Listen, organize, shield

1. 1

   April 6, 2016. Emmanuel Macron launches En Marche! with no party and no database, and thousands of local committees open to anyone.

2. 2

   66.1%. On May 7, 2017, Macron beat Marine Le Pen in the runoff; in June, his majority won about 351 of the 577 seats.

3. 3

   300,000 doors, 100,000 conversations, 25,000 questionnaires. The Grande Marche's listening became a public diagnosis and a story for the press.

4. 4

   4 hours. That's how long a team prepared for digital attacks took to answer the leak of 21,075 emails, without breaking the electoral silence.

5. 5

   Listen and publish what you heard, have press and digital-security protocols before the crisis, and write every email as if it will leak.

Copy summary

If you're new to this, start with the fundamentals, from the vote goal to what the research says. Read the fundamentals

The campaign was run by a small core of advisers in their thirties, an electoral-strategy start-up and volunteers. These are the people whose accounts underpin this playbook. Several spoke only later, in books and interviews, and some points are known only second-hand.

• Guillaume Liegey

  Co-founder of Liegey Muller Pons (LMP); ran François Hollande's door-to-door operation in 2012

  Designed the Grande Marche listening operation with the team and explained that the movement started with no database at all and had to collect data directly from voters.

  Sources

• Arthur Muller and Vincent Pons

  Co-founders of LMP; Pons is an economist at Harvard

  Brought to France the door-knocking they had practised on Obama's 2008 campaign; Pons later measured, in a nationwide experiment, the effect of the 2012 visits on the vote.

  Sources

• Ludovic Chaker

  Head of operations and rallies; first secretary general of En Marche!

  Coordinated the roughly 4,000 Grande Marche volunteers in the field.

  Sources

• Ismaël Emelien

  Macron's strategy and communications adviser; later special adviser at the Élysée Palace

  Steered the campaign's strategy and digital work; joked about the switch from Telegram to WhatsApp after the ANSSI warning and, in 2019, wrote a critical assessment with David Amiel in a book and in public debates.

  Sources

• Mounir Mahjoubi

  Head of the campaign's digital team and of its online rapid-response unit

  Trained staff against phishing, made the attack attempts public and led the technical and communications response to #MacronLeaks.

  Sources

• Sibeth Ndiaye

  Campaign press adviser; later head of press at the Élysée and government spokesperson (2019)

  Organised the candidate's trips and dozens of interviews and guarded his image, with a combative style that journalists criticised.

  Sources

• Jean-Paul Delevoye

  Chair of the national nominating committee for the 2017 legislative elections

  Led the screening of about 19,000 open online applications, with interviews, down to the 428 candidates announced on 11 May 2017.

  Sources

• Jean-Baptiste Jeangène Vilmer

  Researcher at IRSEM (French Ministry of the Armed Forces), author of the Atlantic Council post-mortem

  Reconstructed, from interviews and open sources, the timeline of the leak and the 15 lessons of the French response.

  Sources

• François-Régis Chaumartin (Proxem)

  Founder of Proxem, a semantic-analysis start-up

  Processed the Grande Marche’s open answers, which arrived in a spreadsheet of more than 1.5 million words, and warned that mapping frustrations this way can slide into populism.

  Sources

• Christian Dargnat

  Chair of En Marche!’s financing association; former CEO of BNP Paribas Asset Management

  Ran fundraising from the movement’s creation, including a London trip that drew questions in the National Assembly.

  Sources

Paraphrases of interviews and statements by the participants themselves. Short quotes are in quotation marks, translated where needed.

• At the start there was no database. French privacy law doesn't let you buy or copy voter rolls the way US campaigns do, so the information had to be gathered by knocking on doors.

  Guillaume Liegey, Liegey Muller Pons, VentureBeat, "Meet the French presidential candidate who's using the internet to reinvent politics", 8 Jan 2017

• What the firm does is "combining data, digital and human" — coordinating large numbers of people on the ground, not social-media consulting or fundraising.

  Guillaume Liegey, VentureBeat, 8 Jan 2017

• Every week the team received screenshots of all the phishing addresses found; the only way to be ready is to train people.

  Mounir Mahjoubi, head of digital, The Daily Beast, "Fighting Back Against Putin's Hackers", 25 Apr 2017

• The attacks are meant to distract the campaign. "My role in this campaign is to make sure our message goes through."

  Mounir Mahjoubi, The Daily Beast, 25 Apr 2017

Macron was economy minister, with no party and a short political track record. Instead of starting with a programme, he started with a question asked door to door. A year later he was president, and his team had withstood a hack-and-leak attack on the eve of the vote.

300,000

doors knocked in the Grande Marche, with 100,000 conversations and 25,000 questionnaires (summer 2016)campaign figure

66.1%

of the runoff vote against Marine Le Pen, 7 May 2017official

21,075

emails leaked (15 GB) on 5 May 2017, hours before the electoral silencestudy

19,000

open applications for the legislative elections; 428 nominated in the first list, 50% womencampaign figure

Thirteen months

1. 6 Apr 2016Macron, still a minister, launches the En Marche! movement in Amiens, with no party and no database.
2. 28 May 2016The Grande Marche begins: eight open questions, such as "what works in France?". About 12,000 people sign up to go door to door.
3. Oct 2016The diagnosis is presented at three livestreamed town halls, with a 40-page summary and a 176-page analysis. Its keywords start feeding the speeches.
4. 26 Oct 2016ANSSI brings the parties together for a workshop on cyber threats. From December, the campaign detects phishing attempts.
5. Feb 2017ANSSI visits headquarters and warns the team; the core staff swap Telegram for WhatsApp. In April, Trend Micro attributes the phishing to the APT28 group.
6. 23–27 Apr 2017Macron comes first in the first round (24.01%). The campaign refuses accreditation to RT and Sputnik, accusing them of spreading fake news.
7. 3 May 2017Two hours before the final debate, forged documents about an alleged offshore account appear on 4chan. The next day, the campaign denounces a digital disinformation campaign.
8. 5 May 2017Around 8 pm, links to 15 GB of stolen data spread as #MacronLeaks. At 11:56 pm, four minutes before the silence, the campaign issues its statement.
9. 6–7 May 2017The CNCCEP asks the media not to report the content; most wait until after the vote. Macron wins with 66.1%.
10. 11 May–18 Jun 2017428 candidates nominated, half of them women and 52% with no previous elected office. The presidential majority wins about 351 of the 577 seats.
11. 29 Apr 2025Eight years on, France publicly attributes involvement in the 2017 hack to APT28, linked to Russian military intelligence (GRU).

Three layers

Each layer turned contact with people into raw material for the press and for the organization.

• ListeningVolunteers trained in basic interviewing asked the same open questions across the country. The answers (more than 1.5 million words in a spreadsheet) were analysed by the start-up Proxem with semantic software, reviewed, according to the movement, by a group of about 200 experts, and returned as a public diagnosis, before there was a programme.
• The committeesMore than 2,600 local committees that any member could create or join, with local organisers and departmental leads. At the end of 2016 the campaign claimed about 3,000 committees and 400 events a week.
• Shielded communicationA press core that planned every appearance, a digital rapid-response unit and security rules built on the assumption that anything written can leak.

France in 2016–2017 had a strong, regulated national press, strict data law, two-round elections and a mandatory pre-election silence. En Marche! began with no party, no public money and no voter list, and had to build everything from conversations and press coverage.

Platforms

Door-to-door with a questionnaire app

During the Grande Marche, volunteers entered keywords from the answers into an app; a voice-recording app was dropped because street audio was hard to capture and needed transcribing.

Sign-up site (en-marche.fr)

Joining was free and took one click: 30,000 sign-ups within weeks. It produced 'membership' figures widely quoted in the press, and disputed.

National press, TV and radio

In a country where TV and the big newspapers still set the agenda, the campaign planned dozens of interviews, gave access to documentary makers and used magazines such as Paris Match for the image of the Macron couple.

Facebook Live and Medium

Livestreams for the candidacy announcement and to present the diagnosis at three public town halls in October 2016.

Twitter

Where the leak exploded: about half a million tweets with #MacronLeaks in 24 hours, many from American far-right accounts. Outside the small Parisian bubble, the echo was weak.

WhatsApp and in-person meetings (staff)

After the cybersecurity agency's warning, the team left Telegram for WhatsApp; the most sensitive matters were discussed only face to face.

Local conditions

• Data-protection law (CNIL) that prevents buying or copying voter files as in the US: information had to be collected through conversations.
• Two-round presidential election (23 Apr and 7 May 2017), followed by legislative elections (11 and 18 Jun): whoever wins the presidency usually gains momentum for a majority.
• A mandatory electoral silence of about 44 hours, from midnight Friday to 8 pm Sunday: candidates may not make public statements.
• Active independent authorities: the Constitutional Council, the campaign oversight commission (CNCCEP), the broadcasting regulator (CSA) and the cybersecurity agency (ANSSI), which on 26 Oct 2016 held a workshop for all parties except the National Front, which did not attend.
• A recent US precedent: the 2016 hack of the Democratic National Committee put France on alert, and the NSA warned French authorities about Russian activity.
• A political culture largely indifferent to private-life scandals and a population with limited English: rumours about personal life and an English-language campaign fell flat.
• A weakened mainstream-right candidate (François Fillon) and a runoff against the far right, which rallied voters from several camps around Macron.

There was no single manual: the listening came from LMP's experience with Hollande in 2012 and Obama in 2008; the digital defence came from the US lessons of 2016 and from ANSSI.

Three fronts

Listen before you propose

One open question asked of thousands of people, with the same questionnaire, generates your own data, recruits volunteers and gives the press a story about the country.

A narrative with a calendar

Each phase becomes a dated press moment: the launch, the listening, the diagnosis, the programme, the candidates.

Prepare for the crisis in advance

Digital hygiene, weekly training, authorities alerted and a leak statement drafted in advance. When the attack comes, the decision is fast, short and within the law.

The cycle of a campaign phase

From the 2016 listening to the leak response, every phase followed this loop.

1. Ask Define a few open questions, the same for everyone, such as "what works? what doesn't?".
2. Go out Volunteers in pairs, with neighbourhoods chosen from electoral and demographic data, and short interview training.
3. Record Keywords in an app or simple form, with consent for future contact.
4. Analyse Group answers by theme and sentiment; separate what you heard from what you wanted to hear.
5. Report back in public Publish the diagnosis at open, livestreamed meetings, with a short document and a full document for journalists.
6. Convert Every volunteer and every conversation becomes a committee, a task or a contact in the database.
7. Protect Review access, train the team against phishing and update the crisis protocol before each more exposed phase.
8. Evaluate Measure what happened off-screen (how many volunteers are still active, how many committees meet, how many conversations became consented contacts) and only then what the press picked up; fix what failed before the next phase.

And again.

What you need to build something similar for a candidacy, cause or movement: organised listening, a press office with roles and protocols, and simple digital defence. The communications part is written to be used tomorrow.

Part of the method works anywhere; part depended on France in 2017: its independent authorities, its electoral law and a far-right opponent in the runoff. Separate the two before copying.

Choose your country

Pick the moves that fit your context and add them to your kit. Each one works on its own or combined with moves from other playbooks.

1. Doorstep listening before the manifesto

   A few open questions, the same for everyone (what works, what does not), asked on doorsteps by volunteers in pairs, in neighbourhoods chosen with data, with answers recorded with consent. The Grande Marche in summer 2016 covered 300,000 doors, 100,000 conversations and 25,000 questionnaires.

   How to set it up, step by step

   Works when

   It works when you start with no database or manifesto and the law does not let you buy voter files.

   Don't use when

   It fails if listening is just a backdrop: listening without sharing power comes back as criticism, as the strategists themselves admitted in 2019.

   1. Week −50 Write two or three open questions, the same for everyone
   2. Week −48 Choose neighbourhoods by cross-referencing election results and census data
   3. Week −47 Train volunteers in basic interview techniques, working in pairs
   4. Week −46 Record keywords in a simple form, with consent to future contact
   5. Week −44 Go out for weeks, with targets per neighbourhood
   6. Week −40 Group the answers by theme and sentiment

   Team

   • Listening coordinator: writes the questionnaire, picks areas and trains
   • Volunteers in pairs: hold the conversations and record the answers
   • Analysis: groups answers and separates what was heard from what was hoped for

   What to measure: Completed conversations recorded with consent to future contact, per neighbourhood.

   Risks to watch: Data collected without consent breaches GDPR: ask for explicit consent in every conversation and use contacts only for what you promised.

   Add to my kitIn my kit

2. Give back in public what you heard

   Publish the diagnosis at open, livestreamed assemblies, with a short document and a full one for journalists, and turn each phase into a dated press moment. In October 2016, En Marche! presented its diagnosis at three public assemblies, before there was any manifesto.

   How to set it up, step by step

   Works when

   It works when the listening produced real material and the campaign needs a story about the country rather than the candidate.

   Don't use when

   It fails with two big stories on the same day, or if the diagnosis shows only what the campaign wanted to hear.

   1. Week −36 Set the phase calendar: launch, listening, diagnosis, manifesto, candidates
   2. Week −32 Write the short and the full document, with figures and method
   3. Week −30 Schedule the public assemblies and prepare the livestream
   4. Week −28 Brief the press under a clear embargo, one big story at a time
   5. Week −27 Present live and publish the document at the same moment
   6. Week −26 Measure who joined afterwards and fix things before the next phase

   Team

   • Head of press: owns the agenda: which outlet gets what, and when
   • Press officers by beat: follow TV, radio, print, regional and international
   • Analysis: prepares the figures and the full document for journalists

   What to measure: People who, after the presentation, signed up, created or joined a committee, counted through the membership page.

   Risks to watch: Inflating the listening figures destroys credibility: say where they come from, publish the method and never lie to the press.

   Add to my kitIn my kit

3. Local committees open to anyone

   Joining is free and takes one click, and any member can start or join a local committee, with a local organiser and a departmental lead. The movement claimed more than 2,600 committees and some 400 events a week by late 2016.

   How to set it up, step by step

   Works when

   It works when lots of people want to take part and there is no party to fit them into.

   Don't use when

   It fails if membership numbers become the goal: one survey put active members at about 15%.

   1. Week −50 Open the membership page with explicit choices on contact and committees
   2. Week −46 Publish the guide to starting a committee and the local organiser's role
   3. Week −40 Appoint regional leads to support organisers
   4. Week −30 Turn every listening volunteer into a committee, a task or a contact
   5. Week −20 Open one group per committee for events and tasks
   6. Week −8 Count committees that meet, not just those created

   Team

   • Local organiser: convenes the committee and organises events and tasks
   • Regional lead: supports organisers and links them to coordination
   • Contact base: keeps members and committees with consent

   What to measure: Committees that actually met in the month and members who did a task, not sign-ups.

   Risks to watch: One-click joining inflates numbers and the press grows sceptical: publish active committees and active members, and do not sell sign-ups as mobilisation.

   Add to my kitIn my kit

4. A leak protocol written before the crisis

   Basic digital hygiene, a weekly phishing alert, three tiers of communication and a pre-approved leak statement, ready to go out in minutes and within the law. When 21,075 emails were leaked on 5 May 2017, the campaign responded within four hours without breaking the electoral silence.

   How to set it up, step by step

   Works when

   It works for any campaign exposed to attack, especially in the final weeks, when a hack-and-leak does most damage.

   Don't use when

   It fails with decoys and fake documents, which inject forgeries into the public sphere, or if the campaign reacts to every tweet and amplifies the attack.

   1. Week −30 Turn on two-step verification and review who has access to what
   2. Week −26 Set three tiers: logistics by email, confidential encrypted, sensitive face to face
   3. Week −12 Write the leak statement and get it approved by legal
   4. Week −4 Simulate a leak at 8pm on a Friday: who decides, writes and calls
   5. 2 week(s) after In the crisis: H+0 evidence, H+1 decision, H+2 statement
   6. 2 week(s) after H+3 alert regulator and police; H+4 briefing on what is fake
   7. 3 week(s) after Within 48 hours, review what worked and which rule changes

   Team

   • Digital security: accounts, access, weekly alert and evidence of every attack
   • Electoral legal: says what can be said and when, and talks to regulators
   • Spokespeople: two to four people, the only ones who speak on the crisis
   • Documentation: archive of verified facts to take apart forged documents

   What to measure: Team members with two-step verification on and anti-phishing training done, and minutes to the statement in the drill.

   Risks to watch: Hacking back is a crime and accusing without evidence is costly: keep evidence, file a complaint and leave attribution to the authorities.

   Add to my kitIn my kit

The 2016–2017 sequence, condensed into a checklist. There it took thirteen months; adjust the timing to your calendar. Progress is saved in this browser.

A campaign that presents itself as the serious victim of an attack must itself be above suspicion. These rules apply in any country; check local law with a lawyer.

Consent

Collect contacts only with explicit consent and use them only for what was promised. Data protection (GDPR, Brazil's LGPD or local law) applies to campaigns.

Electoral silence

Respect the silence period: no statements, sponsored posts or interviews after the deadline, even under attack.

Money and help declared

Free work by consultants, software and studies are in-kind contributions. Value them and declare them in the campaign accounts.

Real people only

No fake accounts, bots, bought followers or unsolicited mass messaging, not even to respond to an attack. Coordinating real people to say what they think is allowed; what platforms punish is organizing likes, follows or hashtags to game the algorithm. X, for example, bans trading engagement and using a trending hashtag to manipulate the conversation.

Don't hack back

Answering an attack with another attack is a crime. Preserve evidence and file a complaint.

Press freedom

Don't pressure newsrooms privately, threaten or insult journalists. To recall the law, go to the regulator.

Don't lie

Rebut only what is false, and with evidence. A spokesperson who admits being willing to lie to protect the candidate destroys the credibility of every rebuttal.

Accuse with evidence

Don't attribute an attack to a country or person without technical evidence. In 2017 the campaign spoke of a "coordinated operation" and left attribution to the authorities.

Fair accreditation

Public criteria, the same for all. Excluding an outlet is a serious decision: explain it and document it.

It doesn't explain the win on its own

François Fillon's collapse and a runoff against the far right weighed heavily. No study isolates the Grande Marche's effect on the vote; the measured effect of door-knocking comes from Hollande's 2012 campaign.

Listen without sharing power

The listening inspired speeches, but the movement was run from the top. In 2019, after the yellow vests, Emelien and Amiel admitted they paid too little attention to the ground and that decisions could not be imposed vertically.

Members who don't stay

One-click membership inflated the numbers: Libération estimated about 15% of members were active and, by October 2024, the party (by then Renaissance) had about 8,500 dues-paying members.

Decoys and fake documents

The team said it created decoy accounts and fed fake documents to the attackers to waste their time. That mixed forgeries into the public space and fuelled theories that it was all staged. It is not in this toolkit: use technical defence, transparency and the authorities.

A harsh relationship with the press

The head of press called a journalist's article "travail de sagouin" (slob's work) (Le Monde) and said she was ready to "lie" if needed to protect the candidate (Public Sénat); at the Élysée, the team began choosing who travelled with the president. Excluding RT and Sputnik was defended, but Moscow also used it to accuse France of censorship.

Luck and the attacker's mistakes

The attack came late, in English, with crude forgeries and private-life rumours that barely shock in France. A more competent attack, in the local language, would have been harder to stop.

Free help under investigation

Since 2022, judges have been investigating whether McKinsey consultants' free work for the campaign should have been declared as spending; on 6 Nov 2025 the firm's Paris office was searched again. Macron has not been charged and, as sitting president, is protected by the Constitution.

The majority didn't last

The roughly 351 MPs of 2017 fell to 245 in 2022, already short of an absolute majority, and to 159 (Ensemble) after the 2024 dissolution, 86 fewer.

Five questions to confirm the essentials. Each answer comes with an explanation.

Playbook built from interviews and statements by those who ran the campaign, a research post-mortem based on staff interviews, public data and reporting published between May 2016 and January 2026. All pages were opened and read on 26 October 2026; the interviews in Libération, Les Echos, France Info and The New York Times are cited via the Atlantic Council/IRSEM post-mortem.

Updated 26 October 2026