Methodology & Trust

“Awareness is power.”

Baltic Sonar is an experimental, fully automated open-source situational-awareness index for the Baltic region — Estonia, Latvia, Lithuania, the Baltic Sea, Kaliningrad, Belarus and adjacent areas. It reads public reporting and open sensors around the clock, grades every signal by the credibility of its source, and publishes a single continuously-updated picture. No human curates the output.

⚠ This is not verified intelligence. It is automated aggregation of public reporting and open sensor data, with AI-generated analysis. It is not affiliated with any government, military or alliance, and must not be used as a sole basis for any operational decision. Research and situational awareness only.

1 · Sources are graded, not equal

Every source carries a credibility class. This is the backbone of the whole system: a single social-media post can never, on its own, raise the threat level — but the same claim confirmed by an official body or a sensor does. Each event on the dashboard shows exactly which classes reported it.

Class	What it is	Sources now	Can raise threat alone?
A	Official / primary — governments, ministries of defence, CERTs, NATO, EU, and our own measured sensors	27	yes
B	Trusted independent — established public broadcasters and major dailies (LSM, ERR, LRT, Yle, SVT, Postimees, Delfi…)	25	yes
C	Specialist / OSINT — think-tanks and investigative outlets (ICDS, OSW, CEPA, Bellingcat, DFRLab, Re:Baltica, EUvsDisinfo)	20	yes
D	Social / local — community and local channels. A signal, not a fact.	0 — none registered	no — needs corroboration
E	Unverified aggregator — topical news-search results of unknown origin; the classifier filters them	0 — none registered	no — needs corroboration
P	Adversary / propaganda — RU/BY state media. Would be tracked for narrative only; never contributes to the threat level.	0 — none registered	never

Currently 72 sources, in the classes shown above. Classes with a zero are rules the pipeline implements but no feed currently occupies — we describe the whole ladder rather than hide the empty rungs, so nothing here should be read as a claim that we are reading social channels or adversary media today. Corroboration counts independent editorial groups, not articles: one media group publishing in three languages is one confirmation, not three. For Estonia and Latvia that promise currently has a limit worth stating: fewer than two independent news organisations from those countries are on our source list, so corroboration there can come only from official and public-broadcaster feeds, and a low corroborated share reflects our source list rather than the events themselves.

2 · Three separate numbers, deliberately

Conflating "how much is being reported" with "how dangerous it is" is the most common failure of news dashboards. We keep them apart:

Threat level — severity of confirmed, corroborated incidents. Built to be independent of volume: ten routine mentions never outweigh one measured GPS-jamming or border incident.
Attention — how much is being reported. High attention is not high danger.
Resilience — defensive response and investment (NATO deployments, procurement, infrastructure protection). Shown as a separate, positive axis so the picture is not pure doom.

3 · How the threat level is computed

Not a mention count. Each incident gets an EventRisk = severity × credibility × relevance × proximity × abnormality × intent, decayed over 48 hours. Credibility folds in source class, evidence type (FACT vs CLAIM), corroboration and whether it was directly measured. Category scores combine peak severity, saturating evidence mass, trend, persistence and cross-source breadth. The overall Baltic Threat Index is a weighted blend across 14 domains, with a convergence bonus only when elevated domains actually coincide in one cluster — never because several categories are independently noisy. Click the threat number on the dashboard to see the full per-domain breakdown in points.

4 · Measured sensors, not only news

Military aviation (ADS-B) — allied aircraft that transmit a transponder. This measures allied presence, not Russian activity, which generally does not transmit; it feeds the resilience side.
Vessel behaviour (AIS, Finnish Digitraffic) — hulls loitering near subsea cables and pipelines. What is measured is the behaviour; a vessel's presence in any sanctions or shadow-fleet registry is a separate fact about the hull and is never used as evidence about the behaviour.
GNSS degradation (GPSJam) — the share of aircraft in a map cell reporting poor navigation accuracy. Degradation is measured; the cause — jamming, spoofing or space weather — is not established.
Grid and pipeline (Elering, the Estonian TSO) — EstLink 1 & 2 flow, Balticconnector gas flow and pressure, system frequency. The asset's own operator measuring its own asset. Flow follows the electricity market, so zero flow can be a price spread or maintenance; no cause is asserted.
BGP routing (RIPE RIS) — visibility of Baltic critical networks. A drop is flagged only against each network's own baseline, and labelled as possible maintenance or artefact, never asserted as an attack.
Seismic (EMSC), internet reachability (IODA), airspace (OpenSky), geomagnetic activity (NOAA Kp), navigation aids reported faulty and port calls (Finnish Digitraffic), and Finland–Russia rail services — measurement and confounder control, so that a geomagnetic storm or a storm-damaged buoy is not read as an attack.
Ransomware leak sites — Baltic organisations named on extortion sites, via a public aggregator. The listing is a fact; the claimed scope is the criminals' assertion.
Weather alerts (MeteoAlarm) — context, so a storm-caused outage is not mistaken for sabotage.

Sensor events are marked measured and shown as class A. The live count of measurement families on the dashboard is defined as those with at least one observation in the last 48 hours; each one, with its row counts and last reading, is listed on the sources page.

5 · What we refuse to do with data

These guards exist specifically so the numbers cannot mislead a serious reader:

Every date says what it is. Where a source gives a publication date we use it, so a two-year-old article resurfacing in a feed never appears as today's incident. Where it does not, we do not invent one. Of the 1586 incidents in the last 30 days, 1558 carry a real publication date. The other 28 do not: 0 carry only the timestamp at which a news aggregator first saw the article (a third party's clock, not a publication date) and 28 carry no date at all, so their date is our collection time. Every row in the open data says which, in date_basis, and the dashboard leaves undated incidents off the timeline instead of stacking them on today.
Baselines refuse to compute when our collection depth changed. If either of the two 7-day windows being compared holds more than 3× the incidents of the other, "heating/cooling" and percentiles say baseline forming rather than inventing a trend that only reflects our own plumbing.
New categories are never flagged anomalous until they have enough history to have a baseline at all.
The system never invents sources, coordinates, events or attribution. Missing location → country centroid, labelled with its geo-precision. Correlation is explicitly flagged as not causation.
We never profile individuals by nationality, ethnicity or religion. A person appears only when already named in a court ruling or an official security-service statement.

6 · Fully local AI

Every classification, brief, narrative and translation is produced by a Qwen-class model running on our own hardware via Ollama — a single Mac Studio M3 Ultra, 256 GB unified memory. No cloud AI, no per-token bills, no data leaving the pipeline. Semantic search uses a local multilingual embedding model (bge-m3) and works across all seven interface languages.

7 · One-way architecture

Collection and analysis run on private infrastructure. The public server you are reading only ever receives a one-way push of a static snapshot — it holds no database, no credentials, and no path back into the pipeline. There is nothing on it worth attacking. The single live endpoint is the tiny search-embedding service, which sees your query text and nothing else. No third-party trackers. The web server keeps a standard access log (IP address, request, browser string) for 14 days, as any web server does; the visitor statistics are computed from a salted hash of it, and the published counts contain neither the address nor the hash.

8 · Honest caveats

Severity, attribution, intent and correlation are automated estimates, not analyst judgements.
Coverage depends on what public sources report; absence of a signal is not evidence of absence.
Translations are machine-made, locally. The English source text is authoritative.
ADS-B and BGP measure only what transmits or is globally visible; both have blind spots by design.

Who runs this

Baltic Sonar is an independent, self-funded experiment by Andris Gailītis — gailitis.ceo. It is not operated by, funded by, or affiliated with any government, military, alliance, political organisation or employer. Everything is built and hosted privately, and the pipeline runs on the author's own hardware. Engineering and design were done with the help of Claude (Anthropic) as a copilot. Responsible-disclosure contact: security.txt.

Contact & feedback via gailitis.ceo.