2007 cyberattacks on Estonia

Series of cyberattacks which began on 27 April 2007 January 2021 Beginning on 27 April 2007, a series of cyberattacks targeted websites of Estonian organizations, including Estonian parliament, banks, ministries, newspapers and broadcasters, amid the country's disagreement with Russia about the relocation of the Bronze Soldier of Tallinn, an elaborate Soviet-era grave marker, as well as war graves in Tallinn.The Guardian 17 May 2007 https://www.theguardian.com/russia/article/0,,2081438,00.html Russia accused of unleashing cyberwar to disable Estonia Ian Traynor https://web.archive.org/web/20200314094038/https://www.theguardian.com/world/2007/may/17/topstories3.russia 14 March 2020 13 December 2016 liveWar in the fifth domain. Are the mouse and keyboard the new weapons of conflict? https://www.economist.com/briefing/2010/07/01/war-in-the-fifth-domain The Economist 1 July 2010 2 July 2010 https://web.archive.org/web/20180818000643/https://www.economist.com/node/16478792 18 August 2018 live Most of the attacks that had any influence on the general public were distributed denial of service type attacks ranging from single individuals using various methods like ping floods to expensive rentals of botnets usually used for spam distribution. Spamming of bigger news portals commentaries and defacements including that of the Estonian Reform Party website also occurred. BBC 25 January 2008 23 February 2008 Estonia fines man for 'cyber war' https://news.bbc.co.uk/2/hi/technology/7208511.stm https://web.archive.org/web/20190227192203/http://news.bbc.co.uk/2/hi/technology/7208511.stm 27 February 2019 live Research has also shown that large conflicts took place to edit the English-language version of the Bronze Soldier's Wikipedia page.Graham Mark Zook Matthew Boulton Andrew 2012-08-10 Augmented reality in urban places: contested content and the duplicity of code Transactions of the Institute of British Geographers 38 3 464–479 10.1111/j.1475-5661.2012.00539.x 0020-2754 This series of attacks has sometimes been called "Web War 1".Schultz Teri April 26, 2017 Atlantic Council New Atlanticist https://www.atlanticcouncil.org/blogs/new-atlanticist/a-decade-after-web-war-1-former-estonian-president-blasts-eu-cyber-inertia/ A Decade After "Web War 1," Former Estonian President Blasts EU Cyber Inertia 9 August 2026 https://web.archive.org/web/20260304060932/https://www.atlanticcouncil.org/blogs/new-atlanticist/a-decade-after-web-war-1-former-estonian-president-blasts-eu-cyber-inertia/ 4 March 2026 live Some observers reckoned that the onslaught on Estonia was of a sophistication not seen before. The case is studied intensively by many countries and military planners as, at the time it occurred, it may have been the second-largest instance of state-sponsored cyberwarfare, following Titan Rain.The Economist 24 May 2007 http://www.economist.com/world/international/displaystory.cfm?story_id=E1_JNNRSVS Cyberwarfare is becoming scarier 26 May 2007 9 December 2008 https://web.archive.org/web/20081209081836/http://www.economist.com/world/international/displaystory.cfm?story_id=E1_JNNRSVS dead As of January 2008, one ethnic-Russian Estonian national had been charged and convicted.https://news.bbc.co.uk/2/hi/technology/7208511.stm BBC News Estonia fines man for 'cyber war' 25 January 2008 22 April 2010 https://web.archive.org/web/20190227192203/http://news.bbc.co.uk/2/hi/technology/7208511.stm 27 February 2019 live During a panel discussion on cyber warfare, Sergei Markov of the Russian State Duma has stated his unnamed aide was responsible in orchestrating the cyber attacks. Markov alleged the aide acted on his own while residing in an unrecognised republic of the former Soviet Union, possibly Transnistria.Radio Free Europe 6 March 2009 https://www.rferl.org/a/Behind_The_Estonia_Cyberattacks/1505613.html Behind The Estonia Cyberattacks Robert Coalson https://web.archive.org/web/20260308133946/https://www.rferl.org/a/Behind_The_Estonia_Cyberattacks/1505613.html 8 March 2026 19 April 2026 live On 10 March 2009 Konstantin Goloskokov, a "commissar" of the Kremlin-backed youth group Nashi, has claimed responsibility for the attack.11 March 2009 Kremlin-backed group behind Estonia cyber blitz https://www.ft.com/content/57536d5a-0ddc-11de-8ea3-0000779fd2ac deviated https://web.archive.org/web/20090411032143/http://www.ft.com/cms/s/0/57536d5a-0ddc-11de-8ea3-0000779fd2ac.html 11 Apr 2009 Financial Times Experts are critical of these varying claims of responsibility.http://www.darkreading.com/blog/archives/2009/03/authoritatively.html Authoritatively, Who Was Behind The Estonian Attacks? https://web.archive.org/web/20090701212951/http://www.darkreading.com/blog/archives/2009/03/authoritatively.html 1 July 2009 17 March 2009 The direct result of the cyberattacks was the creation of the NATO Cooperative Cyber Defence Centre of Excellence in Tallinn, Estonia. Estonia's response The Estonian government was quick to blame the Kremlin, accusing it of being directly involved in the attacks. However, later, Jaak Aaviksoo, admitted that he had no evidence linking the cyber-attacks to the Kremlin. "Of course, at the moment, I cannot state for certain that the cyber-attacks were managed by the Kremlin, or other Russian government agencies," he said in an interview on Estonia's Kanal 2 TV channel, "Again, it is not possible to say without doubt that orders came from the Kremlin, or that, indeed, a wish was expressed for such a thing there." Russia called the accusations of its involvement "unfounded", and neither NATO nor European Commission experts were able to find any proof of official Russian government participation.Bright Arthur Estonia accuses Russia of "cyberattack" https://www.csmonitor.com/2007/0517/p99s01-duts.html Christian Science Monitor 17 May 2007 10 May 2017 https://web.archive.org/web/20170518061111/http://www.csmonitor.com/2007/0517/p99s01-duts.html 18 May 2017 live Since the attack, Estonia has advocated for increased cybersecurity protection and response protocol. NATO's response In response to such attacks, NATO conducted an internal assessment of their cyber security and infrastructure defenses. The assessment resulted in a report issued to the allied defense ministers in October 2007. It further developed into the creation of a cyber defense policy and the creation of the NATO Cooperative Cyber Defence Center of Excellence (CCDCOE) in May 2008. Due to the attacksMarch 2022, the Tallinn Manual on the International Law Applicable to Cyber Warfare was also developed. This report outlined international laws which are considered applicable to the cyber realm. The manual includes a total of ninety-five "black-letter rules" addressing cyber conflicts. The Tallinn Manual has worked to provide a global norm in cyber space by applying existing international law to cyber warfare. The manual suggests that states do not have sovereignty over the Internet, but that they do have sovereignty over components of the Internet in their territory.Shackelford Scott Estonia Two-and-A-Half Years Later: A Progress Report on Combating Cyber Attacks November 4, 2009 Journal of Internet Law 1499849Herzog Stephen Revisiting the Estonian Cyber Attacks: Digital threats and Multinational Responses Journal of Strategic Security 2011 4 2 49–60 10.5038/1944-0472.4.2.3 free Legalities On 2 May 2007, a criminal investigation was opened into the attacks under a section of the Estonian Penal Code criminalising computer sabotage and interference with the working of a computer network, felonies punishable by imprisonment of up to three years. As a number of attackers turned out to be within the jurisdiction of the Russian Federation, on 10 May 2007, Estonian Public Prosecutor's Office made a formal investigation assistance request to the Russian Federation's Supreme Procurature under a Mutual Legal Assistance Treaty (MLAT) existing between Estonia and Russia. A Russian State Duma delegation visiting Estonia in early May in regards the situation surrounding the Bronze Soldier of Tallinn had promised that Russia would aid such investigation in every way available. On 28 June, Russian Supreme Procurature refused assistance,Postimees 6 July 2007 http://postimees.ee/060707/esileht/siseuudised/270899.php Venemaa jätab Eesti küberrünnakute uurimisel õigusabita https://web.archive.org/web/20070708185138/http://www.postimees.ee/060707/esileht/siseuudised/270899.php 8 July 2007 et claiming that the proposed investigative processes are not covered by the applicable MLAT.Eesti Päevaleht 6 July 2007 http://www.epl.ee/artikkel/392271 Venemaa keeldus koostööst küberrünnakute uurimisel et 6 July 2007 https://web.archive.org/web/20070709042142/http://epl.ee/artikkel/392271 9 July 2007 live Piret Seeman, the Estonian Public Prosecutor's Office's PR officer, criticized this decision, pointing out that all the requested processes are actually enumerated in the MLAT. On 24 January 2008, Dmitri Galushkevich, a student living in Tallinn, was found guilty of participating in the attacks. He was fined 17,500 kroons (approximately US$1,640) for attacking the website of the Estonian Reform Party.Leyden John Estonia fines man for DDoS attacks The Register 24 January 2008 https://www.theregister.co.uk/2008/01/24/estonian_ddos_fine 22 February 2008 As of 13 December 2008, Russian authorities have been consistently denying Estonian law enforcement any investigative cooperation, thus effectively eliminating chances that those of the perpetrators that fall within Russian jurisdiction will be brought to trial.ERR 13 December 2008 http://uudised.err.ee/index.php?06147571 Venemaa keeldub endiselt koostööst küberrünnakute uurimisel et 16 December 2008 https://web.archive.org/web/20090112234331/http://uudised.err.ee/index.php?06147571 12 January 2009 live Opinions of experts Critical systems whose network addresses would not be generally known were targeted, including those serving telephony and financial transaction processing.Clarke R.A. Knake R.K. Cyber War: The Next Threat To National Security And What To Do About It Harper Collins 2010 Although not all of the computer crackers behind the cyberwarfare have been unveiled, some experts believed that such efforts exceed the skills of individual activists or even organised crime as they require a co-operation of a state and a large telecom company. A well known Russian hacker Sp0Raw believes that the most efficient online attacks on Estonia could not have been carried out without the blessing of the Russian authorities and that the hackers apparently acted under "recommendations" from parties in higher positions. http://www.smoney.ru/article.shtml?2007/05/28/3004 Электронная бомба. Кто стоит за кибервойной России с Эстонией https://web.archive.org/web/20071009061339/http://www.smoney.ru/article.shtml?2007%2F05%2F28%2F3004 9 October 2007 ru At the same time he called claims of Estonians regarding direct involvement of Russian government in the attacksTimes Online http://www.timesonline.co.uk/tol/news/world/europe/article1802959.ece https://web.archive.org/web/20080724143305/http://www.timesonline.co.uk/tol/news/world/europe/article1802959.ece dead 24 July 2008 Urmas Paet, the Estonian Foreign Minister, accused the Kremlin of direct involvement "empty words, not supported by technical data". Mike Witt, deputy director of the United States Computer Emergency Readiness Team (CERT) believes that the attacks were DDoS attacks. The attackers used botnets—global networks of compromised computers, often owned by careless individuals. "The size of the cyber attack, while it was certainly significant to the Estonian government, from a technical standpoint is not something we would consider significant in scale," Witt said.United Press International https://www.upi.com/Defense-News/2007/06/11/Analysis-Who-cyber-smacked-Estonia/26831181580439/ Analysis: Who cyber smacked Estonia? https://web.archive.org/web/20250527065845/https://www.upi.com/Defense-News/2007/06/11/Analysis-Who-cyber-smacked-Estonia/26831181580439 27 May 2025 28 September 2026 live Professor James Hendler, former chief scientist at The Pentagon's Defense Advanced Research Projects Agency (DARPA) characterised the attacks as "more like a cyber riot than a military attack." "We don't have directly visible info about sources so we can't confirm or deny that the attacks are coming from the Russian government," Jose Nazario, software and security engineer at Arbor Networks, told internetnews.com.Internetnews.com http://www.internetnews.com/security/article.php/3678606 Estonia Under Russian Cyber Attack? 10 July 2007 https://web.archive.org/web/20070621105331/http://www.internetnews.com/security/article.php/3678606 21 June 2007 live Arbor Networks operated ATLAS threat analysis network, which, the company claimed, could "see" 80% of Internet traffic. Nazario suspected that different groups operating separate distributed botnets were involved in the attack. Experts interviewed by IT security resource SearchSecurity.com "say it's very unlikely this was a case of one government launching a coordinated cyberattack against another": Johannes Ullrich, chief research officer of the Bethesda said "Attributing a distributed denial-of-service attack like this to a government is hard." "It may as well be a group of bot herders showing 'patriotism,' kind of like what we had with Web defacements during the US-China spy-plane crisis [in 2001]." Hillar Aarelaid, manager of Estonia's Computer Emergency Response Team "expressed skepticism that the attacks were from the Russian government, noting that Estonians were also divided on whether it was right to remove the statue".http://searchsecurity.techtarget.com/originalContent/0,289142,sid14_gci1255548,00.html Experts doubt Russian government launched DDoS attacks Bill Brenner 18 May 2007 SearchSecurity.com 5 August 2007 https://web.archive.org/web/20080516042653/http://searchsecurity.techtarget.com/originalContent/0,289142,sid14_gci1255548,00.html 16 May 2008 dead "Today security analysts widely believe that the attacks were condoned by the Kremlin, if not actively coordinated by its leaders." Andy Greenberg, author of the WIRED Guide to Cyberwar 23 August 2019. He noted that the next year, 2008, similar attacks on Georgia were accompanied by a Russian physical invasion. wired.com.https://www.wired.com/story/cyberwar-guide/ The WIRED Guide to Cyberwar WIRED Clarke and Knake report that upon the Estonian authorities informing Russian officials they had traced systems controlling the attack to Russia, there was some indication in response that incensed patriotic Russians might have acted on their own. Regardless of conjectures over official involvement, the decision of Russian authorities not to pursue individuals responsible—a treaty obligation—together with expert opinion that Russian security services could readily track down the culprits should they so desire, leads Russia observers to conclude the attacks served Russian interests. thumb|Photograph taken by Bill Woodcock in order to "vet" Hillar Aarelaid, then director of the Estonian Computer Emergency Response Team, to the NSP-Sec cybersecurity coordination community, in the CERT-EE NOC on the night of Tuesday, May 8, 2007. On May 23, 2012, the Atlantic Council convened a retrospective conference, "Building a Secure Cyber Future: Attack on Estonia, Five Years On" in which cyber-experts who had been involved in the conflict discussed lessons learned and how the field of cyber-conflict was changed by the Estonian attack and the following year's attack on Georgia. The conference was organized by Jason Healey, director of the Atlantic Council's Cyber Statecraft Initiative, and featured talks by Jaan Priisalu, Director General of Estonia's Information System Authority; Bill Woodcock, an American cybersecurity expert who assisted in the defense; Jonatan Vseviov, then Minister of Defense and subsequently Ambassador to the United States; Heli Tiirmaa-Klaar, Estonian Ambassador-at-Large for Cybersecurity; and others.Healey Jason Building a Secure Cyber Future: Attacks on Estonia, Five Years On https://www.atlanticcouncil.org/commentary/transcript/building-a-secure-cyber-future-transcript-5-23-12/ May 23, 2012 Atlantic Council 11 June 2021 https://web.archive.org/web/20210611002318/https://www.atlanticcouncil.org/commentary/transcript/building-a-secure-cyber-future-transcript-5-23-12/ 11 June 2021 live Priisalu discussed the attack's impact on the Estonian financial system, while Woodcock described the methods the Estonian CERT used to coordinate defensive actions with network operators and their counterparts in neighboring countries, and Vseviov talked about the broader societal implications of the attack, and NATO's Article 5 obligations. Claiming responsibility for the attacks A Commissar of the Nashi pro-Kremlin youth movement in Moldova and Transnistria, Konstantin Goloskokov (Goloskov in some sourceshttp://www.rferl.org/reports/FullReport.aspx?report=574&id=2007/05/574-07-09 https://web.archive.org/web/20070511062819/http://www.rferl.org/reports/FullReport.aspx?report=574&id=2007/05/574-07-09 dead 11 May 2007 Monument dispute with Estonia gets dirty), admitted organizing cyberattacks against Estonian government sites.Swiss Baltic Chamber of Commerce in Lithuania/Baltic News Service 2 June 2007 http://www.sbcc-chamber.com/index.php?lng=en&page_id=60&news_id=888 Commissar of Nashi says he waged cyber attack on Estonian government sites https://web.archive.org/web/20071010081133/http://www.sbcc-chamber.com/index.php?lng=en&page_id=60&news_id=888 10 October 2007 Goloskokov stressed, however, that he was not carrying out an order from Nashi's leadership and said that a lot of his fellow Nashi members criticized his response as being too harsh. Like most countries, Estonia does not recognise Transnistria, a secessionist region of Moldova. As an unrecognised nation, Transnistria does not belong to Interpol.Tiraspol Times 9 June 2007: Ministry of Internal Affairs lists PMR's 10 most wanted https://web.archive.org/web/20070927193021/http://www.tiraspoltimes.com/news/ministry_of_internal_affairs_lists_pmrs_10_most_wanted.html 27 September 2007 Accordingly, no Mutual Legal Assistance Treaty applies. If residents of Transnistria were responsible, the investigation may be severely hampered, and even if the investigation succeeds finding likely suspects, the legal recourseSeptember 2026 of Estonian authorities may be limited to issuing all-EU arrest warrants for these suspects. Such an act would be largely symbolic. Head of Russian Military Forecasting Center, Colonel Anatoly Tsyganok confirmed Russia's ability to conduct such an attack when he stated: "These attacks have been quite successful, and today the alliance had nothing to oppose Russia's virtual attacks", additionally noting that these attacks did not violate any international agreement.Военно-виртуальный альянс - Украина делает первые шаги на пути в НАТО gzt.ru 2008-02-08 http://gzt.ru:80/world/2008/02/07/220025.html https://web.archive.org/web/20080606033719/http://gzt.ru:80/world/2008/02/07/220025.html 2008-06-06 dead ru Influence on international military doctrines The attacks triggered a number of military organizations around the world to reconsider the importance of network security to modern military doctrine. On 14 June 2007, defence ministers of NATO members held a meeting in Brussels, issuing a joint communiqué promising action by the autumn of 2007.Eesti Päevaleht 15 June 2007 http://www.epl.ee/artikkel/389847 NATO andis rohelise tule Eesti küberkaitse kavale https://web.archive.org/web/20080604044853/http://www.epl.ee/artikkel/389847 4 June 2008 Ahto Lobjakas et NATO's Cooperative Cyber Defence Centre of Excellence (CCDCOE) was established in Tallinn on 14 May 2008.https://ccdcoe.org/about-us/ CCDCOE 25 April 2022 About Us https://web.archive.org/web/20260811020600/https://ccdcoe.org/about-us/ 11 August 2026 liveNATO launches cyber defence centre in Estonia https://www.spacewar.com/reports/NATO_launches_cyber_defence_centre_in_Estonia_999.html 25 April 2022 AFP 14 May 2008 https://web.archive.org/web/20210225102736/https://www.spacewar.com/reports/NATO_launches_cyber_defence_centre_in_Estonia_999.html 25 February 2021 live On 25 June 2007, Estonian president Toomas Hendrik Ilves met with US president George W. Bush.White House 4 May 2007 https://georgewbush-whitehouse.archives.gov/news/releases/2007/05/20070504-6.html President Bush to Welcome President Toomas Ilves of Estonia 25 August 2017 https://web.archive.org/web/20110503194044/http://georgewbush-whitehouse.archives.gov/news/releases/2007/05/20070504-6.html 3 May 2011 live Among the topics discussed were the attacks on Estonian infrastructure. Yahoo/AFP 25 June 2007 https://news.yahoo.com/s/afp/20070625/tc_afp/usestoniainternet Bush, Ilves eye tougher tack on cybercrime The events have been reflected in a NATO Department of Public Diplomacy short movie War in Cyberspace.Postimees 28 March 2009 http://www.postimees.ee/?id=100125 NATO tegi filmi Eesti "kübersõjast" et 28 March 2009 https://web.archive.org/web/20090331092221/http://www.postimees.ee/?id=100125 31 March 2009 live See also Bronze Night Cyberattacks during the 2008 South Ossetia war Fatal System Error Russian influence operations in Estonia References 30em External links Cyber War I: Estonia Attacked from Russia https://web.archive.org/web/20160402222657/http://www.europeaninstitute.org/index.php/component/content/article?id=67:cyber-war-i-estonia-attacked-from-russia 2 April 2016 , by Kertu Ruus, European Affairs: Volume number 9, Issue number 1–2 in the Winter/Spring of 2008. Estonian attacks were a cyber riot, not warfare, by Bill Brenner, 6 August 2007. Black Hat 2007: Estonia: Information Warfare and Strategic Lessons, by Gadi Evron, 26 Jul 2007. Estonia urges firm EU, NATO response to new form of warfare: cyber-attacks Massive DDoS attacks target Estonia; Russia accused Cyberattack on Estonia stirs fear of 'virtual war' https://web.archive.org/web/20081004164223/http://www.iht.com/articles/2007/05/18/news/estonia.php 4 October 2008 Estonia accuses Russia of 'cyberattack' Virtual harassment, but for real Digital Fears Emerge After Data Siege in Estonia EU urged to deepen cooperation after Estonia cyber-attacks The cyber pirates hitting Estonia Estonia hit by 'Moscow cyber war' Analysis: Who cyber smacked Estonia?August 2026 InternetArchiveBot by Shaun Waterman, UPI Hackers take down the most wired country in Europe by Joshua Davis, Wired, 2007-08-21. Georgetown Journal of International Affairs report – Battling Botnets and Online MobsApril 2020 by Gadi Evron who wrote the postmortem analysis of the attacks for the Estonian CERT Estonia Cyberattacks Category:Estonia–Russia relations Category:Internet in Estonia