Annulled last year due to foreign interference, the re-run of Romania's presidential elections continues to be overshadowed by concerns over opaque affiliations, cyberattacks, and coordinated online campaigns. The far-right candidate scored 40.96%.
Romanian presidential elections were annulled in 2024 on claims of foreign meddling. Strong evidence of online coordination actions with content originating from Russia were revealed by a report of the British think-tank Foreign Policy Centre (FPC), which used Osavul, an AI-powered information threat detection software, to analyze over 3,500 messages which circulated in the nullified elections period, across platforms like Telegram, Facebook, X (formerly Twitter), and YouTube (Martinescu et al., 2024). The report found that most content originated from Russia or affiliated actors, including state-owned media such as RT and Sputnik. In the re-run elections, new evidence brought by PROMPT project suggest that the coordinated behaviour continued in the online environment, contributing to an unprecedented extremist wave, in which the far-right politician George Simion scored 40.96% in the first round, on May 4th, 2025.
What happened in the re-run? Coordination and astroturfing, identified
As part of the PROMPT Project, researchers at the University of Urbino analyzed 45,272 Facebook posts from 1,454 accounts between 17–24 April 2025. The analysis, using large language models (LLMs), was based on actor lists compiled by AI de noi, a volunteer network monitoring policy-violating content such as fake accounts, AI-generated images, and emotional manipulation.
The findings showed that most posts prioritized emotionally charged, clickbait-style content over factual reporting. Many included AI-generated images and focused on topics like tragic personal stories, celebrity news, public health fears, and nationalist nostalgia—often apolitical in appearance but containing implicit political cues. The content largely diverged from the actual news agenda. Other relevant datasets, such as Martinescu et al. (2024), are under further analysis within PROMPT.
Meta defines coordinated inauthentic behavior (CIB) as campaigns manipulating public debate across platforms (Meta, n.d.). A typical CIB tactic is astroturfing—simulating grassroots support—used by actors with vested interests (Chan, 2022). Chan describes it as “a problem beyond disinformation,” with growing risks to democratic integrity.
The Romanian case highlights how algorithmic targeting, emotional appeals, and coordinated distribution can distort public discourse and undermine electoral processes.
Evidence of Coordinated Inauthentic Behavior in Romanian Facebook Networks (2025 Elections)
In the context of Romania’s 2025 presidential elections, a network analysis of 1,489 Facebook posts, researched by PROMPT, revealed patterns indicative of coordinated inauthentic behavior (CIB). These posts were disseminated by 21 distinct Facebook accounts, several of which exhibited strong evidence of connected vertices - a term in network analysis that refers to nodes (accounts) linked through synchronized activity or content similarity. For example, three accounts - România Eternă, România Modernă, and România Autentică - published an average of 149 posts circulated in the analyzed months within a 9.3-second window, an anomaly that points to either automated behavior or centralized control (a defining characteristic of this behavior was the near-simultaneous posting of identical or highly similar content).
The images of children, adults or elderly people, alone in a courtyard from rural areas, with a birthday cake, saying that they are alone and sad, come to amplify the theme of fragmented families. DiResta and Goldstein (2024) identified several methods by which spammers and scammers leverage AI-generated images on Facebook to grow their audiences. A common technique involves posting unlabeled AI-generated images accompanied by captions such as "This is my first cake! I would be glad for your marks" or "Made it with my own hands," which explicitly solicit comments and engagement. The aim is twofold: to increase audience size and to inject false information into political discourse.
Romania has the largest community of Diaspora people in Europe, 5.7 million, according to official statistics (Pop, 2025). Some other posts follow the news of the day, in a clickbait style and mainly linking to the website romaniaculturala.eu, with shocking images of accidents, fires, storms, deaths and links in comments where, if clicked, anti-virus softwares warn of phishing. In intense political times, the pages are flooded with political topics (mostly linked to the website romaniaculturala.eu), praising George Simion, Donald Trump or posting the prediction of a horoscope lady saying who will win the presidency.
As to give an idea about the metrics, România Eternă has 116K likes and exactly 116K followers, România Autentică has 133K likes and 132K followers, while România Modernă has 115K followers and 0 accounts following, and no likes indicated.
The post on the nationalist AUR leader, George Simion and his mother is distributed within seconds by three accounts. Source: Meta Library, Prompt research, 2025]
Qualitative Content Analysis
Content-wise, the accounts displayed similar aesthetic and narrative strategies. Posts often featured emotionally evocative scenes: children, elderly individuals, and isolated citizens celebrating birthdays alone - imagery designed to appeal across age demographics.
However, in the days surrounding the election (May 4th), content shifted abruptly from general cultural or emotional posts to overt political messaging. New themes included: praise for international figures such as Donald Trump and Elon Musk, amplification of the U.S. Visa Waiver exclusion of Romania, the announcement made public just before election day, Pro-Georgescu narratives and anti-EU themes.
This abrupt thematic shift, paired with coordinated timing, further supports the hypothesis of strategic manipulation designed to influence voter behavior in the final stages of the campaign.
The analyzed posts show “a clear right-wing populist and nationalist bias, especially in their treatment of political actors”, according to the analysis coordinated by the University of Urbino, in the framework of PROMPT project. Key characteristics include messages against the parties of the ruling coalition, the social democrats and the liberals, and messages against the Romanian president, Klaus Iohannis (Dec. 2014 - Feb. 2025). Nevertheless, other posts on these pages showed strong support for AUR (Alliance of Union of Romania) and its leader George Simion, euroscepticism, and a broader populist anti-elite discourse.
Although many of the analyzed posts appeared unrelated to politics at first glance, they frequently contained implicit or explicit political messaging, either criticizing certain parties or endorsing others. For instance, some posts targeted the ruling Social Democratic Party (PSD) with statements such as: “PSD is doing what it does best again: it makes promises and then mocks the people” and “The thieves from PSD have destroyed Romania. Stop voting for the red mafia!” These examples reflect a strong anti-PSD sentiment, consistent with right-wing nationalist and pro-AUR positions.
Some posts offered direct support for the far-right Alliance for the Union of Romanians (AUR) and its leader, George Simion: “AUR is the only voice telling the truth! The rest of the parties are in someone’s pocket!” and “George Simion fears no one! AUR fights for the Romanians!”
Criticism was also directed at then-president Klaus Iohannis, whose affiliation with the National Liberal Party (PNL) made him a frequent target of anti-establishment populist rhetoric, transcending strict left-right divisions.
When these politically charged messages were combined with emotionally resonant but non-political content - such as personal tragedies, public health scares, or nationalist nostalgia - the overall discursive environment suggested a media ecosystem highly conducive to the spread of populist and extremist narratives, particularly from the far right.
Coordinated inauthentic behavior
Coordinated inauthentic behavior (CIB) and astroturfing were cited in the decision of the Constitutional Court among the main reasons for the annulment of the November 2024 election and are surfacing again in 2025 Romania has 9 million TikTok and 13.03 million Facebook users.
In April 2025, TikTok deactivated two secret networks aimed to influence political narratives in the 2025 Romanian elections. One was composed of 27 inauthentic accounts with over 9,000 followers, which used pseudonyms and generic avatars to pose as news outlets, aiming to amplify specific narratives and influence electoral discussions (Ardelean, 2025). The second network consisted of 4,453 inauthentic accounts, primarily promoting the Alliance for the Union of Romanians (AUR) party and, to a lesser extent, independent candidate Călin Georgescu. Operating from Turkey, this network employed fictitious personas to post comments related to the Romanian elections, rather than creating original videos. Each account had approximately three followers on average. TikTok's investigation suggested that a third-party fake engagement vendor was paid to post these comments, although the identity and location of the individuals directing this activity remain unknown. (Ardelean, 2025).
Post-election inquiries were launched both by Romanian authorities and at the European level. TikTok identified around 27,000 accounts operated from Turkey (TikTok, January 7, 2025), each with two or three clips, supporting the Union of Romania (AUR) and Călin Georgescu as of December 17.
“Remember those bots that generated tens of thousands of comments per second, whose role was to push posts?” rhetorically asked Cristian Terheș, a presidential candidate himself and a member of the European Parliament elected on the AUR list (formerly PSD, currently ex-AUR). He publicly accused Romanian authorities of failing to recognize that the manipulative techniques were directed not only at Călin Georgescu but also at AUR, without any legal measures being taken (Terheș, 2025).
The use of emojis in algorithmic manipulation
A particularly compelling case of algorithmic manipulation came to light just two days before Romania’s presidential election on 4 May 2025, as a result of a joint investigation by investigative journalists from Context and its team of computer specialists.
(screenshot by Context, April 30, 2025)
Timofte & Biro (2025) provide empirical evidence that manipulation of TikTok’s content-ranking algorithms during Romania’s 2025 presidential race went beyond well-known techniques like mass posting, comment flooding, and hashtag use. Notably, the study found that emojis were systematically used to game engagement metrics and boost visibility for specific candidates. Using custom software, the researchers analyzed over 519 TikTok accounts, 70,000+ posts, 4 million+ comments, and thousands of videos. Patterns suggested coordinated, possibly automated, activity.
One key case involved George Simion (AUR), whose content featured heavy emoji use (e.g., “🥰Simion Președinte 🥰🥰🥰🥰”). Similar tactics were seen across candidates, including Crin Antonescu (🙏🌹), Marcel Ciolacu (🌹🌹🌹), Victor Ponta (💯✌️), and Elena Lasconi (💙💙💙) (Timofte & Biro, ibid.).
The investigation also revealed a transfer of influence from Călin Georgescu to Simion, who doubled his followers to 1.3 million in just 30 days. Old pro-Georgescu accounts stayed active, amplifying Simion’s candidacy through coordinated comments and content.
This reflects how far-right movements repurpose digital influence networks and exploit platform algorithms to bypass formal disqualifications and sustain visibility. By May 2025, when elections were rescheduled, manipulation efforts had intensified. Roughly 15% of Simion’s 400,000 recent comments still referenced Georgescu (Timofte & Biro, ibid.).
The study also shows trans-partisan dynamics: some far-right candidates reportedly employed consultants linked to centrist or liberal actors (Neag et al., 2024), blurring ideological lines in favor of tactical digital gains. Overall, the case highlights how subtle elements like emojis can significantly affect algorithmic visibility. It calls for greater platform transparency and forensic oversight to prevent the distortion of public discourse through engineered digital influence.
The online parameters of CIB and the connection to FIDI
Several reports have shed light on the phenomenon of CIB, through various techniques. A series of pieces of evidence emerged - some even before the elections were annulled - including reports published by Expert Forum and investigative media outlets, with others appearing after the elections were overturned.
The report of the Service for surveillance and protection against foreign digital interference, a French intelligence agency, put in light, when analysing how Călin Georgescu got so visible in the social platforms, “a sophisticated campaign to manipulate the TikTok algorithm and describes the scheme of the online platform”. (SGDSN, February 2025).
“The sophisticated astroturfing campaign involved the deliberate manipulation of the recommendation algorithm through the mass dissemination of videos and comments featuring targeted hashtags and keywords (SGDSN, ibid.)
(Source: screenshot - SGDSN - VIGINUM report, Feb. 2025, p. 4)
Russian External Intelligence Services reacted pro-Georgescu
Călin Georgescu was the only Romanian candidate in the post-Communist Romania, in the case of which the Russian External intelligence service SVR took a public position accusing the European Commission as being behind the “decision of the Romanian prosecutor's office to charge Georgescu” (Izvestia, 2025). The EU service countering disinformation revealed there was no evidence to support the claims and pointed to the conspiracy theories (EuVsDisinfo, 2025).
After the annulment of the Romanian elections, the authorities prosecuted Călin Georgescu with six crimes, including incitement to actions against the constitutional order, in an attempted form - he is accused of having plotted a plan to destabilize Romania. Due to these accusations, he was under temporary interdiction to leave the country and was banned for a presidential candidacy.
“Călin Georgescu discourse, as it appears on social media and on video platforms, was analysed by media and by civic activists to identify pro-Russia, anti-NATO and anti-UE themes, mixed with numerous references to God, with pseudoscience and with a sovereignist approach to agriculture and economy.” (Radu, 2024)
The mechanisms that made Călin Georgescu relevant in the online environment were not entirely unknown; the think tank Expert Forum, had warned prior to the elections on November 24, 2024, about manipulation techniques, particularly the campaign using the hashtag #balanceandverticality on TikTok. However, there was no substantive reaction from the authorities. (Voinea, M.E., Ioniță, S., 18.11.2024)
Călin Georgescu received 2.4 million views in two months, despite having zero funds for his electoral campaign, under the hashtag #balanceandverticality. In addition to the seemingly harmless hashtag like the popular #balanceandverticality, other mechanisms included networks of fake accounts (27,000 of which were identified by TikTok as operating from Turkey) and micro-payments to bloggers with no political affiliation, facilitated by the agency Fade Up. This agency was mentioned in declassified documents from the Romanian intelligence services and later investigated by Le Monde (2024)
“Following the model of the Moldovan Stoianoglo campaign, there are Romanian influencers with no political affiliation - i.e., those focused exclusively on fashion, makeup, and entertainment - who helped divert the political campaign of the liberal party. Georgescu's name was not explicitly mentioned. (Expert Forum, 2024). From September 2024 till the end of the year the hasgtag #calingeorgescu has gained 120 million followers.
The TikTok was similar to “Brother Near Brother”, the campaign Russia run in Ukraine, based on the manipulation of micro-influencers (the declassified report of the Ministry of Internal Affairs, 2024) and to the one dedicated to Stoianoglo (Cristea, 2024, Expert Forum, 2024).
Apart from its initial warning, Expert Forum investigated the causes and made recommendations for future actions, including:
- Data preserved under the retention order issued to TikTok by the European Commission must be made publicly accessible for researchers.
- Relying solely on opaque internal investigations conducted by TikTok is not only dysfunctional but also undermines the principles of transparency and accountability, particularly during critical periods such as elections.
- Additionally, exploratory research must be conducted to examine TikTok’s recommender system, including practices such as the 'heating system,' where employees manually amplify the virality of content. (Expert Forum, 2025)
More on Romanian elections:
- EJO: Romania: how a disinformation campaign prevented free suffrage
- Euractiv.ro: Elections timeline | Political context. Evidences for the annulment | Why Moldova voted differently
Copyright: European Journalism Observatory (EJO)
The Institute for Communication Studies (ICS) is a member of the European Journalism Observatory (EJO). The views expressed on this page are those of the authors and do not necessarily reflect the views, policies and positions of the EJO and ICS.
Manuela Preoteasa is a professor at the Faculty of Journalism and Communication Studies at the University of Bucharest. She is the co-founder of an online media organization and an active advocate of independent, quality journalism as a form of combating disinformation.
