Baltic Ghost: EUCOM Declassified Baltic Cyber Exercises

BALTIC GHOST was a series of cyber defense exercises that U.S. European Command ran with Estonia, Latvia and Lithuania from 2013 to at least 2019. It began as workshops pairing each Baltic state with a U.S. National Guard partner and grew into an annual exercise on defending critical infrastructure and supporting NATO forces in the region. Its after-action reports, several of them originally classified Secret, were released to the National Security Archive under the Freedom of Information Act and published in the Archive’s Cyber Vault in December 2021 (Briefing Book #781, compiled by Cristin J. Monahan). The Archive added seven related documents in November 2026.

Origins in the Guard partnerships, 2013

The series grew out of the National Guard State Partnership Program. A 2019 U.S. Army War College study by Jeffrey L. Caton, posted by the Archive as Document 1, describes 2013 workshops “facilitated by U.S. European Command” that built cyber partnerships between Estonia and the Maryland Army National Guard, Latvia and the Michigan Army National Guard, and Lithuania and the Pennsylvania Army National Guard. The Archive places the effort in the context of the 2007 cyberattacks on Estonia.

NATO’s Wales Summit Declaration of September 5, 2014 (Document 2) stated that cyber defense is part of the alliance’s core task of collective defense. According to Caton’s study, BALTIC GHOST became a training exercise in September 2015, held at the same time in Tallinn, Riga and Vilnius and focused on coordinating responses to attacks on critical infrastructure.

The 2016 tabletop exercise

The earliest after-action report in the release covers a tabletop exercise held September 20-22, 2016 (Document 3). It was prepared by the Joint Cyber Center in USEUCOM’s communications directorate (ECJ6) and is marked Secret. The objectives it lists belong to the Baltic states, among them to “define military dependencies on national critical information infrastructure” and to test national procedures from an initial event through a request for support. Participants entered scenarios through an online exercise platform run by the NATO Cooperative Cyber Defence Centre of Excellence in Tallinn. Most of the discussion points and all of the takeaways are redacted. The Archive reads the absence of USEUCOM objectives as a sign that the command served as facilitator.

The exercise followed NATO’s Cyber Defence Pledge, adopted at the Warsaw Summit on July 8, 2016 (Document 4).

Planning and execution, 2017

Three 2017 reports cover the planning conferences and the exercise itself (Documents 5 through 7). The initial planning report, dated January 31, 2017, lists Estonia, Latvia and Lithuania as participants alongside USEUCOM, the Defense Information Systems Agency, U.S. Cyber Command and the Maryland, Michigan and Pennsylvania Guard units, with Denmark, Sweden, Finland and the United Kingdom as observers, according to the Archive’s summary.

The final planning conference report, dated April 14, 2017 (Document 6), is unclassified and carries no visible redactions. It describes a scenario centered on the Baltic states’ energy and logistics sectors, with emphasis on sectors that affect U.S. forces. It records that “Estonia will include injects covering the Maryland National Guard A 10 unit on rotation in Estonia.” Small teams were to travel to USEUCOM headquarters in Stuttgart while the rest trained in their own countries, with academic sessions on the “road to crisis,” cyber intelligence and incident response. The three nations and USEUCOM also agreed to develop “one common message” for release through each country’s public affairs office. The report calls the 2017 event the fourth in the series. The 2017 tabletop report (Document 7), dated July 3, 2017, is marked Secret, and the Archive reports that its lessons and takeaways are redacted in full.

Enhanced Forward Presence, 2018-2019

By 2018, the exercise had turned toward NATO’s enhanced Forward Presence battlegroups, deployed to the Baltic states and Poland after 2016 (Document 10). A July 6, 2018 report on a USEUCOM seminar titled “eFP Cyber Defense” (Document 8), marked Secret, records nearly 50 attendees from nine partner nations, according to the Archive. More than half of it is redacted.

The 2019 exercise was held in Legionowo, Poland, hosted by USEUCOM and Poland’s National Cyber Security Centre (Document 11, dated July 2, 2019, marked Unclassified/For Official Use Only). Participants came from Estonia, Germany, Latvia, Lithuania, the Netherlands, Poland, the United Kingdom and the United States, with Guard units from Illinois, Maryland, Michigan and Pennsylvania. USEUCOM’s defensive cyber operations team wrote the scenario. The first listed objective was to understand the operational and strategic impact of a cyberattack. The report groups information-sharing problems under nation-to-nation trust and authorities and technical availability. It records the U.S. battlegroup’s communications officer observing that “without availability users will often disregard integrity and confidentiality.” The scenario narrative and lessons are redacted.

The two documents disagree on the count. Document 11 calls the 2019 event the fourth annual BALTIC GHOST, while Document 6 calls the 2017 event the fourth of the series. The 2019 report also gives the exercise dates as both June 25-27 and June 23-25. A companion report (Document 12) records that USEUCOM’s director of communications, Brig. Gen. Maria Biank, and the director of Poland’s National Cyber Security Centre signed a cyberspace cooperation agreement during the visit, according to the Archive.

Later records

In November 2026, the Archive added seven documents to the posting, including a Defense Information Systems Agency report on the 2019 exercise and a 2025 Michigan National Guard history of its partnership with Latvia. In the update, the Archive says the exercise appears to have been folded into NATO’s Cyber Coalition exercise since at least 2021. No BALTIC GHOST after-action report later than 2019 appears in the release.