RSF's investigation desk has uncovered a vast disinformation campaign led by French media conglomerate Vivendi that directly targets the press freedom organisation.
This statement was originally published on rsf.org on 4 July 2024.
Reporters Without Borders (RSF)’s investigation desk has uncovered a vast disinformation campaign led by French media conglomerate Vivendi that directly targets RSF. The investigation desk was probing into a fake website that used Kremlin-like techniques to discredit RSF when they discovered that the perpetrators were nowhere near Russia. The website’s origins were traced to a company located in the center of Paris, operating from the offices of Vivendi, a media group run by the family of French billionaire Vincent Bolloré, who is credited with helping France’s far-right gain unprecedented power.
RSF has been targeted by the Vivendi group’s media following a historic decision made by France’s top court, the Council of State, on 13 February 2024. The court ordered the French broadcasting regulator, ARCOM, to make CNews, a TV channel owned by Vivendi, comply with truthfulness, independence, and pluralism requirements in French law. The decision was the result of an appeal filed by RSF against ARCOM’s refusal to fully exercise its regulation power over CNews.
The court’s decision is simply the consequence of CNews’ disregard for French laws regulating journalistic ethics, including rules that govern the air time allotted to politicians and requirements to cover diverse opinions. Rather than updating their content to adhere to the cardinal rules of journalism, Vivendi was swift to retaliate: programs on CNews and their radio station Europe1 made barbed comments about the court ruling, and the front page of their weekly newspaper Journal du Dimanche portrayed RSF as an enemy of freedom of expression.
The attacks against RSF reached unprecedented heights when the investigation desk came across a fake website that led them to discover an anti-RSF astroturfing campaign orchestrated by Progressif Media, a small company claiming to be a communications agency. RSF discovered that Vivendi is not only a shareholder of Progressif Media, but houses them in their offices, which are located in Paris’ 8th arrondissement.
One week after the court’s historic decision against ARCOM, a website using RSF’s logo and visual identity, and a similar domain name, went live. Named “Sectaires Sans Frontières” (Sectarians Without Borders), the website accused RSF of encouraging the “cataloguing of journalists” and attempting to “modify the French landscape of audiovisual media according to its vision of pluralism.” The page quickly appeared as one of the first results in Google searches for “RSF,” as Progressif Media had paid for a Google advertising campaign. The counterfeit website was designed to mislead readers, and the press contacts listed at the end of the fake press release consisted of two phone numbers that have often been reported for attempted scams.
“Forgery, deception, cybersquatting, trolling, disinformation… The Progressif Média agency uses the full arsenal of today’s worst polluters of public discourse. Hiding behind the guise of a grass-roots movement, the company is conducting influence and disinformation campaigns, such as the one targeting RSF. Does Vivendi – which hosts and is a shareholder in this agency – endorse these methods and actions? Is it helping finance these campaigns at a time when it is currently negotiating the renewal of its channels with the Terrestrial Digital Television in France [TDT, France’s television regulator]? You cannot plead the right to information as a defense before the National Assembly and then be complicit in its deterioration.”
Arnaud Froger, Head of RSF’s Investigation Desk
After a few days of technical investigation, RSF discovered that there was not one, but five domain names using RSF trademarks – making it unlikely that this was an isolated incidence. RSF was able to identify the company managing the domain names, the content delivery network, the name servers, the web host, the web server used and the real IP address behind the fake website.
A multifaceted campaign to discredit opponents
These elements made it possible to quickly trace the origins of the fake website discrediting RSF. The technical characteristics and modus operandi of the fake RSF webpages were very similar, if not identical, to a small group of sites. Two of these sites have inactive domain names referencing Jean-Marie Le Pen, founder of the far-right National Front party. The active domain names include Corsaires de France, a project that directly opposes Sleeping Giants – a group of anonymous citizens that pressures brands to withdraw ads from media disseminating hate speech – and Fan de CNews, which promotes the TV channel and its leading figures on both a website and social media accounts.
“It’s funny to have found that the fake RSF site is actually hosted on the same web server as the Fan de Cnews site. Concealing the IP address of a web server is a technique typically used by certain cybercriminal groups paid by totalitarian regimes. These groups are known to conduct disinformation and even phishing campaigns via usurping domain names, with one main objective: to undermine democracy.”
Nicolas Diaz, Head of Digital Security at RSF
On 20 February, the day before the fake RSF website went online, the Corsaires de France (“Privateers of France”) were the first to use “Sectaires sans frontières” visuals in a tweet. On the same day, a page titled “battle” against RSF” was created on their website, inciting users to post pre-written tweets. On 6 March, a video of a man with a blurred face and modified voice urged people to join the “fleet of privateers” in opposing RSF, who were described as a “handful of political commissioners” seeking to censor CNews. According to RSF’s information, the campaign was sent to more than 16,000 people, an “active community” with very modest results: taken together, their video and tweets received fewer than 1000 direct hits.
This disinformation campaign, which attacks on multiple fronts, was created and executed by Progressif Media. The company was already the subject of an investigation by the French daily Libération for its involvement in multiple projects by far-right groups, including the website of Génération Identitaire, a small group with violent tendencies that was disbanded in 2021. Claiming to provide “the best support to those working towards a more virtuous world”, the company also orchestrates – in a hidden but not necessarily discreet way – influence campaigns that benefit Bolloré’s media group, with which it has very close links.
Vivendi has been a shareholder in Progressif Media since 2022, when it bought 8.5% of Progressif Media’s shares from Zewatchers, an evangelist foundation run by Chantal Barry, a businesswoman known to be close to Bolloré. Barry produced “Bienvenue au monastère” (“Welcome to the Monastery”), a controversial reality TV show broadcast in early 2024 on C8, a television channel, which is owned by the Bolloré family. The celebrities invited to the show’s spiritual retreat were hosted by religious communities that have been repeatedly criticised for cult-like tendencies and sex crimes.
The leaked internal document detailing the campaign
When contacted by RSF, Vivendi replied that it had no comments on the situation, and reiterated that it was just a minority shareholder of Progressif Media. Yet an internal document obtained by RSF, titled “Vivendi Reporting,” outlines the entire campaign against RSF. The document, created by Progressif Media for Vivendi, states that five domain names were purchased to “dominate Google’s ranking” and disseminate a “manifesto on RSF’s sectarianism.” A strategic cyber attack, using a technique known as “typosquatting,” is clearly outlined in the document.
The typosquatting method, which imitates real domain names in order to deceive internet users, is frequently used by Kremlin agents to spread disinformation. Typosquatting is also used by cybercriminals seeking sensitive information, personal data or money. Progressif Media’s tactics are closer to the methods of mercenaries than those of citizen activists.
The document also details the use of “trolling” and “hacking” techniques. To fuel its “counter-campaigns,” Progressif Media claims to have collected shocking information about RSF’s “funding”, “hypocrisy” and “militant bias.” The company’s director, Émile Duport, has remained silent despite being contacted by RSF on numerous occasions. How does he finance his company’s influence campaigns, like the one targeting RSF? Are Progressif Media’s clients aware of these shadowy campaigns and the questionable means used to achieve them?
Watchdog campaigns against Vivendi’s competitors
In addition to the fake websites targeting RSF and Sleeping Giants, at least two other influence campaigns benefitting Vivendi’s interests are currently underway. According to RSF’s information, the first campaign frames CNews as “the only place in favour of freedom of expression,” and the only channel that “won’t let itself be coerced into silence by the dictates of a falsely self-righteous society.” On 23 May 2024, CNews was fined €50,000 for hate speech comments made on air by Geoffroy Lejeune, managing editor of Le Journal Du Dimanche. The day after the fine was announced, the CNews fan account on X (formerly Twitter) launched a petition in support of the news channel. The campaign resembles a grassroots movement but was actually an operation led by Progressif Media, which RSF was able to document.
At a time when CNews’ license with TDT is up for renewal, Progressif Media is stepping up its efforts to rescue the most heavily sanctioned broadcast channel since the start of 2024 (equaled only by C8, its sister channel, which is also owned by Vivendi). It seems no holds are barred for the communications agency, as members of their team have been tasked with watching rival programs – mostly public service programs – and scrutinising the “activist background of their guests.” Yet the fear of being monitored in the same way by ARCOM following the Council of State’s decision prompted CNews presenters, contributors and guests to lash out. As a result, Progressif Media and its “privateers” have filed a series of reports to ARCOM in the past few weeks – to no avail so far.
RSF reserves the right to take legal action.
RSF would like to thank Epieos, Onyphe and Crowdsec for contributing to its cyberthreat analysis toolbox. RSF also thanks the volunteer experts who contributed to the technical research in this investigation.
If you have any related information to share, please contact us at investigation[at]rsfsecure.org.
