The information presented by the Romanian Intelligence Service (SRI), the Foreign Intelligence Service (SIE) and the Ministry of Internal Affairs (MAI) at the meeting of the Supreme Council of National Defence (CSAT) on November 28, which were declassified on Wednesday, by President Klaus Iohannis indicate that the financing of the independent candidate Calin Georgescu's campaign on TikTok amounted to one million euros, that there were actions of a state cyber actor on the IT&C infrastructures supporting the electoral process and that Romania is a target for aggressive Russian hybrid actions.

The document presented by the MAI - General Directorate of Internal Protection shows that the specialized technical checks in the online environment and the analysis of the metric values identified in social media, mainly on the TikTok platform, in the electoral process, have validated the existence of an electoral campaign not labeled as such, in which, starting in November, a number of more than 100 influencers (who had a total of more than 8 million active followers) were subjected to a manipulation action regarding the identity of the promoted candidate.

The quoted source states that TikTok has not implemented the BEC instructions regarding marking as a political candidate, respectively marking electoral video materials with the unique code assigned by AEP to each candidate.

It also indicates that the metric analysis revealed a steep increase between November 13 and 26, reaching ninth place worldwide in the top trending video content promotion associated with several hashtags used in Calin Georgescu's election campaign, but an artificial amplification was not identified at the level of the TikTok platform until November 24, the explosion of the number of views, of the order hundreds of millions, being registered after November 25.

The data analyzed by the MAI revealed approximately 130 TikTok accounts through which videos with such content were disseminated, using the hashtags #ebilibrusiverticalitate, #prezidentiale2024, #unliderpotrivitpentrumine, most of the posts of this type not being marked as paid advertisements.

"The evaluation of the scenario used to create the elements of content indicates similar situations carried out within the framework of actions to influence the voting intention in the Republic of Moldova. Specifically, part of the opening text used by Romanian influencers to promote the pro-Russian candidate from the Republic of Moldova was found within the mentioned posts. Within the comments section related to each content element, a series of messages promoting a presidential candidate. The analysis of these accounts indicates anomalies in their creation, with indications of the use of fictitious accounts created only for the distribution of such comments", the MAI document states, saying that most of the influencers did not know that they were promoting a specific candidate.

It is specified that the influencers were paid and that in the present case the calculation base for such a campaign is paid with 400 lei for 20,000 followers.

"Some of the campaign supporters involved in promoting and buying votes are exponents of right-wing extremist, criminal and religious cults, previously involved in promoting pro-Russian, anti-Semitic, anti-NATO or anti-Ukraine narratives", the MAI also shows, giving that example the leader of a clan.

***
The Special Telecommunications Service (STS) shows that during the electoral process DDOS-type cyber attacks were identified at the level of IT&C infrastructure, as well as at the level of other resources in the governmental sphere. The attacks on the IT&C infrastructures managed by STS were successfully blocked, and for the others, the system administrators of the affected institutions were informed.

At the level of the own cyber security systems, no indications were identified regarding the compromise of data related to the voting process in SIMPV and SICPV, emphasizes STS.

At the same time, for the preparation of the electoral process, at the level of the Special Telecommunications Service, threat identification processes, vulnerability assessment, risk analysis, secure configuration, cyber security testing, as well as the implementation of measures to ensure detection, protection, response and recovery in case of cyber security incidents.

STS states that it has thus implemented technical measures to detect and protect against cyber attacks, including complex APT type ones, by using a solution, operationalized and managed exclusively at the STS level, which allows the verification of secure configurations on all systems, the detection of malicious activities , ransomware detection, monitoring the integrity of files in computer systems, vulnerability detection, integrated analysis and security log correlation, as well as threat identification. AGERPRES(RO - authors: Oana Ghita and Florentina Peia, editor: Georgiana Tanasescu; EN - editors: Simona Iacob, Simona Klodniski, Bogdan Gabaroi)


President Klaus Iohannis has agreed to declassify the information, according to the law, at the request of the issuing institutions.

***
In the declassified document, the SRI said that the financing of Calin Georgescu's campaign on TikTok was carried out by Bogdan Peschir and amounted to one million euros.

"Using the 'bogpr' account, he made donations on TikTok of over one million euros. After it became the subject of public debate, the involvement of 'bogpr' in financing the promotion of Calin Georgescu on the platform was confirmed by TikTok representatives in a dialogue with the Romanian authorities on November 28, 2024," SRI shows.

Representatives of TikTok confirmed the identity of the user "bogpr" and mentioned that he made payments amounting to 381,000 US dollars between October 24 and November 24, 2024, to users of TikTok accounts involved in the promotion of candidate Calin Georgescu, including after the end of the electoral campaign, SRI points out.

SRI shows that the financing of TikTok influencers was provided through the FameUp platform (dedicated to monetizing online promotional activities), where the advertising opportunity was published, along with well-defined descriptions. "One of the methods of attracting Romanian influencers to collaborate in the promotion of Calin Georgescu's candidacy was the company of South African origin contacting them by e-mail (...), and offering the amount of 1,000 euros for the distribution of a video made by them," SRI says

The cited source estimates that in the context of the first round of the presidential elections, data was obtained which revealed "an aggressive promotion campaign, carried out by evading the national electoral legislation, but also by exploiting the algorithms of some social media platforms to increase the popularity of Calin Georgescu at an accelerated pace".

It was to this end that the TikTok platform was used, SRI further shows. The massive promotion activity involved a campaign on TikTok, through several coordinated accounts that actively published electoral content, both with the help of recommendation algorithms and through paid promotion.

The network of accounts directly associated with Calin Georgescu's campaign was initially made up of 25,000 accounts on the TikTok platform, which became very active two weeks before the election date. The promotional campaign was particularly well organized, with the number of followers increasing significantly.

The Telegram channel Propagator - get involved, Rebirth of Romania, Food Water Energy (Gpropagatorcg), which has the role of coordinating other users on the posts and video content distributed, was also identified.

"The @propagagatorcg subscribers received clear instructions on how to operate the accounts, recommendations on user behavior at the TikTok level, respectively the messages that were to be promoted or distributed, in the sense of including specially chosen emoji and the name of the candidate to exploit TikTok algorithms. These were prepared in advance and instantly uploaded to TikTok," the SRI added.

Furthermore, an extensive network of high-profile public figures from the TikTok platform (influencers) was used to promote Calin Georgescu's campaign, both directly (by publicly supporting the candidate) and indirectly (through messages that were apparently neutral, but contained labels associated with the candidate, such as #echilbrusiverticalitate). Some of them intentionally did not mark the advertising as paid, in order to avoid the association of the posts with those dedicated to election campaigns.

Also, according to the cited source, accounts falsely representing Romanian state institutions were created and used, such as TikTok accounts that falsely used the SRI logo and the Counter-Terrorism Brigade (BAT) name, namey displaying thousands of followers and over 100,000 likes.

Numerous images of the Romanian Police and BAT forces, taken from the public space were distributed on these accounts. Appreciative posts of SRI-BAT/institutions of force and supporting candidate Calin Georgescu were identified in the comments, thus falsely inducing the idea that state institutions support him.

On November 20, according to SRI, the Central Electoral Bureau ordered "the removal of the online electoral propaganda materials illustrating the candidate Calin Georgescu in the 2024 elections for the Romanian President which do not contain the identification code of the fiscal agent".

The request was sent to TikTok, through the Permanent Electoral Authority (AEP), on November 21.