Analysis: The Government Crisis and Manipulation on TikTok

Monitoring Report: April–May 2026

Authors: Mădălina Voinea (Digital Programs Coordinator, Expert Forum), Vlad Adamescu (Co-Chair, Center for Democracy and Good Governance), Monirul Hassan (Independent Researcher, Computer Science)

FULL REPORT HERE

1. Context: Romania’s Political Crisis, the Digital Media Landscape, and Inauthentic Campaigns as Information Pollution

In a period of political crisis, Romanian TikTok feeds have become an information battlefield. We analysed 23,599 viral political videos from the beginning of the year. Of these, in the period 1 April – 11 May 2026 alone, the monitored videos generated 101.9 million views, 829,000 shares, and 68,400 comments. 52% of comments were identical messages. Of the 267,799 followers of the accounts that produced this content, 53.1% were empty accounts with no videos posted. Are we talking about real people, concerned citizens, patriots? Our data suggests the continuous presence of amplification networks that artificially keep the conversation at peak levels precisely at the moments when the public is most vulnerable. We ask ourselves in this context how we can determine who came first — the inauthentic accounts or the genuine supporters? More importantly, who is accountable in a democracy for the manipulation of information reaching citizens?

Beyond platform obligations, responding to information pollution requires action at the societal level. In this report we propose three complementary directions:

1. the regulation of online political advertising, within which we should explicitly include a ban on the use of inauthentic content campaigns by marketing companies contracted by Romanian political parties. Such a regulation may be accompanied by a Code of Conduct for parties in the online environment.
2. Strengthening civil strategic communication capacity through the establishment of a Romanian STRATCOM. This does not entail replicating models from France, Sweden, Norway or Moldova, but rather the creation, first and foremost, of studies on the Romanian information space, consumption habits, and vulnerabilities, together with experts from universities and civil society in the Romanian information space.
3. A clear distinction between legitimate forms of user coordination in the online environment, for example, coordinated citizen campaigns supporting a politician, information campaigns, organic political expression campaigns, and coordinated inauthentic campaigns.

2. Analysis of 23,599 Videos, 68,000 Comments, and 267,286 Accounts, in the Period 11 January – 11 May

Evolution of Posting Volume

Our analysis shows a sharp intensification of posting activity during the governmental crisis of April–May 2026. Total video output grew steadily from January, before accelerating sharply in April and reaching a peak of nearly 4,000 videos in a 14-day window, a level almost four times higher than that observed at the start of the year. Daily activity patterns show steady growth and a peak in the period 1–5 May, up to the no-confidence vote, with repeated spikes exceeding 400–500 videos per day.

The number of posts published by the 49 source accounts was in continuous growth from January. From 57 videos posted per day in January, by April these accounts were posting an average of 246 videos per day, a pace that was maintained into April as well. We observed a growth in the April–May period of up to 4x in posting activity by the accounts.

Two accounts stand out, having likely been created or converted into political accounts in 2026:

Comment Analysis

The majority of comments analysed consist of a repetitive sequence of emojis. We limited the analysis to comments repeated at least five times and identified 36,000 comments. Approximately 47% of these are duplicate comments, not merely similar, but identical: the exact same number of emojis, the exact same comma, the exact same exclamation mark in the exact same position.

We believe the purpose is to artificially amplify interactions with the posts of these accounts, pushing these inauthentic accounts, which simulate genuine interest at first glance, into users’ feeds.

The largest group of coordinated comments revolves around Călin Georgescu. The message “Călin Georgescu President” (and slight emoji variations thereof) was posted 17,268 times by 9,399 unique users across 2,051 videos, making it the most amplified text message in the dataset, active in the period 1 April – 11 May 2026.

Analysis of Followers of Main Accounts

Total records: 267,825 followers collected from 49 potentially coordinated source accounts. DEFINITIONS: source account = account that creates monitored content in the period 1 April – 11 May; follower = one of the 267,825 accounts collected from the follower lists of source accounts.

Of the total 267,825 follower records analysed, 53.1% are empty accounts that have posted no videos. The strongest coordination signals come from a group of accounts whose follower lists with no posts overlap to a large extent between accounts, the most heavily affected being the accounts sieusuntcggs and patriot.aur1, where 90% and, respectively, 87% of their empty (no-video) follower accounts are shared with other monitored accounts.

Additionally, 25% of the total analysed display characteristics specific to automated accounts: they have a disproportionate follower-to-following ratio, have no videos posted, and have no profile descriptions.

Main Topics and the Real-Life Impact of These Narratives

Politically, the analysed accounts aim to undermine trust in the European Union, in its programmes (SAFE, cohesion funds, etc.), as well as in Romania’s immediate neighbours, victims of Russian military aggression (Ukraine) or hybrid aggression (Republic of Moldova), and in the politicians and political parties seen as their most important domestic supporters (Nicușor Dan, Ilie Bolojan, USR). These are also associated with the decision to annul the 2024 presidential elections, which produced a democratic deficit. As a solution, especially in the context of the current governmental crisis, snap elections (both parliamentary and presidential) are proposed, along with the creation of a new majority to support Călin Georgescu either as Prime Minister or as President.

We are dealing with an ecosystem formed by mainstream media and TikTok that mutually reinforce each other: television or online broadcasts with sovereignist sympathies (Realitatea Plus, Marius Tucă Show, or Gândul interviews, among others) invite sovereignist politicians or opinion formers, who often discuss TikTok content, and this content then returns to the online space through new reposts.

A qualitative analysis of the inauthentic content studied reveals two main categories of “targets” of trust-undermining:

The European Union and other international organisations or EU programmes on the public agenda (for example, OECD accession, the European Commission’s SAFE programme) and the Republic of Moldova and Ukraine.

They are portrayed as antagonistic to the “national interest” or even anti-national. Anti-EU or pro-“sovereignty” themes dominate, accounting for 32.8% of the total.

Old rhetorical devices are used, transposed into the present: Romania is a “rich” country with abundant natural resources, which are supposedly being “stolen” by foreigners or ceded by pro-European politicians in government. EU cohesion funds are presented as a form of dependency from which Romania could escape if it were able to exploit its natural resources, thereby sustaining the (erroneous, as a recent EFOR report shows: we import 25% of our gas needs and 76% of our oil needs) perception that Romania has unexploited natural resource potential: “Romania is a country that can produce energy for all of Europe.” The SAFE programme is specifically targeted, in a manner similar to the PNRR, as a means of control by European elites through non-transparently allocated loans with “high interest rates.”

Dismissed Prime Minister Ilie Bolojan, President Nicușor Dan, and the Save Romania Union (USR). These actors are presented as facilitators of the European Union’s interests in Romania.

Ilie Bolojan is held responsible for Romania’s economic situation, always presented in apocalyptic terms, “the economy is collapsing!, as well as for measures such as the stock exchange listing of minority share packages from state-owned companies, viewed as an example of “selling the country.” The attacks are highly personalised and concentrated around the dismissed prime minister. The party he leads, PNL, is mentioned very rarely, exclusively as part of the former governing coalition, without negative connotations. No other PNL personalities are mentioned. USR, on the other hand, appears to be taking on the negative role of the governing party, associated with Bolojan.

President Nicușor Dan remains the preferred target of the examined accounts. Great emphasis is placed on the President’s various “gaffes,” on his rhetorical style, or on his gestures. When it comes to substance, the President is criticised for his support for the Republic of Moldova and Ukraine: even their mere mention in European formats where the two neighbouring states are on the agenda draws complaints along the lines of “not enough is being said about Romania.”

Digital Regulations and the Obligations of VLOPs (Very Large Online Platforms)

Argument: Platform safety mechanisms appear to be created ad hoc when a public scandal emerges or during elections, despite the obligation to continuously ensure a safe information environment for users.

What do we mean? Within the European Union, the Digital Services Act applies,  the principal legislation regulating the rights and obligations of VLOPs (very large online platforms) such as Meta, Google, and TikTok. Within it, we have the definition of systemic risks (Article 34), where systemic risks fall into four categories:

1. the dissemination of illegal content,
2. negative effects on fundamental rights,
3. negative effects on civic discourse, electoral processes, and public security, and
4. negative effects related to gender-based violence, public health, the protection of minors, and severe negative consequences for physical and mental health.

In this regard, we see how there exists an obligation to build systems for continuous monitoring of the integrity of the services provided, with Article 34 specifying that risk assessments must take into account a multitude of factors such as the architecture (design) of the recommendation algorithm, content moderation systems, the implementation of terms and conditions, including analysis of whether the service is affected by automated, inauthentic content, and by the amplification and dissemination of content incompatible with their terms and conditions.

Furthermore, the Code of Practice against Disinformation (Code of Conduct on Disinformation 2025) has been integrated into the DSA framework. Within it, under Commitment 14, the Service Integrity section, we find explicit definitions of prohibited manipulative behaviours, including: the creation and use of fake accounts, as well as amplification through bots, identity impersonation (the CG1, CG2, CG100 accounts), deepfakes with malicious intent, non-transparent promotion including through the use of influencers, and user behaviour aimed at artificially amplifying disinformation.

Revision of National Regulations on the Financing of Promotional Campaigns

The Emergency Ordinance on the transparency of political advertising did not address the fundamental problem, but merely imposed a complaints mechanism for unlabelled advertisements, based on the principles of Regulation 2024/900. On the other hand, the fundamental questions remain: where is the payment made, how is it reported, and who is responsible. A large part of political advertising is financed from the subsidies received by political parties. A large influx of funds is visible during political crises or in pre-electoral periods. All of this advertising has been financed until now without any labelling of materials, as happens during the electoral campaign. Although the entry into force of Regulation 900 should have produced greater transparency, this remains to be seen. ANCOM and AEP have begun working on a bill to adapt the Regulation to Romania, including through the regulation of an institutional framework. Nevertheless, in order to understand the link between content and the source of funds, several concrete measures must be taken:

• Detailed monthly reports on subsidy expenditure for propaganda, which should also include the names of the ultimate beneficiaries of the funds (i.e. not the consultancy firms)
• The creation of an effective mechanism for tracking expenditure in the online space. For example, AEP could develop a methodology for monitoring and tracking illegal online expenditure. Previous experience showed that during the 2025 elections, a major unlabelled negative advertising campaign ran illegally on Facebook without the payer being identified. In the absence of serious investigations, including with the support of the Police or prosecutors, as well as ANAF, such campaigns can run unchecked. The reluctance of VLOPs to provide data on the identity of the creators of certain campaigns must also be noted, even in cases of obvious violations of the law.
• Legislative amendments for the electoral period must be introduced. At this point, Emergency Ordinance 1/2025 no longer applies, and electoral legislation is very vague regarding the tracking and sanctioning of illegal online campaigns. Furthermore, these regulations should not only aim to sanction actors for individual posts, but must above all watch over organised campaigns with coordinated content, for which money is paid by competitors or third parties.
• The definition of third parties and the possibility for actors external to electoral campaigns to contribute legally. This is regulated in many countries, such as the UK, Germany, or Latvia.

STRATCOM – Strengthening Civil Strategic Communication Capacity in Romania

In November 2024, the only monitoring published before the first round of presidential elections was that of Expert Forum. Months later, TikTok confirmed that there had indeed been 27,000 fake accounts promoting Călin Georgescu. In the year and a half that has passed since then, civil society, universities, and the press have been the ones to continue these investigations and to react.

Romania’s current institutional architecture provides fragmented competences to multiple institutions for monitoring, response, and digital regulation. For example, in Romania ANCOM coordinates the implementation of the DSA (Digital Services Act), but the mandate of this institution is predominantly coordinative and reactive. Intelligence services could be engaged in such monitoring initiatives (SIE for FIMI; SRI for DIMI, etc.) and in monitoring inauthentic behaviour, but we have no public information about what they are working on in this direction and how effective they are. Trust in a STRATCOM is the cornerstone of the success or failure of such an initiative. If we choose to give it a secretive character and place it in the hands of non-transparent institutions, we will only feed the wave of distrust in the state’s intentions.

What do we propose instead?

First of all, we can look at functional models from the EU: Viginium in France, the Psychological Defence Agency in Sweden, the Centre of Excellence in Helsinki, STRATCOM Moldova, the NATO STRATCOM Centre in Riga. All of these entities publish regular reports accessible to citizens, and have large-scale information programmes and collaboration with institutions, journalists, and civil society. Why? All studies referring to FIMI, domestic CIB, and influence campaigns are created using publicly available data. The argument of state secrecy or classified information cannot exist as long as we are talking about data that major platforms and private companies already make available. In Romania, NGOs and journalists already publish such reports and investigations, and other EU member states have been doing the same for years.

• An independent Research Advisory Council, composed of digital rights practitioners, university researchers, representatives of press organisations and civil society, with the statutory right to publish independent opinions. In Romania, we believe that no STRATCOM initiative can function legitimately without this mechanism for collaboration with independent experts. Partly for a pragmatic reason,  the majority of expertise in digital rights, the study and countering of online manipulation lies outside the public sector. And partly due to legitimate concerns about how such a mechanism, whether through lack of capacity or through political manipulation, could transform into a body that justifies decisions against freedom of expression.
• A support programme for coordinating governmental responses and supporting already existing initiatives in media literacy, civic education, and countering historical revisionism. Here we believe there is first and foremost a need to develop the capacity of the relevant ministries and institutions to have a communication strategy that is not reactive, but that pre-empts the wave of online disinformation and manipulation through a standard communication protocol. A STRATCOM also has this advisory function: to help institutions develop this communication infrastructure in times of crisis, either by anticipating that certain topics will be exploited, or through a response protocol in the face of a disinformation campaign. In the long term, grassroots interventions in schools and in teacher training are among the few solutions that can build resilience against a phenomenon that is amplifying across the world.
• Accountability of political decision-makers and the restoration of trust in institutions, through the drafting of a report on the annulment of the 2024 presidential elections, which addresses the root causes of the phenomenon and explains what happened before election day. One of the most frequently repeated narratives in our analysis is based on the absence of such a report,  publicly promised during the electoral campaign and during the current president’s mandate, to be assumed by the Romanian state and to detail the events that led to the annulment of the elections. In the absence of a comprehensive, official, and well-argued report, necessary in a democratic society, conspiracies about the annulment of the elections will continue to spread despite all institutional efforts to close the discussion on the subject.
• Clear strategic communication from political decision-makers on files of national interest and the use of prebunking techniques. Public officials, from ministers to the President, have a responsibility to explain the public policies they assume, such as the SAFE programme (for example, by answering simple questions: what it is, why it is important, why the interest rates are very advantageous, where the money goes, etc.),  to be transparent and to actively work to counter the false narratives spread in the online environment and in the mainstream press. In the absence of such efforts, including argumentation, malign actors can convince even more people of the veracity of the false narratives they circulate.