Information operations and the 2020 Georgian parliamentary elections

Election protest on November 1st in Tbilisi. Crowds of people standing in front of Parliament building. Photo: EvaL Miko / Shutterstock

On October 31st 2020 parliamentary elections were held in Georgia. The pre-election period saw a high degree of negative campaigning and information operations designed to influence voters’ opinion. Both foreign and domestic actors conducted several social media influence campaigns in an attempt to deepen pre-existing political and social divides ahead of the elections. Overall, Facebook emerged as the primary platform for these efforts. While foreign interference mainly aimed to sow confusion and instil a feeling of vulnerability within Georgian society, domestic information operations focused on influencing Facebook users’ opinion of particular political actors through the use of misleading information. Moreover, some of the domestic information campaigns were driven by desires for profit. Some political parties even outsourced their trolling campaigns to external advertising and media companies.

Foreign influence attempts

Covert foreign influence attempts in the lead up to the Georgian elections came in three main forms: attacks on Georgia’s cyber space; influence operations on social media; and the funding of political parties (or political grooming). While most of these activities can be clearly accredited to the Kremlin or related actors, others were difficult to attribute directly to any specific actor.

The first observed trend regarding external interference was related to the disruption of Georgian websites and “hack-and-lead” operations which targeted the US-funded Richard Lugar Center for Public Health Research in Georgia. On October 28th 2019 a massive cyber-attack was carried out in Georgian cyber space. This attack saw hackers take around 15,000 Georgian websites offline, including the official websites of the president of Georgia, local municipalities and television channels. A joint investigation led by Georgia, the United Kingdom and the United States concluded with “95+” per cent certainty that Russia’s Main Intelligence Directorate (GRU) carried out the attack. Georgian officials confirmed that the GRU intended to sow confusion within Georgian society by obstructing the proper functioning of state institutions and eroding the country’s national security.

The October 2019 attack was followed by another cyber-disruption in September 2020 – two months before the parliamentary elections. Hackers acting on behalf of a foreign government’s special services stole documents related to the management of the COVID-19 pandemic from the database of the Richard Lugar Public Health Research Centre. The documents were subsequently falsified and uploaded on Raidforums, an online database of breaches and leaks. Georgian law enforcement authorities argued that this release of forged documents was intended to intimidate, confuse and encourage distrust within society. Even though Georgian authorities have not officially published the results of the investigation into this specific attack, the president and the deputy speaker of the Georgian parliament quickly asserted that the cyber-attack was “most likely perpetrated by the Russian government”.

Alongside cyber-attacks, evidence related to the possible hacking of Georgia’s election infrastructure emerged online several months ahead of the elections. In March 2020, leaked personal data of almost five million Georgians appeared on the Raidforums website. The released document contained full names of individuals, their ID numbers, home addresses and dates of birth. Despite this, the authenticity of this personal information was not confirmed. Georgia’s Central Election Commission (CEC) stated that the leaked information was not stolen from its database. The organisation argued that the data was different from the type of data stored in the CEC database. It is possible that the disclosure of this potentially distorted personal data ahead of elections was intended to undermine perceptions of the CEC’s voter list, which could potentially affect electoral credibility. The group responsible for this attack and its intentions remain unclear.

Social media information operations

Ahead of the parliamentary elections, Kremlin-funded propaganda outlets used various fake accounts and pages on Facebook in order to promote their content. In April 2020 Facebook took down two global networks connected to the Russian state-funded Sputnik and News Front media organisations. Some of these organisations’ assets were focused on promoting content from the local Georgian editions of these outlets. The reason for removing these networks was their suspiciously coordinated behaviour. Facebook officially defines such behaviour as a situation in which “Facebook groups or pages or people work together to mislead others about who they are or what they are doing”.

Dubious networks consisting of fake accounts, Facebook pages and groups posted content from the Sputnik and News Front outlets. Whereas the Sputnik content promoted by the network was mainly apolitical, News Front assets pushed explicitly pro-Russian and anti-western narratives. Moreover, News Front pages pushed divisive content about Georgian domestic politics in an attempt to stir up conflict between supporters of the ruling party and the opposition. Additionally, News Front’s subjective reporting in the lead up to the elections aimed to erode trust in pro-western political actors and promote narratives favourable to pro-Russian parties in Georgia.

Domestic information operations in Georgia

Homegrown disinformation and domestic information campaigns were also prevalent in Georgia ahead of elections. As aforementioned, one new observed trend involves some political forces outsourcing political trolling and manipulative behaviour to private PR and marketing companies. Between December 2019 and October 2020, Facebook took down at least four fake networks connected to political parties that were being used to manipulate public opinion ahead of elections.

In December 2019, Facebook took down the first inauthentic Georgian network connected to the Georgian Dream-led government. This network consisted of misleading Facebook pages, fake accouts and groups that were publishing divisive content designed to promote the government and discredit opposition parties and civil society organisations. The pages that were removed also promoted articles that contained specific anti-American sentiment. A Facebook investigation found that this network was administered by the Georgian advertising firm Panda, which was revealed to be conducting a political trolling campaign on behalf of the Georgian Dream-led government.

In April 2020, Facebook removed another fake network administered by the Espersona media organisation, which is owned by an individual connected to the ruling Georgian Dream party. Similar to that network, Espersona’s campaign promoted pro-government and anti-opposition content. Moreover, fake accounts were used to impersonate Georgian health professionals and opposition leaders.

However, it was not just the ruling party that managed inauthentic networks in order to manipulate public opinion. Together with the Espersona network, Facebook also removed a network connected to the United National Movement opposition party. One week before the October parliamentary elections it also took down a network connected to the pro-Kremlin political party Alliance of Patriots of Georgia. Naturally, this was being used to disseminate anti-western messages. Apart from managing a fake network on Facebook, the Alliance of Patriots used other techniques to manipulate public opinion. In 2019-20, the party commissioned a public poll and the results were made public two months ahead of the parliamentary elections. According to the findings of the survey, over 65 per cent of Georgians supported the country’s military neutrality (i.e. implicitly rejecting Georgia’s aspiration to join NATO) and over 70 per cent supported direct talks with Russia and even the secessionist regimes of Abkhazia and South Ossetia. The way in which the survey was conducted, however, casts serious doubts over the reliability of the data. Needless to say, the findings of the survey proved convenient for Russia, whose long-standing goals include blocking Georgia’s accession to NATO and portraying itself as a mediator – rather than a party to – territorial conflicts in Georgia. Indeed, the survey may have been encouraged by the Kremlin itself. Documents published in August 2020 by the Dossier Center (a London-based organisation run by Russian opposition figure Mikhail Khodorkhovsky) indicate that the Alliance of Patriots allegedly received pre-election advice and money from Kremlin-affiliated figures.

The Atlantic Council’s Digital Forensic Research Lab team in Tbilisi found an inauthentic Facebook network connected to ultra-nationalist political party Georgian March. Inauthentic assets connected to this network were camouflaged as groups or pages dedicated to general interest topics (online shopping, travel, photography). In reality, these pages promoted Georgian March’s political content. Facebook removed this network in March 2021 for violating platform’s Community Standards. According to Facebook’s announcement “this network posted in Georgian about news and current events including elections, claims of voter fraud, COVID-19 pandemic, and criticism of the US President Biden”. Georgian March is an extremist organisation that was registered as a political party two months ahead of elections. According to an Estonian intelligence report from 2020, certain individuals among the leadership of Georgian March have close ties to the Kremlin.

Weaponising social media

To sum up, both foreign and domestic actors in Georgia actively used social media to influence election results and advance their own agenda. Kremlin-funded propaganda outlets used some covert means on social media in order to expand their audience beyond their traditional base of support. Apart from social media influence activities, Russia also employed cyber disruption as a means of promoting confusion in Georgia.

The public release of stolen and hacked documents by external actors ahead of elections represents another new experience for Georgia. Such actions could cause significant controversy and confusion ahead of key political events in the future. Another alarming trend was the profit-driven nature of political trolling, with advertising and media firms hired to conduct political discreditation campaigns. There is now a serious risk that more companies will accept similar orders to conduct media manipulation campaigns on behalf of political actors in the future. This in turn threatens both the integrity of elections and genuine public debate on social media.

Last but not least, Georgian far-right forces acted as key promoters of pro-Kremlin narratives and some of them even allegedly collaborated with Moscow. Monitoring of their narratives revealed that posts discussing relations with the West and other countries oftentimes converged with Russia’s narratives. The Kremlin’s support for Georgian internal political proxies did not, however, turn out to be very effective. Altogether, the country’s openly pro-Russian parties received only four per cent of all votes during the parliamentary election.

This article is published as part of a project to promote independent digital media in Central and Eastern Europe funded by the National Endowment for Democracy and coordinated by Notes from Poland.

Givi Gigitashvili is based in Georgia and is a Research Assistant for the Caucasus with the Atlantic Council’s Digital Forensic Research Lab.

This article is based on findings gathered as part of the USAID-funded Election Watch Georgia project. More findings from this project will be disussed in detail in an upcoming Atlantic Council report “Fighting for the Hearts and Minds of Sakartvelo”, authored by Givi Gigitashvili and Eto Buziashvili.

Dear Readers - New Eastern Europe is a not-for-profit publication that has been publishing online and in print since 2011. Our mission is to shape the debate, enhance understanding, and further the dialogue surrounding issues facing the states that were once a part of the Soviet Union or under its influence. But we can only achieve this mission with the support of our donors.  If you appreciate our work please consider making a donation.

Georgia, Georgian 2020 elections, Georgian politics, Russian cyber operations, Russian foreign policy, Russian interference, Russian-Georgian reletions