RSS

Most of us have seen terrorism, if only on television. Compare the recent cyber attacks in Estonia to those scenes or experiences. The electronic interference in Estonia was not terrorism—in fact, the term “cyberterror” is senseless. Stop using it.

Terrorism requires violence and horror. On September 11th, for example, after a day of shocking images, riders of Washington’s subway system could still smell smoke in the tunnels from the burning Pentagon. In Estonia’s recent cyber incident, people were unable to access their bank accounts online.

What Really Happened
Estonia was a large, disruptive, cyber demonstration, akin to noisy mobs blocking traffic and preventing entrance to government Ministries. Computers connected to the Internet were overwhelmed with thousands of bogus messages and requests. Legitimate users were shut out and the computers, unable to handle the load, could no longer function. The attacks were launched automatically from “botnets,” a favored tool of cybercriminals that use thousands of hijacked computers for attacks.

No one died or was injured, dams did not burst, planes did not crash, and electricity was uninterrupted. If the events in Estonia were made into a blockbuster movie, it would star hordes of road-clogging Teletubbies, not Bruce Willis.

International Response
The attacks were first wrongly attributed to Russian government computers. Although a few official computers may have been part of the attacking botnets, it is more likely that Russian officials incited cybercriminals and hackers to punish Estonia for removing a large bronze statue of a Soviet soldier. Most former colonial powers accede to such changes—Britain did not unleash cybercriminals against India for dropping anglicized versions of city names—but Estonia’s relations with the former imperial power are closer and more complex.

It is not usually considered an act of war if a foreign government incites criminals and the disaffected to stage disruptive demonstrations in an opponent’s capital, but law and precedent are inadequate guides for cyber attack and likely to remain so for some time. It is easy to hide on the internet, and difficulties in attributing an attack complicate any response. At a minimum, we should regard the inciting nation as one unconstrained by international norms, whose actions and agents bear close watching. A treaty with such governments banning Internet attacks would be routinely violated and not worth the effort.

Increased Threats
But the Estonia attacks’ implications transcend Baltic tensions. While cyber protests are not new—Chinese, Taiwanese, and Korean hackers routinely take turns abusing government websites—the scale of the attacks, the brazen and immediate connection to a diplomatic dispute, and the links to cybercrime, deserve scrutiny. Cybercrime provides new tools, like massive botnets, for disruption. These tools can be purchased or rented from thriving online criminal communities and, when combined with a deep knowledge of the capacity and vulnerabilities of foreign networks, (many intelligence agencies have spent the last decade mapping opponent networks for exploitation or attack), they provide vast scope for mischief.

Bear in mind Estonia did not face the most damaging mode of cyberattack. Greater harm would ensue if attackers penetrated networks and scrambled or erased data and programs. Destroying tax and health records, disrupting flight and rail schedules, interfering with public utilities; all could have serious consequences. Larger countries would be more difficult to overwhelm than Estonia, but hackers could target individual agencies, key service providers or even entire cities.

Be Prepared
Cyber attacks are now part of international politics, and governments must be prepared to deal with them. Collective defense—sharing information and resources—can help, but computers are so intimately woven into the fabric of national infrastructures that the primary responsibility rests with national governments. The first step is to test important networks for vulnerability—using “red-teams” that mimic attackers. Cyber attacks are currently unpreventable, so governments must provide resiliency and redundancy for services and data supplied by computer networks.

Estonia’s response was timely and effective, and executed without little panic or media hyperbole. Other nations’ plans must account for the predilection for hysteria found in some media outlets, a preference that is abetted by those who argue that no one will pay attention to the cyber threat unless there is wild exaggeration that points to epic disaster.

We do not face disaster, but cyberspace cannot be an unguarded frontier and governments must prepare their defenses or else put their citizens at risk. Estonia was not the first cyberattack, and it will not be the last.


James Andrew Lewis is a senior fellow at the Center for Strategic & International Studies and director of their Technology and Public Policy Program. His experience with the U.S. Foreign Service and Senior Executive Service includes negotiations on arms transfers, advising the U.S. military, and developing new policies for national security and technology.