With an eye on Russia, Estonia seeks security in cloud computing

Concerned about its assertive neighbor Russia, Estonia plans to upload much of its government data to computing clouds to guard against security threats, enabling the Baltic state to be run from abroad if necessary. Estonia is one of the world’s most wired countries with 95 percent of government services online. You can vote, register births and cars, sign official documents and set up businesses online, often in a matter of minutes. But online progress brings risks. Estonia, a country of 1.3 million people, wants to ensure what it calls “digital continuity” - mainly in the face of cyber attacks, especially from Russia. The government aims to finish the first phase of the data migration in 2016. [caption id=“attachment_2535720” align=“alignleft” width=“380”]  Estonia’s government chief information officer Taavi Kotka holds cards to promote e-residency in Tallinn, Estonia, December 2, 2015. REUTERS/Ints Kalnins[/caption] The Baltic states of Estonia, Lithuania and Latvia have been especially concerned about Russia since it seized Crimea from Ukraine last year. Memories of Soviet rule, which ended just over two decades ago, remain fresh among politicians and voters in the three countries. In what officials say was a wake-up call, Estonia was hit by cyber attacks on private and government Internet sites in 2007 which peaked after a decision to move a Soviet-era statue from a square in the capital, Tallinn, provoked street protests by Russian nationals and a diplomatic spat with Moscow. State websites were brought to a crawl and an online banking site was closed. Estonia at first blamed Russia for the attack, but the Kremlin denied involvement. “We learnt a lot from the cyber attacks,” Estonian Prime Minister Taavi Roivas told Reuters in Tallinn. “We were already able to defend ourselves in 2007, but now we are so much more ready because of learning from those attacks.” “One of the things we have to look at is if any of our information systems are physically vulnerable,” Roivas added. “All possible threats have to be looked into. Having some state registers in the cloud, in clusters, in different locations make them less vulnerable.” “A country in the cloud” The broad plan is two-fold: cloud technology to back up data from cyber attacks or natural or human-made disasters and possible off-site servers in Estonian embassies abroad. Every Estonian resident has a digital number that allows access to government services and e-payments. While other European countries, including Germany, have balked at adopting such an idea, in Estonia there is little controversy over citizens having digital “fingerprints”. “Basically, we like to say that everything below from Denmark is the stone age,” said Taavi Kotka, the government’s chief information officer. As he talked, he showed an app on his mobile telephone that keeps daily track of his child’s school attendances and homework. In the private cloud servers, the government envisages guarding against cyber attacks on digital monuments – websites such as the presidential one which do not hold crucial data but which, if attacked successfully, would mark a symbolic victory for hackers. Secondly, government data and services would uploaded into a cloud. By 2016, open data including the land ownership registries and the state gazette of laws are planned to be backed up in commercially available clouds from the likes of Amazon and Microsoft. Estonia does not keep paper copies of laws and legal acts are valid only after the gazette publishes them online. But officials are still reluctant to back up sensitive personal information such as medical records on cloud technology run by private companies. Classified police and military files may also never be uploaded. “The issue is data integrity,” Kotka said. “I can’t see medical data going to the cloud for example”. Last year, the government successfully experimented with backing up the Estonian president’s website and the electronic State Gazette on a Microsoft cloud computing platform. The technical hurdles are not huge. The real estate register has no photos or videos, so the text files in this first phase of uploading will need relatively little storage - somewhere between 20 and 40 terabytes. The plan that allows for government services to be run from servers based in Estonian embassies abroad in case of disasters or attacks will take longer to implement. There are legal uncertainties and technical issues. But the ambition is there. “It might end up in a situation where we have a country in the cloud,” Kotka said Reuters