Georgian far-right group engaged in coordinated inauthentic behavior to disseminate its content

On October 23, 2020, Facebook removed 130 assets linked to Alt-Info, a Georgian far-right group that used the platform to distribute partisan and anti-Western content. The DFRLab’s analysis of these assets showed that Alt-Info was using an inauthentic network of Facebook accounts, groups, and pages to disseminate its content. Facebook previously removed Alt-Info assets in 2019, but, despite the setback, Alt-Info created new Facebook pages and expanded this distribution network.

The latest Facebook takedown took place one week before the October 31 parliamentary elections in Georgia in which several far-right parties ran for seats in the next parliament. The ruling Georgian Dream party claimed victory, with the Central Election Commission determining that it had received 48.07 percent of the votes, well above the 27.12 percent given to the United National Movement, the largest opposition party. The results, however, triggered protests and led the eight opposition parties to declare that they would boycott the parliament.

In its announcement, Facebook stated:

This network used fake accounts to post and comment on their own content to make it appear more popular than it was, and manage Pages, some of which posed as independent from one another. Some of these Pages have gone through significant admin changes and appear to have been purchased. This network focused primarily on amplifying and engaging with Alt-Info’s Page and its content, and commenting on local news media Pages. This network posted primarily in Georgian about news and current events in the country including EU and Russian politics, Georgian parliamentary election in 2020, political figures, criticism of local media and liberal politicians such as representatives of European Georgia party, immigrants, minorities and LGBTQ communities. Some of this activity included posting hate speech and information rated false by independent fact-checkers in Georgia.

Background

In November 2018, Alt-Info announced the creation of an internet television channel to oppose “liberal propaganda” in Georgia by providing a conservative viewpoint about ongoing events in the country.

Georgian fact-checking organizations have reported many times that Alt-Info spreads manipulative information and promotes biased viewpoints; it also disseminates false information. Alt-Info pushes anti-Western messages and frequently promotes anti-immigration discourse. On top of this, it frequently puts forward pro-Russian narratives that are fully in line with the Kremlin’s strategic goals toward Georgia.

The DFRLab previously reported that Alt-Info tried to fuel anti-LGBT sentiments in Georgia in the context of 2019’s Tbilisi Pride event. Alt-Info TV presenter Zurab Makharadze argued that his organization is openly spreading anti-liberal, anti-immigration, and anti-LGBT narratives because it is an official position of Alt-Info as a conservative group that has nothing to hide.

In August 2020, ISFED published a report about Facebook assets spreading Alt-Info content. After ISFED’s report, Radio Free Europe’s Georgian bureau contacted Makharadze to ask whether the assets were linked to Alt-Info. Makharadze confirmed that some of the Facebook pages were run by Alt-Info, but others identified were unrelated but supportive of Alt-Info.

LTD Alt-Info and Alternative for Georgia

The legal entity behind Alt-Info is LTD Alt-Info, which registered with Georgia’s National Agency of Public Registry on January 28, 2019. LTD Alt-Info is owned equally by Shota Martinenko and Tsiala Morgoshia. Martinenko is a board member of “Alternative for Georgia,” a non-commercial legal entity connected to Alt-Info.

Zurab Makharadze is also a board member of Alternative for Georgia board, along with Konstantine Morgoshia, Shota Martinenko, Irakli Kizilashvili, and Giorgi Kardava. Morgoshia’s investment company, the Konstantine Investment Group, has a logo featured prominently on the Alt-info.com website. Morgoshia was previously a member of pro-Kremlin Alliance of Patriots of Georgia party and was also affiliated with extremist pro-Russian Georgian March party members. Other members of Alternative for Georgia were presenters on Alt-Info’s TV channel. Facebook removed individual accounts of all these individuals as well as their accounts on Instagram.

The Alt-Info.com website was registered in June 2017. Although attempts were made to obfuscate the website registration records using a domain privacy proxy, historic WHOIS results indicated that the website was registered to Irakli Kizilashvili with a Georgian address on June 11, 2017.

Politically, these individuals, identified as part of the network removed by Facebook, have worked together in the past. In 2019, Alternative for Georgia board members nominated Georgian conservative politician Koba Davitashvili as their candidate for Tbilisi’s Mtatsminda District for a parliamentary by-election. However, Davitashvili lost the election to a candidate from the ruling Georgian Dream party.

The Alt-Info network on Facebook

The DFRLab analyzed 41 Facebook pages, 46 user profiles, and three groups, and found evidence that the assets identified in the dataset were coordinating their posts. Several of these assets did not indicate any relationship with Alt-Info and, instead published sports or edgy humor pages. Other pages in the set appeared to be more overtly connected with Alt-Info and featured the word “Alt” in their names.

Alt-Info conducted daily live videos and interviews, which were streamed through these Facebook assets. The assets also posted and shared articles published on Alt-Info’s website. In May 2019, Facebook took down some of the anti-liberal pages within the Alt-Info network, including pages named “Alt-Info,” “Anti-Liberal Page,” “Anti-Liberal Club,” and “Geo Pepe.” Despite this action, Alti-Info created new pages, with a new “Alt-Info” page garnering over 36,000 followers between June 2019 and the takedown in October 2020.

The DFRLab used CrowdTangle to obtain all the posts by the Alt-Info groups. The result was a dataset of 30,440 posts published between January 1, 2015, and Oct 23, 2020.

Another subset of pages masqueraded as apolitical, fun pages as a means of concealing their real identity in order to mislead users. These pages, however, mainly shared political video content from Alt-Info in a coordinated manner.

The DFRLab also observed that some of the pages were most likely taken over or co-opted by Alt-Info, as the relevant assets did not appear to have initially been created by anybody connected to Alt-Info. The DFRLab examined the post history of several inauthentic pages and found that they were posting content between 2013–2015 and then stopped posting for some time. When these assets resumed posting — mostly in 2019 — they showed increased posting volumes that consisted mainly of Alt-Info’s videos.

“Anti-Liberal Club,” one of the pages connected to Alt-Info removed in 2019, posted in March 2018 that it had created a new page called Interesting Events. They admitted in the post that such neutral pages can garner likes very fast and that it was the operators’ intention to do so as quickly as possible.

Moreover, the post said that the operators’ wanted to grow the page audience in order to spread anti-liberal content. Such behavior runs against Facebook’s community standards inasmuch as the Interesting Events page was created with the intention to mislead others about its real identity. Although Facebook removed Anti-Liberal Club in 2019, it was revived under the new name “Alt Club.” The behavior exhibited by these pages also transgresses Facebook’s policy on inauthentic activity, in that the Alt Info network appears to have run multiple assets to distribute its content. Facebook removed both the Alt Club and Interesting Events pages.

Alt-Info cross-posting patterns

Within the dataset, it was apparent that some of the pages were cross-posting videos uploaded by other groups. Since cross-posting requires authorization from the initial uploader of the video, this indicated a relationship between the administrators of both pages. A pattern emerged in the data whereby three of these covert Alt-Info pages would consistently cross-post Alt-Info content simultaneously.

In addition, a large proportion of the pages shared links that were originally posted by the Alt-Info page. Using the same dataset, the DFRLab identified the websites most linked to by posts made by these assets. Of these 30,440 posts, 7,654 linked directly to the Alt-Info.com website, with the largest four pages being responsible for 65 percent of the links to the website.

It was also evident from the CrowdTangle data that, even when the assets were not directly cross-posting videos, they were sharing duplicated content by manually copying and pasting links across multiple pages.

An example of this was found where multiple posts of the same video were shared using the same title, generally starting with “🔴LIVE.” Using this pattern, the DFRLab examined all of the posts by these assets starting with this phrase in their title. Some of these titles had been copied and pasted as many as 13 times by various pages, and the bulk of the videos and their titles were copied and pasted three or more times across various pages.

Additionally, the majority of these assets linked the titles to the Alt-Info Facebook page, unless they were cross-posting the video directly.

The DFRLab already identified coordination in that the assets cross-posted content from the main Alt-Info Facebook page, but further evidence indicated that the video content not cross-posted was manually copied and pasted before being posted on some of the other assets.

For example, the timestamps of a video posted by the Alt-Info Facebook page on April 23, 2020, indicated that the same title text was copied and pasted across 13 different assets within the network. These posts were published over the span of around 13 minutes.

Individual accounts

As mentioned above, Facebook also removed user accounts for individuals connected to Alt-Info and Alternative for Georgia. The DFRLab found a photo among Facebook photos posted to the user profile for Sandro Sandro, which showed three Alt-Info presenters sitting together — Makharadze, Kardava, and Kizilashvili (also known as Irakli Martin). Facebook also disabled the user profiles of two other individuals in the photograph — Vasili Gvilia and Sandro Sandro — but the DFRLab could not determine their exact relationship with Alt-Info and its network, though there is some evidence suggesting that Sandro and Kardava might be related to each other.

Facebook also removed user accounts for two other Alt-Info presenters, Emre Kuchuck and Shota Martinenko, not shown in the photo, as well as accounts for Makharadze’s wife Lika Kasradze and Alternative for Georgia founder Konstantine Morgoshia.

A number of inauthentic accounts connected to Alt-Info were also taken down. The DFRLab found that Sandro’s and Gvilia’s names were mentioned in links to some of the inauthentic accounts with misleading names. It may indicate that these accounts were managed by these individuals. In total, Facebook removed four accounts connected to Sandro and two accounts that claimed to be owned by Martinenko.

After Facebook took down Alt-Info network in October 2020, individuals behind this network pushed misleading narratives about Facebook’s decision and claimed that Alt-Info pages were removed due to posting anti-liberal content. For instance, Zurab Makharadze admitted that Alt-Info used Facebook pages and groups previously owned by other people to disseminate its content. He asserted that some of the pages that Alt-Info took over were dedicated to various special interests such as sports. However, Makharadze did not admit that such behavior can be seen as a violation of Facebook’s community standards and he voiced a misleading definition of coordinated inauthentic behavior. According to his definition, coordinated inauthentic behavior is an act when “an employee of a company shares livestream in other groups or posting it on other pages, e.g. page for emigrants — this is an inauthentic behavior.”

Facebook’s decision to remove Alt-info assets was related to misuse and abuse of this platform exhibited in violating community standards and this decision has nothing to do with Alt-Info content. In fact, Alt-Info assets concealed their true identity and they misled Facebook users about their real ownership or control of these pages. Such misrepresentation runs against community Facebook’s standards. Thus, the operators behind the Georgian far-right online television outlet Alt-Info engaged in coordinated inauthentic behavior to disseminate the outlet’s content on Facebook. To that end, they employed a covert network of pages as well as inauthentic user accounts to amplify content.

As of October 27, 2020, the founder of Alt-Info, Konstantine Morgoshia, and other members of his team have already registered even newer accounts on Facebook and launched a campaign called “Solidarity to Alt-Info.” As Morgoshia announced, Alt-Info is about to obtain a license to launch a cable TV channel that would go live within one month. Alt-Info has, however, suspended its operations since the Facebook takedown appears to have severely restricted its ability to disseminate content.

Givi Gigitashvili is Research Assistant, Caucasus, with the Digital Forensic Research Lab and is based in Georgia.

Jean Le Roux is a Research Associate, Southern Africa, with the Digital Forensic Research Lab and is based in South Africa.

Follow along for more in-depth analysis from our #DigitalSherlocks.