Romania’s presidential frontrunner Georgescu benefited from Russia-style booster campaign, declassified docs say

Romania’s ultranationalist presidential candidate Călin Georgescu benefited from a TikTok campaign that was similar to influence operations run by the Kremlin in Ukraine and Moldova, according to declassified Romanian intelligence documents.

Georgescu, who unexpectedly won the first round of Romania’s presidential election and tops opinion polls ahead of this Sunday’s runoff, has expressed admiration for Russian culture and described President Vladimir Putin as a man who loves his country. Georgescu has also strongly criticized the EU and NATO, with his victory potentially spelling trouble for both alliances. 

The declassified Romanian documents allege that paid influencers, along with members of extremist, right-wing groups and people with ties to organized crime promoted Georgescu’s candidacy online. The documents don’t directly state that Russia tried to swing the election but strongly suggest it.

Liberal President Klaus Iohannis agreed to release the files on Wednesday, following a request from Romanian journalists and civil society groups. 

The documents appear to contradict Georgescu’s claims that he didn’t receive any foreign campaign support and came first in the Nov. 24 election simply because his message resonated with the Romanian people. Georgescu’s team did not respond to a request for comment.

In a Romanian TV interview Wednesday, he dismissed the declassified documents as a desperate move by the Romanian political establishment to stop him from winning the runoff.

Evidence of a “state actor” helping far-right campaign

Georgescu’s election campaign exploded on the social media platform TikTok just two weeks prior to the Nov. 24 election, according to one declassified document from the Romanian Intelligence Service (SRI). 

Some 25,000 accounts were part of a network on TikTok directly associated with Georgescu’s campaign, and became very active in those two weeks, the document says.

About 800 of those accounts had existed since 2016 — the year TikTok was released — but had barely been active until November of this year.

“The account activity could have been coordinated by a state actor,” another SRI document suggested. The SRI also assessed that “a very good digital marketing company” was behind the campaign and that those involved were adept at skirting TikTok’s rules.

The SRI noted that each TikTok account had a unique IP address, which shows a deliberate strategy to make it hard to identify the scale of the network.

A group created on the Telegram messaging app was used to coordinate the TikTok activity, the SRI said. Messages included advice on how to mislead TikTok’s content verification system, for instance by recording screens and changing content so the platform perceives it as original content, SRI said.

Logins for Romanian election-related websites were posted on a cybercrime platform of Russian origin as well as on a private Telegram channel known for disseminating data stolen from many countries — but never Russia, according to one of the SRI documents.

The SRI identified over 85,000 cyberattacks that sought to exploit vulnerabilities in Romania’s election IT system, aiming to obtain access to data, change content and crash the network. The attacks continued for several days, including election day and the day after, and came via 33 countries, making it difficult to attribute responsibility to one nation in particular, the SRI said.

Paid influencers

Georgescu claimed he spent no money on his election bid — raising questions about how he managed to run such a successful campaign without dropping a dime.

But a briefing note compiled by Romania’s interior ministry reveals that so-called social media influencers were recruited by intermediary companies, at least one of which appears to have been a ghost entity, to promote an unnamed “ideal candidate” profile before the election on TikTok, Instagram and Facebook. These influencers earned around €80 for every 20,000 followers they had, per post.

The influencers were paid to post videos in which they discussed the profile of an ideal Romanian presidential candidate, alongside the hashtag “#balanceandverticality.” While Georgescu was not directly named, this so-called ideal candidate closely aligned with his own profile. The posts generated between 1,000 and 500,000 views per video.

A Romanian working in cryptocurrency paid $381,000 to some TikTok users who were involved in promoting Georgescu in the month prior to the first round of the presidential election, per the documents. Georgescu claimed in his TV interview on Wednesday that he never met this person and that his name didn’t ring a bell.

Several influencers came out after Georgescu’s first-round victory to say they regretted their posts.

The strategy was similar to a campaign deployed in neighboring Moldova, seeking to convince people to vote for the pro-Russia candidate in that country’s two-round presidential election, according to the document from the interior ministry. Moldova’s incumbent pro-EU President Maia Sandu, who is also a Romanian citizen, narrowly won last month’s runoff, amid warnings that Russia planned to overthrow her government and install its own proxy regime to control the country.

Russia used similar tactics in campaigns the Kremlin ran in Ukraine before launching its invasion of the country, according to the document.

TikTok in the firing line over allegations of campaign law violations

Romania’s election authorities asked TikTok to delete Georgescu-related content four days before the first round of the presidential election because it didn’t comply with a requirement to identify who paid for the material.

In response, TikTok said it had blocked people in Romania from accessing the posts, but they remained available abroad and could still be shared, according to one of the SRI documents.

Subsequent checks showed the posts were still accessible in Romania, even on election day. Election campaigns in Romania must officially end 24 hours before polls open, according to the law.

But TikTok classified Georgescu-related posts as entertainment rather than political content, and made them accessible without restrictions to a wide number of users, without proper election-related labeling, the SRI said.

This treatment increased Georgescu’s reach, while other presidential candidates’ content was filtered, lowering its visibility, the document said.

TikTok did not immediately respond to a request for comment but has rejected accusations it broke Romanian election law.

Organized crime and extremism 

Some of Georgescu’s campaign supporters involved in promoting and buying votes are members of right-wing, extremist movements; have ties to organized crime; or belong to religious cults that were previously involved in promoting pro-Russian, antisemitic, anti-NATO and anti-Ukraine narratives, according to the interior ministry document. 

The documents don’t reveal the supporters’ exact identities but do contain biographical data: One backer (who fought in the French Foreign Legion), promotes a fascist ideology and organizes paramilitary camps to radicalize youth.

Another person, who had ties to organized crime, is believed to have funded Georgescu’s TikTok campaign.

“Aren’t they people too? Very well, I’m honored by this,” Georgescu said in his TV interview.

U.S. concerns

The U.S. State Department said it is concerned about the cyberattacks targeting Romania’s electoral process, calling for a full investigation to ensure its integrity, spokesperson Matthew Miller said in a statement Wednesday.

“Romania’s hard-earned progress anchoring itself in the transatlantic community cannot be turned back by foreign actors seeking to shift Romania’s foreign policy away from its Western alliances,” he said.

Miller warned that such a change “would have serious negative impacts on U.S. security cooperation with Romania, while a decision to restrict foreign investment would discourage U.S. companies from continuing to invest in Romania.”