Cyberattacks on Estonia (2007)

In late April 2007, the Estonian government moved a Soviet soldier statue, the Bronze Soldier, out of central Tallinn. Riots broke out, and a campaign of distributed denial-of-service attacks hit, for about three weeks, the websites of parliament, ministries, major banks, media and parties. Online banking, in one of Europe's most digitized countries, was disrupted, and some banks cut access from abroad. The attacks were carried out by networks of compromised machines and by volunteers called up on Russian-language forums. Estonia accused Russia, which denied it; only one person was ever convicted, a Russian-speaking student living in Estonia. The episode became foundational. It led to the creation in Tallinn, in 2008, of NATO's Cooperative Cyber Defense Center of Excellence, which published the Tallinn Manual. It set the model of the attack with blurred attribution, in which a state benefits from an operation by volunteers it does not claim. For insurance, it shows how hard it is to characterize a hacktivist campaign encouraged by a state: neither act of war nor ordinary crime, it sits precisely in the zone that exclusion clauses struggle to describe.