PARIS â One day before France’s most momentous presidential election in decades, authorities Saturday began investigating the âmassive and coordinated piracy actionâ that the independent candidate Emmanuel Macron reported minutes before the official end of campaigning.
Late on Friday — just before the campaign’s midnight deadline — the Macron team announced in a statement that it had been the victim of a major hacking operation that saw thousands of emails and other internal communications dumped into the public domain.
Although the impact of the data dump on France’s high-stakes race was not apparent, the news quickly stoked fears of a targeted operation meant to destabilize the electoral process, especially after U.S. intelligence agencies concluded that Russian President Vladimir Putin commissioned an “influence campaign” to spin the U.S. presidential election in Donald Trump’s favor.
Macron, an independent centrist, is facing off against the far-right populist and National Front leader Marine Le Pen, who for years has benefitted from considerable Russian financial support and from favorable coverage in state-run Russian media. Voters are set to decide Sunday which candidate becomes Franceâs next president.
âIntervening in the last hour of the official campaign, this operation is obviously a democratic destabilization, as has already been seen in the United States during the last presidential campaign,â the Macron campaign said.
It was not immediately clear who was being blamed for the hacking, which the campaign said had led to the leaking of documents via social media networks.
It remains to be seen, she said, who organized the attack, though “the operating mode is very similar to what happened with the DNC.”
But analysts were quickly able to determine that the social media campaign following the data dump originated in the United States, in a well-known network of alt-right Twitter accounts.
Ben Nimmo, a research fellow with the Atlantic Council’s Digital Forensic Research Lab, said in an interview that the subsequent “#MacronLeaks” Twitter storm — notably in English, not French — largely began with the account of Jack Posobiec, a Washington-based correspondent for the alt-right website theRebelMedia and who has written that he served, in 2016, as “Special Projects Director of Citizens for Trump, the largest Trump grassroots organization in the US.”
From there, Nimmo said, news of the Macron leaks — allegedly containing details of offshore accounts and tax evasion — was retweeted by William Craddick, another alt-right activist known to have spread in December a fake news story about German Chancellor Angela Merkel tolerating Islamic State terrorists in order to deploy an “EU army” to subdue her country’s neighbors. Eventually, Nimmo added, the “#MacronLeaks” began to be retweeted by well-known National Front accounts — reaching 47,000 tweets in just three hours.
Despite France’s strict prohibition on campaigning after the deadline, Florian Philippot, the National Front’s deputy leader, tweeted early Saturday morning: âWill #Macronleaks teach us something that investigative journalism has deliberately killed?â
The Macron campaign immediately went on the defensive, filing a formal complaint with Franceâs National Commission for Campaign Accounts and Political Financing.
âThe ambition of the authors of this leak is obviously to harm the movement En Marche! in the final hours before the second round of the French presidential election,â the Macron statement read. En Marche (Onward) is the centrist political movement that Macron founded a year ago with a platform that blends certain aspects of fiscal conservatism with social liberalism.
But regardless of the traction the leaks received on social media, Nimmo said, it was unclear whether the Macron hack would impact the French election in the same way that, for instance, Russian interference with the Democratic National Committee’s email accounts impacted the American election last year.
The Macron campaign said the documents in question — personal and professional emails, contracts, accounting forms — were typical of a presidential campaign. Despite a tidal wave of media attention, any potentially incriminating information the leaks contained did not immediately surface.
“It doesn’t seem at this stage that there are lots of high-profile, non-Le Pen accounts jumping in and spreading the message around,” Nimmo said of social media patterns surrounding the leaks. “They have kept their constituency — and they have galvanized their constituency — but they haven’t necessarily stepped outside of that constituency.”
“The operating mode is very similar to what happened with the DNC,” said Frederick Douzet, a professor of cybersecurity and geopolitics at University Paris VIII. But she said she expected the release — coinciding with a day when both candidates and mainstream French media cannot circulate campaign materials — to have only a modest impact on how undecided voters will make up their minds.
Unlike in the United States, campaigning in France comes to a hard stop a day before voters go to the polls. The official end of campaigning was midnight on Friday, and candidates may not actively campaign in any way after the close of the campaign.
The disclosure of the leaked documents just before the end of Friday means the Macron campaign will not be able to address the matter substantially on Saturday. Candidates and their aides are strictly prohibited from giving interviews to the press on the Saturday before and the Sunday of the vote.
On Saturday, Franceâs Electoral Commission urged journalists and media organizations not to report on the contents of the leaks. The Commission called on news outlets to heed âthe sense of responsibility they must demonstrate, as at stake are the free expression of voters and the sincerity of the electionâ itself.
Throughout the campaign, Le Pen has been an outspoken advocate of pivoting Franceâs foreign policy toward an improved alliance with Vladimir Putinâs Russia. During a March visit to Moscow, she met with the Russian president.
For years, a complex web of financial ties has also linked Le Pen to Russian lending sources. When French banks refused on principle to lend to the National Front in 2014, Le Pen sought and received the backing of a Russian lender. The bankâs lending license was ultimately revoked late last year, forcing her to seek alternate funding sources.
For months, Le Pen has also received exceedingly positive coverage in Russian state media. Meanwhile, those news outlets have pilloried Macron, accusing him of being secretly gay and of embezzling public funds. To date, most of those rumors seem to have had little effect on French voters.
Throughout the election, Macron has frequently said that his campaign has been the target of Russian meddling, though the Kremlin has repeatedly denied those accusations.
In a report issued last month, researchers at the cybersecurity firm Trend Micro linked intrusions into the Macron campaignâs online network to Russian hackers operating as an arm of Kremlin intelligence. The Tokyo-based firm said it was the same group â known variously as Pawn Storm, APT28 and Fancy Bear â that hacked the Democratic National Committee and officials tied to Hillary Clintonâs unsuccessful campaign for president.
In the specific case of the leaked documents, an explicit Russian connection could not immediately be identified.
But Nicolas Vanderbeist, an expert on social media networking and the author of the well-known blog “Reputatio Lab,” said in an interview that there were significant connections in the Twitter storm following the leaks to accounts linked to Sputnik and Russia Today. In a paper published several weeks ago, he studied many of these accounts — some 40 percent of which were involved with spreading the news about the Macron scandal, he said.
The French government, analysts say, has taken the threat of cybersecurity very seriously. In March, for instance, Franceâs National Cybersecurity Agency said that there was âan extremely high riskâ of cyberattacks and hacking of the countryâs electoral process, which prompted the government to suspend electronic voting this year for French citizens overseas.
Alexander Klimburg, an expert on cyber warfare at the Hague Centre for Security Studies who has been in regular contact with French civil service officers, said he believes the French government is sufficiently prepared for Russian cyber attacks, especially after Russian hackers nearly destroyed a French television network, TV5Monde, almost exactly two years ago.
âThe sense was, âIf this happens again, weâre going to be ready,ââ Klimburg said. âI expect there to be a massive escalation in the covert information environment.”
Lately, however, fake news stories in France have begun spreading beyond the realm of fringe social media accounts.
On Wednesday, hours before the beginning of the last televised debate between Macron and Le Pen, various Twitter accounts began spreading rumors that Macron maintained offshore bank accounts. Le Pen then repeated that allegation in the debate, causing Macron to say that she was âsubject to the diktatsâ of the Kremlin.
Polls show Macron, a former investment banker and Socialist finance minister, with a considerable lead over Le Pen, at 63 percent to 37 percent of the vote, according to the latest analyses released late Friday.
For some, the non-incriminating leaks and subsequent social media campaign — largely in English — represented a last-dash attempt to undermine Macron’s significant lead in an electorate where those who might still be swayed are unlikely to check far-right Twitter handles.
“It’s so obvious, and you make all the connections so easily,” said Vanderbeist. “It’s very amateur.”
Most French voters interviewed on the streets of the capital the day before the country goes to the polls shrugged off the hack. The stakes are much too large to be bothered with compromising internal campaign documents, they said. Paul Lotere, a 29-year-old civil servant, said he was angry — but because Macronâs campaign had no chance to respond, with the official close of the campaign falling right as the documents surfaced. He plans to vote for the former finance and economy minister — and said he had no interest in the documents until their veracity was confirmed.
âAh, yes, âhashtag Macron leaks,ââ sneered Alain Chappotteau, a 51-year-old psychologist, repeating the Twitter tag line popularizing the news. âWith all the fuss, all the tricks, in this campaign, whatâs one more? Iâm voting for my childâs future. This doesnât matter.â