Documents declassified by Romania's security council on December 4 said the country was the target of an "aggressive hybrid Russian action" during recent election campaigns, including last month's surprise victory of a pro-Russian far-right candidate.
The Supreme Council of National Defense declassified the documents, saying they showed that Romania was the target of various coordinated actions leading up to the presidential election's November 24 first round, won by Calin Georgescu.
Voters in the EU and NATO member state will decide the winner of the presidential election in a runoff on December 8 that pits Georgescu against pro-European centrist candidate Elena Lasconi.
It had already been reported that TikTok was used to generate support for Georgescu and connect him to a Romanian audience in the millions. But the declassified documents show that Romania's intelligence service believes that Georgescu was massively promoted on TikTok with backing from Russia through multiple methods, including coordinated accounts, algorithms to boost his presence on the platform, and paid promotion.
SEE ALSO: How TikTok Fueled The Rise Of Romania's Far-Right Presidential Candidate GeorgescuThe documents help explain how Georgescu's popularity increased from 1 percent shortly before the race to 22 percent artificially, through a vast operation of manipulation that involved influencers and ensnared Romanian institutions as well as ordinary voters.
Some 25,000 TikTok accounts allegedly used to increase Georgescu's popularity "became very active two weeks before the date of the elections," according to the declassified documents.
About 800 of these accounts had extremely low activity until November 11. From that date onward "the entire network was activated at full capacity," according to the documents.
The intelligence service documents also show that influencers on TikTok were recruited to promote Georgescu directly by publicly supporting him and indirectly through neutral messages that contained labels associated with him.
Another method used to promote the independent candidate involved the creation of accounts that falsely represented institutions of the Romanian state.
Dozens of TikTok accounts were found that falsely used the intelligence service's logo and the title Anti-Terrorist Brigade (BAT), each displaying thousands of followers and over 100,000 likes.
These fake accounts had supportive posts for Georgescu, presenting the false notion that these state institutions supported him.
In addition, Georgescu's posts were not marked as belonging to a candidate, and this favored their mass dissemination. Other candidates whose posts were labeled as belonging to a candidate had a diminished online presence.
Romania's intelligence services hinted that large sums of money would have been spent in the operation. Georgescu, according to information revealed in the declassified documents, declared to Romanian electoral authorities that he spent nothing on his campaign.
The intelligence service linked the operation to Russia by noting that access data for official Romanian election websites was published on Russian cybercrime platforms. The access data was probably procured by targeting legitimate users or by exploiting the legitimate training server, the intelligence service said.
It added that it had identified more than 85,000 cyberattacks that aimed to exploit system vulnerabilities.
"The attacks continued intensively including on election day and the night after elections," the agency said in one of the declassified document.
"The operating mode and the amplitude of the campaign leads us to conclude the attacker has considerable resources specific to an attacking state."
Russia has denied any interference in Romania's elections.
TikTok confirmed the deletion of electoral propaganda materials two days after the request of the Central Electoral Bureau, but it did not delete the electoral content as requested by the Permanent Electoral Authority, and it continued to be available to the public even after the end of the election campaign, including on election day, in violation of Romanian election law.