11 min de lectura
When a court intervenes in an election, the legal question is only the beginning. The political aftershock can travel much further, especially online, where complex decisions are quickly rewritten into simple stories about betrayal and “stolen democracy.”
Romania’s annulled 2024 presidential first round became one such trigger. Within months, it was repackaged into a portable conspiracy frame and applied to new disputes across Europe.
This paper traces how that frame spread from a single national crisis into a transnational narrative, how it is amplified through social media and Telegram ecosystems, and how it urges Europe to monitor and act against disinformation faster than ever before.
On December 6th, 2024, Romania's Constitutional Court annulled the first round of the presidential election, a historic decision of its kind. Two weeks before the annulment, Călin Georgescu won the most votes, a result that surprised many, given his limited reach. His campaign had minimal visible infrastructure and reportedly claimed zero spending.
The annulment was based on alleged illegal campaign funding, disinformation operations, possible AI-driven digital manipulation, and suspected foreign interference. Given the time-sensitive nature of the election, the court needed to act swiftly on the evidence presented. However, the decision triggered mass protests and sparked debates over democratic legitimacy, political polarization, and accusations of an attempted “coup”.
Since then, the case has been picked up by disinformation channels, which dubbed it the "Romanian scenario" and expanded it into a broader theory. The one claims that elites cancel elections when results are not favorable to their interests, through the use of courts, intelligence agencies, and accusations of foreign interference as cover. This narrative is persuasive as it builds on existing distrust of institutions and simplifies a complex legal-security case into a clear narrative of stolen democracy. What makes it even more persuasive is that it’s hard to disprove it. Counterarguments are framed as manipulated or produced by the very same institutions accused of conspiring in the first place.
Over time, this framing moved beyond Romania. Allegations of “institutional election theft” began to appear in anonymous Telegram channels and circulated during electoral periods in other European countries. In this way, the “Romanian scenario” has evolved into a shared transnational narrative – one that can be adapted to different local contexts and used by both domestic and external actors.
In the la República Checa, claims of election manipulation spread ahead of the October 2025 parliamentary vote. They included misleading stories about postal voting and accusations that the state, the intelligence service, and even the EU could “rig” the result. The Institute for Strategic Dialogue (ISD) notes that similar claims appeared on social media more than a year before election day and were amplified by a broad ecosystem: political activists across the spectrum, prominent public figures, and alternative outlets with Kremlin-linked ties. In practice, the “Romanian scenario” label worked as a simple frame that tied many different topics to one message – namely, that institutions could be used to block unwanted political outcomes.
The label was also used to reframe specific disputes as evidence of behind-the-scenes interference. Two examples were especially visible. First, it was linked to the launch of the EU’s Rapid Response System (RRS), a mechanism that helps EU member states share information about disinformation campaigns. Second, it appeared in conspiracy theories around the Czech Constitutional Court debate on whether Stačilo! y SPD should be treated as a coalition or as separate parties under election rules.
The same framing also appeared in Russian Telegram channels throughout 2025. It peaked in May, after Romania repeated its election. Shortly before the vote, Czech President Petr Pavel had to publicly reassure citizens about the integrity of the election and called on everyone to take part. This move was unusual, and it highlighted how visible and politically sensitive these claims had become.
While such narratives did not determine the election outcome on their own, they helped normalize suspicion toward institutions and fed into a wider sovereignty-first discourse, marked by stronger skepticism toward EU institutions, criticism of digital regulation, and growing opposition to aspects of Czech support for Ukraine. After the election, Andrej Babiš and ANO signed a coalition agreement with Eurosceptic partners, including the anti-EU SPD party, signaling a broader shift toward populist and Eurosceptic currents in Czech politics.
Polonia offers another clear example of how ‘rigged election’ claims can spread online, and how countermeasures can be reframed as censorship.
In June 2025, Poland held a runoff vote, where Karol Nawrocki, an independent nationalist conservative backed by the Law and Justice party (PiS), won the presidential election. By a narrow margin, he defeated the liberal, pro-EU candidate and Warsaw Mayor, Rafał Trzaskowski. The outcome came down to three main factors: mobilization of young voters, geographic division, and foreign interference. Reports of Russian disinformation and extensive cyberattacks marred the campaign. Investigation revealed that digital platforms were flooded with conservative content and fake accounts that systematically attacked Trzaskwski while promoting narratives aligning with Nawrocki.
Polish fact-checking organization, Demagog, analyzed data from multiple sources to investigate the spread of political disinformation on TikTok during the election campaign. They found that TikTok served as a major channel for political manipulation, particularly among younger voters.
Similar to Romania, they identified recurring false narratives claiming that the election would be “rigged” or manipulated. Content targeting Trzaskwski frequently relied on insults, ridicule, and emotionally charged rhetoric, rather than factual criticisms. And social media platforms amplify sensational, startling content through algorithms at the expense of verified information.
Having anticipated threats similar to those seen in Romania, Polish officials introduced enhanced monitoring measures ahead of the election. Several months earlier, the government had announced a cybersecurity program called Election Umbrella, designedto counter disinformation by allowing citizens to report suspicious content through an online platform. However, the PiS party criticized the program as a form of “internet censorship” and launched a counter-campaign, the Election Protection Movement, claimingit would stop the election from being stolen. These developments place Poland within the broader European debate surrounding election interference and disinformation, and the role of digital platforms in amplifying political narratives.
The Czech and Polish cases show how the “Romanian scenario” travels as a frame, even when the local triggers differ. In one setting, legal and institutional disputes are reinterpreted as proof of hidden interference. In another, platform-driven amplification and countermeasures become fuel for “censorship” claims. In both, the result is similar: distrust spreads faster than verification, and election integrity becomes a contest over narratives rather than evidence.
Across the cases above, the same narrative logic repeats. When an outcome is unwanted, or when institutions intervene, political actors and aligned networks frame it as proof that “the system” is prepared to overturn the public will. What begins as a legal, technical, or procedural dispute can quickly turn into a broader story of democratic betrayal.
In this narrative, three elements tend to appear together.
These narratives spread through an ecosystem that mixes mainstream and fringe actors. Politicians and public figures provide visibility. Influencers and partisan outlets add emotion and repetition. Alternative media and Telegram channels help sustain the story and connect it to wider conspiratorial themes. This combination allows domestic grievances to merge with transnational frames. As a result, the argument often shifts from evidence to suspicion: even when proof is limited, the repeated suggestion that elections can be “managed” is enough to weaken trust.
Over time, the harm is cumulative. Each new accusation makes the next one easier to believe. Institutional decisions are interpreted through a lens of hidden interference, and public confidence becomes harder to restore. In this sense, the “Romanian scenario” is not only a claim about one election. It is a reusable script that can be activated whenever trust is already fragile.
The “Romanian scenario” highlights a deeper governance dilemma for democracies. Governments may need to act against unlawful funding, foreign interference, or coordinated manipulation. Courts may need to investigate or overturn violations. Platforms may need to limit coordinated inauthentic behavior. Yet the same actions, especially when taken during a tense campaign, can carry high legitimacy costs if they are perceived as political, selective, or opaque.
This creates a structural vulnerability. The main risk is not only disinformation itself, but also the erosion of trust in institutions meant to protect elections. When credibility is weak, even lawful safeguards can be repackaged as proof of a “stolen” process. In other words, the defensive response can become part of the narrative.
This is why the debate does not end when voting ends. Even if a specific “rigging” claim fades, the frame remains. It can be reused in future campaigns, and it can also be expanded to target EU-level efforts to strengthen election integrity. In contexts of Czechia and Poland, these narratives have blended into broader sovereignty-first messaging: skepticism toward EU institutions and opposition to support for Ukraine. These developments are not caused solely by disinformation, but narratives like the “Romanian scenario” help make institutional distrust sound normal – and that lowers the political cost of exploiting it.
The implication is uncomfortable but clear: protecting elections is not just a technical challenge. It is also a legitimacy challenge. If institutions cannot explain their actions quickly, clearly, and consistently, adversarial actors can fill the gap with a story that is easier to spread than a legal argument.
To understand why this frame spreads so effectively, it helps to look at the mechanisms that turn isolated allegations into a durable political story.
The electoral process is the cornerstone of democracy, yet it is increasingly vulnerable to manipulation. The Czech and Polish examples show that the “Romanian scenario” travels through a familiar delivery system. It does not rely on a single viral post or platform; it spreads when several channels reinforce the same suspicion at once: short-form video, politicized commentary on X, and persistent messaging on Telegram. In this environment, even small signals (court debates, monitoring tools, or platform action) can be reframed as proof of “hidden control.”
Romania illustrates how these dynamics can escalate during a high-stakes vote. Investigations reported extensive cyberattacks, including more than 85,000 attacks against electoral IT infrastructure during the first round of the 2024 presidential election, which continued intensively on election day and the night after the vote. Alongside technical pressure, narratives were amplified through AI-generated content, bot networks, coordinated accounts, and Telegram channels. These tactics do not need to “convince everyone.” Their goal is often to create doubt and inflate the sense of chaos.
Platform incentives help these claims scale, as algorithms tend to reward content that is emotional, polarising, and easy to share. This gives an advantage to sensational accusations over careful explanations, especially in short-form formats. Over time, this can create algorithmic isolation, where users repeatedly encounter the same framing and rarely see corrective context. Bots and coordinated groups further accelerate this effect by boosting visibility and creating the impression of widespread agreement.
These mechanisms are not unique to Romania. In Germany, the 2024–2025 electoral cycles saw a rise in conspiratorial narratives and influence activity, including coordinated propaganda, cyber pressure, and networked amplification. Before the 2025 elections, more than 240 political Telegram channels targeting German audiences were identified, spreading pro-Kremlin and extremist content. The pattern is consistent: domestic grievances provide the entry point, and cross-platform networks help turn them into broader stories about institutional betrayal.
Combatting campaigns of disinformation and foreign interference is proven challenging and requires a multifaceted approach. Because the problem is both technical and political, solutions must address infrastructure and legitimacy at the same time.
In this context, strengthening regulatory frameworks as well as enhancing existing laws governing digital platforms is vital to ensure accountability for the spread of disinformation.
The Digital Services Act (DSA) is the primary law governing social media platforms in the EU, imposing requirements for the removal of illegal content, algorithm transparency, and addressing systemic risks such as disinformation and electoral manipulation. While the DSA strengthens platform accountability and enforces user rights, it has operational shortcomings in the current digital landscape.
Enforcement of the DSA should move beyond formal political advertising to address organic influence campaigns, such as the one observed in Romania. This includes requiring large platforms to conduct real-time risk assessments during electoral periods and to provide greater transparency on algorithmic amplification, particularly for viral political content.
However, the effectiveness of these measures also depends on how quickly and consistently member states implement and operationalize the framework at the national level. As highlighted in the Czech case, delays in transposing and enforcing DSA-related mechanisms can weaken the EU's ability to respond rapidly to coordinated influence campaigns. Because of this, critical tools for countering foreign information manipulation are less effective during sensitive periods.
The EU should also strengthen its Rapid Response System (RRS) to enable faster cross-border information when coordinated campaigns emerge, ensuring that signals (such as the surge in coordinated messaging seen around Georgescu) are identified and addressed early. This would improve coordination between member states and strengthen early detection of coordinated influence campaigns. International cooperation is crucial in addressing these challenges. Collaboration among EU member states and partners allows countries to share the practices that work best and develop coordinated responses to disinformation campaigns. Advocating for a unified stance against foreign interference in elections to uphold democratic integrity across borders is crucial at this stage.
Finally, clearer regulatory strategies are needed for under-regulated platforms like Telegram.
Messaging platforms become breeding grounds for extremist communities, conspiracy networks, and foreign influence operations, and continuously spread unverified narratives and false information.
The highlighted cases demonstrate that regulatory effectiveness depends not only on legislation itself, but also on institutional speed, coordination, and enforcement capacity during a rapidly evolving electoral crisis.
That is why national authorities must prioritize proactive communication strategies. In Romania, the late-stage annulment created an information vacuum that allowed the “Romanian scenario” narrative to flourish. Election bodies should therefore implement pre-bunking strategies ahead of elections, clearly explaining under what legal conditions results could be challenged or annulled.
In addition, authorities should develop a crisis communication manual for high-impact decisions (such as annulments), ensuring rapid, transparent, and consistent messaging across institutions. This includes close coordination with courts and intelligence services to avoid fragmented communication that can be exploited by disinformation actors.
The key takeaway is that protecting democracy depends not only on countering disinformation but on strengthening the institutions that prevent it. Greater support for national regulators and stronger cross-border cooperation are essential to address threats early.
Civil society and independent media should shift from reactive debunking to proactive narrative inoculation. The case of Romania shows that once narratives of “stolen elections” take hold, they are difficult to reverse. Fact-checking efforts should therefore be complemented by early identification of emerging narratives and clear explanations of how disinformation tactics operate.
Encouraging partnerships between tech companies and civil society can enhance the visibility of verified information. However, efforts should focus on building long-term trust, particularly by explaining complex institutional processes in accessible ways.
Lastly, promoting media literacy through educational programs aimed at improving critical thinking and informed decisions might enable individuals to better identify misinformation. Collaborating with civil society organizations to raise awareness of disinformation tactics, specifically linked with real-time electoral contexts, can further strengthen this effort.
The views, thoughts, and opinions expressed in the papers published on this site belong solely to the authors and not necessarily to the Transatlantic Dialogue Center, its committees, or its affiliated organizations. The papers are intended to stimulate dialogue and discussion and do not represent official policy positions of the Transatlantic Dialogue Center or any other organizations with which the authors may be associated.
