The Baltic States, a defence model for the future of cyberwarfare

The world is moving towards a digitised global society full of cyber opportunities. However, as a fully cyber-connected society, this future society will also have to cope with new patterns of conflict, such as cyber-attacks and hybrid warfare.

The Baltic countries - Estonia, Latvia, and Lithuania - which for years were under the control of the Union of Soviet Socialist Republics (USSR) and then forced to fight on the front line of digital warfare, have been forced to take the lead in this process of cyber-innovation. Moscow's attacks on the three pioneers of independence from the USSR have been a constant for years. And they have grown exponentially since the early 2000s. 

The Republic of Estonia was one of the Kremlin's first targets in 2007. Tallinn's decision to move the monument to the fallen Soviet soldiers of World War II from the centre of the capital to the 'Bronze Soldier' cemetery provoked a wave of cyber-attacks from Russia that lasted more than 20 days. Public and private organisations, ministries, banks, the media and even the parliament itself were affected by hundreds of hacker offensives. 

"The government website normally receives between 1,000 and 1,500 hits a day; at the height of the attacks, in the first week of May, it received between 1,000 and 1,500 per second," explained defence spokesman Mikko Maddis at the time. "It blew up the system. 

Fearing that the attack was just the prelude to a larger-scale cyber offensive, Estonia armoured itself. The small country shifted as many government services and systems as possible to new, private and secure networks, improving cyber security and protecting itself against the effects of digital warfare. This path also led Tallinn to transfer citizen services and the most basic government functions to blockchain technology.

Today, Estonia has become a country capable of dealing with almost any cyber threat; defined by The New Yorker as a "digital republic", its citizens have the opportunity to access virtually all available government services online, and its political and economic leaders to run it effectively from anywhere in the world. 

Indeed, in 2014 Tallinn spearheaded the world's first e-residency programme, aiming to exceed 10 million residents by 2025. And while it has so far failed to add more than 85,000 residents, it has enabled more than 19,000 entrepreneurs to consolidate new digital companies that do not need to be physically present. 

The situation in neighbouring Lithuania, meanwhile, follows a similar fate. In the context of the Russian invasion of Ukraine, the country's main electricity company, Ignitis, suffered a few weeks ago what has been considered the biggest computer attack in the last decade. As the company itself reported in a press release, the blocking of its website and other electronic services was delayed for several hours until it could be repelled.

This attack, perpetrated according to Lithuanian sources by the Russian hacker group Killnet, was seen as part of Russian retaliation for the partial blockade of freight transport to the Kaliningrad Oblast. A strategic enclave for Moscow, located on the Baltic Sea halfway between Belarus and Poland, it allows Moscow to maintain a geopolitical sphere of influence in the region. "The offensive will continue until Lithuania lifts the block," the organisation told Reuters, "so far we have destroyed 1,652 web resources". 

The war between Kiev and Moscow has also become another theatre of hybrid warfare. As the wave of Russian cyberattacks against Ukraine prior to the start of the invasion had already foreshadowed, the digital contest has also played an important role in the Kremlin's offensive; the massive distribution of malware, targeted attacks on highly critical infrastructure, and large-scale offensives against other Ukrainian websites (mainly through DDoS viruses, which make it impossible to access portals) have been just another weapon in Moscow's arsenal. 

However, in such a scenario both sides have deployed their own "armies" and allies. While groups involved in ransomware-type attacks, such as Conti, have declared their support for the Russian regime, others, such as Anonymus, have declared war on Putin - conducting information exposure campaigns - and joined Kiev's "cyber army". 

All this is evidence of the special importance of the cyber world on the international stage. Although the "Baltic laboratory" hardly seems exportable to other much larger and less technologically and digitally developed countries, most experts and analysts stress that it is necessary to know and monitor Estonian, Latvian and Lithuanian actions in their defence against Russian cyberattacks. The decisions taken by the small, once-Soviet states will serve as a guide to the characteristics and patterns of future cyber-conflicts. 

According to technology expert Joseph Dana for the Syndication Bureau, it is now Middle Eastern countries - such as the United Arab Emirates and Israel - that are paying most attention to the features of these new wars, and to cyber-defence strategies. The reason for this is twofold. In addition to the large Emirati investment over the past decade to follow the Estonian model, "Emirati officials have also discussed the need to build a better cybersecurity infrastructure to safeguard the nation's knowledge economy". 

Thus, many analysts have agreed that, should conflict break out between the Gulf states and Iran, cyberattacks would become a weapon of choice for both sides. Indeed, Israel and the Persian Islamic Republic have already exchanged several digital and technological offensives, and it is feared that these could extend beyond military infrastructure.