[MatthewJ]

Three weeks of intensive attacks and yet the pathetically weak NATO cannot even bring themselves to point the finger at the bully in case they offend him.
They won't even define a cyber-attack as military action, which it clearly is (GRU) in this case. It's high time for action and sanctions against this terrorist bully.

Russia accused of unleashing cyberwar to disable Estonia

· Parliament, ministries, banks, media targeted
· Nato experts sent in to strengthen defences

Ian Traynor in Brussels
Thursday May 17, 2007
The Guardian

A three-week wave of massive cyber-attacks on the small Baltic country of Estonia, the first known incidence of such an assault on a state, is causing alarm across the western alliance, with Nato urgently examining the offensive and its implications.

While Russia and Estonia are embroiled in their worst dispute since the collapse of the Soviet Union, a row that erupted at the end of last month over the Estonians' removal of the Bronze Soldier Soviet war memorial in central Tallinn, the country has been subjected to a barrage of cyber warfare, disabling the websites of government ministries, political parties, newspapers, banks, and companies.

Nato has dispatched some of its top cyber-terrorism experts to Tallinn to investigate and to help the Estonians beef up their electronic defences.

"This is an operational security issue, something we're taking very seriously," said an official at Nato headquarters in Brussels. "It goes to the heart of the alliance's modus operandi."

Alarm over the unprecedented scale of cyber-warfare is to be raised tomorrow at a summit between Russian and European leaders outside Samara on the Volga.

While planning to raise the issue with the Russian authorities, EU and Nato officials have been careful not to accuse the Russians directly.

If it were established that Russia is behind the attacks, it would be the first known case of one state targeting another by cyber-warfare.

Relations between the Kremlin and the west are at their worst for years, with Russia engaged in bitter disputes not only with Estonia, but with Poland, Lithuania, the Czech Republic, and Georgia - all former parts of the Soviet Union or ex-members of the Warsaw Pact. The electronic offensive is making matters much worse.

"Frankly it is clear that what happened in Estonia in the cyber-attacks is not acceptable and a very serious disturbance," said a senior EU official.

Estonia's president, foreign minister, and defence minister have all raised the emergency with their counterparts in Europe and with Nato.

"At present, Nato does not define cyber-attacks as a clear military action. This means that the provisions of Article V of the North Atlantic Treaty, or, in other words collective self-defence, will not automatically be extended to the attacked country," said the Estonian defence minister, Jaak Aaviksoo.

"Not a single Nato defence minister would define a cyber-attack as a clear military action at present. However, this matter needs to be resolved in the near future."

Estonia, a country of 1.4 million people, including a large ethnic Russian minority, is one of the most wired societies in Europe and a pioneer in the development of "e-government". Being highly dependent on computers, it is also highly vulnerable to cyber-attack.

The main targets have been the websites of:

· the Estonian presidency and its parliament

· almost all of the country's government ministries

· political parties

· three of the country's six big news organisations

· two of the biggest banks; and firms specializing in communications


It is not clear how great the damage has been.

With their reputation for electronic prowess, the Estonians have been quick to marshal their defences, mainly by closing down the sites under attack to foreign internet addresses, in order to try to keep them accessible to domestic users.

The cyber-attacks were clearly prompted by the Estonians' relocation of the Soviet second world war memorial on April 27.

Ethnic Russians staged protests against the removal, during which 1,300 people were arrested, 100 people were injured, and one person was killed.

The crisis unleashed a wave of so-called DDoS, or Distributed Denial of Service, attacks, where websites are suddenly swamped by tens of thousands of visits, jamming and disabling them by overcrowding the bandwidths for the servers running the sites. The attacks have been pouring in from all over the world, but Estonian officials and computer security experts say that, particularly in the early phase, some attackers were identified by their internet addresses - many of which were Russian, and some of which were from Russian state institutions.

"The cyber-attacks are from Russia. There is no question. It's political," said Merit Kopli, editor of Postimees, one of the two main newspapers in Estonia, whose website has been targeted and has been inaccessible to international visitors for a week. It was still unavailable last night.

"If you are implying [the attacks] came from Russia or the Russian government, it's a serious allegation that has to be substantiated. Cyber-space is everywhere," Russia's ambassador in Brussels, Vladimir Chizhov, said in reply to a question from the Guardian. He added: "I don't support such behaviour, but one has to look at where they [the attacks] came from and why."

Without naming Russia, the Nato official said: "I won't point fingers. But these were not things done by a few individuals.

"This clearly bore the hallmarks of something concerted. The Estonians are not alone with this problem. It really is a serious issue for the alliance as a whole."

Mr Chizhov went on to accuse the EU of hypocrisy in its support for Estonia, an EU and Nato member. "There is a smell of double standards."

He also accused Poland of holding the EU hostage in its dealings with Russia, and further accused Estonia and other east European countries previously in Russia's orbit of being in thrall to "phantom pains of the past, historic grievances against the Soviet union and the Russian empire of the 19th century." In Tallinn, Ms Kopli said: "This is the first time this has happened, and it is very important that we've had this type of attack. We've been able to learn from it."

"We have been lucky to survive this," said Mikko Maddis, Estonia's defence ministry spokesman. "People started to fight a cyber-war against it right away. Ways were found to eliminate the attacker."

The attacks have come in three waves: from April 27, when the Bronze Soldier riots erupted, peaking around May 3; then on May 8 and 9 - a couple of the most celebrated dates in the Russian calendar, when the country marks Victory Day over Nazi Germany, and when President Vladimir Putin delivered another hostile speech attacking Estonia and indirectly likening the Bush administration to the Hitler regime; and again this week.

Estonian officials say that one of the masterminds of the cyber-campaign, identified from his online name, is connected to the Russian security service. A 19-year-old was arrested in Tallinn at the weekend for his alleged involvement.

Expert opinion is divided on whether the identity of the cyber-warriors can be ascertained properly.

Experts from Nato member states and from the alliance's NCSA unit - "Nato's first line of defence against cyber-terrorism", set up five years ago - were meeting in Seattle in the US when the crisis erupted. A couple of them were rushed to Tallinn.

Another Nato official familiar with the experts' work said it was easy for them, with other organisations and internet providers, to track, trace, and identify the attackers.

But Mikko Hyppoenen, a Finnish expert, told the Helsingin Sanomat newspaper that it would be difficult to prove the Russian state's responsibility, and that the Kremlin could inflict much more serious cyber-damage if it chose to.

LINK

[Maxim Litvinov]

Simply put, a 'cyber war' is about as hard to identify and stop as is a boycott of the goods of a nationality. Calling for sanctions is just idiocy.

This 'cyber war' just involves individuals and groups in a variety of countries, mostly Russia, trying to fuck around with Estonian sites because they are pissed off. Mostly by going to websites. Not only is it not a 'state action', but the individuals and groups involved are basically impossible to trace and indeed for every Russian that visits an Estonian government site there can be no certainty it is not as a result of a legitimate web request rather than an attempt to overload servers.

Basically the only thing that can be done is the preventative measure of cutting off IP addresses from places deemed to be of risk - but that would severely cripple the effectiveness and reach of your site. Another thing would probably be to stop spitting on the memory of those soldiers who drove Nazis off your soil, but that's thinking outside the box...

[Falx]

Patriotism bites when it isn't you're country that their being patriotic about, doesn't it?

[MatthewJ]

This 'cyber war' just involves individuals and groups in a variety of countries, mostly Russia, trying to fuck around with Estonian sites because they are pissed off. Mostly by going to websites. Not only is it not a 'state action'...

Not a state action? About as plausible as me spending the last night with the Tooth fairy whilst Snow White and the Seven Dwarfs filmed it. Honestly, I expect nothing less from the person who thinks the murders of Politkovskaya, Ivan Safronov and Litvinenko were more likely carried out by Jack The Ripper than the regime which they exposed.

"Massive cyber-attacks"
"Unprecedented scale of cyber-warfare"

The main targets have been the websites of The Estonian presidency and its parliament, almost all of the country's government ministries, political parties, three of the country's six big news organisations, two of the biggest banks; and firms specializing in communications.

Some attackers were identified by their internet addresses - many of which were Russian, and some of which were from Russian state institutions.

"I won't point fingers. But these were not things done by a few individuals."

"This clearly bore the hallmarks of something concerted."

Estonian officials say that one of the masterminds of the cyber-campaign, identified from his online name, is connected to the Russian security service.

You must be right. Looks like a couple of kids playing around.

Another thing would probably be to stop spitting on the memory of those soldiers who drove Nazis off your soil, but that's thinking outside the box...

We have been through this already. It was a removal of a statue in Tallinn, that is all. It was moved, it wasn’t destroyed or desecrated, unlike Koenigsberg Castle or the countless churches all over Eastern Europe.

It was MOVED.

[Maxim Litvinov]

Not a state action?

Well, understandably you - who believe the Soviet Union still secretly exists - will believe anything. But for the record of others reading this, DDoS attacks have come from computers all around the place, mainly from all sorts of places in Russia.

A few attacks, as you put in bold, have come from 'Russian state institutions'. But, then again, this includes everything from schools to universities to libraries to hospitals to academies to local constabularies. It should not be surprising that if lots of Russian hackers are attacking Estonian sites, some are going to be doing so from such institutions.

As for unknown officials alleging that one DDoS attacker has a name that they connect to the FSB... well, not only is that the dodgiest evidence ever, but it doesn't really go in any way to showing some state-run attack any more than a person from the Pentagon posting at PoFo shows it's run by the US secret service.

It was MOVED.

If it was such a small thing that it was moved, as you suggest, then you'd think the good people of Tallinn would be happy to move it back seeing as it's caused so much controversy and now problems for their internet.

[alyster]

A few attacks, as you put in bold, have come from 'Russian state institutions'.

State institutions such as the government. Write to FM Urmas Paet if you want the IPs. He was offering them out to people who are intrested in them in one press converence.

As for unknown officials alleging that one DDoS attacker has a name that they connect to the FSB... well, not only is that the dodgiest evidence ever, but it doesn't really go in any way to showing some state-run attack any more than a person from the Pentagon posting at PoFo shows it's run by the US secret service.

Russia hasn't done anything to co-operate on stopping the cyber-criminals although Estonian side has sent requests.

Simply put, a 'cyber war' is about as hard to identify and stop as is a boycott of the goods of a nationality. Calling for sanctions is just idiocy.

Sanctions have been made. Russia has baned heavy vehicals from crossing teh Narva - Ivangorod border due to the bridge's "bad state". First of all the bridge is 100% Estonian and only one to assess it is Estonian side as only one to guarantee the safety is Estonian side. Futhermore according to current 2 sided treaties Russia had to give 90 day warning before such mesures for any reason.
Secondly Russian railways have stopped supplying oil via Estonia.

Another thing would probably be to stop spitting on the memory of those soldiers who drove Nazis off your soil, but that's thinking outside the box...

Reburrying from city center with heavy traffic, alot of people moving, ongoing clashes between the neosoviets and nationalists to a peaceful cemetary - what a disrespect

Or should have we kept in the buisy city center where neosoviets held their rallies and then taken flowers to it thinking, "Thank you liberator soldier for murdering my gradfather and deporting my grandmother to Siberia for slavelabour" .

[Falx]

I don't know how to DDoS but I do know how to edit packets, and I can "make" the CIA central computer "attack" any institution I choose. And in your twisted little world that would mean the US declared war on Kentucky.

Back in the day when people were still figuring this shit out one of the tricks I saw was a DoS attack on a mail server with ip from another server, the two kept telling each other not to talk and it slowed traffic a lot more than just the regular attack would have.

[Shade2]

It is fairly well known that Russia secret service have internet division engaging in psy-ops on internet-spreading disinformation, monitoring political blogs, publishing pro-Russian propaganda and so on.

[Falx]

And some of their best agents are Shade2 and MathewJ, who discredit anyone that might have a rational argument against Russian foreign policy.

[Maxim Litvinov]

It is fairly well known that Russia secret service...

No doubt lots of things are 'fairly well known' in idiot-conspiracist cliques. MatthewJ will tell you it's 'fairly well known' that the USSR still exists :/

Write to FM Urmas Paet if you want the IPs.

No thanks. Cite or shut up. The article says 'some of which were from Russian state institutions', which is a far cry from the conspiracists' "OMGZ! Putin/FSB is attacking us!".

Sanctions have been made.

We're talking about over this 'cyberwar'.

Reburrying from city centre with heavy traffic

Sorry - the statue was in the middle of the road? We've been through the excuses (or lack of them) for moving it, but the real reason comes in your final line: the Estonians moved it because many don't really think the Red Army's defeat of Fascism deserves commemmoration.

[Shade2]

the Estonians moved it because many don't really think the Red Army's defeat of Fascism deserves commemmoration.

I think it has more to do with the fact that people don't want signs of foreign occupation by soldiers of an army that was notorious for rapes, thievery and tormenting the civilians.

No doubt lots of things are 'fairly well known' in idiot-conspiracist cliques.

I wasn't talking about your friends.

[alyster]

Sorry - the statue was in the middle of the road?

Actucally yes. It is closly surounded by 3 roads, leaving there a quite small ground. Moreover a trollybus stop was right in front of it so even more traffic.

We're talking about over this 'cyberwar'.

When you were speaking of sanctions then it wasn't "we're talking of cyberwar", now when u have nothing to say then "we're speaking of a cyber war".

The article says 'some of which were from Russian state institutions', which is a far cry from the conspiracists' "OMGZ! Putin/FSB is attacking us!".

The article can say alot of things, it's not an official source unlike FM's press converense.

Estonians moved it because many don't really think the Red Army's defeat of Fascism deserves commemmoration

You still haven't pointed out what's wrong with a peaceful cemetary, where alot more soviet soldiers have been burried.

In overall to the topic. This Estonian - Russian row is nothing extraordinary. Russia has been trying for long time to rive the EU's old and new memberstates. Lets start with the polish meat embargo or the fact that Russia refueses to supply oil to Lithuania. Now Estonia. Moreover they are part Russian - Democradic West's row, where to we can also add the missile defense system, Putin's promise to resign from the missile treaty etc. It's partly due to Russian neoiperialism. Maxim once tried to be smart and said that nothing changed in Russia after the February revolution(1917) because basically the same people were left to lead the country. We have the same case today. Putin and Ivanov are ex KGB, Lavrov and Fradkov are ex soviet diplomats etc. So same people, same style?
Also we should note that they atlist try to pretent democracy. Although things with free media and Kreml's oposition aren't too good for some reason they still hold elections. So new elections are coming up- parlament elections in fall of 2007 and president elections in 2008. The government needs to boost their ratings. Steps have been taken to show Russian Fed. citizens that now Russia is doing this and that to punish the Eastern-Europeans who don't want to be part of the Russian empire. That even though the steps may be economically bad to Russia aswell.

[Attila The Nun]

This 'cyber war' just involves individuals and groups in a variety of countries, mostly Russia, trying to fuck around with Estonian sites because they are pissed off. Mostly by going to websites. Not only is it not a 'state action', but the individuals and groups involved are basically impossible to trace and indeed for every Russian that visits an Estonian government site there can be no certainty it is not as a result of a legitimate web request rather than an attempt to overload servers.

Isn't that a bit hasty to rule out anything at this point, including the Russian government? While it is rash of Estonia or NATO to accuse the Russian government, we cannot know for sure what exactly these attacks are coming from until the investigation comes to a close.

And I highly doubt that this is not a DOS attack. Can you explain why tens of thousands, as desrcibed in the article, would all of the sudden visit a site at once? Highly improbable.

[Shade2]

That even though the steps may be economically bad to Russia aswell.

Economy is just a tool of war for Russia.
One doesn't worry if the blade will get dirty when trying to kill somebody.
For Russia money is nothing, it is just a means of conquest. They can lose as much as it is needed just to enslave others. Power and enslavement of others is what Russian imperialists value over all other things.

[kami321]

This 'cyber war' just involves individuals and groups in a variety of countries, mostly Russia, trying to fuck around with Estonian sites because they are pissed off.

You have to ask yourself here though, who is responsible for these Russians being so pissed off? Maybe the state-sponsored propaganda that constantly pours shit on the Balts, more than they deserve? Or you are one of those who believes that the media is always balanced and fair?

[Shade2]

ou have to ask yourself here though, who is responsible for these Russians being so pissed off?

The continuation of Soviet propaganda that portays Soviet Union as something positive and occupation of others as "liberation".
I mean I can meet a German who claims Germany was "liberating" world from Jews in WW2 on the Internet, but I don't see that in German state's statements. On the other hand Russian officials continue to claim that Soviets "liberated" Europe.

[InterestedInPolitics]

Estonia should retialate and attack russian government websites. Russia won't learn to respect Estonia until Estonia fights fire with fire. Denial of Service attacks are not too hard to do. I am willing to bet russian government sites are expecting retialiation and are prepared for it, so perhaps the Estonians should wait and hit back when the time is right and take down Russian government websites.

[alyster]

I strongly disagree with you VForVendetta. This would be the worst thing we could do. That for 2 reasons. First of all it wouldn't be fitting for EU memberstate to attack another country like that. It's totally oposite to European values. Secondly so far Russian attacks have mostly tried to overload the servers. These aren't too complicated attacks and some Russian forums have been showing how everyone can do it. The real brains in Russia are not involved with it. Although someone did hack Reform's party's(PM's party) webpage and posted an apology. That's it with that kind of attacks, luckily if I may add. It's not like they can't do more damage.

On the sad side 2 strongly anti-Estonian media web pages were hacked. Their original page was replaced with Estonian symbolics and anthem. Don't know about the IPs in this case though...

[InterestedInPolitics]

I strongly disagree with you VForVendetta. This would be the worst thing we could do. That for 2 reasons. First of all it wouldn't be fitting for EU memberstate to attack another country like that. It's totally oposite to European values. Secondly so far Russian attacks have mostly tried to overload the servers. These aren't too complicated attacks and some Russian forums have been showing how everyone can do it. The real brains in Russia are not involved with it. Although someone did hack Reform's party's(PM's party) webpage and posted an apology. That's it with that kind of attacks, luckily if I may add. It's not like they can't do more damage.

On the sad side 2 strongly anti-Estonian media web pages were hacked. Their original page was replaced with Estonian symbolics and anthem. Don't know about the IPs in this case though...

What about your fighting spirit. It is like a bully who picks on somebody who is smaller than him in the school yard. You won't get respect until you punch him in the nose and fight back. And even if he kicks your ass, at least you went down fighting.

[Kiroff]

That would be as much a gift for Russia as the Russian cyber-attacks were for Estonia and Washington to justify the whole dirty police charade as "defense from the evil cyber-communism." Except this would justify the FSB and its programs like SORM to do an attack of an unprecedented scale, to "defend its institutions from cyber-terrorists" or some generic crap reprinted from some memo by the US Department of Homeland Security. I don't think it's a good idea. Provocations of any kind are bad, unless they are completely worth it. Both cases were not worth it. Voluntary boycotts by individuals are okay, but when governments get into it it gets pretty dirty.