A New Kind of War

By Anne Applebaum

Published: May 25, 2007 (Issue # 1274)

For The St. Petersburg Times

And now for a quick quiz: A European country — a member in good standing of NATO and the European Union — has recently suffered multiple attacks on its institutions. Can you (a) name the country, (b) describe the attacks and (c) explain what NATO is doing in response?

If you can’t, don’t worry: NATO itself doesn’t quite know what it is doing about the attacks, despite the alliance’s treaty, which declares that an armed attack on one of its members is “an attack against them all.” The country is Estonia — a very small, very recent member of NATO; the attacks are taking place in cyberspace; and while the perpetrators aren’t exactly unknown, their identities can’t be proved either.

Which creates a dilemma, or rather several: Is this an “armed attack”? Is the NATO alliance obliged to respond? And if yes, how? None of these questions have clear answers. And if you thought that terrorists headquartered in ungovernable bits of the undeveloped world were the West’s worst problem, think again.

To add an extra layer of complication to this story, it’s important to understand that its origins lie not in the high-tech cyber-future but in the Cold War past. Several weeks ago, the Estonian government decided to move a bronze statue of a Soviet soldier from its place in the center of Tallinn to a cemetery outside of town, together with the remains of the Soviet soldiers who had been buried beneath it. That might not sound like a casus belli, but to the Russian minority in Estonia, most of whose families arrived in the country after the Red Army drove the Germans out in 1945, that statue had become a rallying point, as well as a justification of their right to remain. To the Estonians, one-tenth of whom were deported to Siberia after 1945, the statue had become a symbol of half a century of Soviet occupation and oppression. When the statue was removed, a riot ensued; an ethnic Russian protester was killed; hooligans attacked the Estonian ambassador in Moscow; and, a few days later, web sites of the Estonian government, banks and newspapers began to go down.

Elsewhere this might not have mattered quite so much. A defense information specialist from another newish NATO member state told me, somewhat ruefully, that his country wouldn’t be vulnerable to a cyber-attack because so little of its infrastructure is sophisticated enough to use the Internet. But Estonia — “e-Stonia” to its fans — practices forms of e-government advanced even by Western European standards. Estonians pay taxes online, vote online, bank online. Their national ID cards contain electronic chips. When the country’s cabinet meets, every member carries a laptop. When denial-of-service attacks start taking down Estonian web sites, it matters.

As is the way of these things, of course, the attacks’ precise origin cannot be determined: Unlike classic terrorism, the essence of modern cyber-warfare is its anonymity. Though some attacks did appear to come from PCs belonging to the Russian presidential administration, others came from as far afield as Brazil and Vietnam. As a result, even the Estonian government’s experts have backed away from directly accusing the Russian government. After all, angry hackers can organize a “ botnet” — a network of computers that have been remotely hacked and forced, unwittingly, to send out spam or viruses — anywhere. Indeed, “patriotic” Chinese hackers have made a specialty of this sort of assault, using computers all over the world to attack both Japanese and U.S. government web sites at moments of high tension. Both the anonymity and the novelty may turn out to be part of the appeal, particularly if, as some in NATO now believe, the attacks are Russian “tests” of the West’s preparedness for cyber-warfare in general and of NATO’s commitment to its newest, weakest members in particular. Some believe the Russian government is experimenting with different tactics, trying to see which forms of harassment work best: the verbal attacks on Estonia, the Russian oil pipeline to Lithuania that mysteriously needs repairs, or the embargos on Polish meat products and Georgian wine.

If that is the case, surely the lesson of the past three weeks is that cyber-warfare has a lot going for it: It creates no uproar, results in no tit-for-tat economic sanctions, doesn’t seem like a “real” form of warfare and doesn’t get anyone worried about Europe’s long-term energy needs. NATO did, in the end, quietly send a few specialists to Estonia, as (even more quietly) did the Pentagon.

A few Europeans complained a bit at a summit over the weekend, too. But there the affair will end — until whoever forced the Estonian government out of cyberspace comes back online, better armed for the next battle.

Anne Applebaum is a columnist for The Washington Post, where this comment appeared.