DARKMARKET

represented ‘a frightening threat to key economic and societal infra-
structure’.

By this time Hillar Aarelaid and his team had fully mobilised.
Estonia’s CERT responded by expanding the country’s
broadband ‘pipeline’ into the country with the assistance
of its friends abroad, notably in Finland and Sweden.
‘We had been expecting that something like this might
happen and we had been on alert,’ Hillar remembered.
‘This was where the Russians made a mistake. If you want to
succeed with an attack like this, you need to know your enemy
really well and you need to be close to your enemy,’ he said,
explaining that the Russians had failed to anticipate the
high level of Estonia’s preparedness. ‘Had they thought
it through,’ he continued, ‘they would have known that
our systems were on high alert because of the recent elections.’

Thanks to the coordination of the government, the police,
the banks and CERT, the impact of the attacks on ordinary
citizens was kept within reasonable boundaries.
Hansabank maintained its online banking, but the other
two largest banks were unable to. Instead people simply
switched to using their branches. Mobile phones were
interrupted and, once the government ordered the shutdown
of Estonia’s links to the outside world, communication
with the country was tricky for a few days. Contrary to
initial reports, traffic lights in Tallinn did not stop working,
but there was some interruption to the work of the
government and the media.

The attacks continued at varying degrees of intensity for
two weeks, culminating in a massive assault on 9th May, the
date of the Red Army’s victory over the Nazis in Europe.
At this point, exhausted by the relentless flood of DDoS attacks,
the Estonian government decided to cut off the country’s
Internet system from the rest of the world. The DDoS
attacks declined to a dribble, eventually coming to an
end on 19th May.

The implications of the Estonian events were grave. In political
terms it was perfectly clear that the attacks came from Russia,
but predictably the government in Moscow denied all
responsibility for them. And it is perfectly possible that
there was no official involvement. Researchers were unable
to track down the precise origin of the attacks. Assuming that
they did come from Russia, however, the government must
have known about them because of their omniscient monitoring
system, SORM-2. Having said that, there was so much extraordinary
Internet