ESTONIA?S NATIONAL CYBER DEFENSE AGENDA

UNCLAS SECTION 01 OF 03 TALLINN 000205 SENSITIVE SIPDIS STATE FOR INR CYBER MICHELLE MARKOFF E.O. 12958: N/A TAGS: PGOV PTER PREL NATO EN SUBJECT: ESTONIA?S NATIONAL CYBER DEFENSE AGENDA REFTEL A: 2007 TALLINN 366 B: 2008 TALLINN 428 ¶1. (U) SUMMARY: Unprecedented and wide-spread cyber attacks in April/May 2007 galvanized Estonia to think strategically about the security of its critical IT infrastructure. Estonia's brainstorming has culminated in a new national cyber defense policy for 2009-2011, focused on strengthening ties between the private sector and government, greater personal computer security responsibility among the populace, and the need for comprehensive international legislation on cyber security within the framework of multi-national organizations. President Obama's recent declaration that cyber security was a high priority for the U.S. has the Government of Estonia looking for areas of increased bilateral cooperation with the U.S. in cyber security. END SUMMARY. Implementing Cyber Security -------------- ¶2. (U) Even prior to April 2007, Estonia was "cyber-savvy," with a small, highly- educated and IT-focused population well- suited for developing high-tech industry and internet innovation. In fact, Estonia's Cooperative Cyber Defense Center of Excellence(CCD COE),which was accredited by NATO in 2008, began building an international reputation in 2003. The April/May 2007 cyber attacks, however, underscored the vulnerability of Estonia's government and private sector Internet infrastructure to cyber warfare (Ref A). ¶3. (SBU) In the wake of the attacks, the GOE directed the Ministry of Defense, in cooperation with the Ministry of Education and Research, the Ministry of Justice, the Ministry of Economic Affairs and Communications, the Ministry of Internal Affairs and the Ministry of Foreign Affairs, to develop a "Cyber Security Strategy for 2008-2013." The inter- agency committee tasked with developing the Strategy also included information security experts from the Estonian private sector. This strategy, intended to safeguard Estonia from future attacks and serve as a model for other countries, was formally unveiled to the public in May 2008. However, the budget crisis in Estonia delayed implementation for more than a year. ¶4. (SBU) In May 2009, the GOE endorsed a plan to implement its national cyber security strategy for the period 2009-2011. The plan calls for a "graduated" system of security measures, development of Estonian expertise in information security, development of an appropriate regulatory and legal framework, and promotion of international cooperation toward achieving global cyber security. The strategy rests on the premise that improved security can only be achieved through international cooperation between nations and with the private sector, and that national cyber security measures must be made visible to encourage international investment. Enhancing Public-Private Cooperation -------------- ¶5. (SBU) In order to achieve the goals outlined in the plan, the GOE will establish a "cyber security critical information infrastructure security unit" this year under the authority of the Ministry of Economic Affairs and Communications. Our GOE cyber security contacts have told us that the mandate of this body will be to liaise with the private sector and oversee security measures and information security across the GOE. The aim of this cross-cutting mandate will be to address key deficiencies highlighted by the 2007 attacks, such as the limited role played by the private sector in national cyber defense. ¶6. (SBU) As one example of how the private sector and the government should join forces, two companies (Linx Telecom and Elion) provide Estonia's backbone connection to the internet. Linx Network Architect Marko Veelma and Country Manager Erki Uvra told poloff they have only occasionally consulted with Ministry of Defense working groups on cyber defense strategy. Instead, they described parallel, rather than integrated, approaches to security among the GOE, banks and private ISPs. Urva and Veelma noted that during the April 2007 massive denial of service (DOS) attacks on banks and government websites in Estonia, Linx Telecom itself was barely affected; online news services that used their servers for internet hosting, for example, were still accessible outside Estonia, TALLINN 00000205 002 OF 003 while banks and GOE websites had to be cut off from the internet outside Estonia. Linx's massive capacity, and ability to re-route traffic via neighboring Swedish and Finnish networks, means that a massive DOS attack on a particular user of their network may register as barely a blip to the overall system. Both the Linx employees and our GOE contacts have told us the government will make use of such resources as it implements its own cyber security plans. ¶7. (U) The 2009-2011 security strategy calls for increased public and private sector cooperation to protect critical information infrastructure, coordinate the distribution of information on cyber threats, and organize security awareness campaigns together with the private sector. The GOE emphasis on this aspect of cyber security is evident in the rhetoric of key Estonian public figures. In a recent key note speech to mark the opening of a cyber defense conference in Tallinn, Estonian Minister of Defense Jaak Aaviksoo stated that cyber security reaches across all fields of cooperation and that a successful strategy will depend heavily on civilian sector contributions. In addition, during a June 2009 trip to Silicon Valley in California to promote Estonian industry, Estonian President Toomas Hendrik Ilves stressed that efficient international cooperation between the private and public sectors is required in order to anticipate cyber threats and to eradicate their consequences. ¶8. (U) Another key tool of the GOE strategy is to raise the awareness and greater personal computer security responsibility of the individual user. In order to achieve this goal, the new strategy foresees the introduction of cyber defense and information security tools at all levels of education, the establishment of minimum requirements for competence in IT security and cyber defense for both public and private sector staff and the organization of an "appropriate evaluation process." Developing Niche Capabilities -------------- ¶9. (SBU) On the international front, the plan envisions a smaller but more defined role for the GOE than in the past. According to Heli Tiirmaa-Klaar, cyber security coordinator at the Estonian Ministry of Defense, in the immediate aftermath of the 2007 attacks Estonia wanted to become a global leader in cyber security. However, over the course of the past two years, the complexity of cyber security issues has forced the GOE to consider the benefits of identifying a few niche capabilities. In particular, Estonia would like to enhance the profile of the CCD COE. According to Ilmar Tamm, CCD COE director, the main goal of the center is to conduct post- incident analysis and research to identify root causes, motivation and future threats. Currently, seven NATO member states have officially signed on as Sponsoring Nations (the U.S., Turkey, and Hungary are in line to join as Sponsors, with Finland, Norway, and Sweden to join as Cooperative Partners). The GOE wants to expand membership and the manpower available to expand research capabilities. ¶10. (SBU) The cyber security strategy also outlines the importance the GOE places on international cooperation as a key element to increasing national cyber security. Not only does the strategy call for further development of the NATO CCD COE's profile, but for increased focus on raising awareness of cyber security in organizations such as NATO, UN, OSCE, and the OECD (which Estonia hopes to join in 2009). Tiirmaa-Klaar pointed to the number of laws for cyber crime on the books in EU and NATO member states, such as the Council of Europe and EU Conventions on cyber crime, but the comparative dearth of such legislation in other countries. The result of this disparity is that there is no legal basis for criminalizing cyber attacks in many countries. This September, the CCD COE will host a conference in Tallinn intended to raise awareness of the need for increased legislation and make governments aware of what binding international agreements and laws can do for them. An Opportunity for Enhanced Cooperation with the U.S. -------------- ¶11. (SBU) President Obama's elevation of the cyber threat to a primary national/international security challenge has the GOE considering possibilities for increased Estonia-U.S. bilateral cooperation in cyberspace. Martin Paas, cyber policy advisor TALLINN 00000205 003 OF 003 at the Estonian Ministry of Interior, told us that the GOE would be very interested in developing ties between U.S. and Estonian cyber security experts dealing with restricted or classified networks, an area Paas cites as being underdeveloped. Paas also communicated the GOE's interest in working with the U.S. to create a training curriculum for the protection of networks. According to Paas, the rapid development of networks and the implementation of different technical solutions have created new types of threats and challenges which can be tackled in close cooperation with partners, both via exchange of experience and creation of training programs. ¶12. (SBU) Heli Tiirmaa-Klaar stated that a high priority for the GOE is training, education and research in information security. Tiirmaa-Klaar suggested that, within the confines of the newly signed but so far un-ratified Science and Technology Agreement (ref B),the USG and GOE could pursue bilateral training and education cooperation, such as academic studies, on-the-job training and expert exchanges. ¶13. (SBU) COMMENT: Cyber security is a key MSP goal, and a big piece of our agenda with the Estonians. Getting the U.S. through the final couple of steps and into the CCD COE as a sponsoring nation is a high priority for us, as it will increase our influence with Estonia and other cyber-minded nations. We also promote deepened ties between and among government agencies and the private sector, and have used the Overseas Security Advisory Committee (OSAC) as a vehicle for supporting public-private discussions of cyber security. The nexus between cyber security and digital piracy is another target area where we and Estonia have overlapping interests. As Estonia develops its niche capabilities, we anticipate being part of the discussion about what makes sense. The prospects are bright: Estonia is viewed by many as a post- Soviet success story whose capabilities, influence and advice are held in high regard internationally. Estonia's eagerness to identify new areas of bilateral cooperation is an excellent opportunity for the U.S. to participate in the development of cyber security policy and further enhance an already solid bilateral partnership. END COMMENT. DECKER