This analysis is based on data collected using techniques such as Google dorking and OSINT monitoring, centralized in two separate Excel files: one dedicated to Russian-language news websites available HERE and one dedicated to Russian-language Telegram channels available HERE. The main objective of the analysis is to understand how the recent protests in Romania on the topic of justice are represented in the Russian-speaking information ecosystem and what kind of narratives, interpretative frameworks, and amplification mechanisms are activated starting from this event.
Quantitative dimension: volume, timing, and distribution
The dataset includes 13 articles published on news websites in Russian and 21 posts published on Telegram, in a relatively short period of time, between December 10 and 19, 2025. From a temporal perspective, the data indicate a clearly defined information wave, with an earlier debut on Telegram and subsequent consolidation on websites.
Telegram functions as initial accelerator: the first mentions appear on December 10–11, with a peak of 5 posts in a single day. Websites follow this trend 1–3 days later, reaching a maximum on December 14. This sequence is typical for hybrid ecosystems: semi-closed and reactive platforms (Telegram) quickly absorb the subject and interpretively charge it, and online press subsequently normalizes it by volume and diversification of sources.
Distribution across websites is fragmented: most domains appear with a single publication, and only a few (e.g., TASS) appear twice. However, this fragmentation does not reduce the impact; on the contrary, it creates an impression of omnipresence. The same topic appears "everywhere," even if each website contributes marginally. From an OSINT perspective, this is an indicator of organization and mirroring, not necessarily of independent editorial production.
In Telegram, distribution is more concentrated. A few channels generate volume (e.g., "Гений Карпат," "Sputnik Moldova 2.0"), but the real impact is measured by the audience, especially a major channel that gets over 200,000 views with a single post. This imbalance between volume and reach is key: a single large node can have a greater impact than dozens of small channels.
From street protests to narrative construction
The triggering event is real and verifiable: protests against corruption and the functioning of the justice system in Romania, triggered and amplified by the publication of the Recorder documentary "Justice Captured". In the first reports, especially on websites that take information from Romanian sources (Agerpres, HotNews), the emphasis is on the description of the protest, on claims and official reactions. However, qualitative analysis shows that Russian-language sources quickly shifts from narration to interpretation. The main theme becomes not the protest itself, but the idea of "capture" or "total control" of the judiciary from Romania – a member state of the European Union. This formulation appears repeatedly and functions as a framework for systemic delegitimization, not as a specific criticism.
The sub-narratives that emerge are relatively consistent in both data sets:
- the idea that the "elite" protect each other;
- the idea that corruption cases are deliberately closed due to the statute of limitations;
- the idea that the protests are not just civic, but symptomatic of a deep crisis in the state.
In the Telegram ecosystem, these sub-narratives are often extended in a geopolitical direction, through direct comparisons with Republic of Moldova (due to the presence of local pro-Russian propagandists) and through attacks on the discourse about Russia's hybrid aggression. Thus, the Romanian event becomes a rhetorical tool to simultaneously undermine both the credibility of the institutions of an EU member state and the legitimacy of judicial reform in the Republic of Moldova in the context of accelerated European integration.
Framing, tone, and emotion
From a framing perspective, content analysis shows a clear alarmist bias in most of the materials published on Russian-language news websites such as TASS, Profile.ru, Dzen.ru, NewsOne, NewsFront or Tsarigrad. These sources explicitly or implicitly use constructions that suggest a total systemic crisis, through phrases such as "захвачена судебная система" (the judicial system is captured), "система контролируется" (the system is controlled) or "правосудие в плену" (justice in captivity). This type of framing leaves no room for nuance or debate, but instead establishes from the outset the idea that the entire justice system is irreparably compromised and that any institutional response lacks credibility.
A distinct and particularly relevant case is identified on the website Romania-Today.ru quoting Romania TV, where the protest is explicitly reframed in a conspiratorial register, being described as “попытка государственного переворота” (attempted coup d'état). Although this interpretation is unique among the set of web articles analyzed, its potential impact is high, as it transforms a legitimate civic protest into a threat to the constitutional order, a narrative pattern frequently used to delegitimization of democratic dissent.
The editorial tone differs significantly between platforms. On news websites such as TASS, Profile.ru or Polit.ru, the tone remains predominantly informative, even when headlines are dramatic or emphasize the crisis dimension. In contrast, on Telegram, especially on channels such as Рыбарь, Sputnik Moldova 2.0, Гений Карпат or Moldova Liberă, the tone often becomes militant or insinuating. Direct assessments, irony, and geopolitical comparisons are used here, as well as indirect attacks on institutions or the press, indicating a shift from simple information to emotional mobilization of the audience.
The emotion induced is, in most cases, distrustThe public is constantly exposed to messages suggesting that institutions "do not work," that reforms are "formal" or "false," and that official discourse is manipulative. This state of mind is constructed through the repetition of terms such as "коррупция" (corruption), "кризис" (crisis), and "система" (system), associated with justice. In certain Telegram posts, especially those with high reach, mistrust is amplified to anger or fear, especially when extreme scenarios such as "государственный переворот" (coup d'état) or the idea of "захваченное государство" (captured state) are invoked.
An additional framing element is using Romania's status as an EU member state as a rhetorical tool, using phrases such as "в стране – члене ЕС захвачена судебная система" (in an EU member state, the judicial system has been captured) or "европейские стандарты не работают" (European standards do not work). Thus, the case of Romania is used to suggest the fragility or hypocrisy of the European model of the rule of law.
The language combines legal terminology – "суд" (court), "судьи" (judges), "прокуратура" (prosecutor's office) – with emotional terms such as "коррупция" (corruption) or "кризис" (crisis), inducing a state of permanent gravity and urgency. Overall, the qualitative analysis indicates that Russian-language web articles use real events to construct a coherent narrative of systemic delegitimization of European democratic regimes., which normalises the idea of a "captured state" and contributes to the erosion of trust in democratic institutions and European standards.
Amplification and narrative alignment
The combined quantitative-qualitative analysis indicates the existence of clear temporal clusters and amplification nodes with disproportionate impact. Websites contribute through volume and apparent diversity, while Telegram contributes through reach and emotional intensity. On the other hand, message transfer between political actors and media or redistribution channels are critical aspects, particularly identifiable in the Telegram set. This type of transfer suggests amplification mechanisms that go beyond simple spontaneous reaction and deserve continuous monitoring.
In terms of alignment with hostile external narratives, the analysis indicates clear convergence with recurring themes in Russian propaganda: delegitimizing democratic institutions, portraying the EU as hypocritical or dysfunctional, and relativizing the concept of hybrid aggression.
Conclusion
The data analyzed shows that protests in Romania are used in the Russian-speaking ecosystem as narrative raw material, not as a subject of neutral information. The informational risk does not derive from the reporting of protests, but from their systemic and geopolitical reinterpretation, which aims to erode trust in institutions, reforms, and pro-democratic securitization discourse. However, future monitoring should focus more on the interpretative layer and nodes with high reach, not just on the volume of content. A clear separation between the factual event and the narrative built around it remains essential for early identification of FIMI and for formulating coherent and credible analytical responses.
—
By Dr. Nicolae Țîbrigan, expert coordinator Digital Forensic Team
