Audio clip: Adobe Flash Player (version 9 or above) is required to play this audio clip. Download the latest version here. You also need to have JavaScript enabled in your browser.

Download MP3
The World’s Clark Boyd heads for Estonia, which is hosting a major cyber-security conference this week.

Read the Transcript
This text below is a phonetic transcript of a radio story broadcast by PRI’s THE WORLD. It has been created on deadline by a contractor for PRI. The transcript is included here to facilitate internet searches for audio content. Please report any transcribing errors to theworld@pri.org. This transcript may not be in its final form, and it may be updated. Please be aware that the authoritative record of material distributed by PRI’s THE WORLD is the program audio.

MARCO WERMAN:  The U.S. is not adequately prepared to fend off cyber-attacks.  That was the warning from a recent report by the Department of Homeland Security’s Inspector General.  And online attacks reported by U.S. federal agencies are increasing rapidly.  For solutions, American officials might want to look to Estonia.  The tiny Baltic nation is hosting a major cyber-security conference this week.  From the capital Tallinn, The World’s Clark Boyd reports.

CLARK BOYD:  The Cooperative Cyber Defense Center of Excellence in Tallinn is home to some of the world’s leading cyber sleuths.  The center’s main goal, to figure out who is launching cyber attacks, and then brainstorm new strategies and tactics to stop them.  Estonia may be a small country, but its way ahead technologically.  Online banking, digital signatures and paying for parking with cell phones are the norm.  But with progress comes potential danger.

PRESIDENT TOOMAS HENDRIK ILVES:  Today you don’t need an Army; all you need is a keystroke.

BOYD: That’s Estonian President Toomas Hendrik Ilves giving the conference opening address.

ILVES: There is time for governments to get their heads out of the sand.  Our critical infrastructure, our electricity grids, transportation and mobile phone networks today are so enmeshed and tied to the internet that any open society is vulnerable to complete and utter failure.

BOYD: In 2007 a series of targeted online assaults wrecked havoc with some of Estonia’s most important web services.  Those attacks highlighted how difficult it is to mount a defense of what has been called “the fifth battle space”.  Three years on, nobody can say for sure who was behind the attacks.  They were launched by software running on machines in more than 100 different countries.  To date, one young student in Tallinn has been tried and convicted of taking part.  His fine was just a little more than $1,500.00.  Jaak Aviksoo is Estonia’s Defense Minister.  He says this new battlefield poses serious challenges for countries around the world.

JAAK AVIKSOO:  There are no smoking guns, no fingerprints in virtual reality.  What is a cyber-dead or cyber-wounded?  What is a cyber war?  Has somebody to declare that?  To what extent you can altogether formally verify who is attacking who.

BOYD: There are no readily agreed upon answers to Aviksoo’s questions.  Mikko Hypponen is the Chief of Research at the Finnish anti-virus firm F-Secure.

MIKKO HYPPONEN:  What we saw in Estonia in 2007, that wasn’t war.  That was online traffic jams, basically.  And in my book, real cyber war, what we want to define what’s cyber war, real cyber war would be when the Army of country “A” would attack the computer systems of Army of country “B”.  And that has never happened, yet.

BOYD: Yet being the operative word.

MALE VOICE 1:  So we’re sitting out here and be able to exploit one server on the edge of your network.

BOYD: Conference organizers invited some insiders to demonstrate how cyber attacks against nation states might be conceived, organized and paid for.  Haroon Meer is with the company that does penetration testing.  In other words, organizations hire Meer to break into their systems to help them improve their security.  Meer’s one of the good guys, but he can get into the head of the bad guys pretty easily.

HAROON MEER:  When people talk about cyber defense, they instantly get to we’ll protect control systems.  But the question is, are you protecting the banks?  Are you protecting your ISP’s?  Are you protecting the largest company in your country?

BOYD: Two years and one hundred million dollars.  That’s what another security consultant figures it would take for North Korea’s Kim Jong Il to find a team of cyber mercenaries to take down systems in the U.S., for instance.  The experts gathered in Tallinn this week agree that playing defense is technically tough.  Defenders have to protect against every kind of attack.  The attackers only need to find one way in.  It’s the kind of stuff that should give Estonian Defense Minister Jaak Aviksoo nightmares, but it doesn’t.  He says its all part of a necessary, if painful, learning curve.

AVIKSOO:  In conventional military conflicts, we know more or less what the risks are and how to handle those.  In cyber defense we don’t know.  So it all has to be worked out in the process of fighting real threats.

BOYD: Estonians, by the way, haven’t turned away from their internet-enabled lifestyle.  We’re not afraid of the danger, one government advisor told me.  Just because you get mugged once in a park, she said, doesn’t mean you stop going to parks.  For The World, this is Clark Boyd in Tallin, Estonia.

Copyright ©2009 PRI’s THE WORLD. All rights reserved. No quotes from the materials contained herein may be used in any media without attribution to PRI’s THE WORLD. This transcript may not be reproduced, in whole or in part, without prior written permission. For further information, please email The World’s Permissions Coordinator at theworld@pri.org.