Sirens over Kaunas, 0.14 in the model: OSINT digest, 11 November

Baltic Security Monitor | Analytical review
Snapshot: 2026-11-11T09:06:47Z · Security Watch 08:00 EET: 1 MATERIAL UPDATE · MODERATE

Overnight on 11 November, Lithuania, Latvia and Estonia told people in border regions to take shelter, and NATO fighters twice failed to bring down a drone over Lithuania. The automated model scored the event at 0.14 — lower than a story about redeveloping a stadium site in Riga. The composite rests on a single sub-index, and the night's main event had to be rebuilt from independent sources.

Today's OSINT indices

• Composite threat index: 0.14 · 6h and 24h delta: 0.00
• Force Posture: 0.00
• Logistics: 0.00
• Info/Cyber: 0.00
• Border/Air/Maritime: 0.58

Snapshot events: 1 · high-confidence: 0 · quarantined in 24h: 2 (low information density) · source failures: 0 · old publications received in 24h: 35. Top-5 median age is 62 hours; median ingest lag is 14.8 hours (p90 34.6 hours).

Three sub-indices at zero and one at 0.58 is the classic "artificial calm": all activity sits in a single domain. That domain is the airspace over the Baltic states, which unidentified drones entered again overnight as Ukraine struck north-western Russia. A composite of 0.14 describes imbalance, not quiet. Structural pressure on the border persists while force posture, logistics and cyber stay silent.

Top-5 digest events

🟠 1. Drone alerts across the Baltic states and Finland OSINT score: 0.14 — WATCH (new entry, Reuters, 11h old)

Lithuania's LT72 emergency alert system began issuing warnings late on 10 November. Red alerts were in force from 00:38 to 02:02 on 11 November for areas including Kaunas, Panevėžys and Biržai. Lithuania's crisis management authorities noted that the warning covered Kaunas, the country's second-largest city with about 300,000 residents.

Lithuania's Chief of Defence Staff, Rear Admiral Giedrius Premeneckas, said the drone entered Lithuanian airspace from Belarus. NATO fighters made two attempts to shoot it down but could not engage near Kaunas because of the risk to civilians. After 03:00 Latvia issued its own warnings and activated interceptor drones, air defence units and Baltic Air Policing jets. Estonia also sent alerts to its border regions. Finland imposed temporary air and maritime restrictions in the eastern Gulf of Finland and later lifted them. No injuries were reported, and all three Baltic states withdrew their alerts on Wednesday morning.

The drone's type and origin have not been officially established. The alerts coincided with a Ukrainian attack on Russia's Leningrad region.

BSM analysis

The alert itself is not new: such episodes have recurred since March 2026. What is new is the route and the outcome. The drone came in through Belarus rather than from Russia and passed over a large city where interception is impossible without risk to people on the ground. The failed attempts show the limits of the current air-defence model: fast jets are a poor tool against slow, small targets over residential areas, which is why Latvia is already using interceptor drones. For the Baltic states, the question is shifting from whether drones will come to what to shoot them down with, and where.

🔵 2. Orlen terminates a long-term QatarEnergy contract OSINT score: 0.08 — WATCH (new entry, Reuters, 11h old)

On 10 November Orlen exercised its right to terminate one of its two long-term contracts with QatarEnergy, covering 1 million tonnes of LNG a year. Deliveries began in 2016 and the deal was due to run until 2034. The trigger was a prolonged force majeure: Qatari supplies were halted after the Iran war began, and at the end of October QatarEnergy extended its force majeure until the end of 2026. The contract stays in force for 60 days after notice. It is the first termination by a QatarEnergy customer.

Orlen keeps its second contract, which is linked to gas benchmarks, and has already signed deals for US LNG from projects in Texas and Louisiana.

BSM analysis

For the north-eastern flank this is a story about resilience, not shortage. The Świnoujście terminal and Baltic gas interconnectors let Poland switch suppliers without endangering security of supply. At the same time, reliance on US LNG keeps growing, tying the region's energy security ever more closely to the transatlantic relationship. The low score of 0.08 is justified here: the event poses no immediate risk.

🔵 3. Estonian developer to build on Riga stadium site (ERR) OSINT score: 0.22 — WATCH (62h old)

🔵 4. Estonian athlete sets national record in Poland (ERR) OSINT score: 0.16 — WATCH (111h old)

Neither entry has anything to do with security. Why both outrank the overnight drone alert is covered in the data-quality section below.

🔵 5. Sweden reinstates internal border checks over Russian hybrid threats OSINT score: 0.23 — WATCH (136h old)

On 5 November the Swedish government decided on targeted checks at internal Schengen borders from 12 November 2026 to 11 May 2027. The justification is hybrid threats and hostile actors linked to Russia operating inside the Schengen area. It extends an earlier six-month period, but this time the rationale names Russia directly. The checks begin tomorrow.

Material Update: strikes have hit about 30% of Russia's nominal refining capacity

Classification: MATERIAL UPDATE · MODERATE · Energy / Russian war economy

On 10 November Reuters, citing two industry sources, put numbers on the Ukrainian strikes against refineries since late October. The affected plants have a combined nominal capacity of about 300,000 tonnes of crude a day, against a national total of roughly 930,000. Over the past week, nine of Russia's 35 major refineries suffered disruptions. The sources estimate the possible real cut in processing at up to 200,000 tonnes a day.

The two figures are not the same thing. Thirty percent is the share of capacity at plants that were hit, not a one-third drop in output. The actual cut, if it reaches the top of the estimate, is roughly a fifth of processing.

Facilities hit include plants in Ryazan, Yaroslavl and the Volga region. The Kirishi refinery was attacked on 9 November: Leningrad region governor Alexander Drozdenko confirmed a fire at the plant and claimed 113 drones were downed. Debris fell on a residential building in Vsevolozhsk, where he said a woman was killed. Overnight on 11 November the governor claimed another 92 drones intercepted. That figure has not been independently confirmed, and there is no confirmed new damage at Kirishi, Ust-Luga, Primorsk or Vysotsk.

BSM analysis

For the Baltic region this cuts both ways. Kirishi and the Gulf of Finland export terminals are part of Russia's war economy, which Ukraine is targeting systematically. Yet every such wave of strikes now comes with alerts in Lithuania, Latvia, Estonia and Finland. The overnight alert over Kaunas and the Reuters estimate are two sides of the same campaign. Caution with the numbers is essential: last year Reuters found that Russia offset much of the damage with spare capacity and rapid repairs, so lost output is well below the share of capacity hit. 🟡

OSINT check: data quality this cycle

The night's main event scored 0.14. A Riga stadium redevelopment story scored 0.22, a sports record 0.16. The model appears to rank entries by keywords or source rather than security significance. Neither ERR item should have reached the top five of a security digest.

Other quality signals:
- Freshness. The top-5 median age is 62 hours, and three of the five entries are more than two days old. The system received 35 old publications in 24 hours. The digest partly reflects last week rather than last night.
- Volume. The snapshot contains one event with no high-confidence items, and two entries were quarantined as low-information. Overnight alerts in three Baltic states and Finland, plus the attack on the Leningrad region, are represented by a single Reuters entry.
- Coverage. Lithuanian and Latvian primary sources (LT72, the crisis management centre, the Latvian National Armed Forces) did not reach the digest. The failed interceptions and the drone's Belarusian route surfaced only through independent verification.
- Mismatch with Security Watch. The morning Security Watch mentions only Latvia and Lithuania, although Estonia also issued alerts. The figure of 92 drones intercepted over the Leningrad region remains a governor's claim without independent confirmation.

B/A/M at 0.58 reflects real pressure on the border, but the low composite this cycle is an artefact of the model, not an assessment of the situation.

WATCH for the next cycle

• Lithuania's official findings on the drone's type and origin, and on why the interception failed.
• Whether the Baltic states revise rules of engagement over populated areas.
• Satellite or industry evidence of damage at Kirishi, Ust-Luga and Primorsk from the overnight attack.
• Sweden's internal border checks starting on 12 November.
• Lithuania's grain rules at Klaipėda from 16 November (MATERIAL on 10 November).

Conclusion

A composite of 0.14 and zeros for force posture, logistics and cyber paint a picture of calm. The night tells a different story: sirens in Lithuania's second city, a drone from Belarus that could not be shot down, and a new wave of strikes on Russian refining a few hundred kilometres from NATO's borders. The war in north-western Russia is already part of the Baltic security environment, and the model cannot yet see it.

An index measures what it manages to read. A border lives in real time.

Baltic Security Monitor (osint-baltic.com) — an analytical publication on security across NATO's northeastern flank.
All OSINT coefficients are calculated by an automated indexing system based on open sources.