In March 2022, just weeks after Russia invaded Ukraine, Raed Arafat publicly backed the creation of a mechanism that would track false information and disinformation narratives as they began gaining traction in online media and on social networks. At the time, a working group involving representatives of public institutions and civil society was discussing a platform that would use automated tools to monitor the online space and identify such narratives at an early stage. The project immediately became controversial: the proposed criteria were so broad that even accusations of “corruption” or “incompetence” directed at the government or state leaders could potentially be treated as indicators of Russian propaganda. Several organisations distanced themselves from the initiative or withdrew, warning of censorship and of the danger of turning the state into an arbiter of truth. Arafat nevertheless defended the principle behind the project with a simple argument: before institutions can respond to disinformation, they first have to know that it is circulating. And, as he put it at the time, “it is easier to fight disinformation before it goes viral.”

That same evening, in the commune of Recea-Cristur in Cluj County, the rumour left the phone and entered the street. An ambulance crew transporting a patient was met with suspicion by locals, who began filming the vehicle and growing agitated. Shortly afterwards, a car blocked its path and several people armed with clubs, stones and axes attacked the ambulance. The driver was injured by shards from the shattered windscreen and required medical treatment; seven people were later placed in pre-trial detention. The same story that had been spreading online was already circulating in the community: apparently ordinary ambulances were supposedly kidnapping children. We do not need to establish that every attacker had watched the exact Glina video to see what had happened: a false narrative, spread and amplified online, had become credible enough to a group of people for the appearance of a real ambulance to be interpreted as a threat and trigger violence.

Four years later, in early August 2026, an old story began circulating once again on Romanian social media. The Ministry of Internal Affairs would later confirm that, “in recent days,” false claims about so-called “black ambulances” kidnapping children had resurfaced, some accompanied by photographs or videos created or altered using artificial intelligence. On Saturday, August 8, however, a TikTok video appeared showing a real ambulance in the commune of Glina, near Bucharest. The person behind the video did not present the story as a rumour but as confirmation: this, the video claimed, was one of the ambulances kidnapping children. “The black ambulance is real, guys,” the voice in the recording says, presenting the vehicle itself as proof that the story is true. The post would eventually reach almost 800,000 views and more than 6,000 shares.

Yet the figure of 800,000 views tells us less than it seems to. It is the number the post had reached when journalists checked it later, not the number of views it had accumulated before the attack. Publicly available data provide no hour-by-hour record of the video’s audience, so we do not know how many people had seen it before the incident and how many found it afterwards, once the attack on the ambulance had itself turned the video into news. We do know something else: the post was shared more than 6,000 times. A view can be entirely passive — the algorithm simply puts a video in front of you — whereas sharing requires a deliberate action. Not every share means that the person believed the story; the clip could also have been forwarded to challenge or ridicule it. But more than 6,000 shares tell us that thousands of users considered the information relevant enough to pass on.

That same evening, in Recea-Cristur, Cluj County, the rumour from Glina took to the streets. An ambulance crew transporting a patient was met with suspicion by locals, who began filming the vehicle and growing agitated. Shortly afterwards, a car blocked its path and several people armed with clubs, stones and axes attacked the ambulance. The driver was injured by shards from the shattered windscreen and required medical treatment, while seven people were later placed in pre-trial detention. The same story that had been wreaking havoc online was already circulating in the community: apparently ordinary ambulances were supposedly kidnapping children. We do not need to establish that every attacker had seen the exact Glina clip to understand what happened: a false narrative, spread and amplified online, had become credible enough to a group of people for the appearance of a real ambulance to be interpreted as a threat — and to trigger violence.  

The Police and the Ministry of Internal Affairs duly came forward with the necessary warnings and corrections. After the incident. We said earlier that we do not know how many people had seen the viral Glina post before the ambulance was attacked in Recea-Cristur. We do, however, know how many people could have seen a public warning from the authorities about this particular wave of false information before the attack: zero. We found no such warning issued before the incident; the Ministry’s reassuring message — “The ambulance doesn’t kidnap. The ambulance saves.” — came the following day.

In 2022, one of the longest-serving and most influential figures in the Romanian administration was publicly warning that the state needed to be able to identify disinformation before it went viral. Two years later, Romania would go through an information crisis with unprecedented political and institutional consequences, culminating in the annulment of the 2024 presidential election. Another two years later, a false story about ambulances kidnapping children travelled from social media into the street and ended with an ambulance crew being attacked with clubs, stones and axes. The mechanism bears an unsettling resemblance to what happened in France in 2019, when rumours that Roma were abducting children in vans spread across social media and were followed by attacks on innocent people. Four years on, we can identify no public monitoring and early-warning mechanism that intervened in the Cluj case; if such a mechanism exists, the obvious questions are what it detected and when. What we can see with certainty looks more like monitoring after the fact: the falsehood spreads, produces consequences, and only then do the institutions identify it, debunk it and scold the people who believed it.

The problem, however, runs deeper than the institutional failure to detect a viral falsehood. Romanian society itself does not appear to have acquired even the basic vocabulary needed to understand these phenomena with any precision. “Fake news,” “deepfake,” “disinformation,” “manipulation,” “rumour” and “conspiracy” are used almost interchangeably, although they describe different mechanisms that call for different responses. In the ambulance case, we do not even have a deepfake in the ordinary sense of the word: the ambulance is real, the footage is real, the location is real. What is false is the story built around them. Slapping the same “fake news” label on all these phenomena is about as useful for understanding disinformation as calling everything that makes us ill a “virus.”

Nor did the Romanian state have to guess what a story like this could produce. In 2018, in Romania itself, the “black ambulance” myth had already led to violence: writer Doina Popescu-Brăila was attacked in Bucharest after the van she was travelling in was mistaken for the vehicle that, according to the circulating rumour, was kidnapping children. The Police publicly debunked the story — after the incident. A year later, France provided a larger-scale example with an almost identical mechanism: rumours spread on Facebook, Snapchat and other channels claiming that Roma driving vans were abducting children in the Paris suburbs. People began identifying real vehicles as “evidence,” and the rumours were followed by attacks on Roma and their cars. French police were forced to intervene online as well to counter the story. Romania in 2026 was therefore facing neither a new kind of disinformation nor an unforeseeable consequence: it had both a precedent of its own and an almost carbon-copy demonstration from another European country.

There is an important distinction in the fight against disinformation between debunking and prebunking. Debunking comes after a falsehood has appeared and tries to dismantle it — exactly what the Ministry did when it announced that “the ambulance doesn’t kidnap, the ambulance saves.” Prebunking tries to intervene earlier: it identifies a dangerous narrative as it begins to spread, warns the public and explains the mechanism of manipulation before it produces consequences. In the Cluj case, the distinction is hardly academic. The debunking came after the ambulance windscreen had been smashed and its driver injured. Prebunking would have meant detecting the return of the myth during the very “recent days” in which the Ministry itself says it had been circulating, and intervening before a real ambulance could be mistaken for a character from an urban legend.

There is, however, a second actor in this story. Nearly 800,000 views do not mean that 800,000 people went looking for information about the “black ambulance.” For what was probably a significant share of the audience, encountering the video was passive: TikTok placed it in the For You feed and put it in front of users who had never asked to see it. In other words, between the person who posted the claim and the hundreds of thousands of people who received it stood the platform’s recommendation system, which judged the clip relevant enough to keep distributing it. This creates a form of responsibility distinct from that of the original poster. One thing is a user’s freedom to publish nonsense; another is an algorithmic system giving that nonsense an audience of hundreds of thousands. The question for TikTok, then, is not merely why the video was not removed, but why its recommendation system amplified it, how many of those nearly 800,000 views came through recommendations, and at what point the platform had enough signals to understand what, exactly, it was distributing.