![\"Helen](\"https:\/\/trialoog.taltech.ee\/wp-content\/uploads\/2026\/10\/IMG_3216-240x320.jpg\")
Helen Popp. Photo: Grete-Liis Johanson[\/caption]\r\nThat power is reflected, among other things, in how states use cyberspace. A cyberattack can disrupt services or critical infrastructure, but it can also form part of intelligence gathering, information operations or broader political pressure.<\/p>\r\n
This is not a new issue for Estonia. Public services began moving online gradually in the 1990s, and as the digital state developed, its dependence on reliable and secure digital systems grew. A turning point came in the spring of 2007, when coordinated cyberattacks targeted Estonian banks, government agencies and other services. According to Popp, the denial-of-service attacks of the time were not particularly sophisticated by today\u2019s standards, but their scale and coordination were unprecedented at the time.<\/p>\r\n
Estonia raised the attacks at NATO, the European Union and other international organisations, and cyberattacks increasingly came to be seen as a matter of foreign and security policy.<\/p>\r\n
The political purpose of cyberattacks<\/strong><\/h4>\r\nStates now use cyberspace increasingly deliberately to achieve their political objectives. According to Popp, both geopolitical tensions and rapid technological development are keeping the threat level high. She considers attacks on critical infrastructure particularly serious.<\/p>\r\n
Russia, she said, uses cyberspace as a tool of foreign and security policy. Ukraine is the main target, but countries supporting Ukraine are also under pressure. Alongside cyberattacks, intelligence gathering and information operations are used, with organisations connected to the military and defence industry among the targets.<\/p>\r\n
In Popp\u2019s view, cyberattacks cannot be considered separately from the wider political situation. Last year, Estonia experienced attacks by pro-Palestinian groups, illustrating how directly international tensions can spill over into cyberspace. When a cyber incident occurs, it is therefore not enough to ask what happened to a system: understanding the timing of the attack and the choice of target is equally important.<\/p>\r\n
For Popp, stability in cyberspace does not mean the complete absence of conflict. Rather, the aim should be to make states\u2019 behaviour as predictable as possible, reduce the risk of miscalculation and escalation, and establish a shared understanding of the limits of acceptable conduct.<\/p>\r\n
\u201cTechnology is not simply one sector among others that drives the economy or puts policy into practice. It has become a source of power for states.\u201d<\/p><\/blockquote>","image":null,"align":""},{"acf_fc_layout":"image","image":26195},{"acf_fc_layout":"text","type":"text","text":"
New technologies blur the boundaries of conflict<\/strong><\/h4>\r\nIn cyber conflicts, it is often difficult to tell where ordinary confrontation between states ends and a more serious conflict begins. Identifying an attacker can take a long time, and even after analysis it is not always clear how to respond to a violation.<\/p>\r\n
\u201cIn cyberspace, conflicts often remain in a grey area: they cannot be categorised as war, yet they are no longer an ordinary diplomatic confrontation either,\u201d Popp said.<\/p>\r\n
The fact that not all countries see the digital world in the same way adds to the complexity. While Western countries once largely shaped international rules governing the internet, China, India, Indonesia, South Africa and others have now brought their own visions to the table. Their views on state control, privacy, human rights and an open internet may differ from those of Western countries.<\/p>\r\n
\u201cWe are not just arguing about protocols or standards. We are arguing about what our societies will be like,\u201d Popp said.<\/p>\r\n
Artificial intelligence adds another layer to an already complex situation. According to Popp, it could significantly change cyber conflicts, including by intensifying them. AI can help prepare attacks more quickly, automate activities and make existing attack techniques more effective.<\/p>\r\n
This does not mean that attackers always need sophisticated AI-based solutions. A weak password, a poorly protected system or human error is often enough. AI can help identify and exploit these weaknesses more quickly and carry out attacks on a larger scale than before.<\/p>\r\n
Other states are watching the response<\/strong><\/h4>\r\nAccording to Popp, it is a mistake to assume that every state can act as it pleases in the digital world. In 2015, agreement was reached at the United Nations that international law also applies in cyberspace and that states should follow norms of responsible behaviour. One of these norms, for example, states that a country should not attack another country\u2019s critical infrastructure.<\/p>\r\n
Having rules does not, however, mean they are always followed. Popp cited Russia\u2019s cyberattack on Ukraine\u2019s power grid, which took place just weeks after the relevant norm was approved. She said such violations must be met with a response, including publicly naming the attacker where necessary.<\/p>\r\n
This matters not only as a way of putting pressure on the particular offender. States assess responses to understand the chains of cause and effect that may operate in the digital environment. \u201cThere are a whole host of countries watching very closely how we respond to what happens in cyberspace,\u201d Popp said.<\/p>\r\n
If violations go unanswered, others may conclude that agreed boundaries can be crossed without significant consequences. Public responses therefore help define more clearly what the international community will and will not accept in cyberspace.<\/p>\r\n
\u201cIn cyberspace, conflicts often remain in a grey area: they cannot be categorised as war, yet they are no longer an ordinary diplomatic confrontation either.\u201d<\/p><\/blockquote>\r\n
\u201cTechnology is not simply one sector among others that drives the economy or puts policy into practice. It has become a source of power for states.\u201d<\/p><\/blockquote>","image":null,"align":""},{"acf_fc_layout":"image","image":26195},{"acf_fc_layout":"text","type":"text","text":"
New technologies blur the boundaries of conflict<\/strong><\/h4>\r\nIn cyber conflicts, it is often difficult to tell where ordinary confrontation between states ends and a more serious conflict begins. Identifying an attacker can take a long time, and even after analysis it is not always clear how to respond to a violation.<\/p>\r\n
\u201cIn cyberspace, conflicts often remain in a grey area: they cannot be categorised as war, yet they are no longer an ordinary diplomatic confrontation either,\u201d Popp said.<\/p>\r\n
The fact that not all countries see the digital world in the same way adds to the complexity. While Western countries once largely shaped international rules governing the internet, China, India, Indonesia, South Africa and others have now brought their own visions to the table. Their views on state control, privacy, human rights and an open internet may differ from those of Western countries.<\/p>\r\n
\u201cWe are not just arguing about protocols or standards. We are arguing about what our societies will be like,\u201d Popp said.<\/p>\r\n
Artificial intelligence adds another layer to an already complex situation. According to Popp, it could significantly change cyber conflicts, including by intensifying them. AI can help prepare attacks more quickly, automate activities and make existing attack techniques more effective.<\/p>\r\n
This does not mean that attackers always need sophisticated AI-based solutions. A weak password, a poorly protected system or human error is often enough. AI can help identify and exploit these weaknesses more quickly and carry out attacks on a larger scale than before.<\/p>\r\n
Other states are watching the response<\/strong><\/h4>\r\nAccording to Popp, it is a mistake to assume that every state can act as it pleases in the digital world. In 2015, agreement was reached at the United Nations that international law also applies in cyberspace and that states should follow norms of responsible behaviour. One of these norms, for example, states that a country should not attack another country\u2019s critical infrastructure.<\/p>\r\n
Having rules does not, however, mean they are always followed. Popp cited Russia\u2019s cyberattack on Ukraine\u2019s power grid, which took place just weeks after the relevant norm was approved. She said such violations must be met with a response, including publicly naming the attacker where necessary.<\/p>\r\n
This matters not only as a way of putting pressure on the particular offender. States assess responses to understand the chains of cause and effect that may operate in the digital environment. \u201cThere are a whole host of countries watching very closely how we respond to what happens in cyberspace,\u201d Popp said.<\/p>\r\n
If violations go unanswered, others may conclude that agreed boundaries can be crossed without significant consequences. Public responses therefore help define more clearly what the international community will and will not accept in cyberspace.<\/p>\r\n
\u201cIn cyberspace, conflicts often remain in a grey area: they cannot be categorised as war, yet they are no longer an ordinary diplomatic confrontation either.\u201d<\/p><\/blockquote>\r\n
According to Popp, it is a mistake to assume that every state can act as it pleases in the digital world. In 2015, agreement was reached at the United Nations that international law also applies in cyberspace and that states should follow norms of responsible behaviour. One of these norms, for example, states that a country should not attack another country\u2019s critical infrastructure.<\/p>\r\n
Having rules does not, however, mean they are always followed. Popp cited Russia\u2019s cyberattack on Ukraine\u2019s power grid, which took place just weeks after the relevant norm was approved. She said such violations must be met with a response, including publicly naming the attacker where necessary.<\/p>\r\n
This matters not only as a way of putting pressure on the particular offender. States assess responses to understand the chains of cause and effect that may operate in the digital environment. \u201cThere are a whole host of countries watching very closely how we respond to what happens in cyberspace,\u201d Popp said.<\/p>\r\n
If violations go unanswered, others may conclude that agreed boundaries can be crossed without significant consequences. Public responses therefore help define more clearly what the international community will and will not accept in cyberspace.<\/p>\r\n
\u201cIn cyberspace, conflicts often remain in a grey area: they cannot be categorised as war, yet they are no longer an ordinary diplomatic confrontation either.\u201d<\/p><\/blockquote>\r\n