Macron campaign says its emails have been subjected to ‘massive, coordinated’ hacking
PARIS — One day before France’s most momentous presidential election in decades, authorities Saturday began investigating the “massive and coordinated piracy action” that the independent candidate Emmanuel Macron reported minutes before the official end of campaigning.
Late on Friday — just before the campaign’s midnight deadline — the Macron team announced in a statement that it had been the victim of a major hacking operation that saw thousands of emails and other internal communications dumped into the public domain.
Although the impact of the data dump on France’s high-stakes race was not apparent, the news quickly stoked fears of a targeted operation meant to destabilize the electoral process, especially after U.S. intelligence agencies concluded that Russian President Vladimir Putin commissioned an “influence campaign” to spin the U.S. presidential election in Donald Trump’s favor.
Macron, an independent centrist, is facing off against the far-right populist and National Front leader Marine Le Pen, who for years has benefited from considerable Russian financial support and from favorable coverage in state-run Russian media. Voters are set to decide Sunday which candidate becomes France’s next president.
“Intervening in the last hour of the official campaign, this operation is obviously a democratic destabilization, as has already been seen in the United States during the last presidential campaign,” the Macron campaign said, stopping short of assigning blame.
It remains to be seen, the campaign said, who organized the attack, said said Frederick Douzet, a professor of cybersecurity and geopolitics at University Paris VIII, though “the operating mode is very similar to what happened with the DNC.”
Analysts were quickly able to determine that the social-media campaign following the data dump originated in the United States, in a well-known network of alt-right Twitter accounts.
Ben Nimmo, a research fellow with the Atlantic Council’s Digital Forensic Research Lab, said in an interview that the subsequent #MacronLeaks Twitter storm — notably in English, not French — largely began with the account of Jack Posobiec, a Washington-based correspondent for the alt-right website TheRebel.media and who has written that he served, in 2016, as “Special Projects Director of Citizens for Trump, the largest Trump grassroots organization in the US.”
From there, Nimmo said, news of the Macron leaks — allegedly containing details of offshore accounts and tax evasion — was retweeted by William Craddick, another alt-right activist known to have spread in December a fake news story about German Chancellor Angela Merkel tolerating Islamic State terrorists to deploy an “E.U. army” to subdue her country’s neighbors. Eventually, Nimmo added, the “#MacronLeaks” began to be retweeted by well-known National Front accounts — reaching 47,000 tweets in just three hours.
Despite France’s strict prohibition on campaigning after the deadline, Florian Philippot, the National Front’s deputy leader, tweeted early Saturday morning: “Will #Macronleaks teach us something that investigative journalism has deliberately killed?”
The Macron campaign immediately went on the offensive, filing a formal complaint with France’s National Commission for Campaign Accounts and Political Financing.
“The ambition of the authors of this leak is obviously to harm the movement En Marche! in the final hours before the second round of the French presidential election,” the Macron statement read. En Marche!, or Onward!, is the centrist political movement that Macron founded a year ago with a platform that blends certain aspects of fiscal conservatism with social liberalism.
But regardless of the traction the leaks received on social media, Nimmo said, it was unclear whether the Macron hack would impact the French election in the same way that, for instance, Russian interference with the Democratic National Committee’s email accounts impacted the U.S. election last year.
The Macron campaign said the documents in question — personal and professional emails, contracts, accounting forms — were typical of a presidential campaign. Despite a tidal wave of media attention, any potentially incriminating information the leaks contained did not immediately surface.
“It doesn’t seem at this stage that there are lots of high-profile non-Le Pen accounts jumping in and spreading the message around,” Nimmo said of social-media patterns surrounding the leaks. “They have kept their constituency — and they have galvanized their constituency — but they haven’t necessarily stepped outside of that constituency.”
On Saturday, France’s electoral commission urged journalists and media organizations not to report on the contents of the leaks. The commission called on news outlets to heed “the sense of responsibility they must demonstrate, as at stake are the free expression of voters and the sincerity of the election” itself.
Throughout the campaign, Le Pen has been an outspoken advocate of pivoting France’s foreign policy toward an improved alliance with Putin’s Russia. During a March visit to Moscow, she met with the Russian president.
For years, a complex web of financial ties has also linked Le Pen to Russian lending sources. When French banks refused on principle to lend to the National Front in 2014, Le Pen sought and received the backing of a Russian lender. The bank’s lending license was ultimately revoked late last year, forcing her to seek alternate funding sources.
For months, Le Pen has also received exceedingly positive coverage in Russian state media. Meanwhile, those news outlets have pilloried Macron, accusing him of being secretly gay and of embezzling public funds. To date, most of those rumors seem to have had little effect on French voters.
Throughout the election, Macron has frequently said that his campaign has been the target of Russian meddling, though the Kremlin has repeatedly denied those accusations.
In a report issued last month, researchers at the cybersecurity firm Trend Micro linked intrusions into the Macron campaign’s online network to Russian hackers operating as an arm of Kremlin intelligence. The Tokyo-based firm said it was the same group — known variously as Pawn Storm, APT28 and Fancy Bear — that hacked the Democratic National Committee and officials tied to Hillary Clinton’s unsuccessful campaign for president.
In the specific case of the leaked documents, an explicit Russian connection could not immediately be identified.
But Nicolas Vanderbiest, an expert on social-media networking and the author of the well-known blog “Reputatio Lab,” said in an interview that there were significant connections in the Twitter storm following the leaks to accounts linked to Sputnik and Russia Today. In a paper published several weeks ago, he studied many of these accountsm, some 40 percent of which were involved with spreading the news about the Macron scandal, he said.
The French government, analysts say, has taken the threat of cybersecurity very seriously. In March, for instance, France’s National Cybersecurity Agency said that there was “an extremely high risk” of cyberattacks and hacking of the country’s electoral process, which prompted the government to suspend electronic voting this year for French citizens overseas.
Alexander Klimburg, an expert on cyberwarfare at The Hague Centre for Security Studies who has been in regular contact with French civil service officers, said he believes the French government is sufficiently prepared for Russian cyberattacks, especially after Russian hackers nearly destroyed a French television network, TV5Monde, almost exactly two years ago.
“The sense was, ‘If this happens again, we’re going to be ready,’ ” Klimburg said. “I expect there to be a massive escalation in the covert information environment.”
Lately, however, fake news stories in France have begun spreading beyond the realm of fringe social-media accounts.
On Wednesday, hours before the beginning of the last televised debate between Macron and Le Pen, various Twitter accounts began spreading rumors that Macron maintained offshore bank accounts. Le Pen then repeated that allegation in the debate, causing Macron to say that she was “subject to the diktats” of the Kremlin.
Polls show Macron, a former investment banker and Socialist finance minister, with a considerable lead over Le Pen, at 63 percent to 37 percent of the vote, according to the latest analyses released late Friday.
For some, the nonincriminating leaks and subsequent social-media campaign — largely in English — represented a last-dash attempt to undermine Macron’s significant lead in an electorate in which those who might still be swayed are unlikely to check far-right Twitter handles.
“It’s so obvious, and you make all the connections so easily,” said Vanderbiest. “It’s very amateur.”
Most French voters interviewed on the streets of the capital the day before the country goes to the polls shrugged off the hack. The stakes are much too large to be bothered with compromising internal campaign documents, they said. Paul Lotere, a 29-year-old civil servant, said he was most upset that Macron had no chance to respond given the strict campaign curfew. He plans to vote for the former finance and economy minister and said he had no interest in the documents until their veracity was confirmed.
“Ah, yes, ‘hashtag Macron leaks,’ ” sneered Alain Chappotteau, a 51-year-old psychologist, repeating the Twitter tagline popularizing the news. “With all the fuss, all the tricks, in this campaign, what’s one more? I’m voting for my child’s future. This doesn’t matter.”
