

Currently released so far... 12404 / 251,287
Browse latest releases
2010/12/01
2010/12/02
2010/12/03
2010/12/04
2010/12/05
2010/12/06
2010/12/07
2010/12/08
2010/12/09
2010/12/10
2010/12/11
2010/12/12
2010/12/13
2010/12/14
2010/12/15
2010/12/16
2010/12/17
2010/12/18
2010/12/19
2010/12/20
2010/12/21
2010/12/22
2010/12/23
2010/12/24
2010/12/25
2010/12/26
2010/12/27
2010/12/28
2010/12/29
2010/12/30
2011/01/01
2011/01/02
2011/01/04
2011/01/05
2011/01/07
2011/01/09
2011/01/10
2011/01/11
2011/01/12
2011/01/13
2011/01/14
2011/01/15
2011/01/16
2011/01/17
2011/01/18
2011/01/19
2011/01/20
2011/01/21
2011/01/22
2011/01/23
2011/01/24
2011/01/25
2011/01/26
2011/01/27
2011/01/28
2011/01/29
2011/01/30
2011/01/31
2011/02/01
2011/02/02
2011/02/03
2011/02/04
2011/02/05
2011/02/06
2011/02/07
2011/02/08
2011/02/09
2011/02/10
2011/02/11
2011/02/12
2011/02/13
2011/02/14
2011/02/15
2011/02/16
2011/02/17
2011/02/18
2011/02/19
2011/02/20
2011/02/21
2011/02/22
2011/02/23
2011/02/24
2011/02/25
2011/02/26
2011/02/27
2011/02/28
2011/03/01
2011/03/02
2011/03/03
2011/03/04
2011/03/05
2011/03/06
2011/03/07
2011/03/08
2011/03/09
2011/03/10
2011/03/11
2011/03/13
2011/03/14
2011/03/15
2011/03/16
2011/03/17
2011/03/18
2011/03/19
2011/03/20
2011/03/21
2011/03/22
2011/03/23
2011/03/24
2011/03/25
2011/03/26
2011/03/27
2011/03/28
2011/03/29
2011/03/30
2011/03/31
2011/04/01
2011/04/02
2011/04/03
2011/04/04
2011/04/05
2011/04/06
2011/04/07
2011/04/08
2011/04/09
2011/04/10
2011/04/11
2011/04/12
2011/04/13
2011/04/14
2011/04/15
2011/04/16
2011/04/17
2011/04/18
2011/04/19
2011/04/20
2011/04/21
2011/04/22
2011/04/23
2011/04/24
2011/04/25
2011/04/26
2011/04/27
2011/04/28
2011/04/29
2011/04/30
Browse by creation date
Browse by origin
Embassy Athens
Embassy Asuncion
Embassy Astana
Embassy Asmara
Embassy Ashgabat
Embassy Apia
Embassy Ankara
Embassy Amman
Embassy Algiers
Embassy Addis Ababa
Embassy Accra
Embassy Abuja
Embassy Abu Dhabi
Embassy Abidjan
Consulate Auckland
Consulate Amsterdam
Consulate Adana
American Institute Taiwan, Taipei
Embassy Bujumbura
Embassy Buenos Aires
Embassy Budapest
Embassy Bucharest
Embassy Brussels
Embassy Bridgetown
Embassy Bratislava
Embassy Brasilia
Embassy Bogota
Embassy Bishkek
Embassy Bern
Embassy Berlin
Embassy Belmopan
Embassy Belgrade
Embassy Beirut
Embassy Beijing
Embassy Banjul
Embassy Bangkok
Embassy Bandar Seri Begawan
Embassy Bamako
Embassy Baku
Embassy Baghdad
Consulate Barcelona
Embassy Copenhagen
Embassy Conakry
Embassy Colombo
Embassy Chisinau
Embassy Caracas
Embassy Canberra
Embassy Cairo
Consulate Curacao
Consulate Ciudad Juarez
Consulate Chennai
Consulate Casablanca
Consulate Cape Town
Consulate Calgary
Embassy Dushanbe
Embassy Dublin
Embassy Doha
Embassy Djibouti
Embassy Dili
Embassy Dhaka
Embassy Dar Es Salaam
Embassy Damascus
Embassy Dakar
Consulate Dubai
Embassy Helsinki
Embassy Harare
Embassy Hanoi
Consulate Ho Chi Minh City
Consulate Hermosillo
Consulate Hamilton
Consulate Hamburg
Consulate Halifax
Embassy Kyiv
Embassy Kuwait
Embassy Kuala Lumpur
Embassy Kinshasa
Embassy Kingston
Embassy Kigali
Embassy Khartoum
Embassy Kathmandu
Embassy Kampala
Embassy Kabul
Consulate Kolkata
Embassy Luxembourg
Embassy Luanda
Embassy London
Embassy Ljubljana
Embassy Lisbon
Embassy Lima
Embassy Lilongwe
Embassy La Paz
Consulate Lahore
Consulate Lagos
Mission USOSCE
Mission USNATO
Mission UNESCO
Embassy Muscat
Embassy Moscow
Embassy Montevideo
Embassy Monrovia
Embassy Minsk
Embassy Mexico
Embassy Mbabane
Embassy Maputo
Embassy Manila
Embassy Manama
Embassy Managua
Embassy Malabo
Embassy Madrid
Consulate Munich
Consulate Mumbai
Consulate Montreal
Consulate Monterrey
Consulate Milan
Consulate Melbourne
Embassy Nicosia
Embassy New Delhi
Embassy Ndjamena
Embassy Nassau
Embassy Nairobi
Consulate Naples
Consulate Naha
Embassy Pristina
Embassy Pretoria
Embassy Prague
Embassy Port Of Spain
Embassy Port Louis
Embassy Port Au Prince
Embassy Phnom Penh
Embassy Paris
Embassy Paramaribo
Embassy Panama
Consulate Peshawar
REO Basrah
Embassy Rome
Embassy Riyadh
Embassy Riga
Embassy Reykjavik
Embassy Rangoon
Embassy Rabat
Consulate Rio De Janeiro
Consulate Recife
Secretary of State
Embassy Suva
Embassy Stockholm
Embassy Sofia
Embassy Skopje
Embassy Singapore
Embassy Seoul
Embassy Sarajevo
Embassy Santo Domingo
Embassy Santiago
Embassy Sanaa
Embassy San Salvador
Embassy San Jose
Consulate Strasbourg
Consulate St Petersburg
Consulate Shenyang
Consulate Shanghai
Consulate Sao Paulo
Embassy Tunis
Embassy Tripoli
Embassy Tokyo
Embassy The Hague
Embassy Tel Aviv
Embassy Tehran
Embassy Tegucigalpa
Embassy Tbilisi
Embassy Tashkent
Embassy Tallinn
Consulate Toronto
Consulate Tijuana
USUN New York
USEU Brussels
US Office Almaty
US Mission Geneva
US Interests Section Havana
US Delegation, Secretary
UNVIE
Embassy Ulaanbaatar
Embassy Vilnius
Embassy Vienna
Embassy Vatican
Embassy Valletta
Consulate Vladivostok
Consulate Vancouver
Browse by tag
ASEC
AE
AF
AM
AR
AJ
AU
AORC
AG
AEMR
AMGT
APER
AGMT
AL
AFIN
AO
AMED
ADCO
AS
ABUD
ABLD
ASUP
ASECKFRDCVISKIRFPHUMSMIGEG
APECO
AID
AND
AMBASSADOR
AN
ARM
AY
AODE
AMG
ASCH
AMCHAMS
ARF
APCS
APEC
ASEAN
AGAO
ANET
ADPM
ACOA
ACABQ
AORL
AFFAIRS
ATRN
ACS
AFSI
AFSN
ADANA
ASIG
AA
AX
AUC
AC
AECL
AADP
AGRICULTURE
AMEX
ACAO
ACBAQ
AQ
AORG
ADM
AINF
AIT
ASEX
AGR
AROC
ATFN
AFGHANISTAN
AFU
AER
ALOW
AZ
AVERY
BA
BY
BU
BR
BE
BL
BO
BK
BM
BILAT
BH
BEXP
BF
BTIO
BC
BBSR
BMGT
BTIU
BG
BWC
BB
BD
BX
BP
BRUSSELS
BN
BIDEN
BT
CW
CH
CF
CD
CV
CVIS
CM
CE
CA
CJAN
CLINTON
CIA
CU
CASC
CI
CO
CACM
CDB
CN
CMGT
CS
CG
CBW
CIS
CR
CONDOLEEZZA
CPAS
CAN
CWC
CY
COUNTER
CDG
CL
CT
CIC
CIDA
CSW
CHR
CB
CODEL
COUNTERTERRORISM
CTR
COM
CICTE
CFED
CJUS
CKGR
CBSA
CEUDA
CARSON
CONS
CITEL
CLMT
CROS
CITT
CAC
CVR
CDC
CAPC
COPUOS
CBC
CBE
CARICOM
COE
COUNTRY
CLEARANCE
CACS
CTM
CNARC
ECON
EFIN
ETRD
EUN
EFIS
EG
ETTC
EZ
EPET
EAID
EAGR
ENRG
ECUN
EU
ELAB
ECPS
EAIR
EINV
ELTN
EWWT
EIND
EMIN
EI
ECIN
ENVR
ELECTIONS
EINVEFIN
EN
ES
ER
EC
EUC
EINT
EINVETC
ENGR
ET
EK
ENIV
ETRDEINVECINPGOVCS
ECONOMY
EAP
EFTA
EUR
EUMEM
EXIM
ERD
ENERG
EUREM
ESA
ERNG
EXTERNAL
EPA
EINVECONSENVCSJA
ECONOMICS
ELN
EINN
EFINECONCS
ENNP
EEPET
ETRDEINVTINTCS
ENVI
ETRO
ESENV
ECINECONCS
ECONOMIC
EAIDS
EDU
ETRA
ETRN
EFIM
EIAR
ETRC
EAIG
EXBS
EURN
ECIP
EREL
ECA
ENGY
ECONCS
ECONEFIN
ETC
ETRDECONWTOCS
EUNCH
EINDETRD
IR
IZ
IS
IAEA
INRB
IRAJ
IQ
IN
IT
IMO
INTERPOL
ICAO
IO
IC
ITALY
ITALIAN
IRAQI
ICTY
ID
IPR
IWC
ILC
INTELSAT
IL
IBRD
IMF
IA
IRC
ICRC
ILO
ITU
ITRA
IV
IDA
IAHRC
ICJ
ISRAELI
IRS
INMARSAT
ISRAEL
ISLAMISTS
INDO
IZPREL
ITPHUM
ITPGOV
ITF
IBET
IEFIN
INR
IACI
INTERNAL
IDP
IGAD
IEA
ICTR
IIP
INRA
INRO
IF
KJUS
KSCA
KNNP
KU
KCOR
KCRM
KDEM
KTFN
KHLS
KPAL
KWBG
KACT
KGHG
KPAO
KTIA
KIRF
KWMN
KS
KG
KZ
KN
KMDR
KISL
KSPR
KHIV
KPRP
KAWK
KR
KUNR
KDRG
KCIP
KGCC
KTIP
KSUM
KPKO
KVIR
KAWC
KPIN
KGIC
KRAD
KIPR
KOLY
KCFE
KMCA
KE
KV
KICC
KNPP
KBCT
KSEP
KFRD
KFLU
KVPR
KOCI
KBIO
KSTH
KMPI
KCRS
KOMC
KTBT
KPLS
KIRC
KREL
KFRDKIRFCVISCMGTKOCIASECPHUMSMIGEG
KFLO
KBTS
KSTC
KTDB
KFSC
KX
KFTFN
KNEI
KIDE
KREC
KMRS
KICA
KPAONZ
KCGC
KSAF
KRGY
KCMR
KRVC
KVRP
KSEO
KCOM
KAID
KTEX
KNUC
KNAR
KNUP
KNNPMNUC
KLIG
KFRDCVISCMGTCASCKOCIASECPHUMSMIGEG
KCRCM
KHDP
KGIT
KNSD
KOMS
KWMM
KPAI
KHSA
KTLA
KO
KMFO
KRCM
KCSY
KSAC
KTRD
KPWR
KID
KWNM
KRIM
KPOA
KCHG
KOM
KSCI
KFIN
KMOC
KESS
KWAC
KMIG
KSEC
KIFR
KDEMAF
KPRV
KBTR
KERG
KTER
KDDG
KPAK
KRFD
KHUM
KDEV
KCFC
KWWMN
KWMNCS
KJUST
MARR
MOPS
MU
MTCRE
MNUC
MY
MASS
MCAP
MOPPS
MAR
MPOS
MO
ML
MR
MASC
MX
MD
MP
MA
MTRE
MIL
MCC
MZ
MK
MDC
MRCRE
MAPS
MV
MI
MEPN
MAPP
MEETINGS
MAS
MTS
MLS
MILI
MTCR
MG
MC
MARAD
MIK
MILITARY
MEDIA
MEPI
MUCN
MEPP
MT
MERCOSUR
MW
MASSMNUC
MQADHAFI
NZ
NATO
NG
NI
NO
NATIONAL
NU
NPT
NIPP
NL
NPG
NS
NA
NGO
NP
NSG
NDP
NAFTA
NR
NC
NH
NE
NSF
NPA
NK
NSSP
NRR
NATOPREL
NSC
NT
NW
NORAD
NEW
NV
NSFO
NAR
NASA
NZUS
OTRA
OVIP
OPRC
OPDC
OSCE
OAS
ODIP
OIIP
OFDP
OVP
OREP
OFFICIALS
OSAC
OEXC
OPCW
OIE
OIC
OFDA
OSCI
OPIC
OBSP
OECD
ON
OCII
OHUM
OES
OCS
OMIG
OPAD
OTR
PGOV
PREL
PHUM
PINR
PTER
PSOE
PINS
PARM
PK
PBTS
PEPR
PM
POLITICAL
PARTIES
PREF
PBIO
PROP
PA
PSI
PINT
PO
PKFK
PL
PAK
PE
POLITICS
PINL
POL
PHSA
PU
PF
POV
PFOR
PHALANAGE
PARTY
PARMS
PRGOV
PNAT
POLINT
PRAM
PMAR
PG
PAO
PROG
PRELP
PPA
PCUL
PSEPC
PSA
PREO
PAHO
PGIV
PREFA
PALESTINIAN
PAIGH
POSTS
PTBS
PGOVLO
PORG
PGOVE
PLN
PINF
PAS
PUNE
POLICY
PDEM
PDOV
PCI
PGOVSMIGKCRMKWMNPHUMCVISKFRDCA
PBT
PHUMPGOV
PMIL
PNG
PP
PS
PHUH
PECON
POGOV
PY
PHUMPREL
PHUS
PRL
PGOC
PNR
PGGV
PROV
PTERE
PGOF
PHUMBA
PEL
RS
RU
RW
REGION
RP
RICE
ROBERT
RSP
RUPREL
RM
RO
RCMP
RSO
RELATIONS
REACTION
REPORT
RIGHTS
ROOD
RF
RFE
RIGHTSPOLMIL
SP
SA
SY
SF
SYR
SENV
SCUL
SOCI
SNAR
SO
SU
SG
STEINBERG
SHUM
SW
SMIG
SR
SZ
SIPRS
SI
SAARC
SPCE
SARS
SN
SYRIA
SANC
SL
SCRS
SC
SENVKGHG
SAN
SNARCS
SHI
SWE
SNARIZ
SIPDIS
SEN
SNARN
SPCVIS
SEVN
SSA
SH
SOFA
SK
ST
TPHY
TU
TRGY
TI
TX
TS
TW
TC
TFIN
TD
TSPA
TH
TT
TIP
TBIO
TSPL
TZ
TERRORISM
TRSY
TN
THPY
TINT
TF
TL
TV
TK
TO
TP
TURKEY
TNGD
TBID
TAGS
TR
UP
US
UNSC
UK
UZ
UE
UNESCO
UV
UNGA
UN
UNMIK
UNO
UY
UAE
UNEP
UG
UNHCR
UNHRC
USUN
UNAUS
USTR
USNC
USOAS
UNCHR
UNCSD
UNDP
USEU
USPS
UNDC
UNDESCO
UNCHC
UNFICYP
UNC
UNODC
UNPUOS
UNCND
UNICEF
UNCHS
UNVIE
USAID
UNIDROIT
Browse by classification
Community resources
courage is contagious
Viewing cable 07TALLINN366, ESTONIA'S CYBER ATTACKS: WORLD'S FIRST VIRTUAL
If you are new to these pages, please read an introduction on the structure of a cable as well as how to discuss them with others. See also the FAQs
Understanding cables
Every cable message consists of three parts:
- The top box shows each cables unique reference number, when and by whom it originally was sent, and what its initial classification was.
- The middle box contains the header information that is associated with the cable. It includes information about the receiver(s) as well as a general subject.
- The bottom box presents the body of the cable. The opening can contain a more specific subject, references to other cables (browse by origin to find them) or additional comment. This is followed by the main contents of the cable: a summary, a collection of specific topics and a comment section.
Discussing cables
If you find meaningful or important information in a cable, please link directly to its unique reference number. Linking to a specific paragraph in the body of a cable is also possible by copying the appropriate link (to be found at theparagraph symbol). Please mark messages for social networking services like Twitter with the hash tags #cablegate and a hash containing the reference ID e.g. #07TALLINN366.
Reference ID | Created | Released | Classification | Origin |
---|---|---|---|---|
07TALLINN366 | 2007-06-04 14:02 | 2010-12-06 21:09 | SECRET | Embassy Tallinn |
VZCZCXRO4489
OO RUEHDBU RUEHFL RUEHKW RUEHLA RUEHROV
DE RUEHTL #0366/01 1551427
ZNY SSSSS ZZH
O 041427Z JUN 07
FM AMEMBASSY TALLINN
TO RUEHC/SECSTATE WASHDC IMMEDIATE 9880
INFO RUEHZL/EUROPEAN POLITICAL COLLECTIVE IMMEDIATE
RUEHMO/AMEMBASSY MOSCOW IMMEDIATE 2513
RUEHBS/USEU BRUSSELS IMMEDIATE
RUEKJCS/SECDEF WASHDC IMMEDIATE
RUENAAA/SECNAV WASHINGTON DC IMMEDIATE
RUEHNO/USMISSION USNATO IMMEDIATE 1194
RUEHVEN/USMISSION USOSCE IMMEDIATE 0480
RHEFDIA/DIA WASHDC IMMEDIATE
RHMFISS/DEPT OF HOMELAND SECURITY WASHINGTON DC IMMEDIATE
RUEKJCS/JOINT STAFF WASHDC IMMEDIATE
RHEHNSC/NSC WASHDC IMMEDIATE
RHEHAAA/WHITE HOUSE WASHDC IMMEDIATE
S E C R E T SECTION 01 OF 04 TALLINN 000366
SIPDIS
SIPDIS
DEPT FOR EUR/NB
E.O. 12958: DECL: 06/04/2017
TAGS: PREL PGOV ECON ETRD NATO RS EN
SUBJECT: ESTONIA'S CYBER ATTACKS: WORLD'S FIRST VIRTUAL
ATTACK AGAINST NATION STATE
REF: A) TALLINN 276 B) TALLINN 280 C) TALLINN 347 D)
LEE-GOLDSTEIN EMAIL 05/11/07
Classified By: Ambassador S. Dave Phillips for reasons 1.4 (b) & (d)
¶1. (S) Summary. Since April 27, Estonia has been the
victim of the world's first coordinated cyber attacks
against a nation state and its political and economic
infrastructure. The sensational nature of the story,
combined with the highly technical details of the subject
matter, has led to a good deal of misinformation in the
public domain. Although GOE and international analysis
is ongoing, these attacks have highlighted the
vulnerability of both government and private sector
internet infrastructure to attacks of this nature. For
over a month, government, banking, media, and other
Estonian websites, servers, and routers came under a
barrage of cyber attacks. Defense against the attacks
was extremely expensive for both GOE and the private
sector. GOE and private cyber defense experts cite the
nature and sophistication of the attacks as proof of
Russian government complicity in the attacks. End
Summary.
Virtual Shots Heard Round the World
-----------------------------------
¶2. (C) Cyber attacks against Estonian websites began on
April 27. They came in the wake of rioting in Tallinn
triggered by the Government of Estonia's (GOE)
preparations for relocating the so called "Bronze
Soldier", a Soviet-era World War II monument (Refs A and
B). The attacks initially targeted GOE websites
including those of the Estonian President, Prime
Minister, Ministry of Foreign Affairs (MFA), Ministry of
Justice (MOJ), and Parliament, among others. According
to XXXXXXXXXXXX the initial attacks were
technically unsophisticated and "seemed more like a cyber
riot than a cyber war." However, all our Estonian
interlocutors clearly recognized these attacks as
political in nature. Russian-language internet chat
forums held discussions exhorting people to attack
Estonian sites and supplied downloadable software tools
to carry out the attacks. According to XXXXXXXXXXXX, these
initial attacks were limited to spam (a barrage of
unsolicited emails) and cyber vandalism (e.g., Prime
Minister Andrus Ansip's photo was defaced on the Estonian
Reform Party's website) and appeared to be nothing more
than a virtual mob reaction to the Bronze Soldier issue.
Estonian media and press commentators were quick to
accuse Moscow of being responsible, interpreting these
attacks as part of Russian retribution for moving the
Bronze Soldier (Ref C).
¶3. (S) However, on April 30, a broader range of cyber
attacks -- from simple spam postings to coordinated DDoS
(Distributed Denial-of-Service) attacks -- began against
GOE sites. (Note. A DDoS attack is when a flood of
bogus queries are made to a specific server or network of
computers in order to over-saturate the target and
prevent access by legitimate users. End Note.) For
example, the Presidential website, which normally has a 2
million Mbps (megabits per second) capacity, was flooded
with nearly 200 million Mbps of traffic. While none of
the technology involved in the attacks was new, tactics
and tools routinely shifted to prevent Estonian
authorities from blocking the attacks. One of the most
pernicious tools in these attacks was "bots." (Note.
Bots are computers and/or servers under the control of a
third party. End Note.) These bot attacks came from
ISPs (internet service providers) around the world (e.g.,
the United States, Canada, Russia, Turkey, Germany,
Belgium, Egypt, Vietnam, etc.). Attacks routinely came
from one set of bots, subsided and then resumed again
using another set of bots with different ISPs. According
to XXXXXXXXXXXX, the attacks ranged from a single
minute to many hours in length. The longest attacks lasted
TALLINN 00000366 002 OF 004
over ten hours and unleashed a crushing 90 million Mbps of
traffic on targeted endpoints. According to XXXXXXXXXXXX,
the GOE's assessment was that a small but unknown number
of individuals were behind these more sophisticated cyber
attacks, which quickly dwarfed the traffic volume of the
initial cyber rioters.
¶4. (S) On May 3, the cyber attacks expanded beyond GOE
sites and servers to private sites. Hansabank and SEB,
Estonia's two largest banks, faced the most significant
problems. Swedish-owned Hansabank and SEB account for
almost 75% of all online banking in Estonia. (Note:
Approximately 90% of all money transfers and bill
payments in Estonia are done online. End Note.)
Hansabank was well prepared with powerful servers,
alternate sites to mirror content (thus making it more
difficult for DDoS attacks), and the ability to
reallocate access lines from foreign to domestic
customers. However, even though Hansabank's site
remained online, XXXXXXXXXXXX estimated that it came
at a cost - - at least 10 million Euros ($13.4 million)
Hansabank also had to temporarily block access to its site by all
foreign ISPs so that there was enough broadband capacity
for its domestic clients. However, Hansabank was able to
create alternate access mechanisms for its largest
foreign customers. Correcting much of the press coverage
in the early days of the attacks, XXXXXXXXXXXX
said that while the cyber attacks against Hansabank and SEB were a
challenge, there was no serious danger of Estonia's
banking sector being shut down.
¶5. (S) This second wave of cyber attacks also hit the
websites of Postimees, Estonia's paper of record, and
Eesti Paevaleht, a leading Estonian-language daily, which
over two-thirds of Estonians regularly visit for their
news. "Imagine if you can the psychological effect,"
XXXXXXXXXXXX asked us, "when an Estonian tries to
pay his bills but can't or get the news online but can't." As
one of the most wired countries on the planet, GOE
interlocutors viewed the evolution of the attacks as a
frightening threat to key economic and societal
infrastructure.
¶6. (S) The attacks reached their apex on May 9, the
Russian anniversary of the end of World War II. To cope
with the rising volume of attacks, the GOE increased its
broadband capacity from two Gbps (Gigabites per second)
to eight Gbps. Hansabank, SEB, Postimees, and others
also added servers to increase broadband capacity. A
EUCOM cyber defense expert described it as a "cyber arms
race" where the Estonians repeatedly increased their
broadband capacity to match the increasing volume of
cyber attacks (Ref D). XXXXXXXXXXXX told us that XXXXXXXXXXXX
increased the "broadband pipe" for both government and private
clients at a frantic pace to keep up with the attacks.
XXXXXXXXXXXX told us that one GOE ministry increased
its original server capacity of 30 Mbps to 1 Gbps (1 Gbps
equals 1000 Mbps). XXXXXXXXXXXX said that this defensive
response by the GOE and the private sector was ultimately
successful, but it was extremely expensive.
¶7. (S) The number of attacks steadily declined after May
9 and 10, allowing GOE and private sites to reduce their
broadband capacity. However, on May 15, there was an
unexpected spike in attacks that focused on Hansabank and
SEB. In two separate and coordinated 15 minute attacks,
these two sites were hit with over 400 bot attacks
(roughly half the number of bot attacks recorded on May
10) from multiple ISPs. The attacks temporarily crashed
SEB's site for 30 minutes. Since the May 15 spike, the
number of attacks has declined and is now hovering
slightly above pre-April 27 numbers.
No Smoking Gun
TALLINN 00000366 003 OF 004
¶8. (S) On May 2, Foreign Minister Urmas Paet released a
statement that the MFA had proof that some of the attacks
originated from GOR ISPs. The Estonian and international
press carried Paet's claim, but XXXXXXXXXXXX interlocutors
distanced themselves from the accusation.
XXXXXXXXXXXX privately said to us that no "smoking gun"
incriminating Moscow has turned up and likely won't.
The use of bots, proxies, and spoofing tactics makes it
extremely difficult to determine with any certainty the origin
of the attacks. Press reports suggested that a million
computers were involved in the attacks. However,
XXXXXXXXXXXX admitted that due to Estonia's poor
monitoring capability, XXXXXXXXXXXX could only speculate on the
number of computers and servers attacking Estonia, and had
even less specific information on the origins of the attacks.
(Note. XXXXXXXXXXXX said that the one million figure
used by the press and the GOE was from a quote to the press
taken out of context in which he tried to explain how he could
only speculate a number ranging from a 1000 to a million
computers. End Note.)
¶9. (S) The GOE believes it has enough circumstantial
evidence to link Moscow with the attacks. As President
Ilves told the Ambassador, renting the large number of
bots used in these attacks is an expensive business.
Moreover, as XXXXXXXXXXXX repeatedly asked us in
conversations, "Who benefits from these attacks?" He
speculated that the probing nature of the attacks on
specific government and strategic private sector targets
through the use of anonymous proxies fit the modus
operandi of the Putin regime testing a new "weapon."
XXXXXXXXXXXXX told us that the GOE now feels that their original
assessment of a "cyber riot" may have been incorrect.
"Looking at the patterns of the attacks, it is clear that
there was a small, core of individuals who intended to
launch their attack on May 9," XXXXXXXXXXXX explained, "but
when the MOD announced its plans to move the Bronze
Soldier on April 27, they moved up their plans to try to
link the attacks with the monument's removal." Estonian
analysis of these later sophisticated attacks and
organization through Russian-language internet forums has
led them to believe that the key individuals tried to
disguise their initial attacks as a cyber riot. "You
don't expect spontaneous, populist cyber attacks to have
a pre-determined list of targets and precise dates and
times for coordinated attacks," said XXXXXXXXXXX.
¶10. (S) GOE interlocutors expressed their frustration
that their requests for information from the GOR or
action on Russian-based ISP attacks were not answered or
acted upon. XXXXXXXXXXX complained that cooperation
with Russia's CERT was almost nonexistent. Even at the height
of the Bronze Soldier controversy, GOE interlocutors who
regularly work with their Russian counterparts (e.g., law
enforcement, customs and tax, border guards, etc.) tell
us that working level cooperation was positive. In
comparison, the lack of responsiveness by the GOR and
Russian CERT personnel only diminished Russia's claims of
innocence in the eyes of the Estonians.
¶11. (S) On May 29, Konstantin Koloskokov, Commissar of
the pro-Kremlin youth group Nashi in Transnistria,
claimed responsibility for some of the early cyber
attacks. While not discounting the possibility of his
involvement, XXXXXXXXXXXX noted that some of the
attacks were extremely sophisticated; beyond the technical
abilities of an amateur. To illustrate the point, XXXXXXXXXXXX
and XXXXXXXXXXXX described an attack that used a mysterious
data packet to crash a GOE and Elion router so quickly that
the Estonians are still uncertain how it was done.
XXXXXXXXXXXX described in detail a number of
additional attacks using different tools and techniques
and targets to argue that an organized group with deep
financial backing was the likeliest culprit. "Koloskokov is
window dressing," said XXXXXXXXXXXX, "a convenient
set-up by the real perpetrators."
TALLINN 00000366 004 OF 004
PHILLIPS