

Currently released so far... 12900 / 251,287
Browse latest releases
2010/12/01
2010/12/02
2010/12/03
2010/12/04
2010/12/05
2010/12/06
2010/12/07
2010/12/08
2010/12/09
2010/12/10
2010/12/11
2010/12/12
2010/12/13
2010/12/14
2010/12/15
2010/12/16
2010/12/17
2010/12/18
2010/12/19
2010/12/20
2010/12/21
2010/12/22
2010/12/23
2010/12/24
2010/12/25
2010/12/26
2010/12/27
2010/12/28
2010/12/29
2010/12/30
2011/01/01
2011/01/02
2011/01/04
2011/01/05
2011/01/07
2011/01/09
2011/01/10
2011/01/11
2011/01/12
2011/01/13
2011/01/14
2011/01/15
2011/01/16
2011/01/17
2011/01/18
2011/01/19
2011/01/20
2011/01/21
2011/01/22
2011/01/23
2011/01/24
2011/01/25
2011/01/26
2011/01/27
2011/01/28
2011/01/29
2011/01/30
2011/01/31
2011/02/01
2011/02/02
2011/02/03
2011/02/04
2011/02/05
2011/02/06
2011/02/07
2011/02/08
2011/02/09
2011/02/10
2011/02/11
2011/02/12
2011/02/13
2011/02/14
2011/02/15
2011/02/16
2011/02/17
2011/02/18
2011/02/19
2011/02/20
2011/02/21
2011/02/22
2011/02/23
2011/02/24
2011/02/25
2011/02/26
2011/02/27
2011/02/28
2011/03/01
2011/03/02
2011/03/03
2011/03/04
2011/03/05
2011/03/06
2011/03/07
2011/03/08
2011/03/09
2011/03/10
2011/03/11
2011/03/13
2011/03/14
2011/03/15
2011/03/16
2011/03/17
2011/03/18
2011/03/19
2011/03/20
2011/03/21
2011/03/22
2011/03/23
2011/03/24
2011/03/25
2011/03/26
2011/03/27
2011/03/28
2011/03/29
2011/03/30
2011/03/31
2011/04/01
2011/04/02
2011/04/03
2011/04/04
2011/04/05
2011/04/06
2011/04/07
2011/04/08
2011/04/09
2011/04/10
2011/04/11
2011/04/12
2011/04/13
2011/04/14
2011/04/15
2011/04/16
2011/04/17
2011/04/18
2011/04/19
2011/04/20
2011/04/21
2011/04/22
2011/04/23
2011/04/24
2011/04/25
2011/04/26
2011/04/27
2011/04/28
2011/04/29
2011/04/30
2011/05/01
2011/05/02
2011/05/03
2011/05/04
2011/05/05
2011/05/06
2011/05/07
2011/05/08
2011/05/09
2011/05/10
2011/05/11
2011/05/12
2011/05/13
2011/05/14
2011/05/15
2011/05/16
2011/05/17
2011/05/18
2011/05/19
2011/05/20
2011/05/21
2011/05/22
2011/05/23
2011/05/24
Browse by creation date
Browse by origin
Embassy Athens
Embassy Asuncion
Embassy Astana
Embassy Asmara
Embassy Ashgabat
Embassy Apia
Embassy Ankara
Embassy Amman
Embassy Algiers
Embassy Addis Ababa
Embassy Accra
Embassy Abuja
Embassy Abu Dhabi
Embassy Abidjan
Consulate Auckland
Consulate Amsterdam
Consulate Adana
American Institute Taiwan, Taipei
Embassy Bujumbura
Embassy Buenos Aires
Embassy Budapest
Embassy Bucharest
Embassy Brussels
Embassy Bridgetown
Embassy Bratislava
Embassy Brasilia
Embassy Bogota
Embassy Bishkek
Embassy Bern
Embassy Berlin
Embassy Belmopan
Embassy Belgrade
Embassy Beirut
Embassy Beijing
Embassy Banjul
Embassy Bangkok
Embassy Bandar Seri Begawan
Embassy Bamako
Embassy Baku
Embassy Baghdad
Consulate Barcelona
Embassy Copenhagen
Embassy Conakry
Embassy Colombo
Embassy Chisinau
Embassy Caracas
Embassy Canberra
Embassy Cairo
Consulate Curacao
Consulate Ciudad Juarez
Consulate Chennai
Consulate Casablanca
Consulate Cape Town
Consulate Calgary
Embassy Dushanbe
Embassy Dublin
Embassy Doha
Embassy Djibouti
Embassy Dili
Embassy Dhaka
Embassy Dar Es Salaam
Embassy Damascus
Embassy Dakar
Consulate Dubai
Embassy Helsinki
Embassy Harare
Embassy Hanoi
Consulate Ho Chi Minh City
Consulate Hermosillo
Consulate Hamilton
Consulate Hamburg
Consulate Halifax
Embassy Kyiv
Embassy Kuwait
Embassy Kuala Lumpur
Embassy Kinshasa
Embassy Kingston
Embassy Kigali
Embassy Khartoum
Embassy Kathmandu
Embassy Kampala
Embassy Kabul
Consulate Kolkata
Consulate Karachi
Embassy Luxembourg
Embassy Luanda
Embassy London
Embassy Ljubljana
Embassy Lisbon
Embassy Lima
Embassy Lilongwe
Embassy La Paz
Consulate Lahore
Consulate Lagos
Mission USOSCE
Mission USNATO
Mission UNESCO
Embassy Muscat
Embassy Moscow
Embassy Montevideo
Embassy Monrovia
Embassy Minsk
Embassy Mexico
Embassy Mbabane
Embassy Maputo
Embassy Manila
Embassy Manama
Embassy Managua
Embassy Malabo
Embassy Madrid
Consulate Munich
Consulate Mumbai
Consulate Montreal
Consulate Monterrey
Consulate Milan
Consulate Melbourne
Embassy Nicosia
Embassy Niamey
Embassy New Delhi
Embassy Ndjamena
Embassy Nassau
Embassy Nairobi
Consulate Naples
Consulate Naha
Embassy Pristina
Embassy Pretoria
Embassy Prague
Embassy Port Of Spain
Embassy Port Louis
Embassy Port Au Prince
Embassy Phnom Penh
Embassy Paris
Embassy Paramaribo
Embassy Panama
Consulate Peshawar
REO Basrah
Embassy Rome
Embassy Riyadh
Embassy Riga
Embassy Reykjavik
Embassy Rangoon
Embassy Rabat
Consulate Rio De Janeiro
Consulate Recife
Secretary of State
Embassy Suva
Embassy Stockholm
Embassy Sofia
Embassy Skopje
Embassy Singapore
Embassy Seoul
Embassy Sarajevo
Embassy Santo Domingo
Embassy Santiago
Embassy Sanaa
Embassy San Salvador
Embassy San Jose
Consulate Strasbourg
Consulate St Petersburg
Consulate Shenyang
Consulate Shanghai
Consulate Sapporo
Consulate Sao Paulo
Embassy Tunis
Embassy Tripoli
Embassy Tokyo
Embassy The Hague
Embassy Tel Aviv
Embassy Tehran
Embassy Tegucigalpa
Embassy Tbilisi
Embassy Tashkent
Embassy Tallinn
Consulate Toronto
Consulate Tijuana
USUN New York
USEU Brussels
US Office Almaty
US Mission Geneva
US Interests Section Havana
US Delegation, Secretary
UNVIE
Embassy Ulaanbaatar
Embassy Vilnius
Embassy Vienna
Embassy Vatican
Embassy Valletta
Consulate Vladivostok
Consulate Vancouver
Browse by tag
AE
ASEC
AS
AR
AMGT
AFIN
AORC
AU
AG
AF
APER
ABLD
ADCO
ABUD
AM
AID
AJ
AEMR
AMED
AL
ASUP
AN
AIT
ACOA
ANET
ASIG
AA
AGMT
AINF
AFFAIRS
ADANA
AY
AADP
ARF
ACS
AGR
AMCHAMS
AECL
AUC
APEC
APECO
AFGHANISTAN
ACAO
ASEAN
ADM
AGAO
AND
ADPM
ATRN
ALOW
AROC
APCS
AORG
AO
AODE
ACABQ
AX
AMEX
AZ
ARM
AQ
ATFN
AMBASSADOR
ACBAQ
AFSI
AFSN
AC
ASEX
AER
AVERY
AGRICULTURE
ASCH
AFU
AMG
ATPDEA
ASECKFRDCVISKIRFPHUMSMIGEG
AORL
BR
BO
BA
BM
BL
BH
BK
BEXP
BILAT
BTIO
BF
BU
BD
BY
BE
BG
BB
BBSR
BT
BRUSSELS
BP
BX
BC
BIDEN
BMGT
BWC
BN
BTIU
CA
CS
CO
CD
CR
CPAS
CDG
CI
CDC
CBW
CU
CVIS
CE
CONS
CH
CMGT
CASC
CY
CW
CG
CJAN
CIDA
CODEL
CWC
CIA
CBSA
CEUDA
CFED
CLINTON
CAC
CL
CACS
CIC
CHR
CAPC
CM
CT
CTR
COM
CROS
CN
COPUOS
CV
CF
CARSON
CONDOLEEZZA
CICTE
CYPRUS
COUNTER
COUNTRY
CBE
CKGR
CVR
COUNTERTERRORISM
CITEL
CLEARANCE
COE
CARICOM
CB
CSW
CITT
CACM
CDB
CJUS
CTM
CAN
CLMT
CBC
CNARC
CIS
EFIN
ECON
ETRD
EAID
EC
EU
EUN
EINV
EG
ETTC
EIND
ELAB
EAGR
ECIN
EINT
ENRG
EFIS
ELTN
EAIR
EPET
EZ
ET
ENERG
ECPS
EWWT
EI
ETRN
EINVECONSENVCSJA
EEPET
EUNCH
ER
ES
EN
EMIN
ESENV
ENNP
ENGR
ETRDEINVECINPGOVCS
ENVI
ECINECONCS
ELN
EFTA
ELECTIONS
ENVR
EXTERNAL
ENIV
ESA
EPA
ETRO
ETRDECONWTOCS
EUR
ECUN
EXIM
EK
EUREM
ECONOMY
EUMEM
ERNG
EFINECONCS
EAIDS
ECA
ETRC
EINVEFIN
ETC
EAP
EINN
ECONOMIC
EXBS
ENGY
ECONOMICS
EIAR
EINDETRD
ECONEFIN
EURN
EDU
ETRDEINVTINTCS
ECIP
EFIM
EREL
EINVETC
ECONCS
ETRA
EAIG
EUC
ERD
IQ
IR
IS
IN
IA
IC
IZ
ICRC
ID
IDA
IT
IO
IAEA
ICJ
ICAO
IV
IBRD
IMF
IAHRC
IWC
ILO
ISLAMISTS
IGAD
ILC
ITU
ITF
INRA
INRO
ICTY
INRB
ITALY
IBET
IL
INTELSAT
ISRAELI
IMO
IDP
ICTR
ITRA
IRC
IRAQI
IEFIN
IPR
IIP
INMARSAT
ITPGOV
ITALIAN
INTERNAL
IRS
INTERPOL
IEA
INR
ISRAEL
IZPREL
IRAJ
IF
ITPHUM
IACI
INDO
KPAO
KMDR
KCOR
KNNP
KJUS
KCRM
KDEM
KVPR
KTFN
KPRP
KTIP
KSCA
KSUM
KTEX
KIDE
KIRF
KV
KTIA
KN
KG
KFRD
KWMN
KUNR
KISL
KU
KGHG
KPKO
KOMS
KPAL
KIPR
KMCA
KOMC
KRVC
KSEP
KAWC
KOLY
KWBG
KACT
KFLO
KHIV
KZ
KGIC
KBCT
KDRG
KBTR
KCFE
KE
KHLS
KMPI
KAWK
KPWR
KIRC
KRAD
KFRDCVISCMGTCASCKOCIASECPHUMSMIGEG
KFLU
KPLS
KRIM
KSTH
KDDG
KPRV
KICC
KS
KSAF
KBIO
KREC
KCGC
KCIP
KTDB
KWAC
KPAI
KFRDKIRFCVISCMGTKOCIASECPHUMSMIGEG
KFSC
KSTC
KMFO
KID
KNAR
KMIG
KVRP
KNEI
KGIT
KNSD
KHDP
KSAC
KWMM
KR
KCOM
KAID
KENV
KVIR
KHSA
KO
KCRS
KPOA
KTER
KFIN
KSPR
KTBT
KX
KCMR
KMOC
KCRCM
KBTS
KSEO
KOCI
KNUP
KPAONZ
KNUC
KNNPMNUC
KERG
KSCI
KTLA
KCSY
KTRD
KMRS
KNPP
KJUST
KRCM
KCFC
KCHG
KREL
KFTFN
KLIG
KDEMAF
KGCC
KICA
KHUM
KSEC
KPIN
KESS
KDEV
KPIR
KWWMN
KOM
KWNM
KRFD
KRGY
KIFR
KWMNCS
KPAK
MARR
MOPS
MUCN
MCAP
MNUC
MEPP
MTCRE
MASS
MO
MIL
MX
MAS
MEDIA
MAR
MI
MQADHAFI
MPOS
MTCR
MK
MG
MA
MY
MU
ML
MPS
MW
MD
MARAD
MC
MR
MT
MTRE
MASC
MRCRE
MAPP
MZ
MP
MOPPS
MTS
MLS
MILI
MEPN
MEPI
MEETINGS
MERCOSUR
MCC
MIK
MAPS
MV
MILITARY
MDC
MASSMNUC
NI
NZ
NL
NO
NPT
NATO
NS
NU
NP
NPA
NSFO
NDP
NT
NW
NASA
NSG
NE
NORAD
NAFTA
NG
NATIONAL
NSSP
NV
NSF
NK
NA
NEW
NPG
NR
NGO
NIPP
NZUS
NH
NC
NRR
NAR
NATOPREL
NSC
OIIP
OPRC
OTRA
OEXC
OREP
OSCE
OVIP
OPAD
OBSP
OECD
OFFICIALS
OAS
OPDC
ODIP
OPCW
OES
OFDP
OPIC
OCS
OIC
OHUM
OSCI
OVP
ODC
OIE
OTR
OMIG
OSAC
OFDA
ON
OCII
PREL
PINR
PGOV
PARM
PE
PTER
PHUM
PO
PINS
PREF
PK
PM
POL
PBTS
PNAT
PHSA
PAS
PA
PL
PGIV
PHUMPREL
POGOV
PAK
PEL
PROP
PP
PINL
PBT
PTBS
PG
PINF
PRL
PALESTINIAN
PSEPC
POSTS
PAHO
PHUMPGOV
PGOC
PNR
PREFA
PMIL
POLITICS
POLICY
PROV
PBIO
PREO
PAO
PDOV
PGOF
POV
PCI
PRAM
PSI
POLITICAL
PAIGH
PJUS
PARMS
PROG
PTERE
PRGOV
PORG
PS
PKFK
PSOE
PEPR
PPA
PINT
PMAR
PRELP
PNG
PFOR
PUNE
PGOVLO
PHUMBA
POLINT
PGOVE
PHALANAGE
PARTY
PDEM
PECON
PY
PLN
PHUH
PF
PHUS
PU
PARTIES
PCUL
PGGV
PSA
PGOVSMIGKCRMKWMNPHUMCVISKFRDCA
RU
RS
REGION
REACTION
REPORT
RO
RW
RCMP
RSO
RP
RM
ROOD
RFE
RICE
ROBERT
RSP
RF
RELATIONS
RIGHTS
RIGHTSPOLMIL
RUPREL
SENV
SY
SNAR
SCUL
SP
SF
SW
SOCI
SU
SMIG
SO
SA
SR
SZ
SI
SC
SEVN
SN
STEINBERG
SK
SH
SNARCS
SPCE
SARS
SNARN
SG
SL
SYRIA
SIPRS
SAARC
SNARIZ
SWE
SYR
SEN
SCRS
SAN
ST
SIPDIS
SSA
SPCVIS
SOFA
SENVKGHG
SANC
SHI
SHUM
TU
TSPA
TBIO
TS
TRGY
TINT
TPHY
TN
TW
TH
TZ
TSPL
TP
TBID
TI
TF
TD
TT
TNGD
TL
TC
THPY
TIP
TX
TV
TK
TERRORISM
TO
TRSY
TURKEY
TFIN
TAGS
TR
UK
UNSC
UNGA
UNESCO
UNHRC
UP
UN
USTR
US
UNDC
UY
UNICEF
UNDP
UNMIK
UNAUS
UNCHC
UNCSD
USOAS
UNFCYP
UG
UNIDROIT
UNO
UV
UNHCR
UNEP
USEU
UZ
UNCND
USUN
UNCHR
USNC
USPS
USAID
UE
UNVIE
UAE
UNODC
UNCHS
UNFICYP
UNDESCO
UNC
UNPUOS
Browse by classification
Community resources
courage is contagious
Viewing cable 07TALLINN375, ESTONIA'S CYBER ATTACKS: LESSONS LEARNED
If you are new to these pages, please read an introduction on the structure of a cable as well as how to discuss them with others. See also the FAQs
Understanding cables
Every cable message consists of three parts:
- The top box shows each cables unique reference number, when and by whom it originally was sent, and what its initial classification was.
- The middle box contains the header information that is associated with the cable. It includes information about the receiver(s) as well as a general subject.
- The bottom box presents the body of the cable. The opening can contain a more specific subject, references to other cables (browse by origin to find them) or additional comment. This is followed by the main contents of the cable: a summary, a collection of specific topics and a comment section.
Discussing cables
If you find meaningful or important information in a cable, please link directly to its unique reference number. Linking to a specific paragraph in the body of a cable is also possible by copying the appropriate link (to be found at theparagraph symbol). Please mark messages for social networking services like Twitter with the hash tags #cablegate and a hash containing the reference ID e.g. #07TALLINN375.
Reference ID | Created | Released | Classification | Origin |
---|---|---|---|---|
07TALLINN375 | 2007-06-06 14:24 | 2010-12-06 21:30 | SECRET | Embassy Tallinn |
VZCZCXRO7255
OO RUEHDBU RUEHFL RUEHKW RUEHLA RUEHROV
DE RUEHTL #0375/01 1571424
ZNY SSSSS ZZH
O 061424Z JUN 07
FM AMEMBASSY TALLINN
TO RUEHC/SECSTATE WASHDC IMMEDIATE 9902
INFO RUEHZL/EUROPEAN POLITICAL COLLECTIVE IMMEDIATE
RUEHMO/AMEMBASSY MOSCOW IMMEDIATE 2522
RUEATRS/DEPT OF TREASURY WASHDC IMMEDIATE
RHEFDIA/DIA WASHDC IMMEDIATE
RUCNFB/FBI WASHDC IMMEDIATE
RHMFISS/DEPT OF HOMELAND SECURITY WASHINGTON DC IMMEDIATE
RHMFISS/HQ USEUCOM VAIHINGEN GE IMMEDIATE
RUEKJCS/JOINT STAFF WASHDC IMMEDIATE
RHEHNSC/NSC WASHDC IMMEDIATE
RUEKJCS/SECDEF WASHDC IMMEDIATE
RUEHBS/USEU BRUSSELS IMMEDIATE
RUEHNO/USMISSION USNATO IMMEDIATE 1204
RHEHAAA/WHITE HOUSE WASHDC IMMEDIATE
S E C R E T SECTION 01 OF 04 TALLINN 000375
SIPDIS
DEPT FOR EUR/NB
E.O. 12958: DECL: 06/06/2017
TAGS: PREL PGOV ECON ETRD NATO RS EN
SUBJECT: ESTONIA'S CYBER ATTACKS: LESSONS LEARNED
REF: A) TALLINN 366 B) LEE-GOLDSTEIN EMAIL 05/11/07
B) TALLINN 347
Classified By: Charge d'Affaires Jeff Goldstein for reasons 1.4 (b) & (
d)
¶1. (S) Summary. On April 27, Estonia became the
unprecedented victim of the world's first cyber attacks
against a nation state. Although an analysis of events is
ongoing, this event demonstrated the vulnerability of both
government and private sector internet infrastructure.
Working together with Estonian cyber security experts, the
Ministry of Defense (MOD) is preparing a report analyzing
the crisis, evaluating the strengths and weaknesses of the
Estonian response, and recommend changes to Estonia's cyber
defenses and security. The GOE and Estonian cyber defense
experts all agree that while they successfully responded to
these attacks, they will need to improve Estonia's defenses
to prevent what they described as the nightmare scenario: a
shutdown of Estonia's internet infrastructure as a result
of more serious attacks at some point in the future. End
Summary.
The Nature of the Attacks
-------------------------
¶2. (SBU) Starting on April 27, Estonia became the world's
first victim of cyber attacks against a nation state's
political and economic infrastructure. For over a month,
government, banking, media, and other Estonian websites,
servers, and routers came under a barrage of ever-shifting
and coordinated cyber attacks that tried to shut down
specific strategic targets (Ref A). Unlike traditional
cyber attacks which try to "hack" into a system, the
attacks against Estonian sites used the basic architecture
of the internet to disrupt their operation. At Post's
request XXXXXXXXXXXX visited Tallinn to assess the
situationApril 16-18. XXXXXXXXXXXX opined that it is
not technically feasible to prevent attacks of this nature,
no matter how sophisticated a country's cyber-defenses are.
However, due to Estonia's rapid response, the attacks did
not seriously threaten Estonia's cyber network and infrastructure.
¶3. (C) The cyber attacks exposed the strengths and
weaknesses of Estonia's cyber defense system. XXXXXXXXXXXX
told us that the Ministry of Defense is preparing a report to
submit to the GOE by the end of June. Based on our discussions
with GOE, CERT, and private Estonian cyber security experts,
it is clear that the Estonians are working furiously to analyze
where their cyber defenses and protocols worked, failed, and/or
need improvement. Although these cyber attacks were
unprecedented in nature, our Estonian interlocutors all
agreed that the outcome could have been much worse. They
also note that the MOD's report notwithstanding, the impact
on cyber defense policy for both the public and private
sectors will be discussed and felt for a very long time.
The following is a summary of GOE "lessons learned" from
these attacks.
Lessons Learned: What Worked
----------------------------
¶4. (SBU) STRENGTH IN BEING SMALL. With a population of 1.3
million people, Estonia's small size was its strongest
asset in reacting rapidly to the cyber attacks. Estonia's
CERT, the GOE's Cyber Defense Unit, and private IT Security
Managers all knew each other for years before the crisis
and were, thus, able to work closely together. Information
sharing and decision making were rapid and flexible.
Everything was handled - from the working level to the
leadership - in an almost seamless fashion throughout the
attacks. "We're talking about a group of ten key people in
the government and private sector who've known each other
for years, trust one another, and all have direct access to
TALLINN 00000375 002 OF 004
each other" XXXXXXXXXXXX, commented to us.
"Therefore, there was no inter-agency bureaucracy or
red tape to cut through."
¶5. (C) E-VOTING. In March 2007, Estonia held the world's
first national election where e-voting was used. From the
outset of the crisis, the e-voting security team was
immediately seconded to CERT and became a vital asset in
responding to the attacks. Although Estonia's CERT has
only two full time staff, XXXXXXXXXXXX said he was able
to call upon a roster of 200 programmers and security
experts from the e-voting security team to ensure a 24/7 response
mechanism against incoming cyber attacks. As the e-voting
team was already at work on next generation security
measures (in anticipation for Estonia's 2009 local
elections), there was no need for them to "catch up"
according to XXXXXXXXXXXX. These experts were invaluable
in addressing the wide variety of attacks (e.g., bots, spam,
DDoS, Trojan Horses, etc.).
¶6. (C) INFORMATION GATHERING. Our MOD interlocutors credit
Estonian law enforcement and cyber security experts'
(public and private) close monitoring of Russian-language
internet forums as key to CERT's ability to rapidly respond
to the attacks. On April 28, less than 24 hours after the
first cyber attacks, Russian-language internet forums
(e.g., http://2ch.ru and http://forum.xaker.ru) were
exhorting people to attack specific GOE websites and
offering links to software tools. Patient monitoring of
these internet-forums led to intelligence on targets,
dates, and exact times for coordinated attacks.
XXXXXXXXXXXX told us privately that without this
information, the cyber attacks against GOE sites could hav
inflicted far more damage than they did.
¶7. (C) SECURE ONLINE BANKING. Hansabank and SEB
successfully weathered the cyber attacks against them
because of defensive measures and procedures already in
place. According to CERT, the banks' procedures are in
many ways superior to the GOE's. XXXXXXXXXXXX
said that due to the longstanding problem of cyber crime
in the region - often with banks as prime targets - the banks
were well prepared for the attacks. For example,
XXXXXXXXXXXX told us, organized gangs have
employed bot attacks in the past. As a result, Hansabank
had the necessary cyber security measures in place to defend
against this type of attack.
In the end, Hansabank-s sites successfully repelled every
attack and were able to provide their Estonian customers
access to their online accounts. (Note. Almost 90% of all
financial transactions (e.g., bill payments) are done
online. Hansabank and SEB alone handle over three-fourths
of that traffic. End Note.)
Lessons Learned: What Failed
----------------------------
¶8. (S) FORMAL PROCEDURES. XXXXXXXXXXXX told us
he believes that Estonia-s formal and institutional procedures
for responding to cyber attacks failed completely.
Throughout the crisis, ad hoc meetings and decision making
based on established informal contacts and relationships
were used to disseminate information - instead of
formalized institutional channels with clear communication
chains. Additionally, XXXXXXXXXXXX told us that the GOE
did not keep an official record or log of decisions and actions
taken during the crisis. Consequently, it is uncertain how
thorough the GOE's post-crisis assessment or efforts to
improve Estonia's formal cyber defense procedures will be.
XXXXXXXXXXXX explained that neither CERT nor the GOE
had the personnel to "put out the fire and also act as a secretary
to take down the minutes." (Note: XXXXXXXXXXXX claims
of staff shortages are somewhat questionable given that he
told us that neither he nor any of his staff had to work
over-time during the cyber attacks. End Note.)
¶9. (S) LACK OF CENTRALIZED GOE POLICY. MOD interlocutors
admitted that there was no consistent GOE policy across
TALLINN 00000375 003 OF 004
ministries on cyber security, broadband capacity, and
information sharing. For example, some ministries use
static websites while others use more vulnerable dynamic
websites. Ministries also use different internet providers
which have different security procedures in place. This
unnecessary complexity made initial information sharing
between ministries more cumbersome and confusing,
especially for ministries with fewer resources for IT risk
management (e.g., the Ministry of Population, Ministry of
Education, Ministry of Culture, etc.). XXXXXXXXXXXX,
told us that creating a consistent policy for the various ministries
will be a key recommendation in the MOD's report.
¶10. (S) MONITORING. The cyber attacks also exposed
Estonia's total lack of a comprehensive monitoring system.
Estonia does not have a national IP (internet protocol)
network of sensors to precisely monitor traffic for cyber
attacks. As a result, the GOE and CERT did not have any
hard data on the number of computers and/or servers that
were used in the attacks. XXXXXXXXXXXX, Estonia's main telecommunication and IT provider, told us that his company
relies on U.S.-based Arbor Networks to monitor its network.
Our MOD and private sector interlocutors all agreed on how
important it was for Estonia to have its own monitoring network,
but they could not confirm on the likelihood that the GOE
would invest in this infrastructure upgrade.
¶11. (S) WHACK-A-MOLE. In the initial stages of the cyber
attacks, the Estonian method of response was to block each
and every attack through its corresponding ISP address as
it happened. XXXXXXXXXXXX dubbed this the "whack-a-
mole" response and opined that prior to April 27 this
approach might have been sufficient. However, the sheer
volume of the recent cyber attacks quickly overwhelmed the
Estonian defenses. CERT, Elion, and the GOE's Cyber Defense
Unit were eventually forced to apply broader and more
stringent filtering mechanisms on all internet traffic to
prevent the attacks from entering Estonia. XXXXXXXXXXXX
observed that unlike the United States and many European
Union members who routinely filter foreign internet
traffic, prior to the recent attacks, the Estonian network
filtered very little foreign traffic.
¶12. (S) INDUSTRY VULNERABILITY. While Hansabank and SEB
successfully weathered the cyber attacks, many other
smaller private Estonian sites that were attacked were
overwhelmed. With no industry standard or best practice in
place in Estonia, many smaller businesses and/or private
organizations (e.g., schools, NGOs, etc.) did not have the
technical expertise or financial means to ramp up their
broadband capacity. XXXXXXXXXXXX claimed that CERT's
log of complaints and reported cyber attacks since April 27 is
over 10 Tb (Tera bits). (Note. One TB is equal to one
million Mega bits. To put this in perspective, the entire
content of the online U.S. Library of Congress uses less
than 10 TB. End Note.) As the majority of Estonian (SME)
small and medium size enterprises employ online services as
part of their daily business, the GOE is now aware that an
industry standard with readily available cyber defensive
software, tools, training, and public awareness-raising
must become a part of Estonia's cyber defenses.
Lessons Learned: Nightmare Scenarios
------------------------------------
¶13. (S) TARGETING KEY ROUTERS AND SITES. Our Estonian
interlocutors all agreed that even during the attacks'
peak, Estonia's cyber network was not in any serious danger
of being shut down. In some ways, Estonia was lucky. Rein
Ottis, MOD Cyber Defense Chief, noted that had the attacks
specifically targeted Estonia's key servers and routers,
they could have shut down Estonia's entire cyber
infrastructure. On May 4, two routers belonging to the GOE
and Elion were attacked with an unknown data packet that
crashed the routers almost immediately. XXXXXXXXXXXX
told us that if enough key routers and/or servers were shut down,
it would be the internet "equivalent of blowing up key roads and
TALLINN 00000375 004 OF 004
intersections in the city Tallinn to bring all traffic to a halt."
¶14. (S) UNANNOUNCED AND BETTER TIMED ATTACKS. Most of the
cyber attacks were discussed in advance on Russian-language
internet forums, giving the Estonians the opportunity to
ramp up broadband capacity in advance. XXXXXXXXXXXX
told us that the perpetrators gave away the element of surprise
and often timed their attacks in the evening (when Estonia's
internet usage is at its lowest). Had they not made these
mistakes, XXXXXXXXXXXX opined that the attacks could
have shut down their GOE targets for up to a week.
XXXXXXXXXXXX was thankful that they had advance
information about th May 15 attacks against Hansabank and
SEB. However, many of the attacks which employed bots
were unannounced and far more challenging, and in some
cases did crash their targets. If all attacks had been like this,
XXXXXXXXXXXX and XXXXXXXXXXXX could not
confidently predict whether Estonia's defenses would
have held.
¶15. (S) 2ND TIER STRATEGIC ATTACKS. Estonia's banks were
generally well prepared for cyber attacks. However, the
economic impact could have been worse if the attacks had
focused on 2nd tier strategic targets which possessed less
formidable defenses (Ref B). XXXXXXXXXXXX speculated
the fallout would have been far more significant if Estonia's
logistic-transport companies had been attacked. "As over
three-fourths of all grocery stores, petrol stations, and
shops rely on the internet for their orders and
deliveries," asked XXXXXXXXXXXX, "can you imagine the
damage this would bring? Cyber crime seems abstract to most
people. There's nothing abstract about empty shelves in
stores." XXXXXXXXXXXX also listed a whole range of
other strategic services and businesses that would have been far
easier to crash than the banks. The MOD felt that
XXXXXXXXXXXX descriptions were far fetched, bordering
on "science fiction." However, when we mentioned
XXXXXXXXXXXX's comments to XXXXXXXXXXXX
he felt that recent events have changed the parameters
of the debate on possible threat scenarios. He said,
"Last year, I would've considered a cyber war against my
country as science fiction, too - but not anymore."
GOLDSTEIN