![The biggest cyber security challenge could be to the internet of things.](/content/dam/images/g/v/h/9/0/1/image.related.afrArticleLead.620x350.gvwbdh.png/1493615592471.jpg)
The Estonians just wanted to relocate a statue.
Ten years ago today, authorities in Tallinn set out to remove a Soviet World War II memorial from the capital's downtown. The Russian government had warned that removing the statue would be "disastrous for Estonians", but since Moscow no longer called the shots in the Baltic state, the statue was duly shipped off.
Soon after, Estonians found that they could not use much of the internet. They could not access newspapers online, or government websites. Bank accounts were suddenly inaccessible. "It was unheard of, and no one understood what was going on in the beginning," Toomas Hendrik Ilves, then Estonian President, told Foreign Policy.
Soon, he was informed that it was not an internal failure – but an attack from the outside. It was a Distributed Denial of Service Attack – an orchestrated swarm of internet traffic that literally swamps servers and shuts down websites for hours or days.
That was made crystal clear at the stroke of midnight on May 9 GMT, when Russia celebrates Victory in Europe day for World War II. Annoying cyber attacks dramatically intensified for exactly 24 hours, then trailed off as fast as they'd spiked. Ilves asked his cyber experts what happened. "Well, the money ran out," he was told – the attack had been bought and paid for by someone, or some state, using criminal hackers to cripple one of the most internet-dependent states in the world.
"Looking back on it, it was the first, but hardly the last, case in which a kind of cyber attack ... was done in an overtly political manner," Ilves said.
Estonia marked a watershed in the use of state-sanctioned cyber attacks to advance foreign policy goals. "Ten years ago, [Russia] put everyone on notice that it was willing to behave badly in cyberspace," said Jason Healey, a senior research scholar at Columbia University.
Moscow denies any role in the 2007 Estonia hack.
Broader information war
Just a year after the Estonia attack, Russia hacked Georgia at the same time it invaded with conventional forces, eager to punish the country for flirting too openly with the West – and, specifically, with NATO. (Russia also denies those attacks.)
Healey stresses the importance of putting cyber attacks within the context of a broader information war. The damning thing about the DNC hacks, he said, was not the hacks themselves, but their dissemination and the narrative around the content they unveiled, which helped distort media coverage of the front-running candidate.
"The damage came from what was being done, how that information was being used, the context around that situation," he said.
In some ways, the cyber threat since the groundbreaking attack in Estonia has only got worse. The United States and Israel unleashed the "Stuxnet" virus on Iran as early as 2007, according to some researchers (though it was discovered in 2010), to slow down its nuclear program. That opened the door to malware that can wreck physical – not virtual – gear.
Potentially even more problematic, says Rob Morgus of the New America Foundation, is the so-called Internet of Things, the universe of internet-enabled devices like televisions, refrigerators, copiers and more. Indeed, experts believe the cyber attack that took out much of America's internet last October – the largest in history – poured through a network infected with special malware. The network was not of computers, but of internet of things devices.
Yet, a decade on, the wake-up call in Estonia has helped spur significant action. Ilves recalls the difficulty of getting NATO to take cyber threats seriously before his country came under attack.
He recalls telling NATO officials, "'Listen, cyber is an area NATO has to deal with.' And they were like, 'yeah, yeah, yeah, go away. We're worried about real stuff.' And then this happened."
The NATO-accredited (though not NATO-funded or commanded) Cooperative Cyber Defence Centre of Excellence was launched in Estonia a year after the attacks, bringing together cyber experts from the military, government, and industry.
Foreign Policy