Russia’s Baltic Cyber Campaign Leaves NATO Endangered
Russia is constantly on the offensive in the Baltic region, seeking to undermine the North Atlantic Treaty Organization (NATO) through cyber intrusions and targeted disinformation efforts. To help bolster this front line and secure their own domains, the Baltic countries of Estonia, Latvia, and Lithuania need to work together, sharing cyber capabilities and understanding.
Russian cyber efforts are presently drawn to the Baltic region, which joined NATO in 2004, because of its physical proximity to the Russian border, its historical ties to Russia as former Soviet republics, and its high concentration of ethnically Russian populations. As the international community grapples with how to formally adjudicate and reprimand cyber intrusions, Russia treats targeted misinformation campaigns as a low-attribution and low-risk operation. Currently, Russia sees Latvia, and to a lesser extent Lithuania, as an entry point into NATO to spread hostile and divisive messaging.
As an organization, NATO has moved too slowly on the cyber front to be effective against a persistent and agile adversary such as Russia. At the 2018 NATO Summit, cyber-related issues were prominently discussed, but few actionable outcomes emerged from the gathering other than increased rhetoric and re-iterated pledges from member states to individually strengthen cyber defensive capacity. While reaching a consensus among member states on cyber issues is important, it does little to effect real change on the ground.
The Baltic countries have vastly different levels of cyber capability and awareness as a result of each country’s recent history with targeted cyber attacks. In 2007, Estonia was the victim of what is regarded as the first wide-scale, state-sponsored cyber attack from Russia. For several weeks after the attack, communications channels across Estonia were broken, the country’s central banking systems were non-functioning, media outlets were unable to broadcast the news, and government data was compromised. As a result, Estonia vowed to never again be the victim of such attacks. After large investments in cyber defensive capabilities over the past decade, Estonia is now a global leader in cybersecurity and is also regularly deemed the most digital country in the world.
Estonia’s southern neighbor, Latvia, is a markedly different story. Latvia has the highest percentage of ethnic Russians of the Baltic countries, at just over one quarter of the population. As such, Latvia has been slow to contain malign foreign political influence from Russia, and this is made apparent in a noticeable lack of cyber capabilities. Unlike Estonia, Latvia has no central cyber organization and is incapable of actively monitoring and deterring cyber intrusions. Common examples of these intrusions are focused Russian social-media efforts to create divisions between the ethnically Russian and ethnically Latvian populations. More sinister attacks meant to alter election data, corrupt financial institutions, or even expose classified data predominantly go unnoticed. Of all social-media posts in Latvia that mentioned NATO, an estimated 53% are from Russian-language bots, intended to carry messages that “NATO is a threat to Russia.” The final Baltic country of Lithuania falls in between Estonia and Latvia on the spectrum of defensive cyber capabilities and vulnerabilities.
A commonly suggested solution is that NATO, collectively, should invest more in cyber defense and offer support to the lacking Baltic region. But in a resource-constrained world, this solution is economically unrealistic, and the planning and agreement for the support would likely take far too long, given the urgent threat. Moreover, it risks relying on Estonia’s approval. Estonia, worried about angering Russia, has been content to merely observe its neighbors as it builds its own cyber defenses.
As a solution, NATO should take advantage of its pre-existing but underutilized training institutions, accredited as “Centres of Excellence,” to promote cooperation among the Baltics. These Centres can efficiently share NATO member-states’ best practices and lessons learned in cyber-preparedness with Baltic leaders and specialists. This training can also motivate the Baltics countries to work together, by emphasizing how little borders will do to contain an attack’s market effects, when one targeted economy is strongly linked to its neighbors, as the Baltics are. Estonia, with its exceptional first-hand experience of devastating cyber attack, has the means and the strategic interest to help strengthen Latvian and Lithuanian cyber defenses.
The United States also has a role to play in assisting its Baltic allies in cyber defense. The most effective means will not be through new, high-level NATO engagements, but rather through proven, existing channels for targeted assistance like the State Partnership Program (SPP). Started in 1993 as a mechanism for linking U.S. National Guard programs to former Soviet Union countries, the SPP has transferred U.S. military and technological expertise to countries around the world. Indeed, one of the more successful partnerships on cybersecurity has been between Estonia and the Maryland National Guard. Partnerships with Latvia and Lithuania, taking the Estonia one as a model, would benefit both the Baltics and the United States, since the cyber tactics that Russia perfects in the Baltics are applied elsewhere, including, it is suspected, in Russian sponsored cyber attacks of U.S. infrastructure as early as 2016. The SPP allows the United States to gain insights from allies to help grow collective cyber defensive capabilities. The mechanisms to improve the Baltic region’s cyber vulnerability are already in place among NATO member states, ready to be used.