A year since the TikTok Messiah’s rise, the shock is far from over

This article was written by Manuela Preoteasa and published on Euractiv.ro.

Although initially credited with only a few percentage points in pre-election polls, Călin Georgescu emerged as the leading challenger after the first round. A previously marginal public figure, Georgescu rapidly transformed into a first-rank contender, propelled by an overwhelming wave of social media content that portrayed him almost as a messianic figure across TikTok, Facebook, YouTube, and other platforms.

At the same time, mainstream parties contracted communication agencies to run extensive influence campaigns - carefully labelled as non-political, since TikTok officially prohibits political advertising.In contrast, Georgescu repeatedly claimed that he spent zero money on his campaign. Warnings regarding these dynamics had already been issued by organisations such as Expert Forum even before the official electoral campaign period began (November 18), one week ahead of the election day.

In terms of narratives, Georgescu’s blend of mystic, sovereignist, and conspiracy-laden discourse is significant because such narratives resonate strongly with both far-left and far-right citizens (See details on what happened in the first campaign in Radu, 2024).

Nevertheless, the society is still in shock, while the manipulation continues on the platforms.

Coordinated inauthentic behaviour (CIB), its form of astroturfing and FIMI

CIB and astroturfing were identified among the reason on which the Constitutional Court based its decision of annulling elections, while they still remain highly active in the platforms.

What does CIB mean? Coordinated inauthentic behaviour was defined by Meta as a "coordinated campaign that seeks to manipulate public debate", and one of its forms, astroturfing, creates "the illusion of widespread support for a product, policy, or concept, when in reality only limited support exists”. (Chan apud Preoteasa, 2025)

What does FIMI mean? Foreign Information Manipulation and Interferences (FIMI) is described as a mostly non illegal pattern of behaviour that threatens or has the potential to negatively impact values, procedures and political processes. Such activity is manipulative in character, conducted in an intentional and coordinated manner, by state on non-state actors, including their pixies inside and outside their own territory. Although countering FIMI is at the core of the fact-checking in Eastern Europe (see 2025, 7-8 November, Unveil the truth - Eastern partnership fact-checkers conference), FIMI remains little discussed in the Romanian public sphere.The National Defence Strategy, publicly presented by the Presidency, has a few points linked to FIMI, however, the concept remained vaguely formulated.

The CIB in electoral frameworks

From the computational perspective, CIB is typically identified through two main dimensions:

• Temporal patterns: Time-stamp analysis examines when a specific post or piece of content is distributed across accounts. If a post is shared by a large number of accounts within seconds or a few minutes, the probability that this is organic human behaviour is extremely low. Such ultra-rapid, synchronised amplification usually indicates automation (bots, scripts) or centrally orchestrated posting schedules. This temporal clustering is one of the strongest early indicators that the behaviour is coordinated rather than spontaneous.

• Network coordination indicators (1.2. Node analysis) Node analysis looks at how accounts interact and whether they form structures that signal organised activity. If multiple accounts repeatedly post the same content, at the same times, using the same hashtags, links, or phrasing, they form coordination clusters.

These clusters (or "nodes”) can show patterns such as shared administrators, synchronised posting routines, identical behavioural fingerprints, or mutual amplification loops. When time-stamp anomalies (1.1) align with coordination clusters (1.2), the probability that the behaviour is manipulative rather than human-driven increases sharply.

Human vs. Manipulative Actions

Human action usually appears irregular: different posting times, varied engagement patterns, natural delays, and diverse language.

Manipulation or fabrication shows high synchronicity, repetition, and structural patterns that do not occur naturally in human networks

CIB was identified prior the shock which led to invalidation, but not stopped

Expert Forum noted in its mid-November research paper, which monitored January- November 2024 interval:

"Georgescu (...) achieved in the last two months the virality built by the first three candidates in 11 months". Some of the reasons listed by Expert Forum:

• the campaign using the hashtag #balanceandverticality had 2.4 million views, where influencers described Călin Georgescu according to a copy-paste script, without naming him, but using his own characterisations.

• Following the model of the Stoianoglo campaign, there were Romanian influencers with no affinity to politics, i.e. with exclusive content on fashion, makeup, entertainment, who have started to post under a single hashtag, without naming the recipient candidate.

• The campaign ws promoting Călin Georgescu under the hashtag #echilibrusiverticalitate and is based on the idea of a president who believes in neutrality, verticality, basically recycling Georgescu's messages from the TikTok campaign from September 2024 to November 18, #calingeorgescu has gained 120 million followers.

Coordinated promotion campaign evidences (exposed before 24 Nov. 2024):

Exaggerated traffic without a relevant number of followers before the last 2 months: 31 800 followers to 154,900 in November - 150 million views is obsessively generated only around the hashtag #calingeorgescu - the main idea was peace (with the meaning of capitulation). See Expert Forum, 2024, November 18, From Underdog to Contender: The Rise of Călin Georgescu in the Polls) .

CIB continued in the re-run elections

The May 2025 re-run elections were organised in a climate of a still highly active Tik-Tok coordination of inauthentic behaviour, which has been evidenced by investigative and research papers.

The Prompt Project made its own analysis since the focus on Romanian elections put in light the manipulation techniques across the social media networks. A set of 164,762 public Facebook posts related to the Romanian elections (Jan 1, 2024 – May 6, 2025) was analysed using CooRTweet to detect coordinated behavior. 97 groups of accounts exhibited signs of CIB. (evidenced through the following indicators: min_participation: time_window: 10 seconds; edge_weight: 0.9 (quantile filter); subgraph: 1 (focus on strong coordination). The full results of the analysis - the first narrative report Prompt #1.

• Source: Prompt First narrative report, 2025

• Explanatory: Each row represents a community - a cluster of accounts, pages, or entities that show some pattern of coordinated activity. The columns includes indicators used to detect coordination, based on timing, structure, and content overlap. The numbers in the Community column (e.g., 2, 42, 8…) are IDs assigned to clusters of accounts. Average time between actions (e.g., posts, retweets, likes) within that community. Low values (e.g., 0.5 seconds) → accounts act nearly simultaneously → strong sign of automation or tight coordination. High values (4–6 seconds) → still fast, but less synchronised → may indicate semi-automated or human-assisted behaviour.

• Interpretation: Community 4 (0.50s) and 42 (0.95s) are highly coordinated. Community 2 (5.74s) and 1 (5.47s) - although slower, the time is unusually close for human user activity.

• See also the partial results of the Analysis published in May 2025: Prompt Research Coordinated inauthentic behaviour surfaces again in the re-run of Romanian elections

Prompt continued to analyse relevant corpus from Romanian media space and also from the Moldovan elections. The conclusions will be presented in a series of articles which will be published both in English and in Romanian in this section.

CIB signaled by various organisations

Analysis by Funky Citizens (2025, April 1-23 and 2025, April 24- May 11, respectively) signaled inauthentic coordinated activity designed to promote and amplify the messages of populist candidates and parties, similar to the process of weaponization of social media, which has been noticed since 2024 (see 2024, Undermining democracy: The weaponization of social media in Romania’s 2024 elections).

Methodology - case study Romanian elections

This case study was designed as a real-time investigation into the Romanian electoral context during 2024-2025, with the objective of rapidly identifying coordination dynamics and dominant narratives across public discourse. The approach aimed to gather the broadest set of social media data related to the Romanian elections, in order to assess the presence of semantically aligned behaviours within the evolving media ecosystem. To achieve this, two datasets were compiled and merged. The first was generated using a set of targeted keywords, including names of political figures (Antonescu, Simion, Ponta, Lasconi, Georgescu, Terheș, Sandru), electoral terms (elections, vote, party, candidate, campaign), ideological references (deep state, traditional values, family, social cleansing), and geopolitical issues (Ukraine, Russia, war, refugees). This dataset spans from 1 January 2024 to 6 May 2025 and consists of approximately 88,000 public posts. The second dataset consisted of approximately 96,000 posts published between August 2024 and 23 April 2025 by problematic Romanian Facebook accounts, identified and provided by a local NGO. These posts were retrieved through Meta's Content Library. The two corpora were deduplicated and combined to form a unified dataset. Coordinationpatterns were then analysed separately using CooRTweet, as detailed in the followingsection.

The temporal dynamics of online interaction can be identified through Saqr method. It identifies temporal centrality - users who initiate or amplify discourse early - reveals short-lived cluster formation around events, and uncovers recurring temporal patterns such as echo bursts or cascades. It can detect narrative reactivation, such as the revival of anti-LGBT rhetoric during elections, and supports crisis reactivity tracking by mapping real-time responses to external events. Because it focuses on temporal co-occurrence rather than content repetition, the method exposes subtle, adaptive coordination - making it especially valuable for disinformation research where behavioural alignment is low-visibility and dispersed. [Full Methodology description - pages 10-38 in the report ]