After 9 gigabytes of Macron-linked documents and emails were released on an anonymous pastebin website on Friday afternoon in what Macron's campaign said was a "massive and coordinated" hacking attack, France - fearing a similar response to what happened with Hillary Clinton after 35,000 John Podesta emails were released one month before the US presidential election - cracked down on the distribution of the files, warning on Saturday it would be a "criminal offense" to republish the data, and warning the French media not to publish content from any of the hacked emails "to prevent the outcome of the vote being influenced."
Quoted by Reuters, the French election commission said in a statement that "on the eve of the most important election for our institutions, the commission calls on everyone present on internet sites and social networks, primarily the media, but also all citizens, to show responsibility and not to pass on this content, so as not to distort the sincerity of the ballot." Following a rushed meeting on Saturday morning, the commission which supervises the electoral process, said that the data been "fraudulently obtained and could be mixed with false information." It is unclear, however, how it hopes to enforce any punitive claims, especially when much of the initial document distribution appears to have taken place offshore.
Domestically, in a similar reaction to the US media's response to the Podesta emails, French TV news channels chose not to mention the hack, although the left-leading Liberation prominently featured the news on its website. Liberation author Cedric Mathiot wrote that the leak, and its timing, "wants to create chaos" adding that the information was distributed in an "unethical method."
On Friday night, as news of what has been hashtagged as @MacronLeaks on twitter spread, Florian Philippot, deputy leader of the National Front, tweeted "Will Macronleaks teach us something that investigative journalism has deliberately kept silent?" In a tweeted response, Macron spokesman Sylvain Fort called Philippot's tweet "vile".
In another parallel to the Clinton leaks, Macron's En Marche! party said the leaked documents dealt with "the normal operations of a campaign and included some information on campaign accounts." It said the hackers had mixed false documents with authentic ones to "sow doubt and disinformation."
But in the biggest parallel to the Clinton hacking, few have touched upon the actual contents of the documents, which some say confirm prior allegations of illicit financial dealings and offshore accounts, and instead merely sought to attack the messenger. Indeed, as journalist Kim Zetter noted overnight, "Telling journos to not report on hacked emails misses point that nearly all important leaks occur because someone broke law or a contract" and then followed up with the following rhetorical question, flipping the situation by 180 degrees: "If GRU, intending to assault dem., hacks Trump & publishes emails showing his direct connection to Russia, should journos report on those."
Telling journos to not report on hacked emails misses point that nearly all important leaks occur because someone broke law or a contract
— Kim Zetter (@KimZetter) May 6, 2017
If GRU, intending to assault dem., hacks Trump & publishes emails showing his direct connection to Russia, should journos report on those? https://t.co/cJJcjXkgBa
— Kim Zetter (@KimZetter) May 6, 2017
As reported on Friday evening, WikiLeaks tweeted that the leak contained "many tens of thousands" of emails, photos and attachments dated up to April 24, but it noted that it had come "too late" to affect the election results. In a follow up tweet, the controversial whistleblowing organization posted a tweet sharing the location of all #MacronLeaks archives which are "now available as uncensorable magnet links http://archive.is/aULcm"
— WikiLeaks (@wikileaks) May 6, 2017
Since there has been no suggestion WikiLeaks is responsible for this hack, speculation about the source of the hack has grown, with Russia once again emerging as the "usual suspect."
Cited by Reuters, Vitali Kremez, director of research with New York-based cyber intelligence firm Flashpoint, said his review indicates that APT 28, a group tied to the GRU, the Russian military intelligence directorate, was behind the leak. He cited similarities with U.S. election hacks that have been previously attributed to that group. Kremez also said that APT28 last month registered decoy internet addresses to mimic the name of En Marche, which it likely used send tainted emails to hack into the campaign’s computers. Those domains include onedrive-en-marche.fr and mail-en-marche.fr.
"If indeed driven by Moscow, this leak appears to be a significant escalation over the previous Russian operations aimed at the U.S. presidential election, expanding the approach and scope of effort from simple espionage efforts towards more direct attempts to sway the outcome," Kremez said.
We expect the Kremlin to deny all allegations shortly.
To cover all bases, others have also accused the "Alt Right" of being responsible for the leak:
Ben Nimmo, a UK-based security researcher with the Digital Forensic Research Lab of the Atlantic Council think tank, said initial analysis indicated that a group of U.S. far-right online activists were behind early efforts to spread the documents via social media. They were later picked up and promoted by core social media supporters of Le Pen in France, Nimmo said.
The leaks emerged on 4chan, a discussion forum popular with far right activists in the United States. An anonymous poster provided links to the documents on Pastebin, saying, "This was passed on to me today so now I am giving it to you, the people."
The hashtag #MacronLeaks was then spread by Jack Posobiec, a pro-Trump activist whose Twitter profile identifies him as Washington D.C. bureau chief of the far-right activist site Rebel TV, according to Nimmo and other analysts tracking the election. Contacted by Reuters, Posobiec said he had simply reposted what he saw on 4chan.
“You have a hashtag drive that started with the alt-right in the United States that has been picked up by some of Le Pen’s most dedicated and aggressive followers online,” Nimmo told Reuters.
Sunday's election, whose result is expected in just over 24 hours, is seen as "the most important in France for decades, with two diametrically opposed views of Europe and the country's place in the world at stake." Tune in then to find out if Wikileaks is correct, and the #MacronLeaks is nothing more than a tempest in a teapot, unable to chisel away at Macron's lead over Le Pen which the latest polls calculate to be as much as 25 points.
- Atlantic Council
- Digital Forensic Research Lab
- Email hacking
- Fancy Bear
- Hacker groups
- Internet culture
- Internet memes
- Internet trolling
- John Podesta
- National Front
- News leaks
- Podesta emails
- Washington D.C.
- World Wide Web