2017 Macron e-mail leaks

Two days before the final vote in the 2017 French presidential elections, more than 20,000 e-mails related to the campaign of Emmanuel Macron were published on the internet. The leaks, dubbed MacronLeaks, garnered an abundance of media attention due to how quickly news of the leak spread throughout the Internet, aided in large part by bots and spammers and drew accusations that the government of Russia under Vladimir Putin was responsible. The e-mails were shared by WikiLeaks and several American alt-right activists through social media sites like Twitter, Facebook, and 4chan.

French campaign posters before the May 2017 election

Originally posted on a filesharing site called PasteBin, the e-mails had little to no effect on the final vote as they were dumped just hours before a 44-hour media blackout that is legally required by French electoral law.

The campaign said the e-mails had been "fraudulently obtained" and that false documents were mingled with genuine ones in order "to create confusion and misinformation." Numerama, an online publication focusing on digital life, described the leaked material as "utterly mundane", consisting of "the contents of a hard drive and several emails of co-workers and En Marche political officials." United States Senator from Virginia, Mark Warner cited the e-mail leak as a reinforcement of the cause behind the U.S. Senate Intelligence Committee's investigation into Russian interference in the 2016 United States elections. Nonetheless, the Russian government denied all allegations of foreign electoral intervention.

Background

Marine Le Pen with Vladimir Putin in 2017

After the first round of the 2017 French presidential election produced no majority winner, the top two candidates proceeded to a runoff election to be held on 7 May of that year. Emmanuel Macron of the En Marche! party and Marine Le Pen of the National Front both began campaigning across France on their competing points of view. The election was characterized by widespread dissatisfaction with the administration of President François Hollande and the French governmental establishment as a whole.

The election was widely regarded as a referendum between the internationalist centrism of Macron and the populist far-right ideology of Le Pen. After a slew of events considered to be detrimental to globalization and a triumph of nationalism and isolationism, such as the Brexit referendum, and the election of Donald Trump, many international observers viewed the French election as another possible trendsetting event for Western politics. Le Pen's anti-immigration, anti-NATO, and anti-European Union stances attracted her the widespread support of far-right politicians and activists as far as the United States, like Donald Trump, and raised questions about possible appeasement of Russia. Russia-funded media outlets such as Russia Today and Sputnik News consistently portrayed Le Pen in a positive light, and her campaign had even secured millions of Euros from a Russian lender in 2014.

In the United States, Le Pen was praised by President Donald Trump on several occasions, and she saw widespread support and praise by large numbers of online conservative trolls and Internet alt-right activists on social media platforms like Twitter, Facebook, Reddit, and 4chan, who simultaneously attacked Macron. These trolls used spamming of Internet memes and misinformation as tactics to assail Macron; accusing him of being a "globalist puppet" and a supporter of Islamic immigration. This was not a new strategy, it had been executed to much success during the 2016 United States presidential election. Legions of pro-Trump Internet users and bots had spammed social media and rapidly spread anti-Clinton news releases and leaks across the web as was the case with the Democratic National Committee leaks and the John Podesta e-mail leaks, allegedly with aid from the Kremlin. Prior to the election, American national security officials warned the French government of the high probability of Russian digital meddling in the election, according to the Director of the National Security Agency, Mike Rogers.

E-mail leaks

On Friday 5 May 2017, two days before the scheduled vote in the presidential election, the campaign of Emmanuel Macron claimed that it had been the target of a "massive hack". At the same time at least 9 gigabytes of data were dumped on an anonymous file sharing site called Pastebin using a profile called 'EMLEAKS'. The drop was made just hours before an election media blackout was due to take place in advance of Sunday's elections, as legally mandated under French electoral law which prevented Macron from issuing an effective response but also limited media coverage of the hack and subsequent leak. The e-mails, totaling 21,075, along with other data was quickly posted to the anonymous message board, 4chan, where it was shared by alt-right activists, notably Jack Posobiec, on Twitter who had them translated by the Québécois wing of right-wing outlet The Rebel Media. It has been remarked that at that time, Rebel Media's Québécois wing consisted solely of radio personality Éric Duhaime.

The e-mail leak spread swiftly under the hashtag #MacronLeaks on Twitter and Facebook. Within three and a half hours of first being used, #MacronLeaks had reached 47,000 tweets. On Jack Posobiec's Twitter, the hashtag was retweeted 87 times within five minutes, likely pointing to the use of bots. WikiLeaks mentioned the leaks in subsequent tweets 15 times, contributing the most to the news' spread. Within a short period of time, #MacronLeaks was trending in France and was on a banner on the Drudge Report homepage. In another sign of bot use the ten most active accounts using the #MacronLeaks hashtag posted over 1,300 tweets in just over three hours. One particular account, posted 294 tweets in a span of two hours. Analysis shows that the hashtag was mentioned more times by American accounts than French ones, but posts concerning them were, by a slim margin, written more often in French than English.

The leaked e-mails were claimed to show evidence of criminal wrongdoing by Macron and his campaign including the committing of tax evasion and election fraud. A less suggestive examination of the e-mails by Numerama, a French online publication focusing on technological news, described the leaked emails as "utterly mundane", consisting of "the contents of a hard drive and several emails of co-workers and En Marche political officials." Leaked documents included "memos, bills, loans for amounts that are hardly over-the-top, recommendations and other reservations, amidst, of course, exchanges that are strictly personal and private — personal notes on the rain and sunshine, a confirmation email for the publishing of a book, reservation of a table for friends, etc."

Reaction

In response to the attack, Emmanuel Macron said it was "democratic destabilisation, like that seen during the last presidential campaign in the United States" and said the hackers had mixed falsified documents with genuine ones, "in order to sow doubt and disinformation." Vice President of the National Front Florian Philippot and Le Pen adviser said in a tweet, "Will #MacronLeaks teach us something that investigative journalism has deliberately killed?" The French election commission warned media in the country that publishing the e-mails or discussing them so close to the election would be a violation of the law and issued a statement that in part read, "On the eve of the most important election for our institutions, the commission calls on everyone present on internet sites and social networks, primarily the media, but also all citizens, to show responsibility and not to pass on this content, so as not to distort the sincerity of the ballot." The leak did not appear to have any impact on the French presidential election which continued as scheduled and ended with a Macron victory by a margin of 32%. Despite this, French security officials commenced an investigation into the hacking shortly after the election.

Shortly after the alt-right media boosted the leak, chief of Macron's campaign Mounir Mahjoubi stated that they have been watching GRU hacking attempts since February, and let them steal a carefully prepared cache of trivial and forged documents. After this was confirmed against the leaks contents, its credibility was seriously undermined.

In the United States, U.S. Senator from Virginia and ranking member of the Senate Intelligence Committee, Mark Warner said the hacking and subsequent leak only emboldened his committee's investigation, and former Secretary of State and Democratic presidential candidate Hillary Clinton said in a tweet, "Victory for Macron, for France, the EU, & the world. Defeat to those interfering w/democracy. (But the media says I can't talk about that)."

Perpetrators

Diagram illustrating how Fancy Bear illicitly obtains access to private servers.

An assessment by Flashpoint, an American cybersecurity firm, stated that they determined with "moderate confidence" that the group behind the hacking and leak was APT28, better known as 'Fancy Bear', a hacking group with ties to Russian military intelligence. Metadata pulled from the dump revealed the name 'Georgy Petrovich Roshka', likely an alias, which has ties to a Moscow-based intelligence contractor. Many similarities, including the use of social media bots in an attempt to scrub metadata, also pointed to Fancy Bear. However, on 1 June 2017, Guillaume Poupard, the head of France's premier cybersecurity agency said in an interview with the Associated Press the hack, "was so generic and simple that it could have been practically anyone". On 9 May, two days after the election, Mike Rogers, head of the NSA, said in sworn testimony with the United States Senate he had been made aware of Russian attempts to hack French election infrastructure, though he did not mention anything related to the identities of those behind the Macron email hacking. This followed a French announcement that electronic voting for France's overseas citizens would be discontinued in light of cybersecurity threats.

According to the Le Monde newspaper and with the work based on non-public rapport of Google and FireEye, the GRU is responsible.

Vladimir Putin has denied claims of election interference, claiming Russia has also been targeted.