Russian intelligence agents attempted to spy on President Emmanuel Macron's election campaign earlier in 2017 by creating phony Facebook personas, according to a US Congressman and two other people briefed on the effort.
About two dozen Facebook accounts were created to conduct surveillance on Macron’s campaign officials, and others close to the centrist former financier, as he sought to defeat far-right nationalist Marine Le Pen and other opponents in the two-round election, the sources said. Macron won by a landslide in May.
Facebook Had Detected Spying Accounts in France
Facebook said that in April, it had taken action against fake accounts that were spreading misinformation about the French election. But the effort to infiltrate the social networks of Macron officials has not been reported previously.
Russia has repeatedly denied interfering in the French election by hacking and leaking emails and documents. US intelligence agencies told Reuters in May that hackers with connections to the Russian government were involved, but they did not have conclusive evidence that the Kremlin ordered the hacking.
Facebook confirmed to Reuters that it had detected spying accounts in France and deactivated them. It credited a combination of improved automated detection and stepped-up human efforts to find sophisticated attacks.
Company officials briefed congressional committee members and staff, among others, about their findings. People involved in the conversations also said the number of Facebook accounts suspended in France for promoting propaganda or spam – much of it related to the election – had climbed to 70,000, a big jump from the 30,000 account closures the company disclosed in April.
Facebook did not dispute the figure. On Thursday, Kremlin spokesman Dmitry Peskov dismissed the accusations that Russia had attempted to influence the French election as "a lie and not true".
Seeking Friends of Friends
The spying campaign included Russian agents posing as friends of friends of Macron associates, and trying to glean personal information from them, according to the US congressman and two others briefed on the matter.
Facebook employees noticed the efforts during the first round of the presidential election and traced them to tools used in the past by Russia’s GRU military intelligence unit, said the people, who spoke on condition of anonymity because they were discussing sensitive government and private intelligence.
Facebook told American officials that it did not believe the spies burrowed deep enough to get the targets to download malicious software or give away their login information, which they believe may have been the goal of the operation.
The same GRU unit, dubbed Fancy Bear or APT 28 in the cybersecurity industry, has been blamed for hacking the Democratic National Committee during the 2016 US presidential election and many other political targets.
The Kremlin referred all questions about the GRU to the Russian Defence Ministry, which did not respond to a request for comment.
Email accounts belonging to Macron campaign officials were hacked and their contents dumped online in the final days of the runoff between Macron and Le Pen.
French law enforcement and intelligence officials have not publicly accused anyone of the campaign attacks. Mounir Mahjoubi, who was digital director of Macron's political movement, En Marche, and is now a junior minister for digital issues in his government, told Reuters in May that some security experts blamed the GRU specifically, though they had no proof. Mahjoubi and En Marche declined to comment.
There are few publicly known examples of sophisticated social media spying efforts. In 2015, Britain’s domestic security service, MI5, warned that hostile powers were using LinkedIn to connect with and try to recruit government workers.
The social media and networking companies themselves rarely comment on such operations when discovered. Facebook, facing mounting pressure from governments around the world to control “fake news” and propaganda on the service, took a step toward openness with a report in April on what it termed as “information operations”.
The bulk of that document discussed so-called influence operations, which included “amplifier” accounts that spread links to slanted or false news stories in order to influence public opinion.
(This story has been published in arrangement with Reuters)
(We all love to express ourselves, but how often do we do it in our mother tongue? Here's your chance! This Independence Day, khul ke bol with BOL – Love your Bhasha. Sing, write, perform, spew poetry – whatever you like – in your mother tongue. Send us your BOL at bol@thequint.com or WhatsApp it to 9910181818.)
(At The Quint, we question everything. Play an active role in shaping our journalism by becoming a member today.)