French ballot box

#MacronLeaks: How Phishing and Forgery Created a Globally Trending Hashtag

By
Brian Friedberg and Joan Donovan
Published on
July 24, 2020
Media Manipulation Tactics Used
Bots
Forgery
Leak
Phishing
Swarming
Trolling
Date Range
May 2017
Region
France
Network Terrain
4chan
Facebook
Reddit
Twitter
Attribution
Partisans
Target
Politician
Strategy
Gaming an algorithm
Vulnerabilities
Election period
Lax security practice
Observable Outcomes
Media exposure
Recognition by target
Mitigation
Debunking
Campaign Adaptation
Unclear or no observable adaptation

Overview

In the final days of the French presidential election in 2017, an anonymous instigated a campaign to discredit President Emmanuel Macron by dropping allegedly leaked emails on 4chan’s “Politically Incorrect” board, claiming they proved Macron was guilty of tax evasion. Campaign participants spread the mix of real and forged documents across the social and , along with critical . A legal stopped the French press from reporting on the documents. International press reported on the “leak” and debunked the claims of tax evasion, and partisan, right-wing international press published articles critical of Macron. Macron’s campaign was forced to address the documents, but the failed in its goal of costing Macron the election.

STAGE 1: Manipulation Campaign Planning and Origins

During the 2017 French presidential election, which pitted incumbent President Emmanuel Macron against the far-right politician Marine Le Pen, a concerted effort was made to damage Macron using falsified and leaked documents. On May 3, 2017, four days before the final scheduled vote in the election, an anonymous /pol/ user posted a series of links and instructions titled Documents proving Macron’s secret tax evasion.1 The links were to nine gigabytes of files allegedly obtained via a phishing scam from the digital archives of Macron’s email indicating lax security practices on the campaign’s behalf. This data, containing items such as email archives, spreadsheets, and bank transfer records, was a mix of genuine content (e.g., standard emails) and forged information (e.g., documents purporting to show evidence of offshore bank accounts).2

As comments on these posts grew, so did a call to troll Macron and swarm the documents. One user on 4chan posted, “See what you can do with this, anon. Let's get grinding. If we can get #MacronCacheCash trending in France for the debates tonight, it might discourage French voters from voting Macron.”3 A wider set of users then executed a coordinated campaign to spread the leaked documents far and wide on social media in an attempt to game the trending algorithm. “Send it to non French journalists, spam it on Twitter,” posted another user.4

Screenshot of the 4chan post with links to leaks containing both authentic and forged information.

This is a /pol/ post with links to the doctored Macron leaks. Credit: Screenshot by TaSC.

STAGE 2: Seeding Campaign Across Social Platforms and Web

The campaign quickly spread across multiple threads on 4chan, Reddit, Facebook, and other message boards.1 And since French law dictates a 44-hour press blackout leading up to the election,2 major domestic were unable to comment on the manipulation campaign as it gained momentum. In the period of press silence for the campaign, the leaks were amplified by social media users and political operatives. In a key tipping point, WikiLeaks tweeted about the documents that had been gathered on Pastebin on May 5, which led to 47,000 tweets referencing the leaks being posted in three hours and got the hashtag #MacronLeaks trending in France.3 Bots were identified as playing some role in spreading #MacronLeaks.4 Within 24 hours, the hashtag was trending worldwide.5

By quickly replicating and disseminating both real and fake content in a single dump, campaign participants took advantage of the limitations of mainstream media to rapidly verify the information and thereby saturated the online conversation with a mix of real leaks, forged content and adversarial political memes. In addition, alternative news reporting from right-wing pundits like Jack Posobiec helped generate media exposure by populating search engines and social media with content critical of Macron,6 which helped obscure the source of the multi-operator campaign.

Macron chasing tearfully after pepes holding the French flag.

This is a variation of the “He Will Not Divide Us” meme featuring Macron. Source: 4chan.

STAGE 3: Responses by Industry, Activists, Politicians, and Journalists

On May 5, Macron’s campaign formally recognized the scam that led to the circulation of real and falsified documents online.1 According to the president’s staff, the leak was an attempt at “democratic destabilisation, like that seen during the last presidential campaign in the United States...in order to sow doubt and .”2 Macron also alleged that some disseminating the documents were “linked to Russian interests.”3 Around the same time, Florian Philippot of Le Pen’s National Front capitalized on the controversy, tweeting, “Will #MacronLeaks teach us something that investigative journalism has deliberately killed?"4 The leak also received significant attention from the international mainstream media community.5

Screenshot of Florian Phillippot's tweet inquiring whether the Macron leaks would reveal something the press has been trying to hide.

This is Florian Phillippot’s tweet inquiring about the Macron leaks. Source: TaSC screenshot.
.

STAGE 4:

The forged documents about Macron’s supposed offshore bank accounts were thoroughly debunked in mainstream media. The overall impact of the leak is debatable.1 On the one hand, actors behind the 4chan campaign were able to capture the attention of social media users and the press. However, though the leaks were clearly an attempt to undermine Macron on the eve of the French presidential election, he won the race by a wide margin, gathering 66% of the vote. In their analysis, The Atlantic Council notes that the Macron leak is worthy of study specifically because it had failed.2

It has also been argued that the press blackout prior to the election may have prevented widespread amplification of the leaks and the falsified information contained within. Although the mainstream press did report on the hack and carried Macron’s statement, little else about it was published as the blackout went into effect shortly thereafter.3 Following the election, coverage of the forged documents diminished rapidly until they became essentially absent from public discourse.

STAGE 5: Adjustments by Manipulators to New Environment

There is no evidence to suggest that the same operators deployed another campaign or adapted their tactics.

Cite this case study

Brian Friedberg and Joan Donovan, "#MacronLeaks: How Phishing and Forgery Created a Globally Trending Hashtag," The Media Manipulation Case Book, July 7, 2021, https://mediamanipulation.org/case-studies/muddy-waters-forged-macron-leak.

Related case studies

  1. Forgery: The Maxine Waters Letter