Keep Us Strong WikiLeaks logo

Currently released so far... 97115 / 251,287

Articles

Browse latest releases

Browse by creation date

Browse by origin

A B C D F G H I J K L M N O P Q R S T U V W Y Z

Browse by tag

A B C D E F G H I J K L M N O P Q R S T U V W X Y Z
ETRD EAGR ETTC EAID ECON EFIN ECIN EINV ELAB EAIR ENRG EPET EWWT ECPS EIND EMIN ELTN EC ETMIN EUC EZ ET ELECTIONS ENVR EU EUN EG EINT ER ECONOMICS ES EMS ENIV EEB EN ECE ECOSOC EK ENVIRONMENT EFIS EI EWT ENGRD ECPSN EXIM EIAD ERIN ECPC EDEV ENGY ECTRD EPA ESTH ECCT EINVECON ENGR ERTD EUR EAP EWWC ELTD EL EXIMOPIC EXTERNAL ETRDEC ESCAP ECO EGAD ELNT ECONOMIC ENV ETRN EIAR EUMEM ENRGPARMOTRASENVKGHGPGOVECONTSPLEAID EREL ECOM ECONETRDEAGRJA ETCC ETRG ECONOMY EMED ETR ENERG EITC EFINOECD EURM EENG ERA EXPORT ENRD ECONEINVETRDEFINELABETRDKTDBPGOVOPIC EGEN EBRD EVIN ETRAD ECOWAS EFTA ECONETRDBESPAR EGOVSY EPIN EID ECONENRG EDRC ESENV ETT EB ENER ELTNSNAR ECHEVARRIA ETRC EPIT EDUC ESA EFI ENRGY ESCI EE EAIDXMXAXBXFFR EETC ECIP EIAID EIVN EBEXP ESTN EING EGOV ETRA EPETEIND ELAN ETRDGK EAIDRW ETRDEINVECINPGOVCS EPEC ENVI ELN EAG EPCS EPRT EPTED ETRB EUM EAIDS EFIC EFINECONEAIDUNGAGM EAIDAR ESF EIDN ELAM EDU EV EAIDAF ECN EDA EXBS EINTECPS ENRGTRGYETRDBEXPBTIOSZ EPREL EAC EINVEFIN ETA EAGER EINDIR ECA ECLAC ELAP EITI EUCOM ECONEFINETRDPGOVEAGRPTERKTFNKCRMEAID EARG ELDIN EINVKSCA ENNP EFINECONCS EFINTS ECCP ETC EAIRASECCASCID EINN ETRP EAIDNI EFQ ECOQKPKO EGPHUM EBUD ECONEINVEFINPGOVIZ ENERGY ELB EINDETRD EMI ECONEFIN EIB EURN ETRDEINVTINTCS EIN EFIM ETIO ELAINE EMN EATO EWTR EIPR EINVETC ETTD ETDR EIQ ECONCS EPPD ENRGIZ EISL ESPINOSA ELEC EAIG ESLCO EUREM ENTG ERD EINVECONSENVCSJA EEPET EUNCH ECINECONCS ETRO ETRDECONWTOCS ECUN EFND EPECO EAIRECONRP ERGR ETRDPGOV ECPN ENRGMO EPWR EET EAIS EAGRE EDUARDO EAGRRP EAIDPHUMPRELUG EICN ECONQH EVN EGHG ELBR EINF EAIDHO EENV ETEX ERNG ED
KMDR KPAO KPKO KJUS KCRM KGHG KFRD KWMN KDEM KTFN KHIV KGIC KIDE KSCA KNNP KHUM KIPR KSUM KISL KIRF KCOR KRCM KPAL KWBG KN KS KOMC KSEP KFLU KPWR KTIA KSEO KMPI KHLS KICC KSTH KMCA KVPR KPRM KE KU KZ KFLO KSAF KTIP KTEX KBCT KOCI KOLY KOR KAWC KACT KUNR KTDB KSTC KLIG KSKN KNN KCFE KCIP KGHA KHDP KPOW KUNC KDRL KV KPREL KCRS KPOL KRVC KRIM KGIT KWIR KT KIRC KOMO KRFD KUWAIT KG KFIN KSCI KTFIN KFTN KGOV KPRV KSAC KGIV KCRIM KPIR KSOC KBIO KW KGLB KMWN KPO KFSC KSEAO KSTCPL KSI KPRP KREC KFPC KUNH KCSA KMRS KNDP KR KICCPUR KPPAO KCSY KTBT KCIS KNEP KFRDCVISCMGTCASCKOCIASECPHUMSMIGEG KNNB KGCC KINR KPOP KMFO KENV KNAR KVIR KDRG KDMR KFCE KNAO KDEN KGCN KICA KIMMITT KMCC KLFU KMSG KSEC KUM KCUL KMNP KSMT KCOM KOMCSG KSPR KPMI KRAD KIND KCRP KAUST KWAWC KTER KCHG KRDP KPAS KITA KTSC KPAOPREL KWGB KIRP KJUST KMIG KLAB KTFR KSEI KSTT KAPO KSTS KLSO KWNN KPOA KHSA KNPP KPAONZ KBTS KWWW KY KJRE KPAOKMDRKE KCRCM KSCS KWMNCI KESO KWUN KPLS KIIP KEDEM KPAOY KRIF KGICKS KREF KTRD KFRDSOCIRO KTAO KJU KWMNPHUMPRELKPAOZW KEN KO KNEI KEMR KKIV KEAI KWAC KRCIM KWCI KFIU KWIC KCORR KOMS KNNO KPAI KBWG KTTB KTBD KTIALG KILS KFEM KTDM KESS KNUC KPA KOMCCO KCEM KRCS KWBGSY KNPPIS KNNPMNUC KWN KERG KLTN KALM KCCP KSUMPHUM KREL KGH KLIP KTLA KAWK KWMM KVRP KVRC KAID KSLG KDEMK KX KIF KNPR KCFC KFTFN KTFM KPDD KCERS KMOC KDEMAF KMEPI KEMS KDRM KEPREL KBTR KEDU KNP KIRL KNNR KMPT KISLPINR KTPN KA KJUSTH KPIN KDEV KTDD KAKA KFRP KWNM KTSD KINL KJUSKUNR KWWMN KECF KWBC KPRO KVBL KOM KFRDKIRFCVISCMGTKOCIASECPHUMSMIGEG KEDM KFLD KLPM KRGY KNNF KICR KIFR KM KWMNCS KAWS KLAP KPAK KDDG KCGC KID KNSD KMPF KPFO KDP KCMR KRMS KNPT KNNNP KTIAPARM KDTB KNUP KPGOV KNAP KNNC KUK KSRE KREISLER KIVP KQ KTIAEUN KPALAOIS KRM KISLAO KWM KFLOA
PHUM PINR PTER PGOV PREL PREF PL PM PHSA PE PARM PINS PK PUNE PO PALESTINIAN PU PBTS PROP PTBS POL POLI PA PGOVZI POLMIL POLITICAL PARTIES POLM PD POLITICS POLICY PAS PMIL PINT PNAT PV PKO PPOL PERSONS PING PBIO PH PETR PARMS PRES PCON PETERS PRELBR PT PLAB PP PAK PDEM PKPA PSOCI PF PLO PTERM PJUS PSOE PELOSI PROPERTY PGOVPREL PARP PRL PNIR PHUMKPAL PG PREZ PGIC PBOV PAO PKK PROV PHSAK PHUMPREL PROTECTION PGOVBL PSI PRELPK PGOVENRG PUM PRELKPKO PATTY PSOC PRIVATIZATION PRELSP PGOVEAIDUKNOSWGMHUCANLLHFRSPITNZ PMIG PREC PAIGH PROG PSHA PARK PETER POG PHUS PPREL PS PTERPREL PRELPGOV POV PKPO PGOVECON POUS PGOVPRELPHUMPREFSMIGELABEAIDKCRMKWMN PWBG PMAR PREM PAR PNR PRELPGOVEAIDECONEINVBEXPSCULOIIPBTIO PARMIR PGOVGM PHUH PARTM PN PRE PTE PY POLUN PPEL PDOV PGOVSOCI PIRF PGOVPM PBST PRELEVU PGOR PBTSRU PRM PRELKPAOIZ PGVO PERL PGOC PAGR PMIN PHUMR PVIP PPD PGV PRAM PINL PKPAL PTERE PGOF PINO PHAS PODC PRHUM PHUMA PREO PPA PEPFAR PGO PRGOV PAC PRESL PORG PKFK PEPR PRELP PREFA PNG PGOVPHUMKPAO PRELECON PINOCHET PFOR PGOVLO PHUMBA PRELC PREK PHUME PHJM POLINT PGOVPZ PGOVKCRM PGOVE PHALANAGE PARTY PECON PEACE PROCESS PLN PRELSW PAHO PEDRO PRELA PASS PPAO PGPV PNUM PCUL PGGV PSA PGOVSMIGKCRMKWMNPHUMCVISKFRDCA PGIV PRFE POGOV PEL PBT PAMQ PINF PSEPC POSTS PHUMPGOV PVOV PHSAPREL PROLIFERATION PENA PRELTBIOBA PIN PRELL PGOVPTER PHAM PHYTRP PTEL PTERPGOV PHARM PROTESTS PRELAF PKBL PRELKPAO PKNP PARMP PHUML PFOV PERM PUOS PRELGOV PHUMPTER PARAGRAPH PERURENA PBTSEWWT PCI PETROL PINSO PINSCE PQL PEREZ PBS

Browse by classification

Community resources

courage is contagious

Viewing cable 08TALLINN326, ESTONIA CHARTS LEGAL, MILITARY FUTURE OF CYBER

If you are new to these pages, please read an introduction on the structure of a cable as well as how to discuss them with others. See also the FAQs

Understanding cables
Every cable message consists of three parts:
  • The top box shows each cables unique reference number, when and by whom it originally was sent, and what its initial classification was.
  • The middle box contains the header information that is associated with the cable. It includes information about the receiver(s) as well as a general subject.
  • The bottom box presents the body of the cable. The opening can contain a more specific subject, references to other cables (browse by origin to find them) or additional comment. This is followed by the main contents of the cable: a summary, a collection of specific topics and a comment section.
To understand the justification used for the classification of each cable, please use this WikiSource article as reference.

Discussing cables
If you find meaningful or important information in a cable, please link directly to its unique reference number. Linking to a specific paragraph in the body of a cable is also possible by copying the appropriate link (to be found at theparagraph symbol). Please mark messages for social networking services like Twitter with the hash tags #cablegate and a hash containing the reference ID e.g. #08TALLINN326.
Reference ID Created Released Classification Origin
08TALLINN326 2008-09-22 14:07 2011-02-22 00:00 CONFIDENTIAL Embassy Tallinn
VZCZCXYZ0010
RR RUEHWEB

DE RUEHTL #0326/01 2661407
ZNY CCCCC ZZH
R 221407Z SEP 08
FM AMEMBASSY TALLINN
TO RUEHC/SECSTATE WASHDC 0819
INFO RUEHMO/AMEMBASSY MOSCOW 2616
RUEHSI/AMEMBASSY TBILISI 0191
RUEHZL/EUROPEAN POLITICAL COLLECTIVE
RUEHZG/NATO EU COLLECTIVE
RUEHNO/USMISSION USNATO BRUSSELS BE
9/22/2008 14:07 CONFIDENTIAL
C O N F I D E N T I A L TALLINN 000326

SIPDIS

DEPT FOR EUR/NB, EEB/CIP and INR/EC

E.O. 12958: DECL: 09/21/2018
TAGS: PREL PGOV PINS TINT NATO RU GG EN
SUBJECT: ESTONIA CHARTS LEGAL, MILITARY FUTURE OF CYBER
WARFARE (INCLUDING APPLICABILITY OF NATO'S ARTICLE V)

Classified by: DCM Karen Decker for reasons 1.4 (b) & (d)

1. (C) Summary and Comment: In the wake of the August cyber attacks against government websites in the Republic of Georgia, Estonia has provided both material and technical assistance to Tbilisi. Lawyers at the Cyber Center of Excellence in Tallinn have produced a legal analysis of the status of cyber warfare under NATO's Article V. The Ministry of Defense (MOD) is prioritizing strategic-level cyber defense planning, and the MOD's forthcoming 2008 Cyber Defense Strategy will clarify lines of authority and create trip-wires to declare a national security threat during a future attack. Various Estonian experts all agree on one thing: Georgia was the latest victim of this new form of warfare, and the attacks are getting more effective each time. Estonia continues to lead international thinking on the cyber issue, having positioned itself as a niche expert on cyber defense based on its combination of past experience, a high level of IT expertise and dependence, and a small country's inevitable fears for its existence. End Summary and Comment.

2. (C) BACKGROUND: In April and May 2007, Estonia grabbed international headlines as it suffered from coordinated, massive, and potentially crippling distributed-denial-of- service attacks (DDOS) from the cyberspace. The attacks of 2007 were a wake-up call for national cyber security in much the same way as the January 2006 Gazprom cut-off of Ukraine was on energy security. For a period of about ten days in late April/early May 2007, key websites of the Government of Estonia (GOE) and private banks could not function, or had intermittent availability, and the country was forced to cut itself off temporarily from the World Wide Web. Both the financial cost of these attacks, and the parties ultimately responsible, are still unknown. The former - if known by banks such as swedebank and SEB Uhispank - is guarded; but the latter is widely assumed both by the GOE and many cyber security experts to be a network of Russian hackers guided and funded by the Kremlin. As the story goes, these hackers used popular Russian blog sites to instruct willing 'patriotic hackers' to assist in punishing Estonia for the GOE's decision to move the WWII-era Bronze Soldier monument. In addition to enlisting 'script kiddies' who did nothing more than click on links provided to them, or pass along a line of malicious code, this core group of hackers acted as 'bot- herders' thus magnifying their impact by exploiting scores of 'bot.net' or 'zombie' computers to send DDOS attacks unbeknownst to their users. Estonia's ad-hoc defense in April 2007, led by its national Computer Emergency Response Team (CERT) was to first increase the capacity of state websites to handle the massive volume of traffic, and then - as a last resort - to pull the plug to the outside world.

Learning from Experience, and Passing it on...
--------------------------------------------- -

3. (C) Now fast-forward to the cyber attacks on Georgian websites in July/August 2008. (NOTE: The cyber attacks actually preceded the August 8 Russian ground assault into South Ossetia and Abkhazia, starting with a July 21 mild DDOS attack against the Georgian presidential website. END NOTE.) In the wake of these attacks, the GOE has been at the forefront of the response to assist Georgia, and the ensuing debate within NATO and the EU on the meaning of the attacks. The GOE response has taken the form of (1) applied expertise, (2) legal thinking about how to characterize and respond to cyber warfare, and (3) strategic defense planning on institutional responses to cyber war. In addition to humanitarian and financial aid, Estonia immediately sent two cyber-security experts from its CERT to assist the Georgian CERT for roughly ten days. Meanwhile, the Estonian Cooperative Cyber Defense Center of Excellence (CCDCOE) began an analysis of the implications of cyber warfare both under international law and NATO Article V. (NOTE: The CCDCOE currently has experts from four of the 15 NATO members who have expressed a desire to be Sponsoring Nations, including the United States. END NOTE.) At the same time, the MOD's forthcoming 2008 Cyber Defense Strategy will propose new institutional structures to deal with future attacks.

Estonia's CERT Mission to Georgia
---------------------------------

4. (C) EmbOffs met with Hillar Aarelaid, Director of CERT- Estonia for his read on the recent assistance mission to Georgia. Aarelaid recapped the profile of the cyber attacks on Georgia: the country's internet satellite or microwave links which could not be shut down (inside Russia) were simply bombed (in southern Georgia). The ensuing DDOS attacks, though intense for several days, had less impact on commerce and government than in Estonia last year, where over 90 percent of the public banks online, and the GOE convenes virtual cabinet meetings. Yet the attacks on Georgia were more sophisticated than those against Estonia, and did not repeat the same mistakes. For example, in 2007, the 'zombie-bots' flooded Estonian cyberspace with identical messages that were more easily filtered. The August 2008 attacks on Georgia did not carry such a message.

5. (C) Although Aarelaid stressed that CERT-Estonia does not have the full picture yet, he offered some assessments of the CERT-Georgia response. Roughly "ten years behind" Estonia, CERT-Georgia "did some stupid things" such as failing to keep archives of collected network flow data, which would have provided material for forensic analysis of the attacks. However, they wisely did not waste time defending GOG websites, he said, but simply hosted them on Estonian, U.S. and public-domain websites until the attack was over. (Steps, according to the CCDCOE, which could not have been taken without the lessons learned from the 2007 attacks against Estonia.) Aarelaid felt that another cyber attack on Estonia "...won't happen again the same way..." but could be triggered by nothing more than rumors. For example, what could have turned into a run on the banks in Estonia during the brief November 2007 panic over a rumored currency devaluation was averted by luck. Money transfers into dollars spiked, he explained, but since most Estonians bank online, these transfers did not deplete banks' actual cash reserves. In terms of improving responses, Aarelaid felt that "We are fighting a global threat locally..." but acknowledged this may be unavoidable since, by their nature, cyber attacks require both a real-time response and a high degree of trust among those coordinating the defense, seemingly impossible at the international level. Although CERT-Estonia currently has a permanent staff of only four, Aarelaid said he "...could hire about 200 extra people in an hour..." if needed to respond to a future attack.

Civil Law, Criminal Law or Article V?
--------------------------------------

6. (SBU) On the legal front, experts at Estonia's CCDCOE quickly prepared a scholarly analysis of the possible legal responses to cyber warfare. In "Cyber Attacks Against Georgia: Legal Lessons Learned" the CCDCOE confronted two of the biggest challenges to (A) determining whether a cyber attack rises to the level of a national security threat and (B) assigning responsibility to a state actor who could then be the object of a legal or military response. The report examines the potential status of cyber attacks as an act of violence from the view of the Geneva Conventions, the Law of Armed Conflict (LOAC) and NATO Article V. The authors acknowledge at the outset the complexity of a situation where "...states use private companies to conduct cyber attacks and thus grant the nation deniability..." Since the North Atlantic Treaty itself does not define an 'armed attack', the report falls back on examinations of international law. It states that both level of damage inflicted by a cyber attack, and the intent of the perpetrator would factor into whether a DDOS rises to the level of 'violence'. Considering finally the intent of the attack, its resulting damages, destruction or deaths (i.e. due to paralyzed emergency response networks) and the ability of its attribution to a willing state actor, the CCDCOE concludes that "If all questions are answered affirmatively, there is a strong basis for application of Article V [to cyber attacks]."

Institutional Responses: MOD and Strategic Planning
--------------------------------------------- ------

7. (SBU) Estonia's Ministry of Defense (MOD) takes cyber defense very seriously. In a 2007 address to Estonia's Overseas Security Advisory Council (OSAC), Minister Jaak Aaviksoo likened a massive DDOS as "...the modern equivalent of a 19th century naval blockade of a nation's ports." In a September 2008 address to a CompTIA/OSAC seminar on cyber security, Aaviksoo again put the threat of cyber attacks in existential terms: "At a basic level, life and liberty depend upon your ability to control the space around you. Threats from cyberspace are national security threats, and cyber warfare is here to stay." In response to the attacks on Georgia, former Prime Minister Mart Laar called on Estonia immediately to "...create state structures for the anticipation and control of information attacks." That is, to get better at confronting the propaganda that accompanies a cyber war aggressor's attempt to blind its enemy to what is happening, and drown out competition in the battle for world opinion.

8. (C) In a meeting with EconOff, XXXXXXXXXXXX, XXXXXXXXXXXX, outlined MOD's position on cyber defense and Article V. (NOTE: XXXXXXXXXXXX went to XXXXXXXXXXXX and served as XXXXXXXXXXXX at the Estonian embassy in XXXXXXXXXXXX prior to taking up his current position. END NOTE.) MOD needs much better cyber intelligence, XXXXXXXXXXXX said, since even the CERT sees only a small percentage of overall internet traffic in Estonia. Banks such as swedebank here are often used for "test runs" of the latest, third-generation cyber attacks before these methods are used against larger western banks. While MOD does not take a position on whether cyber attacks should be subject to Article V, XXXXXXXXXXXX did outline three important considerations. First, a clear state actor is not necessarily a pre-requisite for invocation of Article V (witness NATO's response to the attacks on the United States on September 11, 2001). Second, there cannot be different standards for invoking Article V depending on the victim's ability to respond. Thus, having a cyber defense capability sufficient to thwart otherwise-crippling DDOS attacks should not affect the Article V umbrella. And third, there must be a clear idea of what Article V collective defense would mean in response to cyber attacks. Would it mean other members agree to host the targeted government's websites on their servers, or other measures?

9. (C) While this debate continues within NATO and the international community, MOD is taking steps to improve its domestic response capability. Its forthcoming 2008 Cyber Defense Strategy will recommend a range of measures to increase international cooperation, raise awareness and improve the effectiveness of national cyber defense. A key recommendation is for the creation of a 'Cyber Security Council' under the structure of the GOE's national security committee which reports directly to the Prime Minister. During a future cyber attack, and with input from the CERT, private banks and others, this committee would make the call whether a given cyber attack - which after all occur all the time at low levels - rises to the level of a national security threat. This committee would also clarify who has the authority, for example, to unplug Estonia from the internet. In the case of the 2007 attacks, XXXXXXXXXXXX noted, it was simply one technician who decided on his own this was the best response to the growing volume of attacks.

PHILLIPS