by Leonard Kamps & Polina Guseva
“Estonia is of the smallest countries in Europe. At the same time, it is a world leader in offering e-Government services. And cyber defence. The country is at the centre of NATO operations in cyberspace.”
“The Internet is significantly changing the course of people’s lives and politics in Estonia. But how did that happen? And why Estonia?”
“To understand how Estonia became what it is today, it’s important to understand that its digital transformation didn’t just happen by chance. Estonia declared its independence just as the Internet started to take off with the invention of the web.”
SONG: “Cyberspace, set free, hello, virtual reality!”
“Taking a ‘tiger leap’ into the age of digital communication, the country created an e-Government.”
TOBIAS KOCH, SPEAKER AT E-ESTONIA BRIEFING CENTRE: “The ‘Tiger leap’ program was an initiative launched by the Estonian Government with the focus on equipping schools with information technology, with computers.”
HELI TIIRMA-KLAAR, AMBASSADOR AT LARGE FOR CYBER DIPLOMACY, ESTONIAN MINISTRY OF FOREIGN AFFAIRS: “The level of technological development during the Soviet Union was much lower compared to the Western countries. Then the decision was made to buy the off-the-shelf newest technology available.”
TOBIAS KOCH: “The ‘Tiger leap’ program is really something that was clearly embedded into the whole idea of actually making Estonia into an information society.”
HELI TIIRMA-KLAAR: “The ‘Tiger leap’ has helped to familiarise all different groups in society to this new technology.”
“Now, virtually everything can be done online: forms, voting, taxes…”
EVELINA, LIVES IN ESTONIA: “You can use it really simply. So, when I applied for university it just took one click in the system and it was done. Or, like, lately we had European Parliament elections, right? I was in Brussels and I did it actually during the lecture, so that the lecturer didn’t even notice.”
TOBIAS KOCH: “But then a second very crucial part is the electronic identity.”
HELI TIIRMA-KLAAR: “The PKI (public key infrastructure) system which is the national ID-card which allows to, basically, do all the transactions online in a secure manner. Of course, for some transactions people have to go still to the office, like getting married.”
“But it’s also nicer, right? It has helped Estonia become one of the most prosperous liberal democracies in Eastern and Central Europe.”
“Apparently, Estonia was visionary. And the people living there are very proud of it.”
EVELINA: “I feel that it’s like the complex of a small country. That, you know, Belgium is known for chocolate and beer. And we don’t have ‘our thing’. So, now we have the e-Government and we talk about it a lot.”
TOBIAS KOCH: “Estonia has positioned itself as one of the frontrunners in digital governance, et cetera. And also, in cybersecurity. And this is, actually, something that, in the international policy making area, has provided Estonia with access to very high-level international organizations. So, Estonia, actually, next year is going to be part of the UN Security Council on cybersecurity.”
“But as convenient and enabling as that may seem, the whole system can become a huge liability. If enemies attack it, they may disrupt everything the country depends on. In 2007, a dispute between Russia and Estonia sparked demonstrations and led to riots. Many people were injured, and one person was killed. In the midst of that chaos, a massive DDoS attack happened.”
TOBIAS KOCH: “There was, actually, a massive DDoS attack on Estonian infrastructure. Different services—whether banks, the tax authority, state portal, all sorts of websites—were just flooded with requests and would, eventually—some of them, actually—break down and, in order to contain the risks at some point, different services were taken off the Internet.”
“An attack of unprecedented scale.”
HELI TIIRMA-KLAAR: “This was the first time that people could see that this is possible. That you can use this new cyber domain for a coordinated operation. Which has never been seen before.”
“Since then, Estonia has learned that digitalisation not only brings opportunities and advantages, but also serious risks.”
TOBIAS KOCH: “And it was, actually, it was an attack, a cyberattack on a nation state.”
HELI TIIRMA-KLAAR: “It woke up many governments in the world.”
TOBIAS KOCH: “Everyone around the world who is concerned about cybersecurity should actually really step up their cybersecurity game.”
HELI TIIRMA-KLAAR: “Shortly after this the NATO Operative Cyber Defence Centre of Excellence was established in Estonia, which is still the primary NATO training and exercise centre.”
“As a result, Estonia has become a major cybersecurity hub in Europe and the NATO.”
HELI TIIRMA-KLAAR: “Some of the initiatives by the Centre like the annual conference CyCon and the—largest in the world—technical cyber exercise Locked Shields are those flagship projects.”
“Other countries can draw from its experience.”
HELI TIIRMA-KLAAR: “I think Estonian society had crossed an important milestone which many other societies have not crossed yet. So, in a way, we are now in a position of sharing our experience, and we are receiving around one hundred delegations a year asking for our experience. And we’re happy to share it.”
“Today, cybersecurity is part of Estonia’s e-Government strategy. But even after the DDoS attacks, ordinary people have still unshaken trust into those services that accumulate and combine masses of personalised data.”
TOBIAS KOCH: “When we’re talking about the cyberattacks in 2007—the security challenge that we’ve definitely had in Estonia— how do we address them? And we addressed them openly so that the society is, actually, informed, that the citizens are informed what’s going on.”
EVELINA: “I don’t know the details about cybersecurity, but I do trust the professionals who work on it. And I know that they do.”
TOBIAS KOCH: “It’s all about transparency. If you know who has what data and who has had access to your data, you can also trust the system. I’m just giving this data to authorities that are managing my data, but the precondition for this is that I can see this data. Then, if I can see that somebody actually illegally gets access to my data, I can hold this person accountable. And this is something that we call in Estonia the so-called ‘reversed Big Brother principal’. So, it’s a level of security, a level of trust between a provider—whether public or private sector provider—and the citizen.”
EVELINA: “I think that the benefit, that you can have people all over the world, the global citizens—as I was in Brussels. And I was participating in my country’s political life, just through your phone. This weights up the risks.”
“But shouldn’t people be more suspicious of such an extensive digitalisation?”
“Is it safe to entrust the government with such potential power?”
“Especially in a country that was recently ruled by a power that stripped its political opponents of all basic rights.”
“Are the Estonian people still to learn what the government and the military already know all too well?”
“As Estonia is becoming more and more digitalised, time will show.”