◈ Baltic Sonar — 2026-09-28

**BALTIC SECURITY INTELLIGENCE BRIEF** **Date:** 2026-09-28 **Overall Index:** 23/100 (BLUE) **Overall Assessment** The Baltic security environment remains stable with low immediate kinetic risk. The BLUE index reflects a baseline of routine monitoring rather than active crisis. No evidence of imminent state-on-state conflict is present. **Most Notable Developments** The primary activity involves repeated vessel loitering near critical undersea infrastructure. Specific incidents were recorded near the Baltic Sea Submarine Cable, Eastern Light Sweden-Finland I, and BCS North - Phase 1. These events constitute the bulk of current naval alerts. While loitering near critical infrastructure warrants attention, no confirmed sabotage or physical damage has been reported. ASSESSMENT: These incidents likely represent routine maritime surveillance or testing of response protocols rather than coordinated kinetic attacks. **Correlated Clusters** Data indicates multi-domain correlations: NAVAL activities align with GNSS_EW and ECONOMY_FINANCE indicators. Estonia shows a cluster involving WEATHER, CYBER, DIPLOMATIC, and ECONOMY_FINANCE factors. Latvia exhibits a correlation between CYBER and INFORMATION_OPS. Note: Correlation does not imply causation; these clusters may reflect independent concurrent events rather than a single coordinated campaign. **Narratives Present (Last 7 Days)** Current discourse is dominated by Diplomatic Tensions & Peace Stalemate (18 items), followed by Baltic Defense Readiness & Mobilization (14 items). Russian Hybrid Threats & Sabotage (11 items) and Russian Propaganda & Information Warfare (6 items) also feature prominently. These narratives reflect ongoing strategic competition but do not indicate a shift in operational tempo. **Things to Monitor** 1. **Undersea Infrastructure Integrity:** Continued monitoring of vessel movements near Eastern Light and BCS North cables for signs of physical interference. 2. **Estonian Multi-Domain Activity:** Watch for escalation in the WEATHER-CYBER-DIPLOMATIC cluster, particularly if economic sanctions or diplomatic expulsions occur. 3. **Latvian Information Environment:** Track the intersection of CYBER incidents and INFORMATION_OPS to detect potential disinformation campaigns targeting public trust.