European Union
Romanian Elections and the EU’s Digital Services Act: TikTok and Election Subversion
In light of Romania’s recent presidential elections and the unexpected developments surrounding the political process, the European Commission issued a ‘retention order’ to TikTok on 5 December 2024. The order requires the platform to “freeze and preserve data related to actual or foreseeable systemic risks its service could pose on electoral processes and civic discourse in the EU.” This action is a direct response to evidence of foreign interference and sophisticated digital campaigns orchestrated to manipulate the election’s outcome.
Documents declassified by Romanian President Klaus Iohannis revealed that 797 of nearly 25,000 unusually active TikTok accounts, supporting the presidential candidate Călin Georgescu, were created as far back as 2016 but remained dormant until weeks before the November 2024 election. According to Romania’s intelligence agency, the SRI, these accounts were likely part of a coordinated effort by foreign state actors. Their sudden activation formed the backbone of a highly organised campaign promoting Georgescu’s candidacy.
The network exhibited alarming patterns of activity. For instance, accounts utilised unique IP addresses to obscure their origin, while the coordination of the TikTok campaigns occurred primarily off-platform via Telegram. Specific Telegram groups for this purpose were created as early as September 2022, indicating long-term planning.
Patterns of Influence
Romanian intelligence has so far identified two key strategies employed by this campaign:
- Hashtag Coordination: A total of 1,183 TikTok accounts heavily promoted the hashtag “#cg11.” Of these, 1,057 were created after the corresponding Telegram channel’s establishment, while 76 accounts were exclusively used to post promotional content. The remainder were linked to real individuals who voluntarily engaged in pro-Georgescu activity.
- Algorithm Exploitation: Accounts utilised specific emoji strings alongside Georgescu’s name to exploit TikTok’s recommender system.
Efforts to recruit Romanian influencers also surfaced, with individuals reportedly contacted by the South African-based “FA Agency,” offering €1,000 for each promotional video. The SRI’s findings suggest the involvement of a well-funded digital marketing firm in this subversion. This highlights a continuation of the already decade-long-model of electoral interference, where foreign actors strategically exploit platform vulnerabilities while maintaining plausible deniability, effectively acting with impunity.
The Commission’s Response and the Role of the Digital Services Act
The European Commission’s issuance of the retention order underscores the importance of the Digital Services Act (DSA) as a tool for addressing emerging threats to democratic processes. While the DSA does not explicitly define a “retention order,” its legal basis lies in Article 67, which allows the Commission to request necessary information and demand data preservation to assess compliance with the Act. This measure is part of a broader mandate to mitigate systemic risks under Article 34, in which subsection (a) highlights illegal content and subsection (c) highlights ‘any actual or foreseeable negative effects on civic discourse and electoral processes, and public security’.
The TikTok retention order focuses on preserving critical evidence tied to its recommender systems, including:
- The design and functionality of these systems.
- How they address the risk of manipulation through coordinated inauthentic behaviour.
- Internal policies governing the monetisation of political content.
This order’s scope extends to all EU elections occurring between 24 November 2024 and 31 March 2025. The Commission aims to ensure that data relevant to systemic risks and disinformation campaigns remains intact for potential further investigation.
Coordination Across EU Institutions
The Commission’s has also convened a meeting of the European Board for Digital Services Coordinators to align national efforts across Member States. Moreover, evidence has been shared with the Cyber Crisis Task Force, involving the EEAS, Europol, and ENISA, to address broader cybersecurity threats tied to foreign interference. This collaborative framework demonstrates the EU’s capacity to respond decisively to election-related risks.
TikTok’s obligations under the DSA also extend to facilitating greater transparency and public scrutiny. The platform is expected to grant researchers access to publicly available data to better understand the systemic risks affecting civic discourse and democratic processes.
Is This the New Normal?
The Romanian elections are the latest in a long string of ‘instances’ in which one of a handful state actors effectively meddles in elections and rejoices in sowing chaos. Over the last decade, the use of coordinated online campaigns, disinformation, and algorithm exploitation has fundamentally reshaped how elections are contested and influenced globally. More importantly, states are still unsure as to how to effectively counteract it.
One of the earliest large-scale examples of election subversion through social media was the Brexit referendum. The Leave campaign benefited from targeted advertisements and disinformation spread via Facebook, much of which was tied to external actors exploiting voter fears around immigration and economic decline.
The 2016 US presidential election was the defining moment in understanding social media’s role in election interference. Russian actors, including the Internet Research Agency (IRA), created fake accounts to disseminate divisive content, while Facebook, Twitter, and YouTube were used to amplify political polarisation. Coordinated campaigns targeted swing states with disinformation aimed at suppressing voter turnout among minority groups, sowing doubt about Hillary Clinton, and promoting Donald Trump’s candidacy.
Although platforms implemented stricter policies by 2020, disinformation campaigns relating to the US elections remained rampant. Domestic and foreign actors used Twitter and Facebook to challenge the legitimacy of mail-in voting, amplify conspiracy theories such as QAnon, and dispute election results. TikTok also played a role, as new strategies emerged to manipulate the platform’s recommender system with coordinated content promoting electoral fraud narratives.
In Europe, the 2017 French presidential election saw a massive leak of campaign emails—known as “MacronLeaks” spread through Twitter and forums like 4chan just days before the election. Russian-linked groups were identified as potential perpetrators, though the swift response from French authorities and a media blackout on reporting the leaks helped mitigate the impact.
India, the world’s largest democracy, also grappled with election-related social media subversion in 2019. WhatsApp became a central vector for spreading fake news, with doctored videos, false narratives, and communal propaganda disseminated to influence voters. The Indian elections highlighted the unique challenges posed by closed platforms where encryption limits oversight.
The 2019 EU parliamentary elections were targeted by smaller but equally concerning campaigns. Facebook and Instagram were used to spread politically motivated disinformation about immigration, climate policy, and EU governance. Although platforms like Facebook launched transparency tools for political ads, researchers noted their limited effectiveness in combating covert networks of disinformation.
The Evolving Playbook
It is not only the central role of social media platforms and their algorithms but the adaptability of those seeking to exploit them. While earlier campaigns relied heavily on bots and fake accounts, more recent efforts have shifted toward using real accounts and off-platform coordination tools like Telegram and Discord.
As digital platforms continue to shape public discourse, electoral interference appears to have become a persistent feature of modern politics. It would be deeply unsettling to acknowledge that such subversion tactics have become an unavoidable element of democratic processes in the digital age. This would effectively mean that no democratic election will be safe nor fair.
The desire of regular people to wilfully seek out such content should not be underestimated either. The Dominion Voting Systems v. Fox News Network case and subsequent settlement showed that, during the US 2020 elections, Fox News was losing substantial amounts of viewers to rival conspiratorial media outlets who were falsely accusing the election being stolen and that, to retain their audience (and revenue streams), they effectively had to lie to their viewers, as that was what their audience wanted to tune in to.
Future outlooks for Europe
It should be highlighted that none of the social media companies are made by Europeans and, by extension, none of these companies have any meaningful connections to Europe. Similarly, since the benefits of election subversion are not quantifiable, it should be assumed that, based on the overall decade-long meek response by Europe as a whole, state actors will happily continue doing it, with ever-growing sophistication.
