Operation targets French snap elections using AI-generated content

Operation uses AI to rewrite articles to adopt a more ‘conservative stance’

Operation targets French snap elections using AI-generated content

Share this story
THE FOCUS

BANNER: A woman enters a voting booth to vote in the first round of the French parliamentary elections on June 30, 2024. (Source: Reuters/Yara Nardi)

Website forensics and amplification on Telegram indicate a campaign targeting France’s snap elections could be the latest iteration of a Russian operation dubbed CopyCop, which creates inauthentic news outlets using large language models (LLMs). Recorded Future first reported on Copycop in May 2024.

Following the dissolution of the French parliament in the wake of Europe’s June 9 elections, France held a snap legislative election on June 30, with a second round of voting scheduled for July 9. After the first vote, the French far-right party Rassemblement National was leading, with 34 percent.

On June 26, the DFRLab observed a website impersonating President Emmanuel Macron’s Renaissance Party, making false claims about awarding “100 euros to citizens voting for Renaissance” during the first round of France’s snap elections. The website was promoted by an inauthentic news outlet that used LLMs to create content. We identified hundreds of articles containing a prompt that requested authentic articles be rewritten to adopt a “conservative stance against the Macron administration” in a likely effort to sway voters’ opinions ahead of the European Parliament and the snap elections. Amplification of the two websites on pro-Russian Telegram channels featured messages that appeared to have been machine-translated into various languages

Website impersonates Renaissance Party, spreads false claim of payment for votes

On June 26, a website using typo-squatting impersonated the Renaissance Party via the website ensemble-2024.fr. The domain ensemble-24.fr appears to have been registered on June 19, according to WHOIS information posted on urlscan.io. The registrant used the apparently false name “Mora Deppen” and listed an address in Paris with an erroneous zip code and a phone number with the prefix for the Haut-de-Seine region (92) instead of the Paris region (75).

Screencap of WHOIS records for ensemble-24.fr from urlscan.io. (Source: @gyron_bydton via urlscan.io)
Screencaps show a comparison of the impersonating website (ensemble-24.fr) and the original website (ensemble-2024.fr). (Sources: @gyron_bydton via ensemble-24.fr/archive, top; ensemble-2024.fr/archive, bottom)

The impersonating website spread a false claim that “the Macron bonus is individualized aid of 100 euros which will be paid to people who vote for candidates of the presidential majority.” The website encourages voters who benefit from social support to vote for candidates belonging to Renaissance.

Screencap of the website’s claim about the “Macron bonus,” with an automated English translation. (Sources: DFRLab via Google Translate and ensemble-24.fr/archive)

Furthermore, analysis of the EXIF metadata embedded in the JPG images of the Renaissance Party candidates on ensemble-24.fr shows that the website’s authors likely stole official images, which are copyrighted by the French parliament. The metadata also still contains the name of the photographer who took the image of Renaissance candidate Jean Lassucq.

Screencap of the candidates listed on the impersonating website. (Source: ensemble-24.fr/archive)
Screencap of EXIF metadata embedded in images for Astrid Panosyan-Bouvet and Jean Lassucq. Squared out in red is information showing the copyright, photographer, and candidate name. (Source: DFRLab via EXIFtools)

Forensics points to Russian footprint

The DFRLab found the use of Cyrillic script while investigating the website’s source code. The code, which appears to render comments in the body of the page, features the Cyrillic letter “с” in lieu of the Latin “c,” reinforcing the idea that the website could have been developed by Russian operatives.

A screencap of ensemble-24.fr’s source code showing a Cyrillic letter, highlighted in orange. (Source: @gyron_bydton via urlscan.io)

In addition, the metadata embedded in the image file “1-banner.jpg”, which featured the text, “Come on June 30 and receive 100 €,” shows that the file was originally created on June 26, 2024, and indicated GMT+2 as a time zone. While this remains speculative, this time zone is consistent with the time zone of Russia’s exclave Kaliningrad.

A banner embedded in the website’s source code with the slogan “For the Republic, come on June 30 and receive 100 €.” (Source: ensemble-24.fr/archive)
Screencap showing the creation date of the banner image, featuring the GMT+2 time zone. (Source: @gyron_bydton via metadata2go)

On Telegram, various messages, seemingly machine-translated into English, German, and Spanish, spread sensationalist claims with a link to ensemble-24.fr and an article by franceencolere.fr (France in anger) that promotes ensemble-24.fr. The first iteration of the message appears to have been posted by the pro-Kremlin outlet Slavyangrad. The website was also quoted in a tweet by pro-Russian French influencer Adrien Bocquet on X.

Screencaps of three messages featuring almost identical content with links to ensemble-24.fr and franceeencolere.fr.
(Source: @gyron_bydton via Telegram; Slavyangrad/archive, left; Ubersicht Ukraine/archive, middle; Irinamar_Z/archive, right)

Using the WordPress REST API, the DFRLab found that the majority of the 5,486 articles posted on franceencolere.fr were actually reposts from the now-defunct Russian-sponsored disinformation website infosindependants.fr. The code obtained from the articles shows hyperlinks that point to infosindependants.fr, although the website was deplatformed.

A screenshot of the JSON code of a WordPress article by franceencolere.fr showing a direct link to infosindependants.fr. (Source: @gyron_bydton via franceencolere.fr/archive)

In a May 2024 report, Recorded Futures found that infosindependants.fr is likely an iteration of the Russian-sponsored Doppelganger operation, spreading misleading content and disinformation in French using LLMs. The domain was flagged among hundreds of others for using LLMs to “weaponize AI for influence.”

The DFRLab extracted the entire article database of franceencolere.fr as of June 26 and found that it had published at least 237 articles exhibiting prompts, indicating the likely use of an LLM to generate articles. The body of more than two hundred articles contains direct prompts in French stating: “Please rewrite this article taking a conservative stance against the Macron administration’s liberal policies in favor of working-class French citizens.” It is also possible to retrieve the articles using the website’s search engine. Most of the articles featuring this prompt were published in February and March 2024.

Screencaps of two articles posted on franceencolere.fr that include a direct prompt to generate the article. (Source: @gyron_bydton via franceencolere.fr/archive, left; franceencolere.fr/archive, right)

In addition, the DFRLab found that the rewriting prompt appeared together with unedited copy pasta articles that the website operatives appeared to have stolen from authoritative news outlets without properly sourcing them. The prompt, which apparently was not consistently executed properly, exposes the process of copying genuine articles and transforming them using AI to sway readers’ opinions toward a more “conservative stance.”

Screencaps showing a comparison of the stolen article (left) and the original material posted by French news outlet La Croix (right) on March 29, 2024. (Sources: @gyron_bydton via franceencolere.fr/archive, La Croix/archive)

In another instance, the DFRLab found that articles posted after the first round of elections on June 30 contained the opening sentence, “Here is a short title for the article …” indicating that the operatives of franceencolere.fr used LLMs to rephrase titles, albeit unsuccessfully. These articles did not feature in the original dataset that the DFRLab extracted on June 27 and appeared starting June 30.

Screencaps of articles posted on franceencolere.fr. (Source: @gyron_bydton via franceencolere.fr/archive, left; franceencolere.fr/archive, middle; franceencolere.fr/archive, right)

Analyzing the body of the articles, we found that their dates of publication appear to match the date of publication of the original material. In addition, the images showcased as banners were often renamed into the original titles of the articles they were taken from.

Comparison of the article banner on franceencolere.fr, at left, and the original articles, at right, retrieved using the image names, squared out in red.
(Sources: franceencolere.fr/archive, top left; Le Figaro/archive, top right; franceencolere.fr/archive, bottom left; Le Figaro/archive, bottom right)

As seen in the second stolen article above, the articles are often paywalled, suggesting that the operatives of franceencolere.fr could be using active news subscriptions, noting that archival copies of the article largely appeared to also be paywalled at the time the impersonation was published.

Lastly, by querying the dataset of extracted articles for keywords for France’s top ten newspapers, the DFRLab found fifty-two articles directly citing seven news outlets in the body of the articles. Of these, fourteen seem to feature the rewriting prompt. The other thirty-eight articles appear to have been successfully rewritten by the LLM.

A pie chart showing the distribution of alleged stolen articles from trusted French news sources. (Source: DFRLab via Flourish)

Cite this case study:

Valentin Châtelet, “Operation targets French snap elections using AI-generated content,” Digital Forensic Research Lab (DFRLab), July 4, 2024, https://dfrlab.org/2024/07/04/operation-targets-french-snap-elections-using-ai-generated-content/.