The rioting in cyberspace started on the evening of April 27 against political institutions and news portals. Over roughly four weeks, waves of DDoS attacks swamped the websites of banks, ministries, newspapers, and broadcasters. Botnets deluged sites with bogus requests for information. At its peak more than one million computers created data-request traffic equivalent to five thousand clicks per second on targets.55 Jaak Aaviksoo, the Estonian defense minister, remarked, “The attacks were aimed at the essential infrastructure of the Republic of Estonia. . . . This was the first time that a botnet threatened the national security of an entire nation.”56 Internet traffic that exceeded averageday peak loads by a factor of ten shut down the Estonian governmental website and those of numerous ministries, some for hours and others for days. Many sites were also defaced. The Estonian prime minister and other politicians were spammed, and the Estonian parliament’s email system was taken off-line. In addition, the Estonian news outlet Postimees Online closed foreign access to its networks after attacks on its servers.57
Map 2.1. Estonia
Source: Central Intelligence Agency, “Europe: Estonia,” The World Factbook, https://www.cia.gov/library/publications/resources/the-world-factbook/geos/en.html.
The second phase commenced on April 30 with four waves against mostly governmental websites and financial services. It delegated attack coordination to the command-and-control servers of botnets while the short first phase depended on forum communication and synchronized human actions.58 Initially, Russian-language Internet forums posted calls and instructions for patriotic hackers to launch ping commands, which check the availability of targeted computers. The instructions did not require advanced technical knowledge to follow—just a computer with an Internet connection. Later, executable files were made available to copy onto computers and launch automated ping requests. When coordinated across many users, the pings were effective but easily mitigated.59 The main attack in the second phase continued use of forum calls to schedule attacks at specific times to generate simultaneous large volumes against targets. However, the first wave on May 4 showed intensification and precision, which indicated the use of botnets.60
The DDoS attacks increased on May 8 (in conjunction with Victory Day in Russia, commemorating the defeat of Germany in World War II).61 On May 9, up to fifty-eight sites were shut down at once.62 The attackers used a giant network of enslaved computers, as far away as North America and the Far East, to amplify the impact.63 Banks were hit hard, especially Hansabank, the largest in Estonia, which suffered customer outages for hours. The third wave, on May 15, saw strong DDoS attacks via a botnet of eighty-five thousand hijacked computers.64 The Web portal of SEB Eesti Ühispank, the second-largest bank, went off-line for an hour and a half.65 In addition, hackers infiltrated and defaced individual websites while posting their own messages.66 The final wave struck on May 18, with diminished interruptions afterward.67 Over the course of the assault, at least three major Internet-service providers, three of the six largest news organizations or portals, and three mobile network operators in Estonia were disrupted to some extent.68 While the DDoS attacks definitely achieved effects on public and private targets, they did not achieve their larger goal, for after all the disruptions finally ended, the bronze statue remained in the tranquility of the cemetery.
The origin of the attacks was mainly, although not exclusively, from sources outside of Estonia. Furthermore, the source was worldwide, by compromised computers from 178 countries, indicative of a global botnet. A substantial number of the attackers were “crowds affected by nationalistic/political emotions” that carried out the attacks according to Russian hacker sites and Internet forums that appeared on April 28.69 Some were identifiable by their Internet Protocol (IP) addresses, and many were Russian, including some Russian state institutions and the presidential administration. However, Russian authorities denied any involvement.70 The first time anyone claimed responsibility was in March 2009, when Konstantin Goloskokov, a commissar of the Kremlin-backed Russian youth group Nashi, said that “he and some associates had launched the attack.”71 The Nashi claim added to assumptions concerning involvement by the Russian government. Besides the IP locations, there is also evidence that the Russian government rented time on botnets from transnational criminal syndicates at the peak of the assault. The editor of Postimees, Merit Kopli, said bluntly, “The cyber-attacks are from Russia. There is no question. It is political.”72 The timing and effects of the cyber assault did fit nicely into Russia’s overall foreign policy strategy of preserving its influence and safeguarding Russian minority populations in its neighboring countries.73
Madis Mikko, a spokesman for the Estonian defense ministry, said, “If a bank or an airport is hit by a missile, it is easy to say that is an act of war” and then asked, “But if the same result is caused by a cyber attack, what do you call that?”74 The “same result” charge of lasting physical damage is debatable, especially since the 2007 cyber operations against Estonia, which were widely referred to as “cyber war,” were not publicly characterized by “the international community as an armed attack.”75 The International Group of Experts, the author of the original Tallinn Manual, “agreed with this assessment on the basis that the scale and effects threshold was not reached.”76 Although the cyber operations caused no deaths, injuries, or physical damage, they did fundamentally affect the operation of the entire Estonian society. The effects were immediate and direct upon governmental services, the economy, and daily life. The consequences were more than mere inconvenience or irritation, albeit difficult to quantify since most involved denial of service rather than destruction or damage.77
Overall the cyber operations intentionally frustrated governmental and economic functions. Thus, Michael Schmitt concludes that “taken together as a single ‘cyber operation,’ the incidents arguably reached the use of force threshold. Had Russia been responsible for them under international law, it is likely that the international community would (or should) have treated them as a use of force in violation of the UN Charter and customary international law.”78 The attribution to Russia is lacking due to “no definitive evidence that the hacktivists involved in the cyber operations against Estonia in 2007 operated pursuant to instructions from any State, nor did any State endorse and adopt the conduct.”79 The most likely employment of proxies in the form of patriotic hackers confounds the second condition of “attributable to the State under international law” that is required to firmly establish the existence of an internationally wrongful act. Indisputable facts of this relationship do not exist, only indications that Russia was involved, although arguments are bolstered because the Russian Federation refused to cooperate with the Estonian Public Prosecutor’s Office in identifying the hacktivists behind the attacks.80 According to the prosecutor’s office, earlier similarly phrased requests under the Agreement on Mutual Legal Assistance had been met, but in the cyber operations case, the Russian Prosecutor’s Office conveniently took a different interpretation.81
Cyber Warfare
Paul Cornish, at Chatham House, argues that cyber warfare could be “the archetypal illustration of ‘asymmetric warfare’—a struggle in which one opponent might be weak in conventional terms but is clever and agile, while the other is strong but complacent and inflexible.”82 His definition for cyber warfare encompasses “a conflict between states, but it could also involve non-state actors in various ways. . . . The target could be military, industrial or civilian.”83 The Russian definition for cyber warfare is translated as “cyber attacks carried out by states, groups of states, or organized political groups, against cyber infrastructure, which are part of a military campaign,”84 whereas the US government’s definition is “an armed conflict conducted in whole or part by cyber means.