Wednesday

17th Jan 2018

Investigation

US ignites debate on Russia's role in Macron hack

  • Paris: One cyber expert said a lone far-right activist could have done the Macron hack (Photo: Pedro Lastra)

The US has said Russia was behind the pre-election hack in France, but some cyber experts were less sure.

Mike Rogers, the head of the US spy agency, the NSA (National Security Agency), told a Senate hearing in Washington on Tuesday (9 May) that the Russian regime stole and leaked thousands of emails from France’s now-incoming leader, Emmanuel Macron, on the eve of the French election last week.

Thank you for reading EUobserver!

Subscribe now for a 30 day free trial.

  1. €150 per year
  2. or €15 per month
  3. Cancel anytime

EUobserver is an independent, not-for-profit news organization that publishes daily news reports, analysis, and investigations from Brussels and the EU member states. We are an indispensable news source for anyone who wants to know what is going on in the EU.

We are mainly funded by advertising and subscription revenues. As advertising revenues are falling fast, we depend on subscription revenues to support our journalism.

For group, corporate or student subscriptions, please contact us. See also our full Terms of Use.

If you already have an account click here to login.

  • Bundestag: German elections already targeted by Pawn Storm group (Photo: Pierre)

Asked about the leak, which was splashed on social media last Friday, on 5 May, Rogers said: “We had become aware of Russian activity”.

“We had talked to our French counterparts prior to the public announcements [leaks] ... and gave them a heads-up: ‘Look, we’re watching the Russians, we’re seeing them penetrate some of your infrastructure’,” he said.

US intelligence officials, speaking to the Reuters news agency, corroborated Rogers’ accusation.

The 5-May leak was done by "entities with known ties to Russian intelligence”, one of them said.

Some cyber security firms, such as the US-based Flashpoint and BigID, have agreed.

Trend Micro, a Japanese-based firm which has tracked Russian state hackers for over two years, has also said that Pawn Storm, a group linked to Russia’s GRU military intelligence service, was behind an earlier attack on Macron’s team in March.

But Loic Guezo, an expert from the firm’s Paris office, told EUobserver on Tuesday that the 5-May Macron leak had a different “modus operandi”.

Speaking prior to Rogers’ testimony, Guezo noted that US intelligence services, such as the NSA, were able to make accusations on the basis of external evidence, such as intercepted phone calls, but he said that internal evidence did not point to Russia’s role in the 5-May leak.

“We are not a counter-intelligence organisation, so we don’t have this kind of evidence,” Guezo said.

Modus operandi

Guezo said Pawn Storm had in the past hacked targets well in advance of the leak date, that it had picked out compromising content, and that it had fed that content to media at a time designed to maximise harm.

But he noted that the 5-May hack was done at the last minute, the material was dumped en bloc, it came out just before a pre-election media blackout, and was later found to contain nothing that compromised Macron.

“If you look at the Podesta emails, these were selected and released with some kind of agenda”, he said, referring to Pawn Storm’s hack of Hillary Clinton's campaign chairman, John Podesta, in the US election last year.

“But here, the whole pile of documents was dumped a few minutes before the official media ban in a big risk, a big bet,” he said.

He said the last email in the Macron cache was dated 24 April, indicating that that was when the hack took place.

He said the “bet” failed because French media respected the blackout and because the material contained “nothing interesting”.

Guezo added that it looked suspicious that the far-right National Front [FN] party, whose candidate, Marine Le Pen, was running against Macron, publicly commented on the leak at the very same moment that it came out on social media.

He stopped short of accusing the National Front of doing the hack, but he said the “timing of the comments by Florian Philippot [the FN’s vice-president] seem relevant to the investigation”.

He said Pawn Storm operations, which targeted institutions, including military bodies, for years at a time, required state-level resources.

But he said the “one-off” hack on Macron could have been “not some team, but one guy setting up a simple phishing attack”, referring to a type of attack which uses fake emails or websites to steal people’s passwords.

“It could even have been some alt-right activist in the US hacking Macron’s team. It’s fully open”, Guezo said.

Some of the leaked files had metadata which contained a Russian name linked to Russia’s FSB intelligence service, but Guezo said that that looked like a red herring.

He said it would be “very strange” if Russian intelligence services had left evidence of their involvement.

“In cyber, you never find the smoking gun. Attackers can create digital fog. They can mimic other groups, copy their tools”, he said.

German elections

The NSA’s Rogers told the Senate on Tuesday that he was also working with British and German authorities to block Russian hacks ahead of elections there in June and September.

“We’re doing similar things with our German and British counterparts, they have an upcoming election sequence,” he said.

“We need to make it very clear to nation-states that engage in this behaviour that it’s unacceptable and there’s a price to pay for doing this,” he added.

Trend Micro, in a recent report, said Pawn Storm had hacked the ruling CDU party of German chancellor Angela Merkel, as well as its foundation, the Konrad Adenauer Stiftung, in operations dating back to April last year.

The firm’s Guezo told EUobserver there was a strong chance that some CDU officials or MPs were still “infected” with its malware.

“They [Pawn Storm] tend to flood the whole organisation”, he said.

“They keep most targets at the first level of infection, effectively doing nothing, but if these people enter into the public focus at a later stage, or they see some sensitive document from that person, they can move to the second stage”, he said, referring to extraction and leaks of data.

He said it would be difficult for France, Germany, or the UK to make Russia pay a “price” for hacking by conducting a cyber counter-strike, however.

He said French law would only permit a counter-strike if it was immediate, proportionate, and limited in its effect.

But he said Russian hacks were typically detected long after they occurred and that a “hack-back” against foreign servers would be likely to cause collateral damage to private users who had nothing to do with the Russian regime.

Journalists targeted

Guezo told EUobserver that Pawn Storm was also targeting journalists whose reporting went against Russia’s interests.

The list of media attacked by Pawn Storm so far includes: Buzzfeed and The New York Times in the US, The Economist in the UK, Arabic news agency Al Jazeera, and several Turkish and Ukrainian outlets.

“If they hack journalists they can have access to their sources and try to discredit them”, Guezo said.

He said Russian state media RT France and Sputnik France also made personal attacks on journalists from French media Liberation and AFP.

“In some cases, they used the journalists’ personal tweets to try to discredit their work”, he said.

He said Pawn Storm, which works hand-in-glove with Russian state media, also approached mainstream Western media with baited material.

“We’ve seen a lot of this activity by Pawn Storm in Germany, reaching out, for instance, to Der Spiegel”, Guezo said.

“They sent a preview of hacked material and proposed an exclusive scoop”, he said.

“They wanted to influence opinion by creating a press buzz on topics that had been selected by Pawn Storm and based on material that may have been incomplete or even altered in order to suit its agenda”, the French expert said.

Investigation

Lessons for Germany from the Macron hack

The way the Macron team defended itself against hackers contained lessons for other political parties in Europe, but experts do not agree whether Russia did it.

Anti-Macron leaks try to sway French election

Thousands of documents, some likely fake, were spread by WikiLeaks as well as pro-Trump and pro-Russia social media in the final moments of the French campaign.

Investigation

USA: Russland hat Macron gehackt

Die USA behauptete Russland stecke hinter dem Hackerangriff auf Macron, aber ein Cyber-Experte war sich nicht so sicher und sagte, dass die deutschen Wahlen und EU Journalisten Ziele Moskaus wären.

US neo-Nazis linked to Macron hack

The spread of stolen emails designed to harm Emmanuel Macron was linked to US-based neo-Nazis, according to a French investigation.

Germany to let slip 2020 climate target

Prospective governing coalition partners give up on reducing greenhouse gas emissions by 40 percent in 2020, saying instead they will achieve that in the early 2020s.

Magazine

Schulz: 'hero to zero' in 2017 - but back in 2018?

For Martin Schulz, 2017 was the year he was supposed to go from European Parliament president to German chancellor. He failed badly yet now he looks set to return to centre-stage in 2018, possibly as Germany's foreign minister.

Stakeholders' Highlights

  1. ILGA EuropeFreedom of Movement and Same-Sex Couples in Romania – Case Update!
  2. EU2017EEEstonia Completes First EU Presidency, Introduced New Topics to the Agenda
  3. Bio-Based IndustriesLeading the Transition Towards a Post-Petroleum Society
  4. ACCAWelcomes the Start of the New Bulgarian Presidency
  5. Mission of China to the EUPremier Li and President Tusk Stress Importance of Ties at ASEM Summit
  6. EU2017EEVAT on Electronic Commerce: New Rules Adopted
  7. European Jewish CongressChair of EU Parliament Working Group on Antisemitism Condemns Wave of Attacks
  8. Counter BalanceA New Study Challenges the Infrastructure Mega Corridors Agenda
  9. Dialogue PlatformThe Gülen Community: Who to Believe - Politicians or Actions?" by Thomas Michel
  10. Plastics Recyclers Europe65% Plastics Recycling Rate Attainable by 2025 New Study Shows
  11. European Heart NetworkCommissioner Andriukaitis' Address to EHN on the Occasion of Its 25th Anniversary
  12. ACCACFOs Risk Losing Relevance If They Do Not Embrace Technology

Latest News

  1. Post-Brexit trade roll-over not automatic, EU paper says
  2. Oettinger pushes plastic tax but colleagues express doubts
  3. MEPs target exports of cyber surveillance tech
  4. Kosovo killing halts EU talks in Brussels
  5. ECB withheld information on 'flawed' bank supervision
  6. Fewer MEPs than visitors turn up for Estonian PM
  7. EU names China and Russia as top hackers
  8. Ten Commandments to overcome the EU's many crises

Stakeholders' Highlights

  1. UNICEFMake the Digital World Safer for Children & Increase Access for the Most Disadvantaged
  2. European Jewish CongressWelcomes Recognition of Jerusalem as the Capital of Israel and Calls on EU States to Follow Suit
  3. Mission of China to the EUChina and EU Boost Innovation Cooperation Under Horizon 2020
  4. European Gaming & Betting AssociationJuncker’s "Political" Commission Leaves Gambling Reforms to the Court
  5. AJC Transatlantic InstituteAJC Applauds U.S. Recognition of Jerusalem as Israel’s Capital City
  6. EU2017EEEU Telecom Ministers Reached an Agreement on the 5G Roadmap
  7. European Friends of ArmeniaEU-Armenia Relations in the CEPA Era: What's Next?
  8. Mission of China to the EU16+1 Cooperation Injects New Vigour Into China-EU Ties
  9. EPSUEU Blacklist of Tax Havens Is a Sham
  10. EU2017EERole of Culture in Building Cohesive Societies in Europe
  11. ILGA EuropeCongratulations to Austria - Court Overturns Barriers to Equal Marriage
  12. Centre Maurits CoppietersCelebrating Diversity, Citizenship and the European Project With Fundació Josep Irla

Stakeholders' Highlights

  1. European Healthy Lifestyle AllianceUnderstanding the Social Consequences of Obesity
  2. Union for the MediterraneanMediterranean Countries Commit to Strengthening Women's Role in Region
  3. European Heart NetworkThe Time Is Ripe for Simplified Front-Of-Pack Nutrition Labelling
  4. Counter BalanceNew EU External Investment Plan Risks Sidelining Development Objectives
  5. EU2017EEEAS Calls for Eastern Partnership Countries to Enter EU Market Through Estonia
  6. Dialogue PlatformThe Turkey I No Longer Know
  7. World Vision7 Million Children at Risk in the DRC: Donor Meeting to Focus on Saving More Lives
  8. EPSU-Eurelectric-IndustriAllElectricity European Social Partners Stand up for Just Energy Transition
  9. European Friends of ArmeniaSignature of CEPA Marks a Fresh Start for EU-Armenia Relations
  10. Nordic Council of MinistersNordic Energy Ministers Pledge to Work More Closely at Nordic and EU Level
  11. European Friends of ArmeniaPresident Sargsyan Joined EuFoA Honorary Council Inaugural Meeting
  12. International Partnership for Human RightsEU Leaders Should Press Azerbaijan President to End the Detention of Critics