Romania declassifies intelligence on Russian hybrid interference boosting Călin Georgescu

On 04 December 2024, Romanian President Klaus Iohannis declassified a set of intelligence reports approved by the Supreme Council of National Defence (CSAT). The documents, drawn from the country's intelligence and security services, assessed that the surprise first-round surge of far-right outsider Calin Georgescu in the 2024 presidential election was the result of a coordinated online influence operation. According to Euronews, the reports concluded the campaign was most likely orchestrated by a state actor whose methods matched a state actor's typical mode of operation.

The declassified material centred on a large TikTok campaign. As reported by Romania Insider, the assessment described preferential platform treatment, coordinated accounts, algorithmic amplification, and paid promotion that helped lift Georgescu, who had declared no campaign spending, while one supporter spent close to one million euros. A dormant network largely inactive since 2016 was reactivated roughly two weeks before the vote, with operators recruited and coordinated through Telegram.

One declassified report from the domestic intelligence service detailed more than 85,000 cyberattacks targeting election websites and IT systems, concluding the attacker held resources specific to an attacking state. On 06 December 2024, Romania's Constitutional Court annulled the first round and ordered the entire presidential process redone, citing the declassified intelligence and violations of electoral rules. The reports pointed to a hostile state actor, with Russia widely suspected, though they did not conclusively name Moscow in every document.

The TikTok influence campaign, its coordinated structure, the Telegram-based recruitment, and the documented cyberattacks rest on an official Romanian intelligence assessment that CSAT declassified. The services attributed the operation to a state actor, and Russia is the suspected sponsor, consistent with the Kremlin's pattern of election interference. However, direct Kremlin command and control remains assessed rather than proven: the declassified files stopped short of naming Russia conclusively in all documents, and some later analysis questioned how firmly the evidence tied the activity to Moscow.