I'm trying to rephrase something I read previously but the long and the short of it was: Identifying and outing feds by behaviour *can be a losing strategy, because it can lead to hostility towards otherwise honest behaviours, discriminate against ND users who don't fit 'normal' behaviour patterns and even if you do accurately out and eject someone they are just the fed that you noticed, those who are better at concealing their activity or who otherwise don't raise suspicions can still get by and you're given a false sense of accomplishment. There's a reason why fedjacketing is not permitted here. The better approach is to have robust systems in place that defang or reduce the scope for hostile actors to gather information, distrupt, or dismantle. It's a bit like how people say that in the USA, Marxist reading groups of just a half dozen people are infiltrated. At a certain size of org you'll probably have to accept that you're being monitored.

(edit: i think this is all stuff I gleaned from reading about cops at protests, and people being like 'omg they're so obvious you can see the outline of their gun and their shoes are so pristine' and someone was like 'well, yeah, they're just the ones you noticed')