CSAT Meeting, November 28. File photo/presidency.ro

Iohannis Declassifies Documents in CSAT Meeting Revealing Operation of a State Actor to Promote Calin Georgescu

797 TikTok Accounts out of a total of 25,000 for Georgescu Activated Fully in Electoral Campaign. Tik Tok admitted that it collected $381,000 from Georgescu's campaign.

By Romania Journal Last updated Dec 4, 2024

Get real time updates directly on you device, subscribe now.

President Klaus Iohannis agreed to the declassification, at the request of the issuing institutions, of the information presented by the SRI, SIE, STS and the Ministry of Internal Affairs, in the CSAT meeting of November 28, according to the law, the Presidential Administration announced.

The CSAT announced, after the meeting on November 28, that the members of the Council found that there were cyber attacks aimed at influencing the fairness of the electoral process and that, by violating electoral legislation, a candidate benefited from massive exposure on the TikTok platform.

The National Intelligence Service (SRI) reports speak of an operation prepared in advance, in favor of Călin Georgescu and which has the “mode of operation of a state actor”.

For example, the TikTok accounts were created in 2016, and the Telegram ones in 2022, and all of them were mobilized in the current campaign.

SRI specifies that the network of accounts directly associated with Călin Georgescu’s campaign was initially formed by 25,000 accounts on TikTok that became very active two weeks before the first round.

The promotion campaign was particularly well organized, the number of followers increased significantly. 797 of the accounts that initially formed the network were created as early as 2016. They had very low activity (1%) until November 11, 2024, when the entire network was activated at maximum capacity.

SRI also advances sums of money, 1 million euros, which were mobilized, of which 381,000 dollars were paid to TikTok, money recognized by the Chinese company.

The SRI uses the idea that a state actor was involved in the Romanian elections twice. First, through certain attacks on AEP systems. Secondly, in the way in which Călin Georgescu’s notoriety was inflated and the promotion, messages and volume of TikTok accounts used were correlated.

SRI shows that no common technical resources were used and no shared IP addresses were observed. Specifically, the TikTok accounts in question were assigned to unique IP addresses, which denotes a mode of operation intended to make it difficult to identify the extent of the network based on the use of a common infrastructure (a characteristic aspect of bot networks).

The activity of the accounts in the network was organized outside the TikTok platform, namely on the Telegram messaging service. A propagating Telegram channel was identified – “Get involved too Renașterea României Hrănă Apa Energie” – which has the role of coordinating other users with regard to the posts and video content distributed.

On November 24, the Telegram channel Propagator had 1,088 subscribers, and on December 1 – the day of the parliamentary elections – 5,005, an increase of 600 members compared to the previous day.

According to data provided by TikTok to the Romanian authorities, on November 28, after the creation of the Telegram channel Propagator, 76 new accounts were registered, whose sole role was to promote Călin Georgescu. TikTok representatives also specified that this account – @propagatorrcg- was created on June 15, 2024 and had 3,755 subscribers on November 28 who were trained on sharing videos and posts and leaving comments using certain # on the Facebook, Youtube and TikTok platforms.

SRI mentions that 2 promotion patterns were detected:

1183 accounts used “#cg11” in all videos posted on TikTok. Of these, 1057 were registered on TikTok after the creation of the Telegram channel, and 76 were created and used exclusively with the intention of posting promotional content, the rest being associated with real people who voluntarily posted pro-Călin Georgescu content.
The accounts used a series of specific emoticons accompanied by the candidate’s name to exploit the platform’s algorithms.

Some of the Telegram groups on which Călin Georgescu’s supporters gathered were created in September 2022.

SRI also says that TikTok accounts were used that falsely used the SRI logo and the title Anti-Terrorist Brigade and that displayed thousands of followers and over 1,000,000 likes.

SRI: Bogdan Peșchir donated over 1 million euros, of which TikTok admits to receiving 381,000 dollars

Călin Georgescu declared zero euros in electoral expenses to the AEP. According to SRI data, in reality money was collected and spent. More precisely, SRI claims, Bogdan Peșchir’s TikTok account was involved in financing Călin Georgescu’s promotion. Using this account, Peșchir made donations on TikTok of over 1 million euros. Subsequently, his involvement in financing Georgescu’s promotion was also confirmed by TikTok representatives, on November 28. They mentioned that payments of 381,000 dollars were made from this account between October 24 and November 24 to users of TikTok accounts involved in Georgescu’s promotion. 1,000 euros were paid for sharing a video .

Also, the financing of TikTok influencers was ensured through the Fame Up platform, on which there was an advertising opportunity along with well-defined descriptions. One of the methods of attracting Romanian influencers to promote Georgescu was to contact them by email by the South African company FA Agency, which offered 1,000 euros for sharing a video.

According to the SRI, “the activity of the accounts would have been coordinated by a state actor who would have used an alternative communication channel to spread messages on the platform. It does not use bot farms on the platform but operates more discreetly from outside so as not to violate the platform’s usage policies.”

The SRI also says that those involved in the promotion campaign are very familiar with TikTok’s security policies and know how to circumvent them, and “there is a very good digital marketing company behind it.” The SRI also says that there was also a massive promotion on TikTok in support of POT, the party that supported Călin Georgescu.

These documents were presented at the CSAT meeting on November 28.

At the end of the meeting, the Presidential Administration announced that the CSAT members “asked the authorities with responsibilities in the field of national security, those with responsibilities in the smooth conduct of the electoral process, as well as the criminal investigation bodies to urgently take the necessary steps, according to their legal competences, to clarify the issues presented at the CSAT meeting.”

DONATE: Support our work

In an ever changing and challenging world, the media is constantly struggling to resist. Romania Journal makes no exception. We’ve been informing you, our readers, for almost 10 years, as extensively as we can, but, as we reject any state funding and private advertising is scarce, we need your help to keep on going.
So, if you enjoy our work, you can contribute to endorse the Romania Journal team. Any amount is welcome, no strings attached. Choose to join with one of the following options:

Donate with PayPal

Donate by Bank Wire

Black Zonure SRL
UniCredit Bank. Swift: BACXROBU
RON: RO84 BACX 0000 0022 3589 1000
EURO: RO57 BACX 0000 0022 3589 1001
USD: RO30 BACX 0000 0022 3589 1002