On April 19, four days before France’s presidential election, French nationalist leader Marine Le Pen’s self-declared biggest fan in Russia — Maria Katasonova — launched what she referred to as a Twitter “flash mob” under the hashtag “#dislikeMacron”.

The term refers to Le Pen’s chief rival for the French presidency, centrist Emmanuel Macron.

The same day, Le Pen’s supporters in France launched a separate hashtag drive. This focused on their candidate’s apparently softer side by highlighting her reported love for animals, under the hashtag #MarinePourNosAnimaux (“Marine for our animals”).

Despite persistent concerns over potential Russian interference in the French election, digital forensic research shows that the French hashtag drive was far more successful than the Russian one. How did the two hashtags emerge and spread, and what was the difference between them?

Katasonova is a Russian nationalist commentator on Twitter. As of April 20, she had just over 30,000 followers; her pinned tweet, posted in November 2016, features Le Pen, US President Donald Trump, and Russian President Vladimir Putin with the caption, “Three politicians that will bring peace to the world.”

She has not tweeted in praise of Trump since late February, perhaps mirroring broader Russian disillusionment with the US president.

On April 19, she encouraged fellow Twitter users to take pictures of themselves giving Macron a thumbs-down in protest at his image dominating the news and billboards. She posted her tweet at 14:45 UTC, calling on Twitter users in French to “join us!”.

The hashtag was not an instant success. Between 14:45 and 16:00, it was only posted 58 times. However, then Russian media began to push it. Online outlet Vzglyad ran an article on it, in Russian, tweeting it at 15:55 UTC.

Russian media outlet Life.ru, a broadcaster with a long history of anti-Western reporting, gave it a further impulse with an article titled “#DislikeMacron. Katasanova launched a flash mob against the politician’s hysterical campaign.”

Life.ru interviewed Katasanova, who said that she had been in France the week before, and accused the mainstream media of giving Macron unfair support.

Le Pen has repeatedly made such a claim; Kremlin outlet Sputnik France has repeatedly amplified her, as the DFRLab has already reported.

Boosted by such reports, the hashtag saw a surge in traffic between 16:00 and 19:00 UTC, although it never reached high volumes. It then dropped off equally sharply, reviving slightly the following morning.

The hashtag started in Russia, but spread to France. According to a scan conducted using Keyhole analytics, a little over 11 per cent of all tweets came from Russia, some 58 per cent came from France and almost 17 per cent came from the United States.

The initial flashmob was driven by a handful of accounts.

According to a machine scan of all tweets on the hashtag until 10:00 UTC on April 20, Katasonova was both the first to tweet the hashtag, and the most active, posting fifty tweets on it; forty-one of these were retweets. The second most active user, @russiaru, posted twenty-nine tweets, all but one of them retweets. The third most active, Vzglyad’s general producer, Konstantin Rykov, posted twenty-one; again, all but one were retweets. In total, the ten most active accounts posted 186 tweets, 14 per cent of all traffic.

@russiaru currently portrays itself as a pro-Le Pen account. However, it has a long history of Russian, rather than French, nationalism.

It was created in 2009, and was initially used to drive traffic towards a pro-Kremlin blog site, russia.ru. According to open source analyst geektimes.ru, russia.ru is owned by NewMediaStars, a holding company owned, in turn, by the same Konstantin Rykov who directs Vzglyad.

The initial hashtag drive therefore appears to have been primarily driven by just two people: Katasonova herself, and Rykov — the latter via the Vzglyad site, his own tweets, and the tweets of russia.ru.

As with so many political flashmobs, the #dislikeMacron drive appears to have been boosted by automated “bot” accounts. This can be established by looking at the broader behavior pattern of the accounts which amplified #dislikeMacron most actively.

The account called @CHRISTINA2A12, for example, was one of the top 50 amplifiers of the #dislikemacron hashtag, tweeting it four times between 19:00 and 04:30. This is a relatively low figure; but in a separate scan of tweets posted by those top 50 amplifiers from April 14–20, @CHRISTINA2A12 tweeted 3,176 times, at an average rate of 453 a day. Of those tweets, 3,122 were retweets, a rate of 98 per cent.

The account’s avatar image is a photo of actress Sandra Bullock, apparently taken from the French edition of Elle magazine. Taken together, this combination of anonymity, activity, and amplification indicates that this is a bot account.

The same can be said of other top-50 amplifiers. The account @gariondescale posted nine tweets on the #dislikeMacron hashtag on April 20. This account first tweeted on March 18, according to a timed Twitter search; by the evening of April 20, 34 days later, it had posted 10,000 tweets, for an average of 294 a day.

In the sample week of April 14–20, @gariondescale posted 2,566 tweets, or an average of 366 a day. Of those, 1,550 were retweets; hundreds of others were strings of hashtags, including the American #MAGA and the French #Marine2017. This, again, appears to be a largely automated account.

Particularly interesting is the account @rouss_b, which also tweeted four times on the #dislikeMacron hashtag. During the sample week, this account posted 1,660 tweets, of which 1,525 were retweets, a rate of 92 per cent — a strong indicator of automation.

@rouss_b is interesting because it was also one of the most active accounts to mention Kremlin broadcaster RT France in the scan conducted by the DFRLab between February 28 and March 30. In this period, it retweeted RT 93 times and mentioned it a further 33 times.

In all, during the sample week, the ten accounts which were most active on #dislikemacron posted more than 100 tweets a day each. Most showed clear signs of automation, such as @Bougon1337 (1,654 twees in the week, 95 per cent retweets) and @bbdoill (1,512 tweets, 86 per cent retweets).

The account @ClaireFN3, overtly pro-Le Pen, only started tweeting on April 12. By April 20, it had posted 1,849 tweets, at a rate of up to 368 a day:

This account primarily shares news reports from anti-Western outlets including Kremlin broadcasters RT and Sputnik, and Iran’s Press TV. Many of its tweets are linked to a Facebook profile called Claire Langoulant, whose handle is ClarainRussia; some, at least, are identical:

Apparent bots such as these boosted the overall traffic. The timeline of tweets, shown above, is typical of bot intervention, showing a sudden spike and an equally rapid decline.

However, by 10:00 on April 20, the #dislikeMacron campaign had only posted a total of 1,323 tweets, 100 of them from the Katasonova and Rykov accounts. As such, it can be viewed as, at best, a very limited success.

It is worth comparing this Russian flashmob with the simultaneous campaign launched by Le Pen supporters in France on the hashtag #MarinePourNosAnimaux, “Marine for our animals,” which was launched at precisely 16:00 by a coordinated wave of pro-Le Pen accounts.

This hashmob peaked more quickly, and higher. At its busiest, the #dislikeMacron hashtag garnered 20 tweets per minute; #MarinePourNosAnimaux reached over 100. In total, #dislikeMacron was tweeted 1,323 times; #MarinePourNosAnimaux was tweeted 12,845 times, the great majority in the first four hours.

What made the difference? One reason is likely linguistic: the hashtag was in French rather than English, making it more appropriate for a primarily French audience. However, the main difference lies in the skill of the users.

As the DFRLab has already described, Le Pen’s online supporters are a well-organized and coordinated group who prepare large numbers of memes in advance of their hashtag drives, push them from a small number of highly active accounts, and then amplify them with a shell of bots.

The same technique, and the same team, drove #MarinePourNosAnimaux. One of the first accounts to tweet it was @avec_marine, a driver of many earlier Le Pen hashtag spikes. Two associated accounts, @messsmer and @audreypatriote, also drove it, including by retweeting each other. @messsmer, for example, posted it 38 times in the first hour; @avec_marine posted it 21 times.

They, in turn, were amplified by apparent bot accounts. Very quickly after the launch, a number of probable bots already identified by the DFRLab from earlier hashtag drives retweeted at a rapid rate, including @SimonSimon332 and @Dormez_Dormez. They were joined by accounts such as @Heelleclech, a massive amplifier of RT and Sputnik identified in a separate study.

As in earlier hashtag drives, these accounts greatly amplified the initial posts. In the first two hours alone, the account @mamitit31 posted 231 tweets on #MarinePourNosAnimaux; @YanMaes posted 111; @MlpJean posted 103. In total, the top ten users posted 961 tweets on the hashtag in the space of two hours — a rate of one every 7.5 seconds.

The #MarinePourNosAnimaux hashtag drive can genuinely be considered a campaign, one in a long series waged by Le Pen’s partisans. While significantly less effective than some of their earlier ones, which were capable of generating 25,000 tweets in an hour, it showed their hallmarks of preparation, cooperation and automation. By contrast, the #dislikeMacron drive shows every indication of having been unplanned, uncoordinated, and ultimately unsuccessful.

There was some measure of cooperation between the two campaigns. For example, @messsmer, one of the accounts to launch the #MarinePourNosAnimaux campaign, also retweeted Katasonova’s first tweet on #dislikeMacron. Two other accounts, @tartarinmathieu and @mathieu_71xls, posted both hashtags in a single tweet:

However, there is no sign of broader coordination. According to the machine scans, neither @avec_marine nor @audreypatriote — with @messsmer, the main drivers of the Le Pen campaigns — used or retweeted #dislikeMacron. Just three tweets used both hashtags together: the two mentioned above, and one from the probable bot @gariondescale, which included both in a string of hashtags attached to an alarmist story about migration:

Including retweets, only 33 tweets combined the two hashtags. The cooperation between the two Twitter groups therefore appears to have been improvized, rather than planned — and of the two groups, the French one was far more organized.

This is a salutary indication. While much has been written about the danger of Russian interference in the elections, the #dislikemacron drive shows no sign of the large-scale actions of which professional Russian operators are capable (such as the 25,000 bots identified in one study in 2015). It does not even show the degree of professionalism of which Le Pen’s small group of core supporters are capable.

Concerns will continue over the potential for large-scale Russian interference in the French election, especially if Macron — seen as anti-Kremlin — makes it into the run-off vote scheduled for May 7. However, the #dislikeMacron hashtag drive should not be placed in that category.