Subscribe to the Free Print Edition!
Celebrating 25 Years

GCN Home > 06/16/08 issue

Lauri Almann | Lessons from the cyberattacks on Estonia

GCN Interview with Lauri Almann, Estonia’s permanent undersecretary of Defence

By Wyatt Kash

It’s been a little more than a year since botnets temporarily disabled Estonia’s government Web sites in an incident that could go down in history as the cyberattacks heard round the world.

Lauri Almann, Estonia’s permanent undersecretary of Defence, was part of the team that responded to the attacks. He was in Washington recently to discuss how to guard against future attacks and the steps Estonia is taking to prepare for what he believes could be an even more debilitating assault the next time. His videotaped comments are available in a series of one-to two-minute responses. The following is an excerpt of the interview.
GCN: Where were you when it became clear that the cyberattacks on Estonia were more than just a random assault? And how did the Ministry of Defence respond?

Lauri Almann: We were sitting in the government situation room, and suddenly in walks our chief [public relations] person, who says, “We are unable to put our press releases out” on government Web sites. We didn’t understand the seriousness of the problem until he said, “We are under cyberattack.” It was 1 a.m., 28th of April.

Immediately after we realized there was an attack going on against Estonia, we put together a team of experts from our departments of commerce, communications, military and the intelligence community, led by Estonian CERT, the Computer Emergency Response Team, which coordinated the overall response. The role of the Ministry of Defence was to organize international support. We were particularly successful in defeating some of those attacks because we were so quick to organize. We were also quite quick to put out the alerts to other CERTs around the world and organize an international response.

GCN: Describe how the attacks unfolded.

Almann: We experienced two phases of attacks. The first phase was carried out by what we call hacktivists. Relatively primitive and simple attack tools were used against Estonia by ordinary people who are instructed to attack Estonia mostly on Russian Web sites and those on which the attack tools were posted. Those attack tools were designed against Estonian Web sites — and mostly government Web sites, such as the Estonian government Briefing Room, Estonian Ministry of Defense and certain leading parties in Estonia. But the organizers were not able to come up with a sufficient amount of people taking part in those attacks. And at some point, there was a general fatigue.

More news on related topics: Communications / Networks, IT Security, IT Management, Web Strategies