Estonia's Volunteer Cyber Militia
Interesting—although short and not very detailed—article about Estonia’s volunteer cyber-defense militia.
Padar’s militia of amateur IT workers, economists, lawyers, and other white-hat types are grouped in the city of Tartu, about 65 miles from the Russian border, and in the capital, Tallinn, about twice as far from it. The volunteers, who’ve inspired a handful of similar operations around the world, are readying themselves to defend against the kind of sustained digital attack that could cause mass service outages at hospitals, banks, and military bases, and with other critical operations, including voting systems. Officially, the team is part of Estonia’s 26,000-strong national guard, the Defense League.
[…]
Formally established in 2011, Padar’s unit mostly runs on about €150,000 ($172,000) in annual state funding, plus salaries for him and four colleagues. (If that sounds paltry, remember that the country’s median annual income is about €12,000.) Some volunteers oversee a website that calls out Russian propaganda posing as news directed at Estonians in Estonian, Russian, English, and German. Other members recently conducted forensic analysis on an attack against a military system, while yet others searched for signs of a broader campaign after discovering vulnerabilities in the country’s electronic ID cards, which citizens use to check bank and medical records and to vote. (The team says it didn’t find anything, and the security flaws were quickly patched.)
Mostly, the volunteers run weekend drills with troops, doctors, customs and tax agents, air traffic controllers, and water and power officials. “Somehow, this model is based on enthusiasm,” says Andrus Ansip, who was prime minister during the 2007 attack and now oversees digital affairs for the European Commission. To gauge officials’ responses to realistic attacks, the unit might send out emails with sketchy links or drop infected USB sticks to see if someone takes the bait.
EDITED TO ADD (3/11): Here’s a brief interview with the current commander—and one of the founding members of the unit. Here’s a longer presentation.
Subscribe to comments on this entry
VinnyG • February 19, 2019 8:17 AM
One crucial detail absent from the article is the method used to prevent “moles” from infiltrating the volunteer defense group. Perhaps there is an effective strategy that Estonia does want to reveal for fear of granting an advantage to an adversary, but we should all by now be familiar with the weaknesses of “security by obscurity.” Certainly, independent black hats and Putin-affiliated hackers will make efforts to infiltrate, and the latter would likely lay low, learn, and bide their time until some kind of massive surprise offensive is unleashed.