WikiLeaks and bots help amplify Macron leaks: researchers

Thousands of documents belonging to Macron's En Marche! movement were dumped online

US far-right activists helped amplify a leak of hacked emails belonging to leading French presidential candidate Emmanuel Macron's campaign, some researchers said on Saturday, with automated bots and the Twitter account of WikiLeaks also propelling a leak that came two days before France's presidential vote.

The rapid spread on Twitter, Facebook and the messaging forum 4chan of emails and other campaign documents that Macron's campaign said on Friday had been stolen recalled the effort by right-wing activists and Russian state media to promote hacked documents embarrassing to Democratic US presidential candidate Hillary Clinton last year.

It also renewed questions whether social media companies have done enough to limit fake accounts or spammed content on their platforms and how media organizations should report on hacked information.

Twitter declined to comment on whether it had taken any specific action in response to the Macron leak. Facebook did not respond to a request for comment.



Analysis conducted by The Atlantic Council's Digital Forensic Research Lab published on Saturday found that the hashtag #MacronLeaks reached 47,000 tweets in three and a half hours after it was first used by Jack Posobiec, a writer in Washington for the far-right news organization The Rebel. Posobiec's online biography said he coordinated grassroots organizing for a group that supported US President Donald Trump's campaign.

Posobiec's initial tweet on the Macron documents was retweeted fifteen times within one minute and 87 times in five minutes, Atlantic Council senior fellow Ben Nimmo wrote in a blog published on Medium.

Posobiec is prolific on Twitter, where he has a large following of more than 100,000 accounts. Contacted by Reuters, Posobiec said he did not operate bots and that he used his account to share a post he saw on 4chan.

Bots helped move the hashtag from the United States to France, according to Nimmo, where surveys show far-right leader Marine Le Pen trailing Macron by more than 20 points heading into Sunday's election.

French electoral law forbids candidates from commenting during Saturday and until polling stations close on Sunday.

WikiLeaks, the anti-secrecy group that published hacked emails belonging to Democrats during the 2016 presidential election, provided the largest boost of attention on Twitter to the Macron emails, Nimmo said.

The group did not publish the information itself but tweeted about the leak at least 15 times.



"As the dominant publication in the field we were hours ahead of all other major outlets," WikiLeaks said in a private Twitter message to a Reuters reporter. "That's what our readers expect."

Difficult to attribute

Some researchers also observed the use of identical phrasing in blogs about the leaks, which they alleged was aimed at driving Alphabet Inc's Google search result rankings. Google did not immediately respond to a request for comment.

About nine gigabytes of data purporting to be documents from the Macron campaign were posted on Pastebin, a site that allows anonymous document sharing.

Other recent high-profile political leaks, including those during the US presidential election, have often been dumped by WikiLeaks, which has a sizeable online following and international recognition.

"There is a noticeable lack of a persona taking credit for this," said John Hultquist, a cyber researcher at FireEye, adding that such an absence made attribution more difficult.

The US cyber intelligence firm Flashpoint told Reuters late Friday that an initial review of the Macron leaks indicated that APT 28, a group tied to the GRU, the Russian military intelligence unit, may be behind the leak, though evidence was not yet conclusive. Among other indicators, the firm said metadata contained in one of the leaked files showed it had been modified by someone who works in the technology industry in Moscow.



But other cyber researchers said that analysis was premature, and western security officials contacted by Reuters were cautious about assigning any attribution. The Kremlin has repeatedly denied accusations it has attempted to use cyber attacks to meddle in either the French or US elections.

The Macron leaks prompted swift alarm in the United States, where many believed Russian President Vladimir Putin was again trying to put his thumb on the scales of a Western election.

US intelligence agencies concluded that Putin ordered the hacking of Democratic emails during the US election to benefit Republican Trump, who has been at times dismissive of those findings and resurfaced his claim earlier this week that China could have been responsible.

US Senator Mark Warner, the top Democrat on the Senate Intelligence Committee, said in a statement to Reuters that the Macron leak demonstrates the urgency of his panel's investigation into Russia's alleged interference in last year's US election.

Noting the Macron dump may contain fake documents mixed in with authentic material, as some analysts have suggested, Representative Adam Schiff, the top Democrat on the House Intelligence Committee, said in a statement that the leak may represent "yet another dangerous escalation of cyber interference in a Western nation's democracy."