Analysis
How online activists tried to harm Macron
Rumours, fake news, and leaks propagated on the internet tried to discredit the centrist candidate, Emmanuel Macron, in the last few days of the French election.
They were just the last of many attempts to influence the outcome of the vote, mainly in favour of Marine Le Pen, a far-right and anti-EU politician whose party was partly funded by Russia.
Join EUobserver today
Get the EU news that really matters
Instant access to all articles — and 20 years of archives. 14-day free trial.
Choose your plan
... or subscribe as a group
Already a member?
The anti-Macron content was mostly circulated by the so-called "patriosphere" - a group composed of "identitaires" (nativists), National Front militants, and right-wing supporters of the centre-right Republicans party.
In the last days before the vote, fresh rumours were spread on the other side of the Atlantic by people from the US far-right and later relayed by French far-right accounts.
The main one was that Macron had a hidden account in the Bahamas.
To understand how the operation worked, one has to go back to a study I made in April on communities that were spreading news produced by Russian state media Sputnik and Russia Today (RT).
I collected the records of two and half months of activities on these accounts in order to identify which contents were posted and who was reached by them. I also collected 6,006 profiles that shared the most articles and I analysed how these users followed each other on Twitter.
When I compared the database of French-speaking accounts that shared the Bahamas rumour with the database of accounts that followed Russia media, I obtained a very high level of consistency - over 60 percent. That means that most of the accounts sharing anti-Macron rumours were the same that usually share Russian state media news.
I found the same pattern two days later when information hacked from Macron's campaign was leaked by US activists and spread by pro-Russian, far-right French-speaking communities.
This time, the leaks were also propagated by accounts used for "response operations" by the National Front.
Earlier in the campaign, different methods were used against different candidates; most of them involving the "patriosphere".
The first method was the use of "response teams" that directly targeted candidates.
Hostile hashtags regularly topped the lists of trending topics on Twitter. #FaridFillon - against reference to conservative candidate Francois Fillon - #DemasquonsMacron (Unmasking Macron), or #FillonGate.
This was mostly used by digital activists supporting Le Pen.
They typically agreed on a specific day and hour on which they activated some 1,800 accounts to make one of the hashtags a trending topic. They did it through Discord, a chat platform, or through private groups on Twitter. The aim was to get the visibility granted by the trending topics list as well as to get attention from the media.
A second method was infiltration.
Some National Front activists created three pro-Macron accounts in order to gather supporters of En Marche!, Macron's political movement.
For a while, they posted tweets that were favourable to Macron. But towards the end of the campaign, after a controversy about Islam and a Macron supporter, they said they were withdrawing their support from the candidate.
The true nature of these accounts was intimated by the “likes" they had given to far-right messages, however.
A third method was the framing of real news and the creation of fake news.
In framing, the "patriosphere" circulated factually correct news, but highlighted those aspects that served their political agenda and provided partisan interpretations of events.
In one example, activists seized on the fact that France asks Twitter to remove more content than any other country in the world. “World record of Facebook and Twitter censorship. The name of the Socialist dictatorship was never so appropriate!”, one account said.
This overlooked the important fact that the removed content was primarily radical in nature, including racism and anti-Semitism, as well as incitement to violence.
Reframing news can also be done by deliberately taking out some elements to alter the meaning.
Activists also seized upon a video showing Macron washing his hands after a meeting with fishmongers in which he had handled fish.
They circulated only the part where Macron washed his hands. They then linked it to an old story published by Le Gorafi, a satirical website, under the headline “I feel dirty when I shake a poor man’s hand”. The old story was a spoof, but the anti-Macron activists said it was factual.
A Twitter account posting short videos of debates or electoral meetings, Ridicule TV, was also created to mock the main candidates in the election, especially Macron, but not Francois Fillon.
This account had been created by Fillon’s supporters, including some members of his campaign team.
In a more elaborate operation, an activist or an organisation copied the website of the Belgian daily Le Soir - with the same logo and layout, but under the lesoir.info address, instead of lesoir.be - and published an alleged dispatch from the AFP press agency that said that Macron was funded by Saudi Arabia.
The link to the story was sent by fake accounts with generic names to media and to other anti-Macron accounts so that they spread the news.
A few days later, the story was even taken up by Le Pen's niece, Marion Marechal-Le Pen, who is an MP.
Another operation involved using the platform blog of a mainstream publication in order to give fake news a more powerful brand.
An article that described Macron as the new Jerome Cahuzac, a former French budget minister who resigned after it was revealed he had hidden accounts in Switzerland and Singapore, was posted on the blog platform of Mediapart, an investigative website.
More than 80 accounts were created overnight and activated on a Saturday morning to help the blog article to enter the list of trending topics.
I quickly identified the method and denounced it in a tweet. Some 45 minutes later, all the tweets had been removed. The attempts had been foiled, but I could no longer look at how the story would be propagated.
Another attempt was made, this time by using the blog platform of L'Express, a weekly. L'Express discovered the move when a post also claiming that Macron had a hidden account became one the most read on the site and it decided to take the text offline.
In reaction, the patriosphere said that was another sign that Macron was being protected by mainstream media.
These operations were organised using smoke screens and a Trojan Horse. The first step was to create the Trojan Horse with as much credibility as possible - copying real media or posting a blog note on real media.
The second step was the creation of smoke screens - robots or fake accounts that help to send the Trojan Horse to the right places: communities that will share the story without asking too much where it comes from.
The scheme also explains why it is so difficult to identify for sure where a rumour comes from. Those who share it are not necessarily those who created it.
Nicolas Vanderbiest is a PhD assistant at the University of Louvain and a social media expert. He has a blog on web influence.