Far-right groups spread “fake news” on social media to mobilise their supporters for violent protests targeting migrants after the fatal stabbing of a German man, said officials in the eastern German state of Saxony where they took place.

German police have arrested a 22-year-old Syrian man and a 21-year-old Iraqi man over Sunday’s stabbing in the town of Chemnitz, which provoked two days of protests, including clashes between far-right and leftist demonstrators.

The stabbing and the protests have exposed deep divisions in German society over the influx of more than one million migrants, mostly Muslims fleeing Middle East conflicts, after Chancellor Angela Merkel’s decision in 2015 to let them in.

On Tuesday Merkel repeated her condemnation of both the stabbing and the protests, saying scenes – depicted in amateur video clips – of migrants being chased through the streets were completely unacceptable in a state based on the rule of law.

Michael Kretschmer, the premier of Saxony and a close Merkel ally, vowed to deal firmly with extremists in his state, long a hotbed of support for far-right parties.

“We believe that at least some of the calls that were circulated online (to join the protests) were based on false information, on fake news,” he told a news conference in the state capital Dresden.

For example, a report circulated widely on social media that the 35-year-old man who was stabbed had been defending a woman from migrants, adding that there was no evidence to support the claim, Kretschmer said.

Local authorities were bracing for further demonstrations in Dresden and Chemnitz on Tuesday, and German Interior Minister Horst Seehofer said federal police stood ready to provide additional assistance if needed in Saxony.

HITLER SALUTES

Saxony’s interior minister, Roland Woeller, said the protests had drawn far-right supporters and anarchist groups from Berlin, nearby states of Brandenburg and Thuringia and as far away as North-Rhine Westphalia in northwestern Germany.

“We saw a significant mobilisation effect – that means that anarchists travelled from far beyond the region and state borders, especially right-wing violent actors … from the hooligan scene and from the football scene,” he told reporters.

At least five people are facing charges for performing the ‘Hitler salute’, which is banned in Germany, and a comprehensive investigation is continuing, police officials said.

They also said nearly 20 people had been injured in Monday’s demonstrations, where fireworks were thrown.

German security officials are monitoring the situation in close consultation with state officials at a special command centre for combating far-right activism in Cologne, security sources told Reuters.

Many far-right supporters in Chemnitz joined a small but growing party called “Third Way” after a Nazi-inspired group was banned about four years ago. The new party is also under observation by intelligence agencies, according to the latest report by the BfV domestic intelligence agency.

“The fact that we have a Syrian and an Iraqi suspect is no reason – no reason at all – for a general suspicion of all foreign residents,” said Kretschmer.

“We need a jolt in Germany and Saxony. We need broad public support to win this fight.”

Creators of fake accounts and news pages on Facebook are learning from their past mistakes and making themselves harder to track and identify, posing new challenges in preventing the platform from being used for political misinformation, cyber security experts say.

This was apparent as Facebook tried to determine who created pages it said were aimed at sowing dissension among U.S. voters ahead of congressional elections in November. The company said on Tuesday it had removed 32 fake pages and accounts from Facebook and Instagram involved in what it called “coordinated inauthentic behavior.”

While the United States improves its efforts to monitor and root out such intrusions, the intruders keep getting better at it, said cyber security experts interviewed over the past two days.

Ben Nimmo, a senior fellow at the Washington-based Digital Forensic Research Lab, said he had noticed the latest pages used less original language, rather cribbing from copy already on the internet.

“Linguistic mistakes would give them away before, between 2014 and 2017,” Nimmo told Reuters. “In some of these newer cases it seems they’ve caught on to that by writing less (original material) when posting things. With their longer posts sometimes it’s just pirated, copy and pasted from some American website. That makes them less suspicious.”

Facebook’s prior announcement on the topic of fake accounts, in April, directly connected a Russian group known as the Internet Research Agency to a myriad of posts, events and propaganda that were placed on Facebook leading up to the 2016 U.S. presidential election.

This time, Facebook did not identify the source of the misinformation.

“It’s clear that whoever set up these accounts went to much greater lengths to obscure their true identities than the Russian-based Internet Research Agency (IRA) has in the past,” the company said in a blog post, https://newsroom.fb.com/news/2018/07/removing-bad-actors-on-facebook, on Tuesday, announcing the removal of the pages. “Our technical forensics are insufficient to provide high confidence attribution at this time.”

Facebook said it had shared evidence connected to the latest flagged posts with several private sector partners, including the Digital Forensic Research Lab, an organization founded by the Atlantic Council, a Washington think tank.

Facebook also said the use of virtual private networks, internet phone services, and domestic currency to pay for advertisements helped obfuscate the source of the accounts and pages. The perpetrators also used a third party, which Facebook declined to name, to post content.

Facebook declined to comment further, referring back to its blog post.

U.S. President Donald Trump’s top national security aides said on Thursday that Russia is behind “pervasive” attempts to interfere in November’s elections and that they expect attempts by Russia, and others, will continue into the 2020 elections.

They say they are concerned that attempts will be made to foment confusion and anger among various political groups in the United States and cause a distrust of the electoral process.

Two U.S. intelligence officials who requested anonymity told Reuters this week there was insufficient evidence to conclude that Russia was behind the latest Facebook campaign. However, one said “the similarities, aims and methodology relative to the 2016 Russian campaign are quite striking.”

‘PREVIOUS MISTAKES’

Experts who track online disinformation campaigns said the groups who launch such efforts have changed how they post content and create posts.

“These actors are learning from previous mistakes,” said John Kelly, chief executive of social media intelligence firm Graphika, adding they do not use the same internet addresses or pay in foreign currency.

“And as more players in the world learn these dark arts, it’s easier for them to hide among the multiple actors deploying the same playbook,” he said.

Philip Howard, an Oxford University professor of internet studies and director of the Oxford Internet Institute, said that suspicious social media accounts like those taken down this week were once more easily identifiable because they shared the same information from high-profile publications like RT, the Russian English-language news service, or Breitbart News Network.

But now, the content they often share is more diverse and less discernible, coming from lesser known sites, including internet forums that mix political news with other topics, he said.

“The junk news they’re sharing is using better quality images, for example, more believable domains, less-known websites, smaller blogs,” Howard added.

U.S. intelligence agencies have concluded that Russia meddled in the 2016 presidential campaign using tactics including fake Facebook accounts. The Internet Research Agency was one of three Russian companies charged in February by U.S. Special Counsel Robert Mueller with conspiracy to tamper with the 2016 election.

Moscow has denied any election interference.

The French prosecutor’s office launched an inquiry on Thursday into suspicions of fake news being spread to influence Sunday’s presidential vote after far-right leader Marine Le Pen implied her rival Emmanuel Macron held an offshore account.

Macron, favourite to win the presidency, denied allegations of using a foreign tax haven that were made on social media and referred to by Le Pen in an ill-tempered televised debate with him on Wednesday night. He accused her of spreading lies.

After Macron lodged a legal complaint over the allegations, a judicial source said the prosecutor’s office was investigating suspicions that fake news had been intentionally circulated with the aim of swaying Sunday’s voting.

Opinion polls show Macron, a centrist, has roughly a 20 point lead over Le Pen. They see him firmly on course to win after what was widely seen as his solid performance in Wednesday evening’s fractious face-to-face.

French shares and bonds and the euro performed strongly on Thursday, pointing to relief on financial markets that Le Pen had not gained ground with her pledges to quit the euro currency, hold a referendum on leaving the European Union, and print money to finance higher state spending.

It was at the end of the two-and-a-half hour debate, watched by 15 million people, that the National Front veteran insinuated that Macron might be concealing funds on a foreign tax account.

“I’ve never had an account in any tax haven,” Macron told France Inter radio on Thursday. “Le Pen is behind this. She has an internet army mobilising.”

He said she had allies spreading “false information and lies” who were “in certain cases linked to Russian interests”.

Macron’s party has previously complained that his campaign had been the target of “fake news” put out by Russian media, as well as internet attacks on its databases.

That prompted a warning by the French government in February that it would not accept interference by Russia or any other state in the election.

According to a snap poll by Elabe for BFMTV, 63 percent of viewers found Macron the more convincing of the two candidates in Wednesday’s debate, reinforcing his status as favourite to win the Elysee.

A second poll by Harris Interactive said 42 percent of people found Macron more convincing in the debate, during which the candidates traded barbs over the economy, the euro and how to combat terrorism.

Twenty-six percent found Le Pen more convincing, while 31 percent chose neither candidate, Harris said.

An OpinionWay survey carried out before the debate showed Macron widening his lead over Le Pen to 61 percent to 39.

Le Pen’s proposal to bring back the franc while replacing the euro with another, looser type of cooperation in the form of an ECU basket of currencies prompted an unusual foray into politics by French central bank governor Francois Villeroy de Galhau.

“I hear proposals for a dual currency with the return of a national currency in parallel to a European currency. I must say that such suggestions would put confidence in the currency in danger,” he said at a conference.

A small group of protesters threw eggs at Le Pen as she arrived for a campaign event in Brittany on Thursday, shouting “Out with the Fascists!”

Former U.S. President Barack Obama endorsed Macron in a video message released by Macron’s party on Thursday, praising him for appealing “to people’s hopes and not their fears”.

Campaigning on an anti-EU, anti-globalisation platform, Le Pen has sought to portray Macron, a former investment banker and economy minister, as an out-of-touch member of an elite responsible for France’s ills, including unemployment of about 10 percent, low growth and a two-year spate of Islamist violence.

Macron has promised to stimulate growth with training programmes and a relaxation of labour laws, while reducing state expenditure.

CRITICAL FATHER

Le Pen’s father Jean-Marie Le Pen was critical of his daughter’s performance, saying most viewers would probably have found the first part of the debate incomprehensible.

“That may have benefited Emmanuel Macron, but it didn’t work to the advantage of Marine Le Pen, who perhaps lacked gravitas,” the founder of the National Front told RTL radio.

By law, official campaigning must end at midnight on Friday before voters go to the polls on Sunday.

Macron’s camp said that, two hours before the debate started, an anonymous account posted documents on an Internet forum purporting to prove that Macron had an offshore account, and the information was quickly distributed on Twitter.

Macron’s team released a screenshot of what it said was a falsified signature on documents purportedly proving “Macron’s secret tax evasion” as well as a trail of tweets spreading the information.

Le Pen told BFM TV on Thursday that she had no proof Macron had an offshore account, but did not want undisclosed funds to come to light when it was too late.

Macron’s team say his En Marche! party has been the target of attempts to steal email credentials since January.

Feike Hacquebord, a researcher with security firm Trend Micro, said last week that he had found evidence that it had been targeted by a cyber espionage group linked by some experts to the Russian military intelligence agency GRU.

Russia has denied involvement in attacks on Macron’s campaign.