#MacronLeaks: How Phishing and Forgery Created a Globally Trending Hashtag
In the final days of the French presidential election in 2017, an anonymous individual instigated a campaign to discredit President Emmanuel Macron by dropping allegedly leaked emails on 4chan’s “Politically Incorrect” board, claiming they proved Macron was guilty of tax evasion. Campaign participants spread the mix of real and forged documents across the social and open web, along with critical memes. A legal media blackout stopped the French press from reporting on the documents. International press reported on the “leak” and debunked the claims of tax evasion, and partisan, right-wing international press published articles critical of Macron. Macron’s campaign was forced to address the documents, but the media manipulation failed in its goal of costing Macron the election.
STAGE 1: Manipulation Campaign Planning and Origins
During the 2017 French presidential election, which pitted incumbent President Emmanuel Macron against the far-right politician Marine Le Pen, a concerted effort was made to damage Macron using falsified and leaked documents. On May 3, 2017, four days before the final scheduled vote in the election, an anonymous 4chan /pol/ user posted a series of links and instructions titled Documents proving Macron’s secret tax evasion.1 The links were to nine gigabytes of files allegedly obtained via a phishing scam from the digital archives of Macron’s email indicating lax security practices on the campaign’s behalf. This data, containing items such as email archives, spreadsheets, and bank transfer records, was a mix of genuine content (e.g., standard emails) and forged information (e.g., documents purporting to show evidence of offshore bank accounts).2
As comments on these posts grew, so did a call to troll Macron and swarm the documents. One user on 4chan posted, “See what you can do with this, anon. Let's get grinding. If we can get #MacronCacheCash trending in France for the debates tonight, it might discourage French voters from voting Macron.”3 A wider set of users then executed a coordinated campaign to spread the leaked documents far and wide on social media in an attempt to game the trending algorithm. “Send it to non French journalists, spam it on Twitter,” posted another user.4
- 1. Anonymous, “/pol/ - Politically Incorrect » Thread #123933076,” 4chan, May 3, 2017, accessed via 4plebs, https://archive.4plebs.org/pol/thread/123933076/.
- 2. Stefan Soesanto, “The Macron leak that wasn't,” European Council on Foreign Relations, https://www.ecfr.eu/article/commentary_the_macron_leak_that_wasnt_7285.
- 3. Anonymous, "/pol/ - Politically Incorrect » Thread #124372094," 4chan, May 6, 2017, accessed via 4plebs, https://archive.4plebs.org/pol/thread/124372094/#124372094.
- 4. Anonymous, “/pol/ - Politically Incorrect » Thread #123933076,” 4chan, May 3, 2017, accessed via 4plebs, https://archive.4plebs.org/pol/thread/123933076/#123933592.
STAGE 2: Seeding Campaign Across Social Platforms and Web
The campaign quickly spread across multiple threads on 4chan, Reddit, Facebook, and other message boards.1 And since French law dictates a 44-hour press blackout leading up to the election,2 major domestic media outlets were unable to comment on the manipulation campaign as it gained momentum. In the period of press silence for the campaign, the leaks were amplified by social media users and political operatives. In a key tipping point, WikiLeaks tweeted about the documents that had been gathered on Pastebin on May 5, which led to 47,000 tweets referencing the leaks being posted in three hours and got the hashtag #MacronLeaks trending in France.3 Bots were identified as playing some role in spreading #MacronLeaks.4 Within 24 hours, the hashtag was trending worldwide.5
By quickly replicating and disseminating both real and fake content in a single dump, campaign participants took advantage of the limitations of mainstream media to rapidly verify the information and thereby saturated the online conversation with a mix of real leaks, forged content and adversarial political memes. In addition, alternative news reporting from right-wing pundits like Jack Posobiec helped generate media exposure by populating search engines and social media with content critical of Macron,6 which helped obscure the source of the multi-operator campaign.
- 1. Jean-Baptiste Jeangène Vilmer, “The “Macron Leaks” Operation: A Post-Mortem,” The Atlantic Council and the Institute for Strategic Research (IRSEM) of the Ministry of the Armed Forces, https://www.atlanticcouncil.org/wp-content/uploads/2019/06/The_Macron_Leaks_Operation-A_Post-Mortem.pdf.
- 2. Amanda Erickson, “Macron’s emails got hacked. Here’s why French voters won’t hear much about them before Sunday’s election,” The Washington Post, May 6, 2017, https://www.washingtonpost.com/news/worldviews/wp/2017/05/06/macrons-emails-got-hacked-heres-why-french-voters-wont-hear-much-about-them-before-sundays-election/.
- 3. “EMLEAKS - Magnets,” Pastebin, May 5, 2017, https://pastebin.com/LrFAayFz; Megha Mohan, “Macron Leaks: the anatomy of a hack,” BBC, May 9, 2017, https://www.bbc.com/news/blogs-trending-39845105.
- 4. “Hashtag Campaign: #MacronLeaks,” Atlantic Council’s Digital Forensic Research Lab, https://medium.com/dfrlab/hashtag-campaign-macronleaks-4a3fb870c4e8.
- 5. Mohan, “Macron Leaks: the anatomy of a hack.”
- 6. Vilmer, “The “Macron Leaks” Operation: A Post-Mortem.”
STAGE 3: Responses by Industry, Activists, Politicians, and Journalists
On May 5, Macron’s campaign formally recognized the phishing scam that led to the circulation of real and falsified documents online.1 According to the president’s staff, the leak was an attempt at “democratic destabilisation, like that seen during the last presidential campaign in the United States...in order to sow doubt and disinformation.”2 Macron also alleged that some websites disseminating the documents were “linked to Russian interests.”3 Around the same time, Florian Philippot of Le Pen’s National Front capitalized on the controversy, tweeting, “Will #MacronLeaks teach us something that investigative journalism has deliberately killed?"4 The leak also received significant attention from the international mainstream media community.5
- 1. Christopher Dickey, “Did Macron Outsmart Campaign Hackers?” The Daily Beast, May 6, 2017, https://www.thedailybeast.com/did-macron-outsmart-campaign-hackers.
- 2. “Macron says hacked documents have been mixed with false ones to 'sow doubt and disinformation',” The Journal, May 6, 2017, https://www.thejournal.ie/macron-emmanuel-hacking-documents-french-election-3376197-May2017/.
- 3. Max de Haldevang, “Russia is really doing its damnedest to defeat Macron and make Le Pen president of France,” Quartz, May 5, 2017, https://qz.com/977028/russia-is-doing-its-damnedest-to-defeat-emmanuel-macron-and-make-marine-le-pen-president-of-france/.
- 4. Florian Philippot (@f_philippot), “Les #Macronleaks apprendront-ils des choses que le journalisme d'investigation a délibérément tues? Effrayant ce naufrage démocratique,” Twitter, May 5, 2017, https://twitter.com/f_philippot/status/860610166621954048.
- 5. Aurelien Breeden, Sewell Chan, and Nicole Perlroth, “Macron Campaign Says It Was Target of ‘Massive’ Hacking Attack,” The New York Times, May 5, 2017, https://www.nytimes.com/2017/05/05/world/europe/france-macron-hacking.html.
STAGE 4: Mitigation
The forged documents about Macron’s supposed offshore bank accounts were thoroughly debunked in mainstream media. The overall impact of the leak is debatable.1 On the one hand, actors behind the 4chan campaign were able to capture the attention of social media users and the press. However, though the leaks were clearly an attempt to undermine Macron on the eve of the French presidential election, he won the race by a wide margin, gathering 66% of the vote. In their analysis, The Atlantic Council notes that the Macron leak is worthy of study specifically because it had failed.2
It has also been argued that the press blackout prior to the election may have prevented widespread amplification of the leaks and the falsified information contained within. Although the mainstream press did report on the hack and carried Macron’s statement, little else about it was published as the blackout went into effect shortly thereafter.3 Following the election, coverage of the forged documents diminished rapidly until they became essentially absent from public discourse.
STAGE 5: Adjustments by Manipulators to New Environment
There is no evidence to suggest that the same operators deployed another campaign or adapted their tactics.
- 1. “How we debunked rumours that Macron has an offshore account,” The Observers, May 5, 2017, http://observers.france24.com/en/20170505-france-elections-macron-lepen-offshore-bahamas-debunked.
- 2. Vilmer, “The “Macron Leaks” Operation: A Post-Mortem.”
- 3. Dickey, “Did Macron Outsmart Campaign Hackers?”
Cite this case study
Brian Friedberg and Joan Donovan, "#MacronLeaks: How Phishing and Forgery Created a Globally Trending Hashtag," The Media Manipulation Case Book, July 7, 2021, https://mediamanipulation.org/case-studies/muddy-waters-forged-macron-leak.