ESTONIA'S CYBER ATTACKS: LESSONS LEARNED

S E C R E T SECTION 01 OF 04 TALLINN 000374

SIPDIS

SIPDIS

DEPT FOR EUR/NB

E.O. 12958: DECL: 06/06/2017
TAGS: PREL PGOV ECON ETRD NATO RS EN
SUBJECT: ESTONIA'S CYBER ATTACKS: LESSONS LEARNED

REF: A) TALLINN 366 B) LEE-GOLDSTEIN EMAIL 05/11/07
B) TALLINN 347

Classified By: Charge d'Affaires Jeff Goldstein for reasons 1.4 (b) & (
d)


1. (S) Summary. On April 27, Estonia became the
unprecedented victim of the world's first cyber attacks
against a nation state. Although an analysis of events is
ongoing, this event demonstrated the vulnerability of both
government and private sector internet infrastructure.
Working together with Estonian cyber security experts, the
Ministry of Defense (MOD) is preparing a report analyzing
the crisis, evaluating the strengths and weaknesses of the
Estonian response, and recommend changes to Estonia's cyber
defenses and security. The GOE and Estonian cyber defense
experts all agree that while they successfully responded to
these attacks, they will need to improve Estonia's defenses
to prevent what they described as the nightmare scenario: a
shutdown of Estonia's internet infrastructure as a result
of more serious attacks at some point in the future. End
Summary.


The Nature of the Attacks
--------------


2. (SBU) Starting on April 27, Estonia became the world's
first victim of cyber attacks against a nation state's
political and economic infrastructure. For over a month,
government, banking, media, and other Estonian websites,
servers, and routers came under a barrage of ever-shifting
and coordinated cyber attacks that tried to shut down
specific strategic targets (Ref A). Unlike traditional
cyber attacks which try to "hack" into a system, the
attacks against Estonian sites used the basic architecture
of the internet to disrupt their operation. At Post's
request, Lt. Colonel Broderick, a EUCOM cyber defense
expert visited Tallinn to assess the situation April 16-18.
Broderick opined that it is not technically feasible to
prevent attacks of this nature, no matter how sophisticated
a country's cyber-defenses are. However, due to Estonia's
rapid response, the attacks did not seriously threaten
Estonia's cyber network and infrastructure.


3. (C) The cyber attacks exposed the strengths and
weaknesses of Estonia's cyber defense system. Hillar
Aarelaid, Head of Estonia's CERT (Computer Emergency
Response Team),told us that the Ministry of Defense is
preparing a report to submit to the GOE by the end of June.
Based on our discussions with GOE, CERT, and private
Estonian cyber security experts, it is clear that the
Estonians are working furiously to analyze where their
cyber defenses and protocols worked, failed, and/or need
improvement. Although these cyber attacks were
unprecedented in nature, our Estonian interlocutors all
agreed that the outcome could have been much worse. They
also note that the MOD's report notwithstanding, the impact
on cyber defense policy for both the public and private
sectors will be discussed and felt for a very long time.
The following is a summary of GOE "lessons learned" from
these attacks.

Lessons Learned: What Worked
--------------


4. (SBU) STRENGTH IN BEING SMALL. With a population of 1.3
million people, Estonia's small size was its strongest
asset in reacting rapidly to the cyber attacks. Estonia's
CERT, the GOE's Cyber Defense Unit, and private IT Security
Managers all knew each other for years before the crisis
and were, thus, able to work closely together. Information
sharing and decision making were rapid and flexible.
Everything was handled - from the working level to the
leadership - in an almost seamless fashion throughout the
attacks. "We're talking about a group of ten key people in

TALLINN 00000374 002 OF 004


the government and private sector who've known each other
for years, trust one another, and all have direct access to
each other" Jaan Priisalu, IT Risk Manager for Hansabank,
commented to us. "Therefore, there was no inter-agency
bureaucracy or red tape to cut through."


5. (C) E-VOTING. In March 2007, Estonia held the world's
first national election where e-voting was used. From the
outset of the crisis, the e-voting security team was
immediately seconded to CERT and became a vital asset in
responding to the attacks. Although Estonia's CERT has
only two full time staff, Aarelaid said he was able to call
upon a roster of 200 programmers and security experts from
the e-voting security team to ensure a 24/7 response
mechanism against incoming cyber attacks. As the e-voting
team was already at work on next generation security
measures (in anticipation for Estonia's 2009 local
elections),there was no need for them to "catch up"
according to Aarelaid. These experts were invaluable in
addressing the wide variety of attacks (e.g., bots, spam,
DDoS, Trojan Horses, etc.).


6. (C) INFORMATION GATHERING. Our MOD interlocutors credit
Estonian law enforcement and cyber security experts'
(public and private) close monitoring of Russian-language
internet forums as key to CERT's ability to rapidly respond
to the attacks. On April 28, less than 24 hours after the
first cyber attacks, Russian-language internet forums
(e.g., http://2ch.ru and http://forum.xaker.ru) were
exhorting people to attack specific GOE websites and
offering links to software tools. Patient monitoring of
these internet-forums led to intelligence on targets,
dates, and exact times for coordinated attacks. Mihkel
Tammet, MOD Director for Communications and IT, told us
privately that without this information, the cyber attacks
against GOE sites could have inflicted far more damage than
they did.


7. (C) SECURE ONLINE BANKING. Hansabank and SEB
successfully weathered the cyber attacks against them
because of defensive measures and procedures already in
place. According to CERT, the banks' procedures are in
many ways superior to the GOE's. Priisalu said that due to
the longstanding problem of cyber crime in the region -
often with banks as prime targets - the banks were well
prepared for the attacks. For example, Priisalu told us,
organized gangs have employed bot attacks in the past. As
a result, Hansabank had the necessary cyber security
measures in place to defend against this type of attack.
In the end, Hansabank-s sites successfully repelled every
attack and were able to provide their Estonian customers
access to their online accounts. (Note. Almost 90% of all
financial transactions (e.g., bill payments) are done
online. Hansabank and SEB alone handle over three-fourths
of that traffic. End Note.)

Lessons Learned: What Failed
--------------


8. (S) FORMAL PROCEDURES. Lt. Broderick told us he
believes that Estonia-s formal and institutional procedures
for responding to cyber attacks failed completely.
Throughout the crisis, ad hoc meetings and decision making
based on established informal contacts and relationships
were used to disseminate information - instead of
formalized institutional channels with clear communication
chains. Additionally, Aarelaid told us that the GOE did
not keep an official record or log of decisions and actions
taken during the crisis. Consequently, it is uncertain how
thorough the GOE's post-crisis assessment or efforts to
improve Estonia's formal cyber defense procedures will be.
Aarelaid explained that neither CERT nor the GOE had the
personnel to "put out the fire and also act as a secretary
to take down the minutes." (Note: Aarelaid's claims of
staff shortages are somewhat questionable given that he
told us that neither he nor any of his staff had to work

TALLINN 00000374 003 OF 004


over-time during the cyber attacks. End Note.)


9. (S) LACK OF CENTRALIZED GOE POLICY. MOD interlocutors
admitted that there was no consistent GOE policy across
ministries on cyber security, broadband capacity, and
information sharing. For example, some ministries use
static websites while others use more vulnerable dynamic
websites. Ministries also use different internet providers
which have different security procedures in place. This
unnecessary complexity made initial information sharing
between ministries more cumbersome and confusing,
especially for ministries with fewer resources for IT risk
management (e.g., the Ministry of Population, Ministry of
Education, Ministry of Culture, etc.). Mihkel Tammet, MOD
Director for Communications and IT, told us that creating a
consistent policy for the various ministries will be a key
recommendation in the MOD's report.


10. (S) MONITORING. The cyber attacks also exposed
Estonia's total lack of a comprehensive monitoring system.
Estonia does not have a national IP (internet protocol)
network of sensors to precisely monitor traffic for cyber
attacks. As a result, the GOE and CERT did not have any
hard data on the number of computers and/or servers that
were used in the attacks. Aivo Jurgenson, IT Security
Manager for Elion, Estonia's main telecommunication and IT
provider, told us that his company relies on U.S.-based
Arbor Networks to monitor its network. Our MOD and private
sector interlocutors all agreed on how important it was for
Estonia to have its own monitoring network, but they could
not confirm on the likelihood that the GOE would invest in
this infrastructure upgrade.


11. (S) WHACK-A-MOLE. In the initial stages of the cyber
attacks, the Estonian method of response was to block each
and every attack through its corresponding ISP address as
it happened. EUCOM's Broderick dubbed this the "whack-a-
mole" response and opined that prior to April 27 this
approach might have been sufficient. However, the sheer
volume of the recent cyber attacks quickly overwhelmed the
Estonian defenses. CERT, Elion, and the GOE's Cyber Defense
Unit were eventually forced to apply broader and more
stringent filtering mechanisms on all internet traffic to
prevent the attacks from entering Estonia. Broderick
observed that unlike the United States and many European
Union members who routinely filter foreign internet
traffic, prior to the recent attacks, the Estonian network
filtered very little foreign traffic.


12. (S) INDUSTRY VULNERABILITY. While Hansabank and SEB
successfully weathered the cyber attacks, many other
smaller private Estonian sites that were attacked were
overwhelmed. With no industry standard or best practice in
place in Estonia, many smaller businesses and/or private
organizations (e.g., schools, NGOs, etc.) did not have the
technical expertise or financial means to ramp up their
broadband capacity. Aarelaid claimed that CERT's log of
complaints and reported cyber attacks since April 27 is
over 10 Tb (Tera bits). (Note. One TB is equal to one
million Mega bits. To put this in perspective, the entire
content of the online U.S. Library of Congress uses less
than 10 TB. End Note.) As the majority of Estonian (SME)
small and medium size enterprises employ online services as
part of their daily business, the GOE is now aware that an
industry standard with readily available cyber defensive
software, tools, training, and public awareness-raising
must become a part of Estonia's cyber defenses.

Lessons Learned: Nightmare Scenarios
--------------


13. (S) TARGETING KEY ROUTERS AND SITES. Our Estonian
interlocutors all agreed that even during the attacks'
peak, Estonia's cyber network was not in any serious danger
of being shut down. In some ways, Estonia was lucky. Rein
Ottis, MOD Cyber Defense Chief, noted that had the attacks

TALLINN 00000374 004 OF 004


specifically targeted Estonia's key servers and routers,
they could have shut down Estonia's entire cyber
infrastructure. On May 4, two routers belonging to the GOE
and Elion were attacked with an unknown data packet that
crashed the routers almost immediately. Aivo Jurgenson,
Elion IT Security Manager, told us that if enough key
routers and/or servers were shut down, it would be the
internet "equivalent of blowing up key roads and
intersections in the city Tallinn to bring all traffic to a
halt."


14. (S) UNANNOUNCED AND BETTER TIMED ATTACKS. Most of the
cyber attacks were discussed in advance on Russian-language
internet forums, giving the Estonians the opportunity to
ramp up broadband capacity in advance. Tammet told us that
the perpetrators gave away the element of surprise and
often timed their attacks in the evening (when Estonia's
internet usage is at its lowest). Had they not made these
mistakes, Tammet opined that the attacks could have shut
down their GOE targets for up to a week. Aarelaid was
thankful that they had advance information about the May 15
attacks against Hansabank and SEB. However, many of the
attacks which employed bots were unannounced and far more
challenging, and in some cases did crash their targets. If
all attacks had been like this, Tammet and Aarelaid could
not confidently predict whether Estonia's defenses would
have held.


15. (S) 2ND TIER STRATEGIC ATTACKS. Estonia's banks were
generally well prepared for cyber attacks. However, the
economic impact could have been worse if the attacks had
focused on 2nd tier strategic targets which possessed less
formidable defenses (Ref B). Jurgenson speculated the
fallout would have been far more significant if Estonia's
logistic-transport companies had been attacked. "As over
three-fourths of all grocery stores, petrol stations, and
shops rely on the internet for their orders and
deliveries," asked Jurgenson, "can you imagine the damage
this would bring? Cyber crime seems abstract to most
people. There's nothing abstract about empty shelves in
stores." Aarelaid also listed a whole range of other
strategic services and businesses that would have been far
easier to crash than the banks. The MOD felt that
Aarelaid's descriptions were far fetched, bordering on
"science fiction." However, when we mentioned Tammet's
comments to Priisalu, one of Estonia's leading cyber
security experts, he felt that recent events have changed
the parameters of the debate on possible threat scenarios.
He said, "Last year, I would've considered a cyber war
against my country as science fiction, too - but not
anymore."
GOLDSTEIN