How Estonia is ‘stepping up’ digitally for Ukraine

Welcoming tens of thousands of war refugees while steadily donating weapons and ammunition, bulletproof vests, cybersecurity expertise — and much more — Estonia has been staunchly supporting Ukraine since Russia’s invasion in February.

“We also remember when we were the recipient of aid,” Estonia’s National Cyber Director Liisa Past told DefenseScoop in an exclusive interview at the Estonian embassy in Washington, during her trip to D.C. for the White House international ransomware summit last week.

After declaring independence from the Soviet Union in 1991, Estonia took a firm, fully digital approach to providing government services that ultimately helped establish its reputation as one of the world’s tech savviest nations. Now, it is a strategic NATO ally with a strong cyber infrastructure that shares a 183-mile border with Russia.

“The very essential reminder to everyone is that Ukraine isn’t just ‘the recipient’ of anything. It’s so easy to frame that part of the world [that way] … and that’s simply not true. They are a country that’s built an incredible digital ecosystem. Their mobile-first approach to government services is incredible. But that also meant that, combined with trying to move and often moving data overseas during the war, their citizens had access to the government when they didn’t have access to heat and electricity necessarily — as long as they had one of these,” Past said, pointing to her smartphone. 

Stepping up

“I was the Chief Information Security Officer for Homeland Security when the war in Ukraine broke out, so I did not sleep for a few weeks,” Past told DefenseScoop.

She steered “a small but very, very clever team” responsible for providing information security for “well over 100 digital services,” including those that underpin essential emergency, police and border systems, she noted.

At the start of the invasion, Estonians kicked off projects to rapidly scale up their federal technological infrastructure to help Ukrainian refugees.

“We thought, it’s only right that they should be able to use all the digital services that we have,” Past said.

At the start of this year, Estonia was home to less than 1.5 million people. By now, they’ve welcomed around 40,000 refugees displaced in the war — equivalent to about 4% of its own population. To make that happen, Past said the Baltic nation shifted from processing a few hundred applications for international protection per year to “an estimated or expected few thousand a day with a processing time of five minutes.” Government employees worked nonstop, around the clock.

This level of quick scaling was possible partly because of the European Union’s protection directive that automatically provides Ukrainians who escaped due to the war one year of protected status in any nation that’s an EU member. 

“Of course, countries are very different in how they’ve implemented it and how they welcome their refugees. Estonia was very clear that we’re not going to be re-victimizing people who already had a terrible, terrible, terrible [experience]. So a computer that says ‘No, comeback in two weeks’ is not an answer for someone who doesn’t know where to get their next cup of tea from, in some cases,” Past said. 

Ukrainian refugees now in the country have their own identification cards that are somewhat similar to those Estonians use. 

“Then there are the information system authorities,” Past added. 

Colleagues on her current, extended cyber team “also stepped up really quickly,” she said, to strategically respond to the nation’s changing threat landscape through a variety of tools. For example, the government is now providing the top 100 websites in Estonia with extra protection against denial of service and other network attacks.

With preparation and resource allocation, the nation was able to effectively confront DoS attacks targeting transit and transportation systems in waves across Europe in the spring. 

“We weren’t perfect — and there were websites that went down for longer than we would have liked — but at no point was there privacy and integrity of data compromised, or the other business services themselves,” Past said.

“Then — of course — we did work with the Ukrainians on the cybersecurity side,” she added, without going into much detail due to the sensitive nature of information about capabilities being provided as the war carries on. 

Among many other efforts, Estonians have also been leading formal and informal initiatives to donate defensive equipment such as helmets and other protective gear to Ukraine’s military — as well as food, ambulances, vehicles, clothes and other items of necessity to the country’s civilians who’ve opted to stay behind and endure the conflict.

“I have friends who, as private citizens, will fundraise a few thousand Euros, and load up their cars with first aid equipment and drive it across Ukraine,” Past said, noting that some have done that “maybe like five or six times now, because they couldn’t sit on their hands at home and do nothing.” 

A ‘browser native’ nation

At this point, more than 7 million people have been displaced and more than 6,000 civilian casualties have been reported in connection to Russia’s efforts to occupy Ukraine. 

But before the invasion nine months ago, Past had friends living regular lives there — working as academics, think tankers, government officials and business professionals.

These are “people like me,” she said. 

Suddenly, she noted, conversations with those friends and international colleagues went from simple topics like how long it takes Amazon to deliver certain items to Kyiv, “to ‘do you have a place to sleep when there is shelling?’” 

Born and raised in Estonia when it was part of the Soviet Union, the government tech leader remembers accompanying her mother to her job as a journalist for the Soviet Union National TV.  “She was very heavily watched and controlled,” Past recalled.

Then, when the Soviet Union collapsed in the early 1990s, Estonia had weak indigenous government institutions and infrastructure to build off of “because it had been so government-controlled, so centrally planned from Moscow,” she said, noting that private entrepreneurship was also banned by the Soviets until the late 1980s — “so it’s not like we could take what we had.” 

At the same time, personal computers and connected technologies were advancing and becoming more widely adopted in some parts of the world. With limited funds and no established blueprint for e-governance, Estonians went all-in on building their new federal architecture to enable primarily digitized public services. The move is now largely considered a crucial “first” for the government.

“That was partially because we couldn’t afford anything else, and partially it was about the convenience,” Past noted.

Through that approach, Estonians established a digital population registry and interconnectivity platform that all of its citizens can use to easily access different government services online. 

“What that then means is that, as someone who runs an information system,” like major service providers for the nation’s education or healthcare organizations, Past said, “you just get to pull what’s needed — and as a citizen, I don’t have to worry that my doctor and the post office and the taxman do not have my current address, because I can just update that in the population registry.”

Each Estonian citizen also has their own unique identification number and an ID card with a chip that can be used to access government portals and file information such as their taxes, which generally only takes about two minutes, according to Past.

So, when Russia invaded Ukraine, Estonia’s government agencies immediately stepped up to provide information technology and cybersecurity support and help build out equipment, she said.

Compared to Estonia and the other Baltic nations, Ukraine had a more turbulent path to self-rule from the former Soviet Union. And informed in some ways by more recent technological advancements, its still-unfolding digital transformation built on Estonia’s but prioritized enabling government services to be easily accessible by smartphones.

“In terms of their government app, definitely Ukraine’s ahead of us. There’s no question. We’re mostly browser-native, which is already not bad. But they are mobile-native,” Past said. “And often people who look deeper into their systems say that it’s like you took the Estonia digital state and reimagined it in circa 2020, or 2019.”

Protecting ‘the miracle’

Three of Past’s grandparents were child refugees during World War II.

“I’m in no way special in that everyone’s families have terrible historical trauma in my neighborhood,” she said.

When she was little, basic everyday goods were not always available to her family.

“I remember seeing someone literally on the street with a piece of bread — I must have been maybe six or seven, so in the late ’80s — and running back up the stairs in our apartment building [and telling my family that] they must have bread in the shops, because I saw someone with a piece of bread. Sometimes you forget how far you’ve come,” Past said. 

Familiar fears of food insecurity have resurfaced with the Ukraine-Russia war.

“To me, an independent Estonia is such a miracle,” Past said, “that it then becomes sort of a moral imperative to make sure that Estonia remains independent.”

It’s through that lens that she makes decisions now as the nation’s top cyber official — a responsibility she assumed just a few months ago. Her team’s work spans a wide range of critical duties, including ensuring compliance and national security baseline standards, and enabling incident handling capabilities.

“The very central question to what my office does is, how do we make sure that this very digital way of life that Estonia has chosen is secure in the now, but it also is secure in the future?” she said.

While the nation’s technology infrastructure is relatively new, Past confirmed that she worries whether it is all “future-proof.”

“But I’ll make my agencies and my team figure that out,” she said.

Editor’s note: This article was updated to clarify Past’s current role.