Cyber Security in Estonia 2020 Contents
Total Page:16
File Type:pdf, Size:1020Kb
Cyber Security In Estonia 2020 Contents The Year of Shaping International Law . 3 Cyber Security Governance in Estonia . 5 Threats and Challenges in Civilian Networks . 8 Cybercriminals Keep Us on Our Toes . 11 Threats and Challenges to Estonia’s National Security . 14 Threats and Challenges Around the World: Russian Cyber Threat . 18 Attribution and Deterrence in Cyberspace . 23 The Challenge of 5G Networks: A View From Estonia . 26 NATO CCDCOE Training the Alliance . 28 Defending the Nation Needs Steady Planning . 32 The EDF Cyber Command: What Is It and What Does It Do? . 34 The EDL Cyber Defence Unit: Preparing For The Storm . 36 Engaging the Cyber Security Community At Home and Abroad . 38 Making I-voting Even More Secure And User-friendly . 43 Protecting Personal Data Becomes An Issue Of Trust . 46 EISA: A Collaborative Effort To Boost Estonian Cyber Potential . 48 DISCLAIMER: All chapters express the views of the respective institutions that are identified at the top of each chapter . For general inquiries and media requests regarding the publication please contact the Estonian Information System Authority at www .ria ee. For specific questions regarding topics discussed in each chapter please contact the institutions directly . 2 CYBER SECURITY IN ESTONIA 2020 The Year of Shaping International Law KERSTI KALJULAID President of the Republic of Estonia If we want cyberspace to become a safe, secure, and stable domain, then malicious cyber activities should have similar consequences as attacks carried out in the ‘analogue’ world. Part of this deterrent is also clearly stating how international law applies in cyberspace – and this is something where Estonia was able to chip in last year. Cyberattacks have, for quite a long time, been the weapon of choice for vari- ous state, state-backed, and non-state actors in promoting their subversive goals – whether it is stealing money, influencing democratic processes, or just wreaking confusion . One of the rea- sons is that there is no clear and consen- sual agreement on how international law and the consequences of breaking these laws apply to cyberattacks and -activi- ties . Indeed, the last couple of years have seen a notable improvement on this issue mainly through states using attri- bution more actively . To put it bluntly: you still have a pretty good chance of conducting a coordinated, malicious, and devastating cyberattack – and CYBER SECURITY IN ESTONIA 2020 3 getting away with it even if the consequences of your activities in the case of conventional attacks or activities would mean a serious breach of international law . Not to mention everything that would come after this in our ‘analogue’ world – condemnations and resolutions by international organisations, sanctions, travel bans, and other restrictions . Therefore, creating a clear and agreed understanding on the appli- cation of international law vis-à-vis cyberspace is not a theoretical and philosophical issue, but at the end of the day, a question of deterring cyberattacks and keeping our digital societies safe and secure . To bring an obvious parallel from the analogue world – international law and con- ventions have not managed to eliminate wars and use of force as an instrument of interna- SUMMARY OF ESTONIAN POSITIONS tional affairs, but they most certainly have ON HOW INTERNATIONAL LAW limited the number and intensity of conflicts, APPLIES IN CYBERSPACE: as everybody is still deterred by the possible 1 . International law applies to state behav- consequences of going against the rules- iour in cyberspace . based international order . 2 . States are responsible for their activities The challenge here lies in the fact that in cyberspace . international law does stem, among other 3 . States have to make reasonable efforts to things, from conventions, agreements, and ensure that their territory is not used to customs – but first and foremost, it is still adversely affect the rights of other states . only the states themselves who can define 4 . States have the right to attribute cyber and interpret international law in a way that operations both individually or collec- makes academic theories become acclaimed tively according to international law . tenets of law and order . 5 . States have the right to react to mali- Taking all that into account, I was actually cious cyber operations, including using a bit surprised to realise a couple of years ago diplomatic measures, countermeasures, that Estonia – the world’s first digital state, and, if necessary, their inherent right of target of the first politically motivated and self-defence . coordinated cyberattacks back in 2007, and home of the Tallinn Manual on the relations of See more: vm .ee/en/cyber-security cyber and international law – was still miss- ing its official positions on this issue . That is why I convened a group of Estonia’s best law and cyber experts to my office back in the autumn of 2018 . By the end of that meeting, everybody more and less agreed that – all things consid- ered – Estonia’s official positions should indeed be drafted, confirmed by the Government, and publicly introduced . The Estonian positions themselves (see textbox), introduced at CyCon 2019, are relatively simple, and one could even say – quite habitual . However, they do carry a clear – and now official – understanding of how Estonia perceives this very important issue . As such, these positions are already helping us to further develop and interpret international law in international organisations and forums . As a non-permanent member of the United Nations Security Council, Estonia, among other issues, intends to raise awareness of the threats that emerging cyber risks entail for our societies and security . For example, in March 2020, we raised the issue of cyber security for the first time in the UN Security Council when Estonia, alongside the United States and the United Kingdom, condemned the 4 CYBER SECURITY IN ESTONIA 2020 President Kersti Kaljulaid speaking at CyCon conference in 2019 where she presented the Estonian positions on how international law applies in cyberspace . extensive cyberattacks against Georgia in 2019 and attributed them to Russian military intelligence . There are also two parallel working groups in the UN currently tackling cyber topics and Estonia’s official positions are being used to promote discussions in those two groups . There are a couple of countries – the UK, for example – that have already introduced their official positions in the past couple of years . Since mid-2019, many other nations have also followed suit and introduced or supplemented their positions on the relations of international law and cyberspace – Australia, the Netherlands, and France, to name a few . It is also true that many actors in the international arena will not share our understanding, or will purposefully remain ambiguous on this issue – that is also one way of creating deterrence . As a small and highly digitised state, Estonia, for one, does not have this kind of luxury . As the first post- war President of Estonia, Lennart Meri, once said: ‘International law is the nuclear weapon of a small state’ . CYBER SECURITY IN ESTONIA 2020 5 Cyber Security Governance in Estonia Government of Estonia Government Security Committee Cyber Security Council • Estonian Information System Authority (RIA) • State Infocommunication Foundation (RIKS) • Consumer Protection and Technical Regulatory Authority (TTJA) • StartUp Estonia • Estonian Police and • Data Protection Border Guard Board: Inspectorate (AKI) Cybercrime division (C3) • Estonian Internal Security Service (KAPO) • Estonian Defense Forces: Cyber Command (KÜVJ) • Estonian Defense League: Cyber Defense Unit (KKÜ) • Estonian Foreign Intelligence Service (VLA) 6 CYBER SECURITY IN ESTONIA 2020 Cyber security is essentially the management and mitigation of the digital and electronic risks of the information society. This is why cyber security is inextri- cably linked to the development and management of state information systems and data. The goal is to prevent incidents from happening, which means that cyber security has to be integrated into the life cycles of all communications and information systems. If a cyber security incident or crisis were to occur, the state has to have the capabilities to manage the incidents, investigate the cyber crime, and handle all internal crisis situations. Government Security Committee Lead by: The Prime Minister Members: Ministers of Defence, Economic Affairs and Infrastructure, Foreign Trade and Information Leading ministry in the area of cyber security . In addition to Technology, Finance, Foreign Affairs, digital development and cyber security, also in charge of the Interior, and Justice . policies of trade, energy, construction, transport, media ser- Responsibility: Analyses and vices, and other areas . assesses the national security situ- ation and coordinates the activities of the authorities of executive power with regard to planning, develop- The Minister of Foreign Trade and ment, and organisation of national Information Technology defence . The political leader in charge of cyber security in Estonia . Cyber Security Council Lead by: Permanent Secretary of Secretary-General of the Ministry the Ministry of Economic Affairs and In charge of departments at the ministry and Communications . agencies under its authority . Members: Permanent Secretaries of all relevant ministries and top leader- ship of relevant agencies . Responsibility: Coordinates cyber security policy,