Coordinated Network of False Media Pages on Facebook Operating with Political Intentions
As the parliamentary election date gets closer, waves of disinformation and discrediting content intensifies both from Russian and domestic sources. It is likely that the coronavirus pandemic has caused early activation of the infrastructure created for exerting information influence on election processes. Consequently, a high level of activity of coordinated Facebook pages, groups and accounts operating in favor of political actors is visible as early as 6 months prior to the elections. In addition to pages operating for discrediting opponents, a new closely coordinated network of false media pages has emerged, abusing social media platforms to disseminate their favorable messages and information. Even though on 20 December 2019, Facebook removed majority of false media pages, relatively new false media pages have started employing different tactics for operation.
ISFED identified a network of false media pages with elements of close coordination on Facebook, which operates in disguise and utilizes common tactics in an attempt to disseminate pro-governmental messages in an inauthentic manner and demonize critical opinions. In addition to dissemination of pro-governmental articles, these false media pages disseminate targeted disinformation for discrediting public figures and opposition leaders that are critical to the government.
Within the information network ISFED identified:
-----
14 false media Facebook pages employ the same tactic, which indicates their coordination. Majority of these pages were created the same day, on 27 May 2019. In parallel with the Facebook pages, their 14 websites and the same number of YouTube channels are also active. Those too have been created within the same period of time. False media names, design of their Facebook pages and appearance of their websites aim to mislead users into thinking that they are real media outlets.
Some false media articles are disseminated selectively in Facebook groups with thousands of subscribers. This way, they reach significant numbers of Facebook users. 35 groups identified by ISFED where false media materials are disseminated in an organized manner, have nearly 5 million members in total.
Personal accounts are used intensively to disseminate posts of some false media pages by sharing them in different Facebook groups within short periods of time. One of such accounts identified by ISFED belonged to a deceased U.S. citizen. It was probably taken over in Georgia and from March 14 through April 13, it was used to disseminate false media posts and provoke interaction in groups with thousands of members.
Notably, 50 fake Facebook pages are evident in the comments section of posts published by false media pages. These pages disguise themselves as different people, while they are all created not as personal accounts but as Facebook pages. They do not exhibit behavior of standard Facebook pages and they remain active with the purpose of leaving mass comments on false media pages.
Coordinated False Media Network
ISFED discovered a network of suspicious coordinated false media pages on Facebook, which in addition to dissemination of pro-governmental messages amid the coronavirus crisis also disseminate discrediting messages about opposition parties, their leaders, public figures critical to the government and media. A total of 14 websites have been discovered alongside corresponding Facebook pages, which are closely connected and operate in an organized manner. Unlike false media pages detected earlier, which massively sponsored their posts in order to increase their audience, these pages tend not to sponsor their posts. Instead, they use Facebook groups with thousands of members to attract audience. They target Facebook groups that focus on politics, entertainment and specific interests.
How does coordination manifest in behavior?
The same date of registration: among 14 coordinated false media Facebook pages identified by ISFED, 11 were created the same day, on 27 May 2019. One additional page was created on June 22 and two additional pages were created on June 25. Their names are similarly bilingual (English-Georgian) and their logos are similarly designed.
Cloning actual media outlets: logo, design and name of some of these pages is similar to those of actual media outlets - for instance, one page is called „Interpressnet“ and its logo contains an abbreviation - „IPN“. Purpose of the false media logo design and name is to copy an actual media outlet “Interpressnews” and possibly mislead Facebook users.
Similar description: the coordinated pages misrepresent themselves as news agencies. All of them indicate “News & Media Website” under the page category. Notably, the style and formulation of sentences in page descriptions are similar. See the slideshow below:
|
Slide 1: Georgia Daily is an independent Georgian media platform. News agency - Georgia Daily is an independent Georgian media platform that offers its users impartial information on processes in and outside of Georgia. Our team focuses on protection of principles of free press in order to provide balanced and objective information to public in an operative manner. Slide 2: Ikitxe.com is a media platform that focuses on protection of journalistic ethics and free media principles to provide its readers with impartial and objective information about developments in and outside of Georgia. Slide 3: Tbilisi-Today.com is an independent news agency that functions based on contemporary standards.Tbilisi-Today.com is an independent Georgin news agency that functions based on contemporary standards. It focuses on protecting free media and journalistic ethics standards, providing public with objective and comprehensive information about developments in and outside of Georgia. |
-----
Websites created the same day: each of the 14 false media Facebook pages has a website with the same name and majority of their posts are shared in the form of links to these websites. Website domains that correspond to Facebook pages created on 27 May 2019 were created the same day, on May 12 - 15 days before the Facebook pages were created. On this date, domains of 11 false media websites were registered within four minutes. Another false media website domain created later (Georgiadaily.net) was registered before corresponding Facebook page was created (12 days prior). Two false media websites were launched two months after corresponding Facebook pages were created.
-----
-----
Suspicious coordinated scheme of content dissemination
Facebook pages of false news agencies employ the same scheme for delivering their content to the audience. In particular, an article is placed on a website and then shared in a corresponding Facebook page, followed by dissemination of the Facebook post by different false accounts in Facebook groups with thousands of members. This scheme is used to disseminate materials containing a particular political content and messages. It is not the purpose of these pages to deliver all of their articles to the audience. Instead, they aim to create high-volume content to ensure that their positioning of the page as a media outlet is more convincing.
Since activity of false media pages described in this report mostly targets Facebook groups, posts published on them are rarely sponsored and majority of sponsored posts are anti-opposition.
-----
Examples of sponsored posts
|
“On June 20 we missed the chance of overthrowing the regime” - Saakashvili |
Saakashvili wasn’t allowed to attend a meeting with the State Secretary of America |
A contract between UNM and Orion Strategy was made public |
-----
Notably, organized comments by fake accounts are evident under certain posts of this set of false media pages. For instance, majority of comments under a post published by “Fakt Press • ფაქტ პრესი” on March 19 has been left by inauthentic accounts. Authors of these comments are accounts registered as pages on Facebook, which have been created since January 28. All of them use abstract photos or photos stolen from the Internet as their profile pictures. Similarly, false accounts left numerous comments on March 18 under an article of a news agency Interpressnews concerning performance of PM Giorgi Gakharia and the government.
Video proofs of above statement:
Interactions of fake accounts
Comments by fake accounts at InterPressNews.ge Facebook page
Coordination on YouTube
Notably, the false media pages acting in a coordinated manner also use the YouTube platform in an organized way. All of the fourteen Facebook pages have corresponding channels on YouTube. These channels were created as a group, in different stages. First stage began on 28 May 2019 and ended on June 25. Uploading of videos on these channels began on June 20, when as a response to the voyage of Russian MP Gavrilov in Tbilisi a large-scale protest rally was held on Rustaveli Avenue, dispersed by the authorities the same night by using force. Videos published on YouTube channels of false media pages are a collection of reports aired by different TV broadcasters. Majority of these videos have only a few views.
However, videos that serve the purpose of discrediting the opposition and civil activists or portraying the authorities in positive light have more views. As of 27 April 2020, a total of 7,771 videos have been uploaded on 14 coordinated YouTube channels of false media pages. Their total views are up to 400 000.
Coordination of false media pages in Facebook groups
In an attempt to increase their audience, false media pages are abusing Facebook groups with thousands of members that focus on a range of interests. To disseminate their content, in addition to several authentic accounts they are also using fake personal profiles or Facebook pages created for this particular purpose. Their only function is to share false media links in groups and they don’t engage in any other activity, as their only purpose is to share concrete posts with the target audience. Along with the purpose to increase the audience for false media, this activity serves to promote certain political views among the target audience.
It is possible that this tactic was developed in order to evade Facebook sanctions, diversify accounts and make coordinated behavior less visible. In addition, possible purpose of using such scheme is to make false media pages seem credible and mislead the audience into thinking that these news sources are shared by many individuals or news pages.
To disseminate the content of false media Facebook pages currently a total of 35 open and closed Facebook groups intended for a Georgian audience are used. These groups bring together 4,950,688 Facebook users. Their topics vary and mostly focus on religious and national issues.
15 personal accounts and 2 Facebook pages that disseminate false media links in groups in an organized manner.
|
Facebook Pages |
Disseminating Profiles | Facebook Groups |
Monitoring of administrators of these groups suggests that they are managed, used and/or coordinated by a single source. ISFED has identified 3 coordinated pages, 2 genuine and 10 possibly inauthentic accounts as disseminators of contents of 14 false media pages in these groups. They share false media links in the groups in a coordinated manner. One of these accounts is the editor of “Mtavari Ambebi • მთავარი ამბები”, Natia Beridze.
-----
Photo 1:The evil thing that Eka Kvesitadze is preparing against Marina Ezugbaia
Photo 2: Well done!! Georgian Dream members will transfer 1/3 of their salaries to the coronavirus fund for the next three months
-----
Who is Standing Behind the False Media Pages and Who is Disseminating Their Content?
According to the information posted publicly on her personal Facebook account on March 10, one of the eleven pages created on 27 May 2019 - „Mtavari Ambebi • მთავარი ამბები“, is managed by a former journalist of ES Persona publication, Natia Beridze. Her personal Facebook account indicates that she is the editor-in-chief of the agency. In the post published on March 10, Beridze stated that she personally purchased the page and with it she was going to actively start exposing “the National Movement and its satellites”. Notably, Natia Beridze was a key witness in the case initiated against the UNM leader, Nika Melia in connection with the June 20 night.
It is worth noting that on 30 March 2020, editor of false media Mtavari Ambebi, Natia Beridze created a Facebook page that discredits Mtavari TV Company - it is called Kuritsa TV and it features memes about Mtavari TV director, Nika Gvaramia. The fact that the page has been created by Natia Beridze is confirmed by the fact that on March 30, the day it was created, the page had a single like and it was from Natia Beridze.
-----
 |
I begin at last! Several months ago I announced that I would be launching my own agency. After a long wait, the most important and responsible day has come. There were a number of unforeseen details that interfered with my plans. Because I don’t have a sponsor (I am looking for sponsors), I couldn’t create a new site, so I found a simple solution and bought an already existing site that will soon be transformed to suit my needs. The most important thing is for you to have a sense of impartiality when you read an article, see a video, to feel like I am speaking your words. Because it is an election year, it will probably be a difficult year and a big battle is ahead of me. I rely on you in this battle! As a journalist harassed by the UNM and its satellites, I have decided to expose every one of them! To fight against the disinformation that they spread, to tell you who, why and when committed a wrongful act! To show you their real faces, tell you unknown stories and details about concrete individuals. I am ready to listen. I’ll have an email address and I will expect your letters there, your histories, from those of you who personally dealt with and have difficult stories about the National Movement, if they treated you unfairly, if you’ve been persecuted! You can write to me and I will publish your stories, without any embellishments. My phone is always on, so is my messenger where I’ll read your letters, your stories and I will speak on you behalf! I will fight for justice, for the truth! Please, forgive me if there will be any problems in the beginning. Today at 20:00, we begin with a very important 7-minute film “Stolen protest of the youth” and an article that will unmask the so-called youth movements for the first time. |
-----
 |
 |
-----
In addition to personal accounts, links to false media agencies are mostly shared by 2 false pages - “NEWS.” and “News Post”.
-----
 |
 |
|
Text: How the opposition uses coronavirus to its advantage.
|
|
|
Post 1: What is NDI survey, who prepares them and how? Post 2: Italians. Stay Strong Post 3: Will Gakharia be forced to resign - wait for the final episode! |
Post 1: What is NDI survey, who prepares them and how? Post 2: Opposition demonstration in Kutaisi. Post 3: Know the heroes! - Geronti Gogokhia of the National Movement is refusing to arrive in Tbilisi on December 14. |
-----
An example of false media posts disseminated by a personal account in different groups
 |
 |
 |
|
Text: 72-year old employee of Saakashvili Library tested positive for coronavirus
-----
When studying the tactics of dissemination of false media contents in Facebook groups, ISFED discovered that one of the active personal profiles under the name of „Nika Sidamonidze” was a stolen account.
-----
 |
 |
|
Post 1: Tamara Chergoleishvili’s hysteria and a record set in one hour by badmouthing the church Post 2: Salome Zourabichvili: I declare the state of emergency throughout Georgia |
Post 1: Tamara Chergoleishvili’s hysteria and a record set in one hour by badmouthing the church Post 2: Two children infected with coronavirus have recovered in Georgia #thisisimportant |
-----
It seems that the real owner of the account was from the state of Texas in the United States and the account became inactive after the owner’s death in 2012. The account became active again after it was stolen, beginning from 14 March 2020. Change of the profile parameters and in particular, uploading of a new photo was followed by comments from concerned family members and relatives having realized that hackers had taken over the deceased’s account on Facebook.
-----
|
|
|
-----
Notably, after illegally taking over the account, the thief liked only three Georgian Facebook pages: “Espersona”, “Corridor of Shame” and „Mood of sesilia”, which may be indicative of a connection between these pages.
-----
 |
 |
-----
Pages liked and friends added by the account after it was taken over, possibly indicates that the person behind the stolen account is connected to these pages.
Notably, as of April 27, the profile is unavailable, which probably means that the current owner deactivated the account or Facebook removed it after family members reported it.
Fake News on False Media Pages
False media infrastructure is also used to disseminate disinformation against certain political figures or developments.
A member of the National Movement fired a weapon at a Georgian Dream MP
For instance, on 31 March 2020 false media Mtavari Ambebi released disinformation titled “A member of the National Movement fired a weapon at a Georgian Dream MP”. The article actually concerned a confrontation between the Georgian Dreammajoritarian MP Enzel Mkoyan and a local leader of Alliance of Patriots, Samvel Petrosyan in Akhalkalaki on March 26. However, the page falsely reported that Samvel Petrosyan was a member of the United National Movement, not the Alliance of Patriots (both Samvel Petrosyan and Enzel Mkoyan used to be members of the United National Movement in the past).
Two false media pages “Fakt press • ფაქტ პრესი“ and „7 Days • 7 დღე“ published the following articles against opposition leader Sergi Kapanadze, for discreditation purposes: “I am not going to obey the established medical standards” and “Stop panicking and locking everyone up in quarantine just for being next to an infected person”. The same day, MP Sergi Kapanadze published a post on his personal Facebook account, denying these statements and saying that it was a “black PR” by the government’s media trolls.
-----
|
''I am not going to obey the established medical standards - Sergi Kapanadze'' |
|
-----
Quantitative Characteristics of False Media Pages
14 false media pages studied have a total of 8,084 likes and 8,356 subscribers. From the day they were created up to 27 April 2020, these pages published a total of 18,472 posts. The highest number of posts were published by “Georgia Daily”, while “Tbilisi Today • თბილისი დღეს” published the least number of posts. Average number of posts published on these pages was 1,319. Even though these pages do not have a significant number of likes and they do not engage in mass sponsoring of posts, their posts are selectively disseminated in 35 targeted Facebook groups with a total of nearly 5 million members.
Number of Posts Published as of April 27, 2020
The total number of interactions by Facebook users for these posts was 88,003, 63% of these interactions were for “Mtavari Ambebi • მთავარი ამბები”.
Number of Post Interactions as of April 27, 2020
Notably, majority of post interactions (reactions, comments, shares) on false media pages studied by ISFED is content shares, unlike other false media and discrediting Facebook pages previously reported by ISFED, as majority of interactions for their posts was reactions. Higher number of shares is the result of real and inauthentic accounts associated with these pages. Their goal is to share page contents in groups.
The operation strategy of the listed 14 coordinated false media pages is to misrepresent themselves as real news agencies in order to manipulate users with information. In addition, false media contents are usually disseminated in Facebook groups by accounts with inauthentic behavior, in a coordinated manner.
Taking into account the clear political agenda of the false media pages identified, existence of such network in the pre-election period is damaging for the information environment and creates risks of voter manipulation in social media. Therefore, Facebook should study these pages and apply sanctions if violations of the platform’s community standards are found.
=======
Within its social media monitoring, ISFED observes information campaigns in social media that closely follow ongoing electoral and political processes. These campaigns may be directly or indirectly related to the 2020 parliamentary elections. To identify the suspicious coordinated scheme described in this document, ISFED monitored false media Facebook pages and other accounts associated with them, as well as websites and YouTube channels related to the false media pages. Data was collected from open sources of social media platforms, while CrowdTangle, a social media analytics tool owned by Facebook, was used as a monitoring tool for quantitative analysis of the information provided in this document.
ISFED’s social media monitoring program is carried out with the generous support from the American people through financial assistance from the United States Agency for International Development (USAID), East-West Management Institute’s (EWMI) ACCESS Project, and through funding from Open Society Georgia Foundation (OSGF). Content of this report is the sole responsibility of the International Society for Fair Elections and Democracy and may not necessarily reflect the views of the donor organizations.