USG SUPPORT FOR ESTONIAN CYBER CENTER

UNCLAS SECTION 01 OF 02 TALLINN 000054 SIPDIS SENSITIVE SIPDIS E.O. 12958: N/A TAGS: PGOV PTER PREL NATO EN SUBJECT: USG SUPPORT FOR ESTONIAN CYBER CENTER (CORRECTED COPY - ADDED ADDRESSEE) REF: A) 07 Tallinn 366 B) 07 Tallinn 374 TALLINN 00000054 001.2 OF 002 ¶1. (SBU) SUMMARY: The experience of unprecedented and wide- spread cyber attacks in April/May 2007 prompted Estonia to accelerate its leadership efforts in promoting international cooperation on cyber security. The Government of Estonia (GOE) is working with NATO to make its national Cooperative Cyber Defense Center (CCD) a NATO Center of Excellence (COE) and is actively seeking U.S. and other Allied sponsorship of the Center. U.S. sponsorship of Estonia's CCD-COE would not only enhance Estonia's efforts to provide expertise and support to NATO's developing cyber security doctrine, but will also encourage other Allies to participate in the Center. End Summary. Background -------------- ¶2. (SBU) In April/May 2007, cyber attackers targeted government and private sector websites in Estonia. The attacks, which lasted for approximately one month and ranged from simple spam postings to coordinated DDOS (Distributed Denial of Service) attacks, caused severe service disruptions to websites, servers and routers linked to government, banking, media and other resources. (Refs A and B). These highly coordinated cyber attacks captured widespread international media attention. The United States and NATO quickly sent experts to Tallinn to observe and provide a summary of the attacks and the GOE response. Since the attacks, the GOE has actively sought a leadership role on cyber security within NATO, the European Union (EU) and other organizations. As a result, Estonia has emerged as an important player in international cooperation on cyber defense. ¶3. (SBU) The attacks on Estonia demonstrated the vulnerability of both government and private sector Internet infrastructure to cyber warfare and revealed the need for better international cooperation on cyber security. The GOE has advocated in favor of the establishment of an international legal framework on cyber security. Currently, cyber cooperation is done on an almost exclusively ad-hoc basis. In January 2008, NATO approved a cyber-defense policy (Estonian and US officials at NATO worked closely as this policy took shape) that strengthens and streamlines NATO's internal cyber defenses and establishes a capability to assist Allies under cyber 
attack. ¶4. (SBU) In 2004, the GOE offered to host the CCD COE in Tallinn. Development was initiated in 2005 and NATO Supreme Allied Command Transformation (SACT) approval came in 2006. The mission of the CCD COE is to enhance the cooperative cyber defense capability of NATO and to become an important source of expertise for NATO in cooperative cyber defense-related matters. Estonia is working to have the COE accredited by NATO by December 2008. ¶5. (SBU) In November 2007, the USG was the first Ally to send a representative to the CCD - the Department of the Navy seconded a cyber security expert from the Naval Criminal Investigative Service (NCIS) to the CCD for one year. (Note: The CCD NCIS representative's assignment to the CCD will be reevaluated by the Navy at the end of one year and may be transformed into a three year tour. End Note.) MOU Conference -------------- ¶6. (SBU) In late January 2008, the Estonian Ministry of Defense (MOD) hosted a conference in Tallinn to negotiate the Memorandum of Understanding (MOU) that will govern participation in the CCD-COE. Representatives from NATO SACT and ten Allies took part in the conference. Estonia, Italy, Germany, Latvia, Lithuania, Slovakia and Spain participated as likely 'sponsoring nations' (SNs) while the Czech Republic, Norway, Poland and the United States sent observers. (Note: Bulgaria's observer could not come as planned. Denmark, listed as a sponsor nation on the MOU working documents, did not send a representative to the conference and has decided not to participate in the CCD- COE at this time. End Note.) The NCIS Rep to the CCD and Poloff attended the conference. ¶7. (SBU) The conference focused on finalizing the texts of the MOUs so that internal staffing could be completed in time for a May 2008 signing ceremony and NATO accreditation by December 2008. Both Germany and Latvia commented they thought it would be difficult to finalize staffing according to the proposed schedule. Slovakia also raised TALLINN 00000054 002 OF 002 concerns about the stipulation in the draft MOU that all SNs must have at least one representative at the Center in Estonia and said this stipulation could result in Slovakia's withdrawal as a SN. NATO SACT and Estonia said that the issue is non-negotiable: to be a Sponsoring Nation, there is a requirement to have someone on the ground. ¶8. Conference participants also addressed budget and resources issues and discussed the extent to which NATO command would influence the Plan of Work and operations of the CCD-COE. Estonia pledged to cover the EUR 300,000 operating budget for 2008. Starting in 2009, however, each SN will be asked to contribute approximately EUR 20,000. ¶9. (U) One issue still to be resolved is the level of access Allies who are not SNs will have to the CCD-COE's products and services. Both Lithuania and Germany argued strongly against non-SNs being able to request assistance from the CCD-COE or benefiting from developments resulting from work conducted at the CCD-COE. However, both NATO SACT and Estonia were adamant that the CCD-COE would serve to benefit all members of the Alliance and NATO partner nations, on a case by case basis through agreements, as well. ¶10. (U) At the conclusion of the conference, participants agreed to a general time frame for finalizing the agreement. The SNs agreed to submit staffing commitments to the CCD-COE by the end of February 2008. The formal MOU signing will then take place in May 2008, with accreditation by the NATO occurring in November or December ¶2008. The GOE hopes to have the CCD-COE fully accredited, staffed and operational by January 2009. ¶11. (SBU) The U.S. status as an observer and not an SN at the conference sparked considerable discussion among participants. Representatives from Lithuania, Spain and Poland specifically asked whether the United States intends to sponsor the CCD-COE. The Spanish representative noted that U.S. participation as a SN would lend credibility to the CCD-COE. The Polish representative said he believed the U.S.'s quick decision to send an expert had given 'energy and impetus to the project' and had encouraged other Allies to follow suit. Comment -------------- ¶12. (SBU) Post understands that it has not yet been decided if the United States will become a SN of Estonia's CCD-COE. In our view, there would be several significant benefits to sponsorship: -- The Estonian CCD has the potential to become an effective tool in NATO's efforts to institute a coordinated cyber policy and help to ensure NATO and Allies are capable of defending themselves against cyber attacks. -- A well supported CCD-COE could be useful to NATO and U.S. interests in helping to implement NATO's cyber defense policy. -- Cyber security is an ideal niche for Estonia within NATO. Internationally, Estonia is widely acknowledged as a leader in the high-tech industry and Internet innovation. Its small, highly educated and technologically savvy population is well suited for specializing in development of NATO's cyber dimension. U.S. sponsorship would demonstrate our support for Estonia's efforts to take a leadership role in this area. -- U.S. participation will increase the potential for success of the CCD-COE. Other Allies will likely follow the U.S. lead regarding support for the Cyber Center. END COMMENT. ¶13. (U) This cable was cleared by USNATO. DECKER