Disinformation: Russian ‘Cyber War’ against Estonia


Richard Moore

Original source URL:

Hysterical Western Media Hype Flimsy Cyber War Against Estonia
By Mark Ames and Alexander Zaitchik, AlterNet
Posted on June 2, 2007, Printed on June 2, 2007

There's been a lot of bleating in the West lately about Putin stomping on the 
last remnants of Russia's free press, but after witnessing Western coverage of 
last month's cyber-attacks on the websites of Estonian banks and government 
offices, it's hard to say how the Western press is superior or even much 
different from the sleaziest Kremlin mouthpieces.

By now everyone and their iGrandma is quaking in their workstations over reports
of "the world's first massive cyberstrike by a superpower on a tiny and almost 
defenseless neighbor," as Newsweek delicately described the attacks. Most 
outlets' versions were slightly more subtle, emphasis on "slightly." For 
example, this May 17 ABC News lead paid minimum lip service to journalism 

Estonia: Ground Zero for World's First Cyber War?

By Tomek Rolski

It didn't take long for the problem to be diagnosed as a cyber-attack by another
country or a very well-organized entity.

While no one at this stage will point blaming fingers at any one country, 
Estonians have little doubt that it's Russia taking revenge.

But some were willing to point "blaming fingers." Multiple, throbbing, blaming 
fingers. For the Washington Post, the story worked like a megadose of Cialis. 
The daily published not one, not two, but three denunciations of "Kremlin 
cyber-attacks on official Estonian websites," in the words of Post opinion page 
editor Fred "Bomb Iraq Now!" Hiatt.

And who could possibly suspect the Estonians of being the world's biggest 
cyber-bullshitters? What motive could the poor beleaguered Estonians possibly 
have for hyping the storyline of a Kremlin plot? Everyone knows that the 
Russkies are liars, but the Estonians? They're so cute 'n cuddly and vulnerable!
And they all bank online!

If Estonia was in fact the victim of a Kremlin-coordinated attack, as Tallin 
first suggested and many reporters took on faith, then the cyber-assaults 
represent a serious incident indeed. Estonia is a member of NATO, and according 
to Article V of the NATO charter, alliance members, including the United States,
are obliged to respond to an attack on a member state. While NATO doctrine is 
not clear on whether cyberwar constitutes a trigger for Article V -- or even 
what constitutes cyberwar -- to bring up collective security and Kremlin 
aggression in the same breath has dead-serious implications. And so it gave us 
pause when the Washington Post editorialized against "Russian President Vladimir
Putin's Š flagrant if novel aggression against a peaceful state."

That the attacks were neither flagrant nor novel didn't slow down Post/Slate 
columnist Anne Applebaum, who a few days after the Post editorial all but 
expressed disappointment that U.S., British and German forces weren't already 
carving up their occupation sectors in Smolensk, Pskov and Vologda. Applebaum 
admits that while the perpetrators of the cyber-attacks "aren't exactly unknown,
their identities can't be proved, either." It's sort of like a known unknown 
that's really a known known. But even though their identities "can't be proved,"
Applebaum is quick to raise the specter of Article V, slamming what she 
considers NATO's slack response "despite the alliance's treaty, which declares 
that an armed attack on one of its members is 'an attack against them all.'"

"Armed attack," Anne?

It wasn't just usual suspects like the Post and the U.S. networks that jumped on
the Kremlin cyberwar bandwagon. Even the Guardian included the cyber-attacks in 
an editorial litany of Russian polices toward Eastern Europe, taking for granted
a Kremlin connection and thus raising disturbing questions about the appropriate
NATO response.

But what if Estonia's original claims of Kremlin involvement are wrong? What if 
the Western media swallowed a hook that made no sense? What if, say, the 
Washington Post wrongfully accused a country of aggression, suggesting America 
and its allies should respond with vigor, even if the case against that country 
"can't be proved"? Surely the Post had learned its lesson from the WMD fiasco, 
when it pushed incessantly for Bush to attack Iraq on the basis of unproven 
claims of WMD stockpiles and programs. No way would the Post, or the rest of the
media, make that same mistake twice!

We decided to do what journalists are supposed to do in a story this serious: We
called up some cyber experts who don't have Estonian last names and aren't 
"unnamed NATO sources." What we wanted to check was Estonia's "evidence," which 
consisted of a list of IP addresses of the computers that bombarded and shut 
down their sites, including one IP address in the Russian presidential 

Would an official Russian cyberwar against Estonia leave that kind of trail? And
if Russia launched a cyberwar, would it really consist of something as obviously
geeky and easy as flooding a handful of sites into temporary shutdown mode?

"That would be stupid," was the assessment of a Finnish cyber security expert 
named Mikko Hypponen. According to him, fake IP addresses are a routine part of 
any hack attack anywhere in the world, and that, if the Kremlin really wanted to
mess with Estonia's e-infrastructure, it would have done much more than send 
forth a few waves of annoying spam tsunamis.

Hypponen, chief security officer for F-Secure in Helsinki, added that it was 
highly unlikely the Kremlin would use its own computers, as Tallin originally 

He also sent us the "proof" that Estonia distributed. "There were thousands and 
thousands of attack sources," said Hypponen. "This could have been the kid of a 
janitor of some government building in Moscow. This is not a government-run 
information warfare attack."

Another expert, Daniel Golding of the well-regarded U.K.-based Hellbound Hacker 
collective, agreed. In an email interview, he wrote, "The way Estonia has 
reacted is just absurd. These attacks have literally (forgive my stereotype) 
been initiated by some 15-year-old teenage boy in his bedroom, who clicked a 
button saying 'attack this Estonian bank.'"

As for the alleged evidence, the Kremlin IP address, he wrote, "No experienced 
hacker will use his own IP address. For many attacks they will use a proxy which
is another computer setup to bounce their connection. So they can access the 
internet by another computer, thus completely hiding their own address."

The attacks on Estonia were DDoS attacks (Distributed Denial of Service). This 
is when a large collection of computers bombard the victim with more data than 
it can handle, thus crashing the site.

"With these kinds of attacks, none of the computers being used will be from the 
hackers," says Golding. "It will be coming from a collection of thousands of 
infected machines, many of which won't even know their infected are attacking a 
website/network. To say an ISP in the Kremlin was used in an attack is probably 
very true, but so were hundreds of other computers from literally all over the 

The case against the Kremlin in the "world's first-ever state cyberwarfare" is 
so flimsy that it makes the Iraqi WMDs look like a slam-dunk by comparison, even
with 20/20 hindsight. And yet the only English-language publication that could 
be bothered to debunk Estonia's initial claims was the online journal 
SearchSecurity.com in a May 18 article entitled, "Experts doubt Russian 
government launched attacks." That article did the incredible, something 
Newsweek, the Washington Post, ABC News or a score of others never bothered 
doing: actually interviewing experts.

Such as Graham Cluley, a senior technology consultant for a major U.K.-based 
security software company, who told SearchSecurity, "I think it is extremely 
unlikely that the attacks are being sponsored by the Russian government."

The SearchSecurity article even quotes the chief of Estonia's Computer Emergency
Response Team, Hillar Aarelaid, who "expressed skepticism that the attacks were 
from the Russian government, noting that Estonians were also divided on whether 
it was right to remove the statue."

You read that right: Estonia's top cyber-chief didn't buy his own country's 

So here's what we now know about the cyber-attack: Cyber-security pros, as well 
as any hacker-geek you talk to, agree that the cyber-attack on Estonia was (a) 
untraceable, and (b) so low tech and old school that it was almost certainly 
carried out by angry individual Russian hackers, who are famously legion.

And contrary to numerous breathless Western reports, this is not the first time 
that patriotic cyber-geeks have attacked another country's vital websites in the
wake of an international incident. (The attacks followed the controversial 
removal of a Red Army memorial in downtown Tallin.)

As Johannes Ullrich, chief researcher at the Bethesda, Md.-based SANS Internet 
Storm Center, told SearchSecurity.com, "It may as well be a group of bot herders
showing 'patriotism,' kind of like what we had with web defacements during the 
U.S.-China spy-plane crisis [in 2001]."

Guess every reporter forgot to check Google to see if this really was the first 
instance of "cyberwar" or not, because in 2001, after the Chinese downed an 
American spy plane, angry Chinese net-nerds attacked U.S. sites. Lots of them. 
Then they did it again on the anniversary, the following year. During these 
attacks on U.S. sites, we don't remember Ann Applebaum, or anyone else, claiming
that Beijing was behind the attacks.

Nor did anyone make much of a stink when, at the beginning of Gulf War II, DDoS 
attacks shut down Al Jazeera's website, something that was chalked up at the 
time to "patriotic" American hackers, and not the American government itself 
(which preferred to simply bomb Al Jazeera, as it did on April 8, 2003, killing 
its Baghdad correspondent, Tariq Ayoub).

What this all means is that the biggest, most harrowing, hysterical news story 
to come out of these parts in the past few months -- Russia launching "the first
ever state cyberwarfare" against NATO-EU member Estonia -- stands as an example 
of Western journalism at its most sloppy and sinister. There are good reasons 
for the West to be concerned about what the Kremlin might be up to these days, 
but playing with Estonian websites is not one of them.

The reason this story is so maddening is not simply because po' Russia done got 
blamed for something she didn't do. Pity is not exactly the first emotion that 
comes to our minds when we think of Russia these days.

No, what's infuriating is how a sleazy Estonian P.R. exercise, designed to 
deflect the world's attention from its mistreatment of its Russian-speaking 
minority, succeeded, thanks to the collusion of so many powerful Western media 

The Estonians have been working desperately to maintain the West's protection, 
which they need not only to succeed, but also to allow them to continue getting 
away with abusing their Russian minority. To maintain the West's protection, 
Estonia needs the world to see them as "defenseless" against Russia, as Newsweek
dutifully does, even though calling a NATO country "defenseless" is about as 
insane an inversion of reality as calling Sophia Coppola "profound."

The crude manner in which the bronze statue in Tallin was removed and the 
Pinochet-like police response to the Russian minority's riots set in the context
of 16 years of official racist policies against its minority, threatened 
Estonia's position as the EU's greatest lil' victim. Estonia, and its EU and 
NATO minders, desperately needed to make its Western overlords forget about the 
riots, which threatened to raise serious questions about Estonia's human rights 
record. Even notorious Russophobe/Baltiphile Edward Lucas, formerly the 
Economist's correspondent in Moscow, expressed disgust at Estonia's handling of 
the bronze statue on his personal blog. Estonia needed to avoid the kinds of 
articles and inquiries that look into the "root causes" of the riots and keep 
the West focused instead on the "external causes."

The lie in early May about secret Kremlin agents fomenting the riots didn't work
well enough, because it kept people focused at least partially on the riots and 
hence on the plight of Estonia's Russian minority. Estonia needed to change the 
narrative away from the unpleasant domestic story to the more palatable 
international spin.

With the tale of Russia's cyberwarfare against Estonia, they struck P.R. gold: 
the riots, the disenfranchised Russian minority, the police brutality -- all of 
it vanished overnight, replaced by a new story about tiny, defenseless e-Stonia 
getting cyber-attacked by giant, menacing Russia, "the first ever attack of its 
kind," an attack that the West was not prepared for.

Of course, when we think of "attacks we're not prepared for," we think of 9/11.

Congratulations to Estonia, its P.R. goons and, most of all, to the Western 
media tools who made it all possible. If there's any lesson here, it's that much
of the Western press has "moved on" from its post-WMD-stockpile syndrome. Thank 
god for freedom.

Mark Ames and Alexander Zaitchik are editors of a Moscow English alt weekly, The
eXile. Ames is the author of "Going Postal: Rage, Murder, and Rebellion: From 
Reagan's Workplaces to Clinton's Columbine and Beyond."

© 2007 Independent Media Institute. All rights reserved.

Posting archives: http://cyberjournal.org/show_archives/
Escaping the Matrix website: http://escapingthematrix.org/
cyberjournal website: http://cyberjournal.org

Community Democracy Framework: 

Subscribe cyberjournal list: •••@••.•••  (send blank

cyberjournal blog (join in): http://cyberjournal-rkm.blogspot.com/

Moderator: •••@••.•••  (comments welcome)