2021 . 06 . 25

How Russian threats in the 2000s turned this country into the go-to expert on cyber defense

When people like the German Chancellor Angela Merkel or the King of Belgium want to learn more about cybersecurity, they go to Estonia.

The Baltic country runs on the internet. From filing taxes and voting, to registering the birth of a new baby, nearly everything a person might want or need from the government can be done online. It's an approach that's incredibly convenient for Estonia's 1.3 million people -- but it also requires high level of cybersecurity.

Luckily for its residents, Estonia is punching way above its weight when it comes to online safety. It regularly places on top of security rankings. Its capital city of Tallinn is home to NATO's cyber defense hub, the Cooperative Cyber Defence Centre of Excellence. When it took up the rotating presidency of the United Nations Security Council last year, it made cybersecurity one of the policy priorities.

"Estonia digitized a lot sooner than other countries, it was focusing on things like online schooling and online government services and it took a more proactive approach to technology," said Esther Naylor, a international security research analyst at Chatham House.

"And it recognized that it needs to be a secure country in order for citizens to want to use online systems and for businesses to want to do business in Estonia ... and I think that this is why Estonia's approach is often heralded as the model approach," she added.

A new European Union report obtained by CNN last week showed serious cyberattacks against critical targets in Europe have doubled in the past year. There have also been a series of high-profile attacks on US targets in recent weeks. The issue came up during a high-stakes summit between the US President Joe Biden and his Russian counterpart Vladimir Putin on Wednesday.

Biden said he told Putin that certain areas of "critical infrastructure" should be off-limits for cyberattacks, and warned the Russian leader that the US had "significant cyber capability" and would respond to any further incursions. Putin told reporters the two leaders had agreed to start consultations on the issue.

Estonia is no stranger to the cyber threat posed by Russia. Back in 2007, a decision to relocate a Soviet-era war memorial from central Tallinn to a military cemetery sparked a diplomatic spat with its neighbor and former overlord. There were protests and angry statements from Russian diplomats. And just as the removal works started, Estonia became the target of what was at the time the biggest cyberattack against a single country.

The Estonian government called the incident an act of cyberwarfare and blamed Russia for it. Moscow has denied any involvement.

The attack made Estonia realize that it needed to start treating cyber threats in the same way as physical attacks.

At that time, the country was already a leader in e-government, having introduced services like online voting and digital signatures. While no data was stolen during the incident, the websites of banks, the media and some government services were targeted with distributed denial of service attacks that lasted for 22 days. Some services were disrupted, while others were taken down completely.

"We saw what would happen if our precious systems that we really loved were down," said Birgy Lorenz, a cybersecurity scientist at Tallinn University of Technology. "We started to understand that fake news is really important and that people can be manipulated, and that we have to protect our systems better -- and that this is not only about the systems, but also about understanding the role people play in the systems."