PARIS — It was only the latest plot twist in a long, bitter campaign defined by rancor and uncertainty.
The day before France’s most momentous presidential election in recent history, authorities were still investigating the “massive and coordinated piracy action” that independent candidate Emmanuel Macron reported just minutes before the campaign’s official end Friday night.
The data dump, the Macron campaign said, involved thousands of nonincriminating emails and other internal communications — some of which, the campaign insisted, were fake. In a year of populist upheaval, this was the nightmare scenario for many observers, immediately reminiscent of the American election — in which, as U.S. intelligence agencies recently concluded, Russian President Vladimir Putin commissioned an “influence campaign” to benefit President Trump.
The identity of the hacker remains unconfirmed, but the parallels were clear enough in Paris and Washington: Macron, an independent centrist candidate and staunch defender of the European Union, is facing off against Marine Le Pen, a far-right populist whose party has relied on Russian banks in the past and who favors pivoting France’s foreign policy toward the Kremlin. In March, Le Pen met personally with Putin on a visit to Moscow.
“Intervening in the last hour of the official campaign, this operation is obviously a democratic destabilization, as has already been seen in the United States during the last presidential campaign,” the Macron campaign said, stopping short of assigning blame.
The sentiment was echoed across the Atlantic, with Rep. Adam B. Schiff (Calif.), the ranking Democrat on the House Intelligence Committee, warning that the hacking, if successful, “would represent yet another dangerous escalation of cyberinterference in a Western nation’s democracy.”
But amid France’s government-mandated day of silence that always precedes election day — when candidates are strictly prohibited from campaigning in any way — the impact of the leaks on the election remained to be seen.
In the French press, the leaks received comparatively little coverage: In keeping with French campaign law, reporting on the emails’ contents could result in criminal charges. On Saturday, France’s electoral commission urged journalists and media organizations to heed “the sense of responsibility they must demonstrate, as at stake are the free expression of voters and the sincerity of the election” itself.
Ben Nimmo, a research fellow with the Atlantic Council’s Digital Forensic Research Lab, said in an interview that enthusiasm for the leaks was scarcely discernible beyond the far-right, pro-Le Pen online circles that had circulated them in the first place.
“It doesn’t seem at this stage that there are lots of high-profile non-Le Pen accounts jumping in and spreading the message around,” he said of social-media patterns surrounding the leaks. “They have kept their constituency — and they have galvanized their constituency — but they haven't necessarily stepped outside of that constituency.”
Most French voters interviewed on the streets of the capital the day before the vote shrugged off the hack. The stakes are much too high to be bothered by compromising internal campaign documents, they said.
Paul Lotere, a 29-year-old civil servant, said he was most upset that Macron had no chance to respond given the strict campaign curfew. He plans to vote for the former finance and economy minister and said he has no interest in the documents until their veracity is confirmed.
“Ah, yes, ‘hashtag Macron leaks,’ ” sneered Alain Chappotteau, a 51-year-old psychologist, repeating the Twitter tagline popularizing the news. “With all the fuss, all the tricks, in this campaign, what’s one more? I’m voting for my child’s future. This doesn’t matter.”
Although the hacker remained unknown, Nimmo said, the social-media campaign following the Macron data dump originated in the United States, in a well-known network of Twitter accounts used by members of the alt-right, a small, far-right movement that seeks a whites-only state.
The #MacronLeaks Twitter storm — notably in English, not French — largely began with the account of Jack Posobiec, a Washington-based correspondent for the alt-right website TheRebel.media, Nimmo said. Posobiec has written that he served, in 2016, as “Special Projects Director of Citizens for Trump, the largest Trump grassroots organization in the US,” according to an article Nimmo wrote on the Macron case.
From there, Nimmo said, news of the Macron leaks — allegedly containing details of offshore accounts and tax evasion — was retweeted by William Craddick, another alt-right activist known to have spread in December a fake news story about German Chancellor Angela Merkel tolerating Islamic State terrorists to deploy an E.U. “army” to subdue her country's neighbors. Eventually, Nimmo added, the leaks began to be retweeted by well-known National Front accounts — reaching 47,000 tweets in just three hours.
Despite France’s strict prohibition on campaigning after the deadline, Florian Philippot, the National Front's deputy leader, tweeted early Saturday morning: “Will #Macronleaks teach us something that investigative journalism has deliberately killed?”
For months now, Le Pen has also received exceedingly positive coverage in Russian state media. Meanwhile, those news outlets have pilloried Macron, accusing him of being secretly gay and of embezzling public funds. To date, most of those rumors seem to have had little effect on French voters.
Throughout the election, Macron has frequently said that his campaign has been the target of Russian meddling, though the Kremlin has repeatedly denied those accusations.
In a report issued last month, researchers at the cybersecurity firm Trend Micro linked intrusions into the Macron campaign’s online network to Russian hackers operating as an arm of Kremlin intelligence.
The Tokyo-based firm said it was the same group — known variously as Pawn Storm, APT28 and Fancy Bear — that hacked the Democratic National Committee and officials tied to Hillary Clinton’s unsuccessful campaign for president.
In the specific case of the leaked documents, a Russian connection was not immediately identified. But according to analysis conducted by Flashpoint Intel, a digital risk firm, “it appears to be linked to the Russian state-sponsored campaign by APT28.”
Nicolas Vanderbiest, an expert on social-media information dissemination and the author of the well-known blog “Reputatio Lab,” said in an interview that there were significant connections in the Twitter storm following the leaks to accounts linked to Sputnik and Russia Today. In a paper published several weeks ago, he studied many of these accounts, some 40 percent of which were involved with spreading the news about the Macron scandal early Saturday, he said.
In any case, analysts say, the French government has taken the threat of cybersecurity in the election very seriously.
In March, for instance, France’s National Cybersecurity Agency said that there was “an extremely high risk” of cyberattacks and hacking of the country’s electoral process, which prompted the government to suspend electronic voting this year for French citizens overseas.
Alexander Klimburg, an expert on cyberwarfare at the Hague Centre for Security Studies who has been in regular contact with French civil service officers, said he believes the French government is sufficiently prepared for Russian cyberattacks, especially after Russian hackers nearly destroyed a French television network, TV5Monde, almost exactly two years ago.
“The sense was, ‘If this happens again, we’re going to be ready,’ ” Klimburg said. “I expect there to be a massive escalation in the covert information environment.”
Polls show Macron, a former investment banker and Socialist finance minister, with a considerable lead over Le Pen, at 63 percent to 37 percent of the vote, according to the latest analysis from the Ipsos firm, released Friday.
For many, the hacking and subsequent data dump represented a desperate, last-dash attempt to thwart Macron’s considerable lead in the polls — a lead that has actually grown in the final days of the campaign.
“It’s so obvious, and you can make all the connections so easily,” said Vanderbiest. “It's very amateur.”