DFRLab
Published in

DFRLab

Inauthentic network promoted far-right Georgian political party on Facebook

Alt-Info had previously been de-platformed for anti-LGBT posts; Facebook taking action against the latest network

Anti-LGBT protesters storm the office of LGBT campaigners ahead of the planned March for Dignity during Pride Week in Tbilisi, Georgia, July 5, 2021. The far-right group Alt-Info actively encouraged its supporters to protest Tbilisi Pride Week. (Source: REUTERS/Irakli Gedenidze)

By Sopo Gelava

An inauthentic Georgian network operating on Facebook uncovered by the DFRLab promoted the newly formed Conservative Movement political party, which grew out of the anti-LGBT Georgian far-right group Alt-Info. In response to this investigation, Facebook has taken down assets affiliated with the network, having originally banned Alt-Info in October 2020.

Alt-Info announced the formation of the political party on November 15, 2021. On November 20, it held a constituent congress officially launching the party, electing Alt-Info leader Zurab Makharadze as chairperson. Makharadze said the party supports “a direct and unconditional dialogue” with Russia and that it would work to establish a “close partnership and alliance with the Russian Federation.” In a video circulating on Facebook, Makharadze said he supports opening a Russian military base in Georgia, noting that Georgia can align with Russia’s security interests in the region.

Alt-Info has a history of using inauthentic assets to distribute hyper-partisan and anti-liberal content. As previously noted, Facebook banned the organization in October 2020, at the time removing around 130 assets linked to the group for engaging in coordinated inauthentic behavior, and has taken action against the group on multiple occasions since then. It also removed a smaller Alt-Info network in 2019.

As part of its latest investigation, the DFRLab uncovered 15 pages, 15 groups, and 53 user accounts created by Alt-Info to promote the new political party.

Background

Alt-Info, which is affiliated with anti-liberal organization Alternative for Georgia, is the most well-known far-right group in Georgia. It was the main instigator of violence on July 5, 2021, when a mob of protesters disrupted the March of Dignity, organized by Tbilisi Pride, and physically attacked journalists, leading to one death. The DFRLab previously reported on Alt-Info’s role in mobilizing its followers online to attend the July 5 Pride Week rally, as well as a similar effort prior to Tblisi Pride 2019.

The establishment of a political party has long been a part of Alt-Info’s agenda. The plan became more concrete after the events of July 5, which members of the group viewed as a success. They believed their actions had helped to ensure “the process of European integration will be turned upside down,” and that Christian conservatism would replace liberalism. In an interview with Radio Free Europe/Radio Liberty, Alt-Info founder Konstantine Morgoshia said the formation of the party was hastened by the desire of Alt-Info’s supporters and their demand for the creation of an affiliated party. Morgoshia also said that the party would be prepared if snap elections were to take place.

Alt-Info is linked to pro-Kremlin Georgian actors. Founder Konstantine Morgoshia is a former leader of Georgian March and ex-member of Alliance of Patriots, both of which are pro-Kremlin political parties. Morgoshia is also a close friend of Levan Vasadze, Georgia’s representative to the World Congress of Families, a network of organizations promoting an anti-LGBT agenda around the world. Vasadze also has strong ties to Aleksandr Dugin, a controversial Russian philosopher who has been accused of spreading fascist ideas and leads the pro-Putin organization Eurasia Movement.

Facebook pages

The DFRLab identified 15 pages, with roughly 300,000 followers in total, as a part of this investigation. Some of the posts from these pages received little engagement, while other posts overperformed, according to a query using Facebook monitoring tool CrowdTangle. The DFRLab’s query found that all 15 pages received a 13.5 percent daily interaction rate in the period between November 15, when the party formation was announced, until November 20, the day of that constituent congress. Only one page explicitly included Alt-Info in its name. Three other pages posted Alt-Info’s logo as their profile image but had names with variations of “alt” and “alternative,” including “Alt-Analitika,” “Alternative,” and “Alternative Viewpoint”. Other pages posed as platforms promoting traditional values and nationalistic ideology with names like “Conservative,” “Traditionalist Platform,” and “Georgian Page.”

Ten of the 15 pages were created between June and November 2021. Two pages, ალტერნატივა (“Alternative”) and “Georgian Page,” were created on the same day, October 9. Some of the pages had a history of name changes; for example, the page ალტერნატიული ხედვა (“Alternative Viewpoint”) was originally named სწავლება (“Online learning”), but changed its name on November 1.

Screencap of the Page Histories for some of the pages in the network. A majority of the pages in the network were created between June 2021 and November 2021. (Source: Facebook)

Three pages also linked to the website altinfo.pw in their “About” section. The domain ending is affiliated with the Republic of Palau, a country in Oceania, but the website hosts exclusively Alt-Info content. According to a WHOIS search, the website was created on October 26, 2021 using Russian domain registrar and hosting service Reg.ru. Alt-Info’s official YouTube channel links to a similar website featuring the domain name altinfo.net. This website was registered on July 13, 2021, also via the Russian registrar Reg.ru.

Screencap of search queries for external websites linked by pages in the network, including one with a domain URL from the Republic of Palau. Alt-Info’s YouTube channel also promoted a website, but at a different URL. Both websites were registered by REG.Ru, a Russian webhosting service. (Source: Sopo Gelava/DFRLab via WhoisDomainTools)

The DFRLab used CrowdTangle to identify several instances of cross-posting, confirming some level of coordination between the pages. In the context of Facebook, cross-posting is a way to post an already published video from its source onto another page without having to upload it again. To accomplish this, the originator page must grant permission to any other pages wanting to share the video, thus forming a “cross-posting relationship.” By identifying which pages have cross-posted, it’s possible to infer a degree of coordination between the pages.

Table showing the pages that cross-posted the video promoting Alt-Info’s new political party, all within seconds, indicating some degree of coordination between these pages. (Source: Sopo Gelava/DFRlab via CrowdTangle)

User accounts

The DFRLab also identified 53 user accounts that shared content from the previously pages affiliated with the inauthentic network. Twelve of them were designed to look like Facebook pages rather than user profiles, with names like სამართალი აქ (“Justice here”), სა ქართველო (“Georgia”), კონსერვატიული ხედვა (“Conservative viewpoint”), საქართველო ჩვენია (“Georgia is ours”), and სიმართლე სიმართლე (“Truth Truth”), among others. The accounts were likely registered as user profiles to mitigate detection and monitoring. These page-like user accounts promoted the newly established political party and shared content from the inauthentic pages on their timelines and into various groups, as well as posted promotional posts as original content.

Screencaps from the user accounts designed to look like Facebook pages and that promoted Alt-Info’s new pro-Kremlin political party in various groups and on their own timelines. (Source: Facebook)

The DFRLab also found that at least two Facebook pages and four user accounts were linked to one person. A user account by the name არსენ ფოფხაძე (“Arsen Popkhadze” — a Georgian name and surname) was affiliated with two additional profiles with slight variations of his name — არსენ არსენ (“Arsen Arsen”) and ფოფხაძე ფოფხაძე (“Popkhadze Popkhadze). Besides repetition of the names, the assets used profile pictures featuring the same person, who was also identified in the profile image of a user account with the name “Georgian page.” These user accounts regularly shared content from two particular pages, კონსერვატიული (“Conservative”) and a page also named “Georgian Page,” as well as from the inauthentic user account სამართალი აქ (“Justice here”). The DFRLab checked the timestamps of their posts and found that these assets frequently shared each other’s content within narrow windows of time.

Screencaps of four accounts that all used an image of the same person, which, combined with other factors such as nearly identical posting times, indicates that a single actor (or actors) is likely behind the assets. (Source: Facebook)
Screencap showing how the assets in this network shared content from each other within minutes, indicating on coordination between these assets. (Source: Facebook)

The network also involved inauthentic user accounts that portrayed themselves as real people, but a reverse image search showed the profile photos were taken from elsewhere on the internet. These inauthentic accounts managed groups promoting Alt-Info and their new political party, including the party’s official group and its supporters.

Screencaps showing accounts that stole profile images from elsewhere on the internet; the Yandex and Google queries at right show two photos taken from other sources. These accounts also managed groups, as at left, including a group for the newly established party Conservative Movement. (Source: Facebook, left; Yandex Images, top right; Google Images, bottom right)

Other user accounts in this network coordinated to promote Alt-Info’s announcement of its formation of a political party into groups not affiliated with this network, including groups propagating COVID-19 conspiracies and anti-vax sentiments.

Screencaps of user accounts in this network promoting Alt-Info’s political party launch into various unaffiliated groups, including groups dedicated to COVID-19 conspiracies and anti-vaccine sentiment. (Source: Facebook)

Facebook groups

The 15 Facebook groups identified by the DFRLab, only one of which was private, had a combined membership of around 40,000. Fourteen of them were created in 2021 between May and November. The newest, კონსერვატიული მოძრაობა (“Conservative Movement”), was created on November 20, 2021, the day of the party’s inaugural congress, using the same name as the new party. Another group, ალტერნატივა საქართველოს (“Alternative for Georgia”), changed its name to კონსერვატიული საქართველო (მხარდამჭერები) (“Conservative Georgia Supporters”) on November 20, 2021.

The DFRLab was able to link only some of the groups to Alt-Info by name alone, as a majority of the groups used less-specific names such as ამაყი ხალხი/Proud Boys&Girls/, ქართველი კონსერვატორები (“Georgian Conservatists”), ‼️✅ ჯგუფი ერთობა✅‼️ (“Group Unity”), 🇬🇪კონსერვატორი🇬🇪 (“Conservatist”), 🇬🇪georgia group🇬🇪, and others.

Many of the groups, however, shared administrators, some of which were the pages and user accounts discussed above.

Screencap of some of the administrator lists for the groups in this network showing overlap and directly connecting them to this network. (Source: Facebook)

Similar to the Facebook pages, content promoting Alt-Info and its new political party was reposted into these groups in a coordinated manner over a short period of time. For example, the same live video from the party’s constituent congress was shared into the groups between 1:07 pm — 2:00 pm local time on November 20, 2021.

Table showing the dates and times at which user accounts posted the same live video from Conservative Movement’s constituent congress into groups within the same hour period. (Source: Sopo Gelava/DFRlab via CrowdTangle)

Overall, the network was early in its operation when the DFRLab uncovered it; most of the assets were created in 2021, and some were only several days old. This network exhibited coordination and inauthenticity among the pages, groups, and user accounts comprising it. Compared to previous inauthentic networks attributed to Alt-Info, this one seemingly prioritized fake user accounts over public pages and groups.

Sopo Gelava is a Research Associate, Caucasus, with the Digital Forensic Research Lab.

Cite this case study:

Sopo Gelava, “Inauthentic network promoted far-right Georgian political party on Facebook,” Digital Forensic Research Lab (DFRLab), December 1, 2021, https://medium.com/dfrlab/inauthentic-network-promoted-far-right-georgian-political-party-on-facebook-5eb5ad76b358.

--

--

--

@AtlanticCouncil’s Digital Forensic Research Lab. Catalyzing a global network of digital forensic researchers, following conflicts in real time.

Recommended from Medium

The “Animal Farm” attitude by too many Westerners towards Macedonia

7 iconic technologies that have shaped the UN’s work for refugees

Coalition and Iraqi Strikes on ISIS Remnants

Theresa May will always put party before country

Indian state terrorism in occupied Kashmir, 3 more Kashmiri martyrs

Reason Why LIC IPO May Defers To Next Year!

Reason Why LIC IPO May Defers To Next Year!

Africa’s 5G Train is on a Collision Course with US Regulation

How Technology Can Help Traffic In India

Get the Medium app

A button that says 'Download on the App Store', and if clicked it will lead you to the iOS App store
A button that says 'Get it on, Google Play', and if clicked it will lead you to the Google Play store
@DFRLab

@DFRLab

@AtlanticCouncil's Digital Forensic Research Lab. Catalyzing a global network of digital forensic researchers, following conflicts in real time.

More from Medium

Pro-Russian outlets promote misleading story about US Army howitzers moving through Poland

How to Be Happy

Memories of the Spinal Unit - A Time of Tragedy and Hope

Fem/ Gift Biz Model