terena logo
10 May 2007
TF-CSIRT to Estonia’s Rescue

A prolonged and large-scale denial of service attack on Estonia’s websites continues to be fended off thanks to the support of Computer Security Incident Response Teams (CSIRTs) based in various countries. The attacks have been perpetrated as part of wider civil unrest after Estonia relocated a statue of a Soviet Russian soldier at the end of April.

The CSIRTs have been helping to defend Estonia’s public and government websites since Thursday, 3 May, when Hillar Aarelaid of the Estonian incident response team CERT-EE joined the delegates at the TERENA Task Force meeting TF-CSIRT in Prague.

Mr Aarelaid made an impassioned plea to the gathered security experts after explaining that the attacks were crippling his country's Internet activities. In response, the Task Force chairman, Gorazd Božič of ARNES (Slovenia), sent out a request for assistance to TI Accredited Teams and FIRST Teams, and within 24 hours the situation was immensely improved.

However, during a telephone conversation with TERENA staff on Thursday this week, Mr Aarelaid said that since Tuesday May 8th the attacks had escalated again, with a wider range of websites and services now coming under increasing fire.

"If you have lost government sites, newspaper sites, bank sites and so on, it's quite awful," he said.

Sounding remarkably cheerful despite the situation, Mr Aarelaid expressed enthusiastic thanks to TERENA and to his CSIRT colleagues around the world. "They're all still helping," he explained. "I really appreciate every single team that has been working with us".

Mr Aarelaid first came into contact with the CSIRT community when he participated in a TERENA run TRANSITS training course in Lithuania in March 2006.


BBC report: Russia accused of 'attack on EU'
Neowin.net report : Estonia holds suspect over cyber-attacks
The Register report: Estonian/Russian statue riots spill online

Please see the TERENA web pages for more information about TRANSITS and TF-CSIRT.