Professor Corneliu Bjola
On 6 December 2024, in an unprecedented move, Romania’s Constitutional Court annulled the results of the first round of its 24 November presidential election, citing evidence provided by intelligence agencies that the electoral process had been “compromised throughout its duration and across all stages”.
This dramatic decision, unparalleled in Romania’s history since the 1989 revolution against the communist regime, underscores the evolving nature of hybrid warfare, one aspect of which includes algorithmic manipulation and cyber-enabled disinformation campaigns that target and destabilise democracies. The prospect of a NATO Ally on the Alliance’s south-eastern flank being undermined—not through military invasion but through algorithm-driven social media manipulation—serves as a stark reminder of national security vulnerabilities in the digital age. The implications extend far beyond Romania, highlighting the urgent need to integrate robust information security measures into NATO’s strategic framework.
Case study: foreign information interference in the 2024 Romanian presidential election
At the centre of the controversy is Călin Georgescu, a pro-Russian ultranationalist candidate who has openly lauded the Romanian Iron Guard—a fascist and antisemitic movement active between 1927 and 1944—referring to its members as “heroes.” His unexpected first-place finish in the first round—receiving just under 23% of the vote, while the second-place candidate secured just over 19%—shocked both Romanians and international observers, especially given his minimal public profile before the election. His success capitalised on widespread dissatisfaction among a significant segment of the population with the political establishment. Georgescu’s campaign employed sophisticated digital strategies, heavily relying on TikTok and Telegram to manipulate public opinion with emotionally charged, highly polarising content. At the core of this strategy was a conspiratorial narrative portraying the country as being systematically “exploited” —its people and resources undermined by EU influence, allegedly facilitated by a corrupt national elite serving external interests. In fact, Georgescu’s out-of-nowhere campaign was itself supported by external actors with a geopolitical agenda. On TikTok, accounts linked to his candidacy amassed millions of views and likes. Analysis indicated that this surge resulted from a coordinated effort, with a significant proportion of the accounts originating from Russia and even Iran, strategically leveraging the Chinese-owned platform’s algorithms to amplify his message. Telegram played a complementary role, hosting regional groups that tailored messages to local concerns, mimicking tactics seen in the Republic of Moldova by pro-Kremlin networks.
Declassified intelligence reports revealed that 25,000 TikTok accounts, some of which had been dormant since 2016, became active in the weeks preceding the election and started supporting Georgescu. The engagement data displayed a clear pattern of artificial manipulation, involving bot-driven activity and coordinated amplification efforts. Allegations of cloned or hijacked campaigns deepened suspicions. A preliminary forensic investigation pointed to illegal funding streams and techniques associated with a sophisticated state actor, further implying external interference. A report published in December 2024 by the Foreign Policy Centre, a UK-based think tank, found that a coordinated ecosystem of online platforms—including Telegram, Facebook, X and YouTube—was used to disseminate nearly identical content promoting Georgescu. Of a sample of over 3,500 messages and publications amplifying his persona, the majority originated from Russia or Russia-affiliated actors, including channels, accounts, websites and state-owned media such as Russia Today (RT) and Sputnik, alongside numerous affiliates. Additionally, the output of a Telegram channel called Press TV—registered in the United States but flagged as affiliated with Iran’s state-owned media—suggested potential coordination, given the striking similarity in messaging. Between 25 November and 4 December, the Iranian outlet posted or reposted 15 messages about Georgescu, reinforcing narratives propagated across multiple platforms by a vast network of Russian-linked actors.
Then-US Secretary of State Antony Blinken and US lawmakers directly accused Russia of orchestrating the interference, drawing parallels to similar events earlier in 2024 during Moldova’s presidential elections. Moscow denied involvement, but the revelations sparked widespread international concern. Blinken emphasised the urgent need for a robust response to protect democratic processes in Eastern Europe. In December 2024, the European Commission opened a formal investigation into how TikTok manages risks of elections meddling in response to the situation in Romania. Taking note of the situation in Romania, Germany’s Ministry of Foreign Affairs issued a stark warning, stating that “Putin aims to divide us and undermine unity within the EU and NATO”.
Although Romania’s president holds limited powers, these include overall command of the armed forces and oversight of the country’s foreign policy objectives. Georgescu’s platform—as troubling for the West as his methods—directly challenged Romania’s integration into the EU and NATO. He disparaged the Deveselu base, a cornerstone of the United States’ Aegis Ashore Ballistic Missile Defence System, and promised to “reevaluate” its role. He also claimed that the Mihail Kogălniceanu military base, set to become NATO’s largest defence facility in Europe, would serve as a launchpad for war against Russia. Additionally, he referred to Ukraine as an “invented state” that would be dismantled after its defeat, suggesting that Romania should consider making territorial claims of its own.
These positions closely align with Kremlin narratives and pose a direct threat to NATO’s cohesion. Romania is critical to supporting Ukraine, serving as a main conduit for military deliveries and facilitating Ukrainian grain exports through the Black Sea. Destabilising Romania at this juncture could undermine international support for Ukraine, economically and diplomatically isolate the Republic of Moldova—which faces growing Russian intimidation ahead of its parliamentary elections—and neutralise a key element of US and NATO infrastructure. The geopolitical stakes are profound. Romania is not just a NATO member but a linchpin in the Alliance’s eastern defence strategy. A compromised Romania would disrupt NATO’s ability to project stability in the Black Sea region and beyond.
Reactive measures are not enough to defend against information warfare
The annulment of Romania’s election underscores the limitations of reactive measures in countering hybrid threats. Democratic systems remain ill-equipped to confront the challenges of the digital age, where hostile state actors and private entities exploit vulnerabilities in cybersecurity, social media governance and public awareness. The interference in Romania’s election exemplifies Russia’s approach to informational coercion, which does not rely on a single decisive action but rather on “persistent operational friction”—a sustained, cumulative process that builds influence over time and can be strategically activated when needed. Russia’s information operations in Romania did not emerge spontaneously in the weeks or months preceding the election; rather, they were the product of a long-term effort to establish networks, shape narratives and cultivate a disinformation ecosystem that could be mobilised at a critical moment. Russian narratives portraying Romania as a victim of the EU, NATO and Western elites were seeded into online spaces long before the electoral cycle – as similar narratives have been deployed in other NATO countries, pouring fuel that can be ignited when Russia decides to strike a match. This aligns with Russia’s doctrine of creating and maintaining a “positive informational background” (polozhitel’nyi informatsionnyi fon), where the information space is continuously shaped so that, when required, specific narratives can be rapidly amplified.
The annulment of the presidential election following intelligence revelations of foreign interference was, in itself, a strategic success for Russia. Whether or not Georgescu secured victory was secondary; the primary objective was to erode confidence in Romania’s democratic institutions and signal to other NATO states that their elections are equally vulnerable. The Romanian case should serve as a wake-up call for NATO and its Allies, underscoring the urgent need to shift from reactive crisis management to proactive, systemic resilience against hybrid information warfare.
NATO’s strategy for countering hybrid threats, first outlined in 2015 in response to Russia’s illegal annexation of Crimea, focuses on three pillars: preparedness, deterrence, and defence. Preparedness relies on intelligence-sharing among Allies and exercises like Steadfast Defender 24, which incorporate hybrid scenarios to enhance readiness for conflicts that blur traditional boundaries. Deterrence emphasises strengthening societal resilience, addressing vulnerabilities and sending a signal to potential adversaries that NATO is ready to respond if provoked. The strategy’s third pillar—defence—relies on strategic ambiguity regarding the conditions that would trigger collective action under Article 5 of the Washington Treaty. While this flexibility allows NATO to tailor responses to specific threats, it also introduces uncertainty that adversaries may seek to exploit, particularly in hybrid warfare scenarios. If hostile parties perceive that the Alliance is hesitant or divided over the Article 5 threshold, they may exploit this uncertainty to incrementally challenge NATO’s resolve, pushing boundaries without triggering a collective response.
In 2024, NATO updated its approach to address the increasing sophistication of information threats as a component of hybrid warfare, such as the use of AI and deepfake technologies by adversaries to erode public trust and destabilise societies. The October adoption of the Approach to Counter Information Threats introduced data-driven tools like the enhanced Information Environment Assessment (IEA), designed to analyse large datasets in real time and enable proactive responses to hostile narratives. In December, a further publication reinforced NATO’s commitment to safeguarding democratic institutions through strengthened partnerships with the EU and global actors.
Despite NATO’s efforts, the Romania case highlights significant gaps in the Alliance’s strategy, underscoring the urgent need for adaptation. Four key issues stand out. First, NATO member countries demonstrate uneven capacities to monitor and respond effectively to information threats. Under NATO’s rules, the primary responsibility to counter such threats rests with the targeted country, yet many lack the requisite resources and coordination for timely action. The European Centre of Excellence for Countering Hybrid Threats, established in April 2017, has provided a platform for sharing best practices, testing methods and exercising defences. While valuable for refining established approaches, it is less effective when adversaries employ rapidly evolving tactics, leaving gaps in preparedness. Second, the inherent difficulty in attributing hybrid actions—particularly those conducted via proxies or sophisticated disinformation systems powered by algorithms on non-Western platforms—significantly hinders NATO’s decision-making processes. This delay provides aggressors with a critical tactical advantage, leveraging speed and confusion to overwhelm the targeted state’s response capacity. Third, there is a growing amount of plausible evidence of strategic collusion between Russia and China, where the two powers indirectly or directly obscure each other’s involvement. This pattern has become apparent in incidents such as cable severing in the Baltic Sea, where Chinese vessels have advanced Russian strategic interests. Similarly, in the digital domain, Ukrainian intelligence reports suggest that Chinese hackers compromised up to 600 websites ahead of the war—claims later corroborated by US intelligence agencies. Finally, NATO’s strategy faces a persistent challenge in responding to hybrid threats that individually fall below the threshold for invoking Article 5 of the Washington Treaty. While the Alliance has affirmed since 2016 that hybrid actions could, in aggregate, justify collective defence, operationalising this response remains a critical task. Rather than relying solely on Article 5, NATO has demonstrated adaptability by coordinating responses through other mechanisms, such as the recent Baltic Sentry maritime initiative to protect undersea infrastructure. The challenge lies not in the absence of a response framework, but in ensuring that NATO’s approach effectively deters adversaries from exploiting sub-threshold tactics.
A new approach: Dynamic Information Resilience
To effectively address the challenges NATO faces in countering hybrid threats, the Alliance should adopt a Dynamic Information Resilience (DIR) framework designed to disrupt Russia’s strategy of persistent operational friction. This requires a dual focus: first, dismantling the long-term mechanisms through which adversaries embed and sustain disinformation ecosystems, and second, preventing the tactical exploitation of this groundwork at critical junctures, such as elections or geopolitical crises. This framework would be structured around four interconnected pillars, the first two aligned with dismantling long-term disinformation ecosystems and the second two focused on preventing their tactical exploitation at critical moments.
- Establish a NATO-wide Information Threat Intelligence Hub (ITIH) to detect and dismantle networks of malicious actors who create long-term disinformation ecosystems. Leveraging AI and real-time data analysis, the ITIH could identify suspicious algorithmic manipulation and ensure timely attribution, even when aggressors use proxies or sophisticated misinformation systems to obscure their involvement. In the Romanian case, the ITIH it could have tracked disinformation patterns on TikTok, exposing the interplay between Russian narratives and Chinese algorithmic amplification, providing actionable intelligence to pre-empt and counter information threats before they escalated.
- Strengthen partnerships through a Global Counter-Hybrid Alliance (GCHA) comprising NATO, the EU and international partners (South Korea, Australia, Japan, India, etc.) to exchange threat assessments, coordinate responses and implement measures including sanctions, cyber defences and strategic communications. In Romania’s case, the GCHA could have applied diplomatic pressure on platforms hosting such content, and exposed the strategic collusion between Russian and Chinese actors.
- Develop a Hybrid Threat Escalation Framework (HTEF) to prevent the tactical exploitation of information threats at critical moments by defining clear thresholds for NATO intervention. This framework would ensure a coordinated response to sub-threshold hybrid actions, enabling NATO to counter disinformation or other hybrid attacks without escalating to Article 5. In Romania, the HTEF could have triggered collective defensive measures, such as deploying digital forensic experts or initiating joint cybersecurity operations, to disrupt disinformation before it could destabilise democratic institutions.
- Deploy a Resilient Narratives Task Force (RNTF) to counter disinformation in real time and strengthen public trust in NATO and its members. Comprising NATO strategic communications experts, Allied governments, hybrid warfare specialists and independent voices (e.g., DFRLab, Bellingcat), the task force would expand as needed to include local influencers, journalists and cybersecurity experts. By ensuring counter-narratives are credible, widely disseminated and strategically amplified, the RNTF can directly engage audiences. In Romania, it could have deployed verified messaging on TikTok and other platforms to undermine falsehoods and restore confidence in democratic processes.
Unlike conventional military threats, which often present clear and identifiable thresholds of aggression, information warfare thrives on ambiguity. Adversaries deliberately obscure their involvement, operate below traditional conflict thresholds and exploit legal, institutional and procedural gaps to manipulate information ecosystems. This complexity makes it difficult to establish clear response mechanisms, often resulting in fragmented, delayed or inconsistent action—weakening deterrence and enabling sustained influence operations.
Through its four core dimensions, Dynamic Information Resilience (DIR) creates a structured and coordinated approach to countering hybrid threats. By defining clear points of action across intelligence, coordination, escalation and strategic communication, DIR ensures that NATO and its partners maintain a common threat perception, recognise the same intervention thresholds, and act in a predictable and unified manner. This shift ensures that responses are not merely reactive but also proactive, aligning intelligence, diplomacy, cybersecurity and strategic communication to systematically disrupt disinformation networks and prevent their tactical exploitation at critical moments.
