News 

"We aren't pointing the finger at anyone in particular, not yet," a Nato spokesperson told PC Pro. "This attack was unprecedented in both scale and the impressive way it was co-ordinated, and has serious implications. The secretary general has spoken to the Estonian president and we've sent an expert to Estonia to monitor the attacks."

The Estonian government, whose decision to move a Soviet-era statue in Tallinn sparked this dispute, isn't as reluctant to apportion blame. Prime minister Andrus Ansip pointed the finger square at Moscow, saying some of the attacks came from government computers. The Distributed Denial-of-Service attacks targeted banks, government departments and media organisations, and the Tallinn authorities believe a botnet of at least a million computers was used.

Critical computer ports were targeted in telephone exchanges and other key hubs, and multimegabyte "packet bombs" were sent first to one key address and then another, tactics that Estonia's experts claim are beyond even organised criminal gangs.

The clearest evidence that the attack was political rather than criminal is the lack of extortion: no-one is demanding $30m in an offshore account to stop the bots. Russia denies any wrongdoing, but international warfare experts say it's entirely possible the Russian government at least knew of the attacks.

"Russia uses a number of methods of keeping control in the former Soviet states - think back to the cutting of gas supplies to Ukraine. It's happy to use any way of retaining some control," says Matthew Clements, Eurasia editor of defence experts the Jane's Information Group. "What's certain is that this comes from Russia, but it's impossible to say whether this is state sanctioned and being carried out by the government agencies. The scale and the level of organisation suggest some sort of official complicity, but it's hard to know how high that goes."

Security experts,

ADVERTISEMENT

however, are more sceptical and imply nationalistic hackers could be behind the attacks. "It's more likely to be the work of vigilantes," claims Andy Cuff, of Network Intrusions, which counts America's National Security Agency among its clients. "If Russia really wanted to attack someone they wouldn't be so obvious."

Nevertheless, state cyber capabilities are improving, even if Whitehall is understandably coy about discussing to what extent Britain or its allies have used digital weaponry in recent operations. "We wouldn't comment on this due to operational security," said an MoD spokesperson, which falls some way short of a denial. Even in cyber warfare, no country wants to be seen as incapable of attack. "As we learn how to defend ourselves, we're developing an offensive capability," says US information warfare analyst John Arquilla. "You can't defend yourself against something unless you understand how it works."

Not surprisingly, the US isn't taking any chances: its Air Force recently set up a new command centre for co-ordinating sorties on the internet. Its mission statement says it will "deliver sovereign options for the defence of the United States of America and its global interests, to fight in air, space and cyberspace."

According to Dr Lani Kass, director of the Air Force Cyberspace Task Force, the net is a strategic theatre of operations. "The domain is defined by the electromagnetic spectrum," she says. "It's a domain just like air, space, land and sea. It's a domain in and through which we deliver effects - fly and fight, attack and defend - and conduct operations to obtain our national interests. It allows us to help find, fix and finish the targets we're after."

Yet, despite such posturing, Nato doesn't currently define cyber attacks as a military action - leaving the victim without the protection of collective self-defence that traditional warfare would guarantee. The Council of Europe and International Telecommunications Union are both trying to structure agreements on what constitutes a cyber crime or an act of cyber war, but, with the stakes so high, a convention isn't expected to be signed until 2012. After any agreement, the consequences of a state caught sabotaging somebody else's network could be far more grave.

"Obviously, if what's happened here could be called an act of war under agreed convention, this would be more serious," says Clements. "If it was seen as a collective attack on a Nato member nation, that could spark a physical reaction."