Cable Viewer

Currently released so far... 14239 / 251,287

### Articles

Brazil Sri Lanka United Kingdom Sweden 00. Editorial United States Latin America Egypt Jordan Yemen

### Browse latest releases

2010/11 2010/12 2011/01 2011/02 2011/03 2011/04 2011/05 2011/06
2010/11/28 2010/11/29 2010/11/30
2010/12/01 2010/12/02 2010/12/03 2010/12/04 2010/12/05 2010/12/06 2010/12/07 2010/12/08 2010/12/09 2010/12/10 2010/12/11 2010/12/12 2010/12/13 2010/12/14 2010/12/15 2010/12/16 2010/12/17 2010/12/18 2010/12/19 2010/12/20 2010/12/21 2010/12/22 2010/12/23 2010/12/24 2010/12/25 2010/12/26 2010/12/27 2010/12/28 2010/12/29 2010/12/30
2011/01/01 2011/01/02 2011/01/04 2011/01/05 2011/01/07 2011/01/09 2011/01/10 2011/01/11 2011/01/12 2011/01/13 2011/01/14 2011/01/15 2011/01/16 2011/01/17 2011/01/18 2011/01/19 2011/01/20 2011/01/21 2011/01/22 2011/01/23 2011/01/24 2011/01/25 2011/01/26 2011/01/27 2011/01/28 2011/01/29 2011/01/30 2011/01/31
2011/02/01 2011/02/02 2011/02/03 2011/02/04 2011/02/05 2011/02/06 2011/02/07 2011/02/08 2011/02/09 2011/02/10 2011/02/11 2011/02/12 2011/02/13 2011/02/14 2011/02/15 2011/02/16 2011/02/17 2011/02/18 2011/02/19 2011/02/20 2011/02/21 2011/02/22 2011/02/23 2011/02/24 2011/02/25 2011/02/26 2011/02/27 2011/02/28
2011/03/01 2011/03/02 2011/03/03 2011/03/04 2011/03/05 2011/03/06 2011/03/07 2011/03/08 2011/03/09 2011/03/10 2011/03/11 2011/03/13 2011/03/14 2011/03/15 2011/03/16 2011/03/17 2011/03/18 2011/03/19 2011/03/20 2011/03/21 2011/03/22 2011/03/23 2011/03/24 2011/03/25 2011/03/26 2011/03/27 2011/03/28 2011/03/29 2011/03/30 2011/03/31
2011/04/01 2011/04/02 2011/04/03 2011/04/04 2011/04/05 2011/04/06 2011/04/07 2011/04/08 2011/04/09 2011/04/10 2011/04/11 2011/04/12 2011/04/13 2011/04/14 2011/04/15 2011/04/16 2011/04/17 2011/04/18 2011/04/19 2011/04/20 2011/04/21 2011/04/22 2011/04/23 2011/04/24 2011/04/25 2011/04/26 2011/04/27 2011/04/28 2011/04/29 2011/04/30
2011/05/01 2011/05/02 2011/05/03 2011/05/04 2011/05/05 2011/05/06 2011/05/07 2011/05/08 2011/05/09 2011/05/10 2011/05/11 2011/05/12 2011/05/13 2011/05/14 2011/05/15 2011/05/16 2011/05/17 2011/05/18 2011/05/19 2011/05/20 2011/05/21 2011/05/22 2011/05/23 2011/05/24 2011/05/25 2011/05/26 2011/05/27 2011/05/28 2011/05/29 2011/05/30 2011/05/31
2011/06/01 2011/06/02 2011/06/03

### Browse by creation date

66 72 73 75 79 85 86 87 88 89 90 91 92 93 94 95 96 97 00 01 02 03 04 05 06 07 08 09 10
1966/12
1972/02 1972/08
1973/04
1975/03
1979/08
1985/03 1985/05 1985/06
1986/05
1987/06
1988/01 1988/03 1988/07 1988/08
1989/12
1990/01 1990/07 1990/08 1990/10
1991/05
1992/01 1992/03 1992/06 1992/09 1992/12
1993/01 1993/10
1994/12
1995/04
1996/07 1996/11
1997/06 1997/10 1997/12
2000/05 2000/06 2000/09 2000/11
2001/02 2001/03 2001/06 2001/07 2001/09 2001/10 2001/11
2002/01 2002/02 2002/03 2002/04 2002/07 2002/08 2002/09 2002/11 2002/12
2003/01 2003/02 2003/03 2003/04 2003/05 2003/06 2003/07 2003/08 2003/09 2003/10 2003/11 2003/12
2004/01 2004/02 2004/03 2004/04 2004/05 2004/06 2004/07 2004/08 2004/09 2004/10 2004/11 2004/12
2005/01 2005/02 2005/03 2005/04 2005/05 2005/06 2005/07 2005/08 2005/09 2005/10 2005/11 2005/12
2006/01 2006/02 2006/03 2006/04 2006/05 2006/06 2006/07 2006/08 2006/09 2006/10 2006/11 2006/12
2007/01 2007/02 2007/03 2007/04 2007/05 2007/06 2007/07 2007/08 2007/09 2007/10 2007/11 2007/12
2008/01 2008/02 2008/03 2008/04 2008/05 2008/06 2008/07 2008/08 2008/09 2008/10 2008/11 2008/12
2009/01 2009/02 2009/03 2009/04 2009/05 2009/06 2009/07 2009/08 2009/09 2009/10 2009/11 2009/12
2010/01 2010/02

### Browse by origin

A B C D F G H I J K L M N O P Q R S T U V W Y Z
Embassy Athens Embassy Asuncion Embassy Astana Embassy Asmara Embassy Ashgabat Embassy Apia Embassy Ankara Embassy Amman Embassy Algiers Embassy Addis Ababa Embassy Accra Embassy Abuja Embassy Abu Dhabi Embassy Abidjan Consulate Auckland Consulate Amsterdam Consulate Adana American Institute Taiwan, Taipei
Embassy Bujumbura Embassy Buenos Aires Embassy Budapest Embassy Bucharest Embassy Brussels Embassy Bridgetown Embassy Bratislava Embassy Brasilia Embassy Bogota Embassy Bishkek Embassy Bern Embassy Berlin Embassy Belmopan Embassy Belgrade Embassy Beirut Embassy Beijing Embassy Banjul Embassy Bangkok Embassy Bandar Seri Begawan Embassy Bamako Embassy Baku Embassy Baghdad Consulate Belfast Consulate Barcelona
Embassy Copenhagen Embassy Conakry Embassy Colombo Embassy Chisinau Embassy Caracas Embassy Canberra Embassy Cairo Consulate Curacao Consulate Ciudad Juarez Consulate Chennai Consulate Casablanca Consulate Cape Town Consulate Calgary
Embassy Dushanbe Embassy Dublin Embassy Doha Embassy Djibouti Embassy Dili Embassy Dhaka Embassy Dar Es Salaam Embassy Damascus Embassy Dakar Consulate Dubai
Embassy Freetown Consulate Fukuoka
Embassy Guatemala Embassy Gaborone Consulate Guayaquil Consulate Guadalajara
Embassy Helsinki Embassy Harare Embassy Hanoi Consulate Ho Chi Minh City Consulate Hermosillo Consulate Hamilton Consulate Hamburg Consulate Halifax
Iran RPO Dubai Embassy Islamabad Consulate Istanbul
Embassy Jakarta Consulate Jerusalem Consulate Jeddah
Embassy Kyiv Embassy Kuwait Embassy Kuala Lumpur Embassy Kinshasa Embassy Kingston Embassy Kigali Embassy Khartoum Embassy Kathmandu Embassy Kampala Embassy Kabul Consulate Kolkata Consulate Karachi
Embassy Luxembourg Embassy Luanda Embassy London Embassy Ljubljana Embassy Lisbon Embassy Lima Embassy Lilongwe Embassy La Paz Consulate Lahore Consulate Lagos
Mission USOSCE Mission USNATO Mission UNESCO Embassy Muscat Embassy Moscow Embassy Montevideo Embassy Monrovia Embassy Minsk Embassy Mexico Embassy Mbabane Embassy Maputo Embassy Manila Embassy Manama Embassy Managua Embassy Malabo Embassy Madrid Consulate Munich Consulate Mumbai Consulate Montreal Consulate Monterrey Consulate Milan Consulate Melbourne
Embassy Nicosia Embassy Niamey Embassy New Delhi Embassy Ndjamena Embassy Nassau Embassy Nairobi Consulate Naples Consulate Naha
Embassy Ouagadougou Embassy Ottawa Embassy Oslo
Embassy Pristina Embassy Pretoria Embassy Prague Embassy Port Of Spain Embassy Port Louis Embassy Port Au Prince Embassy Phnom Penh Embassy Paris Embassy Paramaribo Embassy Panama Consulate Peshawar
Embassy Quito Consulate Quebec
REO Basrah Embassy Rome Embassy Riyadh Embassy Riga Embassy Reykjavik Embassy Rangoon Embassy Rabat Consulate Rio De Janeiro Consulate Recife
Secretary of State Embassy Suva Embassy Stockholm Embassy Sofia Embassy Skopje Embassy Singapore Embassy Seoul Embassy Sarajevo Embassy Santo Domingo Embassy Santiago Embassy Sanaa Embassy San Salvador Embassy San Jose Consulate Strasbourg Consulate St Petersburg Consulate Shenyang Consulate Shanghai Consulate Sapporo Consulate Sao Paulo
Embassy Tunis Embassy Tripoli Embassy Tokyo Embassy The Hague Embassy Tel Aviv Embassy Tehran Embassy Tegucigalpa Embassy Tbilisi Embassy Tashkent Embassy Tallinn Consulate Toronto Consulate Tijuana Consulate Thessaloniki
USUN New York USEU Brussels US Office Almaty US Mission Geneva US Interests Section Havana US Delegation, Secretary UNVIE Embassy Ulaanbaatar
Embassy Vilnius Embassy Vienna Embassy Vatican Embassy Valletta Consulate Vladivostok Consulate Vancouver
Embassy Windhoek Embassy Wellington Embassy Warsaw
Embassy Yerevan Embassy Yaounde
Embassy Zagreb

### Browse by tag

A B C D E F G H I J K L M N O P Q R S T U V W X Y Z
ASEC AEMR AMGT AR APECO AU AORC AJ AF AFIN AS AM AFFAIRS AA AG ADM ALOW ACOA ARABL ATRN AID AND APER ADANA APEC ADPM ADCO AL AADP AMED AY AORG ASEAN ABUD AROC ABLD AE AO ARF APCS AINF AGAO AODE ACABQ AX AMEX AZ ASUP ARM AQ ATFN AMBASSADOR ACBAQ AFSI AFSN AC ASIG ASEX AER AVERY AGRICULTURE ASCH AFU AMG ATPDEA ASECKFRDCVISKIRFPHUMSMIGEG AORL AN AIT ANET AGMT ACS AGR AMCHAMS AECL AUC AFGHANISTAN ACAO
BR BB BG BEXP BY BA BRUSSELS BU BD BK BL BH BM BTIO BP BO BE BILAT BX BIDEN BC BF BBSR BT BMGT BWC BN BTIU
CPAS CA CASC CS CBW CIDA CO CODEL CI CROS CU CH CWC CMGT CVIS CDG CD CV CG CF CHIEF CJAN CBSA CE CY CT CM CR CONS CW CN CDC CONDOLEEZZA CICTE CYPRUS COUNTRY CBE COM CTR CARSON COUNTER CIVS CFED COPUOS CKGR CHR CVR CLINTON COUNTERTERRORISM CITEL CLEARANCE COE CARICOM CB CSW CIC CITT CARIB CAFTA CACM CDB CJUS CTM CAN CONSULAR CLMT CBC CIA CNARC CIS CEUDA CAC CL CACS CAPC
DR DJ DHS DAO DCM DO DEFENSE DOMESTIC DK DOD DA DE DPRK DEPT DEA DISENGAGEMENT DOE DTRA DS DEAX
ECON ETTC EFIS ETRD EC EMIN EAGR EAID EU EFIN EUN ECIN EG EWWT EINV ENRG ELAB EPET EN EAIR EUMEM ECPS ELTN EIND EZ EI ER ET EINT ECONOMIC ENIV EXIM EFTA ES ECONOMY ERNG ELECTIONS ENERG EK EDEV EPA ENGR ETRC ENVI EXTERNAL ELN EAIDS ECA EDU EFINECONCS ECOSOC EUREM EINVEFIN ETRDEINVECINPGOVCS ETC ENVR EAP EINN EXBS ENGY ECONOMICS EIAR EINDETRD ECONEFIN EURN ETRDEINVTINTCS ECIP EFIM EREL EINVETC ECONCS ETRA ESA EAIG EUR EUC ERD ETRN EINVECONSENVCSJA EEPET EUNCH ESENV ENNP ECINECONCS ETRO ETRDECONWTOCS ECUN
FR FI FOREIGN FAS FTAA FREEDOM FBI FINANCE FAA FM FJ FTA FARC FAC FAO FINR FDA FOR FOI FO FMLN FISO
GM GG GERARD GT GA GR GTIP GLOBAL GV GH GL GOV GOI GF GE GTMO GANGS GCC GAERC GZ GAZA GY GUILLERMO GASPAR
HR HO HA HYMPSK HK HUMAN HU HILLARY HI HUM HURI HSTC HEBRON HUMOR
IZ IN IAEA IS IMO ILO IR IC IT ITU IV IMF IBRD IWC IRAQI IDB ISRAELI ITALY ITPGOV ITALIAN INDO ICAO ITRA IPR INMARSAT ID ICRC INTERNAL IIP IRS ICJ ILC IO ICTY IQ IEFIN IA INTERPOL IEA INR INRB IAHRC ISRAEL IZPREL IRAJ IF ITPHUM IL IACI IDA ISLAMISTS IGAD ITF INRA INRO IBET INTELSAT IDP ICTR IRC
JA JO JM JP JUS JAMES JOHN JOSEPH JOHNNIE JIMENEZ
KOMC KNNP KFLO KDEM KSUM KIPR KFLU KPAO KE KCRM KJUS KAWC KZ KSCA KDRG KCOR KGHG KPAL KTIP KMCA KCRS KPKO KOLY KRVC KVPR KG KWBG KMDR KTER KSPR KV KTFN KWMN KFRD KSTH KS KN KISL KGIC KSEP KFIN KTEX KTIA KUNR KCMR KMOC KCIP KTDB KBIO KU KO KIDE KSTC KICC KIRC KIRF KSEO KSAF KR KNUP KCSY KFRDCVISCMGTCASCKOCIASECPHUMSMIGEG KOCI KMPI KNUC KPAONZ KHLS KPRP KHDP KHIV KTRD KNAR KWAC KTAO KJUST KTBT KCRCM KNPP KMRS KBTS KAWK KHSA KPRV KMFO KNNPMNUC KACT KSCI KERG KBCT KVRP KPWR KVIR KFSC KENV KPIR KCFE KX KCOM KAID KTLA KPOA KNDP KRCM KCFC KNEI KCHG KPLS KREL KFTFN KTFM KLIG KDEMAF KRAD KBTR KGIT KGCC KICA KHUM KSEC KPIN KESS KDEV KWWMN KOM KWNM KRFD KFRDKIRFCVISCMGTKOCIASECPHUMSMIGEG KRGY KREC KIFR KSAC KWMNCS KPAK KOMS KFPC KRIM KDDG KCGC KPAI KID KMIG KNSD KWMM
LY LE LABOR LU LA LI LTTE LG LH LO LAB LT LOG
MARR MX MASS MOPS MNUC MCAP MTCRE ML MR MRCRE MTRE MASC MY MK MAS MO MIL MTCR MG MAPP MD MAR MU MZ MP MA MOPPS MTS MLS MILI MEPN MEPI MEETINGS MERCOSUR MW MT MCC MIK MAPS MV MILITARY MARAD MDC MEPP MASSMNUC MUCN MEDIA MI MQADHAFI MPOS MPS MC
NZ NATO NI NO NG NL NU NPT NS NC NA NATIONAL NSF NDP NIPP NR NSSP NP NE NGO NAS NZUS NH NSG NAFTA NEW NRR NT NASA NAR NK NOVO NATOPREL NEA NSC NV NPA NSFO NW NORAD NPG
OTRA OECD OVIP OREP OPRC ODC OIIP OPDC OAS OSCE OPIC OMS OEXC OPCW OPAD ODIP OVIPPRELUNGANU OIE OFDP OFFICIALS OSCI OHUM OTR OMIG OSAC OBSP OFDA OVP ON OCII OES OCS OIC
PGOV PREL PARM PINR PHUM PM PREF PTER PK PINS PBIO PHSA PE PBTS PL POL PAK POV POLITICS POLICY PERL PA PPA PCI PAS PALESTINIAN PROP PREZ PTE PAIGH PO PROG PJUS POLITICAL PMIL PGOF PINO PG PARMS PDOV PSI PRAM PREO PTERE PAO PRGOV PORG PP PS PKFK PSOE PEPR PDEM PINT PMAR PRELP PREFA PNG PTBS PFOR PUNE PGOVLO PHUMBA PNAT POLINT PGOVE PHALANAGE PARTY PECON PY PLN PHUH PEDRO PF PHUS PU PARTIES PCUL PGGV PSA PGOVSMIGKCRMKWMNPHUMCVISKFRDCA PGIV PHUMPREL POGOV PEL PINL PBT PINF PRL PSEPC POSTS PAHO PHUMPGOV PGOC PNR PROV
QA
RS RP RU RW RFE RCMP RIGHTSPOLMIL RM ROBERT RICE REGION RO ROOD RELAM RSP RF RELATIONS RIGHTS RUPREL REMON REACTION REPORT RSO
SZ SENV SOCI SNAR SY SO SP SU SI SMIG SYR SA SCUL SG SW SR SYRIA SNARM SPECIALIST SC SEN SF SENVSXE SL SAARC SNARIZ STEINBERG SARS SCRS SWE SN SAN ST SIPDIS SSA SPCVIS SOFA SENVKGHG SANC SHI SEVN SHUM SK SH SNARCS SPCE SNARN SIPRS
TRGY TBIO TSPA TU TPHY TI TX TH TIP TSPL TNGD TP TW TZ TF TN TC TL TV TS TT TK TD TWI TERRORISM TO TRSY TURKEY TINT TFIN TAGS TR TBID THPY
UK UNSC UNGA UN US USTR UZ USEU UV UG UP UNAUS UNMIK UY UR USPS UNSCR UNHRC UNMIC UNESCO UNCHR USUN UNHCR USGS USNC UNEP USOAS USAID UE UNVIE UAE UNO UNDP UNODC UNCHS UNFICYP UNDESCO UNC UNPUOS UNDC UNICEF UNCHC UNCSD UNFCYP UNIDROIT UNCND
VE VM VT VZ VTEG VTIZ VTPREL VENZ VAT VC VI VN
WHTI WIPO WTRO WS WHO WTO WZ WI WBG WMD WWARD WHA WITH WTRQ WEU WMO WA WFP WB
XA XR XW XX XK XL XM XS XF XG XT XH XB XU XY XV XD XC XE XZ XQ XI XTAG
YI YM YL YMCS YE
ZU ZI ZP ZR ZOELLICK ZF ZL ZJ ZO ZB ZEALAND ZN ZA ZK ZANU

### Browse by classification

CONFIDENTIAL CONFIDENTIAL//NOFORN SECRET SECRET//NOFORN UNCLASSIFIED UNCLASSIFIED//FOR OFFICIAL USE ONLY

### Community resources

Follow us on Twitter Check our Reddit Twitter this Digg this page Contact us on IRC

courage is contagious

### Viewing cable 07TALLINN366, ESTONIA'S CYBER ATTACKS: WORLD'S FIRST VIRTUAL

If you are new to these pages, please read an introduction on the structure of a cable as well as how to discuss them with others. See also the FAQs
Understanding cables
Every cable message consists of three parts:

- The top box shows each cables unique reference number, when and by whom it originally was sent, and what its initial classification was.
- The middle box contains the header information that is associated with the cable. It includes information about the receiver(s) as well as a general subject.
- The bottom box presents the body of the cable. The opening can contain a more specific subject, references to other cables (browse by origin to find them) or additional comment. This is followed by the main contents of the cable: a summary, a collection of specific topics and a comment section.

To understand the justification used for the classification of each cable, please use this WikiSource article as reference.
Discussing cables
If you find meaningful or important information in a cable, please link directly to its unique reference number. Linking to a specific paragraph in the body of a cable is also possible by copying the appropriate link (to be found at theparagraph symbol). Please mark messages for social networking services like Twitter with the hash tags #cablegate and a hash containing the reference ID e.g. #07TALLINN366.

Reference ID | Created | Released | Classification | Origin
--- | --- | --- | --- | ---
07TALLINN366 | 2007-06-04 14:27 | 2010-12-06 21:30 | SECRET | Embassy Tallinn

`

    VZCZCXRO4489
    OO RUEHDBU RUEHFL RUEHKW RUEHLA RUEHROV
    DE RUEHTL #0366/01 1551427
    ZNY SSSSS ZZH
    O 041427Z JUN 07
    FM AMEMBASSY TALLINN
    TO RUEHC/SECSTATE WASHDC IMMEDIATE 9880
    INFO RUEHZL/EUROPEAN POLITICAL COLLECTIVE IMMEDIATE
    RUEHMO/AMEMBASSY MOSCOW IMMEDIATE 2513
    RUEHBS/USEU BRUSSELS IMMEDIATE
    RUEKJCS/SECDEF WASHDC IMMEDIATE
    RUENAAA/SECNAV WASHINGTON DC IMMEDIATE
    RUEHNO/USMISSION USNATO IMMEDIATE 1194
    RUEHVEN/USMISSION USOSCE IMMEDIATE 0480
    RHEFDIA/DIA WASHDC IMMEDIATE
    RHMFISS/DEPT OF HOMELAND SECURITY WASHINGTON DC IMMEDIATE
    RUEKJCS/JOINT STAFF WASHDC IMMEDIATE
    RHEHNSC/NSC WASHDC IMMEDIATE
    RHEHAAA/WHITE HOUSE WASHDC IMMEDIATE

` `

    S E C R E T SECTION 01 OF 04 TALLINN 000366

    SIPDIS

    SIPDIS

    DEPT FOR EUR/NB

    E.O. 12958: DECL: 06/04/2017
    TAGS: PREL PGOV ECON ETRD NATO RS EN
    SUBJECT: ESTONIA'S CYBER ATTACKS: WORLD'S FIRST VIRTUAL
    ATTACK AGAINST NATION STATE

    REF: A) TALLINN 276 B) TALLINN 280 C) TALLINN 347 D)
    LEE-GOLDSTEIN EMAIL 05/11/07

    Classified By: Ambassador S. Dave Phillips for reasons 1.4 (b) & (d)

    ¶1. (S) Summary. Since April 27, Estonia has been the
    victim of the world's first coordinated cyber attacks
    against a nation state and its political and economic
    infrastructure. The sensational nature of the story,
    combined with the highly technical details of the subject
    matter, has led to a good deal of misinformation in the
    public domain. Although GOE and international analysis
    is ongoing, these attacks have highlighted the
    vulnerability of both government and private sector
    internet infrastructure to attacks of this nature. For
    over a month, government, banking, media, and other
    Estonian websites, servers, and routers came under a
    barrage of cyber attacks. Defense against the attacks
    was extremely expensive for both GOE and the private
    sector. GOE and private cyber defense experts cite the
    nature and sophistication of the attacks as proof of
    Russian government complicity in the attacks. End
    Summary.

    Virtual Shots Heard Round the World
    -----------------------------------

    ¶2. (C) Cyber attacks against Estonian websites began on
    April 27. They came in the wake of rioting in Tallinn
    triggered by the Government of Estonia's (GOE)
    preparations for relocating the so called "Bronze
    Soldier", a Soviet-era World War II monument (Refs A and
    B). The attacks initially targeted GOE websites
    including those of the Estonian President, Prime
    Minister, Ministry of Foreign Affairs (MFA), Ministry of
    Justice (MOJ), and Parliament, among others. According
    to XXXXXXXXXXXX the initial attacks were
    technically unsophisticated and "seemed more like a cyber
    riot than a cyber war." However, all our Estonian
    interlocutors clearly recognized these attacks as
    political in nature. Russian-language internet chat
    forums held discussions exhorting people to attack
    Estonian sites and supplied downloadable software tools
    to carry out the attacks. According to XXXXXXXXXXXX, these
    initial attacks were limited to spam (a barrage of
    unsolicited emails) and cyber vandalism (e.g., Prime
    Minister Andrus Ansip's photo was defaced on the Estonian
    Reform Party's website) and appeared to be nothing more
    than a virtual mob reaction to the Bronze Soldier issue.
    Estonian media and press commentators were quick to
    accuse Moscow of being responsible, interpreting these
    attacks as part of Russian retribution for moving the
    Bronze Soldier (Ref C).

    ¶3. (S) However, on April 30, a broader range of cyber
    attacks -- from simple spam postings to coordinated DDoS
    (Distributed Denial-of-Service) attacks -- began against
    GOE sites. (Note. A DDoS attack is when a flood of
    bogus queries are made to a specific server or network of
    computers in order to over-saturate the target and
    prevent access by legitimate users. End Note.) For
    example, the Presidential website, which normally has a 2
    million Mbps (megabits per second) capacity, was flooded
    with nearly 200 million Mbps of traffic. While none of
    the technology involved in the attacks was new, tactics
    and tools routinely shifted to prevent Estonian
    authorities from blocking the attacks. One of the most
    pernicious tools in these attacks was "bots." (Note.
    Bots are computers and/or servers under the control of a
    third party. End Note.) These bot attacks came from
    ISPs (internet service providers) around the world (e.g.,
    the United States, Canada, Russia, Turkey, Germany,
    Belgium, Egypt, Vietnam, etc.). Attacks routinely came
    from one set of bots, subsided and then resumed again
    using another set of bots with different ISPs. According
    to XXXXXXXXXXXX, the attacks ranged from a single
    minute to  many hours in length. The longest attacks lasted

    TALLINN 00000366 002 OF 004

    over  ten hours and unleashed a crushing 90 million Mbps of
    traffic on targeted endpoints. According to XXXXXXXXXXXX,
    the GOE's  assessment was that a small but unknown number
    of  individuals were behind these more sophisticated cyber
    attacks, which quickly dwarfed the traffic volume of the
    initial cyber rioters.

    ¶4. (S) On May 3, the cyber attacks expanded beyond GOE
    sites and servers to private sites. Hansabank and SEB,
    Estonia's two largest banks, faced the most significant
    problems. Swedish-owned Hansabank and SEB account for
    almost 75% of all online banking in Estonia. (Note:
    Approximately 90% of all money transfers and bill
    payments in Estonia are done online. End Note.)
    Hansabank was well prepared with powerful servers,
    alternate sites to mirror content (thus making it more
    difficult for DDoS attacks), and the ability to
    reallocate access lines from foreign to domestic
    customers. However, even though Hansabank's site
    remained online, XXXXXXXXXXXX estimated that it came
    at a cost -  - at least 10 million Euros ($13.4 million)
     Hansabank  also had to temporarily block access to its site by all
    foreign ISPs so that there was enough broadband capacity
    for its domestic clients. However, Hansabank was able to
    create alternate access mechanisms for its largest
    foreign customers. Correcting much of the press coverage
    in the early days of the attacks, XXXXXXXXXXXX
     said that  while the cyber attacks against Hansabank and SEB were a
    challenge, there was no serious danger of Estonia's
    banking sector being shut down.

    ¶5. (S) This second wave of cyber attacks also hit the
    websites of Postimees, Estonia's paper of record, and
    Eesti Paevaleht, a leading Estonian-language daily, which
    over two-thirds of Estonians regularly visit for their
    news. "Imagine if you can the psychological effect,"
    XXXXXXXXXXXX asked us, "when an Estonian tries to
    pay his bills but can't or get the news online but can't." As
    one of the most wired countries on the planet, GOE
    interlocutors viewed the evolution of the attacks as a
    frightening threat to key economic and societal
    infrastructure.

    ¶6. (S) The attacks reached their apex on May 9, the
    Russian anniversary of the end of World War II. To cope
    with the rising volume of attacks, the GOE increased its
    broadband capacity from two Gbps (Gigabites per second)
    to eight Gbps. Hansabank, SEB, Postimees, and others
    also added servers to increase broadband capacity. A
    EUCOM cyber defense expert described it as a "cyber arms
    race" where the Estonians repeatedly increased their
    broadband capacity to match the increasing volume of
    cyber attacks (Ref D). XXXXXXXXXXXX told us that XXXXXXXXXXXX
    increased the  "broadband pipe" for both government and private
    clients  at a frantic pace to keep up with the attacks.
    XXXXXXXXXXXX  told us that one GOE ministry increased
    its original  server capacity of 30 Mbps to 1 Gbps (1 Gbps
    equals 1000  Mbps). XXXXXXXXXXXX said that this defensive
    response by  the GOE and the private sector was ultimately
    successful,  but it was extremely expensive.

    ¶7. (S) The number of attacks steadily declined after May
    9 and 10, allowing GOE and private sites to reduce their
    broadband capacity. However, on May 15, there was an
    unexpected spike in attacks that focused on Hansabank and
    SEB. In two separate and coordinated 15 minute attacks,
    these two sites were hit with over 400 bot attacks
    (roughly half the number of bot attacks recorded on May
    10) from multiple ISPs. The attacks temporarily crashed
    SEB's site for 30 minutes. Since the May 15 spike, the
    number of attacks has declined and is now hovering
    slightly above pre-April 27 numbers.

    No Smoking Gun

    TALLINN 00000366 003 OF 004
    ¶8. (S) On May 2, Foreign Minister Urmas Paet released a
    statement that the MFA had proof that some of the attacks
    originated from GOR ISPs. The Estonian and international
    press carried Paet's claim, but  XXXXXXXXXXXX interlocutors
    distanced themselves from the accusation.
    XXXXXXXXXXXX  privately said to us that no "smoking gun"
    incriminating  Moscow has turned up and likely won't.
    The use of bots,  proxies, and spoofing tactics makes it
    extremely  difficult to determine with any certainty the origin
    of  the attacks. Press reports suggested that a million
    computers were involved in the attacks. However,
    XXXXXXXXXXXX admitted that due to Estonia's poor
    monitoring  capability, XXXXXXXXXXXX could only speculate on the
    number of computers and servers attacking Estonia, and had
    even less specific information on the origins of the attacks.
    (Note. XXXXXXXXXXXX said that the one million figure
     used by  the press and the GOE was from a quote to the press
    taken out of context in which he tried to explain how he could
    only speculate a number ranging from a 1000 to a million
    computers. End Note.)

    ¶9. (S) The GOE believes it has enough circumstantial
    evidence to link Moscow with the attacks. As President
    Ilves told the Ambassador, renting the large number of
    bots used in these attacks is an expensive business.
    Moreover, as XXXXXXXXXXXX repeatedly asked us in
    conversations, "Who benefits from these attacks?" He
    speculated that the probing nature of the attacks on
    specific government and strategic private sector targets
    through the use of anonymous proxies fit the modus
    operandi of the Putin regime testing a new "weapon."
    XXXXXXXXXXXXX told us that the GOE now feels that their original
    assessment of a "cyber riot" may have been incorrect.
    "Looking at the patterns of the attacks, it is clear that
    there was a small, core of individuals who intended to
    launch their attack on May 9," XXXXXXXXXXXX explained, "but
    when the MOD announced its plans to move the Bronze
    Soldier on April 27, they moved up their plans to try to
    link the attacks with the monument's removal." Estonian
    analysis of these later sophisticated attacks and
    organization through Russian-language internet forums has
    led them to believe that the key individuals tried to
    disguise their initial attacks as a cyber riot. "You
    don't expect spontaneous, populist cyber attacks to have
    a pre-determined list of targets and precise dates and
    times for coordinated attacks," said XXXXXXXXXXX.

    ¶10. (S) GOE interlocutors expressed their frustration
    that their requests for information from the GOR or
    action on Russian-based ISP attacks were not answered or
    acted upon. XXXXXXXXXXX complained that cooperation
    with  Russia's CERT was almost nonexistent. Even at the height
    of the Bronze Soldier controversy, GOE interlocutors who
    regularly work with their Russian counterparts (e.g., law
    enforcement, customs and tax, border guards, etc.) tell
    us that working level cooperation was positive. In
    comparison, the lack of responsiveness by the GOR and
    Russian CERT personnel only diminished Russia's claims of
    innocence in the eyes of the Estonians.

    ¶11. (S) On May 29, Konstantin Koloskokov, Commissar of
    the pro-Kremlin youth group Nashi in Transnistria,
    claimed responsibility for some of the early cyber
    attacks. While not discounting the possibility of his
    involvement, XXXXXXXXXXXX noted that some of the
    attacks were  extremely sophisticated; beyond the technical
    abilities  of an amateur. To illustrate the point, XXXXXXXXXXXX
     and  XXXXXXXXXXXX described an attack that used a mysterious
    data  packet to crash a GOE and Elion router so quickly that
    the Estonians are still uncertain how it was done.
    XXXXXXXXXXXX described in detail a number of
    additional  attacks using different tools and techniques
    and targets  to argue that an organized group with deep
    financial backing was the likeliest culprit. "Koloskokov is
    window  dressing," said XXXXXXXXXXXX, "a convenient
    set-up by the  real perpetrators."

    TALLINN 00000366 004 OF 004

    PHILLIPS

`