Two drones in seven days: how the drone topic was kept active online

The complete report - HERE.

On May 28–29, a Russian Geran-2 drone crashed into a residential building in Galați, causing an explosion and injuring two people — an incident with clear attribution. The Constanța explosion comes one week after a Russian Geran-2 drone crashed into a building in Galați, causing an explosion and injuring two people.

On June 5, a Magura-type maritime drone self-detonated in the Port of Constanța, with no casualties. In the first few hours, Romanian authorities did not officially confirm the provenance: the MoND stated that it was "a drone used in the war in Ukraine," without specifying the vessel's origin. Subsequently, the Ukrainian Naval Forces confirmed that the drone belonged to them, stating that the vessel had lost control under the influence of Russian electronic warfare means during a mission in the operational area of the Black Sea.

This material analyses two dynamics that overlapped in the same week: the narratives that emerged organically around the new incident in Constanța (Part I), and the coordinated campaign that kept the Galați incident artificially on the public agenda, day after day, for one week (Part II). The distinction between the two — what appears spontaneously and what is systematically amplified — is precisely what this analysis seeks to establish.

The Constanța incident landed on an information space already primed by a week of coordinated amplification on the drone topic, with an already intense presence on the public discussion agenda. 

Narratives identified – June 5, 2026, Port of Constanța

What was confirmed? A maritime drone was discovered in the morning in the Constanța Civil Port, near the ARSVOM headquarters, and self-detonated at around 10:30, producing no casualties. The MoND stated that the object does not form part of the Romanian Army's equipment and was not involved in recent exercises in the Black Sea area, with the case being investigated by the Prosecutor's Office attached to the Constanța Court of Appeal. The official communiqué described the drone as "of the type used in the war in Ukraine," without attributing its provenance.

Subsequently, the Ukrainian Naval Forces confirmed that the drone belonged to them, stating that the vessel had lost control under the influence of Russian electronic warfare means during a mission in the Black Sea operational area, and that they had provided the necessary information to the Romanian naval forces for the purpose of preventing civilian casualties. Three further drones that self-detonated were also identified: two offshore (also confirmed by a commercial vessel 145 km east of Constanța, which observed two powerful consecutive explosions) and a third outside the port.

However, in the hours between the incident and this confirmation, the information space remained open. The time gap between the moment of the explosion and the official clarifications created a vulnerable window: in the absence of a confirmed version of events, narratives lacking factual grounding circulated freely and rapidly materialised into alternative interpretations. The narratives below were constructed precisely during this interval.

Our analysis of a dataset of 1,116 posts collected between 01:48 and 11:47, sourced from X, Reddit, Bluesky, and media outlets, reveals four main narratives that circulated simultaneously in the Romanian information space on the day of the incident. The estimated number of views up to the moment of data extraction (11:47) is 2,319,056, indicating significant reach in the first ten hours of analysis.

The drone is Ukrainian was the dominant narrative. It was not fed by an official attribution (which did not exist), but by the gap between the MoND's ambiguous communiqué ("of the type used in the war in Ukraine") and the identification of the Magura model based on a military expert's statements and image analysis. Some of those involved stopped at the technical fact — a type of drone that Ukraine uses in the Black Sea against the Russian fleet. However, a portion of the posts went beyond the technical observation and constructed an intentionalist narrative, arguing that Ukraine had deliberately sent the drone to provoke an incident on NATO territory — a kind of false flag operation — with the aim of drawing Romania into the conflict or forcing the Alliance's intervention. Messages such as "Zelensky is desperate to drag NATO into war" circulated intensely, transforming an uninvestigated technical incident into a political certainty within the narrative.

Undermining the authorities was the second most frequent narrative, fuelled by concrete and in part legitimate facts: the drone was discovered early in the morning and remained in the port for hours before self-detonating, the Ro-Alert message was sent nearly an hour after the explosion, and the authorities communicated that there could be as many as four more explosive vessels offshore, without confirming an exact number. These legitimate criticisms were, however, amplified beyond the incident toward a broader message of generalised institutional incompetence — useful both for discrediting the authorities and for eroding public trust in the state's capacity to protect critical infrastructure.

The drone is Russian appeared as a counter-narrative, supported by users who invoked the precedent of the Galați investigation (where the drone had been officially confirmed as Russian) and who argued that the rapid attribution to Ukraine, before the conclusion of the investigation, serves Russia's interests precisely by generating ambiguity and public division.

Reversed attribution was the most elaborate narrative, combining real technical elements with false interpretations, such as "the drone was Ukrainian but diverted by the Russians" or "Russia redirected a Ukrainian drone toward Romania." Messages in this category had the greatest potential for virality precisely because they could not be simply refuted, blending verifiable data with unfounded conclusions. This is a pattern similar to that identified in the coordinated campaigns following the Galați incident, where the narrative of responsibility reversal had appeared a few days after the incident.

The absence of a clear and rapid official communiqué in the early morning hours left an informational void that these narratives occupied simultaneously, each attracting different audiences and consolidating divergent interpretations of the same event. This is a pattern we also documented in the analysis of the Galați incident of May 28–29: on that occasion too, coordinated networks exploited the gap between the moment of impact and official communication to install alarmist narratives and channel public emotion toward predetermined conclusions. The difference is that, in the Constanța case, these narratives did not fall on empty ground, but on an information space already saturated by a week of coordinated amplification on the drone topic, which gave them a head start in the competition for public attention.

Keeping the subject on the public agenda: May 29 – June 5, 2026

Analysis of coordinated posts from the period May 29 – June 5, 2026 reveals a systematic pattern of artificial amplification of the Galați drone subject. For seven consecutive days, the subject was kept active in the Romanian information space through successive waves of synchronised distributions, with each day bringing a new or recycled message adapted to the day's context. This persistence is not organic: a security topic that would have followed the natural course of the news cycle was instead relaunched daily, with messages calibrated to maintain public attention and refresh the narrative, thereby preparing the informational ground on which, on the seventh day, the Constanța incident landed.

The second part of this analysis documents a mechanism distinct from that described in the first part: not the narratives that appear spontaneously around a new incident, but the artificial maintenance of a subject on the public agenda, day after day, well beyond the natural news cycle. The coordinated networks identified during this period did not create a subject from nothing — they took one that was already sensitive and present in public debate and exploited it systematically, amplifying it daily through calibrated messages and synchronised distributions.

June 4

On June 4, a network of 28 pages distributed the message "Vladimir Putin has broken his silence! The drone from Galați was…" in 28 posts, promoting the disinformation that the drone had been Ukrainian and that Vladimir Putin had called for an objective analysis, thereby reversing responsibility for the incident:

• first wave: 07:00–07:04, at dawn, two posts at an interval of 14 seconds
• second wave: 11:06–11:28, with 6 posts in approximately 20 minutes
• third wave: 18:02–18:20, the most intense, 20 posts in approximately 18 minutes, with groups of 2–3 posts at intervals of seconds
• isolated post: 01:27 on June 5

The narrative is a typical responsibility-reversal one. Romanian authorities and the MoND had officially confirmed that the drone was Russian, of the Geran type, yet the coordinated message relaunched public doubt a week after the incident.

The network of 28 accounts involved in distributing this message has, in aggregate, 5.5 million followers, over 10.8 million views, and 63,000 shares — metrics reflecting the total activity of these pages.

In parallel, a further 263 coordinated messages were identified in 3,709 posts, confirming that the amplification infrastructure remained active until the eve of the Constanța incident.

June 3

On June 3, a network of 46 accounts distributed the message "Oana Țoiu puts Vladimir Putin on the spot" in 46 posts, adapting the narrative concerning Russia and the war in Ukraine to the domestic political agenda and keeping the topic active by associating it with a Romanian political figure:

• first wave: 12:28, with two posts published at an interval of 12 seconds
• second wave: 18:10–19:12, the most intense, 36 posts in approximately two minutes
• third wave: 22:40, with eight posts published in just 17 seconds

Between 18:10 and 18:12, 36 identical posts were published, many at intervals of one to a few seconds, including two posts at the same second — a strong indicator of the use of automated mechanisms.

The network of 46 accounts involved in distributing this message has, in aggregate, over 14 million followers, over 66 million total views, and approximately 1.2 million shares — metrics reflecting the total activity of these pages.

Also on the same day, a further 260 coordinated messages were identified, distributed in 3,426 posts — a decrease in volume that did not, however, affect the consistency of the coordination pattern.

June 2

On June 2, a network of 38 accounts distributed the same message "The forensic examination of the Galați drone has been completed! SHOCKING result" in 38 posts, continuing the amplification of the narrative promoted the previous day as well:

• first wave: 11:30–11:31, with two posts published at an interval of 27 seconds
• second wave: 18:03–19:26, the main distribution wave, 36 posts in approximately 83 minutes, with numerous groups at intervals of a few seconds

Unlike previous days, activity did not begin in the nocturnal interval or in the early morning hours, but the distribution structure remains similar: a small group of accounts publishing the same message in compact time windows to maximise visibility.

The network of 38 accounts involved in distributing this message has, in aggregate, 6.6 million followers, over 10.2 million views, and approximately 52,000 shares — metrics reflecting the total activity of these pages.

On the same day, a further 397 coordinated messages were identified in 6,054 posts, indicating that the amplification network maintained its pace over the weekend.

June 1

On June 1, a network of 38 accounts distributed the message "The forensic examination of the Galați drone has been completed! SHOCKING result" in 61 posts — a message that exploited public anticipation regarding the results of the official investigation to keep the subject active:

• first wave: 06:04–06:12, the most intense, over 35 posts in approximately 10 minutes
• second wave: 09:02–09:15
• third wave: 22:04 și 23:00, isolated posts in the evening

As on previous days, the first wave began early in the morning, with posts at intervals of seconds confirming automation.

The network of 38 accounts involved in distributing this message has, in aggregate, 11 million followers, over 16 million views, and 99,000 shares — a smaller network compared to previous days, but with the same coordination pattern — metrics reflecting the total activity of these pages.

Beyond the main message, on the same day a further 396 coordinated messages were identified, present in 4,780 posts — a lower volume compared to previous days.

May 31

On May 31, a network of 81 accounts distributed the message "Maia Sandu has admitted everything! The drone from Galați was…" in 83 posts — a message that extended the drone narrative by involving another foreign political leader, adding a geopolitical layer to the already active topic:

• first wave: 06:30–06:45, with posts at 4-minute intervals
• second wave: 10:40–10:42, the most intense, over 40 posts in
• third wave: 12:47–15:56
• fourth wave: 17:40–23:30, with a dense cluster at 23:30, 10 posts in 27 seconds

As on previous days, the first posts appeared around 06:30, before the public had woken up, in order to saturate feeds ahead of peak hours.

The network of 81 accounts involved in distributing this message has, in aggregate, over 33 million followers, over 102 million views, and 1.4 million shares — metrics reflecting the total activity of these pages.

Also on the same day, a further 412 coordinated messages were identified, distributed in 6,827 posts, maintaining the same pattern of integrating the drone subject into an active amplification network across multiple narratives simultaneously.

May 30

On May 30, a network of 105 accounts distributed the message "TOTAL SHOCK! Vladimir Putin demands Romania hand over…" 145 times, keeping the drone topic and its diplomatic consequences active in the information space:

• first wave: 06:03–06:39, with posts in the early morning
• second wave: 07:05–07:41, the most intense, over 30 posts in 36 minutes
• third wave: 09:50–09:51, 14 posts in 55 seconds
• fourth wave: 10:50–10:51, 14 posts in 60 seconds
• fifth wave: 12:00–17:20, with dense clusters at 14:01, 16:40–16:42, and 17:20, the last recording 12 posts in just 10 seconds

The first waves began around 06:00 — an unusual pattern suggesting an operation programmed to begin before the public had woken up, in order to saturate feeds ahead of the day's peak hours.

The network of 105 accounts involved in distributing this message has, in aggregate, nearly 46 million followers, over 155 million views, and 1.7 million shares — metrics reflecting the total activity of these pages.

On May 30, a further 433 coordinated messages were also discovered, present in 6,501 posts. These continued to systematically promote several coordinated narratives active during the same period, indicating the persistence and expansion of the amplification activities identified in previous days.

May 29

On May 29, a network of 74 accounts distributed the message "RUSSIA, first reaction after the drone crash in Romania" 104 times, structured in five waves between 08:10 and 17:34:

• first wave: 11:10–11:54
• second wave: 12:42–13:10, with a dense cluster between 13:26–13:27, 11 posts in 30 seconds
• third wave: 14:26–14:33
• fourth wave: 16:10–16:13, the most intense, over 40 posts in approximately three minutes
• fifth wave: 17:11–20:34, with sparser posts, keeping the subject active throughout the afternoon

The network of 74 accounts involved in distributing this message has, in aggregate, nearly 49 million followers, over 154 million views, and nearly 1.7 million shares — metrics reflecting the total activity of these pages.

Beyond this main message, on the same day a further 390 coordinated messages were identified, distributed in 6,037 posts. Among these were messages on the Galați drone topic, confirming that the subject was not being amplified in isolation, but was integrated into a broader coordination infrastructure active during the same interval.

How far do coordinated messages reach and why they remain online 

These figures raise a direct question about the role of platforms. Coordinated inauthentic behaviour violates the declared policies of all very large online social media platforms. Nevertheless, the networks documented in this analysis operated unhindered for seven consecutive days, accumulating hundreds of millions of views with no visible intervention from the platforms.

This is not an isolated case. Funky Citizens has for several years been documenting the operation of coordinated networks of pages on social media platforms, in various contexts (from electoral campaigns to security incidents). The pattern is consistent: multiple accounts publish identical messages within time windows of a few seconds, in synchronised waves, with the aim of saturating users' feeds and amplifying certain narratives that undermine users' capacity to engage with factual information. This behaviour is explicitly defined as coordinated inauthentic behaviour and constitutes grounds for the removal of the accounts involved.

In practice, however, platforms leave these networks intact and operational. The result is that the same amplification infrastructure is reused from one incident to the next, from one electoral cycle to the following one. The Digital Services Act (DSA) places very large platforms under an obligation to assess and mitigate systemic risks, including those related to information manipulation. The data in this analysis show that, at least in Romania's case, this obligation is not being effectively fulfilled.

Which were the main topics discussed online over the past week?

We collected 116,014 social media posts from the following sources: Telegram, X, Facebook, Instagram, TikTok, Reddit, as well as articles from mass media outlets. We extracted the texts of these posts and analysed them using a human-in-the-loop machine learning system.

Drone incidents and discourses addressing security 

These texts detail the crash of a Russian drone into a residential building in Galați, including information on the injured, civilian casualties, official reactions from Romanian authorities, international reactions (NATO, EU), and diplomatic responses, such as the expulsion of the Russian consul and the level of conflict escalation. Internal political debates and criticisms regarding the management of the incident are present, as are disinformation campaigns and pro-Russian conspiracy theories, denials of Russia's responsibility, and narrative divergence between the actors involved. The reactions of political leaders (Nicușor Dan, Ilie Bolojan, Radu Miruță, Oana Țoiu), as well as international statements (EU, USA, NATO), are integrated, all anchored in the specific drone event. Also included are texts addressing the maritime drone incident in Constanța on June 5.

From the same category of texts addressing security-related matters, two further topics were covered: Defence and SAFE contracts and Corruption scandals.

The analysed texts outline two main directions in the discussion of the European SAFE programme: on one hand, the presentation of the A7 and A8 infrastructure projects in Moldova as significant investments, with concrete actors, timelines, and funding, intended to support regional development; on the other hand, a strongly critical area dominated by accusations of corruption, favouritism, fraud, and manipulation in the use of SAFE funds, both for infrastructure and military procurement, with references to politicians, institutions, and legal controversies such as the challenge to the SAFE Ordinance before the Constitutional Court.

News about tragedies in Romania, international events, and events in Moldova 

A significant segment of texts, over 8% of the total posts analysed, covers tragic events that took place in Romania, using language with strong emotional charge. Another important segment, over 2.9%, covers news about the War in Ukraine as well as various other news about Russia. News about the situation in the Middle East was also present during this week, alongside coverage of events in the Republic of Moldova.

Discourses related to the political crisis, annulled elections, and public policies

The texts portray a climate of political crisis and contestation of institutional legitimacy in Romania following the fall of the Bolojan government, marked by disputes over the nomination of a prime minister, tense negotiations between parties, and criticism of the caretaker government.

Furthermore, the narrative of the illegal annulment of the elections remains present online, portraying Călin Georgescu as the legitimate president and victim of a corrupt political and media system. The adoption of various public policies is also reflected in the analysed texts, covering EU regulations on the digitalisation of payments, legislative changes related to pensions and ANAF audits, texts detailing legislative modifications targeting homeowners and drivers, as well as other similar texts.

Spirituality, health and the glorification of history 

The narratives in the "Spirituality, health, and the glorification of history" category combine three distinct registers, united by the idea of "protecting community identity, purity, and continuity." Alongside texts referring to public holidays and religious processions, the spiritual dimension is also marked by anti-ecumenical discourses presenting Orthodoxy as threatened by external religious forces and by an alleged persecution of Orthodox Christians.

Discourses focused on health advice centre on balanced nutrition, diets, healthy recipes, and personalised medical interventions, particularly in a local context, promoting lifestyle changes as well as folk remedies without scientific basis.

Other types of texts invoke significant events from Romanian history, and in some cases glorify the Dacian heritage, regional traditions, myths, and historical Romanian communities, constructing an idealised image of the national past.

Methodological note

The data analysed in this report were collected from multiple social media and online press sources: Telegram, X, Facebook, Instagram, TikTok, Reddit, as well as articles from mass media outlets. Data collection was carried out through a combination of third-party tools and an in-house scraper developed internally, used exclusively for TikTok.

The total corpus for the period May 29 – June 5, 2026 comprises 116,014 posts. For the analysis of narratives from June 5, 2026 (the Constanța incident), a subset of 1,116 posts was separately extracted and analysed, collected between 01:48 and 11:47, sourced from X, Reddit, Bluesky, and media outlets.

Following collection, the data were labelled through qualitative methods (Braun & Clarke, 2006), followed by narrative coding and quantitative corpus analysis. The analysis of narratives for June 5, 2026 also benefited from support from large language models (LLMs), used as a tool to accelerate qualitative analysis, under continuous human supervision (human-in-the-loop). The research for this day was supported by the Counter Disinformation Network.

For the interactive visualisations of the coordinated network (the pages-days relationship graph), Claude (Anthropic) was used as an assistance tool for generating visualisation code. All primary data (page lists, network sizes, daily campaign messages) originate from Funky Citizens monitoring and were independently validated by the team. The AI model was not used for identifying, labelling, or attributing coordinated behaviour, but exclusively for transforming verified data into interactive visual representations.