Method

PURPOSE This tracker measures the risk of war between NATO and Russia. It does not cover the war in Ukraine except where that war bears on the alliance's position. A war between NATO and Russia would take months or years of visible preparation, but only days to activate once a decision is taken. We track that preparation: indicators scored 0-3 from open sources on both sides, each with a dated check log. THE SCALE 0 Dormant - no movement beyond pre-2022 norms. 1 Latent capacity - machinery being built, switch off: plans, studies, voluntary schemes, legal groundwork. 2 Accelerating - capacity funded with dates, or active friction and loosened rules. 3 Activation - the switch on: compulsion, enforcement, deployments, direct clashes. Higher always means more dangerous. Some indicators score a STATE rather than activity - the health of communication channels, the arms-control regime, the condition of diplomatic relations. These are scored by distance from normal on the same scale, and they are exempt from the decay rule below, because a persistent condition generates no events and silence is not improvement. WHAT COUNTS AS EVIDENCE Open-source and raw material comes first: satellite imagery, ship and flight tracking, legal texts and gazettes, procurement records, budget documents, parliamentary records. Official statements are one input among many, never the basis of a score on their own. Sort every claim into one of three categories and write it accordingly. An OBSERVABLE EVENT - a ship sank, a fighter fired, a law passed, a unit moved - is recorded as fact. An ATTRIBUTED ASSERTION - whose drone, whose saboteur, whose intent - is recorded with the attributor named. An INTERPRETATION is recorded as analysis and marked as such. Belligerent governments are not evidence. Statements by Ukrainian officials about Russian intentions, and by Russian officials about NATO's, are positions held by parties with a direct interest in shaping threat perception. They are logged as attributed claims. Where a belligerent claim is the only support for a score, the honest score is the one the independent evidence supports. The same scepticism applies to allied claims. The failure mode is asymmetric caution: flagging Russian assertions carefully while writing NATO, Baltic or EU government statements as established fact. Both are governments with reasons to shape perception. Access journalism is a source type, not a fact. Outlets whose business is proximity to officials publish what officials want published, when they want it published. Their claims are attributed assertions by anonymous officials unless a document or named source stands behind them. No single such report carries a score; corroboration is sought from a different source family, and a leak's timing is itself informative. The counterpart limitation is equally real: independent outlets have no access to diplomatic correspondence, so excluding access journalism means systematically missing state-to-state events. The answer is weighting and labelling, not exclusion. Sources from both sides are read for every indicator, including Russian state and state-adjacent outlets, Russian and Belarusian independent and exile media, regional and local media where events occur, relevant trade press, and non-Western outlets that often carry statements Western coverage omits. Every source carries a stated lean; slanted sources are used for verifiable facts, never for their conclusions. An adversary's description of an event can be accurate. Russian accounts of Western activity and Western accounts of Russian activity are both interested, but interest is not error: each side watches the other closely and often describes what it sees correctly while drawing a self-serving conclusion from it. The discipline is to separate the description from the conclusion rather than discount both. Where an official framing and an adversary's framing describe the same observable facts, we use neither side's adjectives - no 'routine', no 'unprecedented' - and state what is happening in terms both sides would recognise, then record each side's interpretation as interpretation. Assessments of INTENT deserve the heaviest discount of all, whoever issues them. Capability can be observed; a decision to do harm cannot. When a service states that an adversary 'very likely' intends something, that is an inference, usually drawn from a small number of incidents, by an institution whose budget, powers and relevance rise with the threat level it reports. The same is true of every service on every side. We record such assessments with the issuer named and their confidence language quoted, then set out the other readings the same facts permit - reconnaissance rather than attack, failure rather than intent, criminal or commercial activity, a third party who benefits from the blame - and we score the observable events, never the attributed motive. Attribution of sabotage deserves separate discipline, because it is where the gap between what is observed and what is concluded is widest. An explosion, a fire or an arrest is an observable event; who ordered it is almost never one. Nationality indicates recruitment, not sponsorship - services on several sides use third-country nationals, and suspects in recent European cases have held Turkish, German, Colombian, Cuban and Ukrainian passports. More importantly, the party that benefits from blame is not necessarily the party that acted: an operation that implicates one state serves whoever wants that state isolated. The Nord Stream explosions are the documented case - attributed overwhelmingly to Russia for years, with the only person ever brought to trial a former Ukrainian special forces officer, prosecuted in Germany on physical and telecoms evidence. We therefore log incidents, arrests and charges as what they are, name who alleges what, and treat an attribution as established only when evidence has been tested rather than asserted. VERIFICATION Claims are verified in the same run in which they are logged, before the entry is written. The procedure is to consult the source families most likely to carry the claim independently of the outlet that reported it: local media where it happened, the relevant trade press, primary documents, and the other side's own outlets. Agreement across families that do not copy each other is confirmation; a single wire recycled by aggregators is not. Where verification fails, the item is logged as unverified, the families checked are named, and it is carried forward as an explicit task. DATING AND CURRENCY Every entry carries the date of the EVENT, not the date of the research. Where an event predates an indicator's baseline and the original score was simply too low, the entry is marked as a baseline correction and distinguished from new movement. The date an indicator was last checked and the dates of events in its log are different things and are reported separately. A score describes what is happening now. A months-old event is context, not current escalation. An old event sustains a score only if it created a persisting condition - a structural change, a standing legal power, a unit that now exists, a rule of engagement still in force. Where the newest evidence for a score is more than a quarter old, the entry says so. Search results favour analytical summaries that recycle old events, which makes stale material look current. The date of the underlying event is established before anything is scored. SCORES FALL AS WELL AS RISE Escalation arrives as reportable events; de-escalation arrives as an absence of events or as quiet reversals that attract little coverage. Without deliberate counterweight a tracker only ratchets upward. Three safeguards apply. STRUCTURAL REVERSAL: a score is lowered when what justified it is undone - screening suspended, mobilisation infrastructure dismantled, crossings reopened, escorts or interdictions stopped, forces withdrawn from a built base, delegated engagement authority returned to capitals, transit arrangements restored. QUIET PERIOD, measured in elapsed time since the most recent qualifying event: at score 3, more than one month; at score 2, more than three months; at score 1, more than twelve months. Past that point the score is a candidate for lowering by one step, provided the underlying structure is also unchanged or reversing. Primary sources are checked before any lowering: a slow news period is not evidence. State indicators are exempt. DEDICATED SEARCHING: each update includes a search in de-escalation vocabulary - talks, agreement, resumed, restored, reopened, withdrawal, reduction, moratorium, exchange, easing, normalisation, deconfliction, inspection - because escalation vocabulary alone will not surface easing. GUARDING AGAINST INFLATION The overall average is taken over a changing basket and is therefore not a measure of change over time. The headline figure is the FIXED COHORT: the original indicators, scored then and now. The full basket is reported as a secondary number, and a rise caused by adding indicators is never presented as deterioration. New indicators do not default to a high score. An indicator is created after something is noticed, which biases new entries upward. A 2 requires capacity funded with dates, or active friction measured against the pre-2022 norm - not merely that there was material to write about. Each new indicator is scored as though it had been in the basket from the beginning, and indicators in quiet areas are added deliberately as controls. SCOPE: WHAT IS NATO-RELEVANT Russian military developments are assessed by whether they change what Russia could do to NATO, or only what it can do in Ukraine. Force generation, equipment losses and front-line movement in Ukraine are context, not escalation here. For manpower, the discriminator is whether it flows into the formations facing NATO rather than to the Ukrainian front. This is a scoring rule, not a reading rule. Ukraine-war diplomacy, sanctions and energy routinely move indicators that are in scope, and are therefore read and logged. ACTIONS AND PERCEPTIONS, NOT DECLARED INTENTIONS 'X is not planning Y' is a statement about intent, usually sourced to the officials of X, and is not evidence. What counts: forces positioned, exercises rehearsing the scenario, authorities pre-delegated, capabilities fielded, decision times shortened. Entries describe what exists and what has been rehearsed first, then what each side says about it. Both sides' perceptions are recorded as data. Each side's rehearsals are the other's evidence of intent, and the gap between 'we are preparing in case' and 'they are preparing to' is where escalation spirals form. The 1914 and 1939 precedents are the standing caution: capability plus plans plus short decision times reduce the weight intentions carry. The counter-caution is equally recorded: unlike 1914, current arrangements are reversible and communication channels function, so the analogy argues for watching decision times and channel health rather than assuming inevitability. FINDING WHAT THE INDICATOR LIST WOULD MISS Indicator-shaped searching finds developments inside categories already defined and is blind to everything outside them. Each update therefore begins with deliberately generic queries in several languages, asking what the largest stories in this space are rather than what has happened to existing indicators. Where a significant story maps to no existing indicator, that is treated as evidence the indicator set has a gap, and a new indicator is proposed. Three beats are checked every update regardless of what the sweep returns, because none is reliably caught by posture-focused queries: Ukraine-war diplomacy, including ceasefire proposals and negotiation rounds; sanctions in both directions, including easing, by the US, EU and UK; and energy as a weapon, including strikes on energy infrastructure and price-driven policy shifts. Every entry states why it matters for the risk of war between NATO and Russia, in its own words and without assuming the reader will infer it. Where the connection is direct - a member state's territory, forces, airspace or waters; alliance posture; Russian capability facing NATO - the entry says so and says through which mechanism. Where it is indirect, the entry says that too, plainly: an election, a sanctions decision or a sabotage case may bear on influence, cohesion or supply without changing anyone's military position, and saying so is more useful than implying significance by inclusion. Where something is context rather than escalation, it is labelled context. An indicator that cannot answer the question 'through what mechanism would this contribute to war between NATO and Russia' does not belong in the set. THE CHECK LOG Every score change carries a dated entry naming its sources. Verification checks that find nothing new are also logged, so the log shows when each indicator was last confirmed rather than merely when it last moved. Routine verification entries begin with the word CHECKED; entries describing something that happened never do, which is what allows readers to separate news from housekeeping. Entries are written as they should stand. Where a previous entry was wrong or imprecise, the text itself is corrected rather than annotated. The log records the situation, not the process of writing it. CADENCE The baseline is a full update daily. Daily is sufficient for indicators that move on timescales of weeks to years, with three exceptions that can move within hours and warrant a same-day second check: an incident involving crewed platforms rather than drones; casualties among NATO-state personnel, whether diplomats, ships' crews or troops; and communication channels going dark, which is both the fastest-moving signal and the least likely to be reported promptly, because its evidence is an absence. When one of these fires, checking moves to hourly for as long as it is live, primary and local sources take precedence over wires, and provisional entries are logged with their uncertainty stated and corrected as the picture firms.