Zero evidence: the bogus ‘intelligence’ behind Romania’s cancelled election

On 6 December 2024 Romania’s Constitutional Court (CCR) cancelled the country’s presidential election while runoff voting was already underway in the diaspora. Domestically and internationally, this was justified on the basis of “Russian interference” in the first round, held on 24 November, when little-known independent candidate Calin Georgescu had shockingly topped the poll.

The Trump-aligned Georgescu, widely accused by the mainstream media of pro-Russia views, was running on a very effective nationalist, pro-peace platform. He was set to win the second round on 8 December and become president – before the entire process was brought to a halt by the politically-appointed CCR justices, ostensibly because the 24 November result had somehow been vitiated by a Russian “influence operation”.

The official claim of Russian meddling rested directly and exclusively on a specific set of intelligence documents on the matter, first submitted in a closed National Security Council meeting on 28 November and then hastily declassified on 4 December by the sitting President in order to “inform” the Constitutional Court’s decision. But the reports contained no actual evidence of the sort.

It is therefore important to look closely at what these documents actually say (and don’t say), and to put it on the record for future reference and for comparison with the misleading media narrative that was spun up around them. Below is a detailed, full analysis of the declassified intelligence on the supposed “Russian electoral interference” that lies at the heart of the Romanian election scandal.

First, here are all the documents in question, as published on the Romanian presidency’s website:

• The MAI Document – prepared by DGPI, the intelligence service of Romania’s Ministry of Internal Affairs (MAI).
• The SIE Document – prepared by the SIE, Romania’s foreign intelligence service (MI6/CIA equivalent)
• The SRI Document, Part I – prepared by the SRI, Romania’s domestic intelligence service (MI5/FBI equivalent). (The President actually declassified two separate SRI documents, but they were both submitted together at the 28 November meeting and are referred to, jointly, as the “SRI Document” in the public debate.)
• The SRI Document, Part II – see above
• The STS Document – prepared by the STS, Romania’s signals intelligence agency (GCHQ/NSA equivalent).

Summary

• The documents provide no concrete evidence of Russian state interference in Romania’s presidential elections or any links between presidential candidate Calin Georgescu and Russia.
• The most important and explosive term used in these documents (by SRI) is “state actor.” The documents offer no evidence or analytical explanation for the use of this term, rendering it an unsupported claim.
• On the contrary, to the extent that they shed light on anything, the documents indicate that Georgescu’s campaign simply employed highly effective digital marketing techniques, giving him a “comparative exponential” advantage (according to SRI).
• The documents offer only disparate, circumstantial, and often trivial information presented in a way that leaves plenty of room for wide-ranging interpretations. Their tone and terminology appear designed to fuel an anti-Georgescu narrative in the public sphere.
• As intelligence products, the documents are sloppy and of very poor quality by Allied standards. They include contradictions, errors, and blatant inaccuracies. The language is often vague, and key terms remain undefined (e.g., various uses of the word “network”). For the most part, the documents are full only of useless platitudes, with the majority of the information already having been circulating in the public domain in the days after 24 November (the date of the first voting round).
• The documents are merely “Briefing Notes” (note informative, in Romanian), not assessments – thus lacking clear and definitive analytical conclusions or interpretations. They make isolated claims (mostly unsupported), with no discussion of sources or evidence. This is likely a method for the intelligence services to protect themselves politically. Subsequent interpretations of these documents by the media are not, therefore, based on conclusions of the Romanian state.
• The documents are also redacted in key parts. It is therefore important to understand that the information in these documents was only partially declassified – despite the media narrative suggesting the documents were declassified in their entirety. It is also important to understand that the redacted passages may alter the meaning of the text.
• The SIE Briefing Note has not actually been declassified. The President only published an “unclassified excerpt” from it. The SIE Note itself remains classified, likely because it contradicts the Notes submitted by the other agencies.
• The documents do point to potential irregularities in Georgescu’s campaign finance statements. However, such issues are common in campaigns worldwide and, moreover, should be investigated with respect to all the other candidates as well, in the same way. In any case, the documents make no suggestion of foreign funding, let alone from Russia.
• The only concrete elements noted in the documents as being specifically identified as of 24 November (the day of the vote in the first round) are: 100 TikTok influencer accounts paid to distribute content using 3 (three) hashtags that do not even mention Calin Georgescu; 797 accounts created before (!) the launch of TikTok itself, under this brand name; 1,088 users in a “coordination” group on Telegram (which, again, is standard in all political campaigns); and $381,000 paid to some “influencers”.
• Conclusion: The CSAT documents declassified by the President provide absolutely no real, concrete basis for the public narratives about a “Russian attack” on Romania or of links between Georgescu’s campaign and Russia. These documents, by themselves, cannot rationally be used as arguments against this candidate because they prove nothing.

Analysis of the MAI Document – Key Points

1.The MAI (Romania’s Internal Affairs Ministry) speaks from the outset about an “unlabeled electoral campaign” on TikTok, specifying “100 influencers” who were involved in promoting Mr. Georgescu. Later in the document, the MAI states that it found “approximately 130 TikTok accounts” that disseminated the 3 (three) hashtags associated with Calin Georgescu:

• #echilibrusiverticalitate (BalanceAndIntegrity)
• #prezidentiale2024 (Presidentials2024)
• #unliderpotrivitpentrumine (aRightLeaderForMe)

In layman’s terms, the MAI focuses on 100–130 specific accounts that pushed these hashtags. The entire discussion about Georgescu’s campaign is essentially about this social media tactic (a standard marketing approach) that generated views and was later branded by the media as a “Russian influence operation.”

2. The MAI also says that “the majority of posts of this type” (i.e., content carrying these hashtags) were not “marked as paid advertisements.” It later specifies that “most influencers were not aware that they were promoting a specific candidate.”Therefore, the MAI itself effectively admits that these posts (i.e., most of Georgescu’s online campaign) were not promotional messages for a particular candidate and did not need to be labeled as political advertising. While this is a clever tactic to “game” the TikTok algorithm, it remains within the platform’s rules.

3. The MAI states that “during the period November 13–26,”… “trends in promoting video content associated with multiple hashtags” used in Georgescu’s campaign “reached 9th place globally.” However, the language is unclear regarding:

• Whether this ranking aggregates different hashtags,
• Which of the hashtags included Georgescu’s name, and
• How this ranking was compiled.

The same paragraph notes that “no artificial amplification” was identified before November 24 (i.e., the date of the vote) and specifies that the “explosion in the number of views, in the hundreds of millions,” occurred after November 25, following the first round of voting.

Upon closer reading, it becomes clear that “9th place globally” refers to the post-vote effect (November 25–26), when everyone began searching for Georgescu on TikTok. The MAI provides no evidence of the campaign’s evolution before election day, explicitly stating there was no “artificial amplification” (e.g., bots).

4. The MAI makes a brief parallel with “similar situations” during the recent October elections in Moldova. It refers to the same social-media modus operandi, involving “neutral” content distributed by influencers, which is later picked up and commented on by other accounts.The same marketing tactic was also observed in Moldova but means nothing in itself. This tactic is likely common in various countries and contexts, including commercial product promotion. It’s also possible that other candidates in Romania used this approach in the same presidential campaign. However, the MAI neither clarifies this nor provides evidence suggesting malice. A marketing tactic available to anyone is not inherently malicious unless connected to specific actors or intentions, which the MAI does not suggest.

5. In a separate section, the MAI makes observations about a few individuals. This section is heavily redacted, leading to uncertainties. For instance:

• One individual was involved in collecting signatures for Georgescu (a legal requirement) and allegedly had neo-legionary sympathies (referencing Romania’s interwar fascist Legion of Archangel Michael).
• Other individuals are described as underworld/criminal figures who “conducted a promotional campaign” on TikTok and “financially supported Calin Georgescu’s electoral campaign.”

Comment: The MAI should investigate individuals gathering signatures for other parties too, checking for communist sympathies. Regarding underworld figures, such revelations are common in campaigns worldwide, which often receive support (financial or otherwise) from dubious sources. This is neither unique nor specific to Georgescu. Additionally, the phrase “financially supported Calin Georgescu’s electoral campaign” is vague. The MAI implicitly admits that the hashtags weren’t strictly “electoral,” as even the influencers disseminating them were unaware of their connection to Georgescu.

6. The MAI draws a parallel between Georgescu’s “informational campaign,” called “Balance and Integrity” (#EchilibrușiVerticalitate), and the “Brother Next to Brother” campaign run by Russians in Ukraine in 2022 before the invasion. The common elements noted include:

• “Manipulating legitimate micro-influencers.”
• Coordinating influencers via Telegram.

Comment: These techniques are standard for any content dissemination campaign. The comparison to Russian methods in Ukraine lacks meaningful context, as such techniques are likely widespread. Telegram coordination is not inherently suspicious and is widely used in many campaigns worldwide.

Side Note: On 20 December – after the election had been cancelled – ANAF, Romania’s tax agency, discovered that one of the hashtags (#EchilibrușiVerticalitate) was paid for by the National Liberal Party (PNL), a ruling coalition party and opponent of Georgescu. The MAI’s suggestions of foul play turned out false, as this hashtag campaign was a tactic by PNL to boost Georgescu’s visibility, benefiting their candidate. This strategy backfired, revealing ulterior motives behind the accusations.

Analysis of the SIE Document

The SIE document is irrelevant. It contains general assessments about Russia’s information warfare approach toward Romania and a few slightly more detailed aspects related to some tactics, techniques, and procedures used by the Russians. All of this information is publicly available in open-source and well-known to any academic expert in this field.

The SIE document has no connection and makes no reference to the case of Calin Georgescu. It is likely intended to provide a conceptual framework for discussions. From a theoretical and practical standpoint, there is nothing special here. Most importantly, it is worth noting that the SIE document is an “unclassified excerpt” from the note presented by SIE on 28 November, not the full note itself. In other words, the President did not declassify the SIE Briefing Note, even though SIE, as the country’s foreign intelligence service, is the most qualified to evaluate a potential “Russian factor” in the elections. The reason for keeping the SIE note classified can only be either because it contradicts the other declassified documents and absolves Calin Georgescu of “Russian collusion” accusations (perhaps, therefore, changing the entire public narrative completely), which is likely; or because it incriminates Georgescu with concrete evidence, but for some reason it is being kept in reserve for use at a later date (unlikely). The possibility of “protecting sources” is excluded, given that the SIE note could have been released in a redacted format like the other documents.

Analysis of the SRI Document (Part I, No. 1742) – Key Points

1. The SRI document (Part I) is the most problematic from a professional standpoint. In the first paragraph, SRI unequivocally speaks of an “aggressive promotional campaign,” “evasion of electoral legislation,” and “exploitation of algorithms” in favor of Calin Georgescu.

SRI opens its briefing with a harsh and categorical tone, atypical for normal practices in intelligence production which require neutral language – with a strong suggestion that the SRI is pursuing an agenda. As to the three elements highlighted in this first paragraph, none are incriminating, not even in relation to legislation. It is worth noting that SRI refers to “evasion” rather than “violation” of legislation.

2. SRI notes that the “massive” promotion of Georgescu on TikTok was achieved through coordinated accounts that “actively published electoral content, both with the help of recommendation algorithms and through paid promotion.”

The use of coordinated accounts was also noted by the MAI, as discussed earlier – i.e. the 100 influencers. The term “electoral content” in this context is unclear because, as already seen, the MAI note implicitly acknowledged that the content in question (posts that were pushing the main hashtags) was generic did not directly link to any candidate in particular. Furthermore, SRI makes a contradictory statement, possibly due to a misunderstanding. It claims that “active publication” (i.e. manual posting) was done “with the help of recommendation algorithms,” – but if the content posting on TikTok was done algorithmically, it could at the same time have been “active,” i.e., via manual posts by individual users. This reflects either a lack of understanding by SRI analysts of how social media works, or an unprofessional, imprecise phrasing (intentional or otherwise).

3. SRI states that the “network of accounts associated with Calin Georgescu initially consisted of 25,000 accounts” on TikTok, which became “very active” two weeks before the elections.

This is an extremely serious statement by SRI, which strongly influenced public debate in Romania and contributed to the pressure for cancelling the election. The first issue is the precise, perfectly round number of 25,000 – neither more nor less – advanced by the SRI, which is highly suspicious to begin with, particularly since all other figures presented in the briefing are precise not rounded. Additionally, SRI provides no source or explanation for how this figure was determined; the number is simply an unsupported claim. Another issue lies in the definition of the phrase “network of accounts associated with Calin Georgescu,” which SRI does not clarify and which could mean various things. For example, it might include accounts of bone fide TikTok users – i.e. members of the general public, not in any way linked to the campaign – who organically shared or spread Georgescu-related content (that related to the three hashtags or otherwise) when it appeared on their screens. Making such an explosive claim without any basis, explanation or definition, in an intelligence product, is deeply problematic and unprofessional. Thus, the figure of 25,000 lacks any credibility to be in any way considered a serious argument in public debate.

4. SRI states that “797” of the accounts “forming the initial support network” were created as early as 2016.

This is a laughable claim that reinforces the impression that the SRI document is unprofessional and/or improvised in haste (and therefore prone to error). Douyin, TikTok’s predecessor app, was only launched in 2016, and TikTok itself debuted under this name in 2017. It is possible that some or most of the original Douyin accounts transferred over to TikTok. But here SRI appears to suggest, bizarrely, that Georgescu’s 2024 TikTok campaign was planned even before TikTok as we know it even existed. Regarding the use of very old accounts, as is typical on all social media platforms, many accounts are recycled over time for various marketing networks or other commercial and political purposes. There is nothing unusual or suspicious in this regard. It is also worth noting SRI’s use of the term “support network” which likely differs in SRI’s view from the notion of “network of accounts associated with Georgescu,” discussed above at paragraph no.3.

5. SRI notes that “no shared technical resources” such as IP addresses were used, making it difficult to “determine the scale of the network based on shared infrastructure (which is a characteristic feature of bot networks).”

In layman’s terms, SRI effectively says that no bots were used in/by Mr Georgescu’s campaign. The MAI also did not mention bots. Additionally, SRI acknowledges that it is difficult to determine the “scale of the network” (again, a loose, undefined term in this context that could mean a range of things), precisely because it involved individual accounts (i.e. almost certainly manually operated) with unique IPs. Given all this, SRI’s previously claimed figure of “25,000 accounts” is even more bizarre, with SRI itself admitting the difficulty of quantifying the “network”.

6. SRI also goes into some detail about how the activity of “network accounts” was seemingly coordinated via Telegram – again, a fact also mentioned in the MAI document. SRI provides some data on the Telegram coordination channel in question, @propagatorcg: created in June 2024, with 1,088 users on 24 November (the day of the vote) and 3,755 on 28 November. SRI explains that the channel would broadcast instructions to all users for “posting comments” (i.e. on TikTok videos) and “sharing posts”. SRI also states that several Telegram groups with Georgescu “supporters” were created as early as 2022 to promote his “narrative.”

SRI presents most of these details in a separate, imprecisely redacted “footnote-style” box, confirming that these technical details are secondary and, in themselves, prove nothing of an illegal or malicious nature. This essentially describes a well-organized, standard marketing mechanism. Campaign coordination groups (and sub-groups) are common across parties in Romania and globally. Based on what SRI describes here, Georgescu’s campaign appears relatively modest; even local political campaigns draw hundreds or even thousands of activists on such coordination groups in other countries.

7. SRI also notes the existence of some TikTok accounts “falsely displaying the SRI logo” that were used to support Georgescu. These accounts, SRI says, had “over 100,000 likes” and were found to have carried “pro-Georgescu posts in comments.”

This is another odd point in the SRI document. The argument is vague and poorly defined: SRI complains about a few unspecified pro-Georgescu comments on accounts that had (probably for a long time) been using the SRI logo. However, it does not mention whether other candidates or parties received similar positive comments on these accounts (which is likely). This point is entirely unrelated to the document’s main topic, i.e. potential foreign influence.

8. Regarding TikTok itself, SRI states that the platform classified “purely electoral posts” from “accounts linked to the network that is promoting Calin Georgescu” as “entertainment posts.” This led to a “preferential increase” in Georgescu’s visibility on TikTok, while content from other candidates was “heavily filtered,” [presumably because it was deemed “electoral” content] thus diminishing their “online” presence “exponentially”.

Again, SRI uses vague language and concepts here. But SRI effectively says that Georgescu’s campaign outsmarted the TikTok algorithm to gain a massive advantage by getting Georgescu’s messages classified as “entertainment.” SRI does not suggest any collusion between TikTok (i.e. the company itself) and Georgescu; it also acknowledges no laws were broken, but only “evaded.” In other words, Georgescu’s team were simply smarter, and achieved more with less. Therefore, SRI itself provides the clearest explanation for the “miracle” of Georgescu’s surge on TikTok: it was neither about bot farms, nor anything unusual in terms of coordination and sharing groups, let alone Russian assistance. Rather, they came up with a clever strategy that made TikTok’s algorithm give Georgescu an exponential advantage (SRI’s own word).

9. At the end, SRI addresses matters relating to the financing of Georgescu’s campaign. It identifies an individual named Bogdan Peșchir, whose account, “bogpr,” made over €1 million in “donations” on TikTok and was “involved” in “funding Calin Georgescu’s promotion”. SRI claims “bogpr” paid $381,000 to “TikTok users promoting Georgescu” in the month preceding the election.

As so often in this document, SRI’s text is vague, unprofessional, and leaves room for interpretation. For example, it is unclear to what extent the €1 million is linked to financing for Georgescu’s campaign, considering that “bogpr”/Bogdan Peșchir was already a major TikTok figure in his own right, with a significant track record as a specialised PR professional on that platform. The only concrete information of actual relevance to the topic of the SRI document is the $381,000 amount. (As a side note, it is interesting that SRI uses euro for one of the sums involved, and dollars for the other, in the same paragraph.) However, this kind of questions over campaign finance are common in all democracies, and this amount is relatively small. It certainly warrants investigation, but SRI fails to present in this document any kind of “smoking gun” with respect to foreign interference in the election, let alone anything related in any way to Russia.

Analysis of the SRI Document (Part II, No. 1743) – Key Points

1. The SRI document (Part II) is the most contradictory of all. To start with, SRI focuses on cybersecurity aspects surrounding the elections, noting that over 85,000 cyberattacks were “identified in this context.”

The cybersecurity aspects of the Romanian electoral process are unrelated to Georgescu’s campaign. Such cyberattacks regularly occur around elections (and beyond) in nearly all allied countries. The cyber domain is complex and the definition/classification of an “attack” varies. There are Western countries, like the UK, that report average levels of tens of thousands of cyberattacks daily. The figure of 85,000 is an expected peak and not necessarily shocking for experts in the field.

2. SRI reiterates the argument from its other document above (Part I, i.e. No. 1742), emphasizing that Georgescu “benefited from preferential treatment,” [on TikTok] as his content was not labeled as political, which gave him an “exponential” advantage compared to his competitors.

Curiously, this document partially overlaps with the text of the previous SRI document (Part I), with some passages, like this one, repeated almost verbatim. This could be an error or a method of emphasizing a key point – namely, that Georgescu’s advantage on TikTok was primarily due to the way his content was classified by the platform.

3. SRI states that “the conclusions of the present analysis” show that “the activity of the accounts appears to have been coordinated by a state actor, who used an alternative communication channel to amplify messages on the platform.”

This statement is extremely serious, yet SRI provides no evidence, source, or explanation for it. In the flow of the text, the claim is made abruptly and without any supporting comments or contextual information – and stands out as an odd insertion that goes against the thrust of the information and evaluations presented in all the other documents. The “state actor” statement does not specify the period or the extent/level of involvement of this alleged “state actor”, or what “coordination” means – a term SRI itself discussed in detail in the previous document regarding Telegram. The statement displays  contradictions, imprecision, a lack of context, and in particular a lack of any analysis of the intent (as regards the presumed “state actor”), as would normally be the case in a proper intelligence briefing. Normally, such a huge and highly consequential claim made in an intelligence product would be rigorously and seriously argued, but here SRI merely mentions it in passing, as one bullet point on a longer list of discussion items. Even the term “state actor” is unclear in this context and could have multiple interpretations (at a basic level, for example, between a government agency and state-directed criminal organisation). Additionally, it is worth noting that the page containing this statement is carelessly written, in almost a colloquial language, while the formatting is different from the rest of the document.

4. Just a few lines later, SRI states that “behind this is a very good digital marketing firm” and that “it is practically a coordinated volunteer effort (mass guerrilla political campaign).”

This is the key contradiction in this entire collection of “declassified intelligence”, that should definitively put to rest the whole discussion surrounding the Georgescu issue. SRI itself says, on one hand, that everything was coordinated by a “state actor,” but then literally states that it was actually a marketing firm. The two claims are mutually exclusive. The “state actor” hypothesis is clearly incorrect, not only due to the reasons mentioned earlier but also because all these declassified documents broadly support the “marketing firm” theory. SRI even identifies the type of technique used (“mass guerrilla political campaign”), which is neither some new invention in the field of communications, nor a “special operation” at the state level –  but a well-known, widely used approach in commercial and political campaigning. By confirming that Georgescu’s TikTok surge resulted from a digital marketing campaign, the wilder scenarios about a supposed Russian interference are effectively debunked. Case closed.

Analysis of the STS Document

Finally, there is the STS document, which is in fact irrelevant to the subject at hand. The STS discusses the national IT system that facilitates the electoral process and the role and activities of the STS in ensuring the integrity of this process from a technical perspective. The STS states that “all identified cyberattacks were successfully blocked” during the elections and that “there are no indications of any data integrity breaches” related to the election results.

The STS document is a formal, technical report confirming that the results recorded in the first round reflect the actual votes cast and that no Russian (or other) hackers accessed the electoral authority’s computer networks in order to alter the figures. The document does not mention or relate to the topic of Calin Georgescu’s campaign in any way.

A crime that will live in infamy

This concludes the analysis (Romanian version here) of the so-called “intelligence” that provided the basis for Romania’s Constitutional Court to cancel the country’s democratic presidential election. As seen in the above, there is nothing in these documents to even remotely prove any Russian connection on Georgescu’s part, let alone the existence of an entire Russian “influence operation” to win the Romanian presidency for its supposedly preferred candidate.

It is not impossible that such evidence may indeed exist, somewhere, and that the official narrative may eventually be proven correct. Mr Georgescu may yet be uncovered as some kind of Russian agent, in the way that many people still think that Donald Trump is. What we do know is that no such proof has been presented, and now a whole month has passed since the greatest political crime ever perpetrated against Romanian democracy – indeed, against democracy anywhere. Paraphrasing FDR’s speech to Congress after the Japanese attack on Pearl Harbour on 7 December 1941, this was a crime – by Romania’s own elites – that will live in infamy.

The “declassified intelligence” behind the cancellation of Romania’s presidential election was at best unreliable, at worst deceptive or even fake – in a word, bogus. After 20 January the new US Administration should be asking hard questions of those in Romanian politics and intelligence who took part – directly and indirectly – in the decision-making around these shameful events and enabled them. Such a brazen affront to the most basic political right of a free people in an Allied democracy – and to the liberal democratic principles at the heart of the Western world – cannot be allowed to stand.