The International Community Must Hold Russia Accountable for Its Cyber Militias

Disclaimer: The opinions expressed are not necessarily those of the U.S. Army War College, Department of the Army, or the Department of Defense.

Tensions in Tallinn, Estonia had been building for weeks when Hillar Aarelaid—director of Estonia’s Computer Emergency Response Team (CERT)—detected an unusually volume of web queries toward government and commercial websites on 26 April 2007.[1]  He was not particularly surprised.  The ethnic Russian minority population in Tallinn was incensed about the Estonian government’s intention to reposition the “Bronze Soldier” war memorial from downtown Tallinn to a military cemetery—not to mention the annual enmity that occurred on the forthcoming 9 May “Victory Day” observance of triumph over Nazi Germany.  Many Estonians viewed Victory Day as an unwelcome reminder of Soviet occupation from 1944-1991, and derisively called the Bronze Soldier “the Unknown Rapist.”[2]

As Russian protests turned into riots, the simple queries grew into a well-coordinated Distributed Denial of Service (DDOS) effort—led by associates of the pro-Kremlin cyber militia calling itself Nashi.[3]  For nearly three weeks Estonia experienced periodic DDOS disruptions involving over a million unwittingly “enslaved” botnet computers from 175 countries.[4]  Bank services were unavailable to customers; government websites were defaced and overtaxed with incoming queries.  On 19 May 2007 the disruptions ceased almost all at once—suggesting the presence of central control, with most botnet controllers’ Internet Protocol (IP) addresses traced to Internet Service Providers in Russian Federation locations.[5]  Antivirus giant McAfee’s analysis revealed over 80,000 participating IP addresses—many traced to the Russian mafia and Russian sympathizers in Latvia, the Ukraine, and the United States.[6]

The DDOS caused financial damage to banking and private industry estimated at over three million euros,[7] yet there were no consequences for the hackers outside Estonia.  Russia feigned ignorance of the nationalistic cyber militia; unsurprisingly, European Union and NATO experts could find no evidence of direct collusion between the government and Nashi.[8]  Nevertheless, Russia-based botnet controllers violated Estonia’s sovereignty by interfering with the nation’s commerce, governance, and communication; the Russian government should have been held accountable to stop the DDOS.  There are two levers to accomplish this if it occurs again: demand United Nations legal action against Russia for its unlawful conduct, and request sanctions from the World Trade Organization (WTO) for violations of international trade conventions.      

Countries victimized in the future by Russia’s cyber bullying could make a strong case against the Kremlin in the UN’s International Court of Justice. Under international law norms, nations are responsible for their citizens’ actions that are detrimental to other countries.  The recently published Tallinn Manual on the International Law Applicable to Cyber Warfare—a three-year project by an “International Group of Experts” at NATO’s Cooperative Cyber Defence Centre of Excellence—describes cyber responsibility in Rule 5: “A State shall not knowingly allow the cyber infrastructure located in its territory…to be used for acts that adversely and unlawfully affect other States.”[9]

The Russian government asserted that it neither had knowledge of the DDOS’ origin from IP addresses inside its borders, nor were its law enforcement organizations willing to investigate.  When the Estonian General Prosecutor contacted his Russian counterpart for assistance in bringing hackers to justice, the response was curt:  “In our criminal proceedings, Russian police do not identify IP addresses.”[10]  Although post-event analysis did not produce evidence of a Nashi conspiracy with President Putin’s government, the Tallinn Manual indicates that Russia was in violation by failing to act “upon notification by another State that [DDOS] activity is being carried out.”[11]  Russia was aware of the DDOS in Estonia, and its origins on the Russian-language hacker websites—yet they chose to do nothing.  When the DDOS ended, the Estonian government took measures to remove the worldwide botnets and determine the locations of botnet controllers.  Out of 175 countries hosting computers victimized by botnet malware, all but one cooperated in cleaning up the bot problem:  Russia.[12]

The financial backing and intellectual prowess required to execute the DDOS further implicated the hand of the Kremlin.[13]  David J. Smith, a Senior Fellow at the Potomac Institute for Policy Studies, candidly describes Russia’s cyber posture in 2012: “Russia—a motley crew of government-sponsored cyber criminals and youth group members—has integrated cyber operations into its military doctrine.”[14]  Evidence of Nashi involvement surfaced during the DDOS attacks on Lithuania and Georgia in 2008, as well as Kyrgyzstan in 2009.[15] Thus, there is growing suspicion that the Nashi now receives subsidies directly from the Kremlin, particularly because Vladislav Surkov held meetings with the group during his time as first deputy chief of President Putin’s staff from Nashi’s early days in 2005.[16]  Since December 2011, Surkov has been Putin’s Deputy Prime Minister.  Smith asserts that working through hacktivists is cheap for the Russian government and confounds attribution; traces of IP addresses will never point to a government computer, which provides plausible denial.[17]         

After decades of marginalization from international trade decisions, Russia completed its accession to the World Trade Organization (WTO) in December 2011.  Russia’s membership should boost its annual economy by tens of billions of dollars—but the WTO expects it to reduce corruption and improve the rule of law.[18]    Estonia’s Defense Minister, Jaak Aaviksoo, declared the DDOS effects “can effectively be compared to when your ports are shut to the sea.”[19]  This is known in international legal parlance as a blockade.  The Tallinn Manual’s Group of Experts could not agree about whether a cyber blockade could meet the legal criteria for a true blockade—and therefore an unlawful use of force.[20]  As an impediment to trade, though, such an action would be unacceptable to the WTO.  Sanctions could be on the table for Russia’s nascent membership.             

Estonia’s loss of three million euros—or over 4 million dollars[21] —is not insignificant to a nation with a population comparable to Phoenix, Arizona.  Estonia lost over 1.85% of its 2007 GDP; the same scale of attack upon the United States would cost US citizens nearly $260 billion.[22]   This equates to wiping out the Gross State Product of the entire State of Arizona for a year—which was the United States’ eighteenth-largest state economy in 2007.[23]    The international community must choose one or both of the aforementioned courses of action to discourage Russian collusion with cyber militias.  As Hillar Aarelaid remarked while reflecting on Estonia’s DDOS event, “If you have an unknown number of attackers with different skills and capabilities, it’s quite painful.”[24]