USG SUPPORT FOR ESTONIAN CYBER CENTER

UNCLAS SECTION 01 OF 02 TALLINN 000054

SIPDIS

SENSITIVE
SIPDIS

E.O. 12958: N/A
TAGS: PGOV PTER PREL NATO EN
SUBJECT: USG SUPPORT FOR ESTONIAN CYBER CENTER
(CORRECTED COPY - ADDED ADDRESSEE)

REF: A) 07 Tallinn 366 B) 07 Tallinn 374

TALLINN 00000054 001.2 OF 002



1. (SBU) SUMMARY: The experience of unprecedented and wide-
spread cyber attacks in April/May 2007 prompted Estonia to
accelerate its leadership efforts in promoting
international cooperation on cyber security. The
Government of Estonia (GOE) is working with NATO to make
its national Cooperative Cyber Defense Center (CCD) a NATO
Center of Excellence (COE) and is actively seeking U.S. and
other Allied sponsorship of the Center. U.S. sponsorship
of Estonia's CCD-COE would not only enhance Estonia's
efforts to provide expertise and support to NATO's
developing cyber security doctrine, but will also encourage
other Allies to participate in the Center. End Summary.

Background
--------------


2. (SBU) In April/May 2007, cyber attackers targeted
government and private sector websites in Estonia. The
attacks, which lasted for approximately one month and
ranged from simple spam postings to coordinated DDOS
(Distributed Denial of Service) attacks, caused severe
service disruptions to websites, servers and routers linked
to government, banking, media and other resources. (Refs A
and B). These highly coordinated cyber attacks captured
widespread international media attention. The United
States and NATO quickly sent experts to Tallinn to observe
and provide a summary of the attacks and the GOE response.
Since the attacks, the GOE has actively sought a leadership
role on cyber security within NATO, the European Union (EU)
and other organizations. As a result, Estonia has emerged
as an important player in international cooperation on
cyber defense.


3. (SBU) The attacks on Estonia demonstrated the
vulnerability of both government and private sector
Internet infrastructure to cyber warfare and revealed the
need for better international cooperation on cyber
security. The GOE has advocated in favor of the
establishment of an international legal framework on cyber
security. Currently, cyber cooperation is done on an
almost exclusively ad-hoc basis. In January 2008, NATO
approved a cyber-defense policy (Estonian and US officials
at NATO worked closely as this policy took shape) that
strengthens and streamlines NATO's internal cyber defenses
and establishes a capability to assist Allies under cyber
attack.


4. (SBU) In 2004, the GOE offered to host the CCD COE in
Tallinn. Development was initiated in 2005 and NATO
Supreme Allied Command Transformation (SACT) approval came
in 2006. The mission of the CCD COE is to enhance the
cooperative cyber defense capability of NATO and to become
an important source of expertise for NATO in cooperative
cyber defense-related matters. Estonia is working to have
the COE accredited by NATO by December 2008.


5. (SBU) In November 2007, the USG was the first Ally to
send a representative to the CCD - the Department of the
Navy seconded a cyber security expert from the Naval
Criminal Investigative Service (NCIS) to the CCD for one
year. (Note: The CCD NCIS representative's assignment to
the CCD will be reevaluated by the Navy at the end of one
year and may be transformed into a three year tour. End
Note.)

MOU Conference
--------------


6. (SBU) In late January 2008, the Estonian Ministry of
Defense (MOD) hosted a conference in Tallinn to negotiate
the Memorandum of Understanding (MOU) that will govern
participation in the CCD-COE. Representatives from NATO
SACT and ten Allies took part in the conference. Estonia,
Italy, Germany, Latvia, Lithuania, Slovakia and Spain
participated as likely 'sponsoring nations' (SNs) while the
Czech Republic, Norway, Poland and the United States sent
observers. (Note: Bulgaria's observer could not come as
planned. Denmark, listed as a sponsor nation on the MOU
working documents, did not send a representative to the
conference and has decided not to participate in the CCD-
COE at this time. End Note.) The NCIS Rep to the CCD and
Poloff attended the conference.


7. (SBU) The conference focused on finalizing the texts of
the MOUs so that internal staffing could be completed in
time for a May 2008 signing ceremony and NATO accreditation
by December 2008. Both Germany and Latvia commented they
thought it would be difficult to finalize staffing
according to the proposed schedule. Slovakia also raised

TALLINN 00000054 002 OF 002


concerns about the stipulation in the draft MOU that all
SNs must have at least one representative at the Center in
Estonia and said this stipulation could result in
Slovakia's withdrawal as a SN. NATO SACT and Estonia said
that the issue is non-negotiable: to be a Sponsoring
Nation, there is a requirement to have someone on the
ground.


8. Conference participants also addressed budget and
resources issues and discussed the extent to which NATO
command would influence the Plan of Work and operations of
the CCD-COE. Estonia pledged to cover the EUR 300,000
operating budget for 2008. Starting in 2009, however, each
SN will be asked to contribute approximately EUR 20,000.


9. (U) One issue still to be resolved is the level of
access Allies who are not SNs will have to the CCD-COE's
products and services. Both Lithuania and Germany argued
strongly against non-SNs being able to request assistance
from the CCD-COE or benefiting from developments resulting
from work conducted at the CCD-COE. However, both NATO
SACT and Estonia were adamant that the CCD-COE would serve
to benefit all members of the Alliance and NATO partner
nations, on a case by case basis through agreements, as
well.


10. (U) At the conclusion of the conference, participants
agreed to a general time frame for finalizing the
agreement. The SNs agreed to submit staffing commitments
to the CCD-COE by the end of February 2008. The formal MOU
signing will then take place in May 2008, with
accreditation by the NATO occurring in November or December

2008. The GOE hopes to have the CCD-COE fully accredited,
staffed and operational by January 2009.


11. (SBU) The U.S. status as an observer and not an SN at
the conference sparked considerable discussion among
participants. Representatives from Lithuania, Spain and
Poland specifically asked whether the United States intends
to sponsor the CCD-COE. The Spanish representative noted
that U.S. participation as a SN would lend credibility to
the CCD-COE. The Polish representative said he believed
the U.S.'s quick decision to send an expert had given
'energy and impetus to the project' and had encouraged
other Allies to follow suit.

Comment
--------------


12. (SBU) Post understands that it has not yet been decided
if the United States will become a SN of Estonia's CCD-COE.
In our view, there would be several significant benefits to
sponsorship:

-- The Estonian CCD has the potential to become an
effective tool in NATO's efforts to institute a coordinated
cyber policy and help to ensure NATO and Allies are capable
of defending themselves against cyber attacks.

-- A well supported CCD-COE could be useful to NATO and
U.S. interests in helping to implement NATO's cyber defense
policy.

-- Cyber security is an ideal niche for Estonia within
NATO. Internationally, Estonia is widely acknowledged as a
leader in the high-tech industry and Internet innovation.
Its small, highly educated and technologically savvy
population is well suited for specializing in development
of NATO's cyber dimension. U.S. sponsorship would
demonstrate our support for Estonia's efforts to take a
leadership role in this area.

-- U.S. participation will increase the potential for
success of the CCD-COE. Other Allies will likely follow
the U.S. lead regarding support for the Cyber Center.

END COMMENT.


13. (U) This cable was cleared by USNATO.


DECKER