Read the full article here ❯

The incident that occurred during the night of May 28 to 29, 2026 did not take place in isolation, but rather within a broader context of escalating Russian drone activity near the Romanian border. On May 23, the Ministry of National Defence signalled the most recent Russian army attack on Ukrainian infrastructure near Tulcea County, making the drone subject a constant and recurring element of public interest in the Romanian information space.

The chronology of events during the night of May 28 to 29 is as follows:

The incident occurred one day after the MoND had announced the signing of four contracts, totalling nearly 700 million euros, under the European SAFE programme (the newest and most comprehensive European instrument dedicated to defence). SAFE offers member states loans of up to 150 billion euros for urgent and large-scale military acquisitions, covering categories such as ammunition, drones, air and missile defence systems, cyber, and military artificial intelligence. Romania received the second largest allocation in the programme — 16.68 billion euros — after Poland, confirming both the scale of its military modernisation needs and the country's active role in the European security architecture. The four contracts signed concerned the acquisition of military reconnaissance drones and MANPAD MISTRAL anti-aircraft missiles, purchases that reflect precisely the air defence vulnerabilities exposed by the incident the following night.

Why was the drone not shot down?

The Ministry of National Defence (MoND) explained that the time available for identifying, assessing, and engaging a small drone flying at low altitude is extremely short. Engagement over an urban area presented significant risks — the resulting debris could produce effects comparable to the drone's impact itself — and the aircraft type was not known at the time. The legislative framework in force during peacetime further restricts intervention options, conditioning the opening of fire on the protection of life and property. Based on public briefings, the MoND concluded that there were no real opportunities for engagement under safe conditions.

Pre-attack narrative preparation on social media

The security context described above did not go unnoticed in the information space. The two networks of coordinated pages identified in the analysis below did not react to the Galați incident — they preceded it. Their activity began days before the impact, at a moment when the drone subject was already present and active in the public sphere.

On May 23, the most recent Russian army drone attack on civilian and infrastructure targets in Ukraine, near the river border with Romania in the Tulcea County area, generated a Ro-Alert from the MoND, without any unauthorised airspace intrusions or impacts on Romanian territory being reported.

The event nonetheless created fertile ground for information manipulation. Four days later, on May 27, a network of 21 coordinated pages simultaneously distributed an identical alarmist message: "BREAKING NEWS! Russian drone in Romania! The population has been evacuated" — exploiting the public anxiety accumulated around the real incident to amplify fear and disinformation among the population.

The coordination is evidenced by the posting timestamps: all 21 pages distributed the message within just seven minutes (between 12:33:40 and 12:40:55). Such a short interval indicates automated or centrally coordinated distribution, in which the content was prepared in advance and launched simultaneously, suggesting that this campaign was not an improvised reaction but a premeditated action, synchronised with the drone topic already in the public eye.

The network cumulatively has nearly 3,7 million followers , over 5,8 million views and 44.000 shares , giving it significant potential for influencing public opinion.

On May 28, the second identified network, consisting of 50 pages, distributed an identical message invoking the authority of Raed Arafat to urge the population to prepare a 72-hour emergency backpack. The content mimics official civil protection communication, lending it the appearance of institutional legitimacy.

Analysis of posting times reveals a more sophisticated pattern than in the case: distribution unfolded in four coordinated waves — the first around 11:17–11:18, the second between 12:02–12:13, the third around 15:00–15:01, and the fourth in the evening, between 19:03 and 19:19. The short intervals within each wave (sometimes under ten seconds between posts) confirm process automation, while the multi-wave structure indicates a deliberate strategy for keeping the subject active in users' feeds throughout the entire day. Given that the drone attacks took place that same night, these messages functioned as a possible premeditated psychological preparation of the public, coordinated in time with the moment of the attacks.

The network cumulatively has nearly 8,7 million followers , over 11,8 million views and 90.000 shares , representing significant reach for a coordinated disinformation campaign.

What is being communicated on social media?

The Galați incident is not an isolated case in the Romanian disinformation landscape. Funky Citizens has documented similar patterns in two analyses: in September 2025, following the entry of a Russian drone into Romanian airspace in the Tulcea County area, coordinated networks propagated narratives framing the incidents as "NATO-manufactured hysteria," minimising the real threat and delegitimising the response of Romanian authorities ( Analysis of false narratives regarding Russian drone incidents in Romanian airspace ). In October 2025, the explosion in the Rahova neighbourhood was rapidly transformed into a vector for disinformation, with conspiracy theories diverting public attention away from the confirmed findings of the investigation ( The Rahova Case: from tragedy to conspiracy ). Both cases confirm a recurring pattern: events with high emotional impact and a high degree of informational uncertainty systematically become opportunities for the amplification of coordinated disinformation.

In total, we collected 14,033 general social media posts between 00:00 on May 28 and 11:00 on May 29. These posts were distributed across the following social media platforms: Twitter/X, Instagram, YouTube, TikTok, , Bluesky, Telegram, Wire, and press outlets.

You can access our network analysis at this link .

The 80 most widely shared clusters address the following themes ( link ):

The incident of the night of May 28 to 29, 2026 illustrates an increasingly well-documented dynamic in the Romanian information space: high-emotional-impact security events are no longer merely news — they become, in real time, raw material for coordinated manipulation campaigns. The two identified networks did not react to the incident; they accompanied it and acted early, which indicates an active disinformation infrastructure, prepared to exploit any window of informational vulnerability.

Analysis of the 8,913 posts directly addressing the incident confirms that narratives circulated online which minimised the threat or amplified the state of panic — all exploiting the same gap: the interval between the occurrence of the event and the provision of clear and complete official information.

The present case confirms two systemic tendencies that Funky Citizens consistently documents. First, disinformation in security contexts does not necessarily seek to convince, but to disorient — that is, to occupy the public's cognitive space before verified information reaches them. Second, the coordinated distribution infrastructure is already in place and operates independently of the subject matter, capable of being rapidly activated around any sensitive event.

The response to this reality cannot be merely reactive. It requires rapid and clear institutional communication in moments of crisis, as well as the technical capacity to detect coordination in real time, so that the public is promptly informed the false narratives circulating in the online space. Without these, every security incident at the border will continue to be mirrored, in the online space, by a second incident — harder to manage and slower to remedy — one that erodes citizens' trust in the capacity of institutions to respond in moments of crisis far more deeply.

The analysis is based on four datasets collected through third-party providers from the platforms Twitter/X, Instagram, YouTube, TikTok, , Bluesky, Telegram, and Wire, supplemented by posts from online press sources. The data were processed and explored using the Python programming language. On this basis, we constructed a Social Network Analysis in which nodes represent the accounts that posted, and the links between them are verbatim-shared texts. The resulting graph visualises the connections between accounts that distributed identical content, enabling the identification of coordination patterns and amplification structures in the online space.

Co -Funded by the European Union. Views and opinions expressed are however those of the author(s) only and do not necessarily reflect those of the European Union or DIGITAL-2021-TRUST-01. Neither the European Union nor the granting authority can be held responsible for them.