Lessons from the cyberattacks on Estonia

It's been a little more than a year since botnets temporarily disabled Estonia's government Web sites in an incident that could go down in history as the cyberattacks heard round the world.

Lauri Almann, Estonia's permanent undersecretary of Defence, was part of the team that responded to the attacks. He was in Washington recently to discuss how to guard against future attacks and the steps Estonia is taking to prepare for what he believes could be an even more debilitating assault the next time. The following is an excerpt of the interview.

GCN: Where were you when it became clear that the cyberattacks on Estonia were more than just a random assault? And how did the Ministry of Defence respond?

Lauri Almann: We were sitting in the government situation room, and suddenly in walks our chief [public relations] person, who says, 'We are unable to put our press releases out' on government Web sites. We didn't understand the seriousness of the problem until he said, 'We are under cyberattack.' It was 1 a.m., 28th of April.

Immediately after we realized there was an attack going on against Estonia, we put together a team of experts from our departments of commerce, communications, military and the intelligence community, led by Estonian CERT, the Computer Emergency Response Team, which coordinated the overall response. The role of the Ministry of Defence was to organize international support. We were particularly successful in defeating some of those attacks because we were so quick to organize. We were also quite quick to put out the alerts to other CERTs around the world and organize an international response.

GCN: Describe how the attacks unfolded.

Almann: We experienced two phases of attacks. The first phase was carried out by what we call hacktivists. Relatively primitive and simple attack tools were used against Estonia by ordinary people who are instructed to attack Estonia mostly on Russian Web sites and those on which the attack tools were posted. Those attack tools were designed against Estonian Web sites ' and mostly government Web sites, such as the Estonian government Briefing Room, Estonian Ministry of Defense and certain leading parties in Estonia. But the organizers were not able to come up with a sufficient amount of people taking part in those attacks. And at some point, there was a general fatigue.

The second phase of the attacks used much more sophisticated attack tools ' mainly botnets. This is a rough estimate, but [we've learned] the attacks came from 75 or more jurisdictions using 1 million or more computers.

The fascinating thing about this is that the people who owned those computers actually had no idea they were attacking another government. The notion of a personal computer is really counterintuitive. There is no such thing as a personal computer. Everyone's computer can be used to attack another country.

GCN: Have you been able to confirm who was behind the attacks?

Almann: With botnets, attribution is relatively difficult. But we have analyzed the traffic, and we can state with certainty that the attacks were carried out by a well-organized group. The attacks had the features of central command and control. Attacks came in waves. The attacks required financial but also intellectual resources. They were fairly sophisticated.

For example, when we started to [shut down] botnets with the help of the [European Union] and the United States, the people herding the botnets were so smart that they moved them to less friendly or less advanced jurisdictions that had no way of cooperating with us.

GCN: Does the Estonian government's relatively new and modern network infrastructure make it more or less vulnerable to those kinds of attacks?

Almann: Estonia relies heavily on all kinds of e-services. We have'a lot of online banking ' 97 percent of all banking transactions take place online; we completely skipped the checkbook phase ' and a lot of other online services. So yes, we can say that because of that heavy reliance, Estonia is more vulnerable to attacks. And so are other countries that are more technologically advanced. But because of this, we also luckily had people who were thinking about the threats in cyberspace.

GCN: How did your infrastructure allow you to combat the attacks?

Almann: What we had to do as a response to those attacks was to incrementally increase our Internet throughput capacity in cooperation with other countries. We had to do that incrementally because there was intelligence activity going on all the time in our Web space. We identified several ping messages being sent to measure our Internet throughput capacity. When that was measured, then the attacks were organized accordingly. Therefore, we had to be one step ahead and not reveal our real capacity to increase our throughput.

GCN: Looking back, what might you and your peers have done differently in setting up the government networks?

Almann: There are a lot of lessons to learn from the attacks. One is that we were able to come up with a team of people that was able to start working on the attacks very fast. Although we have excellent relations with the United States and all the EU countries, having an international preparedness to deal with an attack like that is something that we are now paying more attention to.

Another important lesson is that the next attack is going to be more severe. It's going to be more painful. We don't have to prepare for the last war; we have to prepare for the next war and figure out what [our adversaries] might use.

GCN: What other measures has the Estonian government taken in the past year to try to improve the security of its systems and the ability to operate during a major outage?

Almann: We have taken a number of measures. We have strengthened our cyber emergencies response team.

We have signed agreements with major Estonian banks, service providers and telecommunications companies to cooperate in an event like this. We have started several initiatives in NATO and with the European Commission to cooperate with the private sector.

And we have also launched our own national cyberdefense strategy, in which we identify the critical information infrastructure and come up with solutions to defend it.

There are various [technology measures] we can also [implement]: We can make our backbone Internet infrastructure much more robust. We can expand our connections to the World Wide Web so our Internet throughput capacity would be more difficult to overwhelm. We could better integrate various e-services the government provides. We have a method of integrating government e-services, called X-Road, a facility that connects most of the government databases that are available online and provides tools to operate and control them centrally.

And last but not least is to expand and further invest in the capability to detect cyberattacks. Because this is very critical ' countries have to know when a cyberattack has hit.

GCN: Looking ahead, what are the one or two most important activities you're focusing on to continue to improve Estonia's systems and services?

Almann: The right to use the Internet is almost a human right that the government has to guarantee. We also believe e-services bring the government closer to the people. E-elections have tremendously increased turnouts in elections, especially among younger generations. We shouldn't let the attacks affect our way of life. But we need to deal with those threats and learn from them.

The chief lesson is that we shouldn't prepare for the last war. We should think about what could hit any country next time. There will be a next cyberattack. And governments need to cooperate to overcome those threats.