Overview
Since 2016, Proofpoint researchers have examined spam email volumes related to major elections in the United States, France, the UK, and Germany. In each of these cases, higher volumes of spam associated with a particular party or candidate were correlated with positive outcomes in the election. Now, in advance of the US midterm elections on November 6, we found that, once again, “Trump” dominates election-related spam subject lines. While more general terms like “Republican” and “Democrat” appeared fairly frequently, “Cruz” and “Pelosi,” were the most common high-profile surrogates for their respective parties in spam subject lines. Not only has the volume of email messages with election-related subject lines increased as voting day nears, but it appears that incumbents, with their associated name recognition and strong brands -- whether positive or negative -- continue to dominate email spam subject lines.
Methodology
High-profile, nationally recognized candidates are less common in midterm elections than in Presidential election years. As a result, we generally relied on searches in our spam filters for party names, frequent surrogates, and the highest profile US Congressional races. Beginning September 27, we analyzed subject lines and email bodies for the following terms:
kamala
ocasio
pelosi
cruz
trump
kobach
romney
desantis
giuliani
sessions
midterm
democrat
republican
election
mid-term
We also searched for the last names of each candidate running in US Congressional races regardless of national profile; these searches resulted in only a handful of spam messages and were discarded for analyses.
Finally, we searched within the spam subject lines returned by the search above for the terms “clinton” and “obama” and began specific searches across our spam systems for these two terms on October 26 as we saw many occurrences of the names in the searches above and both figures emerged more publicly in the run-up to the election. As these searches were started later in response to emerging data trends, we present the data separately; occurrences of “clinton” and “obama” presented in the initial analyses did not trigger capture of the spam messages but were applied after the fact to determine how frequently they appeared alongside the other search terms.
Results
A closer examination of the data reveals that, in all of our filters, regardless of the specific key words, the term “trump” dominated spam subject lines. In political party-related searches, “trump” appeared 4.6 times as often as the next nearest term, “democrat”, and 10% more often than all other search terms combined.
Figure 1: Comparison of the frequency of subject line search terms to the median frequency across all searches.
Among high-profile candidates, only “Cruz” and “Pelosi” were above the median number of references in email subject lines.
Figure 2: Relative mix of top search terms in election email spam
Figure 3: Indexed relative daily volumes of spam subject lines referencing top party-related terms
Midterm elections are frequently regarded as a referendum on the sitting President, regardless of the other candidates on the ballot. As Figure 3, shows, the centrality of “trump” as a brand and driver is reflected in the volume of spam emails. As our previous studies have shown, spam campaigners understand the value of brands, and for spam as for ballots, and whether for or against, the election is all about Trump.
Figure 4 shows daily volumes associated with Democratic party candidates and top surrogates. However, superimposing results for “Trump” taken from email subject lines in this subset of election-related spam reinforces the relative importance of the Trump brand to spammers.
Figure 4: Indexed relative daily volumes of spam subject lines referencing top terms associated with the Democratic party; “Trump” included for reference
Figure 5 tells a similar story, with “Trump” dominating results relating to his own party.
Figure 5: Indexed relative daily volumes of spam subject lines referencing top terms associated with the Republican party
It is worth noting that during this period we also observed a general increase in social media spam. In the runup to the elections from August through September, overall social media spam volumes increased by over 200%, with roughly 5% of all spam consistently focused on political topics or leveraging political accounts and pages. Figure 6, for example, shows work-from home spam responding to political accounts.
Figure 6: Work from home spam links posted to political social media pages
Figure 7, on the other hand, shows indexed levels of user-reported spam from GSMA's spam reporting system. These are manual reports generated by a user, usually by forwarding a message to 7726 (S P A M on a phone keypad).
Figure 7: Daily counts of user-reported spam from the GSMA reporting system
While these are not specifically screened for political content, we can observe an overall increase in mobile text message spam in the weeks approaching the midterm elections. This suggests an element of both voter fatigue with received messages as well increased volumes. Anecdotally, we know that high volumes of political SMS messages are accompanying this election cycle.
Conclusion
As we have repeatedly found in recent elections -- and more generally in the spam landscape -- spam actors rely on strong brands to generate clicks. Whether these brands are popular or polarizing, spammers include them in subject lines, email bodies, URL landing pages, social media comments, and more to drive clicks and eyeballs, even if the actual spam or affiliate pages are completely unrelated to politics.
Perhaps more importantly, spam provides insight into the potential “incumbents’ advantage,” where name recognition translates to strong brands. These brands, then, are accompanied by massive spam volumes. Even in the 2016 Presidential elections, Trump-themed spam appeared 9 times more often than Clinton-themed spam at its lowest point, again reflecting brand strength that often defied election polling. It remains to be seen whether brand strength and associated spam volumes will be similarly reflected in results on November 6.
Subscribe to the Proofpoint Blog