What we saw in the lead-up to the German elections

On Sunday, September 24, Germans took to the polls to vote in Germany’s federal election. As expected, Angela Merkel’s Christian Democratic Union (CDU) party came in first, however the CDU captured only 33 percent of the vote, the party’s worst showing in decades. Meanwhile, the far-right Alternative für Deutschland party (AfD) received over 12.5 percent of the vote, a record showing for a fringe party in Germany.

While the election has wide implications on both sides of the Atlantic, the campaign maintained a distinctly local focus. In a country that prioritizes political stability, each party doubled down on efforts to boost the turnout of existing supporters. One party in particular, the far-right AfD, utilized emotive and sometimes fake messaging on social media to gain an edge.

Throughout the summer, the @DFRLab tracked the Kremlin’s foremost amplifiers in Germany and investigated the international far-right’s online foothold in German politics. In the last week before the election, the AfD’s online efforts ramped up with increased anti-immigration messaging, some of it amplified by automated, Russian-language bots. Although the impact of these activities on the final results remains unclear, @DFRLab’s analysis reveals a demonstrable trend of Russian-language networks amplifying fake messaging.

Vkontakte

An investigation into Russian social media platform Vkontakte (VK) revealed the tactics AfD used in their targeted messaging efforts.

VK, a Russian social media alternative to Facebook, boasts a significant German audience. With 6.9% of VK’s total visitors coming from Germany, it is the 8th most popular website in Germany based on traffic, outranking Twitter, Spiegel, Bild, Whatsapp, and Netflix due to the highly-engaged nature of its user base.

An analysis by @DFRLab in the days leading up to the election showed that 90 percent of the most popular posts concerning the German election on VK supported the AfD. Furthermore, the clear majority of pro-AfD content shared on the platform linked to untrustworthy fringe media outlets rather than established publications.

The analysis shows a significant VK user preference for biased and highly emotive reporting, especially anti-refugee and anti-Merkel stories. For example, one popular article from Anonymousnews.ru shared by the outlet’s VK page attacked Merkel as a war criminal.

The other German political parties have no such presence on VK. The AfD pursues a strategy of micro-segmenting political demographics in its effort to build support for it among the Russian diaspora in Germany, and it often communicates in Russian to do so. Since VK posts from outside Russia appear largely unconstrained by hate speech laws, it has enabled a fringe, highly engaged minority to dominate the space shared by a diverse group of Germans, giving unusual prominence to false reporting and biased news that align with the ideology of one political party.

Fake News and Photoshops

In one example of their emotive, and ultimately fake, messaging in the lead up to the election, AfD affiliates amplified a graphic image on Facebook recalling the mass sexual assaults in Germany on New Year’s Eve in 2016. The image, urging citizens to get out and vote, was shared by a regional chapter of the party.

@DFRLab, in collaboration with Germany’s BILD newspaper, proved that the image was a fake. The heavily edited photo came from an extremist white supremacist source with the apparent intent to manipulate voter perception.

A Google reverse image search of the photo reveals that the image’s background came from footage of CBS News journalist Lara Logan, who was sexually assaulted on Tahrir Square in Cairo on February 11, 2011. Users photoshopped the image, replacing Logan’s head with that of glamour model Danica Thrall.

The meme shared by the AfD accounts falsified the photo, its location (Cairo not Germany), and the date (February 2011 not New Year’s Eve 2016). This was a many-leveled fake designed to stir up anti-refugee and anti-Muslim sentiment. AfD’s use of it just before the election appeared aimed at using that sentiment to galvanize voters.

Further investigation showed that the image initially emerged from the anti-Semitic community in 2015 before pro-AfD Facebook and Twitter pages, including bots and actual representatives of the party, began sharing it.

The AfD’s use of this manipulated photo highlights their focus on galvanizing anti-migrant and anti-Islam supporters ahead of the vote. It also shows the lengths far-right groups will go to produce eye-catching fakes.

Botnets and Election Fraud

Ahead of the elections the AfD also pushed a narrative warning about possible fraud and calling on supporters to volunteer as election observers. Analysis by @DFRLab shows that a network of Russian language-bots amplified such tweets, highlighting yet another link between Russian-associated networks and the AfD.

While this involved a relatively small botnet, the specter of the far-right claiming election fraud was significant, since the AfD could use it to call the legitimacy of the election into question. Furthermore, the incident raised both the possibility of larger-scale claims of election fraud being made in the days after the vote and the possibility that non-German sources would boost any such claims.

The far-right call for election monitors centered on a website called wahlbeobachtung.de (“election observation” in German). The site takes an openly partisan stance and expresses hostility towards Chancellor Angela Merkel. The website draws from EinProzent, an anti-migrant and anti-Merkel website, einprozent.de, which calls itself a “professional resistance platform for German interests.”

Over the past few years, EinProzent repeatedly accused Merkel and her party, the CDU, of tampering with elections, tweeting the “Keep an eye on Merkel’s fingers” slogan as early as September 2016. While marginal in impact, the group’s call for election monitors got picked up on September 20 by a Russian-language botnet that previously propagated commercial and pornographic messages, as well as support for the AfD and attacks on Russian anti-corruption campaigner Alexey Navalny.

Apart from amplifying attacks on Navalny from a single Twitter account and amplifying a politician in Vladivostok, this botnet is not generally politically active. This suggests that unknown users (whether the manager of the botnet or a client) repurposed the botnet to boost political messaging, turning it into a botnet-for-hire.

The botnet’s most aggressive political activity focuses on Germany. The botnet clearly aims to push far-right messaging, including the claim of election fraud. This could either be because it was hired to do so or because of the bot manager’s own choice.

Final Hours of Fake News Hype

The AfD’s warnings about voter fraud only increased as the election drew nearer. On the eve of the election, anonymous troll accounts propagated the claims and the same Russian-language botnet continued to boost them. One such claim of election fraud originated from a tweet by an account claiming to be an election monitor, saying that they looked forward to invalidating AfD votes.

Outraged AfD supports picked up the tweet and began using the hashtag #WahlBetrug (“election fraud”) as a rallying cry. However, the account originating the claim appears to be fake, with a suspicious lack of historical activity and the picture of a Pakistani actress as its profile avatar.

Traffic around #WahlBetrug reached its peak on the eve of the election.

A machine scan showed the inorganic nature of the traffic, revealing that the same network of automated Russian-language “bot” accounts that previously amplified calls for election monitors around the EinProzent campaign also boosted the traffic of these election fraud claims.

More generally, AfD supporters took to social media on Saturday to predict election fraud. In addition to bots and troll accounts, official AfD accounts attached to the party’s regional chapters shared content raising the same possibility.

Comments from the fringe on the eve of the German election took various forms, including official posts, posts from probable fake accounts, and bot amplification. While the posts offered no evidence of fraud, they all spread the same narrative, that its members should be on the alert to prevent attempts to defraud the AfD of votes; a narrative the party could readily use to discredit the election results if they wished.

Conclusion

Any foreign effort to influence the German elections was more discreet than other recent and highly publicized efforts, like persistent efforts in the United States’ 2016 elections or the #MacronLeaks in recent French elections. However, this should hardly grant us confidence to conclude efforts to influence local voting populations in Germany didn’t exist. They did.

Information operations are designed to capitalize on and exploit existing vulnerabilities or social rifts. Elections are designed to discuss and decide the direction and leadership of a country, and — many times — that process exposes social rifts. The far-right AfD is exemplary in this regard.

Although the impact of Russian-language amplification of aggressive and sometimes fake AfD messaging on the final election results in Germany remain unclear, the correlation of far-right messaging and foreign amplification is very clear.

@DFRLab will continue to monitor online narratives and events surrounding the vote and the activity of possible botnets and other instruments of influence. Follow along with #ElectionWatch.

A @DFRLab staff report. Follow along for more in-depth analysis from our #DigitalSherlocks.

Follow the @DFRLab’s #ElectionWatch series and share your tips.