After months of trying to move the political needle in favor of Marine Le Pen in the French presidential election, American far-right activists on Saturday threw their weight behind a hacking attack against her rival, Emmanuel Macron, hoping to cast doubt on an election that is pivotal to France and the wider world.
The efforts were the culmination of an extended campaign against Macron after his candidacy began to gain steam this year, with digital activists in the United States and elsewhere sharing tactics, tips and tricks across the English- and French-speaking parts of the internet.
It is unclear whether the leaked documents, which some experts say may be connected to hackers linked to Russia, will affect the outcome of the election Sunday between Le Pen, the far-right candidate from the National Front, and Macron, an independent centrist. But the role of American far-right groups in promoting the breach online highlights their growing resolve to spread extremist messages beyond the United States.
“It’s the anti-globalists trying to go global,” said Ben Nimmo, a senior fellow of the digital forensics research lab at the Atlantic Council, a think tank, who has studied the far right’s recent efforts against Macron and others in France. “There’s a feeling of trying to export the revolution.”
The leak, which involved posting campaign documents like emails and accounting records to message boards, occurred late Friday, hours before a legal prohibition on campaign communications went into effect across France. In response, Macron’s team said the hackers had included fake information alongside authentic material “to sow doubt.”
“Intervening in the final hour of the official campaign, this operation is clearly a matter of democratic destabilization, as was seen in the United States during the last presidential campaign,” Macron’s campaign said in a statement late Friday, minutes before the communications prohibition went into effect.
By Saturday, a trail of digital crumbs appeared to tie the attack on Macron’s campaign to Russian hackers. Forensics specialists found that one of the leaked Excel documents from Macron’s campaign had been modified on a Russian version of Excel, and edited on Russian-language computers.
One document had last been modified by a Russian user named Roshka Georgiy Petrovich. Petrovich, 32, an employee of the Moscow-based Eureka CJSC, a Russian technology company, did not immediately return emails requesting comment. Eureka CJSC’s clients include several Russian government agencies.
U.S. intelligence officials say that Russian government agencies regularly outsource political cyberattacks to Russian cybercriminals and top computer engineers. Security experts note that the digital crumbs could be the sloppy work of a Russian engineer, or studiously left as a false flag used by hackers looking to mask their true identities and whereabouts.
Within hours after the hacked documents were made public, the hashtag #MacronLeaks began trending worldwide, aided by far-right activists in the United States who have been trying to sway the vote in favor of Le Pen.
Jack Posobiec, a journalist with the far-right news outlet The Rebel, was the first to use the hashtag with a link to the hacked documents online, which was then shared more widely by WikiLeaks. Posobiec remains the second-most mentioned individual on Twitter in connection with the hashtag behind WikiLeaks, according to a review of the past 100,000 Twitter posts published since late Friday.
While there is no evidence that the breach against Macron’s campaign was organized by this loosely connected group of far-right campaigners, the U.S. activists have been gathering on sites like 4chan and Discord, which were previously used to coordinate support for Donald Trump’s presidential campaign.
One popular tactic, experts say, has been “Twitter raids,” or efforts to hijack trending hashtags and topics on the social media site and inject far-right and anti-Macron propaganda.
A week before the second round of the French election, for instance, online activists, many from the United States and other English-speaking countries, flooded Twitter with coordinated anti-Macron memes — online satirical photos with often biting captions — carrying hashtags like #elysee2017 that were linked to the campaign. That included portraying him as a 21st-century equivalent of Marie Antoinette, the out-of-touch last queen of France, and other memes made allegations of an extramarital affair.
“They tried to bombard French Twitter with memes favorable to Le Pen,” said Padraic Ryan, a project coordinator at Storyful, an online marketing company that tracks social media activity around news events. “The campaigns are showing an increasing level of sophistication and coordination.”
Just days before the last French presidential debate, an anonymous user on 4chan, whose message boards include anti-Semitic, white supremacist and other far-right discussions, posted what were said to be copies of documents showing that Macron had supposedly set up a bank account in the Bahamas to avoid paying taxes. He denied the allegations.
Le Pen referred to such an overseas bank account during the vicious debate, leading to a bitter rebuttal by Macron’s team and an official investigation into the spread of the rumors.
The reports were followed with another accusation, also posted on 4chan, hours before Macron’s campaign was subjected to the online leak, that he had bank accounts in the Cayman Islands. There is no evidence that he has such accounts.
Despite these increasingly coordinated digital efforts by far-right activists, analysts say, their efforts had not reached the vast majority of the French electorate — until the Friday release of the hacked documents.
It will most likely take until after the election to review all the leaked documents. Under France’s strict electoral rules, any publication of the material before polling day could lead to charges.
On Saturday, Le Monde, a French newspaper that has been fact-checking online information during the campaign, posted a message below all of its articles about the election, saying that it would not disclose the contents of the breach until after the voting Sunday. Le Monde said it did not want the leak to be used to disrupt the electoral process.
Yet as the French readied themselves for the election Sunday, discussion on social media — both in favor and in opposition of leaking the documents — began to swirl, according to a review of Twitter data.
Since late Friday, Twitter hashtags related to the leak have topped the trending charts for France, a sign that people are talking about the leak, although most of the discussion has been limited to members of the far-right community who already support Le Pen.
Yet in a sign of how the far right outside the country is trying to foment the discussion, many of the Twitter posts about the hacking have originated in the United States, according to Trendsmap, a data analytics tool. About half the social media messages around political hashtags linked to the breach have been written in English, based on a review of Trendsmap data, as activists outside France have helped to spread news of the leak.
The French media has been ordered by the electoral commission not to publish contents of the leaks. But the growth of digital misinformation and other falsities is likely to only grow in a season of elections in Europe in which British and German voters will soon head to the polls, said Janis Sarts, director of the NATO Strategic Communications Center of Excellence, a think tank in Riga, Latvia.
“Misinformation is increasingly used to achieve political ends,” Sarts said. “Technology helps to amplify that message through fake news sites and social media.”