Romanian Intelligence: History, Structure, and the Headlines

Romania sits on NATO’s eastern flank, shares a 650-kilometer border with Ukraine, and borders Moldova, where Moscow has spent years trying to keep its influence. That geography makes Romanian intelligence one of the busiest services in the alliance. It also carries one of the heaviest histories in Europe. The Securitate, communist Romania’s secret police, was dissolved only in December 1989, and the services built from its remains have spent three decades proving they answer to parliament, the courts, and the law.

This guide covers the main agencies, how they are overseen, where they came from, and the cases that have put Romanian intelligence in the news, from the annulled 2024 presidential election to a string of Russian-directed sabotage plots. It is written for executives, lawyers, journalists, and analysts who need a working map of the system. Allegations are marked as allegations. Where a case is still in court, we say so.

Romanian intelligence at a glance

Romania splits intelligence work among several bodies, coordinated at the top by the Supreme Council of National Defense (Consiliul Suprem de Apărare a Țării, CSAT), which the president chairs.

• The Romanian Intelligence Service (Serviciul Român de Informații, SRI) is the domestic service and the largest. It handles counterintelligence, counterterrorism, and threats to the constitutional order inside the country. It was created on March 26, 1990, and works under Law 14/1992 (SRI).
• The Foreign Intelligence Service (Serviciul de Informații Externe, SIE) collects intelligence abroad. Law 1/1998 defines it as the state body specialized in foreign intelligence on national security and defense (SIE).
• The General Directorate for Defense Intelligence (Direcția Generală de Informații a Apărării, DGIA) is the military intelligence and counterintelligence arm of the Ministry of National Defense.
• Prosecutors at DIICOT, the Directorate for Investigating Organized Crime and Terrorism, bring most espionage, treason, and sabotage cases to court. DIICOT is a prosecution office, not an intelligence service, but it is the name that appears on most charging announcements.

The directors of the SRI and the SIE are appointed by parliament in a joint session, on the president’s proposal, after a hearing before the relevant oversight committee. Each service has its own parliamentary oversight committee.

As of November 2026, the SRI has had no confirmed director for more than three years. Parliament declared the post vacant on July 10, 2023, after Eduard Hellvig resigned, and the service has been run since then by its first deputy director, General Răzvan Ionescu, on an interim basis (Stiripesurse; Euronews Romania). The SIE has been led by Gabriel Vlase since July 2018 (Romania Insider; Adevărul). President Nicușor Dan, in office since May 2025, has said he wants a civilian director at the SRI and has discussed candidates with the governing coalition, but no nomination had gone to parliament as of early November 2026 (Capital).

History: from the Siguranța to a NATO service

Romania’s modern intelligence tradition begins with the general staff, which set up a military intelligence unit on a French model in 1865. On the civilian side, the interior ministry created a Bureau of General Security in April 1892, which became the Directorate of Police and General Security, the Siguranța, in March 1908 (SRI timeline via Alba24).

Between the world wars, Romania built a dedicated secret intelligence service under Mihail Moruzov in the mid-1920s, later known as the Special Intelligence Service (Serviciul Special de Informații, SSI). The SSI ran Romania’s intelligence through the Second World War. In September 1944, after Romania switched sides, a decree-law moved it under the war ministry and renamed it.

The communist takeover rebuilt the whole system on the Soviet model. Decree 221 of August 30, 1948, created the General Directorate for the Security of the People, the Securitate, inside the interior ministry, on the skeleton of the old Siguranța and with Soviet advisers in key roles. Its stated mission was to defend the “democratic conquests” of the regime against enemies inside and outside the country (Newsweek România; Sighet Memorial). In March 1951 it became the General Directorate of State Security, with its own foreign intelligence directorate.

Romania’s relationship with Moscow then changed in a way that set it apart in the Warsaw Pact. In the early 1960s, under Gheorghe Gheorghiu-Dej, the Securitate was purged of many officers placed there by Moscow, and in 1964 the regime curtailed foreign intelligence cooperation with the KGB (GlobalSecurity). Nicolae Ceaușescu, who took power in 1965, kept that distance from Moscow while building the Securitate into an instrument of personal rule.

The most damaging blow came from inside. In July 1978, Lieutenant General Ion Mihai Pacepa, deputy head of foreign intelligence and an adviser to Ceaușescu, walked into the U.S. embassy in Bonn and asked for asylum. His information exposed Romania’s networks abroad, and the foreign service was purged and reorganized that September as the Foreign Intelligence Center, or CIE (Dennis Deletant in G4Media; Newsweek România).

After the revolution of December 1989, the new authorities dissolved the Securitate and split its functions among new institutions. The SRI was established by Decree 181 of March 26, 1990, as the domestic service. Foreign intelligence was reconstituted as a separate service, later the SIE. Law 51/1991 on national security named the bodies with intelligence duties, Law 14/1992 set the SRI’s rules, and Law 1/1998 did the same for the SIE. The armed forces created the DGIA in 1999 (Infosfera, Ministry of National Defense).

The past did not go away. Law 187/1999 created the National Council for the Study of the Securitate Archives (CNSAS) and gave citizens the right to read the files kept on them. The Constitutional Court struck that law down in January 2008, and an emergency ordinance replaced it the same year (Mediafax; Emergency Ordinance 24/2008). CNSAS still issues findings on whether public figures served as Securitate officers or informers, and those findings remain news. Romania joined NATO in 2004 and the European Union in 2007, and its services now work inside both alliances.

How Romanian intelligence is organized today

Coordination. CSAT, chaired by the president, sets intelligence priorities and coordinates the services. The SIE reports to CSAT on how it carries out its duties, and it needs CSAT’s approval to establish relations with foreign services.

The SRI. The SRI is the country’s main domestic intelligence body and has a minister-rank director. Beyond counterintelligence and counterterrorism, it coordinates Romania’s national counterterrorism system and is the national authority for security at civil airports. Its activity is overseen by a joint standing committee of the two chambers of parliament. Its annual reports go to that committee and then, in principle, to a vote in the full parliament. In practice, the reports for 2021 through 2024 cleared the committee but were never debated in plenary. The last one voted was the 2020 report, in October 2023 (Digi24).

The SIE. The SIE is organized as an autonomous administrative authority and is part of the national defense system. Its law allows it to use legal entities under cover and specific collection methods. Its director has minister rank. A special parliamentary committee oversees it, and its activity reports are classified by law, so only committee members can read them (SIE).

The DGIA. Defense intelligence sits inside the Ministry of National Defense and covers military intelligence, military counterintelligence, and defense security. Its head is appointed within the ministry, with CSAT’s approval. The ministry has proposed giving the DGIA a stand-alone statute that would spell out its collection powers and parliamentary oversight, which has drawn debate in the Romanian press (Digi24; Spotmedia).

Prosecutors and courts. Intelligence services in Romania do not prosecute. When the SRI or DGIA uncovers espionage or sabotage, the case goes to DIICOT, and judges at the Bucharest Court of Appeal and the High Court of Cassation and Justice decide on arrest, trial, and appeal. Romanian criminal procedure moves in visible stages: a 24-hour detention, a request for 30 days of pretrial arrest, then indictment, trial, and appeal. Each stage produces its own headline.

On NATO’s eastern flank

Russia’s full-scale invasion of Ukraine in February 2022 changed Romania’s threat picture. Romania’s border with Ukraine runs along the Danube delta and the northern Carpathians, and Russian drones attacking Ukrainian ports across the river have repeatedly strayed into Romanian airspace. Moscow has called Romania’s accusations about those incursions unfounded.

The response has been diplomatic as well as military. Romania has cut the number of accredited Russian diplomatic personnel by about two-thirds since 2022 (United24, citing Euronews). In March 2025, the foreign ministry declared Russia’s military, air, and naval attaché, Colonel Viktor Makovskiy, and his deputy, Colonel Evgeny Ignatiev, persona non grata for activities that breached the Vienna Convention on Diplomatic Relations. Russia called the move unfriendly and expelled two Romanian diplomats in April (Romania Insider; Kyiv Independent).

Romanian services describe a Russian campaign with several parts: influence operations aimed at elections and public opinion, recruitment of Romanian citizens to watch military sites, and sabotage plots carried out by hired foreigners. The SRI says it has foiled sabotage attempts in 2024, 2025, and 2026, often in cooperation with “partner services” abroad. Several of those cases are part of a joint investigation team with the Czech Republic, Poland, and Lithuania, set up in March 2025 (Universul).

Romania also watches Moldova closely. The two countries share a language and much of their history, many Moldovans hold Romanian citizenship, and Belarus and Russia both work the space between them. One of the cases below, involving a former Moldovan intelligence official, shows how that overlap can become a Romanian security problem.

Romanian intelligence in the news

Most of the recent headlines involve Russia, but not all. The first case below is about the services’ own limits at home.

The SRI–prosecutor protocols (2009–2019)

For years, the SRI helped prosecutors carry out wiretaps and other technical surveillance in criminal cases, including corruption cases brought by the National Anticorruption Directorate (DNA). Prosecution bodies relied heavily on SRI equipment and personnel to carry out court-ordered surveillance warrants.

In February 2016, the Constitutional Court ruled in Decision 51/2016 that the law could not let “other specialized bodies of the state” carry out such surveillance for criminal cases. In effect, it barred the SRI from that role (Romania Insider). Defense lawyers began challenging SRI-assisted evidence in pending cases. Within weeks, the government issued an emergency ordinance setting new rules for how prosecutors could use the SRI’s interception systems (Romania Insider).

A second fight followed over cooperation protocols that the prosecutor general’s office and other bodies had signed with the SRI starting in 2009, some of them classified. In January 2019, the Constitutional Court ruled that the 2009 protocol had placed prosecutors and the SRI in a constitutional conflict with parliament (Reuters). The rulings were politically charged. Supporters of the anticorruption drive saw an attack on prosecutors, while critics saw overdue limits on the SRI. Both rulings still shape how courts treat evidence gathered with the SRI’s help.

A spy for the Russian embassy (2024)

In May 2024, DIICOT detained Alexandru Dorin Piscan, a Romanian businessman from Ploiești who had announced a run for mayor. Prosecutors said that since 2022 he had watched Romanian and NATO military sites near Tulcea, close to the Ukrainian border, and sent photographs of military equipment and troop movements to a diplomat at the Russian embassy in Bucharest. The SRI had documented his activity. Romania declared the diplomat persona non grata, and Russia expelled a Romanian diplomat in return (Radio Free Europe).

In December 2024, the Bucharest Court of Appeal sentenced Piscan to five years and six months in prison for continued treason. Treason carries 10 to 20 years in Romania, but his sentence was reduced because he admitted guilt during the trial (Digi24).

The annulled 2024 presidential election (2024–present)

On November 24, 2024, Călin Georgescu, an independent with a mostly online campaign, finished first in the first round of Romania’s presidential election. On December 4, outgoing President Klaus Iohannis declassified documents presented to CSAT by the SRI, the SIE, and the interior ministry.

The documents said Romania was a target of “aggressive hybrid Russian actions.” They described a TikTok network of about 25,000 accounts that became very active two weeks before the vote, influencers paid to promote Georgescu directly or through neutral messages tagged to him, and cyberattacks on election infrastructure. TikTok confirmed to Romanian authorities that a user called “bogpr” had paid about $381,000 to accounts promoting the candidate between October 24 and November 24, 2024. Georgescu had declared that he spent nothing on his campaign. Russia denied any interference (Radio Free Europe; Agerpres).

On December 6, 2024, the Constitutional Court annulled the election, citing the declassified documents (AP). The rerun in May 2025, from which Georgescu was barred, was won by Nicușor Dan.

The declassified documents attribute the campaign to a state actor and describe Russia as the threat. They do not show a tasking chain between a Russian service and Georgescu personally, and he has not been charged with working for Russia. He has been charged in separate cases: one for promoting fascist and legionary ideas, one for complicity in attempted actions against the constitutional order, alongside mercenary leader Horațiu Potra and others, and, in September 2026, a fraud case. He denies all charges and calls them political (HotNews; Puterea; Stirile ProTV). The constitutional-order case went to trial at the Bucharest Court of Appeal in September 2026.

The “Vlad Țepeș Command” (2025–present)

On March 6, 2025, DIICOT detained six members of a group calling itself the Vlad Țepeș Command on suspicion of treason. Prosecutors allege the group, organized on a military model with its own “general staff,” planned to remove Romania’s constitutional order, abolish political parties, take Romania out of NATO, and rebuild ties with Russia (Agerpres).

According to the arrest request, reported by Radio Free Europe, prosecutors allege the group was started in 2023 under the coordination of the Russian military attaché, Colonel Makovskiy, and his successors, including his deputy, Colonel Ignatiev. They also allege that two members traveled to Moscow in early 2025 to meet a person suspected of acting for a foreign state. A 101-year-old retired general was investigated as a suspect but was not detained (Radio Free Europe).

The Bucharest Court of Appeal ordered pretrial arrest for two members and judicial control for four, and the High Court upheld that decision on March 18, 2025. The case was announced the day after Romania expelled the two Russian attachés, and Agerpres reported that the charges were connected to the expulsions (Gândul; Agerpres). The allegations are prosecutors’; we found no reported verdict as of early November 2026.

A former Moldovan intelligence official and the Belarusian KGB (2025–present)

In September 2025, police stopped Alexandru Bălan, a former deputy director of Moldova’s Intelligence and Security Service (SIS), in Timișoara. Bălan, 47, holds both Moldovan and Romanian citizenship and had earlier headed Moldova’s counterintelligence directorate. The SRI, which said it worked with services in four countries, accused him of passing Romanian state secrets to the KGB of Belarus, and DIICOT detained him on suspicion of treason. Prosecutors allege he met Belarusian intelligence officers twice in Budapest in 2024 and 2025 and was paid for information (TVR Info; Adevărul).

DIICOT indicted him on February 25, 2026, for attempted treason by passing state secrets and for disclosing secrets that endanger national security, and the case went to the Bucharest Court of Appeal. A court in Chișinău separately convicted him of attempting to disclose Moldovan state secrets and sentenced him to a year and six months, and in April 2026 Romanian police handed him over to Moldovan authorities at the border. The Romanian charges remain allegations (Digi24; HotNews).

The Bragadiru sabotage plot (2024–2026)

In late July 2024, Luis Alfonso Murillo Diosa, a 34-year-old former Colombian soldier, flew into Bucharest from Medellín by way of Madrid and Mykonos. Prosecutors said he spent the following days reconnoitering targets in Ilfov County near Bragadiru: a recyclable-waste depot, two oil wells, and a natural gas metering station. He photographed and filmed them and sent the images to a contact in Russia. The SRI, working with partner services in Europe, identified him quickly, and police stopped the plan before he acted (Radio Free Europe).

After his detention, Russian Telegram channels claimed, falsely and with photographs of other fires, that a fuel depot for Ukraine had been destroyed at Bragadiru. In June 2025, the Bucharest Court of Appeal sentenced Murillo Diosa to six years in prison for attempted sabotage. The High Court made the sentence final on September 22, 2025 (Agerpres; Romania Insider).

The case then grew. In September 2026, a joint investigation by Deutsche Welle and European broadcasters identified the alleged recruiter as Oemis Romagoza Durruthy, a Cuban-born dance teacher living in Russia, and tied him to attacks and attempted attacks in the Czech Republic, Poland, Lithuania, and Romania (LRT). U.S. federal prosecutors in New York charged him and four others with conspiracy to finance terrorism that month (Cubanet). On November 2, 2026, the Bucharest Court of Appeal approved an arrest warrant in absentia for Romagoza Durruthy, accused of instigating the Romanian plot by paying Murillo Diosa. He lives in Russia and has not been arrested (Agerpres).

Military bases under watch (2026)

On September 8, 2026, DIICOT detained a 40-year-old Russian citizen living in Romania on suspicion of attempted sabotage. Prosecutors allege that from February to July 2026, under the direction of a contact reached through encrypted messaging, he surveilled and gathered information on Romanian and multinational military bases in Cluj, Constanța, Călărași, and Ilfov counties and in Bucharest. The SRI said he also filmed Ukrainian Antonov cargo aircraft while they were in Romania (Economedia).

The SRI said it worked on the case with DIICOT, the interior ministry’s organized crime directorate, the DGIA, and foreign partner services. It said the pattern matched sabotage networks seen elsewhere in Europe, and it pointed to earlier cases, including an October 2025 plot in which two Ukrainians allegedly planned to set fire to a Nova Post courier office in Bucharest. The Russian man is presumed innocent. Moscow dismissed the reports as fantasy (Stirile ProTV).

How to read coverage of Romanian intelligence

Know which institution is speaking. The SRI and DGIA investigate; DIICOT charges; courts decide. A headline saying “SRI foiled a plot” and one saying “DIICOT indicted a suspect” describe different stages of the same case, and neither is a conviction.

Watch the procedural stage. A 24-hour detention, a 30-day arrest, judicial control, indictment, a first-instance sentence, and a final High Court ruling all make news. Romanian arrest decisions are frequently reversed on appeal, so check the latest ruling before treating someone as jailed or free.

Separate official releases from “judicial sources.” Romanian outlets often publish details attributed to unnamed judicial sources or to leaked arrest requests. Those can be accurate, but they are not the prosecutors’ public position, and they sometimes go further than any charging document.

Read declassified documents for what they say. The December 2024 CSAT documents are intelligence assessments. They describe a campaign and a likely state actor. They are not a court finding against any individual, and claims on either side that go beyond the text deserve caution.

Expect the past to surface. CNSAS findings on Securitate service can upend a public career decades later. CNSAS has confirmed, for example, that a former SIE operational chief served in the communist-era foreign intelligence center from 1987 to 1989 (HotNews).

These habits are part of good trend analysis and help guard against cognitive bias when a story fits what a reader already believes.

Frequently asked questions

Related reading

• Intelligence Services Around the World: Structure, History, and the Headlines
• Polish Intelligence: History, Structure, and the Headlines
• Ukrainian Intelligence: History, Structure, and the Headlines
• Russian Intelligence: History, Structure, and the Headlines
• Cuban Intelligence: History, Structure, and the Headlines
• Hungarian Intelligence: History, Structure, and the Headlines

Competitive Futures briefs companies and governments on intelligence services, foreign influence, and Romania and NATO’s eastern flank; details are on the services page.