Assets linked to Georgian far-right and pro-Kremlin party were camouflaged as entertainment content

By Sopo Gelava and Eto Buziashvili

Amid a deepening political crisis in Georgia related to the detention of the leader of the main opposition party, Facebook removed a network connected to the violent far-right and pro-Kremlin party Georgian March. The network of 70 assets camouflaged itself as a collection of entertainment and online shopping platforms and included 24 Facebook pages, 12 groups, 23 user accounts, and 11 Instagram profiles.

The takedown comes after a December 2020 DFRLab investigation that identified an inauthentic network promoting Georgian March and pro-government media outlet PosTV on Facebook.

In a statement released by a Facebook spokesperson, the company said:

The people behind this activity used fake and duplicate accounts to post, comment and manage Pages and Groups. This network had multiple strikes for violating our Community Standards related to hate speech. They focused primarily on amplifying the content of Georgian March, a political party on the right in Georgia. This network posted in Georgian about news and current events including elections, claims of voter fraud, covid-19 pandemic, and criticism of the US President Biden. This network was early in its operation when we removed it.

We found this network after reviewing public reporting on this activity by researchers at the Digital Forensic Research Lab at the Atlantic Council. Although the people behind this activity attempted to conceal their identities and coordination, our investigation found links to individuals associated with Georgian March, a political party in Georgia, and its youth wing.

Before transforming itself into a political party prior to the 2020 parliamentary elections, Georgian March was formed in 2017. The group has routinely targeted migrants, the LGBT community, and democracy activists.

An Estonian Intelligence Service report referred to Georgian March as a Russian-backed “umbrella organization for extremist movements” promoting “so-called traditional values.” Georgian March has strong ties with local pro-Kremlin actors, including the Y. M. Primakov Georgian-Russian Centre and Levan Vasadze, a millionaire who gained his fortune in Russia and is a supporter of local far-right groups. Vasadze himself has connections with Alexander Dugin, aka “Putin’s brain,” a geopolitical theorist known for fascist views and close ties to the Kremlin.

Civil society representatives and political analysts have long raised concerns about the connections between Georgian March with the Georgian Dream led-government. Until 2016, the leader of Georgian March, Sandro Bregadze, served as a Deputy Minister of Diaspora Affairs; his relatives donated to Georgian Dream prior to 2016 parliamentary elections. Some researchers have suggested that Georgian Dream neglects the threat posed by Georgian March and other far-right groups, and instrumentalizes them for intimidating liberal groups that are also critical of the government.

Facebook pages

Facebook took down 24 pages; according to the company, around 119,000 accounts followed one or more of them. Among these pages were several official pages of Georgian March and the dormant page of Irakli Shikhiashvili, one of the leaders of the political party.

Another removed page, მარში ტვ (“March TV”), was created ahead of the Georgian parliamentary elections and announced the broadcasting of the Georgian March-affiliated TV channel. As investigated by the DFRLab, the page shared content from Georgian March’s official page and also managed two public groups, საგიჟეთი, ღამურები, შერეკილები (“Madhouse, Bats, Eccentrics”) and ყიდვა გაყიდვა საქართველოში (“Buy and Sell in Georgia”). The content from this page was also promoted by Beka Kvitsiani, an author with the Kremlin-affiliated disinformation outlet News Front Georgia. The page had been inactive since February 2021.

Georgian March, together with other far-right and pro-Kremlin actors, fueled sentiments around Davit-Gareji, the disputed historical monastery complex between Georgia and Azerbaijan, that was followed by detainment of two cartographers of the Delimitation and Demarcation Commission, accusing them of attempting to cede land to Azerbaijan ahead of the 2020 parliamentary elections. The timing of the accusation and other inconsistencies in the case have raised concerns among Georgian civil society groups and the political opposition, who have assessed the investigation as politically motivated and intended to consolidate power around the Georgian Dream party. The official page of Georgian March sponsored several posts on the Davit-Gareji controversy and held several demonstrations at the Gareji complex with the slogan “Davit-Gareji is Georgia.” One of the demonstrations at the Azerbaijan border was held amid the 2020 Nagorno-Karabakh conflict between Armenia and Azerbaijan.

Facebook also deleted pages connected to George Toreli, a photographer and video blogger. DFRLab has previously reported on the Facebook network linked to Toreli, which was used by Georgian March and pro-government TV channel PosTV to promote its content. Pages in Toreli’s network presented themselves as focused on general interest topics, such as online sales and marketing, travel, photography, movies, and entertainment. In reality, however, they promoted Georgian March and PosTV content on their Facebook timelines and to related groups in a coordinated manner. Giorgi Gabedava, one of the leaders of Georgian March, responded to DFRLab’s previous article claiming that George Toreli is his close friend and shared the videos from Georgian March to support the party. Since the DFRLab’s investigation, pages in Toreli’s network no longer disseminated posts promoting Georgian March and PosTV.

Pages in this network also included two well-known far-right pages, “წინააღმდეგობა • Resistance” and the page “გათბობის სისტემები — “ბეგიო” / Boil Systems — “BeGio,” formerly known as “რუხი კარდინალი” (“Grey Cardinal”), as well as the newly established dormant page “CoronaVirus News.”

Facebook accounts

The network also included 23 user accounts. Nine of these accounts had stolen profile pictures from elsewhere on the internet, and were likely inauthentic. The DFRLab previously identified that the same fake accounts as sharing content from Georgian March-affiliated pages in a coordinated manner. Two of the removed accounts also indicated that they worked as PR managers for Georgian March.

Some of the accounts that promoted Georgian March, at the same time shared PosTV’s content and a Facebook post from Shalva Ramishvili, a shareholder and an anchor at PosTV. One of the users in this network disseminated a PosTV video published by “Georgian March Ball,” a page connected to Georgian March, in anti-liberal groups such as “ქართული მარში — ეროვნული მოძრაობის მხარდამჭერთა” ჯგუფი (“Georgian March — National Movement” supporters group) and “ანტილიბერალური სივრცე” (“Anti-Liberal Space”).

Other accounts in this network also shared content from another far-right page “წინააღმდეგობა • Resistance .” Three accounts camouflaged themselves under general names such as “employment agent,” “Georgian emigrants,” and “Tbilisi, Georgia.” Remaining deleted accounts were connected to George Toreli.

Facebook Groups

The 12 Facebook groups in the network, some of which were private, had a combined membership of around 10,500 accounts. Engagement with their posts was low and, in many cases, close to zero. Similar to the pages, the groups used deceptive names that indicated they were focused on apolitical topics, such as entertainment or job vacancies, while hosting political content related to Georgian March for an unsuspecting audience. Only two out of 12 groups identified themselves as for Georgian March supporters.

The users in the group “ქართული მარში — ეროვნული მოძრაობის მხარდამჭერთა ჯგუფი” (“Georgian March — supporters of national movement”), which had 2,500 members, also fueled negative sentiment toward Turkey — a common tactic applied by far-right and pro-Kremlin groups in Georgia in order to provoke ethnic and religious tension and distract attention from threats Georgia faces from Russia; and promoting Georgian far-right group Alt-Info, which has spread anti-Western and anti-LGBT narratives and engaged in coordinated inauthentic behavior that resulted in a previous Facebook takedown.

Similar to the pages, the groups used deceptive names that indicated they were focused on apolitical topics, while hosting political content related to Georgian March.

According to the information given in the about section, one of the groups in the network, “შავი ღრუბელი / Black Cloud,” was created specifically for mobilizing people to reporting “liberal Facebook pages” (i.e. attacking Facebook pages that have culturally liberal values) in a coordinated way. The description of the group said, “whenever possible, everyone’s suggestions on the targets of coordinated report will be taken into consideration….[T]here will be an announced exact time when everyone should find five minutes to report [the targeted page] in a coordinated way.” Apparently, the network employed the group for targeting people and pages they opposed and used the Facebook reporting mechanism as a tool to silence or disrupt pro-Western accounts.

Multiple groups were managed by common administrators– Facebook pages and accounts titled with variations of George Toreli’s name, as well as with names dedicated to shopping and job vacancy pages.

Instagram accounts

The network also included 11 Instagram accounts, some of which were personal accounts of Georgian March supporters. These were the same users that had accounts on Facebook as well. Images of George Toreli appeared on four accounts, however, under different names. Two accounts also posed as advertising and entertaining platforms that the DFRLab has previously identified as part of Toreli’s network.

George Toreli, who operated a network that promoted Georgian March and PosTV had several accounts on Instagram with different names. (Source: Instagram)

Sopo Gelava is a Research Associate, Caucasus, with the Digital Forensic Research Lab.

Eto Buziashvili is a Research Associate, Caucasus, with the Digital Forensic Research Lab.

Cite this case study:

Sopo Gelava and Eto Buziashvili, “DFRLab investigation leads to Facebook takedown of assets affiliated with Georgian March party,” Digital Forensic Research Lab (DFRLab), April 6, 2021, https://medium.com/dfrlab/dfrlab-investigation-leads-to-facebook-takedown-of-assets-affiliated-with-georgian-march-party-c556777795e3.

Follow along for more in-depth analysis from our #DigitalSherlocks.