Cyberterrorism attacks on Estonia, Georgia, and the United States

Warfare & Terrorism

The proliferation of cyberattacks -- aptly referred to as cyberterrorism -- carried out by criminal miscreants with grudges, shadowy techies with political motives, and other anti-social individuals, represent the new digital wars that threatened personal and state security worldwide. This is not a problem that will go away any time soon, and cyber security officials it seems will always be one or two steps behind the offenders causing the digital carnage. The cyberattacks that are reviewed in this paper include: Russia's denial-of-service attacks on Estonia in 2007 and Georgia in 2008, and the cyberattacks against U.S. State Department computers in 2006. Denial of service refers to strategies that "…block access of legitimate users" through the "…relentless transmission of irrelevant information" -- called "flood attacks" -- which restrains computer servers (Richards, 2010).

Russia's cyberterrorism against Estonia -- 2007

An article in the International Affairs Review indicates that the victim in this 2007 cyberterrorism was clearly Estonia and the aggressors were obviously hackers in Russia. It involved a "…three-week wave of distributed denial-of-service attacks" and what it disrupted was the infrastructure of Estonia's information-based technologies (Richards, 2010, 5). The attacks began on April 26, 2007, at 10:00 P.M., focusing first on the Estonian prime minister's "Reform Party website" and soon after other government and political websites, including the official website for Estonia's parliament were part of the attack (Richards, 6). After a full week of denial-of-service attacks on these sites, they had been "knocked…completely offline," Richards explains on page 6.

In the second week of cyberterrorism against Estonia the Russians were able to knock news websites offline. And when officials realized the attacks were coming from outside Estonia, they blocked all incoming information from outside the country, which created an irony because these news organizations could not report the terrorism to the world, Richards continues on page 7. The worst of the attacks arrived May 10, 2007, when the Internet capabilities of the largest bank in Estonia, the Hansabank, were shut down. This was a major disruption in the Estonian economy because "…97% of all banking transactions occurred online" and moreover, the ATMs in Estonia were also shut down (Richards, 7).

How did the hackers launch this cyberterrorism? They used "…weblogs, web journals, and Russian-language chat rooms" to advise hackers as to what time to launch attacks and what Estonian sites were most vulnerable, Richards continues (7). The flood attacks (using botnets which are computers that have been stolen from unsuspecting personal users) contained from 1,000 packets per hour early in the event (April 26) up to 4 million "incoming packets of information per second at hundreds of targeted websites" by May 9 (Richards, 7).

What did Estonia do in response to prevent similar attacks? First NATO sent cyberterrorism "experts" to assess what happened, why it happened, and helped to patch the vulnerable spots that allowed the attacks to be conducted. Cyberterrorism response strategies have subsequently been produced, and according to a peer-reviewed article in the Baltic Security & Defense Review, Estonia has fine-tuned its preventative measures against cyberterrorism to the point that they are now "…heralded as a leader in technological security" (Ashmore, 2009). In fact within a year after those attacks, Estonia adopted a "…comprehensive national cyber security strategy" and has been recognized for the quality of its defenses against future attacks (Ashmore, 9).

U.S. State Department computers were compromised in 2006

In the summer of 2006, the U.S. State Department (State) was hit with "…large-scale computer break-ins worldwide" that resulted in the theft of "…sensitive information and passwords," a far more serious intrusion than the first two mentioned in this paper (Associated Press). The hackers -- who were able to hide malicious code in a seemingly innocent Word document, resulting in a Trojan horse being installed in the agency's computer network -- focused on American offices that are in or deal with Asia. This was a substantial blow to security because daily State processes about 750,000 emails and instant messages from more than 40,000 employees and contractors in 100 domestic and 260 foreign locations (Reid, 2007). The perpetrators were not identified but they appear to have launched the several weeks of attacks from Asia, possibly from China. In a peer-reviewed piece in the Journal of Business Continuity & Emergency Planning, cyber security expert John Streufert goes to great lengths in detailing the new policies at State, which include: a halt to lengthy written reports (that are out of date before they are published); the use of "risk scoring with aggressive intrusion detection"; "watchful incident management" and greater "diligence in training"; and avoidance of "information overload" (Streufert, 2010, 314). Further, the author asserts that securing computer networks involves "a race against time to better cope with information overload" and there is a great need to address "high risk first" and to turn "a cold shoulder" to the flood of "metrics" that result in information overload (312).