Cable Viewer

Currently released so far... 6236 / 251,287

### Articles

Brazil Sri Lanka United Kingdom Sweden Editorial United States Latin America Egypt Yemen Jordan

### Browse latest releases

2010/11 2010/12 2011/01 2011/02 2011/03
2010/11/28 2010/11/29 2010/11/30
2010/12/01 2010/12/02 2010/12/03 2010/12/04 2010/12/05 2010/12/06 2010/12/07 2010/12/08 2010/12/09 2010/12/10 2010/12/11 2010/12/12 2010/12/13 2010/12/14 2010/12/15 2010/12/16 2010/12/17 2010/12/18 2010/12/19 2010/12/20 2010/12/21 2010/12/22 2010/12/23 2010/12/24 2010/12/25 2010/12/26 2010/12/27 2010/12/28 2010/12/29 2010/12/30
2011/01/01 2011/01/02 2011/01/04 2011/01/05 2011/01/07 2011/01/09 2011/01/10 2011/01/11 2011/01/12 2011/01/13 2011/01/14 2011/01/15 2011/01/16 2011/01/17 2011/01/18 2011/01/19 2011/01/20 2011/01/21 2011/01/22 2011/01/23 2011/01/24 2011/01/25 2011/01/26 2011/01/27 2011/01/28 2011/01/29 2011/01/30 2011/01/31
2011/02/01 2011/02/02 2011/02/03 2011/02/04 2011/02/05 2011/02/06 2011/02/07 2011/02/08 2011/02/09 2011/02/10 2011/02/11 2011/02/12 2011/02/13 2011/02/14 2011/02/15 2011/02/16 2011/02/17 2011/02/18 2011/02/19 2011/02/20 2011/02/21 2011/02/22 2011/02/23 2011/02/24 2011/02/25 2011/02/26 2011/02/27 2011/02/28
2011/03/01 2011/03/02 2011/03/03 2011/03/04 2011/03/05 2011/03/06 2011/03/07 2011/03/08 2011/03/09 2011/03/10 2011/03/11 2011/03/13 2011/03/14 2011/03/15 2011/03/16 2011/03/17 2011/03/18 2011/03/19 2011/03/20 2011/03/21 2011/03/22

### Browse by creation date

66 72 73 75 79 85 86 88 89 90 00 01 02 03 04 05 06 07 08 09 10
1966/12
1972/02 1972/08
1973/04
1975/03
1979/08
1985/03
1986/05
1988/01
1989/12
1990/01 1990/07 1990/08 1990/10
2000/06 2000/09 2000/11
2001/02 2001/03 2001/07 2001/10 2001/11
2002/02 2002/03 2002/04 2002/07 2002/11 2002/12
2003/02 2003/03 2003/04 2003/05 2003/06 2003/07 2003/08 2003/09 2003/10 2003/11 2003/12
2004/01 2004/02 2004/03 2004/04 2004/05 2004/06 2004/07 2004/08 2004/09 2004/10 2004/11 2004/12
2005/01 2005/02 2005/03 2005/04 2005/05 2005/06 2005/07 2005/08 2005/09 2005/10 2005/11 2005/12
2006/01 2006/02 2006/03 2006/04 2006/05 2006/06 2006/07 2006/08 2006/09 2006/10 2006/11 2006/12
2007/01 2007/02 2007/03 2007/04 2007/05 2007/06 2007/07 2007/08 2007/09 2007/10 2007/11 2007/12
2008/01 2008/02 2008/03 2008/04 2008/05 2008/06 2008/07 2008/08 2008/09 2008/10 2008/11 2008/12
2009/01 2009/02 2009/03 2009/04 2009/05 2009/06 2009/07 2009/08 2009/09 2009/10 2009/11 2009/12
2010/01 2010/02

### Browse by origin

A B C D F G H I J K L M N O P Q R S T U V W Y Z
Embassy Athens Embassy Asuncion Embassy Astana Embassy Asmara Embassy Ashgabat Embassy Ankara Embassy Amman Embassy Algiers Embassy Addis Ababa Embassy Accra Embassy Abuja Embassy Abu Dhabi Embassy Abidjan Consulate Amsterdam American Institute Taiwan, Taipei
Embassy Bujumbura Embassy Buenos Aires Embassy Budapest Embassy Bucharest Embassy Brussels Embassy Bridgetown Embassy Bratislava Embassy Brasilia Embassy Bogota Embassy Bishkek Embassy Bern Embassy Berlin Embassy Belgrade Embassy Beirut Embassy Beijing Embassy Banjul Embassy Bangkok Embassy Bandar Seri Begawan Embassy Bamako Embassy Baku Embassy Baghdad Consulate Barcelona
Embassy Copenhagen Embassy Conakry Embassy Colombo Embassy Chisinau Embassy Caracas Embassy Canberra Embassy Cairo Consulate Curacao Consulate Ciudad Juarez Consulate Chennai Consulate Casablanca Consulate Cape Town
Embassy Dushanbe Embassy Dublin Embassy Doha Embassy Djibouti Embassy Dhaka Embassy Dar Es Salaam Embassy Damascus Embassy Dakar Consulate Dubai
Embassy Freetown
Embassy Guatemala Embassy Gaborone Consulate Guadalajara
Embassy Helsinki Embassy Harare Embassy Hanoi Consulate Hermosillo Consulate Hamburg
Iran RPO Dubai Embassy Islamabad Consulate Istanbul
Embassy Jakarta Consulate Jerusalem Consulate Jeddah
Embassy Kyiv Embassy Kuwait Embassy Kuala Lumpur Embassy Kinshasa Embassy Kigali Embassy Khartoum Embassy Kathmandu Embassy Kampala Embassy Kabul Consulate Kolkata
Embassy Luxembourg Embassy Luanda Embassy London Embassy Ljubljana Embassy Lisbon Embassy Lima Embassy Lilongwe Embassy La Paz Consulate Lagos
Mission USNATO Embassy Muscat Embassy Moscow Embassy Montevideo Embassy Monrovia Embassy Minsk Embassy Mexico Embassy Mbabane Embassy Maputo Embassy Manama Embassy Managua Embassy Malabo Embassy Madrid Consulate Munich Consulate Mumbai Consulate Montreal Consulate Monterrey Consulate Milan
Embassy New Delhi Embassy Nassau Embassy Nairobi Consulate Naples
Embassy Ouagadougou Embassy Ottawa Embassy Oslo
Embassy Pristina Embassy Pretoria Embassy Prague Embassy Port Au Prince Embassy Phnom Penh Embassy Paris Embassy Paramaribo Embassy Panama Consulate Peshawar
Embassy Quito
REO Basrah Embassy Rome Embassy Riyadh Embassy Riga Embassy Reykjavik Embassy Rangoon Embassy Rabat Consulate Rio De Janeiro Consulate Recife
Secretary of State Embassy Stockholm Embassy Sofia Embassy Skopje Embassy Singapore Embassy Seoul Embassy Sarajevo Embassy Santo Domingo Embassy Santiago Embassy Sanaa Embassy San Salvador Embassy San Jose Consulate Strasbourg Consulate Shenyang Consulate Shanghai Consulate Sao Paulo
Embassy Tunis Embassy Tripoli Embassy Tokyo Embassy The Hague Embassy Tel Aviv Embassy Tehran Embassy Tegucigalpa Embassy Tbilisi Embassy Tashkent Embassy Tallinn Consulate Tijuana
USUN New York USEU Brussels US Mission Geneva US Interests Section Havana US Delegation, Secretary UNVIE Embassy Ulaanbaatar
Embassy Vilnius Embassy Vienna Embassy Vatican Consulate Vladivostok
Embassy Windhoek Embassy Wellington Embassy Warsaw
Embassy Yerevan Embassy Yaounde
Embassy Zagreb

### Browse by tag

A B C D E F G H I J K L M N O P Q R S T U V W X Y Z
ASEC AF AM AE AG AR AORC AJ AMGT AU AS ACOA AX AFIN AL APER AFFAIRS AA AEMR AMED ABLD AROC ATFN ASEAN AFGHANISTAN ADCO AO AFU AER ALOW AODE ABUD ATRN APECO ASUP AID AC AGMT AVERY APCS ASIG ASECKFRDCVISKIRFPHUMSMIGEG
BR BA BM BRUSSELS BL BO BTIO BEXP BH BE BK BX BU BIDEN BG BY BF BBSR BC BT BB BILAT BMGT BTIU
COUNTER CH CO CG CASC CU CI CS CDG CIA CACM CDB CVIS CA CBW CMGT CE CAN CN CJAN CY COE CD CM COUNTRY CLEARANCE CPAS CACS CWC CF CONDOLEEZZA CT CARSON CL CR CIS CLINTON CODEL CTM CB COM CKGR CJUS CONS CV COUNTERTERRORISM
DEAX DA DOE DISENGAGEMENT DJ DEA DK DHS DR DTRA DS DOMESTIC DOD
ECON EG EAID EFIN ELAB EUN ETRD EU EXTERNAL ENRG ETTC EPET EINV EMIN ECIP ECPS EINDETRD EAGR EN EAIR EZ EUC EI EIND EWWT ELTN EREL ER ECIN ETRDEINVECINPGOVCS EFIS ES EC ENVR ECA ET ENERG EINT ENGY ETRO ELECTIONS ELN EK EFTA ECONCS ECONOMICS EUR ECONEFIN ENIV EINVETC EINN ENGR ESA ETC ETRDEINVTINTCS ESENV ETRDECONWTOCS ENVI EUNCH EINVECONSENVCSJA ENNP ECINECONCS EFINECONCS ECUN EINVEFIN
FR FAO FTAA FARC FREEDOM FI FBI FJ FINR FMLN
GTMO GOI GM GG GV GH GA GT GR GE GAZA GCC GZ GOV GY GTIP GANGS
HA HU HR HUMAN HO HURI HILLARY HK HSTC HYMPSK
IS IR IZ IAEA IN IT ID IO IV ICTY IQ ICAO INTERPOL IPR INRB ITPHUM IWC IC IIP ICRC ISRAELI IMO IL IA INR ITALIAN ITALY ITPGOV IZPREL IRAQI ILC IRC INRA INRO IRAJ IEFIN IF INTELSAT ILO IBRD IMF ICJ ITRA IACI
JO JAMES JOSEPH JA JP JOHNNIE JM JUS
KCRM KDEM KJUS KCOR KOLY KIPR KNNP KU KWBG KPAL KN KS KZ KAWK KISL KPAO KSEC KGHG KIFR KTFN KDRG KV KSUM KAWC KDEMAF KFIN KGIC KTIP KHLS KSPR KGCC KPIN KG KBIO KHIV KSCA KE KFRD KPKO KMDR KPLS KUNR KIRF KIRC KMCA KFRDCVISCMGTCASCKOCIASECPHUMSMIGEG KWMN KACT KRAD KTIA KCIP KGIT KPRP KOMC KSTC KFLU KBTS KPRV KBTR KVPR KTDB KERG KWMM KRVC KFRDKIRFCVISCMGTKOCIASECPHUMSMIGEG KSTH KSEP KNSD KFLO KWAC KMPI KICC KVIR KBCT KNUP KTER KCFE KNEI KDDG KHSA KMRS KHDP KTLA KPAK KNAR KREL KPAI KTEX KNPP KCOM KNNPMNUC KO KPOA KLIG KOCI KRFD KHUM KDEV KNUC KCFC KREC KOMS KWWMN KTBT KIDE KX KWMNCS KCRS KSAF KFSC KR KPWR KMIG
LY LE LG LH LI LO LOG LT LTTE LU LAB
MX MARR MOPS MCAP MNUC MZ MO MASS MEPP MA MR ML MIL MTCRE MPOS MOPPS MAPP MU MY MASC MP MT MERCOSUR MK MDC MI MAPS MCC MD MASSMNUC MQADHAFI MUCN MTCR MG MAR MC MTRE MV MEPI MRCRE
NATO NG NI NO NL NU NIPP NPT NS NSG NA NZ NATIONAL NP NRR NAR NE NASA NK NPG NT NGO NSF
OTR OREP ODIP OVIP OPDC OPRC OSAC OAS OEXC OIIP OFDP OTRA OSCE OECD OPCW OSCI OPIC OIC OFFICIALS OIE OVP
PREL PGOV PTER PHUM PINR PAK PREF PL PBTS PHSA PARM PO PINS PK PROP PE POGOV PINL POL PBIO PSOE PKFK PMIL PM PY PFOR PALESTINIAN PHALANAGE PARTY PRAM PAO PA PMAR PGOVLO POLITICS PUNE PORG PHUMPREL PF POLINT PHUS PGOC PNR PGGV PNAT PGOVE PRGOV PRL PROV PTERE PGOF PHUMBA PARMS PINT PINF PEL PLN POV PG PEPR PSI PU POLITICAL PARTIES PECON
QA
RS RU RO RW RIGHTS RF RICE ROBERT RFE REGION RP
SOCI SP SY SCUL SNAR SA SENV SF SO SR SG STEINBERG SW SU SL SMIG SZ SIPRS SH SI SNARCS SOFA SANC SHUM SK ST SC SAN SN SEVN SYR
TIP TERRORISM TI TU TC TRGY TX TS TBIO TW TSPA TH TO TZ TK TSPL TPHY TNGD TINT TRSY TR TFIN TD TT TP TURKEY
UN US UK UG UNSC UP USEU UNMIK UZ UY UNGA UNO UV UNESCO UNEP UNDP UNCHS UNHRC UNAUS USTR UNVIE UNCHC UE UNDESCO USAID UNHCR UNDC USUN UAE
VZ VE VT VTPREL VN VM
WTRO WTO WTRQ WWARD WB WHA WI WBG WHO WA WMO WZ WEU
XF XG XT XM XR XS XL XH XA XZ XW XY XE XD XK XC
YE YM YI YMCS
ZI ZU ZP ZR ZB ZF ZO ZANU ZA ZOELLICK ZK ZJ

### Browse by classification

CONFIDENTIAL CONFIDENTIAL//NOFORN SECRET SECRET//NOFORN UNCLASSIFIED UNCLASSIFIED//FOR OFFICIAL USE ONLY

### Community resources

Follow us on Twitter Check our Reddit Twitter this Digg this page Contact us on IRC

courage is contagious

### Viewing cable 07TALLINN375, ESTONIA'S CYBER ATTACKS: LESSONS LEARNED

If you are new to these pages, please read an introduction on the structure of a cable as well as how to discuss them with others. See also the FAQs
Understanding cables
Every cable message consists of three parts:

- The top box shows each cables unique reference number, when and by whom it originally was sent, and what its initial classification was.
- The middle box contains the header information that is associated with the cable. It includes information about the receiver(s) as well as a general subject.
- The bottom box presents the body of the cable. The opening can contain a more specific subject, references to other cables (browse by origin to find them) or additional comment. This is followed by the main contents of the cable: a summary, a collection of specific topics and a comment section.

To understand the justification used for the classification of each cable, please use this WikiSource article as reference.
Discussing cables
If you find meaningful or important information in a cable, please link directly to its unique reference number. Linking to a specific paragraph in the body of a cable is also possible by copying the appropriate link (to be found at theparagraph symbol). Please mark messages for social networking services like Twitter with the hash tags #cablegate and a hash containing the reference ID e.g. #07TALLINN375.

Reference ID | Created | Released | Classification | Origin
--- | --- | --- | --- | ---
07TALLINN375 | 2007-06-06 14:02 | 2010-12-06 21:09 | SECRET | Embassy Tallinn

`

    VZCZCXRO7255
    OO RUEHDBU RUEHFL RUEHKW RUEHLA RUEHROV
    DE RUEHTL #0375/01 1571424
    ZNY SSSSS ZZH
    O 061424Z JUN 07
    FM AMEMBASSY TALLINN
    TO RUEHC/SECSTATE WASHDC IMMEDIATE 9902
    INFO RUEHZL/EUROPEAN POLITICAL COLLECTIVE IMMEDIATE
    RUEHMO/AMEMBASSY MOSCOW IMMEDIATE 2522
    RUEATRS/DEPT OF TREASURY WASHDC IMMEDIATE
    RHEFDIA/DIA WASHDC IMMEDIATE
    RUCNFB/FBI WASHDC IMMEDIATE
    RHMFISS/DEPT OF HOMELAND SECURITY WASHINGTON DC IMMEDIATE
    RHMFISS/HQ USEUCOM VAIHINGEN GE IMMEDIATE
    RUEKJCS/JOINT STAFF WASHDC IMMEDIATE
    RHEHNSC/NSC WASHDC IMMEDIATE
    RUEKJCS/SECDEF WASHDC IMMEDIATE
    RUEHBS/USEU BRUSSELS IMMEDIATE
    RUEHNO/USMISSION USNATO IMMEDIATE 1204
    RHEHAAA/WHITE HOUSE WASHDC IMMEDIATE

` `

    S E C R E T SECTION 01 OF 04 TALLINN 000375

    SIPDIS

    DEPT FOR EUR/NB

    E.O. 12958: DECL: 06/06/2017
    TAGS: PREL PGOV ECON ETRD NATO RS EN
    SUBJECT: ESTONIA'S CYBER ATTACKS: LESSONS LEARNED

    REF: A) TALLINN 366 B) LEE-GOLDSTEIN EMAIL 05/11/07
    B) TALLINN 347

    Classified By: Charge d'Affaires Jeff Goldstein for reasons 1.4 (b) & (
    d)

    ¶1. (S) Summary. On April 27, Estonia became the
    unprecedented victim of the world's first cyber attacks
    against a nation state. Although an analysis of events is
    ongoing, this event demonstrated the vulnerability of both
    government and private sector internet infrastructure.
    Working together with Estonian cyber security experts, the
    Ministry of Defense (MOD) is preparing a report analyzing
    the crisis, evaluating the strengths and weaknesses of the
    Estonian response, and recommend changes to Estonia's cyber
    defenses and security. The GOE and Estonian cyber defense
    experts all agree that while they successfully responded to
    these attacks, they will need to improve Estonia's defenses
    to prevent what they described as the nightmare scenario: a
    shutdown of Estonia's internet infrastructure as a result
    of more serious attacks at some point in the future. End
    Summary.

    The Nature of the Attacks
    -------------------------

    ¶2. (SBU) Starting on April 27, Estonia became the world's
    first victim of cyber attacks against a nation state's
    political and economic infrastructure. For over a month,
    government, banking, media, and other Estonian websites,
    servers, and routers came under a barrage of ever-shifting
    and coordinated cyber attacks that tried to shut down
    specific strategic targets (Ref A). Unlike traditional
    cyber attacks which try to "hack" into a system, the
    attacks against Estonian sites used the basic architecture
    of the internet to disrupt their operation. At Post's
    request XXXXXXXXXXXX visited Tallinn to assess the
    situationApril 16-18.  XXXXXXXXXXXX opined that it is
    not technically feasible to  prevent attacks of this nature,
    no matter how sophisticated  a country's cyber-defenses are.
    However, due to Estonia's  rapid response, the attacks did
    not seriously threaten  Estonia's cyber network and infrastructure.

    ¶3. (C) The cyber attacks exposed the strengths and
    weaknesses of Estonia's cyber defense system. XXXXXXXXXXXX
     told us that the Ministry of Defense is  preparing a report to
    submit to the GOE by the end of June.  Based on our discussions
    with GOE, CERT, and private  Estonian cyber security experts,
    it is clear that the Estonians are working furiously to analyze
    where their cyber defenses and protocols worked, failed, and/or
    need  improvement. Although these cyber attacks were
    unprecedented in nature, our Estonian interlocutors all
    agreed that the outcome could have been much worse. They
    also note that the MOD's report notwithstanding, the impact
    on cyber defense policy for both the public and private
    sectors will be discussed and felt for a very long time.
    The following is a summary of GOE "lessons learned" from
    these attacks.

    Lessons Learned: What Worked
    ----------------------------

    ¶4. (SBU) STRENGTH IN BEING SMALL. With a population of 1.3
    million people, Estonia's small size was its strongest
    asset in reacting rapidly to the cyber attacks. Estonia's
    CERT, the GOE's Cyber Defense Unit, and private IT Security
    Managers all knew each other for years before the crisis
    and were, thus, able to work closely together. Information
    sharing and decision making were rapid and flexible.
    Everything was handled - from the working level to the
    leadership - in an almost seamless fashion throughout the
    attacks. "We're talking about a group of ten key people in
    the government and private sector who've known each other
    for years, trust one another, and all have direct access to

    TALLINN 00000375 002 OF 004

    each other" XXXXXXXXXXXX,  commented to us.
    "Therefore, there was no inter-agency  bureaucracy or
    red tape to cut through."

    ¶5. (C) E-VOTING. In March 2007, Estonia held the world's
    first national election where e-voting was used. From the
    outset of the crisis, the e-voting security team was
    immediately seconded to CERT and became a vital asset in
    responding to the attacks. Although Estonia's CERT has
    only two full time staff, XXXXXXXXXXXX said he was able
    to call  upon a roster of 200 programmers and security
    experts from  the e-voting security team to ensure a 24/7 response
    mechanism against incoming cyber attacks. As the e-voting
    team was already at work on next generation security
    measures (in anticipation for Estonia's 2009 local
    elections), there was no need for them to "catch up"
    according to XXXXXXXXXXXX. These experts were invaluable
    in  addressing the wide variety of attacks (e.g., bots, spam,
    DDoS, Trojan Horses, etc.).

    ¶6. (C) INFORMATION GATHERING. Our MOD interlocutors credit
    Estonian law enforcement and cyber security experts'
    (public and private) close monitoring of Russian-language
    internet forums as key to CERT's ability to rapidly respond
    to the attacks. On April 28, less than 24 hours after the
    first cyber attacks, Russian-language internet forums
    (e.g., http://2ch.ru and http://forum.xaker.ru) were
    exhorting people to attack specific GOE websites and
    offering links to software tools. Patient monitoring of
    these internet-forums led to intelligence on targets,
    dates, and exact times for coordinated attacks.
    XXXXXXXXXXXX told us  privately that without this
     information, the cyber attacks  against GOE sites could hav
     inflicted far more damage than  they did.

    ¶7. (C) SECURE ONLINE BANKING. Hansabank and SEB
    successfully weathered the cyber attacks against them
    because of defensive measures and procedures already in
    place. According to CERT, the banks' procedures are in
    many ways superior to the GOE's. XXXXXXXXXXXX
     said that due to  the longstanding problem of cyber crime
    in the region -  often with banks as prime targets - the banks
    were well  prepared for the attacks. For example,
    XXXXXXXXXXXX  told us,  organized gangs have
    employed bot attacks in the past. As  a result, Hansabank
     had the necessary cyber security  measures in place to defend
    against this type of attack.
    In the end, Hansabank-s sites successfully repelled every
    attack and were able to provide their Estonian customers
    access to their online accounts. (Note. Almost 90% of all
    financial transactions (e.g., bill payments) are done
    online. Hansabank and SEB alone handle over three-fourths
    of that traffic. End Note.)

    Lessons Learned: What Failed
    ----------------------------

    ¶8. (S) FORMAL PROCEDURES. XXXXXXXXXXXX told us
    he  believes that Estonia-s formal and institutional procedures
    for responding to cyber attacks failed completely.
    Throughout the crisis, ad hoc meetings and decision making
    based on established informal contacts and relationships
    were used to disseminate information - instead of
    formalized institutional channels with clear communication
    chains. Additionally, XXXXXXXXXXXX told us that the GOE
    did  not keep an official record or log of decisions and actions
    taken during the crisis. Consequently, it is uncertain how
    thorough the GOE's post-crisis assessment or efforts to
    improve Estonia's formal cyber defense procedures will be.
    XXXXXXXXXXXX explained that neither CERT nor the GOE
    had the  personnel to "put out the fire and also act as a secretary
    to take down the minutes." (Note: XXXXXXXXXXXX claims
    of  staff shortages are somewhat questionable given that he
    told us that neither he nor any of his staff had to work
    over-time during the cyber attacks. End Note.)

    ¶9. (S) LACK OF CENTRALIZED GOE POLICY. MOD interlocutors
    admitted that there was no consistent GOE policy across

    TALLINN 00000375 003 OF 004

    ministries on cyber security, broadband capacity, and
    information sharing. For example, some ministries use
    static websites while others use more vulnerable dynamic
    websites. Ministries also use different internet providers
    which have different security procedures in place. This
    unnecessary complexity made initial information sharing
    between ministries more cumbersome and confusing,
    especially for ministries with fewer resources for IT risk
    management (e.g., the Ministry of Population, Ministry of
    Education, Ministry of Culture, etc.). XXXXXXXXXXXX,
    told us that creating a  consistent policy for the various ministries
    will be a key  recommendation in the MOD's report.

    ¶10. (S) MONITORING. The cyber attacks also exposed
    Estonia's total lack of a comprehensive monitoring system.
    Estonia does not have a national IP (internet protocol)
    network of sensors to precisely monitor traffic for cyber
    attacks. As a result, the GOE and CERT did not have any
    hard data on the number of computers and/or servers that
    were used in the attacks. XXXXXXXXXXXX, Estonia's main telecommunication and IT  provider, told us that his company
    relies on U.S.-based  Arbor Networks to monitor its network.
    Our MOD and private sector interlocutors all agreed on how
    important it was for  Estonia to have its own monitoring network,
    but they could  not confirm on the likelihood that the GOE
    would invest in  this infrastructure upgrade.

    ¶11. (S) WHACK-A-MOLE. In the initial stages of the cyber
    attacks, the Estonian method of response was to block each
    and every attack through its corresponding ISP address as
    it happened. XXXXXXXXXXXX dubbed this the "whack-a-
    mole" response and opined that prior to April 27 this
    approach might have been sufficient. However, the sheer
    volume of the recent cyber attacks quickly overwhelmed the
    Estonian defenses. CERT, Elion, and the GOE's Cyber Defense
    Unit were eventually forced to apply broader and more
    stringent filtering mechanisms on all internet traffic to
    prevent the attacks from entering Estonia. XXXXXXXXXXXX
    observed that unlike the United States and many European
    Union members who routinely filter foreign internet
    traffic, prior to the recent attacks, the Estonian network
    filtered very little foreign traffic.

    ¶12. (S) INDUSTRY VULNERABILITY. While Hansabank and SEB
    successfully weathered the cyber attacks, many other
    smaller private Estonian sites that were attacked were
    overwhelmed. With no industry standard or best practice in
    place in Estonia, many smaller businesses and/or private
    organizations (e.g., schools, NGOs, etc.) did not have the
    technical expertise or financial means to ramp up their
    broadband capacity. XXXXXXXXXXXX claimed that CERT's
    log of  complaints and reported cyber attacks since April 27 is
    over 10 Tb (Tera bits). (Note. One TB is equal to one
    million Mega bits. To put this in perspective, the entire
    content of the online U.S. Library of Congress uses less
    than 10 TB. End Note.) As the majority of Estonian (SME)
    small and medium size enterprises employ online services as
    part of their daily business, the GOE is now aware that an
    industry standard with readily available cyber defensive
    software, tools, training, and public awareness-raising
    must become a part of Estonia's cyber defenses.

    Lessons Learned: Nightmare Scenarios
    ------------------------------------

    ¶13. (S) TARGETING KEY ROUTERS AND SITES. Our Estonian
    interlocutors all agreed that even during the attacks'
    peak, Estonia's cyber network was not in any serious danger
    of being shut down. In some ways, Estonia was lucky. Rein
    Ottis, MOD Cyber Defense Chief, noted that had the attacks
    specifically targeted Estonia's key servers and routers,
    they could have shut down Estonia's entire cyber
    infrastructure. On May 4, two routers belonging to the GOE
    and Elion were attacked with an unknown data packet that
    crashed the routers almost immediately. XXXXXXXXXXXX
    told us that if enough key  routers and/or servers were shut down,
    it would be the internet "equivalent of blowing up key roads and

    TALLINN 00000375 004 OF 004

    intersections in the city Tallinn to bring all traffic to a  halt."

    ¶14. (S) UNANNOUNCED AND BETTER TIMED ATTACKS. Most of the
    cyber attacks were discussed in advance on Russian-language
    internet forums, giving the Estonians the opportunity to
    ramp up broadband capacity in advance. XXXXXXXXXXXX
     told us that  the perpetrators gave away the element of surprise
    and  often timed their attacks in the evening (when Estonia's
    internet usage is at its lowest). Had they not made these
    mistakes, XXXXXXXXXXXX opined that the attacks could
     have shut  down their GOE targets for up to a week.
    XXXXXXXXXXXX  was  thankful that they had advance
    information about th  May 15  attacks against Hansabank and
    SEB. However, many  of the  attacks which employed bots
    were unannounced and far more challenging, and in some
    cases did crash their targets. If  all attacks had been like this,
    XXXXXXXXXXXX and XXXXXXXXXXXX could  not
    confidently predict whether Estonia's defenses would
    have held.

    ¶15. (S) 2ND TIER STRATEGIC ATTACKS. Estonia's banks were
    generally well prepared for cyber attacks. However, the
    economic impact could have been worse if the attacks had
    focused on 2nd tier strategic targets which possessed less
    formidable defenses (Ref B). XXXXXXXXXXXX speculated
    the  fallout would have been far more significant if Estonia's
    logistic-transport companies had been attacked. "As over
    three-fourths of all grocery stores, petrol stations, and
    shops rely on the internet for their orders and
    deliveries," asked XXXXXXXXXXXX, "can you imagine the
    damage  this would bring? Cyber crime seems abstract to most
    people. There's nothing abstract about empty shelves in
    stores." XXXXXXXXXXXX also listed a whole range of
    other strategic services and businesses that would have been far
    easier to crash than the banks. The MOD felt that
    XXXXXXXXXXXX descriptions were far fetched, bordering
    on  "science fiction." However, when we mentioned
    XXXXXXXXXXXX's  comments to XXXXXXXXXXXX
     he felt that recent events have changed  the parameters
    of the debate on possible threat scenarios.  He said,
    "Last year, I would've considered a cyber war  against my
     country as science fiction, too - but not  anymore."

    GOLDSTEIN

`