Assets linked to the Alliance of Patriots were camouflaged as media and entertainment platforms to push anti-Western political agenda

Shortly before Georgian parliamentary elections in Georgia on October 31, 2020, Facebook removed a network connected to the Alliance of Patriots of Georgia (AoP), an openly pro-Russian, far-right political party. The network targeted a domestic Georgian audience with posts about politics and elections. The individuals behind the network employed multiple Facebook pages, groups, and fake accounts to promote the party’s anti-Western agenda and discredit the pro-Western opposition, as well as Georgia’s Western partners.

Far-right, pro-Russian, and anti-Western political parties have become noticeably active both online and offline prior to elections. Since the last parliamentary elections in 2016, during which it won its first six seats in the Georgian parliament, AoP has been accused of working for Russia against the interests of Georgia by targeting civil society organizations, media, and pro-Western political parties. According to a recent investigation by the Dossier Center, a London-based organization owned by the exiled Kremlin critic Mikhail Khodorkhovsky, AoP is directly financed by the Kremlin, which is also handling the party’s election campaign. The party has long called for “enhancing relations” between Georgia and Russia, organizing visits to Moscow for these purposes. AoP is also known in Georgia for its anti-Western, xenophobic, and Turkophobic statements. Opposition leaders and civil society organizations have been demanding AoP to be banned from parliamentary elections and investigated by the General Prosecutor’s Office for their links with the Kremlin as Georgian parties and the candidates are prohibited from receiving foreign and anonymous donations.

The DFRLab recently reported on how AoP attempted to provoke ethnic and religious tensions ahead of the elections by erecting anti-Turkish billboards and launching anti-Turkish ads on Facebook.

The pre-election period in Georgia has become increasingly polarized. A wave of anti-government rallies calling for reform to the country’s electoral system, dispersal of protesters with water cannons outside parliament, violence against opposition leaders and journalists, and physical clashes have all contributed to a fraught election environment.

It was in this political setting that Facebook removed assets linked to the far-right Alliance of Patriots. In its announcement of the takedown, Facebook stated:

This network was still early in its audience building when we removed it. The people behind it used fake accounts — some of which have gone through significant name changes — to create fictitious personas, comment on other people’s content, post in Groups and manage Pages. Some of these Pages posed as news entities. This network posted primarily in Georgian about news and politics in Georgia, including the parliamentary elections in October 2020, memes and other content about Russia-Georgia relations, supportive commentary about Alliance of Patriots and Georgian Choice parties, and criticism of their political opponents and Georgia-NATO relations. The network also posted content rated false by local fact-checkers. The inauthentic engagement activity appeared to begin in December 2019 focusing on one party (Alliance of Patriots), and then in May 2020 shifted to focus on another (Georgian Choice).

It is the third takedown to occur during the pre-election period in Georgia. Two previous takedowns investigated by the DFRLab involved a network belonging to a private marketing company with ties to the Georgian Dream-led government, and a media organization owned by an individual also with links to Georgian Dream.

Facebook pages

Facebook took down Tinp.ge — დღეს პოლიტიკაში (“Today in Politics”), a page camouflaged as a mainstream media outlet that hid its links to AoP by not openly identifying itself as a party-affiliated online outlet. The page was created in November 2019 and has been sharing articles from the external website tinp.ge, which promotes the activities of the far-right party and its leaders behind a veneer of supposedly objective reporting.

The Tinp.ge page ran Facebook ads promoting the AoP and its leaders’ anti-Western statements. According to Georgian fact-checking organization Myth Detector, the page had also run ads discrediting the work of U.S. National Democratic Institute (NDI) and the International Republican Institute (IRI) in Georgia.

According to the page transparency section for Tinp.ge, its admin was Omar Mdzevashvili, who also managed additional Facebook groups. His personal user account was also removed as a part of this takedown.

To amplify content, the network used Facebook pages camouflaged as media outlets, stock broker agencies, and other various page types. They shared articles from the Tinp.ge website as well as sport-themed webpages such as sportvideo.ge, footballs.ge, sportery.ge, and blogsport.ge.

The DFRLab found several domains and their affiliated Facebook pages, initially dedicated to sports, that were actively used as AoP assets. Together with sports news, these domains capitalized on the COVID-19 pandemic and the Georgian government’s response with clickbait headlines as a means of growing their reach and engagement. They also promoted the leaders of the ruling Georgian Dream party and attempted to discredit its political opposition. There were also articles fueling negative sentiment toward Iranians. It has been a matter of debates in Georgia weather AoP operates as a satellite party to Georgian Dream. A number of indicators, including support of GD presidential candidate by AoP, identical political messages against pro-Western opposition parties and international and local organizations, manning up AoP parliamentary fraction by GD MPs, made local actors raise concerns over two parties’ covert alliance.

Links to two domains in particular — Sportery.ge and Blogsport.ge — were among the most frequently shared by the same fake account that promoted AoP and Tinp.ge. A third, Dailyinfo.ge, camouflaged itself as media outlet. According to a whois search, all three domain URLs appear to have been registered by the same person, “beqa tsulaia.”

A user account for BeQa TsuLaia claimed to be founder for all three websites, as well as CEO of DailyInfo.ge and Director of Blogsport.ge.

Additionally, the DFRLab found that this network has links to PosTV, a pro-government television channel that frequently targets pro-Western political opposition, media outlets critical of the government, pro-democracy activists, and NGOs. Sportery.ge is co-owned by Giorgi Amashukeli, a social media marketing manager at PosTV. User accounts for both Giorgi Amashukeli and BeQa TsuLaia were also listed as administrators for a public group named Dailyinfo.ge. Initially Daily Info was named “Milan Georgian fans” and was renamed as Daily Info on October 6, 2020, weeks before parliamentary elections.

The websites for Dailyinfo.ge, Sportery.ge, and Blogsport.ge, together with AoP-linked Tinp.ge, were developed by the same website designer company, Studio GB.

Other pages in the network were dormant and had deceptively generic names that could allow the page operators to amplify specific content without any obvious sign of political bias.

Facebook groups

The removed network also included two Facebook groups with more than 22,000 members combined, both of which had the English and Georgian names of “Tinp.ge.”

The history section of the Facebook group “დღეს პოლიტიკაში” (“Today in Politics,” aka “TINP”) showed that the group was originally created on May 18, 2015 and had undergone a number of name changes prior to removal. The first name change was to “პოზიტივი” (“Positive”) on October 5, 2016, then to “ღამურები” (“Bats”) on August 29, 2018, and then “Sportery” less than a month later on September 17, 2018. The group settled on its final name on December 13, 2019, but the earlier generic names indicated a possible attempt to engage Facebook users with different types of content.

The same accounts managed both TINP Facebook groups. One of the admins of the groups was Omar Mdzevashvili, who also managed the Facebook page Tinp.ge, as illustrated earlier.

The DFRLab found that another admin of the removed groups, Nikoloz “Nika” Inashvili, is the nephew of Irma Inashvili, one of the leaders of AoP. Inashvili’s personal user account was also removed as a part of the takedown. A phone number listed on Tinp.ge’s “About” page appeared to be for Inashvili, as corroborated by Nomrebi.com, an open database of Georgian cell numbers.

Materials on Tinp.ge are multiplied through another duplicate website todayinpolitics.ge. Both domains publish identical articles in order to diversify sources. Historic WHOIS result shows that Todayinpolitics.ge have been registered by same Nikoloz Inashvili. At this moment, both domains hide registration information.

The two Facebook groups amplified content from AoP’s official Facebook page, as well as from the Tinp.ge page and website. The posts to the groups were mostly shared by the admins. In addition to promoting AoP’s election campaign and discrediting its political opposition and Georgia’s Western partners, the groups also included posts about COVID-19, religion, domestic security, social politics in Georgia, and the ongoing conflict in Nagorno-Karabakh.

User accounts

The DFRLab had access to 54 user accounts removed as part of the takedown. Out of the 54 acccounts, 33 of them reappropriated publicly available images and, in certain cases, personal pictures as a means of obscuring their inauthenticity.

Some of the removed fake accounts promoted AoP’s election campaign, while others were relatively less active. These accounts amplified Facebook posts from both the Tinp.ge Facebook page and website, as well as posts from AoP and its leaders. Some of the removed accounts spread homophobic, anti-Western, and pro-Kremlin sentiments, leading some of them to have been investigated by Myth Detector.

Besides fake accounts, Facebook also deleted the personal Facebook and Instagram accounts of individuals directly connected to AoP, including those for Mdzevashvili and Nika Inashvili. Facebook also deleted the user account and Instagram accounts for Gvantsa Giorgobiani, an anchor on TV Obieqtivi, a television channel known for its openly anti-Western and pro-Russian reporting, as well as hate speech. The channel, which has openly supported AoP ahead of the parliamentary elections, was founded by Irma Inashvili, one of the leaders of AoP and Nika Inashvili’s aunt.

Among the accounts, content from Tinp.ge was the most shared on domestic, regional, and international issues, and none of the accounts was transparent regarding their links to AoP. All of the analyzed accounts, both fake and real, appeared to coordinate in sharing links to Tinp.ge content on various thematic groups with thousands of members as a means of increasing the content’s reach and artificially boosting its popularity.

Georgian Choice

Facebook also removed assets for Georgian Choice, a newly established political party founded by former AoP member Bezhan Gunava. Gunava left the AoP in June 2020 for the reason that the party had been distancing from the interests of society and that the decision-making process had been one-sided. Georgian Choice was established in July 2020 and the majority of the party members are young people. The party does not have a website and its election program is not publicly available. Based on the videos published on the party’s official Facebook page, Georgian Choice mostly capitalizes on social issues, especially in regions. Georgian Choice is not widely-covered in mainstream media and the party’s Facebook page has only 6K likes. The party’s page was created on September, 2013 under the name “პოეზია” (eng: Poetry) and changed its name into Georgian choice on April, 2020.

In this subset, the removed assets included personal Facebook accounts for party two candidates for parliament, Bezhan Gunava and Ketevan Buturishvili, and the party leaders Mariam Margvelani, and Davit Darsadze, as well as fake accounts promoting Georgian Choice.

Instagram accounts

The network also included 18 Instagram assets, some of which were personal accounts for Georgian Choice politicians, Obiektivi TV journalists, and the admins of Tinp.ge Facebook pages and groups. Some of these individuals seemingly had two or three accounts. Other IG assets included in the takedown were ones focused on entertainment and dormant accounts with few followers.

Eto Buziashvili is a Research Associate, Caucasus, with the Digital Forensic Research Lab.

Sopo Gelava is a Research Associate, Caucasus, with the Digital Forensic Research Lab.

Follow along for more in-depth analysis from our #DigitalSherlocks.