Overview
Proofpoint researchers continue to track election-related spam, uncovering potential correlations between the topics used by spammers, the volumes of spam with specific subjects related to candidates, and the final outcomes of the election. While these correlations do not suggest that spam content influences election results, the relationships do demonstrate that spam actors follow trends and current events closely - perhaps more accurately than pollsters - to capitalize on politics and improve click rates for their email lures.
We have had the opportunity to observe this in three recent or current election cycles: Trump/Clinton (US), Macron/Le Pen (France), and the ongoing UK Parliamentary Elections.
Our first case study involved the Trump/Clinton US Presidential Election.
In the leadup to the US Presidential elections in November 2016, Proofpoint researchers examined both the volume and content of election-related spam associated with each candidate. Although the exact mix of spam varied, junk email messages specifically mentioning Donald Trump vastly outnumbered messages mentioning Hillary Clinton or both candidates -- and based on this disparity, we questioned the reliability of the polls that regularly showed Hillary Clinton in the lead, and ultimately saw our predictions validated when Donald Trump won the election.
Our second case study involved the French Presidential Election.
In 2017, Proofpoint researchers compared spam volumes associated with Emmanuel Macron and Marine Le Pen (Figure 3). While the disparities between spam volumes mentioning each candidate were not as extreme as those observed in the US election, trends showed the clear drop in poll numbers for third-party candidates, the resurgence of Le Pen, and the narrow Macron margin heading into the first debates. Messages featuring Emmanuel Macron also dominated in the weeks before the election that saw Macron win decisively.
Now, election-related spam in the UK is following trends that we first observed in both US and French elections:
- Close correspondence between spikes in spam Subject line keywords and major election events
- Strong relationship between opinion polls and relative spam volumes associated with each candidate
Whether spam volumes ultimately predict the results of the June 8th Parliamentary elections in the UK remains to be seen, particularly because elections in the UK are for Members of Parliament instead of specific candidates for Prime Minister. This will test our methodology, which focuses on the occurrence of the names of party leadership, and therefore the likely Prime Minister that Parliament will select after the election.
Analysis
Looking back at key charts and metrics from our analysis of election-related spam in the 2016 US election, we see these same relationships playing out over several months. The first thing to note is the overwhelming presence of Trump-related spam versus spam using lures featuring just Hillary Clinton or both candidates (Figure 1).
Figure 1: Percent of total US election-related spam for Trump, Clinton, and both candidates
At the time we concluded that both the strength of Trump’s brand and its polarizing nature allowed spammers to drive clicks regardless of whether Trump-themed lures were positive or negative.
Figure 2 shows spikes in election spam that correspond to major events related to the election such as televised debates and national political party conventions.
Figure 2: Spam volume trends by candidate for July-October
Likewise, we conducted a similar analysis at several points prior to the French presidential elections. We first examined spam with French election lures at the end of March and, based on the upward trends in Macron-related spam (Figures 3 and 4), predicted that Macron would win the May 7 runoff election.
Figure 3: Rolling average of spam featuring at least one of the three French presidential candidates during March 2017.
Figure 4: Relative spam volumes featuring the three French presidential candidates in March 2017
A post hoc look at aggregated traffic statistics for all messages featuring the three candidates up to and through the runoff election confirms a relationship between email volumes and election outcomes (Figure 5). While we are not suggesting causation or quantifying correlation, having only observed this relationship over two elections, both the US and French presidential elections support the notion that spam actors use the strongest brands among candidates to tailor lures according to public opinion.
Figure 5: Overall relative message volumes for email featuring the three French presidential candidates in April and May 2017
Currently, the UK elections are providing further insight into the relationships between news cycles, campaign and world events, and spam that leverages election themes to convince recipients to click. Relative spam volumes continue to follow opinion polls, but other noteworthy dynamics are also in play in Figure 6:
Figure 6: Relative spam volumes in April and May 2017 featuring major UK political parties in the email lures
Note that relative spam volumes associated with all three parties declined dramatically in May, despite the rapid approach of general elections next month. This decline appears to be associated with the complete domination of news cycles worldwide with news about the Trump administration. Figure 8 shows the relative increase in spam featuring Trump-related lures between the May 3 and May 8 spikes in Figure 6. during this same period. With just over one week until the general election, however, the spam volumes featuring both major parties are beginning to increase again. Legitimate emails, however, which are included in overall volumes reflected in Figure 7, remain relatively low given the indefinite suspension of campaigning following the Manchester bombing on May 22.
Figure 7: Overall relative traffic volumes, including both spam and legitimate email, in April and May featuring major UK political parties
Figure 8: Relative volume of Trump-themed spam in April and May 2017
More important, though, is the obvious alignment with ongoing opinion polls. In the UK, the Telegraph tracks poll data, which, when plotted, corresponds closely with the higher volumes of spam associated with the Conservative party (Figure 9):
Figure 9: Opinion poll data (data obtained from http://www.telegraph.co.uk/news/0/general-election-latest-polls-odds-tracker/)
As with spam we observed in the runup to the US elections, UK election-themed spam is often just clickbait for scams or unrelated sites (Figure 10).
Figure 10: Scam donation email that appears to be from the Labour Party
In other cases, they are using white text on a white background to include election-related words that will help bypass spam filters (Figure 11):
Figure 11: Hidden text (highlighted in blue) featuring election-related text attempting to bypass spam filters
Conclusion
Spam actors have long used current events, noteworthy trends, and strong brands to drive clicks on the emails they send. Holidays, the Olympics, presidential elections - all of these and much more are fodder for spammers looking to conceal the true nature of bogus emails, phishing schemes, work-from-home offers, and a myriad of other scams clogging inboxes worldwide. The recent election campaigns in the United States, France, and the UK, though, have provided particular insight into the ability of spammers to track trends and events.
As with most things, causation and correlation are difficult to differentiate without extensive historical data. However, spam volumes do appear to have predictive value in high-profile elections given how carefully spammers apparently track public opinion and align themselves with strong brands. This also speaks to how candidate branding relates to success in modern elections and gives a path for us to further study potential causal relationships between spam and election outcomes. High-volume spam with well-crafted clickbait lures not only reinforce brands through familiarity but address Cialdini’s principles of influence relating to authority and social proof.
The end result is that, at least in the US and French elections, relative volumes of both spam and combined spam and ham emails associated with each candidate provided advance insight into the election outcomes and public opinion. Higher spam volumes for both Trump and Macron were followed by victories by both candidates. We will continue to watch both of the upcoming elections in the UK and Germany to build additional longitudinal data and observe potential cultural effects on the association between spam volumes and election outcomes.