From Estonia, lessons for the Age of Cyberwar

Attackers crippled Estonia's digital networks in 2007. Since then, it has shored up cyberdefenses while expanding connectivity to every corner of daily life.

Long before Moscow became the prime suspect in the Democratic National Committee data breach, hackers tied to the Russian government have sought to sew political discord via the internet.

Most notably, many experts believe that in 2007 Russian operatives unleashed a series of devastating cyberattacks on neighboring Estonia following a dispute with Moscow over a Soviet-era war memorial.

At the time, Estonia had the world's most connected society, giving attackers plenty of targets. They succeeded in taking down government computers, banks, and newspaper sites, trying to paralyze the "e-way of life" Estonians painstakingly crafted after the Soviet Union dissolved in 1991.

And now, as a growing number of digital attacks hit countries' most critical systems, from hospitals to electric utilities to voting infrastructure, Estonia has become a critical voice and an important model when it comes to preparing for escalating conflict in cyberspace.

"Estonia's drum-beating has helped increase the dialogue among other nation-states about what aggressive actions in cyberspace warrant either a political, military, or economic response, or a combination of these," says John Bumgarner, research director at the US Cyber Consequences Unit, an independent, nonprofit research institute in Washington.

Indeed, in the years after the 2007 attacks, and with President Toomas Hendrik Ilves taking the lead, Estonia has challenged the world to pay closer attention to cyberwarfare. 

"The first battle in the wars of the future will be over the control of cyberspace," said Lani Kass, a special assistant to the US Air Force chief of staff, four months after the digital assault on Estonia. "If we don’t dominate cyberspace, we won’t be able to dominate air, space, land, or sea domains."

In 2008, NATO established its center of excellence for cyberdefense in Tallinn, Estonia's capital city. Today, it's where Americans meet with allies to conduct hands-on cyberwar simulation exercises.

"It’s about how those countries would come together if an aggressor like Russia caused some harm on an another member," says Mr. Bumgarner. 

That's a conversation that's taking place in Washington in light of allegations that Russians breached the networks of the Democratic National Committee and separate reports of hackers compromising state election boards. 

As a result of those reports, US lawmakers and government officials are considering a range of measures including new federal legislation that would safeguard the polls.

After the 2007 attacks, Estonia went to great lengths to harden its digital security. It's currently in the process of improving its encrypted digital ID card that citizens use when doing everything from filing taxes to paying library fines to buying bus passes to casting votes. Estonia started issuing e-residency cards to nonresidents in late 2014.

The ID card provides an important layer of protection for the country, say Estonian officials. "Security is multilayered. If there is a weakness, this does not mean that attacker can hack to system and cause harm," said Agu Kivimägi, a former IT head for Estonia's interior ministry.

And that helps protect Estonia's digital voting system, too, he said. "The electoral system is the basis of democracy, and you must defend it."

To be sure, the introduction of Estonian-like electronic ID cards would face tremendous opposition in the US and other Western democracies. Critics of relatively new laws in several states that require voters show photo ID at the polls say the practice can be discriminatory and even discourage people to vote.

"Estonia is a good model, but one that would be hard for the US to duplicate," says James Lewis, senior vice president at the Center for Strategic and International Studies in Washington.

"At the end of the day, cybersecurity is a government responsibility," said Mr. Lewis. "Estonia’s government led the rest of the country in creating an integrated defense. [The US is] bigger and is in a slow-moving constitution crisis."

Still, Piret Pernik of the Tallinn-based International Centre for Defense and Security, Russia's alleged tampering with US politics and election systems "put into question the reliability of the system, the accuracy of the election results for the general public."

And even if there's no tangible effect of the breaches on the outcome of the upcoming presidential election, "In that sense, Russians may have achieved their political goals," she said.

And, like many other experts, Ms. Pernik drew parallels between the DNC hack to the 2007 Estonian attacks. "The methods are not the same but the main goal, to discredit western rule power, confuse society, and undermine the western system of democracy, is the same."