BANNER: A woman enters a voting booth to vote in the first round of the French parliamentary elections on June 30, 2024. (Source: Reuters/Yara Nardi)

Website forensics and amplification on Telegram indicate a campaign targeting France’s snap elections could be the latest iteration of a Russian operation dubbed CopyCop, which creates inauthentic news outlets using large language models (LLMs). Recorded Future first reported on Copycop in May 2024.

Following the dissolution of the French parliament in the wake of Europe’s June 9 elections, France held a snap legislative election on June 30, with a second round of voting scheduled for July 9. After the first vote, the French far-right party Rassemblement National was leading, with 34 percent.

On June 26, the DFRLab observed a website impersonating President Emmanuel Macron’s Renaissance Party, making false claims about awarding “100 euros to citizens voting for Renaissance” during the first round of France’s snap elections. The website was promoted by an inauthentic news outlet that used LLMs to create content. We identified hundreds of articles containing a prompt that requested authentic articles be rewritten to adopt a “conservative stance against the Macron administration” in a likely effort to sway voters’ opinions ahead of the European Parliament and the snap elections. Amplification of the two websites on pro-Russian Telegram channels featured messages that appeared to have been machine-translated into various languages

On June 26, a website using typo-squatting impersonated the Renaissance Party via the website ensemble-2024.fr. The domain ensemble-24.fr appears to have been registered on June 19, according to WHOIS information posted on urlscan.io. The registrant used the apparently false name “Mora Deppen” and listed an address in Paris with an erroneous zip code and a phone number with the prefix for the Haut-de-Seine region (92) instead of the Paris region (75).

The impersonating website spread a false claim that “the Macron bonus is individualized aid of 100 euros which will be paid to people who vote for candidates of the presidential majority.” The website encourages voters who benefit from social support to vote for candidates belonging to Renaissance.

Furthermore, analysis of the EXIF metadata embedded in the JPG images of the Renaissance Party candidates on ensemble-24.fr shows that the website’s authors likely stole official images, which are copyrighted by the French parliament. The metadata also still contains the name of the photographer who took the image of Renaissance candidate Jean Lassucq.

The DFRLab found the use of Cyrillic script while investigating the website’s source code. The code, which appears to render comments in the body of the page, features the Cyrillic letter “с” in lieu of the Latin “c,” reinforcing the idea that the website could have been developed by Russian operatives.

In addition, the metadata embedded in the image file “1-banner.jpg”, which featured the text, “Come on June 30 and receive 100 €,” shows that the file was originally created on June 26, 2024, and indicated GMT+2 as a time zone. While this remains speculative, this time zone is consistent with the time zone of Russia’s exclave Kaliningrad.

On Telegram, various messages, seemingly machine-translated into English, German, and Spanish, spread sensationalist claims with a link to ensemble-24.fr and an article by franceencolere.fr (France in anger) that promotes ensemble-24.fr. The first iteration of the message appears to have been posted by the pro-Kremlin outlet Slavyangrad. The website was also quoted in a tweet by pro-Russian French influencer Adrien Bocquet on X.

Using the WordPress REST API, the DFRLab found that the majority of the 5,486 articles posted on franceencolere.fr were actually reposts from the now-defunct Russian-sponsored disinformation website infosindependants.fr. The code obtained from the articles shows hyperlinks that point to infosindependants.fr, although the website was deplatformed.

In a May 2024 report, Recorded Futures found that infosindependants.fr is likely an iteration of the Russian-sponsored Doppelganger operation, spreading misleading content and disinformation in French using LLMs. The domain was flagged among hundreds of others for using LLMs to “weaponize AI for influence.”

The DFRLab extracted the entire article database of franceencolere.fr as of June 26 and found that it had published at least 237 articles exhibiting prompts, indicating the likely use of an LLM to generate articles. The body of more than two hundred articles contains direct prompts in French stating: “Please rewrite this article taking a conservative stance against the Macron administration’s liberal policies in favor of working-class French citizens.” It is also possible to retrieve the articles using the website’s search engine. Most of the articles featuring this prompt were published in February and March 2024.

In addition, the DFRLab found that the rewriting prompt appeared together with unedited copy pasta articles that the website operatives appeared to have stolen from authoritative news outlets without properly sourcing them. The prompt, which apparently was not consistently executed properly, exposes the process of copying genuine articles and transforming them using AI to sway readers’ opinions toward a more “conservative stance.”

In another instance, the DFRLab found that articles posted after the first round of elections on June 30 contained the opening sentence, “Here is a short title for the article …” indicating that the operatives of franceencolere.fr used LLMs to rephrase titles, albeit unsuccessfully. These articles did not feature in the original dataset that the DFRLab extracted on June 27 and appeared starting June 30.

Analyzing the body of the articles, we found that their dates of publication appear to match the date of publication of the original material. In addition, the images showcased as banners were often renamed into the original titles of the articles they were taken from.

As seen in the second stolen article above, the articles are often paywalled, suggesting that the operatives of franceencolere.fr could be using active news subscriptions, noting that archival copies of the article largely appeared to also be paywalled at the time the impersonation was published.

Lastly, by querying the dataset of extracted articles for keywords for France’s top ten newspapers, the DFRLab found fifty-two articles directly citing seven news outlets in the body of the articles. Of these, fourteen seem to feature the rewriting prompt. The other thirty-eight articles appear to have been successfully rewritten by the LLM.

Cite this case study:

Valentin Châtelet, “Operation targets French snap elections using AI-generated content,” Digital Forensic Research Lab (DFRLab), July 4, 2024, https://dfrlab.org/2024/07/04/operation-targets-french-snap-elections-using-ai-generated-content/.