A Forensic Investigation

In early June, local communities across Northern Ireland were shaken by a rapidly spreading wave of public unrest. The sexual crime under investigation, an alleged rape committed by two Romanian nationals, initially triggered localised peaceful demonstrations. From advocacy for the general safety of girls and women, otherwise legitimate concerns in public discourse, to increasingly virulent tropes targeting migrant communities, online amplification largely mirrored the offline escalation of violence.

Social media platforms and online ecosystems acted as conduits, effectively globalising a local incident while morphing it into a rallying point for far-right narratives and xenophobic rhetoric. Hashtags and viral content recast the event within a broader anti-immigration framework that has long and opportunistically polarised societies, inflaming tensions and shaping public discourse in ways that outpace institutional responses.

These dynamics catalyse what can be described as "narrative convergence", whereby disparate actors – from grassroots (community) agitators and transnational ideological networks to vast online manipulation networks and hostile, state-driven influence operations – coalesce around simplified, emotionally resonant framings of complex issues, each purporting to gain traction. In such contexts, social media platforms function not merely as neutral spaces of communication but as accelerants in the production and circulation of contested meaning, often with the scope of widespread destabilisation.

Understanding these patterns becomes essential for developing more resilient policy frameworks and crisis response – those that can anticipate, rather than simply react to, the socio-digital amplification of polarising events. It also calls for renewed attention to the governance of digital spaces, platform accountability, and the development of early warning mechanisms bridging online harms and offline consequences in physical spaces.

This forensic analysis, the fruit of a collaborative endeavour, builds on multiple datasets and methodological approaches, condensing vast amounts of information into interactive, publicly palatable and simplified graphs.

Sources: Osavul (an AI-powered information threat detection software), Armed Conflict and Event Data (ACLED), local and international media, etc.

In brief, our data corpus comprises over 1,380 publications, including social media content distributed across seven platforms and the web, related to the Ballymena incident and subsequent public unrest, spanning a timeline from June 7th to 20th, 2025. Though limited in duration, this body of messages amassed 107 million views and over 4 million reactions, reflecting the speed of transnational engagement and its vast, global footprint.

Geo-Temporal Expansion of Protests

Mapping the offline geographical dispersion of public unrest in Northern Ireland, from localised peaceful protests and demonstrations to mob violence and law enforcement interventions. We adapted a detailed dataset from ACLED (Armed Conflict and Event Data), while simultaneously tracking media coverage and transforming it into data points.

In such a complex landscape, reactive or ad-hoc communication proved insufficient. What is needed is a proactive, coherent framework for strategic engagement, narrative monitoring and trust building across institutional, civic, and diasporic layers, both online and in those communities most affected by the consequences of violence, misinformation and systemic neglect. Conversely, diaspora organisations in the UK and beyond provide a much-needed interface between the institutional and community layers. However, these associations are often poorly coordinated, fragmented, and marked by competition or lack of professionalisation, limiting their ability to act cohesively or credibly during crises. Strengthening this civic-community layer is essential for trust-building, improving early response, and sustaining long-term resilience in the face of escalating crises – both online and offline.

The heatmap below displays a geo-temporal evolution of public unrest across cities, towns, and counties in Northern Ireland.

Content, Platform Distribution & Dissemination Pathways

Distribution / Dissemination by Platform

Our investigation tracked content across six major platforms – TikTok, Facebook, Twitter/X, Telegram, YouTube and VKontakte (VK, Russian-based platform), as well as the web, revealing how each platform specifically contributed to amplification.

×

TikTok Engagement Analysis (Sample)

The scatter plot visualises engagement dynamics across TikTok posts related to the Ballymena unrest. Each circle/bubble represents a post, plotted by total views (X-axis), engagement ratio (Y-axis), with circle size reflecting total reactions. The trendline indicates a weak positive correlation between views and engagement, though many high-view videos sit below the 0.05 engagement mark, suggesting limited emotional traction despite broad visibility (indicative of passive consumption). Conversely, several lower-view videos exhibit high engagement ratios (>0.1), signalling intense audience resonance within smaller or more targeted segments.

This dispersion pattern underscores that virality alone does not equate to meaningful engagement – some of the most impactful content is not necessarily the most widely viewed, but the most ideologically charged or emotionally provocative. Please note, engagement metrics may have shifted since the analysis, as platform dynamics evolve rapidly and content visibility can fluctuate based on algorithmic recalibration, user reporting, or retrospective moderation (if the case).

Example of Sequential Distribution on Twitter/X

One of the most widely reposted messages originated from Baroness Claire Fox of Buckley, a British non-affiliated life peer in the House of Lords, highlighting the political ramifications of a local event and its resonance within ideological echo chambers. The message resonates with broader populist and culture war narratives that challenge institutional responses from within, even at the debate stage. The linear graph below illustrates message distribution by repost, indicating amplification within political/decision-making environments.

Online Geographies of Information Flows

Information Flows by Country Role & Frequency

For those accounts where we could trace the origin, the geographical distribution reveals how information flows between countries.

"source_country" refers to where the message originated, based on the content itself (not platform domain).

"actor_country" captures the location of the user or account that posted the content. This includes not only original posts but also replies, comments, and reposts that contribute to narrative reinforcement, reinterpretation/reframing, or amplification across platforms.

"origin_actor_country" reflects cases where the content's thematic or geographic origin diverges from the user that amplified it, acting as the source of origin. This is often used, when, for example, an article or narrative about Romania is shared by an account in the UK, or when a video originating in Germany is repackaged by users elsewhere.

The top countries listed in the origin_actor field – where the content's thematic or narrative origin differs from the posting actor – include Romania (53 entries), Germany (47), the United Kingdom (32) and the US (22), followed by Italy (15), France (13), Russia (9) etc.

Online Information Flows Between Countries

The chord diagram illustrates both in-country information flows, revealing how narratives surrounding events in Northern Ireland moved across borders as well as within national contexts. Strong intra-European exchanges may be attributed to the Romanian diaspora, likely playing a key part in recirculating and localising content across linguistic lines and geographies.

Mapping Overall Geographical Dispersion

Platform Activity by Country (Heatmap)

The heatmap illustrates temporal spikes in platform activity (overall and by country), with Telegram and Twitter peaking on June 11, which coincides with the early escalation of public unrest. Upon filtering, the data also shows platform usage patterns by country, not only shaped by audience preference, but also by the transnational structure of the information ecosystem.

Compromised Networks (Disinformation, Influence Operations)

The dataset identifies a notable presence of compromised networks (Indicators of Compromise, IoCs), specifically flagged for disinformation across three attribution levels:

• Source level: 80 posts originating from sources classified as disinformation.
• Actor level: 78 posts were disseminated by accounts identified as disinformation actors.
• Origin actor level: 46 posts trace back to origin actors associated with disinformation activity.

This layered attribution suggests coordinated manipulation efforts, where certain narratives were not only seeded by suspect sources, but also recirculated by compromised or inauthentic accounts. The overlap across levels reflects the presence of persistent influence networks, most likely involved in agenda-driven amplification (with the scope of further destabilisation/incitement), narrative laundering, or cross-platform content injection.

Present in other high-salience circumstances, these accounts displayed synchronised posting patterns, shared linguistic markers, and temporal coordination that strongly suggests orchestrated activity rather than grassroots mobilisation.

Timeline Analysis of Disinformation Networks (by Platform and Country of Origin)

The geo-temporal evolution of the disinformation eco-system reveals coordination with real-world event escalation.

One particular example, Romania's diplomatic mission in the UK became a visible target of online outrage culminating on June 14, several days after the initial unrest in Ballymena and environs. A Telegram post by Stiri Romania Info-Mass-Media (an alternative news channel) marks one of the earlier mentions, criticising the diplomatic response in the UK and calling attention to the perceived lack of protection or advocacy for Romanian nationals amid rising hostility. Disinformation networks also seized the narrative, amplifying dissent and institutional mistrust across platforms.

Although the Romanian diplomatic and consular mission issued an official communique and later dispatched an envoy following the peak of violence, these actions came after narratives had already taken root online. Efforts towards official communication via traditional media, paired with public mistrust and rampant polarisation within diasporic communities and beyond, did not assuage the wave of online recriminations – be it opportunistic actors, community agitators, political spin, or transnational disinformation networks. The delay in pre-emptive and coordinated communication allowed for alternative narratives – some conspiratorial, other politically motivated – to fill the informational void. As a result, the Romanian diplomatic presence in the UK became a symbolic target in broader narratives of abandonment, distrust and ethnic (Roma) scapegoating – narratives further exploited by transnational disinformation networks and amplified within digitally networked diasporic spaces.

Brief Concluding Remarks

This analysis was the basis of a preliminary presentation held at the Romanian Embassy in the UK, where the data and its correlation with on-the-ground developments were shared and discussed. It marked a promising step towards a more applied and collaborative dialogue between civic researchers and institutional actors. Crucially, this case underscores the importance of civic intelligence in identifying early signs of narrative escalation, particularly where digital signals may prefigure offline unrest.

Yet the challenges are layered and systemic. The Romanian diaspora in the UK – especially in communities affected by economic precarity and integration gaps – has repeatedly found itself at the centre of public controversy, both as targets, in documented cases such as Ballymena, and as perpetrators of violence and unrest. This cycle of violence has been repetitive. Furthermore, the visibility of infractionality within certain segments of the Romanian community often triggers intense media scrutiny and political pressure, contributing to a cycle of stigma and exclusion. Such dynamics unravel in hotspot areas marked by historical societal disaffection, weak institutional trust and limited strategic outreach.

In such a complex landscape, reactive or ad-hoc communication proved insufficient. What is needed is a proactive, coherent framework for strategic engagement, narrative monitoring and trust building across institutional, civic, and diasporic layers, both online and in those communities most affected by the consequences of violence, misinformation and systemic neglect. Conversely, diaspora organisations in the UK and beyond provide a much-needed interface between the institutional and community layers. However, these associations are often poorly coordinated, fragmented, and marked by competition or lack of professionalisation, limiting their ability to act cohesively or credibly during crises. Strengthening this civic-community layer is essential for trust-building, improving early response, and sustaining long-term resilience in the face of escalating crises – both online and offline.