Initiative
Target Map
Lithuania’s infrastructure is in the sights of Russian information attacks. For the first time, a study has measured which of twelve sites – from airports to undersea cables – Russia cares about most, who writes about them and through which channels.
Lithuania’s infrastructure is a target of Russian information attacks.
Most disinformation research measures long-term effects – how propaganda shifts public attitudes on elections, the war or NATO over months and years. Much less is known about how it works over a few days or even hours, when the power grid fails, an airport closes or another incident happens. This study is the first in Lithuania to measure exactly that: which narratives follow incidents at infrastructure sites, and what would happen during a hybrid attack if several such incidents came at once. The researchers looked at what interests Russia and the actors spreading its propaganda in Lithuania most, and assessed how Lithuanian institutions, media, social media users and the public respond.
Russia watches Lithuania’s infrastructure and turns every disruption or dispute around it into an argument against the state. Repsense analysed Lithuania’s information space over twelve months: 358,156 posts in Lithuanian, Russian and English about twelve infrastructure sites and four crises that affected them. The results show which sites Russia cares about most, how its media and the distribution networks active in Lithuania exploit every disruption, and how far their messages travel.
Russian sources are most interested in energy and in what connects Lithuania to the outside world: Kaliningrad transit, undersea cables, airports. The biggest crisis of the year – the Kapčiamiestis military training area – showed that a Lithuanian distribution network had been set up in advance and switched on the same day the public dispute began. And every delay by the state, from seven weeks of silence about the Centre of Registers data leak to public information fading during the storm, became material for Kremlin campaigns.
Why infrastructure? A power grid, an airport or a state register works only as long as people trust it and follow institutions during a crisis. The NATO Strategic Communications Centre of Excellence names trust in institutions as the main target of Russian information operations in the Baltic states [1]. Researchers have tested this with models: it is enough for some people to believe a false report about an upcoming power cut or fuel shortage and rush at the same moment to buy, stockpile or change plans – and a network where nothing has broken can no longer cope with the load [2][3].
Twelve sites
Vilnius, Kaunas and Palanga airports · railways (LTG) · Port of Klaipėda · border checkpoints · Kaliningrad transit
distribution grid (ESO) · Klaipėda LNG terminal · grid synchronisation with Europe · undersea cables
military training areas · Centre of Registers
banks and payment systems
Sites were chosen because incidents affected them in 2025–2026 or because they are part of the geopolitical dispute between Lithuania and Russia.
How to read the numbers
The study uses two measures throughout. Share of hostile content shows what share of all posts about an area or crisis belittles or mocks the state, stirs up tension or questions the legitimacy of institutions. Criticism of officials in the press is not counted as hostile: it is normal accountability. Share of Russian sources shows what share of that content was published by outlets and accounts outside Lithuania; the rest is domestic – Lithuanian portals, groups and accounts.
Example: of all posts about state capability, 7.7% are hostile, and one in four of those hostile posts was published by Russian sources. Every figure below uses one of these two measures.
Energy draws the most attention, followed by undersea cables and transport
Russian sources watch Lithuania’s infrastructure closely, but not all of it. Most of their attention goes to energy and to the sites that connect Lithuania with Russia and the West – Kaliningrad transit and undersea cables.
By area, the share of Russian sources is highest in energy (8.7% of all posts) and state capability (8.6%), and half that in transport and data (4.4% each). In transport, Russian attention is focused on one site – Kaliningrad transit. Language shows it: two thirds of all posts collected about transit are in Russian, even though Lithuanian sources dominate the dataset as a whole.
Most posts collected about Kaliningrad transit and undersea cables are in Russian
Share of Russian-language posts among all posts collected about each site (in Lithuanian, Russian and English)
Russian-language posts are a minority in the dataset as a whole, so 67% and 55% show unusually high attention to these two sites from the Russian-language space. Less is written about the Klaipėda LNG terminal or grid synchronisation, and in a less negative tone – these are finished projects with clear benefits.
The main target: trust in the state
Six in ten posts about infrastructure are not about grids or airports but about whether the state can protect and manage them. This is also where hostile content is concentrated.
Share of all posts by area. Almost every incident eventually raises the question of how the state responded, which is why this area is the largest. The three busiest months match the three crises: January – Kapčiamiestis, May – Centre of Registers, August – the storm.
Hostile content: how much there is and where it comes from
| Area | Share of hostile content | Of which – Russian sources | Of which – domestic sources |
|---|---|---|---|
| State capability and legitimacy | 7.7% | 24% | 76% |
| Mobility and connections | 3.7% | 4% | 96% |
| Energy and supply | 2.2% | 54% | 46% |
| Data and identity | 0.8% | 0% | 100% |
Ordinary weeks without crisis peaks. Hostile content is highest where the conversation is about the state, and it is mostly domestic. Energy stands out: there is somewhat less hostile content, but more than half of it comes from Russia.
Twelve sites: each has a channel where it is written about most negatively
Airports get the most negative coverage in Telegram alert channels, the Centre of Registers and the border on Facebook, cables and transit in Russian-language outlets. The list is ranked by the share of strongly negative posts. On the right are four channels; the one where a site is written about most negatively is marked in red.
Share of strongly negative posts by channel. Red – the channel where the site is written about most negatively. Amber – considerably more negative than the study average. Hatched – too few posts to assess. Hover to see percentages; click a channel name to sort the list by it.
Telegram: airports and the power grid
Lithuanian war-news channels on Telegram report every airport closure or power outage as an alarm. These channels are not necessarily hostile, but their posts reach readers before official information does, so the first impression of an incident forms there. 63% of their posts about airports are strongly negative, and 54% about the ESO grid. In Lithuanian news the figures are 37% and 16%.
Facebook: registers, the border, training areas, the port
Facebook writes 1.6 to 6 times more negatively than news portals about institutions that depend on public trust. This is where texts spread about abuse of power, “bought media” and decisions allegedly made behind people’s backs. It is the space of the Lithuanian distribution network described in the next chapter.
Russian-language outlets: transit and cables
Two thirds of headlines about Kaliningrad transit and more than half about undersea cables are in Russian. Sputnik Lithuania and similar outlets pick from statements by the State Security Department (VSD) and prosecutors whatever suits Moscow best: incidents are presented as Lithuanian provocations, and Lithuanian measures as blackmail.
Least negative: the LNG terminal, synchronisation, payments
Finished projects with clear benefits get the least negative coverage – even in Russian-language outlets. Negative content gathers around sites that are still disputed, that break down, or where a decision is only being made.
So it is clear what draws attention and where. But how does it work? The data show two different playbooks – one for the Russian-speaking audience, another for the Lithuanian one.
Different audiences – different playbooks
For Russian-reading audiences, Kremlin outlets repeat the same six narratives all year and step up each time Lithuania takes measures against Russia or Belarus. The Lithuanian audience is reached by a different tool – a recurring network of fifteen Facebook groups that posts identical texts on unrelated topics. Kremlin outlets pick up this network’s wording and take it back to the Russian-speaking audience. In both cases the target is the same – a state decision or mistake that can be turned into distrust.
Who. 34 pro-Kremlin and Belarusian state outlets: Sputnik Lithuania, Baltnews, RIA, Izvestia, MK, vz.ru, RT, EADaily and others.
When. When Lithuania closes the border, restricts transit or disconnects from BRELL. Also when a local dispute or disruption can be presented as the state failing to take care of people.
Reach. Small in the Lithuanian space: during crises Russian sources account for 0.4–3.2% of posts. The narratives mostly stay in the Russian-speaking space.
Who. 15 Facebook groups and accounts that posted identical hostile texts on at least three of the five topics studied. Two of them did so on all five.
How. An opinion article or post is republished in dozens of groups on the same day. In the Kapčiamiestis case, 28 texts were spread this way, about 1,030 posts in total; one of them was reposted almost 90 times in two days.
Reach. Seven in ten texts stayed inside the network, and none reached the national media. The network only changes the occasion.
A · Six Kremlin media narratives about Lithuania’s infrastructure
Over the year, Kremlin media repeated six narratives about Lithuania’s infrastructure. They are drawn from these outlets’ content about Lithuanian infrastructure.
“Hysteria over weather balloons”
Евросоюз заистерил из-за «гибридной атаки» воздушных шаров в Прибалтике
EU in hysterics over balloon “hybrid attack” in the Baltics
The balloons are called weather balloons, as in Minsk, and the Lithuanian terms “raid” and “hybrid attack” are put in quotation marks. The headlines do not ask who launches them.
MK · 2025-12-02
“Lithuania is blackmailing Kaliningrad”
Анклав как заложник: зачем Литва шантажирует Калининград
The enclave as hostage: why Lithuania is blackmailing Kaliningrad
44 headlines about transit were published in October and November, 30 of them with the words “blockade”, “blackmail” or “war”. The only narrative that reached Lithuania’s national media (as a Moscow claim).
Baltnews · 2025-10-31
“A weak state and a foot soldier”
Как Лукашенко заставил сдаться Литву
How Lukashenko made Lithuania give in
Lithuania is portrayed as a small country that overestimated its strength: it cannot shoot down balloons, has no money for air defence, obeys Brussels, and its allies would not fight for it.
vz.ru · 2025-11-20
“A NATO training area on Russia’s border”
Лесной фронт НАТО: зачем Литва строит полигон в Сувалкском коридоре
NATO’s forest front: why Lithuania is building a training area in the Suwałki corridor
The word “Kapčiamiestis” barely appears – only “Suwałki corridor”, “forest front”, “trap”. In April, RT and vz.ru reported that the training area is being built on the Russian border, although it does not border Russia.
Izvestia · 2026-01-16
“The government does not hear its own people”
Плевать на жителей: власти Литвы одобрили полигон в Капчяместисе
To hell with the residents: Lithuanian authorities approve the Kapčiamiestis training area
The narrative that drew the most attention and connected both spaces. The wording was born in Lithuanian – in regional media on 29 December and on Facebook from 10 January – and Kremlin outlets picked it up on 27 January. In January, 21 of their 56 headlines about the training area were about residents’ opposition.
Sputnik Lithuania · 2026-01-27
“The price of energy independence”
Двойной холод Литвы: прибалты замерзают ради НАТО
Lithuania’s double cold: Balts freeze for NATO
Disconnecting from BRELL is portrayed as a costly mistake: record prices, people freezing “for NATO”. The narrative recurred every month from September to April, peaking in February around the anniversary of the disconnection. In August the storm was attached to it – supposedly it “threw Lithuania back to the Middle Ages”.
MK · 2026-02-05
| Kremlin outlet headlines | Oct | Nov | Dec | Jan | Feb | Mar | Apr |
|---|---|---|---|---|---|---|---|
| Kaliningrad transit | 24 | 20 | 1 | 0 | 2 | 0 | 0 |
| Balloons | 21 | 7 | 22 | 5 | 4 | 3 | 1 |
| Training area · Suwałki | 6 | 1 | 12 | 56 | 41 | 34 | 41 |
| Energy · BRELL | 10 | 4 | 10 | 4 | 28 | 6 | 2 |
Number of headlines by month. Each Lithuanian decision has its own wave: transit and balloons in October, the training area in January, energy in February. The leak drew 18 headlines in May, the storm 59 in August.
B · The Lithuanian distribution network: the same 15 groups, five unrelated topics
The identical hostile texts were not posted by random accounts. The same groups did it during the training area dispute, the balloon waves, the Centre of Registers leak, the April debate about the VSD and the July debate about the Central Electoral Commission (VRK). Two of them are still named after the 2021 “Great Family Defence March”.
Groups and pages are named as they appear on Facebook. Private individuals are not named.
| Date | Identical text | Source | Posts | Accounts |
|---|---|---|---|---|
| 01-10 | “The army leadership’s meeting with residents ended in complete fiasco…” | opinion article | 55 | 29 · 16 groups |
| 01-10 | “State racketeering: we are meat on our own land…” | Facebook post | 46 | 23 · 15 groups |
| 01-27 | Text attacking the President, repeating Lavrov’s “provocation” claim | Facebook post | 87 | 34 · 17 groups |
| 01-28 | “Can a decision be made in a democracy without public debate?” | Facebook post | 61 | 20 · 9 groups |
| 03-23 | “The price of the Kapčiamiestis training area – a billion?” | Facebook post | 87 | 43 · 20 groups |
| 04-20 | Article about former KGB informants and the VSD | pozicija.org | 23 | 19 · 13 groups |
| 05-23 | “When the balloons were called a ‘hybrid attack’, the public was offered a convenient explanation…” | Facebook page | 20 | 14 · 7 groups |
| 05-25 | “The Centre of Registers failed to protect our data” | Facebook post | 29 | 20 · 16 groups |
| 05-28 | “Why were the 2024 warnings about cyber vulnerabilities ignored…” | Facebook post | 17 | 11 · 8 groups |
| 07-03 | The Central Electoral Commission’s powers presented as censorship | Facebook post | 25 | 18 · 11 groups |
The ten largest identical texts of 2026. Each was posted in dozens of groups within one day. One post contains antisemitic wording and is not quoted.
How this network operates is easiest to see in Kapčiamiestis – in December and January it could be followed day by day.
Kapčiamiestis: the distribution network was ready before the training area was even decided
On 15 December 2025, Lithuania’s State Defence Council decided to build a brigade-sized military training area near Kapčiamiestis in the Lazdijai district. The area covers 90 homesteads, and some residents would have to be relocated. The decision triggered local opposition and the biggest crisis of the year in the information space: in seven weeks almost 18,000 posts were published about the training area, nine in ten of them on social media. The groups that later spread the opposition had been created in advance: one in December 2024 as a group about the Rūdninkai training area, the other, a local classifieds group, in July 2024. According to LRT’s investigative team, both are run by fake profiles. Accounts linked to Russia posted criticism from 17 December, while public debate in Lithuania began only a week later.
As you scroll, the days described light up on the chart.
The decision – and the first post against it
The State Defence Council decides to build a brigade-sized training area in the Lazdijai district. The same day, a local classifieds group run by fake profiles carries the first post against the training area: residents will supposedly lose their homes and the forest will be cut down. From the next day, such posts appear there daily.
Russia moves first
Russia-linked Telegram and TikTok accounts start posting criticism of the training area: it is supposedly useless in modern warfare, will serve NATO interests at the expense of Lithuanian citizens and will become a threat to Kaliningrad. There is no debate in Lithuanian media yet.
Lithuanian groups switch on
On 21 December a local resident creates the group “Kapčiamiesčio poligonas” (Kapčiamiestis training area). Within a month it grows to 7,400 members, although about 800 people live in Kapčiamiestis. On 23 December a group earlier devoted to Rūdninkai is renamed, and profiles showing signs of inauthenticity become its administrators. The same day, after residents meet the Ministry of National Defence, LRT reports on the discontent. Posts jump to 102 a day.
Sixteen days without an official answer
National media publish one post over the holidays. Residents fill the space themselves: a third of posts are their objections, a fifth are worries about the forest. The threat-to-Kaliningrad theme raised by Russian channels on 17 December is now repeated almost word for word in Lithuanian Facebook comments. Share of hostile content – 8.5%.
The state responds. Bots switch on
On 8 January the army publicly names disinformation, on 9 January a tense meeting with residents takes place, and on 12 January the President says he suspects Russian involvement. The same week, the National Crisis Management Centre (NKVC) records a rise in inauthentic account activity across all groups about the training area: at least one network is made up of about 1,000 accounts from Indonesia, the Philippines, Thailand and Zambia. A group with fewer than 200 real members grows to 1,700 in a week, and to 3,600 a week later. Share of hostile content – 13%.
A forged document and a wave of copies
On 20 January a forged document is circulated and police open an investigation. On 24 January posts reach 665 a day. The Lithuanian distribution network goes into full gear: 28 identical texts appear in dozens of groups, about 1,030 posts in total. A text attacking the President and repeating Lavrov’s “provocation” claim is posted almost 90 times in two days. On 27 January Sputnik Lithuania picks up the Lithuanian wording “the government does not hear the people”. Share of hostile content – 17%.
Decline and blocking
On 2 February posts fall below a fifth of the peak, and the same day LRT publishes its investigation into bots. On 11 February Meta blocks a group run by inauthentic accounts and requires another 2,000 suspicious accounts to verify their identity. According to the NKVC, no evidence of direction by foreign states was found – domestic radical actors were at work, exploiting residents’ uncertainty and the lack of answers.
What Kapčiamiestis shows
The campaign took place in the Lithuanian space, but followed a script Russia published first. The themes Russia-linked accounts raised on 17 December appeared in Lithuanian groups a week later, and at the end of January Kremlin outlets picked up the Lithuanian wording and took it back to the Russian-speaking audience. The distribution network – groups with fake administrators and the same fifteen groups that post identical texts on other topics – was prepared in advance and waiting for an occasion.
The first to appear, and the ones that travelled furthest, were residents’ genuine objections, which went unanswered for two weeks. That silence is what got filled.
Sources: Repsense analysis (ELTA, 2026-01-11), LRT investigative team (2026-02-02), NKVC and Government statements (2026-02-11), Lithuanian Armed Forces statement of 2026-01-08, BNS interview with the President (2026-01-12).
In Kapčiamiestis the network plugged into a local dispute. The other three cases show what it and Kremlin outlets use when there is no dispute – the state’s delays.
How state mistakes become material for Kremlin media
The other three cases had no coordinated campaign, but each showed the same pattern. Kremlin outlets and Lithuanian distribution networks exploited not the incident itself but the time the state needed to report it or answer people.
Four cases
On social media, the storm drew the most hostile content. What separates a campaign from anger is not the amount of criticism but identical texts in dozens of groups.
Kapčiamiestis
- 17,885 posts, 87% on social media
- State response: after 16 days
- Russian sources: 0.4% of posts, 7% of hostile content
- Identical texts: 28, about 1,030 posts
Centre of Registers
- 1,968 posts, 69% on social media
- State response: same day, but 7 weeks before disclosure
- Russian sources: 0.4% of posts
- Identical texts: 2
Balloons
- 5,555 posts, 41% on social media
- State response: next day
- Russian sources: 2.8% of posts
- Identical texts: 1
August storm
- 2,319 posts, 31% on social media
- State response: same day
- Russian sources: 3.2% of posts
- Identical texts: 0
Share of posts with hostile framing across all channels. What sets Kapčiamiestis apart is not the share of hostility but identical texts in a recurring network of groups.
Seven weeks when officials knew the facts but the public did not
Posts per day about the leak. Amber zone – the period from the first warning to institutions until public disclosure.
What happened
Using the login of an authorised data recipient, more than 600,000 register records were copied – names, personal ID numbers, property addresses. Some of the access came from abroad. Institutions received the first warning in early April, and the State Data Protection Inspectorate an official notification on 7 May. Nothing was said in public.
How the state responded
On 22 May the news portal 15min asked the Centre of Registers about the leak. The same day the register confirmed the incident, the Prosecutor General’s Office opened an investigation and the Prime Minister called on the register’s head to resign. The peak came four days later, the decline after eight.
Who exploited it
The hostile content was domestic and partisan: the register supposedly failed to protect the data and the Government covered up the leak. The text “The Centre of Registers failed to protect our data” was posted by 20 accounts from the same distribution network within one day. Kremlin media and Russian Telegram channels presented the scandal as government incompetence – claiming the Lithuanian authorities themselves “let leak” the data of intelligence officers and military personnel. This did not reach the Lithuanian discussion.
What worked and what did not
After disclosure, the space was filled not by hostile texts but by practical information: almost a quarter of posts explained how to check your data and protect yourself from scammers – three times more than hostile content. Institutions responded the same day and spoke with one voice. What failed was something else: the public found out only when a journalist asked, and for seven weeks anyone who knew about the leak could choose when and how to reveal it. Two fifths of posts after disclosure asked exactly that – who knew and why they kept quiet.
Public information faded before the outages ended
What happened
The storm left more than 268,000 customers without electricity. Power was restored to everyone within three weeks.
How the state responded
From day one, ESO published outage numbers and restoration timelines, and a few days later compensation. On social media, practical advice outnumbered hostile content four to one. But as the outages dragged on, local information faded: in the third week local elderships (municipal sub-districts) were mentioned four times less often than in the first, although some residents still had no power. By then the discussion had moved to responsibility – mentions of Ignitis rose two and a half times.
Who exploited it
Kremlin outlets presented the storm as proof that the state cannot cope: Sputnik Lithuania wrote that the storm “threw Lithuania back to the Middle Ages” while the President was enjoying himself. The share of Russian sources in storm posts – 3.2% – was the highest of the four cases. No one picked up this narrative in Lithuanian.
When the state responds the next day, hostile content is lowest
What happened
Smuggling balloons launched from Belarus first shut Vilnius Airport on 4 October and kept coming until summer. The peak was 27 October, with 280 posts a day. Until June, balloons were written about more than 100 times a month.
How the state responded
The day after the first closure, the President, the Prime Minister and the NKVC attributed the launches to the Minsk regime. This position held through every wave: the border was closed from 27 October to 20 November, and a state of emergency was declared in December. 87% of posts were informational.
Who exploited it
In autumn, hostile content came from Kremlin outlets – mockery about “weather balloons” and Kaliningrad blackmail. In the first wave, 73% of it came from sources in the Russian region. From January, hostile content moved to Lithuanian Facebook, where it was claimed that the threat had been made up to divert attention. The overall share of hostile content – 2.8% – was the lowest of the four cases.
The four cases left 16 hostile narratives. Whether they undermined trust depends not on their number but on how far they travelled.
Twelve of sixteen narratives stayed where they started
The study identified 16 hostile narratives: six from Kremlin media and ten texts from the Lithuanian distribution network described in chapter 2. We assessed each by how far it travelled from where it started – whether it stayed in one network, moved to another platform or language, or was reported by national media. For this we use the Nimmo Breakout Scale [4], applied by platforms and researchers.
The scale measures how far a narrative travelled, not how false it is. The number at each level is how many of the 16 narratives reached it as their highest level. The threshold is level 3: while a text stays in its own network, a public rebuttal would only show it to a new audience.
Twelve stayed where they started
Seven in ten texts from the Lithuanian network stayed in their own groups, and none got into national media. The Kremlin narratives about “weather balloons”, a “weak state”, a “NATO training area” and the “price of energy” stayed in the Russian-speaking space.
Four moved to another audience
Three Lithuanian texts – about the cost of the training area, a decision “without debate” and the Centre of Registers – reached accounts outside the original network. “The government does not hear its own people” moved from Lithuanian into Kremlin media.
One reached national media
“Lithuania is blackmailing Kaliningrad”: on 5 November 15min, tv3 and Lrytas reported Moscow’s accusation, clearly presenting it as a Russian claim. In January the claim also reached Lithuanian Facebook.
None was repeated as fact
National media did not pick up any of the sixteen narratives as fact, and none shaped a political decision. What travelled furthest were not hostile texts but the objections of Kapčiamiestis residents, which LRT and ELTA reported from 6 January.
Four crises, sixteen narratives, one network. What does the state learn from this?
Three conclusions and eight proposals
Four different crises gave three answers: what to monitor, whether to speak and how to speak. The proposals under them cover the whole cycle – from the period between crises to the first hours after an incident.
A slow-spreading narrative is not a harmless narrative
Most hostile narratives do not reach a wide audience, so they look insignificant. But they do not go away. They are repeated for months until an occasion arises – a new incident they can be attached to. The same goes for the groups that spread them: between crises they do not go quiet, they just talk about something else. So monitoring is needed not only when a narrative is spreading but also when it seems to be having no effect.
Monitor continuously, not only during a crisis
Monitoring hostile narratives is continuous, because narratives take shape between crises, not during them. It is worth tracking not only the narratives that are spreading now but also those that keep being repeated even though no one reacts to them. And only by knowing how much hostile content there is on ordinary days can one tell whether it grew because of a crisis or because someone amplified it on purpose.
Monitor the network, not the topics
Hostile texts are spread not by random accounts but by the same groups, which only change the occasion. These are what need to be monitored – whatever topic is current today. A campaign gives itself away not by how many people criticise but by many accounts posting the same text at the same time.
Monitor the Russian-speaking space after every decision concerning Russia or Belarus
Kremlin media react to Lithuanian decisions in waves – after border closures, transit restrictions, changes to energy interconnections. Such decisions are known in advance, so the reaction to them can be prepared in advance too: know which narratives will appear and have an answer ready before the decision is announced.
Scale the response to spread, not to content
Not every hostile text deserves a public response. While it stays in its own groups or language space, a public rebuttal only shows it to a new audience. Respond when a narrative moves to another language, platform or community, and when national media report it – respond with facts.
Communicating is better than not communicating
Where there is silence, others fill the space. The state’s silence after a decision or incident is not neutral: that time is taken by those who have their own version and their own aims, and later the institution is left answering other people’s claims. The study shows this in all four cases – hostile content was lowest where the state spoke first.
Announce a decision together with answers for people
When a decision changes people’s daily lives – homes, land, work – the first communication must answer practical questions: what will change, for whom, from when and what they will get in return.
Report incidents yourself
An institution that learns of a leak, breach or disruption decides itself when and how the public will find out – if it does not report within days, others will. The announcement covers not only the fact but also what people should do: then the space fills with practical information rather than speculation.
Keep communicating for as long as the disruption lasts
Institutions’ attention usually fades before the problem itself does – when the peak passes but some people are still waiting for help. Local information on where to get help and when service will be restored continues until the last affected person, not until media attention ends.
An effective response is fast and unified
It matters not only whether the state speaks but how. When institutions speak with one position and at the same time from day one, hostile content has no room. When answers come from different institutions, at different times and in different words, every gap between them becomes room for someone else’s interpretation.
Have a pre-agreed response protocol for infrastructure incidents
Who speaks first, within how many hours, which position all other institutions and operators adopt, who responds on the ground and through which channels. All of this is agreed in advance, because during a crisis there is no time left to coordinate.
Lithuania’s infrastructure is a target of Russian information attacks. The distribution network is prepared in advance. The response to it: monitor continuously, speak first and speak with one voice.
There is not much hostile content about Lithuania’s infrastructure, but it is precisely aimed: at trust in the state and at decisions that can be presented as mistakes. Kremlin outlets turn every Lithuanian decision concerning Russia or Belarus into a headline within days, and the Lithuanian distribution network does the same with local disputes. Both follow the same logic: they wait for a state decision or a pause and fill it with their own version.
This is the first study of its kind in Lithuania. Next year we will repeat it and compare what has changed.
Methodology
The study covers 1 September 2025 – 31 August 2026: 358,156 articles, posts and comments in Lithuanian, Russian and English. The data were collected and analysed with the Repsense Narrative Intelligence platform, using the Havel narrative-chain tracking model. Twelve infrastructure sites, five areas and four cases were studied.
Russian sources are outlets and accounts outside Lithuania; Kremlin media are 34 pro-Kremlin and Belarusian state outlets. Hostility describes the framing of content and the channel, not the authors’ links to foreign states.
References
[1] Sazonov, V. et al. (2024). Russia's Information Influence Operations in the Nordic–Baltic Region. NATO Strategic Communications Centre of Excellence.
[2] Jamalzadeh, S., Barker, K., González, A. D., Radhakrishnan, S. (2022). Protecting infrastructure performance from disinformation attacks. Scientific Reports, 12, 12707.
[3] Jamalzadeh, S. et al. (2024). Weaponized disinformation spread and its impact on multi-commodity critical infrastructure networks. Reliability Engineering & System Safety, 243, 109819.
[4] Nimmo, B. (2020). The Breakout Scale: Measuring the impact of influence operations. Brookings Institution.
Kapčiamiestis timeline: ELTA, “Analysis: Russian manipulation detected in public discourse on the Kapčiamiestis training area” (2026-01-11); LRT investigative team, “How bots mobilised opposition to Lithuania's military plans” (2026-02-02); Government and NKVC statement on Meta’s decision (2026-02-11); BNS interview with the President (2026-01-12).