal, political, and socio-economic conditions vary widely, shaping different levels of vulnerability. Our participating CSOs operate in a Western, European democracy; organizations elsewhere may face additional risks, including state repression (Greig, 2024). In more authoritarian contexts, the threat model shifts fundamentally: anonymity and operational security become central requirements, and the value of legally robust evidence for domestic proceedings may be lower where such processes are inaccessible or unsafe, with international accountability mechanisms mattering more instead. In this context, transnational collaboration – with external CSOs absorbing public-facing exposure while threatened organizations focus on evidence collection – may itself constitute a form of sociotechnical scaling, distributing both risk and capacity across organizational (and national) boundaries. The role of online platforms also differs by political and regulatory context, over time, and according to the thematic focus of CSOs. Even within our sample, practices and needs varied, underscoring the difficulty of developing design implications that are both generalizable and flexible. Core needs such as multimodal data processing, robust search, and legal evidence handling appear broadly relevant, but must be adapted to organization-specific conditions. Future research should include a broader range of European and international CSOs to test and refine our findings. The interviews were conducted with monitoring professionals rather than AI or software experts. Some participants struggled to articulate technical needs beyond existing practices, potentially narrowing perspectives. In some cases, the interviewer suggested potential features, prompting participants to consider aspects they may not have raised themselves, as clarified in our methodology. While qualitative interviews provide a solid foundation as our main method, a more in-depth requirements analysis would benefit from additional methods, such as user stories and use cases, personas, contextual inquiries, design probes, and requirement prioritization techniques. To begin to address this limitation, we have incorporated workshops and are conducting longitudinal testing with two organizations. 7. Conclusion Our study advances the understanding of CSOs as crucial yet understudied actors in the development and application of monitoring technologies. The precarious situation of CSOs, their diverse activities, and the multiplicity of obstacles they face underscore the heterogeneity of the field. This heterogeneity requires technological solutions that are flexible and adaptable, capable of accommodating varied organizational practices and thematic foci. Our findings further highlight that while CSOs recognize the potential of AI – particularly in expanding access to otherwise inaccessible information embedded in audio, image, and video content – there is widespread skepticism about automated classification systems. Such systems are perceived as misaligned with CSO workflows and especially problematic in legal and evidentiary contexts, where transparency, accountability, and human credibility are indispensable. The contributions of our work are threefold: first, we provide an in-depth, empirically grounded account of civil society monitoring as a form of collaborative, infrastructural, and epistemic work conducted under precarious, adversarial, and legally uncertain conditions. In doing so, we extend existing understandings in CSCW of how sociotechnical systems are maintained and made workable outside well-resourced institutional settings. Second, we translate these insights into actionable design and research implications. We articulate design considerations for flexible monitoring infrastructures focussing on search, (multimodal) data preprocessing, evidence collection and documentation, that remain adaptable across thematic domains. Third, we introduce the manual labor trap as an empirically grounded concept that explains why monitoring CSOs tend to remain locked into labor-intensive, low-capacity arrangements, and propose to develop a CSCW-grounded theory of collaborative sociotechnical scaling to better understand how alternative, collaborative modes of organization could reconfigure these dynamics. References Ackerman et al. (2013) M. S. Ackerman, J. Dachtera, V. Pipek, and V. Wulf Sharing Knowledge and Expertise: The CSCW View of Knowledge Management. Computer Supported Cooperative Work (CSCW) 22 (4), p. 531–573. External Links: Document Cited by: §1, §2.4, §4.4.2. ADL Center for Technology & Society (2023) ADL Center for Technology & Society Online hate and harassment: the american experience 2023. Technical report ADL. Note: Retrieved 02-02-2026 External Links: Link Cited by: §1, §4. AI (2022) O. AI Introducing Whisper. Note: Retrieved 07-05-2025 External Links: Link Cited by: §3.3, §4.1.6. Åkerlund (2021) M. Åkerlund Influence without metrics: analyzing the impact of far-right users in an online discussion forum. Social Media+ Society 7 (2), p. 20563051211008831. Cited by: §1. Auernhammer (2020) J. Auernhammer Human-centered AI: The role of Human-centered Design Research in the development of AI. DRS Biennial Conference Series. External Links: Document Cited by: §1. Ayache et al. (2024) G. Ayache, M. Pirchi, A. Navon, A. Shamsian, G. Hetz, and J. Keshet WhisperNER: unified open named entity and speech recognition. Note: Retrieved from https://doi.org/10.48550/arXiv.2409.08107 External Links: Document Cited by: 2nd item, §4.3.3, Table 3. Barbosa and Milan (2019) S. Barbosa and S. Milan Do Not Harm in Private Chat Apps: Ethical Issues for Research on and with WhatsApp. Westminster Papers in Communication and Culture 14 (1). External Links: Document Cited by: §2.4. Baumgartner et al. (2020) J. Baumgartner, S. Zannettou, M. Squire, and J. Blackburn The Pushshift Telegram Dataset. Proceedings of the International AAAI Conference on Web and Social Media 14, p. 840–847. External Links: Document Cited by: §3. Bäumler et al. (2025) J. Bäumler, T. Riebe, M. Kaufhold, and C. Reuter Harnessing Inter-Organizational Collaboration and Automation to Combat Online Hate Speech: A Qualitative Study with German Reporting Centers. Proceedings of the ACM on Human-Computer Interaction 9 (2), p. 1–31. External Links: Document Cited by: §1, §2.3, §2.4, 1st item, 4th item, 5th item, §4.1.1, §4.1.2, §4.1.6, §4.2.1, §4.2.3, §4.2.4, §4.2.5, §4.3.3, §4.3.5, §4.4.1, §4.4.2, §4, Table 3, Table 3, Table 3, Table 3, Table 3, Table 3. BBC News (2024) BBC NewsEuropean farmers protest across eu over prices and regulations(Website) BBC News. Note: Retrieved 02-05-2025 External Links: Link Cited by: §1. Beauduin (2025) A. Beauduin Report: the social media domination of the german far right. Technical report European Center for Digital Action. Note: Retrieved 02-05-2025 External Links: Link Cited by: §1. Beers et al. (2020) A. Beers, M. McClure Haughey, A. Arif, and K. Starbird Examining the digital toolsets of journalists reporting on disinformation.. In Proceedings of Computation + Journalism 2020 (C+J ’20), Boston, MA. Cited by: §2.3, 3rd item, §4.1.1, §4.1.3, §4.1.7, §4.2.1, §4.3.1, Table 3, Table 3. Beham and Soennichsen (2026) S. Beham and B. SoennichsenUmbau und unruhe: projekte von ‘demokratie leben’ auf dem prüfstand(Website) Tagesschau. Note: Retrieved 28-03-2026 External Links: Link Cited by: footnote 3. Bélair-Gagnon et al. (2023) V. Bélair-Gagnon, R. Larsen, L. Graves, and O. Westlund Knowledge Work in Platform Fact-Checking Partnerships. International Journal of Communication 17 (0), p. 21 (en). Cited by: §4.1.7, §4.2.1. Benavidez (2023) N. Benavidez Big Tech Backslide: How Social-Media Rollbacks Endanger Democracy Ahead of the 2024 Elections.. Technical report Free Press. External Links: Link Cited by: §2.1. Bernhard et al. (2019) M. Bernhard, A. B. Edgell, and S. I. Lindberg Parties, civil society, and the deterrence of democratic defection. Studies in Comparative International Development 55 (1), p. 1–26. External Links: Document Cited by: §2.1. Bingley et al. (2023) W. J. Bingley, C. Curtis, S. Lockey, A. Bialkowski, N. Gillespie, S. A. Haslam, R. K. L. Ko, N. Steffens, J. Wiles, and P. Worthy Where is the human in human-centered AI? Insights from developer priorities and user experiences. Computers in Human Behavior 141, p. 107617. External Links: Document Cited by: §1. Bozarth et al. (2023) L. Bozarth, J. Im, C. Quarles, and C. Budak Wisdom of Two Crowds: Misinformation Moderation on Reddit and How to Improve this Process—A Case Study of COVID-19. Proc. ACM Hum.-Comput. Interact. 7 (CSCW1), p. 155:1–155:33. External Links: Document Cited by: §2.4. Braun and Clarke (2006) V. Braun and V. Clarke Using thematic analysis in psychology. Qualitative Research in Psychology 3 (2), p. 77–101. External Links: Document Cited by: §3.5, §3.5. Buehling and Heft (2023) K. Buehling and A. Heft Pandemic protesters on telegram: how platform affordances and information ecosystems shape digital counterpublics. Social Media + Society 9 (3), p. 20563051231199430. External Links: Document Cited by: §1. Büscher et al. (2001) M. Büscher, S. Gill, P. Mogensen, and D. Shapiro Landscapes of Practice: Bricolage as a Method for Situated Design. Computer Supported Cooperative Work (CSCW) 10 (1), p. 1–28. External Links: Document Cited by: §2.3, §4.1.6, §5.3. [22] Capacity4dev Thematic Programme for Civil Society Organisations Multiannual Indicative Programme 2021-2027. Note: Retrieved 12-05-2025 External Links: Link Cited by: §2.1. CeMAS (2025) CeMASAbout cemas(Website) CeMAS. Note: Retrieved 29-04-2025 External Links: Link Cited by: §2.2, §2.4. Cifliku and Heuer (2025) B. Cifliku and H. Heuer “This could save us months of work” - use cases of AI and automation support in investigative journalism. In Proceedings of the Extended Abstracts of the CHI Conference on Human Factors in Computing Systems, CHI EA ’25, New York, NY, USA. External Links: Document Cited by: §2.4, 2nd item, 4th item, §4.1.5, §4.2.2, §4.3.1, §4.4.1, Table 3, Table 3, Table 3. Classen et al. (2024) K. Classen, A. Kollmer, M. Schlage, A. Schöpflin, J. Winkler, and H. Witerspan Right-wing populist communication of the party AfD on TikTok: to what extent does the AfD use TikTok as part of its communication to win over young voters?. In The Dynamics of Digital Influence: Communication Trends in Business, Politics and Activism, A. Godulla, C. Buller, V. Freudl, I. Merz, J. Twittenhoff, J. Winkler, and L. Zapke (Eds.), p. 100–122. External Links: Link Cited by: §1. Conway et al. (2019) M. Conway, R. Scrivens, and L. McNairRight-wing extremists’ persistent online presence: history and contemporary trends(Website) Note: Retrieved 05-09-2025 External Links: Link Cited by: §1, §4. Conway (2021) M. Conway Online Extremism and Terrorism Research Ethics: Researcher Safety, Informed Consent, and the Need for Tailored Guidelines. Terrorism and Political Violence 33 (2), p. 367–380. External Links: Document Cited by: §3.3, §4.2.3, §4.2.4, §4.3.3. Darius and Stephany (2022) P. Darius and F. Stephany How the far-right polarises twitter: ‘hashjacking’ as a disinformation strategy in times of covid-19. In Complex Networks & Their Applications X, p. 109–121. External Links: Document Cited by: §1. Das et al. (2023) A. Das, H. Liu, V. Kovatchev, and M. Lease The state of human-centered NLP technology for fact-checking. Information Processing & Management 60 (2), p. 103219. External Links: Document Cited by: §2.4, §2.4, §4.1.1, Table 3. Décary-Hétu and Aldridge (2015) D. Décary-Hétu and J. Aldridge Sifting through the Net: Monitoring of Online Offenders by Researchers. The European Review of Organised Crime 2 (2), p. 122–141. Cited by: §2.3. Demartini et al. (2020) G. Demartini, S. Mizzaro, and D. Spina Human-in-the-loop Artificial Intelligence for Fighting Online Misinformation: Challenges and Opportunities. IEEE Data Eng. Bull. 43, p. 65–74. Cited by: §2.4, §4.4.4. democ (2023) democ Abschlussbericht ‘interferenzen’. webdoku zu on- und offline-dynamiken antidemokratischer bewegungen. Technical report democ e. V.. Note: Retrieved 02-05-2025 External Links: Link Cited by: §1. Etikan et al. (2015) I. Etikan, S. A. Musa, and R. S. Alkassim Comparison of convenience sampling and purposive sampling. American Journal of Theoretical and Applied Statistics 5 (1), p. 1–4. External Links: Document Cited by: §3.1. European Union Agency for Fundamental Rights (2018) European Union Agency for Fundamental Rights Challenges facing civil society organisations working on human rights in the eu. Technical report European Union Agency for Fundamental Rights, Vienna, Austria. Note: Retrieved 08-05-2025 External Links: Link Cited by: §2.2, §2.2. European Union Agency for Fundamental Rights (2023) European Union Agency for Fundamental Rights Protecting civil society – Update 2023. Technical report Note: Retrieved 04-01-2026 External Links: Link Cited by: §2.2, §2.2. Evangelista et al. (2021) J. R. G. Evangelista, R. J. Sassi, M. Romero, and D. Napolitano Systematic Literature Review to Investigate the Application of Open Source Intelligence (OSINT) with Artificial Intelligence. Journal of Applied Security Research 16 (3), p. 345–369. External Links: Document Cited by: §2.3, §2.3. Fortuna and Nunes (2018) P. Fortuna and S. Nunes A survey on automatic detection of hate speech in text. ACM Comput. Surv. 51 (4). External Links: Document Cited by: §1. Franz et al. (2018) C. Franz, M. Fratzscher, and A. S. Kritikos German Right-Wing Party AfD Finds More Support in Rural Areas with Aging Populations — diw.de. Technical report Vol. 8, DIW Berlin, German Institute for Economic Research. Note: Retrieved 12-05-2025 External Links: Link Cited by: §2.1. Franzke et al. (2020) A. S. Franzke, A. Bechmann, M. Zimmer, C. Ess, and A. of Internet Researchers Internet Research: Ethical Guidelines 3.0. Note: Retrieved 21-02-2026 External Links: Link Cited by: §3.3. Galloway (2005) A. Galloway Non-probability sampling. In Encyclopedia of Social Measurement, K. Kempf-Leonard (Ed.), p. 859–864. External Links: Document Cited by: §3.1. Gangopadhyay (2025) S. Gangopadhyay Telegram data collector. Methods Hub. External Links: Document, Link Cited by: §2.4. Geiler and Fröhlich (2024) J. Geiler and A. FröhlichGewalt, Erpressung, Waffen: Razzia gegen Neonazis – einer hatte Zugang zu einem Polizeigebäude in Berlin(Website) Tagesschau. Note: Retrieved 08-05-2025 External Links: Link Cited by: §1. Glassman and Kang (2012) M. Glassman and M. J. Kang Intelligence in the internet age: The emergence and evolution of Open Source Intelligence (OSINT). Computers in Human Behavior 28 (2), p. 673–682. External Links: Document Cited by: §2.3. Greig (2024) J. GreigCivil society under increasing threats from ‘malicious’ state cyber actors, us warns.(Website) Note: Retrieved 04-09-2025 External Links: Link Cited by: §6. Guhl et al. (2020) J. Guhl, J. Ebner, and J. Rau The online ecosystem of the german far-right. Technical Report Institute for Strategic Dialogue. Note: Retrieved 02-05-2025 External Links: Link Cited by: §1. Guo et al. (2024) L. Guo, Y. Yin, and J. Thebault-Spieker Understanding perceptions of the reddit reaction mechanism in political subreddits. In Companion Publication of the 2024 Conference on Computer-Supported Cooperative Work and Social Computing, CSCW Companion ’24, New York, NY, USA, p. 261–267. External Links: Document Cited by: §2.4. Guo et al. (2022) Z. Guo, M. Schlichtkrull, and A. Vlachos A Survey on Automated Fact-Checking. Transactions of the Association for Computational Linguistics 10, p. 178–206. External Links: ISSN 2307-387X, Document Cited by: §1. Hancock et al. (2024) J. Hancock, R. Hui, J. Singh, and A. Mazumder Seeing human rights at sea: how to align tech development with the needs of maritime human rights investigators and affected communities. In Extended Abstracts of the CHI Conference on Human Factors in Computing Systems, CHI EA ’24, New York, NY, USA. External Links: Document Cited by: §2.4, §2.4, 1st item, 5th item, §4.2.1, Table 3, Table 3, Table 3. Hartmann et al. (2025) D. Hartmann, A. Oueslati, D. Staufer, L. Pohlmann, S. Munzert, and H. Heuer Lost in moderation: how commercial content moderation apis over- and under-moderate group-targeted hate speech and linguistic variations. In Proceedings of the 2025 CHI Conference on Human Factors in Computing Systems, CHI ’25, p. 1–26. External Links: Document Cited by: §2.4. Hrckova et al. (2025) A. Hrckova, R. Moro, I. Srba, J. Simko, and M. Bielikova Autonomation, not Automation: Activities and Needs of Fact-checkers as a Basis for Designing Human-Centered AI Systems. ACM Journal on Responsible Computing 2 (4). External Links: Document Cited by: §2.3, §2.4, §2.4, §2.4, §2.4, §4.2.1, §4.4.1, §4.4.2, Table 3, Table 3, Table 3. Hulshof-Schmidt (2024) R. Hulshof-Schmidt 2024 Nonprofit Digital Investments Report. Technical report NTEN, Heller Consulting. Note: Retrieved 02-05-2025 External Links: Link Cited by: §2.2, §2.2, 5th item, Table 3. Hummel et al. (2022) S. Hummel, L. Pfirter, and R. G. Strachwitz Civil Society in Germany: a Report on the General Conditions and Legal Framework. Technical report Technical Report 169, Maecenata Institut für Philanthropie und Zivilgesellschaft. Note: Retrieved 07-01-2026 External Links: Link Cited by: §2.2, 5th item, Table 3. Ihler (2025) B. M. IhlerMonitoring: a vital tool of antifascist resistance - rosa-luxemburg-stiftung(Website) Note: Retrieved 04-09-2025 External Links: Link Cited by: §2.1, §2.2. Immenkamp et al. (2024) B. Immenkamp, I. Zamfir, and D. de GrootHate speech and hate crime: time to act?(Website) Note: Retrieved 02-05-2025 External Links: Link Cited by: §1, §4. Institute for Strategic Dialogue (2024) Institute for Strategic Dialogue The German far-right’s digital push: Analysing the AfD’s campaign in Saxony and Thuringia. Institute for Strategic Dialogue. Note: Retrieved 12-01-2026 External Links: Link Cited by: §1. Institute for Strategic Dialogue (2025) Institute for Strategic DialogueDigital analysis unit(Website) Institute for Strategic Dialogue. Note: Retrieved 29-04-2025 External Links: Link Cited by: §2.2, §2.4. Internet Archive (2025) Internet ArchiveAbout the internet archive(Website) Note: Retrieved 29-04-2025 External Links: Link Cited by: §4.1.2. Juneja and Mitra (2022) P. Juneja and T. Mitra Human and Technological Infrastructures of Fact-checking. Proc. ACM Hum.-Comput. Interact. 6 (CSCW2), p. 418:1–418:36. External Links: Document Cited by: §2.3, §2.3, 2nd item, 3rd item, §4.1.1, §4.2.1, §4.2.2, §4.2.5, §4.3.1, §4.4.2, Table 3, Table 3, Table 3, Table 3, Table 3. Karanasios et al. (2022) S. Karanasios, P. K. Senyo, J. Effah, and A. Zorina Digital Bricolage: Creating a Digital Transformation from Nothing. ICIS 2022 Proceedings. External Links: Link Cited by: §2.3, §4.1.6, §5.3. Karasti (2014) H. Karasti Infrastructuring in participatory design. In Proceedings of the 13th Participatory Design Conference: Research Papers - Volume 1, PDC ’14, New York, NY, USA, p. 141–150. External Links: Document Cited by: §1, §2.4, §4.2.5. Karimi (2021) F. KarimiFearing more violence, online platforms are cracking down on livestreams from Washington(Website) Note: Retrieved 08-05-2025 External Links: Link Cited by: §1. Kayyali (2025) D. KayyaliMeta’s Content Moderation Changes are Going to Have a Real World Impact. It’s Not Going to be Good.(Website) Note: Retrieved 14-04-2025 External Links: Link Cited by: §2.1. Koenecke et al. (2020) A. Koenecke, A. Nam, E. Lake, J. Nudell, M. Quartey, Z. Mengesha, C. Toups, J. R. Rickford, D. Jurafsky, and S. Goel Racial disparities in automated speech recognition. Proceedings of the National Academy of Sciences 117 (14), p. 7684–7689. External Links: Document Cited by: §2.4. Kovács et al. (2021) G. Kovács, P. Alonso, and R. Saini Challenges of Hate Speech Detection in Social Media. SN Computer Science 2 (2), p. 95. External Links: Document Cited by: §2.4. Lai et al. (2022) V. Lai, S. Carton, R. Bhatnagar, Q. V. Liao, Y. Zhang, and C. Tan Human-AI Collaboration via Conditional Delegation: A Case Study of Content Moderation. In Proceedings of the 2022 CHI Conference on Human Factors in Computing Systems, CHI ’22, New York, NY, USA, p. 1–18. External Links: Document Cited by: §2.4. Lakomy (2024) M. Lakomy Open-source intelligence and research on online terrorist communication: Identifying ethical and security dilemmas. Media, War & Conflict 17 (1), p. 23–40. External Links: Document Cited by: 1st item, Table 3. Liu et al. (2024) H. Liu, A. Das, A. Boltz, D. Zhou, D. Pinaroc, M. Lease, and M. K. Lee Human-centered NLP Fact-checking: Co-Designing with Fact-checkers using Matchmaking for AI. Proceedings of the ACM on Human-Computer Interaction 8 (CSCW2), p. 1–44. External Links: Document Cited by: §2.4, §2.4, §2.4, 2nd item, 4th item, §4.2.2, §4.4.1, Table 3. Massanari (2018) A. L. Massanari Rethinking Research Ethics, Power, and the Risk of Visibility in the Era of the “Alt-Right” Gaze. Social Media + Society 4 (2), p. 2056305118768302. External Links: Document Cited by: §3.3, §4.2.4, §4.3.3. McKeown et al. (2014) S. McKeown, D. Maxwell, L. Azzopardi, and W. B. Glisson Investigating people: a qualitative analysis of the search behaviours of open-source intelligence analysts. In Proceedings of the 5th Information Interaction in Context Symposium, IIiX ’14, New York, NY, USA, p. 175–184. External Links: Document Cited by: §2.4, §4.1.2, §4.1.6, §4.2.4, §4.3.1, Table 3. Mellea (2024) J. Mellea Fraternity, fitness, and fascism: active clubs in germany. Technical report Center for Monitoring, Analysis and Strategy (CeMAS). Note: Retrieved 02-05-2025 External Links: Link Cited by: §1. Micallef et al. (2022) N. Micallef, V. Armacost, N. Memon, and S. Patil True or False: Studying the Work Practices of Professional Fact-Checkers. Proc. ACM Hum.-Comput. Interact. 6 (CSCW1), p. 127:1–127:44. External Links: Document Cited by: §2.3, §2.3, §4.5, Table 3. Morris et al. (2024) M. R. Morris, M. S. Bernstein, J. P. Bigham, A. S. Bruckman, and A. Monroy-Hernández Is Human-AI Interaction CSCW?. In Companion Publication of the 2024 Conference on Computer-Supported Cooperative Work and Social Computing, San Jose Costa Rica, p. 95–97 (en). External Links: Document Cited by: §2.4. Mukhopadhyay et al. (2024) A. Mukhopadhyay, S. Venkatagiri, and K. Luther OSINT research studios: a flexible crowdsourcing framework to scale up open source intelligence investigations. Proc. ACM Hum.-Comput. Interact. 8 (CSCW1). External Links: Document Cited by: §3.5, 3rd item, §4.3.1, §4.4.2, Table 3, Table 3, Table 3. Nakov et al. (2021) P. Nakov, D. Corney, M. Hasanain, F. Alam, T. Elsayed, A. Barrón-Cedeño, P. Papotti, S. Shaar, and G. D. S. Martino Automated Fact-Checking for Assisting Human Fact-Checkers. Note: Retrieved from http://arxiv.org/abs/2103.07769 External Links: Document Cited by: §2.3, §2.4. Neumann and Star (1996) L. J. Neumann and S. L. Star Making Infrastructure: The Dream of a Common Language. PDC, p. 231–240. External Links: Link Cited by: §1, §2.4, §4.1.3, §5.3. Nguyen et al. (2018) A. T. Nguyen, A. Kharosekar, S. Krishnan, S. Krishnan, E. Tate, B. C. Wallace, and M. Lease Believe it or not: Designing a Human-AI Partnership for Mixed-Initiative Fact-Checking. In Proceedings of the 31st Annual ACM Symposium on User Interface Software and Technology, UIST ’18, New York, NY, USA, p. 189–199. External Links: Document Cited by: §2.4. NORDIS (2022a) NORDIS Policy approaches to information disorder in the digital welfare state. Technical report NORDIS. Note: Retrieved 28-04-2025 External Links: Link Cited by: §2.3, §2.4, §2.4, §2.4, §4.1.6, §4.1.7. NORDIS (2022b) NORDIS Report on the user needs of fact-checkers. Technical report NORDIS. Note: Retrieved 28-04-2025 External Links: Link Cited by: §2.3, §2.4, §4.1.5, §4.1.6, §4.2.1. Nozza (2021) D. Nozza Exposing the limits of Zero-shot Cross-lingual Hate Speech Detection. In Proceedings of the 59th Annual Meeting of the Association for Computational Linguistics and the 11th International Joint Conference on Natural Language Processing (Volume 2: Short Papers), C. Zong, F. Xia, W. Li, and R. Navigli (Eds.), Online, p. 907–914. External Links: Link, Document Cited by: §2.4. Organization for Security and Co-operation in Europe (2018) Organization for Security and Co-operation in EuropeThe role of civil society in preventing and countering violent extremism and radicalization that lead to terrorism(Website) Note: Retrieved 04-09-2025 External Links: Link Cited by: §2.1, §2.1. Ortutay (2024) B. OrtutayMeta kills off CrowdTangle despite pleas from researchers, journalists | AP News(Website) AP News. Note: Retrieved 29-04-2025 External Links: Link Cited by: §2.4, §4.1.6. Palinkas et al. (2015) L. A. Palinkas, S. M. Horwitz, C. A. Green, J. P. Wisdom, N. Duan, and K. Hoagwood Purposeful sampling for qualitative data collection and analysis in mixed method implementation research. Administration and policy in mental health 42 (5), p. 533–544. External Links: Document Cited by: §3.1. Peeters and Hagen (2022) S. Peeters and S. Hagen The 4CAT Capture and Analysis Toolkit: A Modular Tool for Transparent and Traceable Social Media Research. Computational Communication Research 4 (2), p. 571–589. External Links: Document Cited by: §2.4. Priemer et al. (2015) J. Priemer, A. Labigne, and H. Krimmer Wie finanzieren sich zivilgesellschaftliche Organisationen in Deutschland? Eine Sonderauswertung des ZiviZ-Surveys. Kurzfassung. Technical report Körber-Stiftung. Note: Retrieved 07-01-2026 External Links: Link Cited by: §2.2. Primig and Fröschl (2024) F. Primig and F. Fröschl Introducing the FROG tool for gathering Telegram data. Mobile Media & Communication 12 (2), p. 449–453. External Links: Document Cited by: §2.4. Procter et al. (2023) R. Procter, M. Arana-Catania, Y. He, M. Liakata, A. Zubiaga, E. Kochkina, and R. Zhao Some Observations on Fact-Checking Work with Implications for Computational Support. Note: Retrieved from http://arxiv.org/abs/2305.02224 External Links: Document Cited by: §4.4.1. R. Rogers (Ed.) (2023) R. Rogers (Ed.) The Propagation of Misinformation in Social Media: A Cross-platform Analysis. Amsterdam University Press. External Links: Document Cited by: §4.1.4. Romanian Center for European Policies (2023) Romanian Center for European Policies Striving to thrive in turbulent times. Assessing the sustainability of CSOs and the growing impact of external threats.. Technical report Note: Retrieved 07-01-2026 External Links: Link Cited by: §2.2, Table 3. Rothut et al. (2024) S. Rothut, H. Schulze, J. Hohner, and D. Rieger Ambassadors of ideology: a conceptualization and computational investigation of far-right influencers, their networking structures, and communication practices. New Media & Society 26 (12), p. 7120–7147. External Links: Document Cited by: §1. Ruscica et al. (2025) G. Ruscica, G. Tucci, and B. Carneiro TeleCatch: An open-access software for visualizing, filtering and extracting Telegram messages data. Software Impacts 23, p. 100736. External Links: Document Cited by: §2.4. Samarin et al. (2020) N. Samarin, A. Frik, S. Brooks, C. Cheshire, and S. Egelman Surveying Vulnerable Populations: A Case Study of Civil Society Organizations. Note: Retrieved from http://arxiv.org/abs/2003.08580 External Links: Document Cited by: §2.2, §4.2.4, §4. Schinas et al. (2017) M. Schinas, S. Papadopoulos, L. Apostolidis, Y. Kompatsiaris, and P. A. Mitkas Open-Source Monitoring, Search and Analytics Over Social Media. In Internet Science, I. Kompatsiaris, J. Cave, A. Satsiou, G. Carle, A. Passani, E. Kontopoulos, S. Diplaris, and D. McMillan (Eds.), Cham, p. 361–369. External Links: Document Cited by: §2.4. Schluger et al. (2022) C. Schluger, J. P. Chang, C. Danescu-Niculescu-Mizil, and K. Levy Proactive Moderation of Online Discussions: Existing Practices and the Potential for Algorithmic Support. Proc. ACM Hum.-Comput. Interact. 6 (CSCW2), p. 370:1–370:27. External Links: Document Cited by: §2.4, §2.4, §3.5. Schmidt (2011) K. Schmidt Taking CSCW Seriously: Supporting Articulation Work (1992). In Cooperative Work and Coordinative Practices: Contributions to the Conceptual Foundations of Computer-Supported Cooperative Work (CSCW), K. Schmidt (Ed.), p. 45–71. External Links: Document Cited by: §1, §5.3, §5.3. Schöpke-Gonzalez et al. (2025) A. Schöpke-Gonzalez, S. Wu, S. Kumar, and L. Hemphill Using off-the-shelf harmful content detection models: best practices for model reuse. Proc. ACM Hum.-Comput. Interact. 9 (2). External Links: Document Cited by: §2.4. Schulze (2020) H. Schulze Zur bedeutung von dark social & deplatforming: eine quantitative exploration der deutschsprachigen rechtsaußenszene auf telegram. Zeitschrift für Semiotik 42 (3-4), p. 61–86. Cited by: §1. Seering et al. (2024) J. Seering, M. Khadka, N. Haghighi, T. Yang, Z. Xi, and M. Bernstein Chillbot: Content Moderation in the Backchannel. Proc. ACM Hum.-Comput. Interact. 8 (CSCW2), p. 402:1–402:26. External Links: Document Cited by: §2.4, §2.4, §3.5. Silva (2024) E. C. d. M. Silva TelegramScrap: A comprehensive tool for scraping Telegram data. Note: Retrieved from http://arxiv.org/abs/2412.16786 External Links: Document Cited by: §2.4. Skopik et al. (2024) F. Skopik, B. Akhras, E. Woisetschläger, M. Andresel, M. Wurzenberger, and M. Landauer On the application of natural language processing for advanced OSINT analysis in cyber defence. In Proceedings of the 19th International Conference on Availability, Reliability and Security, ARES ’24, New York, NY, USA. External Links: Link, Document Cited by: §2.3, §2.4, §2.4, §4.4.2, Table 3, Table 3. Smidt et al. (2025) H. Smidt, J. Johansson, and T. Richter Civil Society Under Attack: The Consequences for Horizontal Accountability Institutions. Studies in Comparative International Development 60 (1), p. 81–110. External Links: Document Cited by: §2.1, §2.2. Star and Ruhleder (1994) S. L. Star and K. Ruhleder Steps towards an ecology of infrastructure: complex problems in design and access for large-scale collaborative systems. In Proceedings of the 1994 ACM conference on Computer supported cooperative work, CSCW ’94, New York, NY, USA, p. 253–264. External Links: Document Cited by: §1, §2.3, §2.4, §4.1.3, §4.1.6, §5.3. Star and Strauss (1999) S. L. Star and A. Strauss Layers of Silence, Arenas of Voice: The Ecology of Visible and Invisible Work. Computer Supported Cooperative Work (CSCW) 8 (1), p. 9–30. External Links: Document Cited by: §1, §2.2, §4.2.3, §5.3. Star and work(s): (1989) S. L. Star and J. R. G. R. work(s): Institutional Ecology, ’Translations’ and Boundary Objects: Amateurs and Professionals in Berkeley’s Museum of Vertebrate Zoology, 1907-39. Social Studies of Science 19 (3), p. 387–420. External Links: Link Cited by: §1, §2.4, §4.2.5, §4.4.2. TechSoup (2025) TechSoup The State of AI in Nonprofits. Benchmark Report on Adoption, Impact, and Trends. Technical report External Links: Link Cited by: §2.2, §2.2. Urman and Katz (2022) A. Urman and S. Katz What they do in the shadows: examining the far-right networks on Telegram. Information, Communication & Society 25 (7), p. 904–923. External Links: Document Cited by: §3. Widholm et al. (2024) A. Widholm, M. Ekman, and A. O. Larsson A right-wing wave on tiktok? ideological orientations, platform features, and user engagement during the early 2022 election campaign in sweden. Social Media + Society 10 (3). External Links: Document Cited by: §1. Wolfe and Mitra (2025) R. Wolfe and T. Mitra The Implications of Open Generative Models in Human-Centered Data Science Work: A Case Study with Fact-Checking Organizations. In Proceedings of the 2024 AAAI/ACM Conference on AI, Ethics, and Society, AIES ’24, p. 1595–1607. Cited by: §2.4, §2.4, §4.4.1, Table 3. Yang et al. (2022) C. Yang, F. Zhu, G. Liu, J. Han, and S. Hu Multimodal hate speech detection via cross-domain knowledge transfer. In Proceedings of the 30th ACM International Conference on Multimedia, M ’22, New York, NY, USA, p. 4505–4514. External Links: Document Cited by: §1. Zachlod and Peter (2021) C. Zachlod and M. K. Peter The Social Media Monitoring Process and its Role in Social Media Strategy Development | springerprofessional.de. In Advances in Digital Marketing and eCommerce, p. 11–152. Cited by: §2.3. Appendix A Appendix A.1. Participants Table 5. Overview of interview participants, including the thematic focus of the employing organization (O), the participant’s (P) main activity, and whether they have formal technical education. Id Thematic Focus (O) Main Activity (P) Technical Education (P) P1 Far-right Consulting No P2 Antisemitism Monitoring No P3 Far-right, conspiracy theories Archiving, education No P4 Various phenomena Consulting No P5 Various phenomena Consulting No P6 Far-right Monitoring No P7 Far-right Monitoring No P8 Far-right Archiving, analysis No P9 Far-right Consulting No P10 Far-right Monitoring No P11 Conspiracy theories Monitoring No P12 Various phenomena Monitoring, analysis Yes P13 Human rights violations Software development Yes P14 Antisemitism, racism, conspiracy theories Monitoring Yes P15 Far-right Consulting No A.2. Interview Guidelines A.2.1. Information Phase • Thanks for the willingness to be interviewed. • Information about research + its objectives. • Information about confidentiality. A.2.2. Warm-up Phase Have the work of the organisation / person explained in general terms. • What can you tell me about your work / the work of your organisation? • What are the focal points (main topics) of your organisation? • What is the main focus of your work? (e. g. counselling, monitoring, educational work) A.2.3. Main Phase General analysis / research • What role does analysing anti-democratic actors online play in your work? • Which phenomena or categories are particularly relevant? • Which social media or services are particularly relevant for you? • What role does Telegram play for you? • Which data/media types are of particular interest to you and why? (text, image, audio, video) • Which methods and processes do you use? • Which languages are relevant? Current workflow • How do you currently go about analysing or researching – could you describe a typical process as specifically as possible? • What challenges or problems do you encounter? (e. g. technical or legal) • What human and/or financial resources are available for monitoring/analysis in your organisation? Existing services • Do you already have software that you use for research/analysis? • What exactly do you find helpful about it? • Is there anything in it that you think is missing or that you would like to see better/differently? AI • Where could AI best support you in your work? • What would be the ideal functionality for you? • What about the use of Generative AI? • What role does generated content play in your monitoring work? Other • How would you describe your technical infrastructure? • Do you exchange information with others to keep each other up to date? • Do you share data with others? A.2.4. Closing Phase • Is there anything else you would like to add? • Information about next planned steps (publication of results, workshops to test the software) • Thank participants.

Instant research discovery