Estonia Last Updated: August 2021
Total Page:16
File Type:pdf, Size:1020Kb
Estonia Last Updated: August 2021 CYBERSECURITY POLICY Strategy Documents In Progress Estonia’s Digital Society Agenda 2030 Estonian Ministry of Economic Affairs and Communications The Estonian Ministry of Economic Affairs and Communications is currently undertaking the process of putting together Estonia’s Digital Society Agenda 2030. The Agenda is developed in accordance with Estonia’s national long-term development strategy “Estonia 2035” and its aim that public services would be of a high quality, intuitive and available everywhere, while ensuring the protection of fundamental freedoms. The Agenda will also include the next iteration of Estonia’s Cybersecurity Strategy which sets out goals for national development for the coming years. Source 2021 Estonian Foreign Policy Strategy 2030 Ministry of Foreign Affairs Includes cyber and digital diplomacy aspects, Source 2020 Cybersecurity Strategy 2019-2022 Republic of Estonia; Ministry of Economic Affairs and Communications The Strategy for the period 2019-2022 focuses on four objectives: A Sustainable Digital Society; Cybersecurity Industry, Research and Development; A Leading International Contributor; A Cyber-Literate Society. Source Source 2 5 September 2019 National Security Concept 2017 Ministry of Defence 1. Estonian cyber security is based on close and trust-based cooperation between the public and private sectors; 2. Estonia will continue to develop cyber defence; 3. Estonia will develop digital services and cyber security primarily by investing in them, providing a role model for the private sector; and 4. Estonian cyberspace is part of the safe and stable global cyberspace. Cyber security is founded on constant and close international cooperation. Source Source 2 2017 Implementation Frameworks National Defence Development Plan 2017–2026 Ministry of Defence Announces the upcoming establishment of the Cyber Command, which will achieve integration for carrying out cyber and information operations in cyberspace and the information sphere. Estonia Last Updated: August 2021 Source 2017 IT Baseline Security System (ISKE), Implementation Manual 8.0 Information System Authority (RIA) Information security standard developed for the public sector; Includes organisational, infrastructural/physical, and technical measures; Made mandatory with Government Regulation no. 273 (12 August 2004). Source Source 2 January 2017 STRUCTURE National Centre or Responsible Agency Cyber Security Council Security Committee of the Government of the Republic Contributes to smooth co-operation between various institutions and conduct surveillance over the implementation of the goals of the Cyber Security Strategy; Chaired by the Secretary General of the Ministry of Economic Affairs and Communications. Source 2009 Key Positions Chair Cyber Security Council (Secretary General of the Ministry of Economic Affairs and Communications) Source Head of Estonian Cyber Security Policy Department of State Information Systems, Ministry of Economic Affairs and Communications Source Ambassador for Cyber Security Ministry of Foreign Affairs Source Source 2 4 September 2018 (first entered into function on) Commander Cyber Command Source Dedicated Agencies and Departments Estonia Last Updated: August 2021 Cyber Crime Unit Police and Border Guard Board Investigates cyber crimes Raises awareness regarding cyber threats Source 2012 (consolidated) Information System Authority (RIA) Ministry of Economic Affairs and Communications Organises protection of information and communication technology infrastructure; Remains the main institution responsible for the security of Estonia’s networks; Includes Department of Critical Information Infrastructure Protection (CIIP). Source 2011 (formerly Estonian Informatics Centre) Estonian Defence League's Cyber Unit Defence Forces Objectives include: Cooperation among qualified volunteer IT specialists Raise the level of cyber security for CII Create a network which facilitates public private partnership and enhances crisis preparedness Source 2008 Cyber Command Republic of Estonia, Defence Forces The main mission of the Cyber Command is to carry out operations in cyberspace in order to provide command support for Ministry of Defence’s area of responsibility. Cyber Command's essential tasks are: Provide information and communication technology infrastructure and services; Provide cyber defence; Plan and execute cyber operations; Gain, maintain and share cyberspace situation awareness; Plan and execute information operations; Provide Headquarters support for Joint Headquarters; Plan and execute strategic communicatons; Train, prepare and mobilize wartime and reserve units; Conduct functional area Training, Research and Development. Source Source 2 2018 National Cybersecurity Department Ministry of Economic Affairs and Communications Commenced its work on 1 May 2021; The formation of a new department allows to modernise national cybersecurity coordination and crisis management; The department will work closely with other parts of the Estonian cybersecurity ecosystem. Source Estonia Last Updated: August 2021 1 May 2021 Cyber Diplomacy Department Ministry of Foreign Affairs of Estonia Shapes Estonia's cyber diplomacy efforts Represents Estonia in international fora dedicated to cybersecurity, including in the UN and the OSCE Organises and supports activities related to cyber capacity building Source National CERT or CSIRT Estonian National Computer Emergency Response Team (CERT-EE) Information System Authority (RIA) Governmental CERT; Aims of CERT-EE are: 1. Monitoring of the state of information security in Estonia by using received reports and collecting information about information security incidents; 2. Preventing security incidents and reducing security risks, mainly by raising awareness and through communication work; and 3. Assisting institutions regarding security incidents and advising them if they want law enforcement agencies to start an incident investigation. Source Source 2 1 January 2006 LEGAL FRAMEWORK Legislation Personal Data Protection Act Source 12 December 2018 Cybersecurity Act The Act implements the Network and Security Directive; Contains provisions on the national level requirements for operators of essential services and digital service providers regarding the implementation of security measures and the notification of cyber incidents; Specifies the tasks of the Information System Authority in coordinating cyber security and organising cross-border cooperation. Source Source 2 9 May 2018 Emergency Act Source 1 July 2017 (entry into force) Electronic Communications Act Estonia Last Updated: August 2021 Provides requirements for the public electronic communications networks and publicly available electronic communications services; Entitles Technical Surveillance Authority to require providers carry out a security audit. Source 1 January 2005 (entry into force); 1 July 2015 (amended) Penal Code §206 Interference with computer data; §207 Hindering of functioning of computer systems; See also §208, §216, and §217. Source Source 2 1 September 2002 Views on International Law Summary of Estonia’s Position on How International Law Applies in Cyberspace Republic of Estonia, Ministry of Foreign Affairs The summary of Estonia’s position states the following points: International law applies to state behaviour in cyberspace; States are responsible for their activities in cyberspace; States have to make reasonable efforts to ensure that their territory is not used to adversely affect the rights of other states; States have the right to attribute cyber operations both individually or collectively according to international law; States have the right to respond to malicious cyber operations, including using diplomatic measures, countermeasures, and, if necessary, their inherent right of self-defence. Source Source 2 29 May 2019 Official compendium of voluntary national contributions on the subject of how international law applies to the use of information and communications technologies by States submitted by participating governmental experts in the Group of Governmental Experts on Advancing Responsible State Behaviour in Cyberspace in the Context of International Security established pursuant to General Assembly resolution 73/266 The Group of Governmental Experts established pursuant to the he General Assembly resolution 73/266, adopted its report by consensus on 28 May 2021. In paragraph 73 of the Group’s report (A/76/135), it is stated that, in accordance with the Group’s mandate, an official compendium of voluntary national contributions of participating governmental experts on the subject of how international law applies to the use of ICTs by States will be made available on the website of the Office for Disarmament Affairs. Source Source 2 May 2021 Estonian official positions on international law in cyberspace President of the Republic In her speech, the President of the Republic elaborated the following five points: Estonia Last Updated: August 2021 existing international law applies in cyberspace States are responsible for their activities in cyberspace States must keep on strengthening their own resilience to cyber threats and disruptions, both individually and collectively States have the right to attribute cyber operations both individually and collectively according to international law States have the right to react to malicious cyber operations, including using diplomatic response but also countermeasures, and if necessary, the inherent right of self-defence Source 29 May 2019 COOPERATION