Cyber Warfare: From Disruption to Strategic Effect. Part 1: Estonia 2007

The scale of that digital dependence is worth establishing because it determines what an attacker could potentially affect. In 2007, 98% of banking transactions in Estonia were conducted electronically and 82 percent of tax declarations were submitted through the internet. Digital signatures and electronic identity were already being used across the public and private sectors, while internet voting had moved beyond an experiment. Estonia had introduced it for local elections in 2005, and in the March 2007 parliamentary election, 30,275 people cast an electronic vote. Estonia had therefore begun placing not merely convenient services online, but functions associated with finance, taxation, administration, identity and democratic participation.

Those figures can produce the wrong conclusion. Estonia is sometimes described as having digitised rapidly while neglecting the security consequences. The historical record is more complicated. Its cybersecurity institutions were immature by today’s standards, but awareness of the security problem predated the attacks. CERT Estonia had begun operating on 1 January 2006, following work during 2005 to establish a national capability for handling information-security incidents and a point for international cooperation. Its mandate included prevention, incident response and cooperation with public agencies and private operators, and one of its early cases involved internet-banking fraud.

The capability should not be overstated. CERT-EE was tiny. RIA’s retrospective account records that only two people, Hillar Aarelaid and Tarmo Randel, coordinated the CERT response during the 2007 attacks, while processes, relationships and institutional responsibilities were still developing. Its significance was not that Estonia already possessed a mature national cyber-defence architecture, but that an organisation existed that could recognise relationships between apparently separate incidents, coordinate across organisational boundaries and connect Estonia with international incident-response networks.

The wider security environment was also changing before 2007. At the Prague Summit in November 2002, NATO Allies agreed to strengthen capabilities to defend against cyberattacks. Four years later, the Riga Summit Declaration called for improved protection of key NATO information systems against cyberattack. The Alliance was therefore already addressing cyber defence, although its emphasis remained heavily on NATO’s own information and communications systems and the networks required for Alliance operations. Estonia would expose a wider problem: disruption of the civilian and commercial infrastructure through which a modern state functions.

That distinction is central to understanding the case. Digital dependence increased the number of functions that could potentially be disrupted remotely, but it did not determine the consequences. Resilience also depended on capable operators, alternative arrangements, incident response, network capacity and cooperation between government and industry. Nor was strategic relevance determined by ownership. Electronic banking, online government services and commercial telecommunications could become important to national functioning during a crisis even though the infrastructure remained outside direct government or military control.

Estonia had some of the relationships needed to manage such dependencies, but responsibility remained distributed. Government secured the systems it controlled, banks and telecommunications companies protected their own infrastructure, CERT-EE coordinated incident handling, and international partners could assist with activity originating abroad. The state could therefore depend upon services it did not operate, regulate infrastructure it did not control and require functions during crisis without possessing a single authority responsible for their continuity.

That test would begin against the background of the Bronze Soldier dispute. The political confrontation came first. The cyber activity followed within it, and separating those two facts is necessary before examining what happened from 27 April onward.

2. The Political Crisis: The Bronze Soldier Was Not a Cyber Event

The cyberattacks against Estonia did not create the crisis of April 2007. They entered a political confrontation that was already escalating rapidly and whose origins had little to do with computer networks. Understanding that sequence is necessary because separating the cyber activity from its political environment produces an incomplete picture, while treating everything that happened as a centrally directed cyber campaign claims more than the available evidence supports.

At the centre of the dispute was the Bronze Soldier, a Soviet-era monument in central Tallinn formally dedicated to those who had fallen during the Second World War. The monument had acquired sharply different meanings within Estonian society. For many Estonians, Soviet military symbolism could not be separated from the occupation and annexation of Estonia by the Soviet Union, mass repression, deportations and the loss of independence that followed. For many Russian-speaking residents and for Russia, the monument was associated with the Soviet victory over Nazi Germany and commemoration of those who died fighting it. The disagreement was therefore not primarily a statue. It concerned incompatible interpretations of twentieth-century history, occupation, liberation, political identity and the legitimacy of Soviet power in Estonia.

Those competing interpretations had increasingly turned the site into a political focal point. Tensions had risen during 2006, when demonstrations and counter-demonstrations prompted the government to restrict access to the site. The Estonian parliament subsequently adopted the War Graves Protection Act in January 2007, establishing a legal basis for relocating war graves where their location was considered inappropriate. The legislation did not itself order the removal of the Bronze Soldier, but it created the mechanism through which the government could relocate the graves and monument.

The government’s stated position was that a burial site in a busy central location where political confrontations were increasingly occurring was unsuitable for dignified commemoration. It decided to undertake archaeological excavation, identify the remains buried there and rebury them at the Defence Forces Cemetery in Tallinn. Russia strongly opposed the planned relocation, framing it as an attack on the memory of the Soviet war dead and the historical role of the Red Army. Russian officials, parliamentarians and media repeatedly condemned the plans, and the issue became part of a wider political confrontation between Tallinn and Moscow.

Work at the site began in the early hours of 26 April 2007. Demonstrators gathered later that day, and by evening the confrontation had deteriorated into serious disorder in central Tallinn. Rioting, vandalism and looting followed. One man, Dmitri Ganin, died after being stabbed during the unrest, more than one hundred people were injured, including police officers, and hundreds were detained. Disturbances also occurred elsewhere in Estonia, although Tallinn remained the centre of the violence.

Faced with continuing disorder, the government accelerated the relocation. During the night of 26 to 27 April, the Bronze Soldier was removed from Tõnismägi and subsequently installed at the Defence Forces Cemetery, where an official reopening ceremony took place on 8 May. The human remains excavated from the original site were later reburied there. The monument was therefore relocated rather than destroyed or removed from public commemoration, although that distinction did little to reduce the political confrontation.

Russia’s response was immediate and sustained. President Vladimir Putin criticised the Estonian authorities’ handling of the memorial, the Russian Foreign Ministry issued strongly worded statements, and members of the Russian parliament called for measures including the severing of diplomatic relations. Russian officials demanded the resignation of Prime Minister Andrus Ansip’s government. The dispute had moved beyond disagreement over a war grave into an interstate confrontation involving diplomatic pressure, public accusations and competing historical narratives.

Pressure was not confined to official statements. From 27 April, the Estonian Embassy in Moscow was surrounded by activists from the pro-Kremlin youth movement Nashi and other groups. Demonstrators obstructed access and interfered with diplomatic personnel, while protesters disrupted a press conference involving Estonian Ambassador Marina Kaljurand on 2 May. Estonia argued that Russia was failing to meet its obligations under the Vienna Convention to protect the embassy and its diplomats, and both the European Union and NATO expressed concern the treatment of the diplomatic mission.

Economic pressure and disruption also became part of the confrontation, although the degree of direct state coordination requires careful treatment. Russian retailers and other organisations announced boycotts of Estonian goods, while transport links and transit flows were affected, including Russian rail freight and oil products. Some developments were officially explained on commercial or technical grounds, while Estonian officials regarded the broader pattern as politically motivated pressure. Political context can make separate actions appear coordinated even where evidence of central direction remains incomplete.

The information environment was equally confrontational. Russian television, political statements and other media coverage portrayed the relocation through the language of desecration, fascism and historical revisionism. Estonia presented the dispute through the experience of Soviet occupation and its sovereign authority to determine how war graves and monuments were handled on Estonian territory. Russian television was also an important source of news for many Russian-speaking residents, so competing interpretations circulated within Estonia as well as between states.

Digital disruption began while the physical protests, diplomatic confrontation and information struggle were already underway. The first significant wave of attacks appeared late on 27 April, after violence had erupted in Tallinn and the monument had been removed from Tõnismägi. By 30 April, Estonia’s Information System Authority was reporting deliberate attempts to prevent government web servers from functioning and attacks against the government’s data communications network. RIA also reported that domestic internet traffic continued without major problems while access to government websites from outside Estonia had been disrupted. The distinction between visible attack activity and national-level effect was therefore present from the beginning.

The initial activity reflected the political mobilisation surrounding the monument. Instructions for denial-of-service attacks circulated on Russian-language internet forums, including Estonian targets and guidance enabling people with limited technical expertise to participate. Early activity included website defacement, manually generated traffic and relatively simple denial-of-service attacks, while later phases involved larger distributed attacks using botnets. The campaign should therefore not be compressed into a single level of technical sophistication or organisation.

The Russian state was clearly part of the wider political confrontation, but political alignment, Russian infrastructure and Russian-language coordination did not by themselves establish state direction of individual cyberattacks. Open mobilisation allowed independent participants to join the activity, while the absence of a publicly demonstrated command chain did not establish that state involvement was absent. The evidentiary distinction between participation, political sponsorship and state responsibility will be examined in Section 5.

Seen retrospectively, the confrontation contained many elements now associated with hybrid activity: diplomatic pressure, hostile information activity, politically mobilised groups, economic effects, street disorder and cyber disruption. That description is useful only if it does not imply evidence of an integrated campaign design that the historical record cannot demonstrate. The more important operational problem was that different institutions dealt with different parts of the confrontation even though their effects accumulated on the same state. Police managed public disorder, diplomats handled interstate relations and the embassy crisis, private operators protected their networks, CERT-EE coordinated cyber incidents, and government engaged NATO and the European Union.

States necessarily organise themselves through ministries, agencies, sectors and legal authorities, while an adversary or politically motivated network has no obligation to respect those divisions. Pressure against diplomatic representation, public information, financial services and government networks can therefore remain individually manageable while becoming more consequential when several forms occur simultaneously during a political crisis.

The Bronze Soldier crisis should not be rewritten as a cyber event. The cyberattacks did not cause the dispute, riots, diplomatic confrontation or competing information campaigns. They became another means through which pressure could be applied during an existing crisis, potentially complicating communications, disrupting services and forcing defenders to divide attention and resources. At the same time, those possible purposes cannot simply be assumed from political context.

The step is therefore narrower: reconstructing what actually happened to Estonia’s networks between 27 April and May 2007, how the attacks changed over time, which systems were targeted, what effects they produced and how Estonia’s defenders adapted. Only after establishing those facts can we judge what the cyber component of the crisis actually achieved.

3. What Actually Happened

The cyber campaign against Estonia lasted from 27 April to 18 May 2007. Over those twenty-two days, its volume, targets and methods changed repeatedly. Government websites were the initial focus, but attacks subsequently affected media organisations, banks, telecommunications and other private-sector services. Denial-of-service attacks dominated the campaign, alongside website defacement, spam and other disruptive activity. Most of the techniques were already well understood. What made the campaign unusual was their concentration against organisations associated with the functioning and public life of one country during an ongoing political crisis.

The sequence needs to be reconstructed carefully. Describing the attacks as progressing from unsophisticated volunteers to sophisticated botnets captures part of what happened but makes the evolution appear cleaner than the evidence supports. Automated and manually generated attacks existed alongside one another, and compromised computers were already involved during the opening period. Later waves involved much larger botnets and better coordination, while simple methods remained useful when enough participants or machines generated traffic simultaneously. What changed most significantly was the scale, concentration and selection of targets, together with the defenders’ ability to recognise and counter the activity.

Phase I: 27 April onwards

The first sustained attacks began late on Friday, 27 April. By 23:39 the following evening, CERT-EE was reporting disruption to numerous Estonian public-sector websites. Simultaneous targets included the government, president, parliament, Ministry of Foreign Affairs and Ministry of Defence. Hillar Aarelaid, then head of CERT-EE, described the scale as unprecedented for Estonia because so many government targets were being attacked at the same time.

The initial objective visible from the technical activity was predominantly denial of availability. Attackers attempted to make websites and other internet-facing services inaccessible by directing more requests or traffic at them than the receiving systems or network connections could process. Some websites were defaced, while email and online systems received large volumes of spam. Later analysis identified techniques including ping floods, UDP floods, malformed requests and SYN floods. These methods differed technically but pursued a similar effect: preventing legitimate users from obtaining the service. Importantly, denial of service did not necessarily require penetration of the underlying systems. Availability could be degraded externally without attackers gaining persistent access or control.

Some opening attacks required little technical sophistication. Instructions circulated through Russian-language forums describing targets, timings and methods volunteers could use to participate. Rain Ottis’s subsequent analysis records that these instructions sometimes specified what to attack, when to attack it and how to generate the required traffic. A sufficiently large number of participants following simple instructions could therefore create substantial cumulative load without possessing advanced individual capability.

Other traffic already came through compromised computers whose owners had no knowledge that their machines were participating. CERT-EE warned on 28 April that identifying attack sources was difficult for precisely this reason. The machine transmitting malicious traffic and the person directing it were not necessarily in the same country, or connected except through malware and network infrastructure. This distinction would later become important to attribution.

The defensive response began immediately and had consequences of its own. Estonia restricted access from outside the country to some government websites to reduce malicious traffic reaching targeted systems. By 29 April, CERT-EE reported that domestic internet traffic remained available and Estonian users could access foreign websites, while access from abroad to government sites remained heavily restricted. Most public-sector websites had again become accessible domestically.

Some foreign users therefore lost access because attackers had overwhelmed a service, while others lost it because defenders deliberately filtered foreign traffic to preserve domestic availability. The visible result could be identical, but the operational causes were different. By 30 April, CERT-EE was still reporting deliberate attempts against government web servers and the government data communications network, yet domestic internet traffic continued without major problems. The opening phase had produced visible disruption without producing national internet failure.

Phase II: Escalation, distribution and changing targets

Pressure increased during the following days. On 1 May, CERT-EE reported that attacks had multiplied during the early morning and were concentrating particularly on government web and name servers. Aarelaid described automated and manually conducted attacks and noted that attackers were reacting to defensive measures. CERT-EE had moved to continuous readiness, while government organisations, internet service providers and security authorities coordinated their response.

Targeting name servers had broader potential consequences than attacking an individual website. The Domain Name System translates the names people use for internet services into the addresses required to reach them. Disrupting it can therefore make several otherwise functioning services difficult or impossible to locate.

The growing use of botnets also increased both scale and complexity. Thousands of compromised devices could generate traffic simultaneously without their owners’ knowledge, distributing attack traffic across many countries and making crude source-based blocking less effective. The location of those devices identified where traffic entered the internet, not necessarily who controlled the botnet, selected the target or ultimately directed the operation.

That problem was already visible in Estonia. Later analysis found that the overwhelming majority of malicious traffic originated outside the country, but traffic origin alone provided little evidence ultimate direction. Openly circulating attack instructions also meant that centrally controlled botnet activity could coexist with independently conducted attacks by politically motivated individuals. The observable campaign could therefore contain several categories of participant converging on the same targets.

Targets expanded beyond central government. RIA’s subsequent reconstruction records attacks against the state portal, government, presidency, parliament and ministries, followed by activity affecting education, media and private-sector websites. Other contemporary and later analyses identify banks and telecommunications infrastructure among the targets.

The expansion changed the potential consequences. Temporary loss of a ministry’s public website primarily affected communication and access to information. Interference with a bank could affect ordinary economic activity, while attacks against DNS infrastructure could affect access to multiple services. Operational significance therefore depended less on packet counts or numbers of attacking machines than on the function affected, the duration of disruption and the circumstances in which it occurred.

Defenders faced the same problem from the opposite direction. Blocking foreign traffic could protect domestic availability, but Estonian banks had customers abroad, government needed to communicate internationally during a political crisis, and media organisations needed external audiences. Some banks therefore temporarily blocked foreign traffic and then progressively restored access from countries containing significant numbers of customers but relatively few attack sources. Defence was becoming a balance between maintaining essential service and accepting controlled degradation elsewhere.

Phase III: 9 May and the concentrated waves

The major concentration occurred around 9 May, when Russia commemorates victory over Nazi Germany and a date carrying obvious significance in the political confrontation surrounding the Bronze Soldier.

Later technical and legal analysis records a sharp increase in malicious traffic beginning around 23:00 Estonian time on 8 May, corresponding with the beginning of 9 May in Moscow. Activity continued through 9 and 10 May before ending abruptly. At one point on 9 May, as many as 58 websites were unavailable simultaneously, with government websites and official communications among the prominent targets.

The timing is relevant but does not establish who coordinated the activity. Public instructions can synchronise voluntary participants, botnet operators can schedule attacks, political organisations can mobilise supporters, and state agencies can direct operations. Similar observable timing can therefore emerge from different organisational structures.

There is another complication in the data. Although many websites became unavailable during the 9 May wave, later analysis found that aggregate traffic remained below levels recorded during some earlier periods. Visible disruption was therefore not simply a function of attack volume. Target selection, concentration, infrastructure capacity and defensive configuration influenced the effect produced.

Banks experienced more sustained pressure between 9 and 11 May. Hansapank, Estonia’s largest commercial bank at the time, suffered approximately one and a half hours of web-service unavailability on 9 May and another two hours on 10 May. Those interruptions were limited, but online banking was sufficiently embedded in Estonian economic activity that disruption of a major bank had greater potential consequence than loss of an informational website.

The comparison illustrates why incident counts alone are a poor measure of effect. Many inaccessible informational sites may matter less to national functioning than one unavailable financial service, while even disruption of an important service may remain limited if it is restored quickly, alternatives remain available and the effects do not propagate. Section 4 will examine those consequences directly.

On 15 May, another major distributed denial-of-service attack struck government websites. CERT-EE reported a botnet of approximately 85,000 compromised computers, with strong attacks continuing from around noon until midnight. On raw scale, this was substantial, yet the consequences were less serious than the size of the attacking infrastructure might suggest. Network capacity had already been increased in response to earlier attacks, allowing the additional traffic to be absorbed more effectively.

The private sector remained exposed. During the same period, SEB Eesti Ühispank, Estonia’s second-largest commercial bank, experienced approximately one and a half hours of portal unavailability, with restoration for customers outside Estonia taking longer. Other banks reported lesser incidents. Another substantial DDoS attack against government websites followed on 18 May, while banks continued to experience lower-level interruptions afterward.

Defensive adaptation involved more than additional bandwidth. CERT-EE coordinated with internet service providers, government institutions, banks, security authorities and international incident-response partners. Filtering changed as attack sources and methods changed, foreign access was restricted when necessary and restored selectively, network capacity increased, and information malicious infrastructure was shared internationally. RIA’s later assessment credits close cooperation within the Estonian IT community and support from foreign partners as important factors in containing the campaign.

The interaction matters because the attackers were operating against an active defender. Attack methods and infrastructure changed as defensive measures interfered with the desired effect, while defenders observed activity, filtered traffic, increased capacity, changed routing and coordinated with upstream providers. Contemporary reporting shows that this interaction was already occurring by 1 May, when Aarelaid noted that attackers were responding to Estonia’s defensive actions.

Technical capacity and operational success therefore did not move together automatically. Botnets substantially increased the ability to distribute traffic and complicate filtering, but greater attacking capacity did not produce a corresponding linear increase in disruption. By 15 May, tens of thousands of compromised machines could be absorbed more effectively because Estonia had changed the environment against which they were operating.

Before asking what Estonia 2007 meant for national security or NATO, the section separates the effects the campaign actually produced from those later retellings have sometimes attributed to it. The strategic significance of 2007 does not depend on pretending that Estonia was digitally paralysed.

4. What Was Actually Affected, and What Was Not

The attacks against Estonia were real, sustained and politically consequential. They were also much narrower in their direct effects than some later descriptions suggest, and both facts need to remain visible at the same time.

This distinction matters because cyber incidents are easily described through attack activity rather than consequences. Tens of thousands of attacking machines, millions of requests and dozens of inaccessible websites provide impressive numbers, but none tells us whether government lost command of its institutions, financial activity stopped, communications failed nationally or essential infrastructure ceased functioning.

Estonia’s own assessment after the attacks was measured. In July 2007, when the government approved an action plan based on the experience of April and May, it concluded that the attacks had not paralysed normal daily activity. It nevertheless assessed that similar activity, conducted at sufficient scale and under particular circumstances, could pose a significant security risk. That distinction between limited immediate effect and serious security implications is closer to the significance of Estonia 2007 than either dismissing the attacks as vandalism or describing the country as having been digitally shut down.

What was affected or disrupted

The effects were uneven. Different organisations were attacked at different times, some services remained available domestically while becoming inaccessible internationally, and defensive measures sometimes created restrictions that outwardly resembled successful attacks. Understanding the effects therefore requires looking at functions rather than compiling a list of targeted servers.

Public-facing government websites and information were repeatedly disrupted. The presidency, parliament, government, Prime Minister’s office, ministries and state agencies were among the targets, with later legal analysis recording attacks against all ministries except the Ministry of Culture. Much of this activity concentrated on public websites rather than internal government systems. The immediate consequence was therefore reduced access to government information rather than loss of government itself. During a political crisis, however, that information mattered. Government needed to communicate decisions, correct inaccurate reporting and provide authoritative information domestically and internationally. Estonia’s decision to restrict international access helped preserve domestic availability but made official sources harder to reach for foreign journalists, governments and Estonians abroad while international attention to the crisis was intense.

Official government communications also came under sustained pressure, but this should not be confused with loss of state command and control. Later analysis records persistent attacks against official communications channels between 27 April and 9 May, while CERT-EE reported attempts on 30 April to stop the government data communications network. These were more consequential targets than public webpages because interference with communications could affect officials’ ability to work. The evidence supports attempted and temporary disruption, however, not a conclusion that Estonia’s internal governmental communications architecture was disabled. Target selection can indicate intent or priority, but operational effect must be established through what the target was actually prevented from doing.

Political websites, including that of Prime Minister Andrus Ansip’s Reform Party, were also attacked. Their loss had limited direct effect on the machinery of government but impaired political communication during an intense domestic and international confrontation. The case illustrates that political significance and infrastructure criticality are not identical. A target can matter strategically without being part of critical infrastructure, just as technically critical infrastructure does not necessarily carry the same political significance in every circumstance.

Media organisations experienced disruption as the campaign expanded beyond government. The direct effect was principally reduced availability of news and information during a crisis already characterised by sharply competing Estonian and Russian narratives. There is insufficient evidence to claim that these attacks changed public opinion or produced a measurable information effect. What can be established is that access to domestic information sources was one of the functions placed under pressure.

Banking services suffered genuine but temporary interruptions. Hansapank and SEB Eesti Ühispank, which together controlled a substantial majority of Estonia’s banking market, were attacked repeatedly between 9 and 15 May, with lower-level disruption continuing afterward. Hansapank’s online services were unavailable for approximately one and a half hours on 9 May and another two hours on 10 May, while SEB Eesti Ühispank later experienced an interruption of approximately one and a half hours. In a society where electronic banking had become normal infrastructure for everyday economic activity, those outages mattered. They prevented some transactions and required banks to divert resources to defence and restoration, but they did not destroy banking records, disable the banking system as a whole or produce a sustained national inability to conduct financial activity.

DNS and supporting internet infrastructure were also targeted. CERT-EE reported attacks against government web and name servers, while later analysis identified activity against infrastructure responsible for Estonian domain-name administration, EENet and DNS services operated by internet providers. Shared infrastructure matters because disruption can affect access to several dependent services without compromising each one individually. The attacks did not produce a sustained national DNS failure, but the target selection demonstrated an understanding that visible online services depended on less visible infrastructure underneath them.

Access from outside Estonia was significantly affected, including by Estonia’s own defensive measures. Domestic internet traffic continued while access by foreign users to some government websites was restricted to reduce malicious traffic. This preserved more important domestic services at the cost of legitimate international access. The episode illustrates an important aspect of resilience: maintaining an essential function can require controlled degradation elsewhere rather than preservation of every service at its normal peacetime level.

Public confidence is harder to assess. People experienced inaccessible government pages, intermittent banking problems and disrupted news services while watching political unrest and an escalating confrontation with Russia. The evidence does not support claims of widespread panic or successful erosion of trust in the state. It does support a narrower conclusion: the attacks made digital dependence visible to citizens and decision-makers by demonstrating that ordinary services they had come to regard as reliable could be disrupted during a political crisis.

The negative evidence establishes the upper boundary of the effect achieved. Estonia did not lose national command and control. Government continued making decisions, ministries and police continued operating, diplomacy continued, and Estonia remained capable of requesting assistance from NATO and international partners. Public-facing government services and communications were attacked, but the state itself did not cease functioning.

The banking system was not destroyed or comprehensively disabled. Individual online services experienced consequential periods of unavailability, but banks continued functioning and services were restored. There was no destruction of core banking data or prolonged national inability to make payments.

Estonia’s electricity system was not shut down by the cyber campaign. There was no demonstrated cyber-induced loss of electricity generation or distribution comparable with the effects later produced against parts of Ukraine’s power system in 2015 and 2016. The distinction is important because the cases belong to the same broader history of cyber conflict while demonstrating fundamentally different effects: Estonia experienced sustained disruption of digital services, whereas Ukraine would later experience cyber operations interfering directly with physical infrastructure.

National telecommunications did not collapse, and government databases were not comprehensively erased or corrupted. Domestic internet traffic continued even while providers and government networks were under attack. The campaign predominantly affected availability rather than producing sustained national communications failure, systematic manipulation of official data, large-scale theft of confidential government information or destructive wiping of state systems. Later cyber campaigns would demonstrate those possibilities much more clearly.

From technical effect to strategic effect

The Estonia case introduces a distinction that will run through the rest of this series: technical effect, operational effect and strategic effect. These levels are related, but treating them as interchangeable is one of the easiest ways to exaggerate cyber capability.

A technical effect describes what happened to a system or service. A server became overloaded, a website could not be reached, DNS resolution was disrupted, an online banking portal stopped responding or foreign traffic was filtered. These effects can be measured through system logs, traffic data, outage duration and service availability, but they do not establish the consequence for the organisation or society using the system.

An operational effect occurs when the technical change interferes with something that needs to be done. Citizens could not reach government information, bank customers could not conduct some online transactions, international users lost access to Estonian services, and defenders had to divert personnel and capacity while changing network configurations to preserve more important functions.

The relationship between technical and operational effect is not linear. A large attack can produce little operational effect if the target absorbs it, while a technically simple attack can matter considerably if it disrupts an important service at the wrong moment. The approximately 85,000 compromised machines involved on 15 May illustrate the first case: the attacking infrastructure was substantial, but increased defensive capacity meant that greater offensive scale no longer translated automatically into greater disruption.

Strategic effect concerns whether an operation changes the behaviour, choices, capacity or strategic position of the state being targeted. Estonia did not reverse the relocation of the Bronze Soldier, the government did not fall, the country did not abandon its digital model, and the attacks did not incapacitate the state sufficiently to produce an identifiable coercive political outcome. If success is measured by whether cyber pressure compelled Estonia to reverse the decision at the centre of the crisis, the campaign did not achieve it.

Its wider significance lay elsewhere. Services outside traditional military infrastructure had become usable terrain in an interstate confrontation, while responsibility for defending them crossed government and private-sector boundaries. The attacks also imposed an additional operational burden while Estonia was managing riots, diplomatic pressure and an international information confrontation. They forced decisions which services to protect, which access to restrict and how organisations with different responsibilities should cooperate.

That brings the analysis to attribution. Estonia could observe attacks, identify compromised machines, trace traffic and investigate individual participants, but none of those activities automatically established who ultimately directed the campaign. Distinguishing the infrastructure through which an attack travelled from responsibility for the operation would prove considerably harder, and it would shape what Estonia and its allies could credibly do .

5. Attribution: Knowing Something Is Happening Is Not the Same as Proving Who Ordered It

The political context surrounding the attacks left little doubt why Estonia was being targeted. The cyber campaign began during an escalating confrontation with Russia over the Bronze Soldier, Russian-language internet forums circulated instructions for attacking Estonian systems, and much of the hostile traffic reached Estonia through infrastructure outside the country. None of this, however, automatically established who had organised or directed the attacks. That distinction became one of the most consequential problems exposed by the crisis.

There was ample circumstantial evidence connecting the cyber activity to the wider political confrontation. Attack instructions circulated publicly, targets corresponded closely with institutions associated with the Estonian state and the political dispute, and some attacks were coordinated around politically significant dates. Rain Ottis’s subsequent analysis concluded that the cyber activity was clearly connected with the broader Estonia-Russia political conflict and identified indications that could support suspicions of state involvement. He was equally careful, however, not to claim that the available evidence established responsibility by a particular organisation. More than six months after the attacks, no organisation or group had claimed responsibility, although individual participants had been identified.

The criminal investigation demonstrates the evidentiary problem particularly well. The only person convicted in Estonia for participation in the 2007 attacks was Dmitri Galushkevich, a 19-year-old Estonian citizen and student at Tallinn University of Technology. Galushkevich admitted participating in denial-of-service attacks against infrastructure hosting the Estonian Reform Party’s public website and intranet. He acted in coordination with other unidentified people and was convicted under the Estonian Penal Code for illegally blocking computer data in a manner that hindered the operation of a computer system. The case established individual criminal responsibility for a specific part of the campaign. It did not establish who had directed the wider operation or demonstrate Russian state responsibility for it.

Investigating activity associated with Russia proved substantially more difficult. Estonia submitted a request for legal assistance to the Russian Public Prosecutor’s Office concerning cyberattacks originating from Russian territory and sought investigative measures that Estonia could not lawfully conduct inside another sovereign jurisdiction. Russia declined to carry out important elements of the request. Later analysis by Eneken Tikk and Kadri Kaska concluded that the resulting obstacle was less a straightforward absence of legal mechanisms than a problem of how the bilateral assistance arrangements were interpreted and, ultimately, whether there was political willingness to cooperate. Investigations into attacks originating from Russia consequently stalled.

Even complete cooperation would not necessarily have produced a simple attribution chain. Botnets meant that computers generating attack traffic could belong to innocent users whose machines had been compromised. Command-and-control infrastructure could be located in another jurisdiction, moved between providers or deliberately placed where investigators would encounter legal or practical difficulties. The CCDCOE legal analysis records that some botnet command-and-control infrastructure was moved into jurisdictions where international investigative cooperation was particularly difficult, including Transnistria. An IP address could therefore identify a machine involved in an attack without identifying the person controlling it, while identifying an operator still would not necessarily establish on whose behalf that person was acting.

This is where several different forms of attribution, often collapsed in public discussion, need to be separated. Technical attribution seeks to establish how an operation was conducted: the infrastructure used, malware or tools involved, traffic patterns, command-and-control relationships and links between incidents. Individual responsibility asks which identifiable people committed offences or participated in the operation. Political sponsorship asks whether those people acted with encouragement, assistance, financing, protection or some other relationship with a political organisation or government. State responsibility is a further question because international law requires a sufficient legal basis for treating particular conduct as attributable to a state. Evidence relevant to one level can support assessment at another, but it does not automatically satisfy it.

That separation also prevents two opposite analytical errors. Finding traffic originating from Russian networks did not prove that the Russian government ordered the attacks, particularly when compromised machines could be located almost anywhere. Conversely, failure to establish a publicly demonstrable chain from the Kremlin to individual attacks did not prove that state involvement was absent. The available evidence supported different propositions with different degrees of confidence, and responsible analysis has to preserve those differences rather than resolving uncertainty retrospectively.

NATO’s public language at the time reflected precisely this caution. On 23 May 2007, spokesman James Appathurai confirmed that Estonia had briefed NATO on the breadth of attacks against public and private institutions and had requested political solidarity and technical assistance, both of which NATO provided. When asked where the attacks originated, however, Appathurai declined to attribute them and emphasised how difficult such attacks were to trace definitively. NATO could therefore recognise that an Ally faced a serious security problem and assist it without first resolving ultimate responsibility for every part of the campaign.

That distinction leads to a practical question for governments: how much attribution is necessary before action can be taken, and what kind of action is being considered? There is no single evidentiary threshold because governments are not making one decision. They are making several decisions under different authorities, with different consequences and on radically different timelines.

A network defender may need to block traffic, isolate a service or alter routing within seconds or minutes. Waiting for proof of who ordered the attack would make defence impossible. A criminal investigation operates differently because investigators need evidence linking conduct to identifiable suspects, must obtain material across jurisdictions and eventually need evidence capable of supporting prosecution. Intelligence services may assess responsibility using sources that cannot be disclosed publicly and express conclusions probabilistically rather than according to the evidentiary rules of a criminal court. A government considering public attribution must additionally assess whether the available evidence justifies accusing another state and whether enough of that evidence can be disclosed to make the accusation credible without compromising intelligence capabilities.

Collective defence introduces another set of considerations. An Ally does not need to wait for a criminal conviction before consulting NATO hostile activity, as Estonia itself demonstrated in 2007. At the same time, moving from consultation and technical assistance toward measures premised on another state’s responsibility raises much more demanding political and legal questions. NATO’s response to Estonia was therefore significant partly because assistance did not depend upon pretending that attribution had been resolved. Estonia asked for solidarity and technical assistance rather than invocation of Article 5, and NATO provided both while publicly acknowledging the uncertainty surrounding the provenance of the attacks.

The different processes consequently run on different clocks. Technical defence may begin before the attacker is known. Intelligence assessment may develop while defensive action is already underway. Criminal investigation can continue for months or years and may depend upon foreign jurisdictions. Public attribution can occur when a government judges that the political and evidentiary case is sufficient, even where information supporting that judgment cannot all be released. Decisions involving countermeasures, self-defence or collective defence introduce still different legal and political considerations. Treating “attribution” as a single moment when responsibility suddenly becomes known obscures how governments actually have to manage cyber incidents.

Estonia exposed that problem unusually clearly because the political context was obvious while the evidentiary chain was not. It was possible to understand why Estonia was under pressure, recognise that the cyberattacks formed part of that confrontation, identify some participants and still remain unable to demonstrate publicly who had ordered the campaign as a whole. The uncertainty did not prevent Estonia from defending its networks, investigating crimes, seeking international assistance or raising the issue with NATO. It did constrain what could credibly be claimed state responsibility.

For commanders and governments, the practical requirement is therefore not to wait for a mythical point at which attribution becomes perfectly certain. It is to determine in advance what degree and type of confidence is required for each available action, who has authority to make that assessment, what evidence can be shared with allies and the public, and what measures can proceed while attribution remains incomplete. Estonia in 2007 had to make those decisions while the institutional framework was still being formed. The question is why, despite the attacks and the uncertainty surrounding their direction, the country remained able to function.

6. Why Estonia Did Not Collapse

The attacks exposed genuine weaknesses in Estonia’s dependence on digital services, but they also demonstrated its ability to absorb, contain and adapt to disruption. Government continued functioning, domestic internet connectivity remained available, banks r...