Germany-based AlgorithmWatch says Georgia’s Ministry of Internal Affairs has been using a Russian-built facial recognition system called Polyface to identify, fine, and freeze the bank accounts of protesters in Tbilisi, according to an investigation published this month. The Berlin and Zurich non-profit says the system, sourced from a Moscow vendor under Western sanctions, has been in place for thirteen years and was upgraded to its most powerful version in June 2025, weeks after mass identifications of demonstrators had already begun.
The findings, drawn from tender documents, technical manuals, and on-the-ground footage, describe a procurement relationship that began in 2013 and has widened into a tool for breaking the protest movement. Polyface can pick a single face out of a crowd in poor light, read text on a phone screen across a street, and trace the identity through Georgia’s civil registry. The system Georgia’s government uses to police its streets is built, owned, and updated by a company legally bound to share its data with Russian intelligence.
A 2013 Deal That Still Runs the Cameras
Georgia’s Ministry of Internal Affairs has been procuring Polyface from Papillon AO, a Moscow-based company, since 2013, AlgorithmWatch reports. The system has gone through five upgrades in eleven years and was granted a perpetual license in October 2024. Tender documents reviewed by AlgorithmWatch show the ministry’s reliance on the Russian vendor stretches back to the year after the Georgian Dream party came to power, the same party now in office under the behind-the-scenes influence of its billionaire founder Bidzina Ivanishvili.
The 2018 upgrade contract shows ministry operators were trained directly by Russian personnel, the investigation says. A 2024 tender added a new request: the ability to search pre-loaded images from social media and other external sources, a feature that points to cross-platform surveillance as an intended use. Until 2025, the system was capped at 30 simultaneous operators. The new procurement removed that ceiling, with the ministry explicitly requesting licenses for an unlimited number of operators, a change AlgorithmWatch says signals rising demand to monitor larger demonstrations.
Polyface 3.7.0, the latest version, was delivered in early June 2025, by which time mass remote identifications of protesters and the first wave of fines had already begun. The upgrade built on a deep learning recognition algorithm developed by 3DiVi, a Russian AI company based in Novosibirsk and backed by a Russian state venture fund. The system records high-definition images of large crowds in poor lighting and can identify faces under masks or partial coverings.
- 2013 Georgia’s Ministry of Internal Affairs begins procuring Polyface from Papillon AO, a year after Georgian Dream takes power.
- 2018 Upgrade contract requires Russian specialists to train Georgian ministry operators directly.
- October 2024 Perpetual license granted; tender requests social media search capability and unlimited operators.
- Early June 2025 Polyface 3.7.0 delivered; mass identifications and fines already underway.
- October 2025 Parliament replaces administrative fines with imprisonment for several protest-related offences including blocking roads.
- April 2026 A core component of the system remains under the legal jurisdiction of Russian-occupied Georgian territory.
The Three Modes of Identification
By cross-referencing exclusive camera footage with the Georgian government’s tender documentation and Polyface’s public manuals, AlgorithmWatch identified three ways the software may be used. The first is automated identification: Polyface scans a live camera feed, selects each searchable face in the crowd, and keeps it on screen for a few seconds, long enough to capture the image, before moving on without a human in the loop. The second is an operator-directed search, where personnel manually control the cameras, zoom in on specific individuals, and compare the images against government databases in real time. The third is an automated watchlist system, where authorities preload photographs of people of interest, including activists, organizers, previously fined demonstrators, and individuals flagged in earlier intelligence operations.
To match a face to a name, the system uses the Unified Information Bank, which gives it access to civil registry photographs, according to the investigation. The software can also run searches against the pre-loaded social media archive the ministry requested in 2024. Demonstrators interviewed by AlgorithmWatch described being identified at the edge of the frame by a camera that had zoomed in far enough to read a sheet of paper held in their hand and the text of a phone screen as they typed.
| Mode | How it works | What it requires |
|---|---|---|
| Automated identification | Software scans a live feed, locks onto each face in a crowd, and captures a still image automatically. | No operator input once the camera is live. |
| Operator-directed search | An operator steers the camera, zooms in on a person, and runs a real-time database match. | Trained operator, live feed, civil registry access. |
| Automated watchlist | Authorities preload photos of named individuals; the system alerts when one appears on a live or recorded feed. | Pre-loaded target list; available since 2013. |
A 5,000 Lari Fine and a Frozen Bank Account
Nino, a PR lecturer in her 40s, learned she had been identified when a court assistant called her in mid-March 2025 to schedule a hearing. The charge was blocking a road in central Tbilisi two and a half months earlier, part of a wave of protests against the alleged rigging of the October 2024 elections and the government’s decision to suspend EU integration talks. She had covered her face at the protest. The camera identified her anyway. The fine was 5,000 GEL, around 1,620 euros, and the court never sent her the ticket. Five months later her bank accounts were frozen. She set up a crowdfunding campaign to pay the fine, and her accounts were eventually unblocked.
Luka, a protester in his late twenties who has been demonstrating since November 2024, has accumulated three fines for blocking a road. Under Georgia’s enforcement system, fines are not served in real time; the notification arrives weeks or months later, by which point the debt has already triggered an automatic freeze. Luka now routes his money through someone else’s account because his own can be seized at any moment. The Public Defender’s Office recorded 282 cases of physical abuse, and at least 486 people were detained in November and December 2024 alone.
By March 2025, the Georgian Young Lawyers’ Association reported that at least 2 million GEL, around 640,000 euros, in fines had been imposed on protesters. Demonstrators describe the effect AlgorithmWatch’s investigation traces to the cameras themselves: the surveillance did not just identify people, it changed their behavior. Many of those who once walked the daily Rustaveli Avenue protests have stopped going. The investigation quotes a civil servant named Shako on the new mood: “They can’t make the protest disappear from people, so they try to make it disappear from the streets.”
Now, I practically don’t go outside. I only go to the marches.
Why Russian Law Still Owns the Backend
Papillon AO is sanctioned by Switzerland, Ukraine, Japan, and the United States, a fact the procurement trail makes it hard for Tbilisi to claim it did not know. Its products are used primarily by Russian law enforcement and by Russian proxy states including Tajikistan, Turkmenistan, Kazakhstan, and Belarus. The 2018 training arrangement put Russian engineers in front of Georgian operators. A 2024 contract moved the system onto a perpetual license, locking the ministry into a vendor with no easy replacement and no obligation to share its source code.
As of April 2026, a core component of the Georgian state security infrastructure remains under the legal jurisdiction of the occupied Georgian territory, the territory Russia has controlled since recognizing South Ossetia and Abkhazia as independent states after its August 2008 invasion. Papillon AO, like any other Russian company operating in Georgia, is obliged by Russian law to cooperate with Russian security services if compelled, AlgorithmWatch says. The same law binds the company that supplies the cameras, the algorithm, and the training pipeline. The investigation notes this means the personal data of Georgian citizens could, in principle, flow back to the FSB through the vendor’s own legal exposure.
From EU Candidate to Surveillance State in Three Years
In 2023, Georgia was granted the status of EU candidate, a milestone AlgorithmWatch describes as more than a diplomatic formality for many Georgians. A 2023 poll found 86% of Georgians supported EU accession. Then came the parliamentary elections of 26 October 2024, which the European Parliament said should be re-run, and 580 consecutive days of street protests in response. Prime Minister Irakli Kobakhidze announced the suspension of EU accession talks until 2028, a decision AlgorithmWatch and Georgian legal scholars consider unconstitutional, since the Georgian Constitution explicitly requires all public bodies to facilitate accession.
While in 2023 assembly required no permit, by 2024 covering one’s face was an administrative offense and the penalty for blocking a road had risen from 500 to 5,000 GEL. In 2025, both acts became criminal offenses. In 2026, calling the government illegitimate or criticizing it online using terms deemed offensive also became a criminal act. Transparency International concluded that the laws amended under Georgian Dream have effectively abolished the freedom of assembly guaranteed by the Constitution of Georgia.
The progression is what makes Polyface matter, more than the technical capability. The cameras did not create the repression, but they gave the state a way to identify, fine, and freeze demonstrators after the protest had ended, in a volume that earlier police tactics could not match. AlgorithmWatch says the recent surveillance mechanisms, involving face recognition software and an extensive network of AI-enabled cameras, achieved what physical force alone could not: the authorities finally managed to break the protest movement, through fear and pressure.
The investigation was prepared as part of the AlgorithmWatch Algorithmic Accountability Reporting Fellowship program. OC Media, which reported the findings in the Caucasus, said it contacted the Interior Ministry for comment but had not received a response by publication. The Ministry of Internal Affairs has not publicly confirmed or denied the specific uses of the system that AlgorithmWatch describes.
- 2 million GEL in fines imposed on protesters by March 2025, per the Georgian Young Lawyers’ Association.
- 5,000 GEL standard fine for blocking a road, up from 500 GEL before 2024.
- 580 days of continuous protest in Tbilisi after the 26 October 2024 elections.
- 282 cases of physical abuse recorded by the Public Defender’s Office in late 2024.
- 486 people detained in November and December 2024 alone.
The Other Buyers on Papillon’s List
Papillon AO’s customer list outside Russia tracks the same sanctions problem Georgia now faces. AlgorithmWatch’s investigation names Tajikistan, Turkmenistan, Kazakhstan, and Belarus as primary users of the company’s technology, the same cluster of states the West has spent two decades trying to isolate over human rights. Georgia is the only country in that group that is also an EU candidate and that has, until recently, framed itself as part of the Euro-Atlantic project. Buying from Papillon ties the Georgian state to a vendor whose commercial relationships with Russian security services are baked into Russian law.
For now, the system stays. The October 2025 amendment replacing administrative fines with imprisonment for blocking roads has criminalized the same act Polyface is most often used to charge. The combination of a Russian-supplied camera network, a sanctioned vendor, and a legal architecture that turns a single protest appearance into a prison sentence is what AlgorithmWatch’s investigation puts in front of a global audience that has so far associated facial recognition with other countries, and other kinds of states.
Frequently Asked Questions
What is Polyface?
Polyface is a facial recognition system developed by Papillon AO, a Moscow-based company sanctioned by Switzerland, Ukraine, Japan, and the United States. AlgorithmWatch reports that Georgia’s Ministry of Internal Affairs has been procuring it since 2013, with five upgrades over eleven years. The latest version, Polyface 3.7.0, was delivered in early June 2025 and uses an algorithm from the Russian AI company 3DiVi.
How does Georgia use Polyface against protesters?
AlgorithmWatch identified three modes: automated identification, in which the software scans crowds and captures faces without a human in the loop; operator-directed search, in which trained staff zoom in on individuals and run real-time database matches; and an automated watchlist system that flags pre-loaded target lists. Identifications are then turned into administrative fines for blocking roads, with 5,000 GEL the standard penalty.
Why does the vendor’s Russian origin matter?
Papillon AO is sanctioned by four Western jurisdictions and is, by Russian law, obliged to cooperate with Russian security services if compelled. AlgorithmWatch notes that as of April 2026, a core component of Georgia’s surveillance infrastructure remains under the legal jurisdiction of Russian-occupied Georgian territory, raising the possibility that biometric data on Georgian citizens could flow back to the FSB through the vendor’s own legal exposure.
How many protesters have been fined?
By March 2025, the Georgian Young Lawyers’ Association reported that at least 2 million GEL in fines, around 640,000 euros, had been imposed on protesters. In October 2025, parliament replaced several of those administrative fines with imprisonment, including the charge of blocking a road. AlgorithmWatch documented individual cases including a 5,000 GEL fine against a Tbilisi lecturer whose bank accounts were frozen five months after the protest in question.
What is the political backdrop?
Georgia was granted EU candidate status in 2023, when 86% of Georgians polled supported accession. Mass protests began after the 26 October 2024 parliamentary elections, which the European Parliament called to be re-run, and have run for 580 consecutive days. The government has since suspended EU accession talks until 2028 and tightened protest-related offences year by year, with covering one’s face becoming an administrative offense in 2024, a criminal offense in 2025, and online criticism of the government becoming a criminal offense in 2026.
Civil Georgia’s write-up of the report and JAMnews’s coverage of the procurement trail add detail on the system and the regional sanctions picture. Georgia Today’s summary of the investigation traces the same findings. On related reading, the foreign-agent law that took effect in 2024 and the US Caucasus Act targeting Russian intelligence in the country sit in the same drift from EU candidate toward a different kind of state.
