Lessons from small and highly-digitalised Estonia: Decision-making in the aftermath of cybersecurity crises

Carmichael, Logan Article Lessons from small and highly-digitalised Estonia: Decision-making in the aftermath of cybersecurity crises Internet Policy Review Provided in Cooperation with: Alexander von Humboldt Institute for Internet and Society (HIIG), Berlin Suggested Citation: Carmichael, Logan (2025) : Lessons from small and highly-digitalised Estonia: Decision-making in the aftermath of cybersecurity crises, Internet Policy Review, ISSN 2197-6775, Alexander von Humboldt Institute for Internet and Society, Berlin, Vol. 14, Iss. 3, pp. 1-30, https://doi.org/10.14763/2025.3.2028 This Version is available at: https://hdl.handle.net/10419/324164 Standard-Nutzungsbedingungen: Die Dokumente auf EconStor dürfen zu eigenen wissenschaftlichen Zwecken und zum Privatgebrauch gespeichert und kopiert werden. Sie dürfen die Dokumente nicht für öffentliche oder kommerzielle Zwecke vervielfältigen, öffentlich ausstellen, öffentlich zugänglich machen, vertreiben oder anderweitig nutzen. Sofern die Verfasser die Dokumente unter Open-Content-Lizenzen (insbesondere CC-Lizenzen) zur Verfügung gestellt haben sollten, gelten abweichend von diesen Nutzungsbedingungen die in der dort genannten Lizenz gewährten Nutzungsrechte. Terms of use: Documents in EconStor may be saved and copied for your personal and scholarly purposes. You are not to copy documents for public or commercial purposes, to exhibit the documents publicly, to make them publicly available on the internet, or to distribute or otherwise use the documents in public. If the documents have been made available under an Open Content Licence (especially Creative Commons Licences), you may exercise further usage rights as specified in the indicated licence. https://creativecommons.org/licenses/by/3.0/de/deed.en Volume 14 | Lessons from small and highly-digitalised Estonia: Decision-making in the aftermath of cybersecurity crises Logan Carmichael University of Tartu DOI: https://doi.org/10.14763/2025.3.2028 Published: 13 August 2025 Received: 13 August 2024 Accepted: 13 December 2024 Funding: This work was supported by European Union’s Horizon 2020 research and innovation program under grant agreement No 857622 “ERA Chair in E-Governance and Digital Public Services — ECePS”. Competing Interests: The author has declared that no competing interests exist that have influenced the text. Licence: This is an open-access article distributed under the terms of the Creative Commons Attribution 3.0 License (Germany) which permits unrestricted use, distribution, and reproduction in any medium, provided the original work is properly cited. https://creativecommons.org/licenses/by/3.0/de/deed.en Copyright remains with the author(s). Citation: Carmichael, L. (2025). Lessons from small and highly-digitalised Estonia: Decision-making in the aftermath of cybersecurity crises. Internet Policy Review, 14(3). https://doi.org/10.14763/2025.3.2028 Keywords: Cybersecurity governance, E-governance, Estonia, Crisis management, Cybersecurity management Abstract: As governments across the world increasingly undergo digitalisation processes, ensuring cybersecurity of these provisions cannot be 100% guaranteed. How, then, can governments best respond to a cybersecurity crisis in order to bolster cybersecurity in the future? Even Estonia, one of the earliest and most pervasive examples of e-governance globally, has not been without cybersecurity crises. Using four key Estonian examples, this paper examines the components of government decision-making in the aftermath of cybersecurity crises, which aim to bolster future cybersecurity. Three key approaches emerged from the crises examined: 1) decision-making is derived from prior knowledge and experience; 2) communications around cybersecurity crises is clear, coordinated, and transparent; and 3) innovation and planning should take place in times of non-crisis, as crises often expedite decision-making. Ultimately, this paper offers insight into how governments can make decisions following cybersecurity crises, in contexts beyond Estonia, as they undergo digitalisation processes and increasingly face cyberattacks. Issue 3 Introduction Across the world, governments are increasingly digitalising their service provisions, a process that has been ongoing over recent decades but was expedited in many places with COVID-19 lockdown restrictions (Härmand, 2021; Carmichael, 2021). At the same time, cyberattacks and other malicious activity in cyberspace have been increasing in frequency, sophistication, and severity, with targets across myriad sectors, including governments (see, for example, Tasheva, 2021; Pranggono and Arabo, 2020). Thus, the topics of cybersecurity and e-governance have become increasingly intertwined, with conversations around how digitalised provisions should be secured becoming an inherent and crucial part of the digitalisation process. Despite proactive measures to enhance cybersecurity, crises – broadly, ‘disruptive’ events with the elements of threat, urgency, and uncertainty – in the cyber domain can, and do, still eventuate (Boin et al., pp. 5-7). Thus, this paper addresses the following core question: how can governments, and their ministries and agencies responsible for cybersecurity, respond in the aftermath of a cybersecurity crisis, in order to bolster the future cybersecurity of their digitalisation initiatives? Estonia, a nation of 1.3 million people on the southern shores of the Baltic Sea, is an illuminating case in both the study of e-governance and cybersecurity. This is because of its early and pervasive adoption of e-governance practices, including electronic identification (eID) and nationwide internet voting (i-voting) dating back to the early 2000s (Alvarez et al., 2009; Vassil et al., 2016). The country also faced one of the earliest instances of a publicly-acknowledged DDoS cyberattack on a nation-state in 2007, and crafted new legislation and governance structures in its aftermath, predating most of its counterparts globally. Although deemed a global leader in this space, Estonia has not been without cybersecurity crises, even those impacting its e-governance model. This paper looks at four key crises in the Estonian experience with e-governance and its cybersecurity: the aforementioned 2007 DDoS cyberattacks, impacting government, news media, and banking sites; the 2017 ‘eID’ crisis where a vulnerability in eID cards was discovered; the COVID-19 pandemic, and the cybersecurity realities associated with a public health crisis and lockdowns; and the 2022 Russian full-scale invasion of Ukraine, which coincided with cyberattacks against Ukraine’s allies. Though the latter two events are not uniquely cybersecurity crises, they did come with unique new cybersecurity realities, and along with the former two events, meet the criteria set forth in crisis management literature to constitute a crisis, in order to observe the evolution of decision-making on said topics in the Estonian government. 2 Internet Policy Review 14(3) | 2025 The Estonian case demonstrates the importance of learning from experiences, growth, and continuous improvement to cybersecurity mechanisms, especially in an instance of such pervasive digitalisation. There was a time when Estonia was a unique case purely because of the existence of its e-governance structure, but today, other countries have ‘caught up’ in the digitalisation process. As an earlier adopter of e-governance and, in turn, cybersecurity practices, when faced with crises in these spaces, Estonia often found itself crafting new responses, rather than following global precedent that did not yet exist, given that governments did not typically publicly acknowledge cyberattacks at that time. Thus, the value of the Estonian case lies in its maturity, continuing to learn from the cybersecurity challenges that can befall digitalised provisions. As other governments, at various levels of governance, are embarking on the earlier stages of digitalisation and associated cybersecurity considerations, they stand to learn from the Estonian experience, where the government has been grappling with the topics of cybersecurity surrounding digitalised provisions for more than fifteen years, arguably leading to a more secure e-governance system over time. FIGURE 1: Estonian cybersecurity crises examined in this paper. State of the art While ‘crisis’ can be described as a “broad term related to disruptions of some kind” (Coombs et al., 2019, p. 31), then crisis management is “a set of factors designed to combat crises and to lessen the actual damage inflicted by” them (Coombs, 2018, p. 1). In their foundational work on political crisis management, Boin and colleagues (2017) acknowledge the wide range of domains – including terrorism, natural disasters, and humanitarian emergencies – in which crises have been experienced over prior decades (p. 1). Furthermore, crisis management scholarship has 3 Carmichael proposed a number of different models for crises themselves and for carrying out crisis management. This has included Boin and colleagues’ (2017) criteria for determining what constitutes a crisis; these specific criteria, utilised in this paper, are outlined in greater detail in the following section. Further models in crisis management have included Pearson and Clair’s (1998) model of the crisis management process, with focus on the environmental context, individual and collective reactions, situated before and after a triggering event, respectively (p. 66). More recent work from Jin et al. (2023) proposed a ‘readiness’ model, as a multi-level approach to threats, risks, conflicts, crises, and sticky crises, to bolster preparedness (pp. 4-5). The crisis management model most relevant to this paper is Jaques’ (2007) relational model of crisis management, which clusters parts of the crisis management process into four parts, situated before, during, and following a crisis (pp. 150-151). The approach to crisis response undertaken in this paper corresponds to what Jaques (2007) calls ‘post-crisis management,’ namely, the recovery and business resumption, post-crisis issue impacts, and evaluation and modification (p. 150). As with the crises criteria aforementioned, further detail on this approach will be elaborated upon in the following section. According to Boin et al. (2017), cybersecurity represents a new domain in which crisis management can be studied (p. 3). As a result, there is a limited but emerging body of literature in the particular field of cybersecurity and crisis management. Various works apply elements of the broader study of crisis management into the cyber arena. In earlier literature, Areng (2013) looked at international mechanisms for broaching cyber crises, especially vis-à-vis more ‘traditional’ toolkits for crisis management. Boeke (2017) similarly articulated that states struggle to adapt existing institutional structures to cope in instances of cyber crisis, using the cases of Estonia, Denmark, the Netherlands, and the Czech Republic. Conversely, Backman (2020) looked at cyber crisis as fitting within broader trans-boundary crisis literature. Collier (2017) examined governmental institutional structure for crisis, NGO involvement, and international initiatives. The Estonian cyberattacks of 2007 provided a case study in several of these articles, including Areng, Boeke, Backman, and Collier, while the latter two have compared Estonian and United Kingdom cyber crisis response. Boeke (2017) acknowledges that Estonia has been a pre-eminent case study in cyber crisis management, indeed as one of the first such instances of a state needing to develop a response to a cyber crisis; this article also adopts such reasoning. Divergent from this common case study, the work of Østby and Katt (2019) proposes a model of role distribution in cyber crisis management, compared side-by-side with conventional crisis 4 Internet Policy Review 14(3) | 2025 management roles, using municipal-level governance in Norway as their case. In work examining the components that shape institutional definitions of cybersecurity, Fichtner (2018) asserts that approaches can be shaped by threats, assets protected, measures or policies utilised, and responsibilities given to particular actors, all governance approaches built upon in this paper. In the Estonian context, typically literature broaches the topics of digital governance or cybersecurity, with only a limited number of works examining these topics together. For example, scholars such as Ernsdorff and Berbec (2007), and Kitsing (2008) looked at the early development and success of Estonian e-governance. More recent work from scholars including Kerikmäe et al. (2019), Solvak et al. (2019), and Stephany (2020) have looked at nuanced aspects of Estonian e-governance, such as public perceptions, adoption rates, and elements influencing the success of the Estonian model. Estonian cybersecurity has been studied as an example of a global norm-setter (Crandall and Allan, 2015), while specific attention has been paid in several works to the 2007 cyberattacks: the political decisionmaking and legal reforms that followed, as well as rhetoric surrounding whether this represented an instance of cyber warfare, by scholars including Czosseck et al. (2011), Herzog (2017), and Rid (2017). Early literature on the study of cybersecurity and the Copenhagen School of thought outlined the “systemic threats” in the process of securitising digital systems, encompassing critical infrastructures and a broad range of digitalised provisions, a precursor to e-governance (Hansen and Nissenbaum, 2009, pp. 1160-1161). Works on e-governance and cybersecurity, together, in Estonia, have come from Paršovs’ (2020a; 2020b) and Skierka’s (2023) studies of the 2017 eID crisis, a crisis also explored in this paper. This paper aims to make a theoretical and conceptual contribution at the nexus of these three core strains of literature: crisis management, cybersecurity governance, and e-governance. As such, it contributes to the emerging literature examining crisis management specifically in the domain of cybersecurity and its governance; it does so by looking at crisis responses as they affect e-governance provisions, specifically drawing from a mature Estonian context, albeit one with useful applicability to crisis management, cybersecurity, and digitalisation contexts globally. Theoretical and conceptual background Empirically, this paper employs a historical institutionalist theoretical approach, as a useful means to view governance and decision-making in the wake of cybersecurity incidents affecting the Estonian digital governance structure, though methodologically, it takes a constructivist approach, valuing experiences and ideas derived 5 Carmichael from government officials’ encounters with crisis. Together, these theoretical groundings frame the topics of cybersecurity and digital governance in an Estonian context through institutional path dependencies over time, with cybersecurity crises as critical junctures to study, deriving findings based on the experiences and ideas from decision-makers at the forefront of these junctures. Mahoney et al. (2016) define critical juncture as “a relatively short period in time during which an event or set of events occurs that has a large and enduring subsequent impact” (p. 77). Indeed, these concepts play a prominent role in historical institutionalist scholarship, as indicated by Fioretos et al. (2016) that critical junctures mark the start of path-dependent processes, whereby future outcomes, decisions, or processes are a result of those that came before them (p. 9). The approach to historical institutionalism employed in this paper specifically draws upon Pierson and Skocpol’s (2002) idea that historical institutionalists must look to critical junctures and long-term processes, to understand “overarching contexts and interacting processes that shape and reshape states, politics, and public policmaking [sic]”. In employing this approach, this paper examines cybersecurity crises as critical junctures, and the ‘markers’ of path dependencies aforementioned, to look at how governance processes surrounding cybersecurity have been shaped and impacted over time. Here, the four key crises have been selected as useful and illustrative to study, and their particular relevance and applicability is outlined in greater detail below. This article looks less so at the crises themselves, but rather from a governance perspective, looking at how political decision-making was undertaken in the aftermath of said crises to further improve the security underpinning Estonia’s digital infrastructure. While, in the broader context of the study of critical junctures in historical institutionalism, the 15-year time period of this project is relatively short, considering how recently cybersecurity and digital governance have developed, this approach is justified given that this comprises most of the history of these topics studied here. Crises in the domains of cybersecurity and digital governance in Estonia have tended to involve and impact various actors across the political landscape and society; thus, these crises in the Estonian context are particularly illuminating critical junctures for the study of governance processes undertaken in response. This paper employs a comprehensive definition of cybersecurity, encompassing the security of technological systems and software, free of manipulation or disruption, and the protection of information contained in these systems from alteration, corruption, deletion, unauthorised access, or dissemination (Craigen et al., 2014). Thus, cybersecurity governance is the institutional and organisational structure 6 Internet Policy Review 14(3) | 2025 and decision-making related to cybersecurity, as aforementioned (Urgessa, 2020; Von Solms and Von Solms, 2018). This paper derives its terminology of e-governance from the work of D’Agostino et al. (2011), and Bannister and Conolly (2012), assuming an ‘interactive dynamic’ between the government and citizenry, and a fundamentally digitalised model of governance differing substantively from its analogue predecessors. Specifically, this paper draws its definition and criteria for a crisis from Boin et al. (2017) in The Politics of Crisis Management, a second edition that has been updated to include cyberattacks in a list also encompassing natural disasters, terror attacks, and collapses of financial systems. They write that such crises “routinely shatter the peace and order of societies” testing governance today (p. 3). They set forth the key criteria of a crisis as threat, a “sense that the core values or life-sustaining features of a system have come under threat,” urgency (although this is typically socially constructed and can be used instrumentally, i.e. urgency as a tool in a hostage situation, and can vary by proximity to the crisis), and uncertainty, a lack of clarity about what will happen next (pp. 5-7). Furthermore, while these crises meet the criteria set forth by Boin et al., the particular crisis management response studied in this paper correlates with the “post-crisis management” cluster of Jaques (2007) relational model of crisis management (p. 150). The ‘critical function’ of this post-crisis cluster is “looping back to and preparing for and managing future crises,” by looking at: 1) recovery and business resumption (in this case, of egovernance processes in particular), 2) post-crisis issue impacts, and 3) evaluation and modification, all of which align with the core research question of this paper, focusing on post-crisis learning to bolster future cybersecurity surrounding digitalisation (Jaques, 2007, p. 150). This paper uses four cases, representing critical junctures in the overall cybersecurity and e-governance history of Estonia; they also all meet the criteria of a ‘crisis’ set forth by Boin et al. These cases were initially selected based on a review of literature and examined vis-à-vis yearly government reports on cybersecurity. This was further validated when interviewees were asked about crises that should be studied, indicating that these were the pre-eminent crises impacting Estonian egovernance throughout its history, though some did refer to external crises that were also impactful. Ultimately, interviewing indicated common themes across these crises: building upon prior knowledge and experiences, clear and transparent communications, and crisis as an expeditor of change, thus necessitating innovation in times of non-crisis. 7 Carmichael 2007 cyberattacks Estonia shares a complex and tense relationship with its much larger neighbour, Russia; the country was occupied by the Soviet Union during the Second World War and did not regain independence until 1991. One key historical legacy is an often-wary and ‘securitised’ relationship between the country’s ethnically-Estonian majority and its Russian minority (Jašina-Schäfer and Cheskin, 2019, pp. 1-2). Thus, after the removal of a controversial Soviet-era monument from central Tallinn in April 2007, violent political protest erupted, resulting in one death, followed by three weeks of distributed denial-of-service (DDoS) cyberattacks on news media, banks, and government and politicians’ websites (Ehala, 2009; BBC News, 2007). These cyberattacks threatened the functioning of government websites, some digital services, and banking services; though there was less digitalisation than today, functionality was certainly significantly impacted. There was a sense of urgency to bring these websites back online, as they were crucial to the effective functioning of services. Furthermore, there was uncertainty about how and when the cyberattacks would end, and how an investigation and attribution could occur, especially as the cyberattacks reached a peak on 9 May 2007, Victory Day, and as the Russian government refused to cooperate (Pernik, 2018, p. 57; STRATCOM Centre of Excellence, 2019, pp. 52, 58). 2017 eID crisis In the summer of 2017, Czech researchers found a return-of-the-coppersmith (ROCA) cryptographic key generation vulnerability in approximately two-thirds of Estonian eID cards, alongside technologies used in other countries including Austria and Spain (Nemec et al., 2017). This posed a major security threat, as the eID cards represent a core means for authentication within the Estonian e-governance system, and this unpatched vulnerability could be exploited by malicious actors at any time for myriad nefarious purposes. Indeed, Skierka (2023) maintains that electronic identification is “an indispensable pillar of Estonia’s digital society,” with heavy dependence across Estonian society for access to public and private digital services and digital signatures; “its failure would have dramatic consequences for Estonia’s ‘e-state’ and large parts of society” (p. 2). There was urgency to find a patch to the vulnerability, and to deliver messaging to the general public, especially considering that local elections were coming up, for which eID was vital for voter authentication. Uncertainty existed up until the moment that a patch was developed, as the eID cards, and some of their functions, including elections, could be manipulated by malicious actors. 8 Internet Policy Review 14(3) | 2025 tures and strategies for tackling cyberattacks were necessary moving forward. The MOD took the lead on developing a cybersecurity strategy, whereby ministerial responsibility for cybersecurity should preeminently be a civilian rather than military task, and the MOD would allocate this primary responsibility to the MKM (Former senior MOD official, interview, n.d.; former cybersecurity official, interview, n.d.). The outcome was the first Estonian National Cybersecurity Strategy, published in 2008 and one of the first of its kind globally; to reconfigure governance structures overseeing cybersecurity inside the Estonian government; and to collaborate more closely with the private sector. Multiple respondents pointed out that the shift in cybersecurity purview empowered both RIA and the Estonian Computer Emergency Response Team, CERT (Former RIA official, interview, n.d.; former cybersecurity official, interview, n.d.; L. Areng, interview, n.d.; former senior MOD official, interview, n.d.). RIA, home to some of the most knowledgeable technical personnel, became situated under MKM, and became mandated to conduct audits on other entities within the Estonian government, to ensure compliance with cybersecurity requirements (Former senior MOD official, interview, n.d.). Several respondents also noted that the 2007 cyberattacks prompted the creation of the Cyber Defence League (now the Cyber Unit of the Estonian Defence League), and opened up myriad new educational and training pathways for cybersecurity. The latter resulted in the first cybersecurity Masters programmes at Tallinn Technical University and the University of Tartu, with resourcing from the MOD and, later, the Ministry of Education (former RIA official, interview, n.d.; former government cybersecurity official, interview, n.d.; L. Areng, interview, April 3, 2023; former MOD official, interview, n.d.). Another major outcome of the 2007 cyberattacks, mentioned by almost all of the respondents, was the establishment of the NATO-accredited Cooperative Cyber Defence Centre of Excellence (CCDCoE) in Tallinn in 2008 (Former electoral official, interview, n.d.; former MOD official, interview, n.d.; T.H. Ilves, interview, March 14, 2023). Respondents pointed out that the idea for the CCDCoE to be based in Tallinn had begun three years prior to the cyberattacks, but suggested that the cyberattacks garnered support for this idea to actualise (T.H. Ilves, interview, March 14, 2023). The CCDCoE’s main aims are to provide “cyber defence research, training and exercises covering the focus areas of technology, strategy, operations and law” to NATO allies and their partners, with research and cyber training exercises taking place in Estonia (Cooperative Cyber Defence Centre of Excellence, n.d.). Reflecting on the overall process of post-2007 cyberattacks decision-making, a former Ministry of Defence official (interview, n.d.) noted that there were ‘lessons 15 Carmichael learned’ papers crafted internally, but weren’t released publicly, like in some later cybersecurity crises. This instigated a process of governmental introspection that would derive lessons for future cybersecurity crises. eID crisis Interviews with decision-makers within the Estonian government at the time of the eID crisis showed that the initial decision-making response was threefold: developing internal communications on the topic, crafting public messaging, and working on establishing and deploying a patch to the vulnerability. After being informed by Czech researchers of the vulnerability, which existed in the chip cards used not only in Estonia, but elsewhere in Europe, communications began between RIA, whose knowledge of the technology underpinning eID was the most sophisticated; the Police and Border Guard, who issued the card; and Gemalto, the private company that produced the physical smart card (Former RIA official, interview, n.d.; T. Peterkop, interview, April 3, 2023). The initial response included RIA’s endeavour to establish a patch to the vulnerability, as well as internal attempts from RIA personnel to exploit the vulnerability themselves, and monitoring the dark web to see if an exploit emerged (T. Peterkop, interview, April 3, 2023). Though the vulnerability was not exploited, an exploit was ultimately found to be sold on the dark web after the decision was made to suspend certificates on the vulnerable ID cards (T. Peterkop, interview, April 3, 2023). Firstly, it was determined that the government would take a clear and coordinated approach to their communications on the crisis; RIA communications personnel crafted the term “transparent risk management” to describe their approach (Former RIA official, interview, n.d.). Ultimately, then-Prime Minister Jüri Ratas became the spokesperson for the government in this crisis, beginning with a press conference six days after the vulnerability was disclosed by Czech researchers. Though there were some alternative courses of action suggested, one being that the head of the Police and Border Guard deliver the messaging, ultimately it was deemed a “political decision” for Ratas to take on this role (Peterkop, interview, April 3, 2023). Messaging was selected carefully, attempting to frame the crisis in an understandable and accessible manner for the general population, to maintain the public’s trust in the government and the technology (Former RIA official, interview, n.d.). Respondents from across the Estonian government applauded Ratas’ response as visible, transparent, and explained the situation in a palatable way, while simultaneously taking the situation seriously (Former cybersecurity official, interview, n.d.; former MOD official, interview, n.d.). While the Estonian government faced criticisms or concerns with other aspects of the eID crisis, such as internet voting out16 Internet Policy Review 14(3) | 2025 lined below, the response to the government’s communications strategy was overwhelmingly positive. One Estonian journalist, Aivar Pau, was particularly critical of the communications response at the time of the eID crisis, claiming it sowed panic that was ‘unjustified’ (Pau, 2017a; Pau, 2017b). However, Pau’s works have been rebutted by the likes of former Entrepreneurship and IT Minister Liisa Oviir and former President Toomas Hendrik Ilves, who maintained that informing the public of a cybersecurity crisis is a natural course of action, while a government cover-up of the crisis would have been a far worse option (Oviir, 2017; Beltadze, 2017). This is reflected in scholarship on the eID crisis as well (Skierka, 2023, p. 4; Ventsel and Madisson, 2019, pp. 136-137). A further concern that arose was internet voting, as local elections were upcoming in October 2017, and eID cards were a key tool for verifying and authenticating voters. A former electoral official (interview, n.d.) noted that some inside the Estonian government advocated against the use of internet voting in the 2017 local elections, but these ideas were dismissed rather quickly. A former senior cybersecurity official (interview, n.d.) noted that there was less concern about compromised electoral integrity as a result of the vulnerability, but rather, other forms of manipulation – ie. financial exploitation – prior to the deployment of a patch. Several respondents pointed out the eID was not “an exclusive e-service” for the purpose of authentication, that other methods of government-authorised identification could be used or that voters could vote in-person on-paper (Former MOD official, interview, n.d.; former cybersecurity official, interview, n.d.; Peterkop, interview, n.d.). Despite concerns that i-voting turnout would decrease significantly with the eID crisis, the overall level of voting and i-voting usage did not fundamentally change during the 2017 local elections (Valimised, n.d.). Ultimately, by late October and early November of 2017, patches to the vulnerability were developed, tested, and deployed, albeit with some eventual queues to receive new ID cards and some online glitches (Former RIA official, interview, n.d.). Overall, respondents considered this to be a successful response to a cybersecurity crisis, as the vulnerability was not exploited before a patch was deployed, and also from a communications standpoint. Multiple respondents indicated that the precedent of clear and transparent messaging around a cybersecurity crisis was derived from the 2007 cyberattacks (Former cybersecurity official, interview, n.d.; T. Peterkop, interview, April 3, 2023). Beyond the experience gained from the 2007 cyberattacks, one respondent noted that there was preparedness for such a crisis derived from regular cybersecurity exercises and simulations; earlier that year, a national exercise had simulated a vulnerability with eID, although the respondent 17 Carmichael noted that eID officials had been adamant that such a scenario would never unfold (ERR, 2015; MKM, n.d.; L. Areng, interview, April 3, 2023). Multiple respondents also drew attention to the fact that there was a ‘lessons learned’ paper drafted in response to the eID crisis, and unlike the 2007 cyberattacks before it, this paper was made publicly available (RIA, 2018; Former cybersecurity official, interview, n.d.; Former senior MOD official, interview, n.d.). Furthermore, a former MoD official (interview, n.d.) suggested that, beyond RIA, other ministries and agencies generally made better crisis plans for themselves as a result of the eID crisis. COVID-19 pandemic Initially COVID-19 represented a public health emergency, but the move online necessitated by lockdowns quickly encompassed various elements of Estonia’s e-governance and the cybersecurity of these provisions. At the onset of the pandemic, a respondent from the National Situation Centre (interview, n.d.) noted that the government began to collate information and knowledge from across sectors, especially in the digital space, so that the government could craft potential responses. With the move online taking place rapidly, initial issues were less surrounding cybersecurity, and more about accessibility and usage issues, such as insufficient broadband or ineffective VPNs (Former cybersecurity official, interview, n.d.; Former electoral official, interview, n.d.; Former National Situation Centre official, interview, n.d.; L. Areng, interview, April 3, 2023). There were also concerns around the security of popular video-calling platforms such as Microsoft Teams and Zoom, around espionage or unauthorised persons entering these calls. The remedy to these concerns was a review of best practices in cyber hygiene, which one respondent noted was already particularly strong in Estonia, with training provided within the government, as well as made publicly available by companies such as Cybexer Technologies (Former cybersecurity official, interview, n.d.). Despite global upticks in cyberattacks, in Estonia several respondents noted that there wasn’t a significant wave of cyberattacks from Russian cyberattackers, as might have been expected, but rather, “petty cybercrime” with a quite standard combination of phishing, DDoS, and ransomware attacks, experienced in many other countries as well (Former National Situation Centre official, interview, n.d.; Former cybersecurity official, interview, n.d.; L. Areng, interview, April 3, 2023). What Estonia was more concerned with was the prospect of “more organised, statebacked, state-organised attacks that could take down critical infrastructures,” or target the fundamental functioning of Estonian digital governance, but that this sort of attack did not eventuate during the pandemic (Former cybersecurity official, interview, n.d.). These ideas are also reflected in RIA’s yearbook for 2020 (RIA, 18 Internet Policy Review 14(3) | 2025 2021). While most e-services had been available online in Estonia prior to the pandemic, there were some that had not; two such key services were e-education and real estate transactions. Several respondents outlined how the move online of schooling was highly decentralised, that decisions around the technologies used and their security mechanisms, were largely determined on a case-by-case basis in individual educational settings (Former MOD official, interview, n.d.; Former cybersecurity official, interview, n.d.; L. Areng, interview, n.d.). Indeed, literature and reporting from that time show that the security of new and decentralised e-education provisions posed learning curves, as one e-education platform even suffered DDoS cyberattacks and concerns emerged about the functionality of fully-online e-learning and e-health (Carmichael, 2021, p. 38; Eesti Ekspress, 2020; McBride, 2021). To allow real estate transactions to move online, existing technologies from the Estonian company Veriff, used for the Estonian e-Residency programme, were repurposed to allow real estate transactions to take place remotely (Carmichael, 2021, pp. 40-41). Throughout this process, RIA was consulted to ensure optimal security mechanisms in this process, and the Computer Security Incident Response Team (CSIRT) became involved in assisting service providers (L. Areng, interview, April 3, 2023). Furthermore, one respondent revisited RIA audits, which were being carried out on a regular basis, dating back to the 2007 cyberattacks, to ensure cybersecurity compliance and preparedness across government (Former senior MOD official, interview, n.d.). Russia’s full-scale invasion of Ukraine Several respondents noted that the Estonian government’s cybersecurity response to Russia’s full-scale invasion of Ukraine did not neatly align with the 24 February 2022 start of the invasion, but rather had been ongoing over the past decade as Russian aggression against Ukraine escalated. One respondent, a former senior cybersecurity specialist (interview, n.d.), indicated that Estonian officials had been playing close attention to Russian cyber-activity in Ukraine since 2014 (and perhaps even earlier, dating back to the Russian invasion of Georgia in 2008, about which the Estonian government wrote a lessons learned paper, which is still not publicly-available). Funding for enhancing cybersecurity mechanisms was allocated in January 2022; concerns around the security escalation in Ukraine and, ultimately, the full-scale invasion, made it easier to gain resources for cybersecurity initiatives (T. Peterkop, interview, April 3, 2023; Former MOD official, interview, n.d.). This increased funding is clearly outlined in official government messaging and announcements at the time (ERR, 2021; MOD, n.d.). 19 Carmichael Several respondents expressed that cyberattacks faced by Estonian public and private sector entities in the immediate aftermath of 24 February were less, in both their frequency and severity, than they might have expected (National Situation Centre personnel, interview, n.d.; Former electoral official, interview, n.d.). As the war continued, cyberattacks did begin to earnestly target Estonia: these were mostly DDoS attacks, beginning with the NATO Locked Shields cybersecurity exercise in April 2022, and continuing throughout the year, as RIA’s 2022 yearbook clearly shows (RIA, 2022). Multiple respondents expressed that the impacts of DDoS attacks felt less severe than cyberattacks in the past, including the 2007 cyberattacks, as the technology for mitigating DDoS attacks has improved over time, and the government has increased both its investment into cybersecurity and collaboration with the private sector (Former National Situation Centre official, interview, n.d.; Former senior MOD official, interview, n.d.). While respondents indicated that cybersecurity mechanisms were already quite good at the onset of the 24 February full-scale invasion, they also outlined ways in which the Estonian government undertook a number of decisions in an attempt to further bolster cybersecurity. There was an exchange of technology between public institutions and critical infrastructure providers, and enhanced assistance provided by RIA (Former MOD official, interview, n.d.). A RIA official confirmed this process; since the onset of the full-scale invasion, RIA had crafted a three-layered approach to cybersecurity: the first layer involves the victim of a cyberattack turning first to RIA and its response teams for assistance; the second layer is RIA-supported (via resources and training) IT houses across the Estonian government, and the third layer is the Cyber Unit of the Estonian Defence League (L. Areng, interview, April 3, 2023). Once again, there was a key focus on government messaging, especially in August 2022 as DDoS attacks reached their highest levels since 2007, as a Soviet-era tank was removed from public display in the border town of Narva, confirmed by RIA’s 2022 yearbook (RIA, 2023). Announcing the cyberattack, Estonian CIO Luukas Ilves Tweeted: ‘Yesterday, Estonia was subject to the most extensive cyber attacks it has faced since 2007. Attempted DDoS attacks targeted both public institutions and the private sector’ (Ilves, 2022, n.p.). This Tweet was shared by high-profile Estonian government officials including President Alar Karis and Prime Minister Kaja Kallas. Multiple respondents acknowledge that this was, again, an instance of clear and transparent messaging about cyberattacks targeting Estonia; another noted that it represented an opportunity to “praise” the personnel responsible for responding to these cyberattacks. 20 Internet Policy Review 14(3) | 2025 Some respondents did, however, express concerns with this response, that the high-profile nature of this messaging could unintentionally place a target on Estonia for future cyberattacks, or be manipulated for purposes of Russian information warfare (Former MOD official, interview, n.d.; L. Areng, interview, April 3, 2023). The intrinsic linkage between information warfare and cyber operations by the Russian state – both before and since the start of the full-scale invasion – was pointed out by several respondents as an ongoing concern. Such a linkage between information warfare and cyber operations within Russian governmental doctrine is reflected in a great deal of literature (see for example, Etudo et al., 2023; Zelenkauskaite, 2022; Whyte, 2020). However, one respondent pointed out that crafting messaging around DDoS attacks is “safe” vis-à-vis other types of cyberattacks that may be more sophisticated, or potentially embarrassing or damaging to a country’s reputation (Former National Situation Centre official, interview, n.d.). Therefore, it may have been less risky for Estonian government officials to publicly announce these DDoS attacks in August 2022, as this was deemed less damaging to either its reputation, nor technically to its digital governance’s functionality. External crises informing Estonia Speaking with respondents also revealed that decision-making has not solely been shaped by Estonian crises, but has also been informed by crises that have occurred beyond its borders. One such example, outlined by multiple respondents, was the 2011 earthquake in Fukushima, in which the Japanese government lost a small amount of national data (T.H. Ilves, interview, March 14, 2023; T. Kotka, interview, March 28, 2023). With increased digitalisation and the move away from hard copies, one respondent emphasised how essential it became for information – and even legislation – that is stored solely digitally to be available in the event of disaster. While natural disasters, like the earthquake in Fukushima, are statistically quite infrequent in Estonia, respondents recognised the threat of occupation – as was seen in Crimea since 2014, but which Estonia also experienced during its occupation by the Soviet Union from the end of the Second World War until 1991 – whereby information could be destroyed or fundamentally altered. The same is also possible via cyberattacks. The result was the establishment of the first data embassy, located in Luxembourg, although the Estonian government began storing copies of information outside the country as early as 2005 in response to this threat (T. Kotka, interview, March 28, 2023). 21 Carmichael Path dependencies across crises This paper has treated the four selected crises as critical junctures, derived from historical institutionalist theory outlined previously, which can be used as markers from which path-dependent processes begin, and whereby outcomes, decisions, and processes result from those that came before them (Fioretos et al., 2016, p. 9). Indeed, it can be seen from the analysis above that the post-crisis responses and decision-making processes outlined by the interviewees gave rise to path-dependent processes in the Estonian context. The first is crisis communications responses, which originated with the 2007 cyberattacks, when officials carefully considered whether to go public with an acknowledgement of the DDoS attacks, a decision they did eventually undertake. Interviewees then asserted that subsequent communications strategies emerged from this initial decision: the ‘radical transparency’ approach to the eID crisis in 2017, and the acknowledgement of the largest DDoS cyberattacks on Estonia since 2007, publicly disseminated on the Estonian then-CIO’s Twitter. Secondly, new governance structures that emerged from the 2007 cyberattacks were directly related to crisis decision-making in subsequent cybersecurity crises. This included the elevation and empowerment of RIA in the aftermath of the 2007 cyberattacks prioritised this sophisticated technical expertise within the Estonian government; RIA played a lead role in the 2017 eID crisis and developing the patch to the ROCA vulnerability, while RIA auditing across the whole of Estonian government, aimed at ensuring cybersecurity compliance, was deployed throughout the COVID-19 pandemic and beyond. Furthermore, RIA’s three-tier approach, offering cybersecurity services to the rest of government, was amped up following the start of the full-scale invasion. In addition to RIA, path dependencies from the establishment of the NATO CCDCoE in Tallinn following the 2007 cyberattacks could be seen with Estonian efforts to bring Ukraine into CCDCoE membership, with the purpose of exchanging cybersecurity and cyber defence expertise and knowledge following the start of the full-scale invasion. Finally, DDoS preparedness, resulting from overall improvements and investment in appropriate technology, can be traced from the 2007 cyberattacks. Subsequent disruptions from DDoS attacks throughout the COVID-19 pandemic and following the start of the fullscale invasion of Ukraine by Russia in 2022 were significantly minimised vis-à-vis what was experienced with the DDoS attacks in 2007. Thus, through these multiple instances, the critical junctures examined in this paper can be used to trace path-dependent processes in cybersecurity governance in the Estonian government over time. 22 Internet Policy Review 14(3) | 2025 Conclusions Each of these events represents a distinct point and critical juncture in Estonia’s history of cybersecurity and e-governance, each with their own unique and nuanced realities of the crisis at hand. However, there are commonalities that exist across these critical junctures that offer lessons in how a country, Estonia or beyond, can broach decision-making following cybersecurity crises, especially when those crises may potentially affect digitalised governmental provisions. Thus, there are three key overarching ways in which this paper’s core research question – which asks how governments and their responsible bodies can respond in the aftermath of a crisis to bolster future cybersecurity, especially around digitalisation initiatives – has been addressed using the Estonian case. Firstly, a common thread amongst Estonian government responses to cybersecurity crises is building on prior knowledge and experience, both inside of Estonia and internationally, by monitoring the cybersecurity threat landscape in other countries and their experiences with broaching crises as well. This is a continuous process, one which recognises that the cybersecurity landscape is not static, but everchanging. Estonian government entities, in collaboration with the private sector, derived lessons from earlier cybersecurity crises, like the 2007 cyberattacks and 2017 eID crisis, and applied these learnings in future crises, including the COVID-19 pandemic and the Russian full-scale invasion of Ukraine, so that the impacts of cyberattacks were lessened. Furthermore, Estonian authorities monitored the threat landscape, looking at Japan after the 2011 Fukushima earthquake, or Ukraine since the 2014 annexation of Crimea, to learn from the experiences of other countries and bolster Estonian cybersecurity in response to such events. This indicates a constant process of observing and learning in times of both crisis and non-crisis, internally and looking to external examples. Indeed, a crisis is not a sole impetus for change and improvement to cybersecurity, but serves as a very strong driver. Secondly, across these crises, the Estonian government has employed clear, coordinated messaging and transparency around times of crisis. Such an approach was initially derived from the 2007 cyberattacks, at the time quite unprecedented and as yet uncharted whether the government would acknowledge at all that the cyberattacks had taken place. Indeed, even today, the very acknowledgement of cyberattacks is often not guaranteed amongst many governments globally. However, the Estonian government of the time undertook the decision to acknowledge – to the general public and to other levels of governance (i.e., EU and NATO) – that they were experiencing DDoS cyberattacks, and this approach has subsequently 23 Carmichael been taken during the eID crisis, throughout the COVID-19 pandemic, and following cyberattacks since the Russian full-scale invasion of Ukraine. This messaging has been coordinated by the responsible government entities, and taken place through channels such as press conferences or releases and government figures’ social media, with the specific objective of informing the public of cyber crises in a clear, transparent, and easy-to-understand fashion. Thirdly, while some new solutions indeed arose from these crises, in many cases, these crises acted as expeditors for other ideas that hadn’t gone through prior. During the earliest days of the COVID-19 pandemic, for example, new solutions broached the move of education to a strictly online provision, but even ‘new’ provisions like online solutions for real estate transactions were derived from existing technologies from Estonian company Veriff, used in the e-Residency process, and repurposed for notarisation on real estate transactions. Additionally, the NATO-accredited CCDCoE in Tallinn had been proposed since 2004, but its establishment was likely expedited by the 2007 cyberattacks. Similarly, Ukrainian membership into the CCDCoE in 2023 and Estonian-Ukrainian cooperation on cybersecurity matters was expedited by the full-scale invasion in February 2022. This, therefore, shows the direct linkages between times of crisis and times of non-crisis, underscoring the need for creative responses to crisis in the moment, but also the need for innovation in times of non-crisis. New ideas and approaches, as well as simulations and exercises of the most unimaginable or worst-case scenarios, all contribute to increased preparedness for if, or more likely, when, the next crisis strikes. Estonia represents a unique case in that it has fifteen years of cybersecurity history that can be examined, whereas most countries have not yet developed their cybersecurity processes over such a lengthy period of time. Therefore, as a mature case, Estonia has the benefit of learning and refining their approach over time. Drawing from this case, this paper makes both a theoretical and practical contribution to the existing body of scholarship. Theoretically, the novelty of this paper lies in the contribution to crisis management literature in the domain of cybersecurity, looking specifically at post-crisis management in a highly digitalised and mature case. The use of crises as critical junctures as sign-posts demarcating path-dependent processes in the Estonian cybersecurity governance process, especially examining these processes in the context of post-crisis management, is additionally novel in this regard. These findings have practical novelty for governments globally, who are currently undergoing digitalisation processes, and enacting cybersecurity mechanisms, at various stages and levels of governance. Thus, this case offers lessons for other governments around 1) building upon prior 24 Internet Policy Review 14(3) | 2025