Latvia

Situation Summary

Latvia remains a moderate-risk operating environment (#150 globally) with heightened vigilance around Russian intelligence collection and airspace incursions tied to its NATO membership and Ukraine proximity. The past week saw disclosure of an active GRU-linked espionage network targeting defense and NATO infrastructure, alongside election-day drone activity and temporary German fighter-jet reinforcement. Sub-national risk concentrations in the east—particularly Rēzekne, Daugavpils, and border novads—reflect ongoing border tensions and infrastructure-targeting activity reported since late September.

Key Developments

• October 1 (Latvia, nationwide): Latvia's State Security Service disclosed arrest of two Latvian citizens suspected of collecting defense systems, NATO activities, radar data, and military-aircraft movement intelligence for Russia's GRU. The detention operation occurred June 28; the public disclosure fell within this reporting window.

• October 1 (Ādaži military base, Ādaži): Investigators alleged one suspect used private aircraft to conduct aerial reconnaissance and photograph the NATO-hosting base, potentially supporting Russian intelligence or sabotage networks.

• October 3 (Lielvārde Air Base, Lielvārde): Germany deployed four Eurofighter aircraft and supporting personnel to Latvia at Riga's request to protect Baltic airspace during parliamentary elections, citing concern over drone-related provocations.

• October 3 (Latvian airspace): Foreign drones entered Latvian airspace on election day; reporting indicated jets engaged one drone, though independent official confirmation of specifics remains limited in available sources.

• October 3 (nationwide): Latvia held parliamentary elections under heightened security conditions. Available assessment indicated Latvia's security service found no significant systematic foreign electoral interference, though the environment remained tense due to airspace incursions and geopolitical risk.

• September 25 (A12 motorway, Rēzekne area): Road signs bearing Russian city references were vandalized with paint; State Police investigated.

• Late September (eastern border, location unspecified): Deliberate damage to cables, distribution cabinets, and surveillance poles was reported along the eastern border, apparently targeting critical infrastructure.

Highest-Risk Areas

Eastern and southeastern regions—Rēzekne (risk 68), Daugavpils (65), Rēzeknes novads (58), and adjacent border municipalities—carry substantially elevated composite risk scores. The concentration reflects proximity to Russian and Belarus borders, documented infrastructure targeting, road-sign vandalism, and historical Russian population density. Intelligence collection activity (including the disclosed GRU network) and drone/airspace incursions in the east underscore that frontier regions remain primary vectors for foreign espionage, sabotage preparation, and provocation testing.

How GeoBit Would Assist

Intel Sweep and multi-language OSINT capabilities enable continuous monitoring of Latvian-language and Russian-language threat forums, media, and signals for early warning of new intelligence collection or infrastructure-targeting campaigns. AOI Monitoring & Early Warning with persistent watch on Rēzekne, Daugavpils, and the eastern border novads—coupled with Election Monitoring during future electoral cycles—would flag foreign interference attempts, drone activity, or coordinated sabotage signaling. Network & Actor Analysis applied to the GRU espionage cell disclosed this week would map co-conspirator networks and identify secondary recruitment or dead-drop sites.

7-Day Outlook

No major incidents are forecast for the immediate seven-day horizon. Airspace incursions and intelligence collection are likely to persist as ambient operational activities throughout the fall, particularly around NATO exercises and energy infrastructure. Corporate and diplomatic assets should anticipate continued baseline vigilance on border-zone movements, cable/infrastructure vandalism, and potential drone or cyber-reconnaissance activity targeting defense and critical-infrastructure sites.

Highest-Risk Areas — Ranked

Previous Weekly Briefs

A new Latvia brief is written every Monday, covering the week — each with its own risk map and downloadable CSV. Use the calendar to go further back.

• September 29, 2026⬇ CSV · $5
• September 22, 2026⬇ CSV · $5
• September 15, 2026⬇ CSV · $5
• September 8, 2026⬇ CSV · $5
• September 1, 2026⬇ CSV · $5
• August 30, 2026⬇ CSV · $5
• August 28, 2026⬇ CSV · $5