Shortly before the French presidential election, a large number of emails from Emmanuel Macron’s campaign were leaked online. The details of the leak quickly spread on social media, but mainstream news organisations in France were prohibited from publishing the material. Wasim Ahmed and Joseph Downing present an analysis of how the leak spread and what lessons it can provide for future campaign hacks in high profile elections.
Emmanuel Macron pulled off one of the biggest upset victories in recent political history, taking the French presidency from a standing start in nine months without the backing of a political party. However, this is not the only reason that his campaign was historic. The 2017 French presidential election will also be remembered for an attempt by outside forces to intervene on the eve of the vote with a leak of significant amounts of hacked data.
The election added a new and worrying dimension to the role of ‘fake news’ in shaping electoral outcomes in democracies across the world. In addition, the specificities of the French case meant that French media were unable to report on the details of the leak due to the traditional press blackout that takes place before the final vote. Adding to worries about the role of these incidents, a picture in which alternative media sources and far-right political figures emerge as the most influential figures on twitter also raises significant concerns about the transmission and reception of information in the social media age.
Although the information used in the Macron leaks was obtained through phishing attacks in April, it was not leaked until an hour before official campaigning stopped in the election, meaning that neither Macron nor Le Pen could respond to the content of the documents. As the French press were barred from speaking substantively about the leaks, social media, particularly Twitter, soon became the primary space where the content could be discussed. As such, the issue offers an opportunity to better understand the role of Twitter in political incidents where conventional media sources are prohibited from participating in the coverage of events.
An important theme in the use of Twitter during this event was the speed with which tweeting about the leak spread around not just France, but the world. This is important because it shows the importance of substantive foreign involvement and interest in the election. In examining the Twitter response to the #MacronLeaks hashtag, we can know that by 9.30am UK time there were at least 207,600 tweets using the hashtag #Macronleaks, and many of these tweets were retweets (177,800 – 86%), while 4,300 (2%) were replies. This means that there were around 25,500 individual unique tweets that were sent in a very short amount of time. Figure 1 below is a heat map which shows the location users were tweeting from up to 9.30am.
Figure 1: Heat map which plots the location of users that were tweeting
Note: Compiled by the authors.
Although the French government banned access to the leaked emails from within France, the majority of the tweets appeared to derive from France (41%), and specifically Paris (15%). This was followed by the United States (34%), in particular New York (4%). In terms of looking at influential Twitter users, three of the most retweeted tweets derived from WikiLeaks, and the WikiLeaks account was highly influential overall in covering the affair.
Figure 2: Most retweeted tweet
— WikiLeaks (@wikileaks) May 5, 2017
This is notable because in the vacuum left by the lack of press coverage, WikiLeaks filled the void as one of the primary means by which twitter users could get information about the leaks. While the above tweet does not give anything away about the content of the leaks, it nevertheless signposted WikiLeaks’ involvement in analysing the data, setting itself up to users as a place to get information as the event unfolded. This is important because WikiLeaks is an organisation that operates outside of the rigours of established journalism and as such sets a dangerous precedent for groups to be able to acquire high levels of influence in extremely dynamic news events such as the Macron leaks.
Another worrying trend is for parties with an anti-system stance to also quickly establish themselves as important influencers in fast paced news events like this. Shown below is the tweet which received the most replies up until 9.30am. It was sent by Florian Philippot, one of the Vice Presidents of the Front National. In the tweet, Philippot asked whether the leaks contained information that had been neglected by the mainstream media. This tied in with the anti-system narrative that the Front National deployed repeatedly during the campaign.
Figure 3: Most quoted tweet
Les #Macronleaks apprendront-ils des choses que le journalisme d'investigation a délibérément tues ? Effrayant ce naufrage démocratique.
— Florian Philippot (@f_philippot) May 5, 2017
Another way to look at how people were talking about the leaks on Twitter is through network analysis. Network analysis has the potential to show the connections between users and the groups that emerged around the discussion of the leaks in the form of distinct clusters. A report along these lines was produced by the NodeXL team here. The largest group of users can be found in Group 1 (G1), on the top left hand-side of the graph are the most frequently occurring keywords associated with each group.
Figure 4: Network Analysis of #Macronleaks using NodeXL
One Twitter user who appeared among the most influential and most mentioned on the chart was a Donald Trump supporter from the United States. A number of other Twitter accounts also appear among the most influential and most mentioned which appear to share content associated with alt right politics. In Group 3 and Group 4 the word Russian appears among the most frequently used keyword, as users would discuss whether the hack was linked to Russian hackers.
WikiLeaks ranked as the number one most influential user, and was also the most replied to overall. A top ‘word pair’ (words frequently used in combination) was the word ‘WikiLeaks’ with ‘Macronleaks’. This further highlights the point that WikiLeaks appeared to be an important information source as the event unfolded. WikiLeaks operates outside of the bounds of traditional journalism. Usually, several mainstream media outlets would appear among the most frequently occurring URLs during a political event of this nature. However, this was not possible given conventional media sources were prohibited from reporting on the leaks. What we do see appear are a number of non-mainstream media outlets sharing news of the leaks. The most shared link relates to a Medium blog post which analysed the use of the hashtag.
In this case, it appears that Twitter was used as a communication back-channel to talk about an event where conventional media sources were prohibited from participating. It also appears that despite a media blackout, those who had a political agenda against Macron managed to use Twitter to further their own case. As traditional media outlets were not reporting on the leaks, members of the public were forced to use Twitter for their information. However, given that the top tweet was by a senior figure in a far-right political party, and his tweet was conspiratorial in nature, this raises further questions about how information is transmitted and digested in the social media age.
Note: This article gives the views of the authors, and not the position of EUROPP – European Politics and Policy, nor of the London School of Economics.
Wasim Ahmed – University of Sheffield
Wasim Ahmed is a PhD candidate at the Information School at the University of Sheffield and an expert social media consultant at Sonic Social Media. Wasim has a very successful research blog, which includes posts about key trends and issues within social media but also covers more practical posts on using tools to capture and analyse social media data. Wasim is a keen Twitter user (@was3210), and will be happy to answer any technical (or non-technical!) questions you may have.
Joseph Downing – CNRS
Joseph Downing has been awarded a Marie-Curie individual fellowship to conduct a research project on social media by Muslim organisations and individuals to de-securitise Muslims in the UK and France, based at the School of Oriental and African Studies and the Centre National de la Recherche Scientifique (CNRS). He has published widely on politics and sociology in France, concentrating on minority communities. He received his PhD from the LSE’s European Institute and taught as a fellow at LSE until 2016.