Disinformation and social bot operations in the run up to the 2017 French presidential election

Recent accounts from researchers, journalists, as well as federal investigators, reached a unanimous conclusion: social media are systematically exploited to manipulate and alter public opinion. Some disinformation campaigns have been coordinated by means of bots, social media accounts controlled by computer scripts that try to disguise themselves as legitimate human users. In this study, we describe one such operation occurred in the run up to the 2017 French presidential election. We collected a massive Twitter dataset of nearly 17 million posts occurred between April 27 and May 7, 2017 (Election Day). We then set to study the MacronLeaks disinformation campaign: By leveraging a mix of machine learning and cognitive behavioral modeling techniques, we separated humans from bots, and then studied the activities of the two groups taken independently, as well as their interplay. We provide a characterization of both the bots and the users who engaged with them, and oppose it to those users who didn't. Prior interests of disinformation adopters pinpoint to the reasons of scarce success of this campaign: the users who engaged with MacronLeaks are mostly foreigners with preexisting interest in alt-right topics and alternative news media, rather than French users with diverse political views. Concluding, anomalous account usage patterns suggest the possible existence of a black-market for reusable political disinformation bots. INTRODUCTION Social media have been extensively praised for their power to democratize online conversation. Whether in the context of civil movements (Howard, et al., 2011; González-Bailón, et al., 2011; Tufekci & Wilson, 2012; González-Bailón, et al., 2013; Tufekci, 2014; Bastos, et al., 2014), political outreach (Bond, et al., 2012; Bakshy, et al., 2015), public health interventions (Centola, 2010; Dredze, 2012; Korda & Itani, 2013), or situational awareness (Sasaki, et al., 2010; Merchant, et al., 2011; Signorini, et al., 2011; Paul & Dredze, 2011), platforms like Twitter and Facebook play a central role in the modern information ecosystem. However, such powerful tools can also be abused for nefarious purposes (Ferrara, 2015): Extremist groups use social media for radical propaganda and recruitment efforts (Ferrara, 2017); stock market manipulators have created concerted efforts to game financial systems (Ferrara, 2015); conspiracy groups orchestrate campaigns to distribute fake scientific articles to support anti-vaccination and other anti-science movements, creating massive public health issues (Bessi, et al., 2015; Del Vicario, et al., 2016). Of great concern for democracy is another form of social media manipulation: The rise of popularity of bots and disinformation in the context of political propaganda (El-Khalili, 2013; Bessi & Ferrara, 2016; Ferrara, et al., 2016; Shorey & Howard, 2016; Kollanyi, et al., 2016; Marwick & Lewis, 2017). Researchers warned about the potential for abuse of the social media ecosystem for political propaganda a decade ago (Howard, 2006; Hwang, et al, 2012). The earliest reports of coordinated attacks against political candidates on social media date back to 2010 (Metaxas & Mustafaraj, 2012; Ratkiewicz, et al., 2011a; Ratkiewicz, et al., 2011b). Since then, an increasing account of such events has been recorded in the context of several elections, both in the United States (Bessi & Ferrara, 2016; Kollanyi, et al., 2016; Shorey & Howard, 2016; Wolley, 2016; Wolley & Howard, 2016; Marwick & Lewis, 2017; Wang, et al., 2017), and all over the world, including in South America (Forelle, et al., 2015; Suárez-Serrato, et al., 2016), the U.K. (Howard & Kollanyi, 2016), and Italy (Cresci, et al., 2017). One common trait of these campaigns is the adoption of automation tools to generate large volume of social media posts to support, or attack, candidates. Although automated social media accounts, referred to as social bots or sock puppets, have in some instances been used for social good (Savage, et al., 2016; Mønsted, et al., 2017; Shirado, & Christakis, 2017), in this study we will refer exclusively to those used with the intent to deceive and manipulate. Another form of artificial support expressed on social media is via fake followers, often inactive accounts that are only used to increase the online popularity and/or visibility (e.g., the followership) of a public figure (Marwick & Lewis, 2017). Fake followers are not subject of this study due to their inactivity. On the onset of the 2016 U.S. presidential election, a rather new phenomenon was observed, in concert with social bots and hyper-partisan campaigns: the spread of fake news and the coordination of disinformation campaigns (Allcott & Gentzkow, 2017; Marwick & Lewis, 2017; Mele, et al., 2017). The adoption of automated devices such as social bots in the context of disinformation campaigns is particularly concerning because there is the potential to reach a critical mass large enough to dominate the public discourse and alter public opinion (Ferrara, et al., 2016; Woolley & Howard, 2016; Marwick & Lewis, 2017); this could steer the public’s attention away from facts and redirecting it toward manufactured, planted information. In this paper, we focus on another pivotal recent political event, namely the 2017 French presidential election of May 7, 2017. We aim to describe the social media dynamics related to one potentially disruptive disinformation campaign that occurred in the run up to the election, known as “MacronLeaks”. In the following, we provide a brief account of the events related to MacronLeaks as they unfolded. The popular 4chan.org message board hosts several large yet ephemeral discussion threads. A popular board is the “/pol/” (i.e., politics) community. Partly due to its anonymity features, partly because inactive discussion threads are quickly and automatically archived by the platform itself, 4chan.org has been reportedly functioning as an effective incubator of alt-right and alt-right online communities, most prominently in the United States (Marwick & Lewis, 2017). Among the threads related to the 2017 French election, the most popular was one centered around coordinating cyber-attacks aimed at reveling sensitive information about then-presidential candidate Emmanuel Macron (En Marche!, 2017). Significant user participation guaranteed the generation of a wealth of allegedly incriminating material: while most documents were manufactured and their false nature was easily identifiable, on Friday May 5, 2017 one user anonymously shared an email dump containing “Correspondence, documents, and photos from Macron and his team.” Shortly after its appearance, a link to the “/pol/” anonymous post was shared on Twitter by alt-right activist Jack Posobiec, which contributed to amplify the ongoing disinformation campaign object of this study. Ultimately, the leaked documents were shared on Twitter by WikiLeaks’ official account itself, although with the disclosure that their authenticity was unverified – this made the campaign go viral. DEFINING DISINFORMATION IN THE CONTEXT OF THIS STUDY The notion of “disinformation campaign” used in this work warrants a rigorous definition. We consider MacronLeaks an instance of disinformation as it exhibited two necessary ingredients namely, first, the unverified nature of the shared information, and second the coordinated effort behind its sharing. The unverified nature of the leaked documents make this information qualify for the traditional definition of “rumor” (Allport & Postman, 1947). The documents circulated online have been referred to as evidence of Macron’s tax frauds and other illicit activities. The accuracy and relevance of these leaked documents has been extensively debated for weeks after the fact. The conclusion from official investigations is that, although the leaked documents were not manufactured, there is no evidence to support the allegations: most of the conclusions drawn by the 4chan.org communities were based on erroneous translation from French, as well as biased interpretations (or trivial misunderstanding) of French law (En Marche!, 2017). The voluntary spreading of a rumor by means of an orchestrated effort makes it a disinformation campaign (Del Vicario, et al., 2016). In this case, 4chan.org served as incubator for the initial attempt to smear the candidate by manufacturing, planting, or leaking allegedly incriminating documents. In addition, one major finding of this work, that we will discuss in detail later, is the uncovering of a social bot operation that occurred in the run up to Election Day aimed at amplifying even further the viral sharing of disinformation and email leaks. SUMMARY OF CONTRIBUTIONS In the rest of this manuscript, we will detail the methodological approaches to data collection and analysis, and discuss the findings and contributions of this work, which we summarize as follows: • We monitored the Twitter stream between April 27 and May 7, 2017 (Election Day), and collected a very large dataset containing nearly 17 million tweets related to the 2017 French presidential election. Within it, we identified the subset related to the MacronLeaks disinformation campaign. • By exploiting combinations of machine learning techniques and cognitive behavioral modeling, we identified humans and social bots participating to the campaign. We studied the characteristics of both classes of users independently, as well as their interplay. • We discovered that prior user interests reveal the reasons of scarce success of the MacronLeaks campaign: the users who engaged with it were mostly foreigners belonging to the alt-right Twitter community, rather than French users (i.e., potential voters). • Finally, we uncovered that accounts used to support then-presidential candidate Trump before the 2016 U.S. election have been brought back from a limbo of inactivity (since November 2016) to join the MacronLeaks disinformation campaign. Such anomalous usage patterns point to the possible existence of a black-market for reusable political-disinformation bots.