A 25-person company put an 18-hour clock on Kremlin propaganda
A Vilnius startup measured Moscow's crisis-communication clock for NATO and turned counter-disinformation into a tempo problem the Alliance cannot yet meet. Europe is buying that sensing layer at seed-round prices.
Repsense turned counter-disinformation into a tempo problem NATO cannot yet solve, while Europe buys the sensing layer at seed-round prices.
On 6 August 2024, Ukraine crossed into Russia's Kursk Oblast. Russian state media took seven hours to acknowledge the incursion, and a coordinated Kremlin position took more than 18. The NATO Strategic Communications Centre of Excellence measured those delays in Crisis, Control, Crusade: Russia's Propaganda Architecture, released in Riga on 10 August 2026.
The finding about the Kremlin confirms what analysts broadly assumed. The tooling changes the argument. Repsense, a 25-person Vilnius company that says it has raised EUR 4 million, put a stopwatch on Moscow's crisis machine. Counter-disinformation now has a measurable window, and Europe is buying the sensor at seed-stage prices.
3.13 million media units
The report covers 1 January 2024 through 31 March 2025. Its 3.13 million-unit dataset includes 24,749 articles from seven state domains, led by the defence ministry's mil.ru with 10,526 and kremlin.ru with 2,181. It adds 1,224 recordings from four flagship television programmes and 1.86 million posts from 414 Telegram channels, among them 66 milblogger or war-analysis channels, 32 linked to senior officials and 98 from border regions. A comparative set contributes 1.25 million items from independent Russian and foreign sources across 22 countries.
The report calls the pattern Crisis, Control, Crusade. Disorganisation and narrative testing dominate the first 18 hours; cross-platform consolidation follows between 18 and 72 hours; civilisational framing takes over after 72. Its operating sequence is delay, test, consolidate, amplify. At Crocus City Hall on 22 March 2024, mentions of "Crocus" began rising at 18:00 GMT and pairings with "Ukraine" at 19:00. Within one hour, 16% of Russian coverage named Ukraine, before evidence and before an official Kremlin line, though Islamic State Khorasan claimed the attack. In the January 2025 Nausėda–Kaliningrad episode, Telegram activity peaked two to four hours before State Duma statements.
Jina embeddings and DistilBERT
The pipeline uses publicly described machine learning, not classified intelligence. Per the methodology section, Repsense converts media into text through speech-to-text and optical character recognition, vectorises it with the monolingual Jina Embeddings v2 model, and uses an LLM for translation. Its Adler model then compares every text against more than 30 predefined narrative clusters by cosine similarity.
A self-trained DistilBERT model scores sentiment sentence by sentence and by entity, from negative 100% to positive 100%. Storyline clustering groups semantically similar texts, then hands each cluster to a generative LLM for a title. These are accessible components. The scarce input was not the model but 15 months of uninterrupted collection.
The newest layer reads what text monitoring misses. The report says Repsense processed 13,592 images and short videos during the first Kursk window and identified 4,057 Kursk-related units from 1,232 creators, most of them on YouTube. It cites a TikTok video with more than 9 million likes and 100 million views whose description field was empty, and therefore invisible to any text pipeline.
Kursk, then March 2025
Kursk makes the timing operational, because the information system had to react while the battlefield stayed unresolved. The report describes the 6 August attack as unanticipated and the first significant Ukrainian incursion into Russia since 2022. Russia declared full recapture on 26 April 2025, nearly nine months later, though Ukraine said fighting continued, according to the Associated Press.
The sentiment model scored 6 August at negative 40.1%, the second-most negative day in the sample; only the day after the Crocus attack ranked lower, at negative 40.9%. Regional Telegram channels in the Kursk border districts ran as a civil-defence grid of warnings and all-clears while national channels moved more slowly and supplied the moral labels.
Russian media then escalated into the nuclear register, with claims that Ukraine targeted the Kursk nuclear power plant and language casting Ukrainians as "nuclear terrorists." Vladimir Putin signed a revised nuclear doctrine on 19 November 2024 treating a conventional attack backed by a nuclear power as a joint attack on Russia, per CBC News. The report assesses that the first information wave sought to delegitimise Ukraine's operation and divide Western support, while the doctrine revision aimed to deter another cross-border attack.
By March 2025 the same regional channels had settled into standardised sequences of warning, all-clear and air-defence report. The report calls this the transition of war from crisis to bureaucratic routine, and treats it as a sustainability risk rather than a strength: prolonged normalisation invites fatigue and erodes mobilisation capacity.
Tuva and Buryatia expose a different seam. In those high-casualty ethnic minority republics, the report finds losses acknowledged locally through obituaries, funerals and benefit announcements, but never aggregated nationally. It names the method "containment without aggregation" and recommends reconstructing the dispersed casualty totals, which is a targeting recommendation written as a research finding.
The battlefield and the startup story — free in your inbox every week. No paywall.
Subscribe Free →EUR 4 million in Vilnius
The research carrying NATO's badge was performed by a company. Repsense says UAB Repsense was founded in 2022, employs 25 people, works from Vilnius and Prague, and completed its seed stage in December 2025 with EUR 4 million raised. Vestbee puts total funding at EUR 3.2 million; the discrepancy is unresolved. The EUR 2 million seed was led by Tensor Ventures, a Czech deep-tech and defence investor, with Seed Starter ČS, the venture arm of Česká spořitelna within Erste Group, joined by BSV Ventures and CoInvest Capital, the Lithuanian early-stage fund established by national development bank ILTE with public money.
Two of the report's named authors are Repsense co-founders. Mykolas Katkus is chief executive. Alfredas Chmieliauskas is chief AI officer and, per the company, a former Palantir engineer who designed the Adler model and the deep-video pipeline. Repsense states that its Havel platform is deployed at the StratCom COE and the European Parliament, at government institutions in Lithuania, Moldova, Germany, Romania and Armenia, and for broadcast-compliance monitoring at Lithuanian public broadcaster LRT.
NATO is assembling a wider layer around the same requirement. On 10 February 2026 the NATO Communications and Information Agency selected a Brandwatch and Blackbird.AI consortium to deliver an Information Environment Assessment Capability; Kyiv-based Osavul says it supplies hard-to-reach public data. Blackbird.AI announced $28 million in January 2026, taking total funding to $58 million, per SecurityWeek. PeakMetrics closed a $6 million Series A in May for $16.3 million total, the Los Angeles Times reported. London's Refute raised GBP 5 million in February 2026 with the National Security Strategic Investment Fund participating, per Tech.eu. On 3 August, Nasdaq-listed Cyabra announced a multi-year, six-figure agreement with an Asia-Pacific intelligence agency.
Set that against the target. Russia's draft 2026 federal budget allocates 146.3 billion roubles, about $1.77 billion, to state television, news agencies and online projects, roughly 28% above pre-war 2021, The Moscow Times reported. The disclosed capital behind the entire Western measurement layer is a fraction of one year of the machine it watches. Europe funds the sensor as a venture category; Moscow funds the target as state infrastructure.
One caveat belongs beside those numbers. The vendor is also an author and the publicist: Delfi ran the Lithuanian coverage on 11 August under a press-release byline, quoting Katkus, and two Repsense founders appear on the NATO report. That does not invalidate the work. It does make the report a product demonstration as well as a research document, and no independent team has reproduced the seven-hour and 18-hour measurements.
NATO's 32-government cycle
An 18-hour window converts strategic communications into a tempo problem, and the logic is the same as sensor-to-shooter: detection is worth little if release authority moves slower than the target's cycle.
Katkus put it plainly in the Repsense statement. While the Kremlin takes an average of 18 hours to align an official position, he said, the information space has no owner; speed of response therefore matters more than completeness, because after a day the audience has already decided. Nerijus Maliukevičius of Vilnius University's Institute of International Relations and Political Science, a co-author, named the transition from chaos to control as the weakest point, and the period before it as the one in which fact-based intervention still works.
NATO has no common 18-hour political release cycle. Our reporting on the 20 May 2026 Vilnius airspace alert found that it lasted about an hour and never resolved into an attributable fact. A 29 July paper from the NATO Command and Control Centre of Excellence and the Foundation for Defense of Democracies argued that Russia's Baltic target is Alliance decision-making rather than hardware. The constraint this report exposes is not sensing. It is that 32 governments must agree on what to say.
The publication schedule sharpens the point. A study whose central claim is that the first 18 hours decide the contest appeared more than 16 months after its data window closed on 31 March 2025. Retrospective measurement cannot exploit a real-time vulnerability. The pipeline has to run live, which the report recommends and the NCIA capability is meant to buy.
MAX after Telegram
- Platform migration. MAX, built by VK with Russia's digital development ministry, launched in March 2025 and has been mandatory for pre-installation on smartphones sold in Russia since 1 September 2025. In July 2026 the government ordered state and municipal employees to move work communications to it by 2030. From 1 August, MTS, Beeline, MegaFon and T2 stopped charging for its data, per Meduza. A model built on 414 Telegram channels now watches a platform the state is deliberately draining. Repsense says its follow-up will add VKontakte and Odnoklassniki.
- NCIA metrics. The NATO capability matters if it yields warning times and consolidation clocks. Another sentiment dashboard would describe the environment without matching its tempo.
- Alliance doctrine. A response-time standard written into strategic-communications doctrine would be the first evidence that the 18-hour finding changed operations rather than vocabulary.
- Independent replication. The decisive check is whether a team that does not sell Havel can reproduce the seven-hour and 18-hour results as Russia's information system migrates off Telegram.
Frequently Asked Questions
What is the 18-hour window?
The period after an unexpected crisis in which Russia's official messaging has not yet consolidated. The NATO StratCom COE report measured a seven-hour delay before Russian state media addressed the Kursk incursion of 6 August 2024, and more than 18 hours before a coordinated Kremlin position emerged.
Who actually did the research?
Repsense, a Vilnius narrative-analytics company, with academic collaborators. Two of the report's named authors, chief executive Mykolas Katkus and chief AI officer Alfredas Chmieliauskas, are company co-founders, per Repsense's own materials.
How large was the dataset?
About 3.13 million media units between 1 January 2024 and 31 March 2025: 24,749 Russian state website articles, 1,224 television recordings and 1.86 million Telegram posts from 414 channels, plus 1.25 million comparative items from 22 countries, according to the report.
What technology does the pipeline use?
Speech-to-text and OCR, the Jina Embeddings v2 text-embedding model, a self-trained DistilBERT sentiment model, cosine-similarity narrative matching in the company's Adler model, and LLM-based storyline labelling and short-video analysis, per the report's methodology section.
Why does the MAX messenger matter to this finding?
Telegram carries the report's testing-and-consolidation evidence, and Moscow is displacing it. MAX has been a mandatory pre-install since 1 September 2025, officials were ordered in July 2026 to move work communications to it by 2030, and four carriers stopped charging for its data from 1 August, per Meduza and The Moscow Times.
Has anyone verified the timing numbers independently?
Not so far. The measurements come from one company's pipeline, published by NATO's StratCom COE, and no outside team has reproduced them.
AI-generated summary, reviewed by an editor. More on our AI guidelines.
Marcus Schuler
Marcus Schuler edits BattlePolicy, a daily defense-technology brief connecting the companies and capabilities behind modern war to the contest among Europe, the US, Russia, and China.