- [2020-12-30] A new version of the Election Information System (VIS) is being developed which will introduce an electronic list of voters making it possible to cancel an already given i-vote on election day with a paper vote. News portal Geenius tried to establish whether the authorities are performing background checks on the employees of private companies, Nortal and Cybernetica, involved in the development of the information systems for elections. Not clear whether such checks are needed as the security of the elections should not depend on the integrity of the developers.
https://digi.geenius.ee/rubriik/uudis/kas-valimiste-infosusteemide-arendajate-taust-on-riigile-teada-riigiasutused-keerutavad/ - [2020-12-29] Äripäev’s Russian-language website dv.ee experienced a large-scale DDoS attack. Äripäev’s editor-in-chief believes that the attacks are related to the published story about cryptocurrency millionares in Ida-Viru.
https://digi.geenius.ee/rubriik/uudis/aripaev-sattus-parast-ida-viru-kruptomiljonaride-uurimise-kajastamist-kuberrunnaku-ohvriks/ - [2020-12-28] Arnis Parsovs (UT) has published the draft of his PhD dissertation “Estonian Electronic ID card and its Security Challenges”.
https://cybersec.ee/storage/phd_idcard.pdf - [2020-12-22] An anonymous interview was given for the Kanal 2 television channel where the coronavirus vaccine plan was criticized. The Health Board used a freeware program downloaded from the Internet to remove the voice distortion added to anonymize the source. As a result, the whistle blower was identified and asked to resign from the Health Board.
https://leht.postimees.ee/7139982/terviseametist-vallandatud-simmo-saar-naitab-napuga-sotsiaalministeeriumi-suunas
https://news.err.ee/1215910/health-board-comms-chief-asked-to-resign-after-criticizing-vaccine-plan - [2020-12-18] The Minister of Finance Martin Helme (EKRE) said that Estonian e-elections are not verifiable. The head of the state electoral service refuted the statements of the minister.
https://digi.geenius.ee/rubriik/uudis/martin-helme-eesti-e-valimised-ei-ole-kontrollitavad-ning-neil-puudub-vaatlemise-voimalus/ - [2020-12-16] Sten Mäses (TalTech) defended his PhD thesis “Evaluating Cybersecurity-Related Competences through Simulation Exercises”.
https://digikogu.taltech.ee/et/Item/b4c33d3b-e7ce-48ad-98ad-a0add5e571a3 - [2020-12-16] For years, an IT employee with a state secret permit mined cryptocurrency at the Ämari air base, bought expensive equipment with the Estonian defense budget and smuggled computer components out of the base to sell them in online forums. The purchased goods were not accounted for in the air monitoring division. From 2015 until his arrest in January 2019, the man illegally used devices belonging to the Defense Forces to extract cryptocurrencies worth 30,404 euros and misappropriated at least 190 devices with the total value of 48,935 euros.
https://ekspress.delfi.ee/artikkel/91976323/it-mees-armaani-tegi-eesti-kaitserahaga-osturallit-ja-avas-amaris-salajase-kruptorahakaevanduse - [2020-12-08] The Ministry of Interior sells the residence addresses entered in the population register to commercial enterprises for the purpose of sending advertisements or invitations to participate in surveys. Names, e-mail addresses, dates of birth and personal identification codes are not disclosed to the companies, but the addresses can be purchased by specifying the characteristics such as age, gender and mother tongue. People can opt-out by restricting access to their data in the e-service at rahvastikuregister.ee. In 2019, the data was sold to five customers and the state earned 8,205 EUR.
https://forte.delfi.ee/news/digi/riik-muutis-inimeste-aadressid-ariks-siseministeerium-muub-rahvastikuregistri-andmeid-otsepostitusfirmadele?id=91904305 - [2020-12-07] The Estonian Foreign Intelligence Service (EFIS) allowed an active intelligence officer to give an interview to Postimees. The interview followed strict secrecy rules and Postimees did not learn the agent’s identity. This activity is likely related to the job ads recently put out by the Estonian Foreign Intelligence Service.
https://news.postimees.ee/7127281/estonian-intelligence-operative-our-special-tool-is-our-brain - [2020-12-07] The 6th Interdisciplinary Cyber Research conference took place in a semi-online format. The video recordings and proceedings are available.
https://www.taltech.ee/en/icr2020 - [2020-12-02] By exploiting a flaw in the content management software Drupal, attackers compromised servers of the Ministry of Economic Affairs and Communications, the Ministry of Social Affairs and the Ministry of Foreign Affairs. The attackers downloaded 350GB of data from a total of 11 servers. The data mostly consisted of the data in the document management system. However, the attackers were also able to download a database containing data about 9158 corona-positive persons and their close contacts, that was stored as a LimeSurvey database in the Drupal instance of the Health and Welfare Information Systems Center (TEHIK). RIA initiated supervision proceedings, the Data Protection Inspectorate initiated its own proceedings and the Central Criminal Police initiated criminal proceedings of obtaining illegal access to the systems. Members of Parliament suspected that data from the national car registry had also been leaked, but this information was not confirmed.
https://news.err.ee/1192411/three-government-ministries-came-under-cyber-attack-in-november
https://news.postimees.ee/7123666/cybercriminals-attack-three-ministries
https://news.err.ee/1193476/november-s-cyber-attack-left-foreign-ministry-intranet-unmolested
https://www.err.ee/1192309/riigi-vastu-toimusid-kuberrunded-katte-saadi-9158-koroonapatsiendi-andmed
https://digi.geenius.ee/rubriik/uudis/ria-mkm-ei-kasutanud-infoturbe-osas-parimaid-praktikaid-algatasime-jarelevalvemenetluse/
https://digi.geenius.ee/eksklusiiv/koroonapositiivsete-andmed-lekkisid-limesurvey-teenusest-terviseamet-lopetas-selle-kasutamise/
https://digi.geenius.ee/rubriik/uudis/ministeerium-lukkab-riigikogulase-kahtlustuse-umber/
https://digi.geenius.ee/rubriik/uudis/riigikogulaseni-joudis-info-et-kuberrunnaku-kaigus-saadi-katte-rohkem-infot-kui-seni-on-oeldud/ - [2020-12-01] RIA is developing an environment which will provide the possibility of installing additional smart card applications on the ID card. There are about four companies working on the creation of apps. The proof of concept will be completed by March 2021. RIA will not charge for apps, but it is possible that the use of the app will require a certain fee to be paid to the companies providing the apps.
https://digi.geenius.ee/rubriik/uudis/tulevast-aastast-saab-id-kaardile-appe-installida/ - [2020-12-01] Internet shops of pharmacies Apotheka, Südameapteek and Azeta.ee allowed anyone to query another person’s prescriptions by entering their personal ID code. The Data Protection Inspectorate issued a precept-warning with a one-day compliance deadline and a penalty payment of 100,000 euros to these three pharmacy chains. The chains complied with the precept by the deadline and suspended the possibility for buying a prescription drug for another person from the e-pharmacy.
https://www.aki.ee/et/uudised/andmekaitse-inspektsioon-kohustas-e-apteeke-lopetama-koheselt-ligipaas-teise-inimese
https://www.err.ee/1196452/e-apteekidest-enam-teistele-inimestele-retseptiravimeid-osta-ei-saa
https://arileht.delfi.ee/news/uudised/vooraste-inimeste-retseptiinfot-avaldavad-apteegid-said-riigilt-hoiatuse?id=91845429 - [2020-12-01] Citizen Lab reported that the Estonian Education and Research Network (EENet) hosts Circles surveillance technology that exploits weaknesses in the global mobile phone system SS7 to track people’s phone calls, text messages and location, from anywhere. The technology is sold only to governments, therefore the best guess is that it has been purchased by the Estonian Foreign Intelligence Service to spy on targets abroad. RIA, who are the end-users of the IP addresses, acknowledged that they were used by RIA’s “contract partners”, but refused to name them. Since RIA refused to clarify whether the use of these IPs complied with the EENet’s network policy, EENet blocked traffic to these IPs.
https://citizenlab.ca/2020/12/running-in-circles-uncovering-the-clients-of-cyberespionage-firm-circles/
https://epl.delfi.ee/artikkel/91851591/suur-vend-jalgib-aga-keda-uurijad-paljastasid-hamarat-nuhkimissusteemi-kasutavad-valitsused-nimekirjas-on-ka-eesti
https://www.delfi.ee/news/paevauudised/eesti/voimalikule-eesti-nuhkimissusteemile-tombasid-kriipsu-peale-haridusametnikud?id=91877113
https://twitter.com/ikubjas/status/1333861285725921292
https://digi.geenius.ee/rubriik/uudis/ekspert-nuhkvarast-circles-riigil-on-tagauksed-niigi-olemas-tuvastamisel-piiraksid-telekomid-selle-kasutamist/
https://digi.geenius.ee/eksklusiiv/ria-keeldus-teisele-riigiametile-utlemast-miks-nad-jooksutavad-nende-susteemides-salajast-nuhkvara/ - [2020-11-27] EveryPay AS, which offers payment solutions for Estonian e-shops (used by mTasku), made a mistake which resulted in the bank accounts for a few hundred people being emptied. According to the company, it was a human error in the development which the automatic tests did not catch. All affected customers have received a refund.
https://raha.geenius.ee/rubriik/uudis/eesti-maksevahendaja-eksitus-tuhjendas-monesaja-inimese-pangakonto/ - [2020-11-21] Õhtuleht journalists tailed a ministerial car to reveal its misuse. The Minister of Justice asked the Prosecutor General to have the journalists’ activities investigated on the basis of section 137 of the Penal Code – the section on unauthorized surveillance. The Minister of Justice later claimed that this was a misunderstanding.
https://news.err.ee/1161772/journalists-association-justice-minister-reps-probe-a-press-freedom-threat
https://news.err.ee/1162648/prosecutor-s-office-will-not-open-proceedings-against-ohtuleht-journalists - [2020-11-21] A book chapter by Kärt Salumaa-Lepik (TalTech), Tanel Kerikmäe (TalTech) and Nele Nisu (Ministry of Social Affairs): “Data Protection in Estonia”.
https://link.springer.com/chapter/10.1007/978-94-6265-407-5_3 - [2020-11-20] IT minister Raul Siem (EKRE) proposed using face recognition in i-voting to cut out voter fraud. The Electoral committee responded that the idea is not bad, but may be expensive. RIA supports the idea of using biometrics to identify a person, but acknowledged that this requires in-depth analysis.
https://www.err.ee/1161445/raul-siem-tahab-e-valimistel-hakata-inimesi-kaameraga-tuvastama
https://news.err.ee/1161488/it-minister-smartphone-camera-verification-would-cut-out-voter-fraud
https://news.err.ee/1162239/electoral-committee-face-verification-idea-not-bad-but-expensive
https://news.err.ee/1164544/kaimar-karu-face-recognition-could-be-added-to-e-voting-but-should-it
https://news.err.ee/1196515/it-entrepreneur-doubts-over-e-voting-reliability-is-political-issue
https://twitter.com/ikubjas/status/1329733968099299328
https://digi.geenius.ee/rubriik/uudis/ria-toetab-biomeetria-kasutamise-motet-isiku-tuvastamisel/
https://digi.geenius.ee/rubriik/uudis/itli-president-krull-naotuvastusega-e-valimised-ei-ole-rahvahaaletuse-ajaks-realistik-soov/
https://digi.geenius.ee/rubriik/uudis/it-minister-siem-e-haaletamine-peab-koigile-kattesaadav-olema/
https://digi.geenius.ee/rubriik/uudis/kaimar-karu-naotuvastusega-e-valimiste-teema-tostatus-juba-sel-ajal-kui-mina-olin-minister/ - [2020-11-17] RIA held an online information day. Among the topics covered: new ID card browser extension; new CDOC 2.0 encryption format; new Mobile-ID solution; remote ID card certificate update and remote applet loading; the states authentication service TARA; the new information security standard. The video recordings and the transcribed Q&A are available.
https://blog.ria.ee/kusimused-ja-vastused-ria-infopaeva-esimene-paev-17-11-2020/
https://blog.ria.ee/kusimused-ja-vastused-ria-infopaeva-teine-paev-18-11-2020/ - [2020-11-16] The Ministry of Economic Affairs and Communications (MKM) is planning an independent audit and security analysis on i-voting, however, the details of the audit are still unclear. The ministry plans to propose a model where the security management of i-voting will be two-stage – RIA organizes cyber security and MKM checks the whole process and gives the National Electoral Committee an opinion on whether cyber security is organized at a sufficient level to use electronic systems for conducting elections.
https://news.err.ee/1159591/economics-affairs-ministry-looking-to-tighten-up-e-voting-security
https://mkm.ee/et/uudised/siem-e-valimiste-turvalisus-riikliku-julgeoleku-kusimus
https://digi.geenius.ee/rubriik/uudis/e-valimistele-tehakse-it-ministri-juhtimisel-esimene-rahvusvaheline-audit/
https://digi.geenius.ee/rubriik/uudis/e-valimiste-auditi-osas-valitseb-veel-teadmatus/ - [2020-11-12] SK ID Solutions AS annual conference was replaced with a video presentation. Among the topics covered: SK team has grown; Smart-ID solution is to be implemented in Iceland; SK has teamed up with TalTech to pre-emptively identify and counter phishing scams.
https://www.youtube.com/watch?v=2BBgScfRy0k - [2020-11-08] Minister of the Interior Mart Helme (EKRE) made a statement (without providing any evidence) that election results are falsified in favor of a particular political party by those with access to i-votes. The head of the state electoral service refuted all statements of the minister. The Minister of the Interior later resigned due to other unfounded claims in the context of the U.S. presidential elections.
https://digi.geenius.ee/rubriik/uudis/siseminister-mart-helme-seadis-eesti-e-valimiste-susteemi-ilma-toendeid-esitamata-kahtluse-alla/
https://news.err.ee/1157305/koppel-electoral-committee-does-not-falsify-election-results-in-estonia
https://forte.delfi.ee/news/varia/riigi-valimisteenistuse-juht-lukkab-umber-koik-mart-helme-vaited?id=91621201
https://digi.geenius.ee/rubriik/uudis/riigi-valimisteenistus-lukkab-kategooriliselt-umber-eksminister-helme-e-valimiste-teemalised-vaited/ - [2020-11-01] A cyber defense exercise “Cyber Battle of Tartu” for pupils and students was held at the Delta Center in Tartu. The competition was organized by CybExer Technologies. The participants had to find vulnerabilities in the school’s information system, stop the attack on the hospital’s vital systems and prevent a cyber attack aimed at opening the museum’s treasury.
https://tartu.postimees.ee/7100809/kuberkaitsespetsialist-hans-lougas-internetis-peab-motlema-nagu-hakker
https://tartu.postimees.ee/7099309/tartu-ja-poltsamaa-gumnasistid-esindavad-eestit-rahvusvahelisel-kuberkaitsevoistlusel - [2020-10-29] In the second half of July this year, a new way of banking fraud began to spread – telephone phishing calls. As of the beginning of October, the police has reported 90 cases in which fraudsters have been able to cause damage totaling 200,000 euros. Criminals spoof a bank’s Caller ID, use waiting music, read out the customer’s personal identification code or other personal data, and use all means to create the illusion that the victim is indeed talking to a bank employee. The criminals create fear and state that an action is urgently needed. The victim’s phone receives Mobile-ID or Smart-ID authentication requests and the victim thinks that he is being identified by a bank employee. Scammers are speaking Russian and the victims are mainly the Russian-speaking customers. From the audio recording of the fraudulent call to Swedbank, it is possible to hear that the scammers operate a call center – in the background similar calls can be heard being made to other potential victims. Also the phishing e-mails sent on behalf of banks are once again spreading.
https://tarbija24.postimees.ee/7063755/pank-hoiatab-petukonede-ja-petusonumite-eest
https://www.ria.ee/et/uudised/sagenenud-venekeelsed-telefonikoned-raha-valja-petmiseks.html
https://www.err.ee/1153036/pangapettuste-ohvriks-langevad-enamasti-venekeelsed-kliendid
https://news.err.ee/1153654/ppa-ria-warn-against-phishing-letters-spread-on-behalf-of-banks - [2020-10-28] Draft regulation specifies requirements for handling interruptions in vital services. The telecommunications operator must ensure that the service is restored within 24 hours if 1000 to 30 000 end users are affected and within 8 hours if more than 200,000 users are affected by the failure.
https://digi.geenius.ee/rubriik/uudis/riik-paneb-paika-kui-pikad-voivad-olla-elutahtsate-teenuste-katkestused/ - [2020-10-26] Cybercriminals stole patient data from a Finnish psychotherapy center. Worries are that the same could happen in Estonia.
https://www.err.ee/1151658/ria-hinnangul-kasutavad-turvalisi-kuberteenuseid-umbes-pooled-perearstid - [2020-10-25] The Ministry of Finance plans to register the loans of residents in a central database.
https://www.err.ee/1151293/riik-kogub-inimeste-kohta-aina-enam-infot - [2020-10-22] A 20-year old man in Tartu had repeatedly ridden a bicycle from the Tartu Bike Share System without authorization by using a friend of a friend’s password. It was only discovered after the bike was ridden for more than an hour in one session resulting in the 1 EUR fee being sent to the account holder. The man was identified using security camera footage. He pleaded guilty and promised to compensate for the damage caused. The police imposed a financial penalty on the man in misdemeanor proceedings.
https://tartu.postimees.ee/7076171/sartsuratas-tegi-supilinlase-nime-all-annelinnas-fantoomsoite
https://tartu.postimees.ee/7091433/politsei-tabas-voora-kontoga-sartsurattaid-laenanud-noormehe - [2020-10-21] The Ministry of Economic Affairs and Communications and the Ministry of Interior have made amendments to ban the use of anonymous SIM cards, requiring identification verification for using pre-paid SIM cards. The amendments are needed to help solve drug offenses as well as other organized crime, where anonymous calling cards are often used. The amendments would also affect messaging app services like Skype, WhatsApp and Viber, requiring them to register as communications service providers and require the same degree of ID verification for their users.
https://news.err.ee/1149511/ministry-wants-to-tighten-identification-regulations-on-pre-paid-sim-cards
https://www.err.ee/1149441/mkm-tahaks-turvakaalutlustel-keelata-isikustamata-konekaardid
https://news.err.ee/1149796/legal-expert-anonymous-pre-paid-sim-card-ban-could-violate-privacy-rights
https://news.postimees.ee/7100007/bill-to-obligate-data-collection-and-personalize-prepaid-sim-cards
https://forte.delfi.ee/news/digi/valitsus-toukab-eesti-mitme-pika-sammu-vorra-kontrollimisuhiskonna-poole-likvideeritakse-isikustamata-konekaardid-ja-suhtlusprogrammid-lahevad-voimu-k?id=91396045
https://forte.delfi.ee/news/varia/eksperdid-valitsus-plaanib-olulist-sekkumist-eestlaste-internetivabadusse?id=91408841 - [2020-10-16] Estonia holds the second place in the world in terms of internet freedom after Iceland. Estonia did not receive all the points because, among other things, the Tax and Customs Board can oblige Estonian service providers to block illegal gambling sites.
https://novaator.err.ee/1147918/raport-koroonapandeemia-kiirendab-internetivabaduse-vahenemist
https://news.err.ee/1147145/estonia-ranks-second-in-global-internet-freedom-index
https://mkm.ee/et/uudised/eesti-internetivabaduse-poolest-maailmas-esirinnas - [2020-10-16] A recent audit conducted by the Data Protection Inspectorate (AKI) finds that local municipality governments often unjustifiably mark documents as “information intended for internal use”. Most commonly the wage of employees and their vacation information is hidden. There are rumors that when signing an agreement, some personal information is included on purpose so that access restrictions could be applied. At the same time, there are plenty documents available to the public, containing the full names and contacts of private persons. Sometimes personal data leaks by including personal data in the public title of a non-public document.
https://news.err.ee/1147941/data-protection-inspectorate-local-governments-cover-for-officials - [2020-10-09] The Mobile-ID service was disrupted from 11:20 to 14:30.
https://news.err.ee/1145136/mobile-id-experiencing-disruptions-friday - [2020-10-06] The Ministry of Justice has made amendments to prevent mass-download of personal data from the public databases of court decisions and court calendars. Already on 2020-05-08, before the amendments were passed, a robot trap unexpectedly appeared on the website of Rigi Teataja without a legal basis. Previously, journalists had mass-processed the data to inform the public about the candidates of Riigikogu and municipality elections that have been criminally sentenced.
https://news.err.ee/1143685/law-change-to-stop-personal-legal-information-remaining-open-data
https://news.err.ee/1116586/reduced-accessibility-of-open-data-would-complicate-courts-work
https://news.err.ee/1115164/ministry-of-justice-wants-to-reduce-accessibility-of-court-data - [2020-10-01] CERT.LV organized the online conference “Cybershock 2020”. Among the participants were Estonians Jaanus Kääp (Clarified Security) and Hans Lõugas (CybExer Technologies).
https://cert.lv/lv/2020/09/technical-online-conference-cybershock-2020
https://www.youtube.com/watch?v=JuzAsFakHec - [2020-09-30] The Ministry of Economic Affairs and Communications has finished a regulation bill which will restrict the use of non-EU telecoms tech in Estonia, including those from Huawei. Initially, these requirements will affect the providers of vital services such as the communication companies, which have at least 10,000 clients – Telia, Elisa, Tele2, Levikom and STV. Huawei says it will challenge the bill. Elisa CEO claims that there is no real risk from Chinese tech and that the ban on Huawei’s equipment will cost Elisa tens of millions of euros.
https://news.err.ee/1117620/elisa-ceo-hits-out-at-ministry-huawei-tech-ban-draft
https://www.mkm.ee/et/uudised/mkm-alustas-sidevorkude-turvalisuse-maaruse-eelnou-avalikku-konsultatsiooni
https://www.err.ee/1142482/uus-sidevorkude-turvakontroll-hakkab-hindama-tootjaid
https://news.err.ee/1143507/huawei-plans-to-challenge-estonia-5g-ban-in-court
https://news.err.ee/1147922/huawei-asks-government-to-review-communications-networks-regulation
https://news.err.ee/1146282/estonia-to-limit-officials-choice-of-network-devices-and-software
https://www.err.ee/1161191/elisa-juht-riigi-analuusi-jargi-maarab-vorguseadmete-valjavahetamise-kulud-kohus - [2020-09-29] Three Romanian nationals were arrested in Romania for being suspected of organizing the Mobile-ID and Smart-ID phishing attacks that started in 2019. The aggregate sum stolen from close to 40 victims totals over €100,000. Estonian police detectives took part in the operation that was carried out in Bucharest. The prosecutor’s office is applying for the suspects to be extradited to Estonia for court proceedings.
https://news.err.ee/1140977/police-apprehend-suspects-in-cyberattacks-against-estonia
https://tehnika.postimees.ee/7073958/rumeenias-peeti-kinni-eesti-vastastes-kuberrunnakutes-kahtlustatavad - [2020-09-29] The procurement of a new Mobile ID solution is in process. An offer was received from two companies: the first applicant is the current partner SK ID Solutions that wants to continue providing the service, but the second applicant is the Belgian company Belgian Mobile ID, which was set up in 2016 by seven mobile operators and banks. The procurement doesn’t constrain technology too much and assesses the proposals individually. The solution must allow the change of crypto algorithms without going to a service office (i.e., remotely). For the enrollment it can support face-to-face identification, digital identification and biometric identification. Suspension of the certificates must not be supported.
https://riigihanked.riik.ee/rhr-web/#/procurement/2063672/general-info
https://riigihanked.riik.ee/rhr-web/#/procurement/2063672/applications
https://twitter.com/ikubjas/status/1297196116358897665
https://forte.delfi.ee/news/digi/belgia-ettevote-tahab-eestile-pakkuda-uut-mobiil-idd?id=91411201
https://forte.delfi.ee/news/digi/id-kaart-ja-mobiil-id-vajavad-uuenduskuuri?id=89736991 - [2020-09-25] A research article by Mihkel Solvak (UT): “Does vote verification work: usage and impact of confidence building technology in Internet voting”. The study finds that: i-vote verifiers are younger males and Linux users with the verification rate especially high in the 18 to 40 age group; voting from abroad clearly leads to more verification; the cast-as-intended verification leads to higher confidence that ones vote was taken into account.
https://link.springer.com/chapter/10.1007/978-3-030-60347-2_14 - [2020-09-18] From August, RIA started monitoring procedures for the implementation of information security measures for all critical databases in Estonia. A total of ten critical databases have been defined: e-file (e-toimik), land register, commercial register, Riigi Teataja information system, land cadastre, state treasury information system, taxpayer register, population register, register of identity documents and state pension insurance register.
https://www.ria.ee/et/uudised/olukord-kuberruumis-august-2020.html - [2020-09-17] The investigative journalism show “Pealtnägija” investigated a scam of fictitious real estate ads targeted at foreign students. While the victims believed that they were transferring money as a deposit for an apartment, they effectively paid an Estonian Bitcoin trader for the scammer’s purchase of bitcoins.
https://news.err.ee/1136558/pealtnagija-foreign-students-falling-victim-to-fictitious-real-estate-ads - [2020-09-17] Government will revoke 10 citizenships acquired illegally as the result of a widespread fraud that was committed during the years of 2013-2015 by a criminal group involving PPA employees. Previously, Estonian citizenship has only been revoked once by a government decision in 2016.
https://news.err.ee/1136097/government-to-revoke-10-citizenships-acquired-illegally - [2020-09-16] A research article by Sven Heiberg (SCCEIV), Kristjan Krips (Cybernetica/UT) and Jan Willemson (Cybernetica/STACC): “Planning the next steps for Estonian Internet voting”. The authors mostly reiterate the discussion points in the report of feasibility of i-voting on smart devices.
https://research.cyber.ee/~janwil/publ/planning.pdf
https://digikogu.taltech.ee/en/Download/38e36fd7-1428-42a1-ac6b-30d561bf849c
https://twitter.com/ikubjas/status/1306178995747250179 - [2020-09-06] A research article by Valentyna Tsap (TalTech), Silvia Lips (TalTech) and Dirk Draheim (TalTech): “Analyzing eID Public Acceptance and User Preferences for Current Authentication Options in Estonia”. The study finds that the ID card is used the most to access e-services; Smart ID holds the second position; username/password and Mobile-ID shares the third choice.
https://link.springer.com/chapter/10.1007/978-3-030-58957-8_12 - [2020-09-01] Kaija Kirch, previously a document expert at the Estonian Police and Border Guard Board (PPA), now works for Cybernetica.
- [2020-08-28] After two years, the court has not yet started to resolve the case of PPA vs Gemalto. In August 2019, a preliminary hearing was held where the possibility of finding a compromise was discussed. However, as of 2020-08-28 no compromise has been reached and both parties have submitted a number of different requests that the court has to resolve.
https://forte.delfi.ee/news/tehnika/politsei-vs-gemalto-kaks-aastat-kohtuveskeid-ja-ei-tuhjagi?id=90871257 - [2020-08-25] CERT-EE identified almost twenty websites that did not check the certificate revocation information when authenticating users with an ID card. In two cases, there was also no check on whether the certificate was signed by SK ID Solutions. This effectively allowed ID card authentication bypass in these services.
https://www.ria.ee/et/uudised/olukord-kuberruumis-juuli-2020.html
https://jarvateataja.postimees.ee/7046443/mitmed-eesti-veebilehed-ei-kontrollinud-autentimisel-sertifikaatide-kehtivust - [2020-08-25] BSc thesis by Sander-Karl Kivivare (UT): “Secure Channel Establishment for the NFC Interface of the New Generation Estonian ID Cards”. The thesis describes the cryptographic protocol that is used to communicate with the Estonian ID card over the contactless interface and provides detailed instructions with code examples in Python, to help software developers create applications that can make use of the new NFC interface introduced in the ID cards issued since December 2018.
https://comserv.cs.ut.ee/ati_thesis/datasheet.php?id=70557&year=2020&language=en
https://github.com/Kivivares/estid-nfc - [2020-08-25] BSc thesis by Jekaterina Gorohhova (UT): “Malicious Android app for security testing”. In the context of this thesis, an Android app was developed to demonstrate how a malicious app with a given set of Android permissions can abuse them to collect personal data stored on a user’s device and then send it out.
https://comserv.cs.ut.ee/ati_thesis/datasheet.php?id=70525&year=2020&language=en - [2020-08-21] RIA has banned the social media app TikTok on all phones belonging to RIA employees and has also recommended the ban to other state institutions. The app is considered a security threat as it is collecting far more information about its users than necessary.
https://news.err.ee/1126180/information-system-authority-in-essence-tiktok-a-security-threat - [2020-08-20] July statistics from the state authentication service TARA show that Smart-ID became the most popular identification tool outperforming the ID card. The number of government agencies using TARA in their e-services is currently between 30-40, but RIA expects it to grow to over a hundred. RIA plans to remove the banklink authentication option from TARA at the end of 2020, as the banks are accessed by the same ID card, Mobile-ID and Smart-ID that are directly supported by TARA as well.
https://forte.delfi.ee/news/digi/smart-id-tousis-koige-populaarsemaks-tuvastusvahendiks-eesti-riigi-e-teenustes?id=90789775 - [2020-08-20] Estonia launched the coronavirus exposure notification app “HOIA” (Keep). The app was created in cooperation with 12 Estonian companies – Cybernetica, Fujitsu Estonia, Guardtime, Icefire, Iglu, Mobi Lab, Mooncascade, Velvet, FOB Solutions, Heisi IT OÜ, Bytelogics and ASA Quality Services OÜ. The development was done at the companies’ own expense. The state only paid for an independent security audit that cost 30,000 EUR. The Data Protection Inspectorate and Chancellor of Justice deems the app suitable as the privacy of its users is protected. RIA also recommends using the app, but notes that the requirement for bluetooth to be constantly on creates additional risks.
https://digi.geenius.ee/rubriik/uudis/aki-peab-eestlaste-koroonaappi-sobilikuks-oiguskantsleri-buroo-jagab-tunnustust/
https://news.err.ee/1125119/feature-estonia-launches-coronavirus-exposure-notification-app-hoia
https://forte.delfi.ee/news/digi/eesti-koroonaapp-maksis-30-000-eurot?id=90849441
https://www.ria.ee/et/uudised/trendid-ja-tahelepanekud-kuberruumis-iii-kvartal-2020.html - [2020-08-14] Research article by Arnis Parsovs (UT): “Estonian Electronic Identity Card: Security Flaws in Key Management”. The article, among other things, provides details about the malpractice of the Estonian ID card manufacturer Gemalto in generating private keys outside the ID card.
https://www.usenix.org/conference/usenixsecurity20/presentation/parsovs - [2020-08-13] Tartu County Court convicted Dennis Einasto of computer fraud that caused nearly €28,500 in damages, of illegally obtaining access to computer systems and of large-scale money laundering. Overall, he was sentenced to 4.5 years in jail. Einasto’s computer contained cryptocurrency and web hosting databases hosting large numbers of usernames and passwords, but which did not belong to him. The cyber crimes were committed on an international scale.
https://news.err.ee/1123315/tartu-county-court-convicts-man-of-cyber-crime-money-laundering - [2020-08-05] The passwords and e-mail addresses of 27,000 users of an unnamed Estonian advertising portal was leaked. The data was accessible for almost a year without the portal being aware of it. The portal has informed users about the leak and the same account data can no longer be used to enter the environment. Although the portal did not inform the Personal Data Inspectorate (AKI) in time, AKI has not yet made a decision on whether supervision proceedings should be initiated.
https://digi.geenius.ee/rubriik/uudis/27-000-eestlase-paroolid-lekkisid-portaal-kuulis-lekkest-aasta-parast-selle-toimumist/ - [2020-07-28] Due to a human error, the Ministry of Justice made a report in their document register public that contaied personal data of approximately 1000 people who sought legal advice. The information listed names and the reason the person had obtained legal aid. The Ministry of Justice has not informed the affected persons about the leak as this would have meant further processing of the data, which was intended to be avoided. According to the ministry, the article published by the media is enough.
https://www.err.ee/1117570/justiitsministeerium-jattis-avalikuks-oigusabi-saanud-inimeste-andmed
https://news.err.ee/1117589/justice-ministry-glitch-leaks-legal-aid-personal-data-online
https://news.err.ee/1129734/ministry-of-justice-has-not-informed-people-of-data-breach - [2020-07-27] BSc thesis by Silver Maala (UT): “A Proof of Concept Malware for Interacting with the Smart-ID Android Application”. The thesis presents a proof-of-concept Android malware that can take over the Smart-ID app running on a rooted Android device.
https://comserv.cs.ut.ee/ati_thesis/datasheet.php?id=69678&year=2020
https://digi.geenius.ee/rubriik/uudis/loputoo-pahavaraga-saab-varastada-smart-id-pin-koode-ja-neid-automaatselt-sisestada/ - [2020-07-23] The National Audit Office has published the audit report “Effectiveness of the e-Residency programme”. The report finds that foreigners with a criminal background and/or business ban have become e-Residents, as PPA does not have the capability to perform sufficient background checking for foreigners. Another noteworthy finding is that only 10% of e-Residents have renewed their digital IDs after expiration.
https://news.err.ee/1117934/audit-criminals-have-become-e-residents-better-background-checks-needed
https://www.err.ee/1117824/riigikontroll-kriminaalid-saavad-liialt-lihtsalt-eesti-e-residendiks
https://www.err.ee/1118255/ott-vatter-kahtlase-paritoluga-e-residentide-suhtarv-on-vaga-vaike
https://mkm.ee/et/uudised/valiskaubandus-ja-it-minister-varske-audit-selge-kinnitus-e-residentsuse-programmi
https://www.err.ee/1118243/ministeerium-eesti-teeb-koik-et-e-residentsust-ei-saaks-ohtu-kujutavad-valismaalased - [2020-07-23] The Ministry of the Interior proposed a bill that would give law enforcement organizations backdoor access to encrypted messaging applications. The idea faced sharp criticism and later the Ministry of Justice rejected the proposal due to the lack of a thorough analysis of the consequences.
https://news.err.ee/1116325/interior-ministry-looking-for-backdoor-into-encrypted-messaging-apps
https://www.err.ee/1115645/siseministeerium-soovib-krupteeritud-sonumirakendustesse-tagaust
https://www.err.ee/1116295/kuberoiguse-ekspert-tagauste-lubamine-muudaks-eesti-digiriigi-aluseid
https://digi.geenius.ee/rubriik/uudis/vandeadvokaat-turk-tagaust-toetavad-inimesed-ei-saa-tegelikult-aru-mida-nad-soovivad/
https://digi.geenius.ee/rubriik/uudis/eesti-e-riigi-endine-peaarhitekt-tehniliselt-ei-ole-voimalik-tagada-et-tagauksest-tulevad-sisse-ainult-oilsad/
https://www.err.ee/1116665/peeter-p-motskula-tagauksega-kruptoside-rumal-ja-oigusvastane-idee
https://www.err.ee/1116669/rainer-ratnik-neli-pohjust-miks-tagaukse-lubamine-pole-moistlik
https://www.err.ee/1127157/kaimar-karu-kuberturbeteatri-kordusetendus
https://www.err.ee/1149441/mkm-tahaks-turvakaalutlustel-keelata-isikustamata-konekaardid
https://twitter.com/ikubjas/status/1295653952554438656
https://twitter.com/ikubjas/status/1329455387683250179 - [2020-07-21] The government has made amendments to the “Statutes of the Health Information System” allowing the authentication of subjects using “ID card, Mobile-ID, Smart-ID or other equivalent device”. Historically, access to the Health Information System has only been granted based on authentication using the ID card. The security requirements have likely been relaxed due to the pressing coronavirus situation.
https://www.riigiteataja.ee/akt/118072020004 - [2020-07-21] Kert Kingo (EKRE), a member of the Riigikogu’s Legal Affairs Committee, explained why EKRE is so worried about i-voting. According to her, the distrust is created by the fact that it is possible to give an i-vote using another person’s ID card and that i-voting data is destroyed immediately after the elections.
https://uueduudised.ee/uudis/eesti/miks-erke-e-valimiste-parast-nii-palju-muretseb-kert-kingo-sest-need-tekitavad-usaldamatust/ - [2020-07-10] Research article by Kaido Kikkas (TalTech) and Birgy Lorenz (TalTech): “Training Young Cybersecurity Talents – The Case of Estonia”. The paper describes the Estonian experience with the CyberOlympics/CyberSpike program from 2017–2019 and reflects on the lessons learned about talent building in cybersecurity.
https://link.springer.com/chapter/10.1007/978-3-030-50729-9_36 - [2020-07-07] Research article by Laura Kask (UT/Proud Engineers) and Kristiina Laanest (RIA): “Determining the Time of Electronic Signing: Legal Requirements and Technological Possibilities”. The authors suggest establishing the time from the timestamp as the time of signing, but fail to address the issues raised in the original article “Time of signing in the Estonian digital signature scheme” by T.Mets and A.Parsovs.
https://www.juridica.ee/article.php?uri=2020_4_elektroonilise_allkirjastamise_aja_tuvastamine_iguslikud_n_uded_ja_tehnilised_v_imalused
https://www.id.ee/wp-content/uploads/2020/10/j_20_4_294.pdf
https://cybersec.ee/timesign/ - [2019-12-19] A research paper by Abasi-amefon Affia (UT): “Assessing the NFC Unlock Mechanism of the Tartu Smart Bike Share System”. The paper describes a flaw in the Tartu Smart Bike Share System that can be exploited to create a clone of a victim’s Tartu bus card, which can then be used to unlock the bikes. To create the clone, only the card number printed on the victim’s Tartu bus card is needed (valid numbers can be guessed). The flaw has now been partially mitigated as cloning is still possible, but the task is not that trivial.
https://kodu.ut.ee/~arnis/bikeshare_nfc.pdf