Estonia cites Russia in mass cyber attacks

TALLINN, Estonia - This small Baltic country, one of the most wired societies in Europe, has been subjected in recent weeks to massive and coordinated cyber attacks on Web sites of the government, banks, telecommunications companies, Internet service providers and news organizations, according to Estonian and foreign officials.

Computer-security specialists call it an unprecedented assault on the public and private electronic infrastructure of a state. They say it is originating in Russia, which is angry over Estonia's recent relocation of a Soviet war memorial. Russian officials deny any government involvement.

NATO and the European Union have rushed information-technology specialists to Estonia to observe and assist during the attacks, which have disrupted government e-mail and led financial institutions to shut down online banking.

As societies become increasingly dependent on computer networks that cross national borders, security experts worry that in wartime, enemies will attempt to cripple those networks with electronic attacks. The Department of Homeland Security has warned that U.S. networks should be secured against al-Qaeda hackers. Estonia's experience provides a rare chance to observe how such assaults proceed.

"These attacks were massive, well-targeted and well-organized," Estonian Defense Minister Jaak Aaviksoo said in an interview. They can't be viewed, he said, "as the spontaneous response of public discontent worldwide with the actions of the Estonian authorities" concerning the memorial. "Rather, we have to speak of organized attacks on basic modern infrastructures."

The Estonian government stops short of accusing the Russian government of orchestrating the assaults, but alleges that authorities in Moscow have shown no interest in helping to end them or in investigating evidence that Russian state employees have taken part. One Estonian citizen has been arrested, and officials here say they also have identified Russians involved in the attacks.

"They [Russian officials] won't even pick up the phone," Rein Lang, Estonia's minister of justice, said in an interview.

Estonian officials said they traced some attackers to Internet protocol addresses that belong to the Russian presidential administration and other state agencies in Russia.

"There are strong indications of Russian state involvement," said Silver Meikar, a member of Parliament in the governing coalition, who follows information-technology issues in the country. "I can say that, based on a wide range of conversations with people in the security agencies."

Russian officials deny that claim. In a recent interview, Kremlin spokesman Dmitri Peskov called it "out of the question."

The attacks began April 27, a Friday, within hours of the war memorial's relocation. On Russian-language Internet forums, Estonian officials say, instructions were posted on how to disable government Web sites by overwhelming them with traffic, a tactic known as a denial-of-service attack.

The Web sites of the Estonian president, the prime minister, Parliament and government ministries were quickly swamped with traffic, shutting them down. Hackers defaced other sites, putting, for instance, a Hitler mustache on the picture of Prime Minister Andrus Ansip on his political party's Web site.

"It was like an Internet riot," said Hillar Aarelaid, a lead specialist at Estonia's Computer Emergency Response Team, which headed the government's defense.

Over the following two weeks, the attacks grew in size and sophistication, overwhelming the computer systems of news organizations, Internet service providers, universities, nongovernmental organizations, and banks.

On May 9, the day Russia celebrates victory in World War II, a new wave of attacks began at midnight Moscow time.

"It was the Big Bang," Aarelaid said. By his account, four million packets of data per second, every second for 24 hours, bombarded a host of targets that day.

"Everyone from 10-year-old boys to very experienced professionals was attacking," he said. "It was like a forest fire. It kept spreading."