PROSPECTS OF REGIONALIZATION OF SECURITY IN THE CYBERSPACE: CASE OF THE BALTIC STATES

Māris Andžāns
Rīga Stradiņš University, Latvia

Introduction

Information technologies are embedding in increasing number of spheres of everyday life of modern states and their societies and there are no signs that this trend could retreat. With the increasing use of information technologies by public administrations, private companies and individuals not only they can become more effective and utilize new opportunities but also they increasingly become subjects to different threats in the cyber space. Threats may arise from technical incidents, natural disasters, intentional or unintentional actions of humans, threats may vary from theft or abuse to espionage and cyber wars, sources of threats to entire states may vary from individuals to state sponsored groups or other states, targets may be chosen randomly or they may be chosen intentionally, etc.

Aim of this article is to investigate regionalization of security in the cyber space by using case of the three Baltic States – Estonia, Latvia and Lithuania – as an example. The Baltic States have been generally considered to form a distinct region (group of states) characterized by similar situation in different fields and closer interstate relations in many fields, including security landscape and military cooperation. Do the Baltic States share also common cyber threats and common vision of cyber security? Do the Baltic States form a kind of a regional cyber security complex? What are the prospects of the regionalization of security in the cyber space?

This article has been elaborated using qualitative research methods, and it is based on different sources, including literature, statistical data, official documents, statements. To answer the questions stated above, the article proceeds with a brief review of theoretical aspects of regionalization of security and the concept of security, which is followed by characterization of dependence on use of information technologies of the Baltic States and by their current cyber threats (this article focuses on state sourced threats against other states) and their vision of cyber security.

1. Theoretical Aspects of Regionalization of Security and the Concept of Security

Security in international relations can be analysed at different levels. The regional level is probably the most appropriate level to analyse actors whose impact does not spread to the global level and issues which are region specific. The regional level also allows closer analysis of particular issues, including threats – as threats often are region specific and, in general, in the physical space they usually overcome smaller geographical distances easier and faster. Accordingly, also nowadays conflicts between and among states can be observed at the regional level.

In the international relations theory regions usually are understood as parts of the international system – as subsystems – that are bounded by geography and other common patterns according to the specific context, for example, political integration, cooperation among states, language, religion, history, etc. Probably the best known theoretical approach of analysis of security at the regional level is regional security complex theory. Theory, originally developed by Buzan, offers a framework for analysis of security at the regional level. Initially, “classical” security complex theory defined security complex as “a group of states whose primary security concerns link together sufficiently closely that their national securities cannot realistically be considered apart from one another” (Buzan, 1983, p. 106) (the “classical” definition later stated also as “a set of states whose major security perceptions and concerns are so interlinked that their national security problems cannot reasonably be analyzed or resolved apart from one another” (Buzan et al., 1998, p. 12)). Initially, to trace complexes, historically developed “complex patterns of alignment and enmity” and links that tie together complexes – geographical, political, strategic, historical, economic, cultural (Buzan 1983, pp. 105, 106) – were underlined; later, patterns of amity and enmity, also interdependence among states were underlined, and, in addition, role of other factors like cultural and racial ties (patterns) and economic factors was highlighted (Buzan, 1991, pp. 190, 193, 196, 197, 202). At this point this theory mainly concentrated on states as actors and political and military security.

Later, the theory was reformulated to include wider understanding of security and actors, and another concept of the so called “Copenhagen School” – “securitization”– was included. In general terms, according to the initial conceptualization of securitization, an issue becomes a security issue because with an act of speech something is presented as existentially threatened and, accordingly, it is moved outside the borders of normal politics (Buzan et al., 1998, pp. 23–26). The reformulated definition defines security complex as “a set of units whose major processes of securitization, desecuritization, or both are so interlinked that their security problems cannot reasonably be analyzed or resolved apart from one another” (Buzan et al., 1998, p. 201). Most of the links and binding factors mentioned above were not excluded.

According to most of analyses of the Baltic States under regional security complex theory, Estonia, Latvia and Lithuania have been considered as an interlinked security region (as a sub-region or a sub-complex of a regional security complex) with Russia and related issues as primary security concerns. Authoritative researchers in this field – Buzan and Wæver – in 2003 considered that the Baltic States form a sub-region of the “post-Soviet” regional security complex (Buzan and Wæver, 2003, pp. 350, 397, 415, 430), later – in 2009, Buzan and Hansen have mentioned the Baltic States as a part of the “EU-Europe” (Buzan and Hansen, 2009, p. 180). Most of analyses of the Baltic States under regional security complex theory have included review of them in different security interactions (multiple security sectors).

Regional security complex theory has been developed in different directions. One of the directions has been analysis of homogeneous complexes (also called as sector-specific complexes as they offer analysis of isolated “sector-specific security dynamics” (Buzan et.al. 1998, p. 17)), for example, arguing of existence of regional energy security complexes or hydropolitical security complexes. According to the latter, hydropolitical security complex can be defined as “including those states that are geographically part “owners” and technically “users” of the rivers and further, as a consequence, consider the rivers as a major national security issue” (Schulz 1995, p. 97), but according to the former – regional energy security complexes are “formed by energy related interaction between two or more states in a limited geographical area, which includes an energy dependency relationship between the states involved and perception of this dependency as a threat (securitization)” (Palonkorpi draft (quoted with permission of the author), p. 3). These examples of sector-specific regional security complexes underline the paramount link with the concept of security. Although being seemingly straightforward, also this concept has been understood differently. Historically, security in interstate relations has been mainly associated with military threats and, accordingly, it has been mainly understood as military security. Under the “widened security agenda”, for example, Buzan et al. have analysed security not only in the military, but also in the political, the economic, the environmental and the societal security sectors (important to note, however, that sectors are seen as a “purely analytical device” (Buzan et al. 1998, p. 168)).

However, the aforementioned sectors of security and accordingly types of regional security complexes are not the only the ones possible. According to Albert and Buzan, number and types of sectors depend on existing discourses of security and, for example, discussions about possibility of differentiating law from the political sector, gender and religion from the societal sector, financial from the economic sector are mentioned (Albert and Buzan, 2011, pp. 415, 413, 414, 420). One of options would be to consider cyber threats as an expression (as a new instrument) of different other intentions, thus seeing cyber threats as a part of different security sectors, for example, cyber conflicts as a part of military conflicts could be considered as an issue of the military sector (Andžāns, 2012, pp. 72, 77). However, with the growing importance of threats in the cyber space and as they have become one of the most widely discussed at the international level (usually referred to as one of the “new threats”), the cyber sector could be viewed also as a distinct security sector and also regional cyber security complexes could be defined and identified in empiric analyses.

2. Dependence on Use of Information Technologies of the Baltic States

For an issue to become a major security issue on national level, it has to be existential at least in some aspect. As states and societies vary, also their vulnerabilities and security concerns vary. According to different indexes and reviews (for example, by Net Index, Pando Networks, Akamai Technologies), at least one of the Baltic States usually ranks among the top countries in the world as having the highest download and/or upload speed of the Internet. However, speed of the Internet serves only as one of the characteristics of the significance of information technologies and their supported services in the Baltic States.

Estonia, sometimes also called as “E-stonia”, has been generally considered as the most developed of the Baltic States in regards of use and availability of online services. This can be confirmed also with statistics as 75% of households in Estonia have an internet connection at home (Statistics Estonia, 2012a), 78.4 % of inhabitants (16–74 years of age) can be considered as users of the Internet (Statistics Estonia, 2012b), for 87.4% of the Internet users purpose is internet banking (99.6% of the banking transactions are done electronically (Estonian Information System’s Authority, 2012)), for 90.8% – reading or downloading online newspapers/magazines and for 89.6 % – sending/receiving e-mails (Statistics Estonia, 2012c). Among the various available electronic services, it has to be underlined, that elections of local governments, the European Parliament and the national Parliament (Riigikogu) have been carried out also via the Internet, the latest census was available online and different services of public and private sectors are available online.

Situation in Latvia is similar as 68.7% of households have access to the Internet (Central Statistical Bureau of Latvia, 2012a), 70.3 % of inhabitants (16–74 years of age) use the Internet on regular basis (at least once a week) (Central Statistical Bureau of Latvia, 2012b), for 64.5% of the Internet users purpose is use of internet banks (more than 90 % of transactions of the major banks of Latvia are done electronically (Latvian Internet Association, 2011, p. 14)), for 88 % – reading online or downloading news, newspapers and magazines, for 86.4% – sending or receiving e-mails (Central Statistical Bureau of Latvia, 2012c). Although elections have not yet been carried out online, in 2011 census was available also online and different services of public and private sectors are available online (it can be estimated that approximately one fourth of services of the public administration are available also online (Latvian Ministry of Environmental Protection and Regional Development 2012, p. 60)).

Although, according to official statistics Lithuania can be considered as less dependent on the use of online services, still 55.2% of households in Lithuania have access to the Internet at home (Statistics Lithuania (Lithuanian Department of Statistics), 2012a), 67.2% of inhabitants (16–74 years of age) have used the Internet in the last three months (Statistics Lithuania (Lithuanian Department of Statistics), 2012b), for 43.7% of the Internet users purpose is internet banking, for 62.1% – reading/downloading online news, newspapers, magazines, for 54.4% – sending/receiving e-mails (Statistics Lithuania (Lithuanian Department of Statistics), 2012c). As in Estonia and Latvia, also in Lithuania the latest census was available online and different services of public and private sectors are available online.

From the statistics above it can be concluded that the Baltic States, although at different levels, are highly dependent on availability of the Internet and services provided online. Also, there is little doubt that public administrations are highly dependent on use of information technologies: public-use and internal-use electronic databases; wide range of public online services; internal, inter-institutional, international communication, communication with society (including growing use of digital signatures to sign documents) is increasingly done by using different methods of electronic communications. And although it is harder to measure dependence of essential sectors of economics like transportation, energy, banking on information technologies, it is generally considered that such sectors become increasingly supported and dependent on information technologies. This is confirmed also by official statements, for example, the National Security Concept of Latvia states that “the public administration, society and economics depend on the services provided and supported by information technologies” (Parliament of Latvia (Saeima), 2011) and the National Security Concept of Estonia underlines that “the importance of information and communication systems within society is ever increasing, with the resilience of several other critical services depending on them” (Parliament of Estonia (Riigikogu), 2010, p. 8).

In a state of dependence on information technologies, security can be essential factor not only for availability of the services provided by them but also for trust in use of information technologies, furthermore, as use of information technologies is generally considered as a prerequisite for development and growth of innovative states and societies. Thus, realisation of major cyber threats can have severe effects on everyday life in the Baltic States.

3. Cyber Threats to the Baltic States

As in the physical space, also in the cyber space a variety of threats exist. As outlined in the introduction, threats may arise from technical incidents, natural disasters, intentional or unintentional actions of humans, threats may vary from theft or abuse to espionage and cyber wars, sources of threats to entire states may vary from individuals to state sponsored groups or other states, targets may be chosen randomly or they may be chosen intentionally, etc. This article concentrates on those threats that could be state oriented and their source could be another state. From the recent history, such examples can be identified in the Baltic States.

Estonia has been widely known for “the first-ever co-ordinated cyber attack against an entire country” (Government of Estonia, 2008, p. 6) that followed the displacement of the so called “bronze soldier” in the capital city Tallinn in the spring of 2007. With unrest in the physical space that included street riots and demonstrations and official protests from Russia, also unrest in the cyber space started – attacks against resources of the public administration, private companies (including banks, media, telecommunications companies) and other resources caused limited availability or no availability of substantial online services. At a smaller scale and lower significance compared to the attacks against Estonia, also Lithuania suffered from politically motivated cyber attacks in the summer of 2008 following the ban to use symbols of the Soviet Union and the Nazis in public events. These attacks included also defacement of approximately 300 web pages, replacing their original content with symbols of the Soviet Union and slogans against Lithuania in the Russian language. Due to specifics of information technologies complete tracing of sources of organizers of these attacks was not possible, however, in both cases there were links with Russia – including that cyber attacks were a part of broader conflicts with Russia (with official protests from Russia expressed during them) and clear signs of involvement of Russian speakers in the attacks. Irrespective of the organizers of these attacks, it is clear that cyber attacks become a part of interstate conflicts in which Russia is involved, and such a risk has to be taken into account by countries that have potential for conflicts with Russia (Andžāns, 2012, pp. 72, 74–77).

In the recent years the Baltic States have devoted significant attention to cyber security, with special emphasis also on probable interstate conflicts in the cyber space. According to official documents of Estonia, “the use of cyberspace by terrorist organisations, organised criminals and state-sponsored actors already poses a serious global security threat”, the cyber space can be used “to prevent the state from functioning and also for propaganda purposes” (Government of Estonia, 2008, pp. 10, 21), coordinated cyber attacks “may cause significant damage to society” and the “cyberspace may be used for inciting tension and conflicts within the society” (Parliament of Estonia (Riigikogu), 2010, pp. 6, 8). In order to improve its readiness to respond to threats in the cyber space, Estonia has executed numerous activities and some of them have underlined linkage with probable interstate conflicts in the cyber space. Probably the best internationally known activities have been establishment of the Cyber Unit of the Estonian Defence League (a part of the Estonian Defence Forces) which is “a voluntary organisation aimed at protecting Estonian cyberspace” (Estonian Defence League, 2012) and establishment of the Cooperative Cyber Defence Centre of Excellence of the North Atlantic Treaty Organization (NATO CCD COE) in Tallinn.

Although Latvia so far has not encountered major publicly known incidents in the cyber space that could be considered as sourced from another state, according to official documents, such attacks cannot be ruled out in the future. The National Security Concept underlines, that by using information technologies it is possible “to impede operation of political, economic, military decision making mechanisms of a state, misinform society and cause techno-genic accidents” (Parliament of Latvia (Saeima), 2011). More recently it has been pointed to the already existing link between “politically, societally and economically sensitive events” and the increased number of “politically motivated attacks […] both from the territory of Latvia and from other states”, and also prospective “large scale electronic attacks” against Latvia are not ruled out (Government of Latvia forthcoming, 5, 3). Furthermore, the State Defence Concept of Latvia forsees that in the future a prospective adversary will be able to act not only in the physical space but also in the cyber space (Parliament of Latvia (Saeima), 2012).

Through its official documents also Lithuania devotes considerable attention to threats in the cyber space. Similarly to Estonia and Latvia, Lithuania sees that the cyberspace and public electronic services “have become an attractive target for individuals, criminal groups, political forces and other subjects” (Government of Lithuania, 2011, p. 1). Although, less known internationally, also Lithuania and Latvia have implemented certain practical measures to enhance their preparedness to respond to cyber threats. In future, demonstrating practical linkage with the national security, Lithuania, for example, plans to ensure protection of its “virtual cyber perimeter from external cyber attacks” (Government of Lithuania, 2011, p. 5) and to “develop military capabilities for responding” to cyber security challenges (Parliament of Lithuania (Seimas), 2012), but Latvia, among other activities, plans to “enhance cyber defence capabilities of the National Armed Forces” (Government of Latvia, forthcoming, p. 8).

Looking at the three Baltic States as a distinct regional formation in the cyber space, it is important to note also cooperation among them. All three Baltic States were among the founding nations of the NATO CCDCOE in Tallinn. And since 2009 also regular specialized trilateral meetings aimed at coordination of policies of security of information technologies have been organized – among the topics of these meetings have been exchange of information on the latest developments and incidents, consultations and coordination of national positions towards the outstanding issues in the European Union (EU), the NATO, the Organization for Security and Co-operation in Europe (OSCE), the United Nations (UN), drafting of a trilateral memorandum of understanding on cooperation in security of information technologies (CERT.LV, 2012a; 2012b).

According to the National Security Concept of Latvia, cooperation with Estonia and Lithuania is listed among priorities of Latvia in reducing threats to information technologies (Parliament of Latvia (Saeima), 2011) and it is reconfirmed by the draft Strategy of Security of Information Technologies of Latvia which aims to “strengthen interoperability and relations with Lithuania and Estonia” (Government of Latvia forthcoming, p. 9). With the increased frequency of the trilateral meetings (CERT.LV, 2012b) and the expected memorandum of understanding, probably the cooperation among Estonia, Latvia and Lithuania will become even closer.

Conclusions

The Baltic States have been generally considered to form a distinct region (group of states) characterized by a similar situation in different fields and closer interstate relations in many fields, including security landscape and military cooperation, and according to regional security complex theory they have been mostly analysed as a sub-region or a sub-complex of a regional security complex (according to authoritative researchers, initially as a part of the “post-Soviet” regional security complex, later seen as a part of the “EU-Europe”). These analyses have included review of the Baltic States in different security interactions (multiple security sectors).

However, also sector-specific security analyses of regional security complexes have been developed, thus identifying regional patterns of certain security issues. Accordingly, also regionalization of cyber threats may offer a field for analysis, in particular, because states and societies vary and so do their vulnerabilities and security concerns – for some states, whose dependence on use of information technologies is low, cyber threats may be of low importance, but for highly dependent states they may be of much higher importance. More than two thirds of households in Estonia and Latvia have access to the Internet, more than two thirds of adults in all three Baltic States can be considered as users of the Internet and bulk of them use the Internet for banking services, acquiring information, sending and receiving e-mails, etc. In all of the three states different services of public and private sectors are available online, with Estonia having held also elections of local governments, the European Parliament and the national Parliament online. Also, public administrations and essential sectors of economics are highly dependent on use of information technologies. Accordingly, there is little doubt that the Baltic States and their societies are highly dependent on information technologies. In a state of dependence on information technologies, security can be essential factor not only for availability of essential services supported and provided by them but also for trust in use of technologies, furthermore, as use of information technologies is generally considered as a prerequisite for development and growth of innovative states and societies. Thus, realisation of major cyber threats can have severe effects on everyday life in the Baltic States.

As this article concentrated on those cyber threats that could be state oriented and their source could be another state, two incidents were underlined – coordinated cyber attacks against Estonia that followed the displacement of the so called “bronze soldier” in Tallinn in the spring of 2007 and an incident of smaller scale and lower significance – politically motivated cyber attacks against Lithuania following the ban to use in public events symbols of the Soviet Union and the Nazis in the summer of 2008. Even with unclear links with Russia in both incidents, it is clear that cyber attacks become a part of interstate conflicts in which Russia is involved and such a risk has to be taken into account by countries that have potential for conflicts with Russia (Andžāns, 2012, pp. 72, 77). Also Latvia has not only observed links between sensitive events and increased number of politically motivated attacks from other states but prospectively also large scale electronic attacks against it are not ruled out (Government of Latvia, forthcoming, p. 3).

With globally growing importance of cyber security, in the recent years the Baltic States have devoted significant attention to cyber security, including particular attention to probable interstate conflicts in the cyber space. All three of them have executed numerous activities for improving their readiness and response capabilities and as a part of those activities they already have advanced or plan to advance cyber capabilities of their military authorities. In addition to their generally similar approaches to cyber security, the Baltic States have developed and intensify their trilateral cooperation aimed at coordination of their activities.

Even though, nowadays in many ways significance of distance and borders is of less importance, typical interstate threats can change their form to cyber threats and, for example, effective blockade of a state can be executed not only physically but also in the cyber space (for example, by limiting or preventing flow of information to/from a state (not only information for the international society but also other kinds of information, like communication among agencies of public administration, communication with society, financial transactions, etc.)). The cyber space opens new opportunities also to originators of threats as they can use new forms of expression (instruments) of threats. Thus, cyber threats can be viewed as new forms of expression (instruments) of threats that previously have been executed through the physical space and at the same time they can also be seen as a separate realm. Accordingly, the cyber sector can be viewed also as a distinct security sector and regional cyber security complexes (sector-specific complexes) can be defined and identified in empiric analyses. Such complexes may form where distinct regional security interactions (including mutual or unilateral fears and suspicions, anticipated or realised threats, conflicts, etc.) are clearly visible in the cyber space and they stand out among other regions. In general, their formation may not differ from other types of sector-specific complexes or multiple security sector complexes. They may and may not align with regional security complexes in the physical space. And with the growing dependence on use of information technologies, more regional cyber security complexes may form, having also different security dynamics from physical complexes.

Basing on the review of the Baltic States, it can be concluded that, in general, they share high dependence on use of information technologies, similar cyber threat landscape which includes probability of state sourced attacks and they also share similar policies towards cyber threats which, furthermore, are coordinated at a certain extent. Thus, it can be argued that the Baltic States form a separate regional cyber security formation which could be considered as a sub-region or a sub-complex of a wider regional cyber security complex, probably centred on Russia (subject to further research). With the growing dependence on use of information technologies, more regional cyber security complexes may form having different security dynamics from physical complexes.

Bibliography