#ElectionWatch: Final Hours Fake News Hype in Germany

Bots and trolls push vote-rigging claim ahead of German election

Ahead of Germany’s parliamentary election on Sunday, online supporters of the far-right Alternative für Deutschland (AfD) party began warning their voter base of possible election fraud and calling for observers. On Saturday, the eve of the election, their efforts increased, driven by anonymous troll accounts and boosted by a Russian-language botnet.

@DFRLab investigated some of the claims made and the bots which amplified them.

The probable fake

On the morning of September 22, an apparently left-wing @Twitter user named @von_Sahringen claimed to have been made an election helper, and that as a result, “AfD ballots will be made invalid” — a clear indication of fraud.

The post from @von_Sahringen, archived on September 23, 2017. (Source: Twitter)

The post triggered a swift response from a number of users, including Germany’s official election bureau, which pointed out that election fraud is a punishable offense.

@Wahlleiter_Bund is the official account of Germany’s election bureau. (Source: Twitter)

Four hours later, the same user tweeted that they had been visited by the police and their status as an election helper revoked.

“The police have just been here and said I can’t be an election helper any more.” Archived on September 23, 2017. (Source: Twitter)

By then, the post had triggered a Twitter storm from AfD supporters, using the hashtag #Wahlbetrug (“election fraud”).

“Left-wing pickle @von_Sahringen is already looking forward to being allowed to join the #ElectionFraud.” Archived on September 23, 2017. (Source: Twitter)

The above tweet from user @Hartes_Geld, for example, was shared over 300 times.

However, a quick reverse image search of the @von_Sahringen account suggests that it is a fake account, rather than a genuine user. Its profile picture is a Pakistani actress named Aiza Khan.

Left, profile picture of @von_Sahringen. Right, result of a Google image search for the profile picture. (Sources: Twitter, Google)

Its activity profile is unusual. It was created in February, but, according to a machine scan of its posts, only began posting high quantities in August, in the build-up to the election.

Machine scan of posts from @von_sahringen.

The activity indicates a high likelihood this is a fake account pushing a message to provoke a reaction from the far right, and, potentially, to call the legitimacy of the election into question.

A definite botnet

The #WahlBetrug hashtag was used by AfD supporters throughout the last week of campaigning, but it showed a sudden spike on Saturday afternoon, the eve of the vote. @DFRLab conducted a machine scan of traffic on the tag.

Machine scan of the #Wahlbetrug hashtag, showing the late spike.

The scan shows that the traffic was not organic, but boosted by a network of automated “bot” accounts which operates largely in Russian, and which @DFRLab previously identified in an our #ElectionWatch coverage.

On Saturday, one #Wahlbetrug tweet from an account called @RenateBiller was especially boosted by this network. Posted at noon, it had achieved over 500 retweets by the evening.

“If they stay in power, then there will be civil war in five years.” Archived on September 23, 2017. (Source: Twitter)

This is a spectacular result, since @RenateBiller was created on September 9 and only had 16 followers by September 23.

Profile page for @RenateBiller, showing creation date and number of followers. Archived on September 23, 2017. (Source: Twitter)

The tweet was amplified by a large number of Russian-language accounts, many of them faceless, a key indicator for bots.

Results of a machine scan of retweets of the post from @RenateBiller. Note the number of faceless accounts, the Cyrillic names and the account “Bot Naktrutka”, which also featured in our earlier post.

The accounts which amplified @RenateBiller’s tweet had a number of other indications of being a network of bots. Many were faceless; they posted a range of commercial and pornographic content in Russian and English, as well as pro-AfD posts and attacks on Russian anti-corruption campaigner Alexey Navalny.

Diagnostically, some of the tweets this botnet shared were also shared by a botnet identifed in one of our earlier posts on German elections, such as this ad for Finnish heated floors and complaint about a Moscow surgical clinic.

Retweets from the account @eeeeeee32582717. These also feature in our earlier post, and are diagnostic of this botnet. (Source: Twitter)

This is, in fact, the same Russian-language botnet which amplified calls for AfD election observers on Friday. Its continued amplification of the far-right messaging suggests either that the bot manager is an AfD supporter, or that AfD supporters have paid for a Russian botnet to amplify their messaging.

Warning of fraud

More generally, AfD supporters took to social media on Saturday to predict election fraud.

“There are rumors going about that, no matter how high the result for AfD is, the final count will only give them 9.8 percent!” Archived on September 23, 2017. (Source: Twitter)
“Anything which puts the AfD under 10 percent tomorrow, I’ll count as #ElectionFraud.” Archived on September 23. (Source: Twitter)

This was not limited to bots and troll accounts: official AfD accounts attached to the party’s regional chapters shared content raising the same possibility.

AfD chapter in the Saalekreis, for example, shared a post from anti-migrant magazine Compact calling supporters to gather on Sunday at 2pm local time to watch the counting of postal votes.

(Source: Facebook)

The same chapter shared a post from anti-migrant activist Jürgen Elsässer, whose blog is featured on the Compact magazine website, together with an appeal headlined, “FINAL PHASE — MOBILIZE, ACTIVATE!”.

Facebook post from AfD Saalekreis. Archived on September 23, 2017. (Source: Facebook)

Elsässer’s post read:

This is the last possible hope for our future, for our children, for our Fatherland. Drag all non-voters and undecideds along, set up car pools and a pick-up/ drop-off service for old people, the sick, mobility-reduced and fragile people! Show what the people is capable of, something that the money-mad gluttons in the elite would never manage! Take your right to election monitoring seriously, to prove and prevent the greatest election fraud!

The AfD chapter in Osnabrück, meanwhile, shared a call for its members to:

…monitor the counting as an election observer, and then go to the election party. We don’t want our votes to disappear all of a sudden.
Facebook post from AfD Osnabrück. Archived on September 23, 2017. (Source: Facebook)

Comments from the fringe on the eve of the German election took various forms, including official posts, posts from probable fake accounts, and bot amplification. While no evidence of fraud was presented in the posts, the narrative they all spread is the same: the AfD is in danger of election fraud, and its members should be on the alert to prevent it.

This behavior seems pitched to increase tensions, not least in the polling stations and counting areas. Should the AfD fail to perform well at the urns, it is likely to lead to online accusations of election fraud, potentially undermining the legitimacy of the vote.


Maks Czuperski is the Director of the Digital Forensic Research Lab (@DFRLab) and Special Advisor to the President at the Atlantic Council. Ben Nimmo is Senior Fellow for Information Defense at @DFRLab.

Follow the @DFRLab’s #ElectionWatch series and share your tips.

One clap, two clap, three clap, forty?

By clapping more or less, you can signal to us which stories really stand out.