How cyber war games in Estonia looked at future Russian threats
| Washington
In a modern twist on old-fashioned war games, the United States military dispatched cyber fighters to Estonia this fall to help the small Baltic聽nation search out and block potential cyber threats from Russia. The goal was not only to help a NATO partner long targeted by its powerful neighbor but聽also to gain insight on Russian tactics that could be used against the U.S. and its elections.
The聽聽U.S. Cyber Command聽operation occurred in Estonia from late September to early November, officials from both countries disclosed this week, just as the U.S. was working to聽safeguard its election systems from foreign interference and to keep聽coronavirus research聽from the prying reach of hackers in countries including Russia and China.
Estonian officials say they found nothing malicious during the operation.
The mission, an effort analogous to two nations working jointly in a military operation on land or sea, represents an evolution in cyber tactics by U.S.聽forces who had long been more accustomed to reacting to threats but are now doing more 鈥� including operating in foreign countries 鈥� to glean advance insight into聽malicious activity and to stop attacks before they reach their targets.
The Defense Department has worked to highlight that more aggressive 鈥渉unt forward鈥� strategy in recent years, particularly after聽Russia interfered聽through hacking and covert social media campaigns in the run-up to the 2016 presidential election. American officials were on high alert for similar interference聽in 2020 but described聽no major problems on Nov. 3.
鈥淲hen we look at the threats that we face, from Russia or other adversaries, it really is all about the partnerships and our ability to expand really the聽scope, scale and pace of operations in order to make it more difficult for adversaries to execute operations either in the United States, Estonia, or other聽places,鈥� Brig. Gen. William Hartman, commander of the Cyber National Mission Force, said in a conference call with a small group of reporters this week.
Estonia, a former Soviet republic, was in some ways a natural fit for a partnership with Cyber Command because in years past it has been a cyber target聽of nearby Russia, including crippling attacks on government networks in 2007.
Estonian officials say they have since聽strengthened their cyber defenses,聽created a cybersecurity strategy, and developed their own cyber command, which like the U.S. version is part of the country鈥檚 military.
While nothing malicious was found on the networks during the exercise, 鈥渨hat we did learn is how the U.S. conducts these kinds of operations, which is聽definitely useful for us because there are a lot of kind of capability developments that we are doing right now,鈥� said Mihkel Tikk, a deputy commander聽in Estonia鈥檚 Cyber Command.
Mr. Tikk added: 鈥淚n some areas, it is wise to learn from others [rather] than having to reinvent the wheel.鈥�
Mr. Hartman declined to discuss specifics of the operation but said the networks in Estonia were 鈥渧ery well defended.鈥�
鈥淚 don鈥檛 want anyone to leave here with the impression that Estonian networks were full of adversary activity from a broad range of nation states,鈥� because聽that is not the case, he added.
Gen. Paul Nakasone, the commander of Cyber Command and the director of the National Security Agency, has hinted at a more aggressive, proactive federal聽government approach to cyber threats.
In an August piece for Foreign Affairs magazine, for instance, Mr. Nakasone wrote that U.S cyber fighters have moved away from a 鈥渞eactive, defensive posture鈥澛燼nd are increasingly engaging in combat with foreign adversaries online.
Cyber Command has worked in past years with countries including Montenegro and North Macedonia on similar missions. Estonian officials say they believe聽the partnership could be a deterrent to countries such as Russia.
鈥淭hese kinds of operations, I think, they will continue,鈥� said Undersecretary of Defense Margus Matt. But, he added, 鈥淚 don鈥檛 know how much we will speak聽of them publicly.鈥�
U.S. officials say they think the risks of a proactive approach 鈥� a country, for instance, could regard such an operation as a provocation toward a broader聽international cyber conflict 鈥� are outweighed by the benefits.
鈥淲e believe that inaction in cyberspace contributes to escalation more than reasonable action in cyberspace,鈥� said Thomas Wingfield, deputy assistant secretary聽of defense for cyber policy.
This story was reported by The Associated Press.
