← Baltic Sonar · Methodology & trust

Sources

Every source below is public and carries a credibility class (see methodology). The weight is a starting point by class; it is combined with corroboration across independent editorial groups, so five outlets from one newsroom count as one confirmation, not five. Class D/E/P sources cannot raise the threat level on their own; the classes below are the ones that currently hold at least one registered feed, and a class absent from this page holds none.

Corroborated = share of this source's events that ≥2 independent editorial groups also reported (newsrooms collapsed, aggregators excluded) — the same definition as the Coverage & Confidence panel on the front page, so the two numbers agree. It is low across the board, and that is the honest picture. Auto-attributed = share our classifier marked CONFIRMED / HIGHLY_LIKELY. That is a machine guess about who was behind it, not a confirmation that the event happened, and it is shown in its own column precisely so it is never mistaken for one.

⚠ Estonia and Latvia have fewer than two independent news organisations on this list, so corroboration there can come only from official and public-broadcaster feeds. A low corroborated share for a source reporting from those countries reflects this list, not the event. Newsroom languages are counted as one group, and official, specialist and aggregator feeds are not counted as news organisations.
⚠ Presence here is not an endorsement, and a high weight does not make a single report true. Every item is labelled FACT / CLAIM / ASSESSMENT downstream, and adversary (P) media never contributes to the threat level — only to narrative tracking.

Sensors — primary measurements — marked 'measured', class A

SensorWhat it measuresDataLastWhy it matters
Military aviation (ADS-B, adsb.lol)Allied military aircraft that transmit a transponder9557 observations2026-10-15 18:54Measures allied presence, not Russian activity — feeds resilience, not threat
Vessel behaviour (AIS, Finnish Digitraffic)Position reports for hulls in the Baltic; loitering near cable and pipeline routes7278873 position reports2026-10-15 19:00The behaviour is what is measured. A hull's presence in any sanctions or shadow-fleet registry is a separate fact about the hull and never explains the behaviour
GNSS degradation (GPSJam)Share of aircraft per map cell reporting poor navigation accuracy45 daily grids2026-10-14Degradation is measured; the cause — jamming, spoofing or space weather — is not established. Cells with fewer than 8 transmitting aircraft are excluded. ~1-day lag
Navigation aids (Digitraffic ATON)Finnish buoys, beacons, leading marks and racons reported faulty1026 readings2026-10-15 19:05Ice, storms, vessel contact and wear are the ordinary causes; unlit lights are routine
Port calls (Digitraffic)Vessel arrivals and departures at Finnish ports3054 readings2026-10-15 19:05Traffic context — a quiet port is a market or weather fact before it is anything else
Rail Finland–RussiaScheduled cross-border rail services and cancellations3081 readings2026-10-15 19:05A cancelled train is a schedule fact; no cause is asserted
BGP routing (RIPE RIS)Global visibility of 11 Baltic critical networks38 snapshots · 38 networks2026-10-15 19:00A drop is flagged only against each network's own baseline; cause never asserted
Ransomware leak sites (ransomware.live)Baltic organisations named on extortion sites6 listings2026-10-10 20:42The listing is a fact; the claimed breach scope is the criminals' assertion
Seismic (EMSC)Seismic events in the Baltic Sea area3 events2026-06-02 18:50Underwater explosions leave a seismic signature
Airspace (OpenSky) · Internet (IODA) · Geomagnetic (NOAA Kp)Continuously polled context sensorsmonitoredliveConfounder control — e.g. a geomagnetic storm can explain GNSS degradation that would otherwise look like jamming
Elering (Estonian TSO) class AEstLink 1 & 2 flow, Balticconnector gas flow and pressure, Estonian system frequency20958 readings2026-10-15 17:55The asset’s own operator measuring its own asset — an AIS loitering alert near EstLink can be checked against a real interconnector measurement in the same window. Flow follows the electricity market, so zero flow can be a price spread or maintenance; no cause is asserted.

Reference registry — listings, not our measurement

OpenSanctions — Maritime · 23636 rows · version 20261014150330-jrf · refreshed daily · opensanctions.org · licence CC BY-NC 4.0 (not part of our CC BY open data).

This is not a source class of its own. It aggregates listings made by many different bodies, and the credibility belongs to the body that made the listing, not to the aggregator: class A for EU / OFAC / UK / UN designations and port-state-control detentions, class C for research listings (RUSI Project Sandstone) and for the Ukrainian NACP “War & Sanctions” portal. The NACP portal is official, but it is kept by a party to the conflict, so it is marked as such and can never on its own raise our confidence in anything (§5).

⚠ One number decides how this must be read: across the whole dataset, every “vessel of interest” row (2,943) and every “shadow-fleet” row (857) comes from that one party-to-conflict list — zero from any other body. So every shadow-fleet flag we are able to display rests on a belligerent’s own listing. We show it, we label it, and we never call it “sanctioned”.

What this registry is not: it records listings and detentions, not vessels suspected in incidents, and it has no predictive power. EAGLE S — the vessel whose anchor cut EstLink 2 — is in it (7 rows by IMO). NEWNEW POLAR BEAR and YI PENG 3, both central to earlier Baltic cable incidents, return zero rows. A hull being absent here means nothing, and a hull being present here explains nothing about its behaviour.

The five listing types are kept apart and never collapsed into one “sanctioned” badge: sanctions designation, port-state-control detention (a ship-condition finding, not a security allegation), regulatory warning, shadow-fleet listing, vessel of interest. Merging them would roughly quadruple the apparent picture.

A · Official / primary — governments, CERTs, ministries, NATO, EU, sensors — 27

SourceAreaLangWeightItemsCorroboratedAuto-attributedLast seen
MeteoAlarm FinlandFIen924504100%100%2026-10-15 19:00
MeteoAlarm EstoniaEEen92232849%100%2026-10-15 19:00
MeteoAlarm LatviaLVen92172353%100%2026-10-15 19:00
EU Commission Press (RAPID)multien92313——2026-10-15 19:00
Cloudflare Statusmultien92241——2026-10-15 19:00
MeteoAlarm LithuaniaLTen9214656%100%2026-10-15 19:00
Estonia MFAEEen9212212%98%2026-10-15 19:00
Latvia MFALVen92890%100%2026-10-15 19:00
Riigikogu (Estonia Parliament)EEen92640%100%2026-10-15 19:00
European Central Bankmultien9258——2026-10-15 19:00
CERT.LVLVlv92570%100%2026-10-15 19:00
MCF Sweden (Civil Defence)SEsv9254——2026-10-15 19:00
Europolmultien9253——2026-10-15 19:00
CERT PolskaPLen9248——2026-10-15 19:00
CERT-EE / RIAEEet92420%100%2026-10-15 19:00
Frontexmultien9239——2026-10-15 19:00
EASA (EU Aviation Safety)multien9235——2026-10-15 19:00
Estonia MODEEen92323%100%2026-10-15 19:00
CERT-SESEsv9231——2026-10-15 19:00
NCSC-FI (Traficom)FIen9229——2026-10-15 19:00
Finnish Border GuardFIen92280%100%2026-10-15 19:00
Elering (EE TSO)EEet92180%100%2026-09-24 09:00
NATO ENSEC COE (Vilnius)LTen9217——2026-10-15 19:00
Norway PSTmultisv9215——2026-10-15 19:00
EMSA (EU Maritime Safety)multien9214——2026-10-15 19:00
Estonia Defence ForcesEEen92140%100%2026-10-15 19:00
Google Cloud Statusmultien9213——2026-10-15 19:00

B · Trusted independent — public broadcasters & major dailies — 25

SourceAreaLangWeightItemsCorroboratedAuto-attributedLast seen
Ilta-Sanomat FIFIfi7889054%67%2026-10-15 19:00
LRT Lithuania LTLTlt7878576%83%2026-10-15 19:00
ERR Estonia ETEEet7852276%75%2026-10-15 19:00
Helsingin SanomatFIfi7848958%54%2026-10-15 19:00
LSM Latvia LVLVlv7836776%79%2026-10-15 19:00
ERR Estonia RUEEru7832933%78%2026-10-15 19:00
Yle Finland ENFIen7828210%71%2026-10-15 19:00
SVT SwedenSEsv7818580%83%2026-10-15 19:00
Verslo žinios (LT business daily)LTlt78180117%84%2026-10-15 19:00
Kyiv Independentmultien7810545%69%2026-10-15 19:00
ERR Estonia ENEEen789904%80%2026-10-15 19:00
DataCenterDynamicsmultien78883——2026-10-15 19:00
DR Udland (Denmark)multida7880820%60%2026-10-15 19:00
Notes RU-EUmultien787060%67%2026-10-15 19:00
LSM Latvia ENLVen785424%94%2026-10-15 19:00
The Local SwedenSEen78387——2026-10-15 19:00
Defence24PLen783394%77%2026-10-15 19:00
LRT Lithuania ENLTen783199%86%2026-10-15 19:00
InfoSecurity24 (PL)PLpl7828510%80%2026-10-15 19:00
Baltic Timesmultien7825510%90%2026-10-15 19:00
Notes from PolandPLen7811814%57%2026-10-15 19:00
Data Center Knowledgemultien7899——2026-10-15 19:00
Baltic Sentinelmultien78480%81%2026-10-15 19:00
Emerging Europemultien7848——2026-10-15 19:00
Šiaulių kraštas (LT regional)LTlt7845——2026-10-15 19:00

C · Specialist / OSINT — think-tanks & investigative outlets — 20

SourceAreaLangWeightItemsCorroboratedAuto-attributedLast seen
Meduza ENRUen689407%58%2026-10-15 19:00
The Maritime Executivemultien686590%60%2026-10-15 19:00
Moscow TimesRUen6839019%78%2026-10-15 19:00
The Insider (RU investigative)RUen682700%8%2026-10-15 19:00
Atlantic Councilmultien68225——2026-10-15 19:00
Naval Newsmultien681450%100%2026-10-15 19:00
SWP Berlinmultien68106——2026-10-15 19:00
CEPAmultien6899——2026-10-15 19:00
SubTel Forum (subsea cable)multien6880——2026-10-15 19:00
OSW Warsaw (Eastern studies)PLen6861——2026-10-15 19:00
RUSImultien6858——2026-10-15 19:00
ICDS Estonia (defence think tank)EEen68410%91%2026-10-15 19:00
Clingendael (NL)multien6836——2026-10-15 19:00
DFRLab (OSINT/disinfo)multien68240%80%2026-10-15 19:00
Jamestown (Europe)multien6822——2026-10-15 19:00
Bellingcat (OSINT verification)multien6817——2026-10-15 19:00
SCEEUS (Stockholm E. Europe studies)SEen6817——2026-10-15 19:00
FIIA (Finland)FIen6814——2026-10-15 19:00
EU Parliament Think Tankmultien6810——2026-10-15 19:00
Re:Baltica (LV investigative)LVen6810——2026-10-15 19:00

Generated 2026-10-15 19:00 UTC · “Awareness is power.”