The internet told us Russia would violate NATO territory last week. It can help us figure out what Russia will do next.

Richard Laurent

What will Vladimir Putin do next? This is a question the world, its expectations confounded by two years of Russian adventurism in Crimea, the Ukraine, and beyond, is finding it increasingly difficult to answer. The clues are out there, though — it’s just getting harder to unearth them. On November 8, we used the Predata signal for Russian NATO intrusions — an index of the volatility of chatter around this topic on Wikipedia, YouTube, across the comment section of news websites, and elsewhere — to predict a 75% chance of a Russian intrusion across a NATO border within 30 days. That intrusion arrived, of course, last Tuesday, when Turkey downed a Russian fighter that had, it claims, drifted into its airspace.

Data mapping traffic and user patterns across a handful of strategic web pages, along with analysis of the conversations taking place there, can help guide us through the maze of Russia’s geopolitical designs. This is a game where sophisticated intelligence tools are more needed than ever — not just because of the commoditization of useful intelligence data and the ubiquity of consensus thinking among the political risk community, but because of the sheer unpredictability of Putin’s Russia as a political actor. When Lithuania announced in March that it planned to reintroduce conscription, it was testament to the unease many of Russia’s neighbors felt at the renewed belligerence of the erstwhile superpower. Russia’s intentions have only become more opaque, and its next steps more difficult to forecast, in the months since; the military intervention in Syria has complicated the already-knotty thread of Russia’s expansionist designs on its southern and western flanks (the old Cold War zone of contestation). Russia’s geopolitical energies now radiate in multiple overlapping, at times contradictory, directions, in which conventional post-Cold War opposition to the expansion of NATO, the new post-Ukraine assertiveness in the Russian near periphery, Putin’s desire for a grander role on the international stage and the emergence of Russia, via the Syrian campaign, as a military actor in the multiple conflicts of the Middle East all collide.

Sorting through this morass was already difficult, but events over the last few weeks — notably, Turkey’s downing of the Russian SU-24 fighter last Tuesday and the Sinai air crash of late October — have complicated things further. On November 8 Predata put the likelihood of a Russian NATO incursion within 30 days at 75%, but it’s important to note what our model did not predict: We did not say exactly where the Russian intrusion was likely to take place (though we did say it would take place across a NATO border — an important distinction, given the length of Russia’s frontiers), what form it would take (a stray jet, as in this case, or a full-scale military operation), or where it would sit along the spectrum of intentionality — a spectrum that Putin appears increasingly eager to scramble. We were rightly modest about our prediction: “Based on the current set of 42 intrusion events,” we wrote in an email to our clients, “Predata predictions of Russian air and sea intrusions have a 50% hit rate within a 30 day window at a 20% alarm threshold.” Translated: we back-tested our prediction against a set of 42 previous incidents where Russia had breached NATO territory, by land or by sea, and we found that on half of those 42 occasions, the Predata model successfully raised the alarm of an intrusion within the next 30 days (as long as the likelihood of an attack exceeded 20%).

Broadly speaking, the Predata signal for Russian NATO intrusions measures both chatter and contestation — how much activity there is, and how argumentative it is — on a handful of relevant websites. On November 22, there was a significant spike in the signal, driven almost entirely by rising activity on the Russian-language Wikipedia page on NATO. On November 24, Turkish forces downed the Russian fighter. A visualization of the Predata signal gives a clear sense for the relationship between the signal spike and the downing of the Russian jet. Note that this was not the first time a spike in the signal preceded a significant incursion event: On October 3, for example, Turkey announced a Russian fighter had violated its airspace, a few days after the signal — driven, again, by the Russian-language NATO page — had reached a fresh local maximum. Both spikes can be seen here:

Spikes in the signal of this magnitude are rare, as this full-year visualization shows:

What was happening on these pages to drive these spikes in activity? Pageview increases account for some of the uptick, but the spikes mostly reflect a shift in the intensity of discussion. Were these discussions useful for the purposes of understanding the likely direction of Russia’s fractious relationship with NATO? This, of course, is the critical question. Not all online activity is created equal, especially in places with diverse user groups such as Wikipedia, Twitter and YouTube: Wikipedia is often a hive of vandalism, pedantry and pointless edit wars, and most YouTube comments are resistant to all forms of mature human reasoning. But dig into the substance of the pages driving upticks in the overall Russian NATO intrusion signal, and you will discover some interesting things.

On November 22, just two days before Turkey downed the Russian fighter, a furious edit war, involving a flurry of back-and-forth revisions and reversions, took place on the Russian-language NATO page over one user’s addition of “ОСАД” to the end of the word “NATO.” In Russian, ОСАД means “siege”; in Ukrainian, it can mean “sludge” or “feces.”

In late September, in the days before Turkey announced a violation of its airspace by a Russian jet, there was an editorial skirmish on the Russian-language NATO page over the coloring of Crimea on a map in a way that made it appear part of Russian territory. Vandalism of this nature seems trivial at first, but it can provide useful — if small — analytical clues to the direction of the broader geopolitical contest.

Earlier spikes in the Russian NATO intrusion signal have been driven by other pages: for example, the page for the Akkuyu Nuclear Power Plant, which is being built in the south of Turkey by a subsidiary of the Russian nuclear energy company Rosatom, drove a significant spike in the signal in mid-April, weeks before a Russian surveillance plane was intercepted over the Gulf of Finland. Activity on the Russian-language Wikipedia page on the Organization for Security and Cooperation in Europe has also been a main driver of spikes in the overall Russia-NATO signal. And casting the net beyond Wikipedia, activity spikes on these two YouTube pages have in the past provided an especially robust early warning of Russian intrusion events:

The Kremlin on Saturday announced a range of sanctions against Turkey over the downing of the SU-24 fighter. These may eventually extend to the many energy projects — including the Akkuyu Power Plant — that tie the two countries, though that is not yet clear: Late last week the Russian Economy Minister, Alexei Ulyukayev, flagged eventual restrictions to the TurkStream gas pipeline across the Black Sea. The world is still trying to figure out what further action Russia might take in retaliation for the events of last week, and what fresh direction recent setbacks might give to Putin’s foreign policy.

Extracting predictive value out of trails of online chatter is no easy task, but in Russia’s case, history suggests it’s worth the effort. Russian authorities, operating via agencies with comically villainous-sounding names like the Internet Research Agency, have become especially adept in recent years at manipulating social media and the unstructured internet more broadly to shape a narrative in line with Russia’s strategic interests. The Kremlin maintains good operational security in its official communications, and is especially concerned about the Russian language picture of the world available to Russian viewers on YouTube, Twitter, Wikipedia, and Facebook. There are also sizable resources deployed to control Russian-language TV stations, including the Sputnik news agency launched in late 2014.

Given the size of the Russian government’s ambitions in information control, it seems fair to assume there’s an “information ops” campaign that mirrors the country’s geopolitical moves. Figuring out the patterns behind this campaign requires massive automatic digital sampling and sophisticated mathematical algorithms. Of course, not every person commenting on and contributing to pages relevant to Russian geopolitical designs — including the ones mentioned in this piece — will be a government plant there to drop clues about Russia’s next move. But sophisticated, data-driven monitoring of the activity and discussion on these pages can be a useful tool to provide extra insight into the future of the Putin project — a project which risks becoming even more erratic and complex in the months ahead. | twitter: @predataofficial |