The present report is the result of the cooperation of two intelligence institutes and 135 experts within the past six weeks. Based on the report an influence operation that apparently is originated from the United States has been identified. This operation targeted audiences in France, particularly those involved in recent protests. The operation includes a network of authentic and inauthentic news websites and several huge botnets used to promote and distribute the political narratives in line with the U.S. interests in Europe and France. The influence operation has been attempting to provoke dissidents in France to spread their protests and to portray Macron incompetent to handle what is known as the Gilets Jaunes (Yellow Vest) movement in France. The activity we have uncovered is significant, and demonstrates that while the U.S. government accuses other countries of engaging in online social media-driven influence operations to shape political discourse, the CIA and the U.S. Department of State are doing as such.
Our research shows that the United States has no particular interest in the Yellow Vest movement and the US officials are not directly involved in this movement. The main goal of the CIA and the US Department of State is to fuel the crisis and create uncontrollable disturbances in France to reprimand French President Emmanuel Macron for his actions over the past year. In early July, Macron quickly hit back at Trump’s claim that NATO allies have agreed to increase their defense spending. Macron also put forward the need to create a “real European army” to protect Europe with respect to the threats that originates from China, Russia and even the United States. Macron’s statements about the need for a European Internet to stand against the US online threats and attacks is one of his most critical disputes against the US.
A group of 23 CIA members arrived at Germany a week before the outbreak of the crisis in France. The team includes technical and intelligence experts, information technicians, and social media and network security experts. Except two members of the team who visited the US embassy in Berlin on a daily basis, the other members of the group were based in Beim Fasanengarten 52, 70499 Stuttgart .
Figure 1 maps part of the content promotion connections between the various authentic and inauthentic news sites and social media account clusters managed by the CIA and the U.S. Department of State that we have identified thus far. At the time of publication of this report, we continue to investigate and identify additional social media accounts and websites linked to this activity. For example, we have identified huge number of other botnets supporting Donald Trump and the Republican Party that appear to be part of a broader operation that we do not address here. This report just includes a small part of the wealth of information obtained from analyzing the behavior of the CIA and the Department of State in social networks.
Based on the analysis of our cyber-security team, we assess with moderate confidence that this activity originates from the U.S. government. This assessment is based on a combination of indicators, mostly including the simultaneous linking of social media accounts to the CIA, the US Department of State, and the US Embassies in Germany and France which implies that a meaningful connection exists between them and the Yellow Vest movements and France protests.
Three main categories lead by the CIA are recognized: social media accounts, news and media outlets, and 23-member CIA team. The chart is a general picture of the connections and for each 100-150 accounts, the chart only shows 1 account. So, when 6 accounts are written in a box, it means 600-900 other accounts are active in that section of the operation.
• The CIA manages some social media accounts, in this case twitter accounts, directly or via other groups of accounts managed by the news sources, namely Red Fish, Compact News, Qanon News Network. The main purpose of using these accounts is promoting the pieces related to France protests which are published either by one of the three aforementioned news sources or by CBS, WSJ, and New York Times.
• Having secret connections with some journalists working at CBS, WSJ and NYT, the CIA is able to publish the desired messages for leading the situation in France. For example, the post titled “France’s yellow vest protests are costing the country a fortune” which supports Yellow Vest protesters was published by CBS and was liked, retweeted and promoted by many of the accounts mentioned in the botnet clusters. Our investigation team reported that flags and placards that were used in the protest rally in Champs-Élysées were earlier promoted by the CIA accounts.
• Along with gathering information about the ongoing crisis in France, the 23-member CIA team has been working on various social media platforms (Twitter is reviewed here) to distribute the news pieces published under the CIA supervision. The secret intelligence related to this team is explained comprehensively in the appendix C.
• The five affiliated CIA botnets shown in Figure 2 are all connected with the sections managed by the Department of State. These botnets, apparently, work with the Department of State sections to build a stronger net for distributing those messages that the Department of State intends to send to the France protesters based on their own intelligence.
• We have observed inauthentic social media personas, masquerading as American patriot and voters against Democratic Party officials and supportive of U.S. President Donald Trump and Republican Senators.
• The Department of State is involved in this influence operation both through its embassies and social media activities.
• As it was mentioned earlier, the social media accounts affiliated with CIA are all connected with those of the Department of State.
• We have observed that @SMeichtry (Stacy Meichtry) that has previously used inauthentic news sites to facilitate espionage is followed by the US ambassador to France.
• We have identified multiple Twitter accounts directly affiliated with the news outlets, as well as other associated Twitter accounts, that are linked to the US ambassador to Germany. For example, Richard Grenell (@RichardGrenell), the US ambassador to Germany, is connected with the news source in English named Qanon News Network (@realQNN1) which publishes stories in line with the U.S. policies in France and the two blocks of accounts promote the stories (Figure 3). The noteworthy issue is that the block of twitter accounts which is directly connected to the US ambassador to Germany is also connected with the US Department of State.
While the assessment reported here is limited to moderate confidence as influence operations, by the nature, are intended to deceive, the following is the unquestionable finding of our thorough investigation and extensive research that has irrefutable evidence and undeniable documentation:
• There is a meaningful relationship between the views expressed by CBS, WSJ, and NYT and the current events in Paris.
• There is undeniable relationship between the ambassador of the United States to Germany and the accounts attributed to the Yellow Vest.
• The interests of the United States at this time are in line with the increase of crisis and riots in France.
• For the United States, the rise of the crisis is important, and the no particular connection exists between the US and the Yellow Vest leaders.
• The relationship between the CIA and some journalists working for CBS, WSJ, and NYT and also the connection between these journalists and the State Department is decisive.
• The US Department of State’s diplomatic positions and those tweets by Trump related to Macron and France are precisely in accordance with the influence operation activities reported here.
• Our observations indicate that, with the downgrading of the activities of the chart above, a sharp decline in the France protest took place.
Broadly speaking, the intent behind this activity appears to be promoting the US political interests, including anti-European and anti-Macron themes, as well as supporting specific U.S. policies favorable to the CIA and the US Department of State. In the context of the U.S.-focused activity, this also includes significant pro-Trump messaging and the alignment of social media personas with an American pro-Republican identity.