Breakdown: What has changed in the threat dynamics in Lithuania, Latvia, and Estonia

Overall Assessment for the Day (Composite Index)

Composite: 0.12 | Delta 6h: 0.00 | Delta 24h: 0.00

A score of 0.12 indicates a stable yet active situation. The time deltas (6 and 24 hours) remain zero, meaning there have been no sudden changes over the past day. This is a good sign — the monitoring system is functioning predictably.

However, this middle-range score is composed of very different components. Logistics and communications are resilient, while pressure on the air border is notable. Let's break this down in detail.

Assessment Components

1. Military Posture (Force posture): 0.14

Since April 1, a French aviation flight has been stationed at Lithuania's Šiauliai air base: 4 Rafale fighter jets and approximately 100 personnel (pilots, technicians, logistics staff). This flight is part of one of the French air squadrons (Armée de l'air et de l'espace). Parallel operations include Romanian F-16s and Portuguese F-16s operating from Ämari in Estonia.

Index 0.14 means readiness for rapid response, with no critical gaps. The Quick Reaction Alert system (standing alert) functions as standard.

How this works in practice:

• French Rafales were scrambled about 10 times in May to intercept Russian military aircraft flying without flight plans. This is routine activity for this mission — such frequency is registered every month.
• These fighters are designed to intercept large targets (Russian fighter jets and bombers at altitudes above 5 km).
• When Estonia needed to shoot down a drone on May 19, an F-16 did the job, because specialized counter-drone systems in the region are still insufficient. But this isn't an equipment problem — it's simply the reality that drones are a newer category of threat than conventional aircraft.

2. Logistics (Logistics): 0.00

Fuel, ammunition, and spare parts stockpiles at air bases are in satisfactory condition. Airfield infrastructure is operating without interruptions.

0.00 means that logistics problems are not currently a risk factor. This is the calmest part of the assessment. Although buffers in the system are moderate, no emergency situations exist.

3. Information and Cyber (Info/Cyber): 0.06

Ten major events were detected during the reporting period. Of these — zero high-confidence events. This means the OSINT agent detected signals, but they pass through verification and geolocation filters before being classified as fully reliable.

What's being discussed in the information environment:

• Drones at the borders of Lithuania and Latvia (source often not precisely determined)
• Speculation about the origin of some drones from Ukrainian operations (discussed, but not officially confirmed)
• Russian public statements about "retribution" (standard rhetoric, low practical significance)

0.06 indicates fragmented but controlled information flows. No deep cyber breaches of critical infrastructure have been registered.

4. Borders/Air/Maritime (Border/Air/Maritime): 0.24

This is the most active component. 0.24 means notable activity, but not critical tension.

What happened in recent days:

• May 17: Latvia activated mobile air danger alerts after detecting a drone near the border
• May 19: Estonia shot down a drone — the first such incident in 22 years of the air policing mission. This wasn't a panicked response to an immediate threat, but rather an adjustment to searching for new types of targets
• May 20: Lithuania and Latvia simultaneously activated air danger alerts
• May 20-23: Latvia issued warnings daily in its eastern regions

What this means: Drones are arriving at a frequency of about 1-2 aircraft per day. For people living on the border, this has become a routine part of the day. This is not panic — it's adaptation. Response systems are working as designed.

Top 5 Events Analyzed by the Digest

What Leaders of Lithuania, Latvia, and Estonia Are Requesting

On May 21, the presidents of the three countries issued a joint statement to NATO with the following proposals:

• Transform the air policing mission into a full air defense system
• Strengthen Operation Eastern Sentry with additional counter-drone capabilities
• Coordinate everything under unified command

Status: Requests received; official NATO response is pending.

What the Countries Are Doing Themselves

Estonia

• Expected: 3 IRIS-T missile batteries in 2026
• Currently has: 2 NASAMS batteries (deployed in 2020, being reinforced)
• Demonstrated action: On May 19, for the first time used a fighter to intercept a drone — demonstrating readiness for autonomous defense

Latvia

• Expected: 3 IRIS-T missile batteries in 2026
• Active role: Initiated a coalition with 20 countries to supply drones to allies (over 100,000 UAVs in supply programs)
• Air alerts: Issues daily warnings in eastern regions for about a month now

Lithuania

• Expected: New NASAMS systems throughout 2026
• Expansion: A small German ammunition factory (Rheinmetall) is being built on its territory (launch mid-2026)
• Official position: Readiness to respond, but relatively fewer public declarations

What This Means in Simple Terms

NATO is waiting on the eastern border. This is being done professionally: people know what to do, materials are in place, systems are functioning. But the challenge is changing. Previously, the main threat came from Russian fighters flying out of Kaliningrad. Still a substantial threat, but predictable.

Today a new category has been added: drones. They're cheap, mass-produced, harder to track in terms of origin. NATO architecture is still "tuned" for the first threat, while adaptation to the second is proceeding more slowly than leaders of Lithuania, Latvia, and Estonia would like.

The steps being taken (new air defense systems, training, Operation Eastern Sentry) are correct. They take time because weapons procurement and personnel deployment don't happen overnight. But the system is moving.

Key figure: Latvia issues warnings daily. This is not a cry for help, but a demonstration that the problem is constant and requires a constant solution, not a one-time response.

OSINT Digest: May 23, 2026, 13:00:56 UTC
Events Analyzed: 10
High-Confidence Events: 0
Errors in 24h: 0
Source: Baltic Security Monitor, configured to track the situation at NATO's borders in the northeastern region