Originally posted on a filesharing site called PasteBin, the e-mails had little to no effect on the final vote as they were dumped just hours before a 44-hour media blackout that is legally required by French electoral law.[4]
On Friday 5 May 2017, two days before the scheduled vote in the presidential election, the campaign of Emmanuel Macron claimed that it had been the target of a "massive hack". At the same time at least 9 gigabytes of data were dumped on an anonymous file sharing site called Pastebin using a profile called 'EMLEAKS'.[23] The drop was made just hours before an election media blackout was due to take place in advance of Sunday's elections, as legally mandated under French electoral law which prevented Macron from issuing an effective response but also limited media coverage of the hack and subsequent leak.[23][24] The e-mails, totaling 21,075, along with other data was quickly posted to the anonymous message board, 4chan, where it was shared by alt-right activists, notably Jack Posobiec, on Twitter [25] who had them translated by the Québécois wing of right-wing outlet The Rebel Media. It has been remarked that at that time, Rebel Media's Québécois wing consisted solely of radio personality Éric Duhaime.[26]
The e-mail leak spread swiftly under the hashtag #MacronLeaks on Twitter and Facebook. Within three and a half hours of first being used, #MacronLeaks had reached 47,000 tweets. On Jack Posobiec's Twitter, the hashtag was retweeted 87 times within five minutes, likely pointing to the use of bots. WikiLeaks mentioned the leaks in subsequent tweets 15 times, contributing the most to the news' spread. Within a short period of time, #MacronLeaks was trending in France and was on a banner on the Drudge Report homepage. In another sign of bot use the ten most active accounts using the #MacronLeaks hashtag posted over 1,300 tweets in just over three hours. One particular account, posted 294 tweets in a span of two hours. Analysis shows that the hashtag was mentioned more times by American accounts than French ones, but posts concerning them were, by a slim margin, written more often in French than English.[27][25]
The leaked e-mails were claimed to show evidence of criminal wrongdoing by Macron and his campaign including the committing of tax evasion and election fraud.[28] A less suggestive examination of the e-mails by Numerama, a French online publication focusing on technological news, described the leaked emails as "utterly mundane", consisting of "the contents of a hard drive and several emails of co-workers and En Marche political officials." Leaked documents included "memos, bills, loans for amounts that are hardly over-the-top, recommendations and other reservations, amidst, of course, exchanges that are strictly personal and private — personal notes on the rain and sunshine, a confirmation email for the publishing of a book, reservation of a table for friends, etc."[29]
Reaction
In response to the attack, Emmanuel Macron said it was "democratic destabilisation, like that seen during the last presidential campaign in the United States" and said the hackers had mixed falsified documents with genuine ones, "in order to sow doubt and disinformation."[30] Vice President of the National Front Florian Philippot and Le Pen adviser said in a tweet, "Will #MacronLeaks teach us something that investigative journalism has deliberately killed?"[31] The French election commission warned media in the country that publishing the e-mails or discussing them so close to the election would be a violation of the law and issued a statement that in part read, "On the eve of the most important election for our institutions, the commission calls on everyone present on internet sites and social networks, primarily the media, but also all citizens, to show responsibility and not to pass on this content, so as not to distort the sincerity of the ballot."[32] The leak did not appear to have any impact on the French presidential election which continued as scheduled and ended with a Macron victory by a margin of 32%.[33] Despite this, French security officials commenced an investigation into the hacking shortly after the election.[34]
Shortly after the alt-right media boosted the leak, chief of Macron's campaign Mounir Mahjoubi stated that they have been watching GRU hacking attempts since February, and let them steal a carefully prepared cache of trivial and forged documents. After this was confirmed against the leaks contents, its credibility was seriously undermined.[35][36]
In the United States, U.S. Senator from Virginia and ranking member of the Senate Intelligence Committee, Mark Warner said the hacking and subsequent leak only emboldened his committee's investigation, and former Secretary of State and Democratic presidential candidate Hillary Clinton said in a tweet, "Victory for Macron, for France, the EU, & the world. Defeat to those interfering w/democracy. (But the media says I can't talk about that)."[37]
Perpetrators
An assessment by Flashpoint, an American cybersecurity firm, stated that they determined with "moderate confidence" that the group behind the hacking and leak was APT28, better known as 'Fancy Bear', a hacking group with ties to Russian military intelligence. Metadata pulled from the dump revealed the name 'Georgy Petrovich Roshka', likely an alias, which has ties to a Moscow-based intelligence contractor. Many similarities, including the use of social media bots in an attempt to scrub metadata, also pointed to Fancy Bear.[38] However, on 1 June 2017, Guillaume Poupard, the head of France's premier cybersecurity agency said in an interview with the Associated Press the hack, "was so generic and simple that it could have been practically anyone".[39] On 9 May, two days after the election, Mike Rogers, head of the NSA, said in sworn testimony with the United States Senate he had been made aware of Russian attempts to hack French election infrastructure,[40] though he did not mention anything related to the identities of those behind the Macron email hacking. This followed a French announcement that electronic voting for France's overseas citizens would be discontinued in light of cybersecurity threats.[41]
According to the Le Monde newspaper and with the work based on non-public rapport of Google and FireEye, the GRU is responsible.[42]
Vladimir Putin has denied claims of election interference, claiming Russia has also been targeted.[43]
^Testimony of Admiral Michael S. Rodgers, Commander of the U.S. Cyber Command, United States Cyber Command, Hearing before the Senate Armed Services Committee, 9 May 2017