Russia used Facebook to try to spy on Macron campaign, say sources

Martin Bureau | Pool | Reuters

French President Emmanuel Macron (C) poses for a selfie as he arrives at the Viva Technology conference dedicated to start-ups development, innovation and digital technology in Paris, France, June 15, 2017.

Facebook employees noticed the efforts during the first round of the presidential election and traced them to tools used in the past by Russia’s GRU military intelligence unit, said the people, who spoke on condition they not be named because they were discussing sensitive government and private intelligence.

Facebook told American officials that it did not believe the spies burrowed deep enough to get the targets to download malicious software or give away their login information, which they believe may have been the goal of the operation.

The same GRU unit, dubbed Fancy Bear or APT 28 in the cybersecurity industry, has been blamed for hacking the Democratic National Committee during the 2016 U.S. presidential election and many other political targets. The GRU did not respond to a request for comment.

Email accounts belonging to Macron campaign officials were hacked and their contents dumped online in the final days of the runoff between Macron and Le Pen.

French law enforcement and intelligence officials have not publicly accused anyone of the campaign attacks.

Mounir Mahjoubi, who was digital director of Macron’s political movement, En Marche, and is now a junior minister for digital issues in his government, told Reuters in May that some security experts blamed the GRU specifically, though they had no proof.

Mahjoubi and En Marche declined to comment.

There are few publicly known examples of sophisticated social media spying efforts. In 2015, Britain’s domestic security service, MI5, warned that hostile powers were using LinkedIn to connect with and try to recruit government workers.

The social media and networking companies themselves rarely comment on such operations when discovered.

Facebook, facing mounting pressure from governments around the world to control “fake news’ and propaganda on the service, took a step toward openness with a report in April on what it termed “information operations.”

The bulk of that document discussed so-called influence operations, which included “amplifier” accounts that spread links to slanted or false news stories in order to influence public opinion.