What the Be Safe index measures around the Baltic states

Five inputs, three kinds of evidence

The Be Safe index answers one question: is there more pressure on security and infrastructure in the Baltic states than usual? On the English edition it covers Estonia, Latvia and Lithuania. The other editions run the same index for their own country, described further down. Like the other indexes it is a 0 to 100 reading where 50 is an ordinary day compared with the recent past; How to read a 0–100 reading explains the scale.

It combines five inputs, each counted over the last 7 days and ranked against up to 365 earlier days:

• Hybrid incident reports: news coverage of GPS jamming, airspace violations, drones, sabotage and undersea cables. Media, 30% of the weight.
• Cyber attack reports: news coverage of cyber attacks naming the three countries. Media, 10%.
• Actively exploited software flaws: new entries in a US government catalogue. Institutional, 25%.
• Internet outages: outages measured and listed by Cloudflare Radar. Sensor, 20%.
• Natural hazards nearby: satellite-tracked events in and around the region from NASA. Sensor, 15%.

The three kinds of evidence are treated differently. Sensor and institutional data count fully in the reliability figure; media reports count at 60%, because an article is a claim, not a measurement. With all five inputs live, reliability is 84 out of 100. The two inputs that need no key and no news service, software flaws and natural hazards, carry 40% of the weight together, which is the minimum the site needs to report a reading, so the index still has a value when the news service is busy. The full method is on How it works.

Hybrid incident reports

What it measures: how many English-language news articles per day have a headline that matches this search, in the article lists published by the GDELT Project:

• ‘GPS jamming’ OR ‘GPS interference’ OR ‘airspace violation’ OR ‘undersea cable’ OR sabotage OR drone
• and also one of: Latvia OR Estonia OR Lithuania OR Baltic

‘Hybrid’ is the usual term for pressure that stays below open conflict: interference with navigation signals, unannounced flights near borders, damage to infrastructure whose cause is unclear. They matter to ordinary people because they can disrupt flights and shipping, take power or gas links out of service for months, as the examples below show, and bring more military patrols at sea.

How the site uses it: the daily count of matching English-language headlines, summed over 7 days. GDELT publishes a list of articles every 15 minutes; every two hours the site reads the new lists and counts the matches, and each day’s figure is scaled to the 96 lists in a day. This is the largest single input, at 30%, because it is the only input that follows physical security events in the region.

Other known weaknesses: The history builds forward from the lists the site has read, up to a year, so for now each day is ranked against a shorter period than a full year. The current day is left out until it is complete (UTC), so the latest total ends with yesterday. Coverage follows the international news agenda: a quiet period in the region can still score high if foreign outlets are writing about it. What the React index measures describes the GDELT data in more detail.

Why cables, pipelines and navigation signals are in the search

The search terms reflect events that official bodies in the region have described. They are listed here only to explain why the terms exist. Where an investigation’s conclusions are not set out below, it is because we could not check them against the investigating authority’s own publication.

• Balticconnector, October 2023. The gas grid operators Gasgrid Finland and Elering noticed an unusual pressure drop in the gas pipeline between Finland and Estonia in the early hours of 8 October 2023, closed valves to isolate the damaged section, and stopped gas transmission between the two countries^[7]. After repairs the pipeline returned to commercial use on 22 April 2024^[7]. In November 2023 NATO’s Secretary General said the damage to Balticconnector and nearby cables showed that such infrastructure is vulnerable, and that NATO had increased air and naval patrols in the Baltic and North Seas^[5]. The cause and any responsibility are matters for the Finnish investigating authorities; we could not load their own releases when this guide was checked, so their findings are not summarised here.
• Estlink 2, December 2024. Elering, Estonia’s electricity transmission operator, states that the Estlink 2 power cable between Estonia and Finland was switched off on 25 December 2024 because of damage caused by a ship’s anchor^[8]. About one kilometre of cable was replaced, and the link returned to the electricity market on 20 June 2025^[8]. Questions of responsibility are for the Finnish investigation and courts, whose outcome this guide does not cover.
• Baltic Sentry, January 2025. On 14 January 2025 NATO announced Baltic Sentry, to strengthen its presence in the Baltic Sea and the protection of critical undersea infrastructure there, using frigates, maritime patrol aircraft and a small fleet of naval drones. At the launch the Secretary General said recent sabotage had damaged energy and communication cables^[6].
• Satellite navigation interference. The European Union Aviation Safety Agency keeps a Safety Information Bulletin on outages and alteration of satellite navigation signals and their effect on aircraft communication, navigation and surveillance; its latest revision was issued in July 2026^[9]. GPS jamming and GPS interference are in the search because interference with satellite navigation is a recognised safety issue for aircraft^[9].

This guide does not attribute any of these events to anyone. The index does not either: it counts how much they are written about.

Cyber attack reports

What it measures: the daily count of English-language articles matching ‘cyberattack’ OR ‘cyber attack’ OR DDoS OR hackers, together with Latvia, Estonia or Lithuania. Unlike the hybrid search, the word ‘Baltic’ is not included, so an article has to name one of the three countries.

Why it matters: attacks on government services, banks, media and utilities can make websites and payment services unavailable for hours, and are often reported as part of wider pressure on the region.

How the site uses it: the same GDELT method as hybrid reports, with 10% of the weight. The weight is low because reported attacks vary widely in seriousness, and the measured software-flaw input below gives a firmer signal about cyber risk.

Known weaknesses: the same as for hybrid reports. A claim by a group that it attacked a site is counted as soon as it is written about, whether or not anything was disrupted.

Exploited software flaws, counted worldwide

What it measures: how many software flaws were added in the last 7 days to the Known Exploited Vulnerabilities (KEV) catalogue kept by CISA, the US Cybersecurity and Infrastructure Security Agency. A flaw is only added when it has a CVE identifier, there is reliable evidence that it has been actively exploited, and there is a clear fix or other action to take^[1]. Proof-of-concept code or scanning alone does not count as exploitation^[1].

Why it matters: the same software runs in Riga, Tallinn, Vilnius and everywhere else. A flaw that attackers are using in one country can be used against hospitals, ports, energy companies and city services in another, so a busy week in the catalogue is a sign that many organisations need to patch quickly. A binding US directive requires US federal civilian agencies to fix listed flaws within set deadlines; CISA recommends that every other organisation use the catalogue to prioritise its own patching^[1].

How the site uses it: it downloads the whole catalogue and counts entries by the date CISA added each one. It carries 25% and counts as institutional data. The same count is used in every edition.

Known weaknesses: the date is when CISA listed the flaw, not when it was discovered or first exploited, which can be weeks or years earlier. The catalogue is worldwide and does not say where a flaw was used, so it says nothing specific about the Baltic states. It reflects one US agency’s evidence and priorities. The catalogue is usually updated on working days, and several entries can be added on the same day.

Measured internet outages

What it measures: internet outages in Latvia, Estonia and Lithuania listed by Cloudflare Radar, which observes internet traffic through Cloudflare’s network. Its outage listings are notable drops in traffic, generally corroborated with outside information such as an operator’s status page or a news report^[2]. Causes include power cuts, damaged fibre cables, severe weather, natural disasters and government-ordered shutdowns^[2].

Why it matters: an outage stops card payments, remote work, public services and emergency information that now depend on a connection. It is also one of the few signals of infrastructure damage that is measured directly, rather than reported.

How the site uses it: it asks Radar for outage listings for each country over the last 52 weeks and counts each one on the day it started. It carries 20% and counts as sensor data.

Known weaknesses: it needs a Cloudflare API token, and without one it shows as ‘not connected’; reliability then falls to 64. Radar data is published under the CC BY-NC 4.0 licence^[3], which does not allow commercial use, so the site switches this input off whenever a sponsor is shown. Small or short outages, and those that do not show in Cloudflare’s traffic, are not listed. Most weeks have no listed outage at all. When nine weeks in ten are empty, a quiet week scores about 45 and a week with a single outage scores above 90, so this input moves in large steps.

Natural hazards nearby

What it measures: natural events of any category logged by NASA’s Earth Observatory Natural Event Tracker (EONET) inside a box around the region in the last 7 days. For the English edition the box runs from 10° to 35° east and from 50° to 62° north. That reaches from Oslo and Berlin in the west to St Petersburg and Kyiv in the east, so it includes the Nordic countries, Poland, Belarus and parts of Russia and Ukraine as well as the Baltic states.

Why it matters: wildfires, storms and floods damage power lines and roads, and smoke from large fires can affect air quality across borders.

How the site uses it: all EONET categories, including wildfires, counted on the date each event was first recorded. It carries 15% and counts as sensor data.

Known weaknesses: NASA says EONET is for visualisation and general reference and is not an official source for precise location or timing^[4]. The box is large, so a fire in Belarus or Ukraine counts toward the Baltic reading. It is not a weather warning service; national meteorological services issue those.

What each edition covers

The index page shows the English edition. Each edition’s home page runs the same five inputs for its own area, with its own news place names, outage country and NASA box. The software-flaw count is the same everywhere.

• English: the Baltic states. News: Latvia, Estonia, Lithuania or Baltic (cyber: the three countries only). Outages: LV, EE, LT. Box: 10–35° E, 50–62° N.
• Latvian: Latvia. News: Latvia, Riga, Latgale or Daugavpils. Outages: LV. Box: 20–29° E, 55.5–58.5° N.
• German: Germany. News: Germany, Berlin or Bundeswehr. Outages: DE. Box: 5.5–15.2° E, 47.2–55.2° N.
• Polish: Poland. News: Poland, Warsaw or Polish. Outages: PL. Box: 14–24.5° E, 49–55° N.
• Finnish: Finland. News: Finland, Helsinki or Finnish. Outages: FI. Box: 19–31.6° E, 59.6–70.2° N.

In every edition the news counts behind the index use English-language articles only. The national-language headlines shown in some editions’ event lists are not part of the score.

What it does not measure

• Official threat levels or warnings. Governments and civil protection services issue those; this index does not replace them.
• Military activity itself. Troop movements, exercises and patrols are only seen if they are reported in English with the right words.
• Whether a reported incident happened, or who was behind it.
• Crime, road safety, health or weather warnings.
• Power cuts that do not affect internet traffic.
• Size. A cut cable and a brief website outage can both count as one.

If a reading is high, What to do when a reading is high covers the official channels to check. Sources and licences are listed on the sources page.