The Evolution of Russian Hybrid Warfare: Estonia

January 29, 2021

“The Kremlin’s efforts against Estonia are focused primarily on the country’s less-integrated Russian speakers and Estonia’s highly digitalized society.”

Russia’s Non-Conventional Hybrid Warfare Against Estonia

Russia’s use of hybrid war against Estonia has evolved in recent months and years, not least because these efforts differ from other theaters of operation, but because Estonia is a member of NATO and the European Union. Unlike in Ukraine, using force against Estonia would mean conflict between Russia and NATO. So the Kremlin would naturally wish to keep its moves against Estonia and other Baltic states under the threshold of NATO’s Article V, unless Russia were already in open and direct military conflict with NATO or the United States elsewhere.

Estonia is not a weak state that Russia can relatively easily destabilize and manipulate. It is governed by the rule of law, the level of corruption and criminality are low, and it has no relevant pro-Kremlin political parties, politicians, and movements. Nor is it in a gray zone, as it is strongly anchored in the Western community and institutions. Again unlike some other countries in the neighborhood, Estonia’s economy, including its energy industry, does not depend on Russia. The electric power grids of the Baltic states are in the process of separating from the Russian and Belarusian system,¹ and although Russia is Estonia’s main supplier of natural gas, that is not unusual in the European Union.²

Besides, Europe’s gas supply will diversify, and since Estonia pays the market price for its deliveries, Russia has little incentive to use one of its preferred methods, such as cutting off gas flows, to punish a lucrative customer. Russia tried only once to punish Estonia by switching off the gas in the early 1990s, but it realized quickly that the first to suffer were Russian-speaking people and households in North-East Estonia – exactly those the Kremlin arguably defended.

All of which means that Russia uses considerably different weapons in its hybrid war against Estonia than against Ukraine or Belarus. The Kremlin’s efforts against Estonia are focused primarily on the country’s less-integrated Russian speakers and Estonia’s highly digitalized society. Russia backs these up with a steady military buildup and show of force in its Western Military District, which includes the Kaliningrad exclave to the west and borders Estonia to the east. Other tactics, such as massive money laundering through Nordic banks based in Estonia, are part of a much wider Russian pattern of using the West’s weaknesses to its own advantage.³ Massive flows of Russian money to European and off-shore banks – most of which are likely laundered considering the obscurity of the schemes and actors – serve not only the purpose of fulfilling the financial and personal interests of Russia’s leaders and oligarchs, but also of feeding corruption and manipulating Western countries.⁴

Russia’s non-conventional actions against Estonia have a long history, stretching back at least as far as a failed coup d’état attempt in Tallinn organized by the Soviet Union on December 1, 1924. Fifteen years later, the Soviet occupation and annexation of the Baltic countries in 1939-1940 finds echoes in Russia’s seizure of Crimea in 2014.

The restoration of Estonia’s independence in August 1991 began a new battle in the Kremlin’s hybrid warfare against the country. Despite then-Russian President Boris Yeltsin’s generally democratic sympathies, Russia tried mightily to thwart the Baltics’ natural ambition to reunite with Europe and the trans-Atlantic community. The Kremlin repeatedly and falsely accused Estonia, since the early 1990s, on totally false grounds, of ethnic cleansing, “apartheid in white gloves” and the glorification of fascism.⁵

It became obvious in the 1990s that Russia was determined to discredit Estonia and attempted to prevent it from joining the EU and NATO, most notably by refusing to sign and enforce a border treaty negotiated and agreed by November 1996. Moscow also attempted to exploit friction between the country’s titular ethnic group and its non-Estonian, mainly Russian-speaking, minorities and to use political, economic and military leverage to that end. Although the Kremlin did not manage to keep Estonia and the other Baltic states in its orbit, Vladimir Putin’s rise and the consolidation of his autocratic rule signaled that relations between Russia and the West would sour and the hybrid warfare would not only continue, but would intensify.

Estonia is clearly an attractive target, even if not strategically important, for hybrid attacks as it is home to a community of Russian speakers, most of whom settled there during the Soviet years. However, the Russian speaking community is not homogeneous in terms of integration in Estonian society. Only a minority is made up of Russian-speakers who are not Estonian citizens and those who do not speak Estonian and are poorly integrated in the society. This in turn decreases Russia’s ability to influence the entire community.

Furthermore, the countries’ official histories of Estonia’s incorporation into the Soviet Union are still irreconcilably opposed. Moscow’s hybrid attacks on Estonia and the other Baltic countries are also meant to show that these countries are liabilities to NATO and the European Union.

1. The Military Factor

Russia’s aspirations to great-power status and “special rights” in its backyard rely primarily on its military might rather than the promise of prosperity, given that its economy is smaller, less dynamic, and less diversified than those of the United States, Europe, or China. That matters especially in the Nordic-Baltic region, where all of Russia’s neighbors are members of NATO and/or the EU, and are economically more advanced.

While Russia is bulking up its military muscle on all fronts, its Western Military District has once again become, as in the Cold War, a clear priority. Russia’s Kaliningrad exclave is increasingly militarized, including weapons of blackmail such as Iskander missile systems and likely tactical nuclear weapons, meant to put its unfriendly neighbors on notice. The Baltic states are virtually doubly covered by Russian A2/AD (Anti-Access and Area Denial) protective domes from Kaliningrad, as well as the Leningrad and Pskov oblasts. The Russian navy (Baltic fleet) and air force are very active in or above the Baltic Sea, often violating the maritime boundaries and air space of other countries, including Estonia, and bedeviling ships and aircraft of NATO countries.

Russia has recently conducted large snap exercises to gauge its combat readiness close to NATO territory. It also holds regular strategic-level exercises in its western reaches, including some with Belarus. The next large exercise will be Zapad 2021, probably in September.

As opposition protests continue in Belarus, formally an ally of Russia, President Aliaksandr Lukashenka may soon have no choice but to submit to certain demands from the Kremlin in order to maintain his grip on power, even including deployment of Russian forces to and use of air bases in Belarus. That would set alarm bells ringing for NATO and the Baltics, because the roughly 65-mile (105-kilometer) distance from southeastern Kaliningrad to northwestern Belarus happens to be the Lithuanian-Polish border across the Suwalki Gap.

With Russian troops at both ends, they would need only to cover a small stretch to meet in the middle and cut the Baltics off from their NATO and EU neighbors. Far from de-escalating, the Kremlin considers such military threats an effective political and psychological weapon against the West. The logic of a possible Russian aggression against the Baltic states is not necessarily, if at all, linked to them or the security situation in the Baltic and Nordic regions. It is about Russia willing to weaken and undermine NATO, and eventually use the opportunity to attack the weakest point in the Alliance’s posture.

2. Lessons From the Events of 2007

The history is a major subject of discord between Russia and Estonia. Estonia restored its independence in August 1991 under the principle of legal continuity with the prewar Republic of Estonia, which had been occupied and annexed by the Soviet Union in 1939-1940. Russia, however, still maintains that Estonia voluntarily joined the USSR.

That conflict, along with Russia’s willingness to sow strife among Estonia’s ethnic and linguistic groups, helps explain the Estonian government’s decision in 2007 to move a “liberator” statue of a Red Army soldier from the city center of Tallinn to a nearby cemetery. It also helps explain the protests, riots, and Russian cyberattacks that followed the decision.

The events of the spring of 2007 revealed some truths about Estonian society, including that its Russian speakers were far from integrated into society, that official Russian propaganda could influence Estonia’s Russian minority, and that Russia would not hesitate to meddle in Estonia’s internal affairs given a chance.

Recent analyses, including by the International Centre for Defence and Security (ICDS) think tank in Tallinn, conclude that Russia prepared well in advance of the events, as the statue’s removal was debated publicly for some time, and Moscow’s moves were not at all spontaneous. Putin gave clear indications in his annual address to Russia’s Federal Assembly in May 2006 (the course to militarization), and particularly in his speech at the Munich Security Conference in February 2007.⁶

Russia’s likely first goal was to amplify the riots in Tallinn and provoke interethnic bloodshed, but the riots stopped after two nights of vandalism in the city center. Some smaller protests formed in other towns but were quickly dispersed. Russia did not achieve anything, considering that it likely expected international condemnation against Estonia.⁷ A young Russian man was killed in the first night of riots, and although the police identified suspects in his beating, they never charged anyone in his stabbing death.⁸ The Kremlin tried to use his death for its own purposes and to treat him like a martyr to Russophobia, to no real avail.

Potentially more damaging than the riots were Russian cyberattacks on Estonian state institutions, political parties, banks, and other organizations. The most important aspect of the April 2007 events were Russia’s cyberattacks, as the Kremlin tried desperately to punish Estonia and put it on its knees. Hackers with the skills, coordination, and resources that suggested a state-sponsored campaign launched DDoS and defacement attacks over several weeks. Russian hackers, undoubtedly supported directly by the Russian state, considering the resources and coordination necessary for such massive cyberattacks, targeted web pages, and services of Estonian state institutions, political parties, commercial banks, and other entities (defacing and/or saturation/DDoS attacks).

Russia did not achieve, once again, its desired goals, in spite of prolonged cyberattacks during several weeks.⁹

The result was shows of support from Estonia’s allies and the international community while Russia refused to cooperate in the investigation and denied vehemently any state-level involvement. This practice of ‘plausible deniability’ is by now very well established – Russia continues to deny its direct role in e.g. the Ukrainian Donbas.

The Russian government pretended that it retaliated against Estonia by severely cutting the oil and other goods it sent through Estonian ports, mainly Muuga and Tallinn, ostensibly in retaliation for moving the soldier memorial. Later, it became clear that the redirection of much of Russia’s maritime exports to the Russian ports of Ust-Luga and Primorsk, in the Gulf of Finland, was related not to the “Bronze Soldier” but to the business interests of members of President Putin’s inner circle.¹⁰

The spring 2007 cyberattacks were a kind of turning point. Russia showed that it was willing and able to wage hybrid warfare, while Estonia became the first country to mount a successful cyber defense despite facing a massive, surprise attack and lacking much experience in the field. Estonia soon became home to NATO’s Cooperative Cyber Defence Centre of Excellence (CCD CoE), which had been planned before the 2007 attacks but gained some urgency because of them.

Those attacks were also the center’s first subject of analysis and research, and they provided lessons in strengthening cyber defenses. Apart from helping to prepare allied countries to counter even large, complex cyberattacks (in terms of offering know-how and training opportunities, including large and complex cyber exercises), the CoE also developed guidelines for applying international law in cases of cyberattack, which became known as the Tallinn Manual.¹¹

In response, Estonia also strengthened its own national cyber defense and security capabilities, including the Information System Authority that was created in 2011 on the basis of efforts made since 2007. It entails strengthened coordination between ministries and state agencies through the Government’s Office/Chancellery as well as provides substantially more resources for cyber security and defense and increased cooperation with the private sector). The country’s volunteer Defence League formed a cyber unit to support government agencies and civilian organizations during cyberattacks and to raise general awareness about cyber security. The unit includes IT specialists, mostly from the private sector, who stand ready to mobilize quickly in support of civilian and military structures.¹²

Estonia, its allies, and Russia learned certain lessons from the events in April and May 2007. NATO and EU countries, particularly Estonia, took cyber defense more seriously. It became a top priority for civilian and military organizations. On the other hand, Russia probably learned that it is difficult to provoke widespread and violent ethnic conflict in Estonia, even when poking at sensitive issues. The ultimately unsuccessful Russian cyberattacks against Estonia showed that small states that might be vulnerable in conventional defense can punch above their weight in cyber defense.

A protester holds a flag during a picket of Kremlin-loyal youth organisations in front of the Estonian embassy in Moscow May 3, 2007. The poster on the left shows the statue of a Red Army soldier, whose relocation in Tallinn has sparked recent tensions between Russian and its ex-Soviet neighbour. — A protester holds a flag during a picket of Kremlin-loyal youth organizations in front of the Estonian embassy in Moscow May 3, 2007. The poster on the left shows the statue of a Red Army soldier, whose relocation in Tallinn has sparked recent tensions between Russian and its ex-Soviet neighbor. REUTERS/Denis Sinyakov

3. Russian Propaganda and Disinformation in Estonia

Russia’s principal tools of hybrid warfare against Estonia are undoubtedly its state-owned and specialized propaganda and disinformation channels. These include, as in the case of most other Western countries, the RT (formerly Russia Today) TV channel and the Sputnik news agency, news website, and radio broadcast (formerly Voice of Russia and RIA Novosti). These two Kremlin “news” brands, with nearly global reach and budgets that exceed the BBC’s, are Russia’s inverted versions of CNN and Voice of America/Radio Liberty. Just as the Moscow-led Eurasian Economic Union and the Collective Security Treaty Organization pretend to be analogs of and responses to the European Union and NATO.

Estonia has a fairly large non-ethnic Estonian, mainly Russian-speaking minority, who make up about 27% of the population. That, together with its history and its border with Russia, makes Estonia an attractive target especially for other Russian state-owned TV channels, including PBK (Pervyi Baltyiski Kanal – First Baltic Channel), NTV-Mir, RTR-Planeta and RenTV Estonia. PBK is the Baltic version of Russia’s First Channel (Pervyi Kanal) where propaganda ‘stars’ like pro-Kremlin flame-thrower Dmitry Kiselyov and Vladimir Solovyov are almost as visible to Russian-speaking viewers in Estonia as to the Russian domestic public.

The Russian TV channels are usually part of large packages, including channels in Estonian, English and other languages, offered by Estonia’s main internet and TV providers (e.g. Telia, Elisa, STV and others) in cooperation with intermediary companies (like the Latvian registered Baltijas Mediju Alianse and the Estonian Balti Autorite Levi Liit – Broadcast Union of Baltic Authors). In this way, Russian propaganda channels are part of almost every customer’s TV package in Estonia. In 2018, they earned about €6 million from license fees (paid by all customers) and publicity/advertising.¹³

The other Russian channels, such as RTR Planeta and NTV Mir, in addition to the Baltic version of Pervyi Kanal, are influential among the Russian-speaking audience in Estonia. These major Russian networks will probably remain on Estonian cable TV as long as the service providers are not forced to drop them, and no political party in parliament, particularly the Centrists, is willing to discuss specific regulations and restrictions. Internet and cable-TV service providers claim that they are guided only by market economy and preferences of customers. The vast majority of Russian speakers in Estonia wish to watch television in their own language, but ETV+ (see below) cannot compete with Russia’s TV channels in terms of resources and quality of programs.

ETV+

Estonian Public Broadcasting (ERR) launched a Russian-language television channel (ETV+) in September 2015 aimed at the country’s Russian-speaking minority and airing news and entertainment.¹⁴ ETV+ is not intended to compete with entertainment programs on Russian TV, but rather to provide local news that at least theoretically should be of interest to Russian speakers.

The channel’s annual budget of about €5 million, staffing and productions are meager compared with those of the Russian channels. ETV+’s audience has grown during the COVID-19 pandemic to about 5 percent of Russian speakers, but, paradoxically, it is more popular with Estonian-language viewers who want to see how news is presented to the Russian-language public.¹⁵ It remains to be seen whether ETV+ will be able to hold on to its newer Russian-speaking viewers.

RT and PBK

The government of Estonia has so far not followed Latvia and Lithuania in banning RT.¹⁶ Those countries argued that RT is controlled through its parent company, Rossija Segodnya, by Kiselyov, who is on an EU sanctions list. For their unwillingness to act, Estonian officials cite the country’s high ranking on Reporters Without Borders’ World Press Freedom Index, even though RT, with its diet of pro-Kremlin agitprop and misinformation, hardly stands alongside mainstream journalism.¹⁷

Another reason might lie in the country’s politics. Estonia’s Centrist Party holds the offices of prime minister (Jüri Ratas) and Tallinn mayor (Mikhail Kõlvart), and it is probably loath to do anything that would lose it Russian-speaking (or any) voters. In any event, having been kicked out of neighboring countries, it could make sense for RT to tread lightly in Estonia, lest it leave a reluctant Tallinn no choice but to ban it.

Tallinn’s City Council sponsored for many years a marginal channel called Tallinn TV that aired mostly the political platform of the Centrist Party under the guise of local news. The channel, with an annual budget of about €30 million, was ‘restructured’ recently for the official purpose of saving local taxpayers’ money.¹⁸ Undoubtedly also because the Centrist Party came out of the wilderness to lead the government in 2016 and continued as the leading party in a new coalition following parliamentary elections in March 2019.

However, the government of Estonia and Tallinn’s City Council looked for alternatives to continue the transmission of Tallinn TV news in Russian through other channels to Russian speakers. Tallinn’s mayor announced in April 2020 that the city had chosen PBK, although a plurality of Russian-speaking viewers had recently told pollsters they trust the public, Russian-language ETV+ channel more.¹⁹

The Closure of Sputnik’s Office in Estonia

Sputnik’s Tallinn office employed 35 people until it closed at the end of 2019.²⁰ The channel could no longer fund its operations because EU sanctions prevented Estonian banks from doing business with it. Like RT, Sputnik is part of Rossija Segodnya. Estonian banks did not accept operating Sputnik’s accounts any longer, and the Russian propaganda channel could not pay salaries of employees or the rental space anymore.

Estonia’s foreign minister, Urmas Reinsalu, said Sputnik’s fate was down to sanctions and not its content.²¹ The Russian government, however, called Estonia’s action “political harassment” and vowed to retaliate.²² Blogger Erkki Bahovski, a foreign policy expert at the ICDS, wrote that Sputnik’s closure had “generated a little spat between Estonia and Russia as the latter accused Estonia of oppressing the press and violating the freedom of speech.”²³ But Sputnik’s status as “press” is a matter of debate.¹⁰ Sputnik did not air views that dissented from its pro-Kremlin line, that its amateurish reports were anonymous, and that the channel had been exposed as running several Estonian-language Facebook pages under pseudonyms.

There is no direct and clear information about Russia’s threatened retaliation, which most likely would have been the expulsion of Estonian journalists from Russia – but no Estonian journalists have worked in Russia since March 2020. Former correspondents for Estonian Broadcaster ERR and Postimees, a leading newspaper, have had trouble getting necessary visas or accreditations to work in Russia.

Sputnik’s website in Estonia, which continues to operate, is an outlier among Russia’s propaganda outlets in also offering content in the host country’s language. Its popularity among Estonians is, however, questionable at best.

PROPASTOP

In reaction to Russia’s aggression against Ukraine in 2014 and the rising tide of Russian propaganda and disinformation, members of Estonia’s volunteer Defence League launched the Propastop blog aimed at “cleansing Estonia of propaganda, false information and media lies,” and shoring up the security of Estonia’s information space.²⁴

The blog spots and then marshals facts to refute false information about Estonia. In addition to helping the Estonian public better understand the Kremlin’s techniques and motives, Propastop offers a comprehensive list of articles containing Russian propaganda and disinformation. It also appears in Russian, English, and German.

Russia has likely learned that many of Estonia’s less-integrated Russian speakers, as well as some ethnic Estonians, regularly watch Russian state-owned TV channels. The Kremlin’s tactic is probably to seek long-term gradual influence, filling the glass drop by drop instead of all at once and risking a reaction.

Russia’s propaganda and disinformation find little purchase as long as Estonia’s media remain free and its government and citizens are vigilant. The older Estonian population, with the experience of living in the former Soviet Union, well understands Russia’s propaganda and its motives. Russia seeks to sow doubt among Estonians about their government, liberal democracy, and the rule of law. As long as the country’s people maintain some trust in their institutions and one another, that will be a losing battle.

Photo: A woman looks at the screens during the Locked Shields, cyber defence exercise organized by NATO Cooperative Cyber Defence Centre of Exellence (CCDCOE) in Tallinn, Estonia April 10, 2019. Credit: REUTERS/Ints Kalnins — A woman looks at the screens during the Locked Shields, cyber defence exercise organized by NATO Cooperative Cyber Defence Centre of Exellence (CCDCOE) in Tallinn, Estonia April 10, 2019. REUTERS/Ints Kalnins

4. Lessons Learned From Estonia

At the moment, Estonia is not a primary target of Russian hybrid warfare. The Kremlin is preoccupied with other issues, including the continuing protests in Khabarovsk over the arrest of the governor there, the future of Belarus, the conflict in Nagorno-Karabakh, and Russia’s proxy wars with Turkey in Syria and Libya. But the possibility always remains that Moscow could find it useful some time to stir the pot in the Baltics.

Russia can quickly re-train its propaganda and disinformation on Estonia or other Baltic states at any time, and if it did so, that would likely be a harbinger of some aggression against the region. For that reason, the Kremlin’s official statements as well as its broadcasting bear permanent monitoring for signs of change, such as increased bellicosity, over the usual background noise of persistent and “normal” propaganda and disinformation.

And because the threat of military action is an inseparable part of Russia’s hybrid warfare — and the possibility of fruitful dialogue with the Kremlin is remote — Estonia and its allies must continue to strengthen their deterrence and defense. But Russia’s main weapons in its hybrid war against Estonia, as well as other NATO and EU countries, are propaganda and disinformation, as well as the use of cyberspace.

Estonia should take further steps against Russian state-owned channels that do not meet any professional definition of journalism and free media. Preferably, NATO and EU allies and partners could agree on broadcasting standards and steps to limit the spread of Russian propaganda and disinformation in the trans-Atlantic region. This is about defending common values and concerns as well as fighting Russian misuse of social media for politically subversive aims.

Cyber defense is a key aspect of Estonia’s security. Russia has not launched a major cyberattack against Estonia since the events of 2007, but there is no reason to believe it won’t again. Estonia’s approach is to expose and attribute Russia’s malicious activities not only in cyberspace, but also in espionage and other areas. Estonia’s Western allies should follow its example, even at the risk of riling the Kremlin. Other Estonian examples worth following are the volunteer-run Defence League’s cyber unit,¹² created to support state-run cyber defense and security organizations, and Propastop for countering Russian propaganda and disinformation.

The fight against Russian hybrid warfare, including propaganda and disinformation, is inherently asymmetric because Western governments cannot adopt Russia’s behavior and tactics, and the openness of Western democratic societies makes them more hospitable to bad-faith actors and more vulnerable to misinformation than Russia’s controlled information space. Western countries have to help their citizens become more aware of Russia’s aims and hybrid tools, including its subversive propaganda and disinformation.

Finally, Russia’s money laundering and export of corruption undermine Western countries and societies. It makes little sense or impact to counter only Russia’s efforts in cyberspace and the media, or to try to limit European dependence on Russian energy without rooting out Russian money laundering and corruption.

The Evolution of Russian Hybrid Warfare: United Kingdom

By Precious Chatterje-Doody

“Russia’s main strategic priority for the U.K. can be summarized as cultivating an atmosphere conducive to increasing Russia’s influence there — whether in absolute or relative terms.”