Russia 'had an army of Facebook spies watching Emmanuel Macron during French election'

Warren Barguil of France riding for Team Sunweb stands on the podium in the king of the mountain jersey and talks with French President Emmanuel Macron: Chris Graythen/Getty Images
Warren Barguil of France riding for Team Sunweb stands on the podium in the king of the mountain jersey and talks with French President Emmanuel Macron: Chris Graythen/Getty Images

A network of fake Facebook accounts were trying to spy on Emmanuel Macron during the election.

Russian intelligence agencies create phony accounts on the social network to allow them to watch the then presidential candidate.

More than 20 accounts were made to conduct surveillance on people close to Mr Macron's campaign as he took on Marine le Pen, who he would go on to convincingly defeat.

It was long known that the French election was hit by disinformation campaigns and attacks on social media. But the new network of fake, zombie social networks had not been revealed until the Reuters report.

Russia has repeatedly denied interfering in the French election by hacking and leaking emails and documents. U.S. intelligence agencies told Reuters in May that hackers with connections to the Russian government were involved, but they did not have conclusive evidence that the Kremlin ordered the hacking.

Facebook confirmed to Reuters that it had detected spying accounts in France and deactivated them. It credited a combination of improved automated detection and stepped-up human efforts to find sophisticated attacks.

Company officials briefed congressional committee members and staff, among others, about their findings. People involved in the conversations also said the number of Facebook accounts suspended in France for promoting propaganda or spam - much of it related to the election - had climbed to 70,000, a big jump from the 30,000 account closures the company disclosed in April.

Facebook did not dispute the figure.

The spying campaign included Russian agents posing as friends of friends of Macron associates and trying to glean personal information from them, according to the U.S. congressman and two others briefed on the matter.

Facebook employees noticed the efforts during the first round of the presidential election and traced them to tools used in the past by Russia’s GRU military intelligence unit, said the people, who spoke on condition they not be named because they were discussing sensitive government and private intelligence.

Facebook told American officials that it did not believe the spies burrowed deep enough to get the targets to download malicious software or give away their login information, which they believe may have been the goal of the operation.

The same GRU unit, dubbed Fancy Bear or APT 28 in the cybersecurity industry, has been blamed for hacking the Democratic National Committee during the 2016 U.S. presidential election and many other political targets. The GRU did not respond to a request for comment.

Email accounts belonging to Macron campaign officials were hacked and their contents dumped online in the final days of the runoff between Macron and Le Pen.

French law enforcement and intelligence officials have not publicly accused anyone of the campaign attacks.

Mounir Mahjoubi, who was digital director of Macron's political movement, En Marche, and is now a junior minister for digital issues in his government, told Reuters in May that some security experts blamed the GRU specifically, though they had no proof.

Mahjoubi and En Marche declined to comment.

There are few publicly known examples of sophisticated social media spying efforts. In 2015, Britain's domestic security service, MI5, warned that hostile powers were using LinkedIn to connect with and try to recruit government workers.

The social media and networking companies themselves rarely comment on such operations when discovered.

Facebook, facing mounting pressure from governments around the world to control "fake news' and propaganda on the service, took a step toward openness with a report in April on what it termed "information operations".

The bulk of that document discussed so-called influence operations, which included "amplifier"€ accounts that spread links to slanted or false news stories in order to influence public opinion.

Additional reporting by Reuters