Engagement Context
A StratCom unit within a NATO ally defence ministry engaged Retelnist with a specific requirement: establish a statistically defensible, reproducible baseline for cognitive warfare pressure in the national information environment, to support ongoing monitoring and enable comparative analysis across future reporting periods.
The unit had previously relied on qualitative assessments — analyst reports describing the information environment in narrative terms. They needed quantitative, time-series data that could support resource allocation decisions and brief at the ministerial level with confidence intervals attached.
Scope and Platform Configuration
Agreed scope for the 90-day baseline period:
- Topics: National defence policy, NATO membership narrative, domestic political stability, key alliance relationships
- Platforms: Telegram (primary), X, Facebook, national news RSS (12 outlets, ranging from mainstream to strongly partisan), YouTube (policy-adjacent channels)
- Language coverage: National language (primary), Russian (secondary — the primary vector language for identified adversarial content)
- Excluded: Closed platforms (WhatsApp, Signal) and dark web infrastructure — noted as a coverage gap in the methodology documentation
Methodology Documentation
A key deliverable was comprehensive methodology documentation enabling the client to understand, audit, and if necessary reproduce the measurement approach. This is a non-negotiable requirement for intelligence products used in policy decisions: the methodology must be inspectable.
Documented elements:
- Platform coverage configuration (channels monitored, keyword lists, update frequency)
- V(x,t) component definitions and weighting rationale
- Baseline normalisation approach (rolling 30-day mean)
- Anomaly detection threshold (2σ from baseline)
- Bootstrap resampling parameters (1,000 iterations, 95% CI)
- DISARM tagging protocol and inter-rater reliability testing (two analysts independently tag; discrepancies resolved by consensus; Cohen's kappa reported per reporting period)
- CWPI composite scoring formula with component weightings
The methodology documentation was reviewed by the client's internal methodologist before the monitoring period began. Two modifications were requested: adjustment of the identity coupling weighting to reflect the specific socio-cultural context, and addition of a fourth platform (a national social platform not in our standard stack). Both were accommodated.
Findings: The 90-Day Baseline
Over 90 days of monitoring, the baseline established:
- CWPI baseline mean: 38/100 (95% CI: 34–42)
- Standard deviation: 11 points — indicating moderate natural variation in the information environment
- Anomaly events identified: 4 — periods exceeding 2σ from baseline (CWPI above 60), all of which correlated with identifiable geopolitical events (ministerial statements, international incidents, domestic political calendar events)
- Persistent narrative clusters: 7 — ongoing narratives with consistent presence throughout the monitoring period, all tagged with DISARM technique sets and V(x,t) scores
- Transient narratives: 23 — narratives that appeared, peaked, and declined within single reporting weeks; characterised as opportunistic amplification rather than sustained operations
The Four Anomaly Events
Each anomaly event was documented with:
- CWPI at peak, with confidence interval
- Triggering narrative cluster(s)
- DISARM technique tags
- Attribution confidence (two events: Medium; two events: Possible)
- Observed effect on public sentiment indicators (where available)
- Duration and decline pattern
The most significant anomaly event reached CWPI 74 (95% CI: 68–80) — substantially above the 60-point anomaly threshold. It correlated with a multinational military exercise and lasted 11 days before returning to baseline range. The primary narrative techniques deployed during this event: emotional language amplification (T0061), false consensus construction, and coordinated cross-platform laundering from Telegram to national news comment sections.
Establishing the Monitoring Cadence
Based on baseline analysis, the following monitoring cadence was recommended for ongoing coverage:
- Weekly: CWPI score update with directional trend (rising, stable, falling)
- Monthly: Full narrative inventory update with V(x,t) scores and DISARM tagging review
- On-demand: Immediate anomaly alerts when CWPI exceeds 60 (2σ threshold) or when any single narrative exceeds V(x,t) of 0.70
- Quarterly: Comparative CWPI report against baseline, identifying any structural shifts in the information environment
The StratCom unit accepted this cadence and has maintained the monitoring engagement. The 90-day baseline is now used as the reference point for quarterly comparison reports.
Transferability and the Reproducibility Requirement
One deliberate design choice in this engagement: all methodology documentation was written to enable the client to reproduce the analysis independently if they chose to in-source the capability. We regard this as an ethical requirement for intelligence products — a client who cannot understand what they are buying cannot meaningfully evaluate it.
In practice, most clients maintain the Retelnist engagement rather than in-sourcing, because the operational overhead of maintaining platform coverage and analyst capacity is significant. But the methodology documentation remains as an independent audit resource.