- [2021-08-13] Starting August 23, the Estonian identity cards will be issued containing the ePassport applet that will contain the cardholder’s photo and fingerprints. The residence permit cards have been issued with the ePassport applet already since 2011. The ePassport applet will not be installed on the digital identity cards, the e-resident’s digital identity cards and the diplomatic identity cards. The introduction of the ePassport applet on identity cards is required by an EU regulation.
https://news.err.ee/1608306396/fingerprint-recognition-to-be-added-to-new-id-cards
https://www.riigiteataja.ee/akt/114082021001 - [2021-08-11] Mauno Pihelgas (TalTech) defended his PhD thesis “Automating Defences against Cyber Operations in Computer Networks”.
https://digikogu.taltech.ee/en/Item/beb3e841-9c6e-4496-a73a-17148bc941ef - [2021-08-09] The procurement for the next-generation SIM-less Mobile-ID solution has taken longer than originally planned. The winner should be announced in September and the new solution should be operational from July 1, 2022. The current Mobile-ID contract with SK has been extended by half a year.
https://news.err.ee/1608301968/state-hoping-to-introduce-new-solution-to-replace-mobile-id
https://digi.geenius.ee/rubriik/uudis/uudse-mobiil-id-riigihange-on-veninud-voitja-peab-lahenduse-saama-valmis-vaid-loetud-kuudega/
https://digi.geenius.ee/rubriik/uudis/uudse-mobiil-id-riigihange-on-veninud-voitja-peab-lahenduse-saama-valmis-vaid-loetud-kuudega/ - [2021-08-08] A group of local cyber security enthusiasts are organizing the BSides Tallinn conference with a program committee consisting of well know Estonian cyber security experts. The conference is planned to take place on October 7 in Tallinn.
https://digi.geenius.ee/eksklusiiv/infoturbe-eksperdid-korraldavad-tallinnas-uritust-kuhu-oodatakse-valdkonna-esindajaid-sudant-puistama/
https://tallinn.bsides.ee/ - [2021-08-07] The Data Protection Inspectorate (AKI) has stated that identification check of a person showing a vaccination certificate is allowed only if there is reasonable doubt. For example, if there are obvious discrepancies – the name of the certificate is of the opposite sex, the person’s appearance does not match the date of birth, and so on. Also, the applications used to verify vaccination certificates should not store or forward the data to third-parties. The Minister of Health and Labor suggested the inspection of vaccination certificate only “visually” as it is assumed that most people who live in Estonia are honest.
https://news.err.ee/1608300642/aki-personal-data-must-be-protected-when-checking-covid-19-certificates
https://news.err.ee/1608293448/kiik-vaccination-certificates-will-usually-not-be-scanned - [2021-08-05] RIA has proposed an idea to enable a vaccination status lookup using the document number of the cardholder’s ID card. This would effectively make a person’s vaccination status public, as the document number of a cardholder’s ID card cannot be considered secret. The Health and Welfare Information System (TEHIK) is looking into the legal side of this solution.
https://news.err.ee/1608298248/id-cards-could-be-used-as-vaccination-certificates - [2021-07-29] The web app kontroll.digilugu.ee created to check COVID certificates provides a misleading status response, as it verifies only the authenticity of the certificate and not whether the COVID certificate satisfies legal requirements (e.g., whether test results are not outdated). Currently, the certificate’s compliance to legal requirements have to be inspected manually.
https://digi.geenius.ee/rubriik/uudis/koroonapassi-apis-on-suur-puudus-riik-ei-tea-millal-see-ara-parandatakse/ - [2021-07-28] Geenius journalist Ronald Liive proposes the introduction of a state-level bug bounty program to motive white hat hackers to report vulnerabilities.
https://digi.geenius.ee/rubriik/uudis/ronald-liive-kui-eesti-tahab-tugeva-e-riigi-mainet-hoida-siis-leitakse-otsejoones-raha-heade-hakkerite-premeerimiseks/ - [2021-07-28] A hacker exploited a vulnerability in RIA’s service that allows people to download their document photos using the DigiDoc client. As a result, facial photos of 286,438 persons have been downloaded. The flaw allowed unauthorized retrieval of document photos by sending queries using a fake ID card certificate containing the document holder’s personal identification code. The queries were made from 9,000 different domestic and foreign IP addresses routed through a malware network. The flawed solution was created several years ago. The police has temporarily detained an Estonian citizen, a resident of Tallinn, whose computer was used to download the photos. The downloaded data has been confiscated and the police believes that the data was not transmitted further. The mass download of photos was detected after SK ID Solutions notified RIA of an abnormal number of (OCSP?) queries. The persons whose document photo was downloaded received a notification to their @eesti.ee email addresses. If the leak caused damage, the person can ask RIA for compensation. In RIA’s opinion no damage could have been caused. The government gave RIA 500,000 euros to improve the security of their legacy services.
https://news.err.ee/1608291072/hacker-downloads-close-to-300-000-personal-id-photos
https://www.ria.ee/en/news/police-and-border-guard-board-and-information-system-authority-stopped-illegal-downloading-data.html
https://www.ria.ee/en/news/further-explanation-information-system-authority-ria-data-theft.html
https://news.err.ee/1608294000/ak-ria-unlikely-to-be-fined-over-mass-photo-hack-victims-not-compensated
https://news.err.ee/1608306519/government-sets-aside-500-000-to-update-state-portal-following-july-hack
https://www.err.ee/1608290994/kuberrundaja-laadis-alla-ligi-300-000-dokumendifotot
http://cybersec.ee/storage/20210729_PPA_dokumendifoto_ebaseadusliku_allalaadimise_kohta.eml
https://digi.geenius.ee/eksklusiiv/e-valimiste-ja-lekkinud-dokumendifotode-infosusteemid-vastavad-samale-turvastandardile/
https://digi.geenius.ee/eksklusiiv/ria-juht-dokumendifotosid-varastanud-isik-uritas-radari-alt-labi-libiseda-see-onnestus-tal-suhteliselt-hasti/
https://digi.geenius.ee/rubriik/uudis/riigiportaalis-on-sadakond-komponenti-mille-turvalisuse-kohta-on-riigil-kusimusi/ - [2021-07-24] The number of banking scams is growing. This year already more than 800,000 euros have been lost. If last summer there were 25-30 such cases in one month, then this year there are already more than 50 in one month.
https://www.err.ee/1608287943/telefonipetturite-ohvrite-arv-on-kasvuteel
https://www.err.ee/1608258774/viie-kuuga-on-petukonedega-kaotatud-ule-kahe-miljoni-euro
https://raha.geenius.ee/rubriik/uudis/kelmuse-ohvrid-saavad-tagasi-ule-34-000-euro/
https://www.err.ee/1608188950/pangakelmid-on-inimestelt-valja-petnud-ule-miljoni-euro
https://news.err.ee/1608158017/people-taken-to-the-cleaners-over-the-phone-and-on-dating-websites - [2021-07-22] Gert Auväärt became RIA’s director of the Cyber Security Branch. Lauri Aasmann, the current director of the Cyber Security Branch, will continue as an advisor to the Director General.
https://www.ria.ee/en/news/july-gert-auvaart-will-become-director-cyber-security-branch-information-system-authority.html - [2021-07-21] AS Morrison Invest (morrison.ee) approached the Data Protection Inspectorate (AKI) questioning the legality of kv.ee showing the name of real estate agents for advertisements posted on behalf of legal entities. AKI found it to be in line with good practice, but in turn found that the website morrison.ee that collects personal data does not use an HTTPS connection, the visitor is not informed about the use of Google Analytics cookies, and thirdly, the site does not have the required data protection conditions. AKI issued a precept requesting that these deficiencies be eliminated.
https://digi.geenius.ee/rubriik/uudis/kurioosne-juhus-portaali-tegevuse-kohta-kusimusi-esitanud-kinnisvarafirmal-terendab-kuni-20-miljoni-euro-suurune-sunniraha/
https://aastaraamat.prokuratuur.ee/prokuratuuri-aastaraamat-2020/kuberkuritegevuse-okosusteem-muutunud-teenusepohiseks - [2021-07-21] Estonian citizen Pavel Tsurkan (33) was extradited to the US where he pled guilty for building a botnet of more than 1000 routers and allowing his criminal clients to use them as proxies routing their malicious internet traffic through the compromised routers. He also pled guilty in a second case for operating the Crypt4U service since 2013 that allowed criminals to obfuscate their malware. The Estonian national faces two 10-year prison sentences.
https://www.justice.gov/usao-ak/pr/estonian-citizen-pleads-guilty-computer-fraud-and-abuse
https://ekspress.delfi.ee/artikkel/92169861/koroonaviirus-ei-paasta-eesti-kodanikku-valjaandmisest-usa-le - [2021-07-15] Cybernetica has completed the analysis of implementing facial recognition in the Estonian i-voting. The analysis points out problems with false negatives, the requirement for high quality video cameras, privacy issues related to the fact that the captured video may contain other persons and a voter’s home interior, and points out a list of legal challenges. The report concludes that facial recognition is still in its infancy and should be first piloted within other public services.
https://www.ria.ee/en/news/implementation-biometrics-e-voting-requires-prolonged-testing.html
https://www.ria.ee/sites/default/files/content-editors/publikatsioonid/biomeetria-aruanne.pdf - [2021-07-15] A Geenius journalist had a look at the mysterious information system SITIKAS created by the State Situation Center. The system is meant to help decision makers and almost 2.8 million euros have been spent on its development. The system uses mostly publicly available information, but the content of the system is classified. Allegedly, the system generates various reports and uses machine learning and neural networks.
https://digi.geenius.ee/eksklusiiv/esimest-korda-avalikkuse-ees-salaparane-infosusteem-sitikas-aitab-peaministril-paremaid-otsuseid-teha/ - [2021-07-13] The Data Protection Inspectorate (AKI) has reprimanded the Health Board for its official contacting TalTech to ask whether one of the Health Board employees studies in TalTech. TalTech disclosed the information over phone without identifying the questioner and without the legal basis.
https://digi.geenius.ee/rubriik/uudis/uus-skandaal-terviseametis-osakonnajuhataja-nuhkis-tootaja-jarel-kes-hiljem-koondati/
https://digi.geenius.ee/rubriik/uudis/terviseametist-koondatud-ametnik-tegu-on-sustemaatilise-tookiusamisega/ - [2021-07-13] For DDOC signatures that have been timestamped after 2018-07-01, the ID software will show a warning “The signature is valid (with a warning)”. Signatures in DDOC format use the outdated SHA-1 hash function whose collision resistance was practically broken in February 2017 and hence any DDOC signatures created since then could be challenged.
https://www.ria.ee/en/news/new-version-id-card-software-will-change-status-ddoc-signatures.html
https://www.ria.ee/et/uudised/id-kaardi-tarkvara-uus-versioon-muudab-ddoc-allkirjade-staatust.html - [2021-07-09] RIA has closed an information leak in the state portal eesti.ee, where personal data of 336,733 people could be accessed. The data contained the first and last names, personal identification codes, places of work and, in some cases, links to previous positions. The leak was in the self-service environment that gave representatives of companies the right to manage the access rights of their employees. The leak was part of the intended functionality that was introduced about ten years ago when the approach to data protection and privacy was different than today. The issue was reported by an attentive user. RIA has no information on whether anyone had saved the data.
https://www.ria.ee/en/news/data-more-300000-people-were-available-state-portal.html
https://digi.geenius.ee/rubriik/uudis/riigiportaalis-olid-kattesaadavad-ule-300-000-inimese-andmed/ - [2021-07-01] Personal data of 96 drone pilots was visible in the website of the Transport Agency for two hours. The personal data contained the pilots’ home addresses, phone numbers, e-mail addresses and personal identification numbers. Due to the leak, the registration numbers issued to the pilots will be replaced. Piksel OÜ developed the flight safety monitoring information system (LOIS). The security of the system was tested, but the flaw was detected only after the information system went into production.
https://digi.geenius.ee/rubriik/uudis/ameti-vea-tottu-paases-iga-huviline-ligi-droonilennutajate-andmetele/
https://digi.geenius.ee/rubriik/uudis/transpordiameti-leke-puudutas-pea-sadat-droonilennutajat-juhtunust-informeeriti-andmekaitse-inspektsiooni/ - [2021-06-29] MKM is using the EU structural funds to produce 60 thematic biographical video interviews to document the history of the Estonian digital state. The plan is to collect the memories and knowledge of the birth and formation of the digital state, including the development of eID, i-voting and cyber security. The work will be completed in the beginning of 2022.
https://mkm.ee/et/uudised/eesti-riik-hakkab-talletama-digiriigi-ajalugu - [2021-06-29] The UT computer science BSc student Peeter Vahe in his BSc research discovered a race condition flaw in the Tartu Smart Bike Share system, which allows a user to unlock 2 bikes at once using a single account.
https://www.youtube.com/watch?v=2tKBlegvGXY
https://comserv.cs.ut.ee/ati_thesis/datasheet.php?id=71618&year=2021&language=en - [2021-06-18] The Supreme Court decided that the procedure for storage and use of communications metadata is in conflict with the law of the EU and therefore the state cannot request this data for criminal investigations. The EU law forbids retaining the communication data of all users without distinction, regardless of whether they have any connection with serious crime (the current practice of the Electronic Communications Act). This decision will affect the proceedings where phone logs are the most substantial evidence. The Ministry of Justice is looking for a solution to agree on some kind of a new metadata keeping obligation.
https://www.isoc.ee/nuhkimishaav-sonavabaduse-sudames/
https://www.riigikohus.ee/et/uudiste-arhiiv/riigikohus-riik-ei-saa-sidefirmade-kogutud-andmeid-kuritegude-uurimiseks-valja-nouda
https://news.err.ee/1608251514/supreme-court-state-cannot-demand-telephone-communication-data
https://forte.delfi.ee/artikkel/93776527/riigikohus-keelas-riigil-sidefirmade-andmeid-kuritegude-uurimiseks-valja-nouda
https://news.err.ee/1608252387/prosecutor-supreme-court-phone-data-decision-may-stop-some-proceedings
https://news.err.ee/1608253017/samost-ja-sildam-supreme-court-communications-call-points-to-problems
https://www.err.ee/1608251964/vaher-sideandmeteta-laheb-kuritegude-uurimine-keerulisemaks
https://news.postimees.ee/7278096/interior-ministry-solving-some-crimes-will-become-impossible
https://news.err.ee/1608266760/justice-ministry-looking-for-ways-to-use-communications-data - [2021-06-16] Kaie Maennel (TalTech) defended her PhD thesis “Advancing Cybersecurity Education through Learning Analytics”.
https://digikogu.taltech.ee/en/Item/d01c0b17-3b4b-41c5-ae24-e75b6128a183 - [2021-06-15] An MSc thesis defended at UT brought to light a security risk concerning signing documents with an ID card via a browser. More specifically, the fact that the signatories are not able to see what exactly the service provider is asking them to sign. The thesis provides the implementation of two solutions. RIA is looking to introduce a solution as well.
https://digi.geenius.ee/eksklusiiv/eesti-id-kaardil-on-kogu-aeg-olnud-allkirjastamisel-turvarisk-mida-selle-aastani-ei-peetud-oluliseks/
https://comserv.cs.ut.ee/ati_thesis/datasheet.php?id=72487&year=2021&language=en - [2021-06-15] A bill has been passed to create a central biometric database ABIS for storing facial images and fingerprints, as currently such data is scattered between several databases. No new data will be collected. The bill has raised concerns regarding cross use of biometric data, as it would allow fingerprints and facial images collected for identification purposes (when applying for an identity document) to be used in criminal proceedings. However, it turns out that since 2012 identity documents database has been used in criminal investigations. While it was possible to compare fingerprints against all fingerprints in the database, ABIS plans to provide the technological capability to match a person’s facial image against facial images stored in the database.
https://news.err.ee/1608162490/estonia-to-create-database-for-biometric-identification-system
https://news.postimees.ee/7272664/abis-holds-uncertainty-for-the-future
https://news.err.ee/1608241671/ekre-stalls-riigikogu-s-work-over-personal-identification-database-bill
https://news.err.ee/1608250773/interior-minister-right-to-decide-over-use-of-data-can-be-discussed
https://news.err.ee/1608260931/kaljulaid-promulgates-abis-cross-use-of-data-law
https://www.err.ee/1608247482/oiguseksperdid-naevad-probleemi-abis-e-info-ristkasutuses
https://www.err.ee/1608250389/uno-lohmus-abis-kui-pohiseaduslik-probleem
https://www.err.ee/1608262158/oiguskantsler-naeb-abis-es-mitut-tosist-probleemi
https://www.err.ee/1608261951/helme-inimesed-voiksid-kohtus-nouda-oma-andmete-kustutamist-abis-est
https://www.err.ee/1608240822/jaani-abis-e-eelnou-kooskolastas-siseminister-mart-helme - [2021-06-14] Cyber Security Summer School 2021 took place during June 14-16 in virtual format. The focus of this year’s summer school was on real-world internet voting systems.
https://www.cs.ut.ee/en/news/international-cyber-security-summer-school-focuses-online-voting-technologies-around-world
https://studyitin.ee/c3s2021 - [2021-06-11] The Transport Administration is developing a database in which private parking lots from Helsinki and Riga can obtain personal data of car owners registered in Estonia. The Estonian vehicle owner database has now been opened to Estonia’s private parking lots for imposing fines.
https://news.err.ee/1608243435/parking-tickets-from-nearby-countries-will-soon-find-their-estonian-owners - [2021-06-04] The President of Estonia, Kersti Kaljulaid awarded ENISA’s Executive Director, Juhan Lepassaar, the Order of the White Star, 3rd Class state decoration for advancing EU cybersecurity.
https://news.err.ee/1608120073/president-awards-152-state-decorations
https://nitter.eu/enisa_eu/status/1400819371409297411 - [2021-06-03] MSc thesis by Taavi Turu (TalTech): “The Role of Co-production in National Cyber Security and Cyber Resilience of Critical Infrastructures: the Case of Estonian Defence League’s Cyber Unit”
https://digikogu.taltech.ee/en/Item/b32ff254-b558-4571-8fc9-7127b1c5f408 - [2021-06-02] A new Estonian information security standard (E-ITS) has been compiled to replace the voluminous information security standard ISKE. The standard contains data on security threats and provides measures for public sector authorities.
https://www.ria.ee/en/news/ria-has-compiled-information-security-guidebook-public-sector.html
https://eits.ria.ee/ - [2021-06-02] RIA organized a seminar “Cyber Security in Estonia 2021” in English. Presentations by Gert Auväärt, Tõnu Tammer, Perit Kirkmann, Mark Erlich, Lauri Tankler and Märt Hiietamm are available in RIA’s youtube channel.
https://www.youtube.com/playlist?list=PLNPWRftK1TNr0A3WrxK05IOVCaDlsf6nh - [2021-05-31] Due to a database error, the health information system was not available for more than two and a half hours in the middle of the working day.
https://www.err.ee/1608230814/tervise-infosusteem-oli-esmaspaeval-tehnilise-vea-tottu-paar-tundi-maas
https://www.ria.ee/et/uudised/olukord-kuberruumis-mai-2021.html - [2021-05-28] Arnis Parsovs (UT) has published “Security Analysis of RIA’s Authentication Service TARA”. The analysis finds that the TARA protocol might be susceptible to man-in-the-middle and phishing attacks.
https://cybersec.ee/storage/20210528_tara_analysis.pdf
https://digi.geenius.ee/rubriik/uudis/loputoos-leiti-mitu-kohta-kuidas-riiklikku-autentimisteenust-veel-turvalisemaks-muuta/ - [2021-05-26] The TV investigative program Pealtnägija has published materials and insights from the “passport mafia Marika” criminal case of running an illegal document business with insiders from PPA. A trap was set up with the help of a secret agent who was interested in a document. Video footage and other materials from covert police surveillance activities are demonstrated.
https://www.err.ee/1608225496/salajased-kaadrid-pealtnagijas-ulatuslik-passiari-toimis-kui-kellavark - [2021-05-21] Following a scheduled maintenance at SK ID Solutions, the issuance of Mobile-ID and Smart-ID certificates were disrupted.
https://news.err.ee/1608220819/issuing-of-digital-id-verification-services-encounters-glitches-friday
https://news.err.ee/1608221635/smart-id-and-mobile-id-new-registrations-back-online
https://digi.geenius.ee/rubriik/uudis/mobiil-idd-vaevavad-teist-paeva-jarjest-probleemid/
https://digi.geenius.ee/rubriik/uudis/ria-soovib-hiljutiste-mobiil-id-ja-id-kaardi-katkestuste-kohta-lisainfot/
https://www.skidsolutions.eu/en/News/mobile-id-and-smart-id-services-were-interrupted/ - [2021-05-15] An Estonian accounting software company fell victim to a ransom attack and through it the attackers gained access to the systems of one of the Lääne County rural municipality governments. The attack was discovered by CERT-EE before the attackers were able to cause damage.
https://www.ria.ee/et/uudised/olukord-kuberruumis-mai-2021.html
https://www.ria.ee/et/uudised/mais-runnati-it-teenusepakkujat-ning-jouti-seelabi-tema-kliendini.html
https://forte.delfi.ee/artikkel/93831843/juhtub-ka-eestis-runnak-digiteenusepakkujale-joudis-selle-kliendini-valja - [2021-05-13] RIA refuses to disclose how many sessions at once the authentication service TARA can handle, as this would reveal too much of the e-Estonia capability to potential attackers. TARA has been used up to 150,000 times a day.
https://digi.geenius.ee/eksklusiiv/kui-palju-paaseb-korraga-e-valima-riigiportaali-voi-patsiendiportaali-amet-salatseb-ja-ei-tee-infot-avalikuks/ - [2021-05-13] A court in the US convicted 3 IT specialists that were residing in Estonia for providing bulletproof hosting services to cyber criminals from 2009 to 2015.
https://news.postimees.ee/7247575/estonia-s-it-talents-sold-international-services-to-cybercriminals
https://www.justice.gov/opa/pr/four-individuals-plead-guilty-rico-conspiracy-involving-bulletproof-hosting-cybercriminals
https://therecord.media/botnet-operator-who-proxied-traffic-for-other-cybercrime-groups-pleads-guilty/
https://news.err.ee/1608213967/daily-estonia-based-cyber-criminals-active-for-years-to-face-us-trial
https://news.postimees.ee/7247575/estonia-s-it-talents-sold-international-services-to-cybercriminals - [2021-05-12] There is a plan to amend the Public Information Act that would allow for the classification of documents to last indefinitely. Currently, the access restriction limit for classified documents “information intended for internal use” (AK) is five years. This limit can be extended by another five years to a total maximum of 10 years.
https://news.err.ee/1608210079/defense-minister-documents-should-not-be-classified-for-over-10-years - [2021-05-11] The Data Protection Inspectorate (AKI) has released the 2020 yearbook.
https://aastaraamat.aki.ee/sites/default/files/aastaraamatud/aastaraamat_2020.pdf - [2021-05-05] The Estonian Digital Society Development Plan 2030 has been released. One of the areas is national cyber security. Among the plans is to: improve the personal data tracker service; develop the possibility to get all the data stored in the country from the state portal; create a national eID that is free of physical media; update the national cyber security governance model to clarify roles, responsibilities and tasks of organizations; increase the capacity of academic institutions and development centers to implement nationally important cyber security R&D projects.
https://news.err.ee/1608202027/it-minister-requesting-feedback-on-future-of-digital-society
https://mkm.ee/et/uudised/it-minister-saatis-konsultatsioonile-digiuhiskonna-tulevikuvisiooni-eesti-tais-digivage - [2021-05-03] Liisa Past (former employee of Cybernetica and RIA) has started working as an information security manager (CISO) at the Information Security Department of the Information Technology and Development Center (SMIT) of the Ministry of the Interior.
https://www.smit.ee/et/uudised/smiti-infoturbejuhina-alustas-toeoed-liisa-past-97 - [2021-04-27] Over the last couple of years, most of the security testing procurements have been won by the company Clarified Security OÜ. Last year, procurements for up to 2 million and 3.5 million euros were won. Paevaleht looked at the similarities of the procurement specifications and discussed the need to introduce mandatory rotation of security testers.
https://epl.delfi.ee/artikkel/93253019/koik-munad-uhes-korvis-suure-osa-e-riigi-turvatestimise-hankeid-voidab-uksainus-ettevote
https://www.ria.ee/sites/default/files/content-editors/kuberturve/kuberturvalisuse_aastaraamat_2021_eng_final.pdf - [2021-04-22] Äripäev has published a special issue “Cyber security 2021” covering a variety of cyber security related topics: cyber hygiene, i-voting, cybercrime, training of cyber experts and other topics.
https://www.aripaev.ee/lisa/2021/04/22/kuberturvalisus-22042021 - [2021-04-22] Due to a hardware failure, the state authentication service TARA was not available for 45 minutes, as a result of which it was not possible to log into any service that uses TARA.
https://www.ria.ee/et/uudised/olukord-kuberruumis-aprill-2021.html - [2021-04-15] The government introduced a draft legislation to strengthen rules for assessing eID system trustworthiness and delimiting institutional responsibilities. In addition, RIA will be able to check whether providers of public e-services fulfill the obligation of recognizing international eID solutions arising from the eIDAS regulation.
https://news.err.ee/1608178582/government-endorses-regulation-updates-to-e-identification - [2021-04-13] Due to a software error, the digital prescription service was not available for almost 7 hours.
https://www.ria.ee/et/uudised/olukord-kuberruumis-aprill-2021.html - [2021-04-09] Arnis Parsovs (UT) defended his PhD thesis “Estonian Electronic Identity Card and its Security Challenges”.
https://dspace.ut.ee/handle/10062/71481
https://www.uttv.ee/naita?id=31267
https://blog.cs.ut.ee/2021/04/07/phd-thesis-shows-that-id-card-issues-reoccur-because-they-are-not-learned-from/
https://digi.geenius.ee/rubriik/uudis/riik-valjastas-uheksa-aasta-jooksul-ule-miljoni-vigase-id-kaardi/ - [2021-04-07] The Mobile-ID and Smart-ID phishing attackers who were detained in Romania last September, sent emails to 100,000 Estonians and managed to steal money from the accounts of nearly 40 people in the total amount to more than 100,000 euros.
https://digi.geenius.ee/rubriik/uudis/rumeenias-tabatud-kuberpattide-ohvriks-langes-ligi-40-eestlast-kahju-ule-100-000-euro/
https://www.ria.ee/sites/default/files/content-editors/kuberturve/kuberturvalisuse_aastaraamat_2021_eng_final.pdf - [2021-04-07] RIA released the yearbook “Cyber Security in Estonia 2021”. Some of the covered topics: DDoS ransom attacks, ransomware attacks, phishing attacks, E-ITS security standard, DigiTest cyber hygine training platform, cyber diplomacy, 5G security.
https://news.err.ee/1608168793/ria-yearbook-cyber-criminals-took-advantage-of-covid-19-fears
https://www.ria.ee/en/news/new-yearbook-information-system-authority-ria-cyber-security-summarises-most-influential.html
https://www.ria.ee/sites/default/files/content-editors/kuberturve/kuberturvalisuse_aastaraamat_2021_eng_final.pdf - [2021-04-05] Based on a precept issued by the Technical Supervision Authority (TTJA), Zone Media OÜ blocked access to the websites koroonavabaeesti.ee and kloordiioxidiinfokeskus.ee, which were used to spread misinformation about the anti-COVID drug. The websites were registered by a private person and used the web hosting service of Zone Media OÜ.
https://digi.geenius.ee/eksklusiiv/terviseamet-tahab-blokeerida-ligipaasu-eesti-veebilehtedele-mis-jagavad-koroonaviiruse-kohta-valeinfot/
https://digi.geenius.ee/rubriik/uudis/tarbijakaitseameti-mahitusel-peatati-ligipaas-lehele-mis-vaitis-et-koroonat-saab-ravida-mmsiga/
https://digi.geenius.ee/rubriik/uudis/veebimajutaja-zone-uurib-kuidas-piirata-ligipaasu-teiselegi-vaarinfot-levitavatele-veebilehele/
https://digi.geenius.ee/rubriik/uudis/zone-sulges-ttja-ettekirjutusel-mmsi-koroonaravimina-reklaaminud-veebilehe/ - [2021-04-04] Personal data of 533 million Facebook users leaked online. The leak contains personal data of 87,533 users from Estonia. The data includes their phone numbers, Facebook IDs, full names, locations, birthdates, bios, and (in some cases) email addresses. The dataset was collected by crawling the data made public by users themselves.
https://www.theverge.com/2021/4/4/22366822/facebook-personal-data-533-million-leaks-online-email-phone-numbers
https://tehnika.postimees.ee/7220357/facebook-suudistab-kasutajaid-selles-et-nende-andmed-hakkerite-katte-sattusid
https://www.ria.ee/et/uudised/olukord-kuberruumis-aprill-2021.html - [2021-03-31] The government approved an amendment enabling automatic forwarding of a person’s @eesti.ee mailbox to their contact information in the population register. The population register has almost every person’s contact information (email address and phone number) as it is collected, for instance, when applying for an identity document. Before this change, around 413,000 people of 1.3 million had manually enabled forwarding for their @eesti.ee address. The opt-out in @eesti.ee forwarding was introduced after many elderly people missed invitations to be vaccinated.
https://www.ria.ee/en/news/state-will-link-persons-eestiee-mailbox-their-contact-information-population-register.html
https://www.ria.ee/en/news/information-system-authority-forwarded-state-portal-mailboxes.html
https://news.err.ee/1608146752/people-s-contact-information-to-be-used-to-send-eesti-ee-notifications
https://digi.geenius.ee/rubriik/uudis/karm-kusimus-mis-on-eesti-ee-meiliaadressi-mote-ja-kas-seda-on-uldse-vaja/
https://digi.geenius.ee/rubriik/uudis/eesti-ee-meiliaadressi-on-sel-kuul-ara-suunanud-ligi-16-000-inimest/ - [2021-03-31] E-residency background checks will become more thorough. New data sought from applicants includes information about misdemeanor proceedings initiated against the applicant, prohibition on business as well as bank accounts owned by the applicant or their businesses. To improve user friendliness, PPA has created a new self-service environment for e-residents at https://eresident.politsei.ee.
https://news.err.ee/1608161419/e-residency-background-checks-to-become-more-thorough - [2021-03-26] The Latvian Data Protection Inspectorate did not apply sanctions to the company responsible for the e-shop charlot.ee database leak in which personal data of 14,000 Estonians was made publicly available. According to the Latvian inspectorate, they learned about the personal data of only 168 Latvians being compromised. The Estonian Data Protection Inspectorate (AKI) now regrets not initiating proceedings, as Charlot OÜ had appointed Estonia as the data controller and hence the server’s location in Latvia should not have played a role.
https://digi.geenius.ee/rubriik/uudis/aki-todeb-et-nad-eksisid-eesti-uhe-suurima-andmelekke-menetlemisel/
https://digi.geenius.ee/rubriik/uudis/latlased-ei-algatanud-eesti-ajaloo-suurima-andmelekke-osas-jarelevalvemenetlust/ - [2021-03-19] The attackers who downloaded 350GB of data from government servers last November used the security testing tool Acunetix to discover the .git catalogue which had remained public by accident. By using information in the .git catalogue, the attackers were able to upload malicious code and gain access to the servers. The same scanning pattern has been observed lately against companies in the private sector. RIA has purchased a license to the Acunetix tool and is offering it to the public sector.
https://digi.geenius.ee/rubriik/uudis/hakkerid-leidsid-uue-sihtmargi-eesti-ettevotted-mis-teevad-riigiga-koostood/
https://www.ria.ee/sites/default/files/content-editors/kuberturve/kuberturvalisuse_aastaraamat_2021_eng_final.pdf - [2021-03-17] A former employee of the newspaper Raplamaa Sõnumid was convicted in court of illegally disrupting the operation of the newspaper’s computer system. The employee left the newspaper in 2015 and committed the crime four years later by using Google’s Search Console tool to hide the website https://sõnumid.ee in the Google search engine. The conviction of the county court and the circuit court has been appealed to the Supreme Court.
https://digi.geenius.ee/rubriik/uudis/googlei-otsingus-endise-tooandja-veebilehe-varjamine-toi-kaasa-kriminaalasja/ - [2021-03-17] The Prosecutor’s Office has released a yearbook about 2020. In 2020, various covert surveillance operations were carried out on 729 people. There have been cases where criminals have compromised state systems to mine cryptocurrencies. One of the biggest achievements last year was the detention of three Romanian cyber criminals last September, which was possible thanks to direct contacts with foreign partners. In one criminal case, it was possible to seize 1 million worth of cryptocurrency by transferring it to a wallet held by police. It is not uncommon to see criminal cases being closed without gathering additional evidence if the identified IP address is located abroad.
https://aastaraamat.prokuratuur.ee/prokuratuuri-aastaraamat-2020/jalituse-jarelevalvest
https://aastaraamat.prokuratuur.ee/prokuratuuri-aastaraamat-2020/kuberkuritegevuse-okosusteem-muutunud-teenusepohiseks
https://digi.geenius.ee/rubriik/uudis/prokuror-meil-on-viiteid-et-kurjategijad-kaevandasid-riigi-vahenditega-kruptoraha/ - [2021-03-17] Due to an error on the SK ID Solutions side, 6000 Smart-ID users received a false SMS alert as if someone had just created a Smart-ID account on their behalf. Turns out the alert was not false, but was sent with a delay. Smart-ID users who created an account on 2021-02-27 or later received the alert on 2021-03-17.
https://forte.delfi.ee/artikkel/92868487/6000-inimest-said-tana-eksliku-hoiatusteate-smart-id-loomise-kohta
https://www.skidsolutions.eu/en/News/sms-notifications-for-smart-id-account-creation-were-sent-with-delay/ - [2021-03-08] RIA has published a technical report produced by Cybernetica: “Cryptographic algorithms and their support in libraries and information systems”. The report looks at cryptographic primitives and protocols, federated authentication protocols (OAuth, OpenID), cryptographic libraries and crypto file containers. The use of PGP is not recommended anymore.
https://www.ria.ee/sites/default/files/content-editors/publikatsioonid/cryptoreport2021.pdf
https://www.ria.ee/et/kalender/kruptoalgoritmid-ning-nende-tugi-teekides-ja-infosusteemides.html - [2021-03-04] The birth registration service in the self-service portal of the population register (rahvastikuregister.ee) allows the lookup of a mother’s name and personal identification code by entering a newborn’s personal identification code. A Geenius journalist tried 50 random personal code combinations and in 9 cases was able to see the child’s mother’s name and personal identification code and was able to apply to be registered as the father of the child. A rate limit for number of queries is not present. The officials do not consider this a risk as it only reveals the fact that someone has given birth. The queries leave a trace that can be seen in the data tracker, but to see who exactly viewed the data the child’s mother must contact the Ministry of Interior. The Data Protection Inspectorate (AKI) sees no problem.
https://digi.geenius.ee/eksklusiiv/iga-huviline-saab-e-rahvastikuregistris-naha-vastsundinud-laste-emade-nimesid-ja-isikukoode/ - [2021-03-02] The European Court of Justice ruled that the Prosecutor’s Office in Estonia should not grant access to communications metadata as it is not a fully independent party in the conduct of criminal investigations. A good deal of evidence in thousands of criminal cases may prove inadmissible.
https://curia.europa.eu/jcms/upload/docs/application/pdf/2021-03/cp210029en.pdf
https://news.err.ee/1608130099/thousands-of-pieces-of-evidence-could-disappear-from-criminal-cases
https://ekspress.delfi.ee/artikkel/92783317/advokaat-kas-moosivarguse-uurimine-oigustab-inimese-lausjalitamist
https://news.err.ee/1608191572/lawyers-prosecutor-s-office-riding-roughshod-over-ecj-data-stance
https://news.err.ee/1608209794/bill-initiated-to-use-communications-data-in-court-cases
https://www.err.ee/1608200386/ministeerium-ei-kavatse-piirata-mobiiliandmete-kasutamist
https://news.err.ee/1608231447/bill-aligning-prosecutor-data-collection-with-eu-law-passes-first-reading - [2021-03-02] MKM has submitted a draft regulation on the security of communications networks. The change mostly affects the radio equipment on the mobile operator masts. The transition away from Huawei equipment would cost Elisa up to 54 million euros over the next five years, for Telia up to 5 million euros, but for Tele2 there would be no additional costs. The government will vote on the draft bill in the autumn.
https://mkm.ee/et/uudised/minister-sutt-esitas-valitsusele-sidevorkude-turvalisuse-eelnou
https://www.err.ee/1608127927/huawei-seadmete-keelamine-voib-tuua-vorkudele-kumneid-miljoneid-kahju
https://www.err.ee/1608250608/huawei-seadus-lukkub-sugisesse-5g-sagedusalade-konkurssi-pole-seni-oodata - [2021-03-02] The National Audit Office (Riigikontroll) has raised several issues related to X-Road. The audit has found that in many cases X-Road data service providers did not enter into service agreements and the public authorities have not audited whether private operators were implementing adequate security risk mitigation measures. The regulation should clarify which security measures should be implemented at what level. The audit has found that there has been one significant disruption in X-Road services during the last three years due to the failure of key components.
https://news.err.ee/1608127567/audit-office-it-security-of-firms-using-x-road-not-sufficiently-checked
https://digi.geenius.ee/rubriik/uudis/riigikontroll-manitseb-keegi-ei-kontrolli-x-teed-kasutavate-eraettevotete-turvalisust/
https://www.ria.ee/et/uudised/riigikontroll-riigi-infosusteemi-amet-taganud-x-tee-tookindluse-kuid-x-teed-kasutavate.html
https://blog.ria.ee/x-tee-liikmete-ule-tuleb-tohustada-kontrolli/ - [2021-03-01] A research article by Sven Heiberg, Kristjan Krips and Jan Willemson (Cybernetica): “Mobile Voting – Still Too Risky?”. The article is mainly based on the report “Mobile voting feasibility study and risk analysis” that was released by Cybernetica in April 2020.
https://research.cyber.ee/~janwil/publ/mvoting-design.pdf - [2021-02-01] Denial-of-service extortion attack took place against one of the banks in Estonia. As a result, online banking, card payments and internal bank services were disrupted.
https://www.ria.ee/et/uudised/olukord-kuberruumis-veebruar-2021.html - [2021-01-22] Thousands of .ee domains were unavailable for a few hours due to an administrative error made by the Zone Media in their name server solution.
https://www.ria.ee/et/uudised/olukord-kuberruumis-jaanuar-2021.html - [2021-01-18] For a few hours hundreds of websites hosted at Zone Media were not available due to a network switch failure.
https://www.ria.ee/et/uudised/olukord-kuberruumis-jaanuar-2021.html
https://blog.zone.ee/2021/01/20/katkestuse-post-mortem/ - [2021-01-15] Denial-of-service attacks took place against Estonian financial institutions and technology companies, accompanied by blackmail letters. The ransom demands were between 0.5 to 10 bitcoins. The longest interruption lasted for about six hours. According to RIA, the attackers did not receive any ransom money from Estonia.
https://www.ria.ee/et/uudised/olukord-kuberruumis-jaanuar-2021.html
https://www.ria.ee/sites/default/files/content-editors/kuberturve/kuberturvalisuse_aastaraamat_2021_eng_final.pdf