Facing the Valley of Death Amidst Russian Cyber Threats

Finland and Estonia are building cyber-resiliency amid constant threats. Their border with Russia means they navigate a high-stakes environment where mistakes and trial-and-error can come at a dear cost. Cyber attacks, presumably from their neighbor to the east, are part of daily life in both countries, challenging safety and freedom, so businesses, government, academia and the military collaborate and prioritize cybersecurity to safeguard their countries.

“What we do, is that sometimes, we take the initiative, and we see a market opportunity, and we approach the researchers and the companies and say, ‘Hey, we see this market opportunity. Why don’t you work together towards this market opportunity?’” said Arto Pussinen, senior director, Ecosystems Digitalization, at Business Finland.

Pussinen explained that sometimes his agency coordinates; other times, another actor finds a potential capability and calls on other participants to join. Business Finland pays special attention to dual-use technologies that will fare well in the market and supply cyber warriors with a novel way to counter nefarious intentions and activities from Russia, other countries and nonstate actors.

“Most frequently, the help is innovation funding, so Business Finland is an innovation funding agency in Finland, and we provide the innovation funding for those ecosystems,” Pussinen explained.
Fifty miles south of the Finnish capital of Helsinki, crossing the Gulf of Finland on the Baltic Sea, lies Tallinn—the Estonian capital.

Like Finland, the country shares a border with Russia, and that translates into military tensions and cyber strain.

“The Estonian defense budget is so small that no company would survive if they only wanted to live off the Estonian military,” said Oliver Tsarski, innovation lead at the Estonian Ministry of Defence.

Tsarski explained that companies innovate, and their products are repurposed for military use. There is no Valley of Death, as startups are already economically viable by the time they are evaluated as potential defense suppliers.

Cyber attacks in the country quadrupled between 2021 and 2022, according to government figures. This nation works on cyber-threat prevention with school students, and attacks against private companies, government and military agencies are almost part of daily life, according to anecdotal and recent historical evidence.

Therefore, there is a market for cyber protection, and its businesses build a private innovation ecosystem leveraged by defense agencies.

Both NATO members are well known for their technological strengths. Finland spent 3.0% of its gross domestic product in research and development and Estonia 1.8% in 2021, according to the Organisation for Economic Co-operation and Development (OECD), a developed economies multilateral organization. The average expenditure for this group was 2.7% in the same year.

Estonia, at almost half of the OECD average, must make every dollar count. According to the Global Innovation Index, Finland holds the ninth position in the world and Estonia the 18th.

“Our defense innovation, what we are currently showing to the world, is related to different types of cameras, 360-degree cameras, different monitoring systems from the air, different drone systems, border guarding systems; all these types of things, which are a connection between the digital world and old-fashioned warfare or systems that need to be upgraded,” said Stig Rogenbaum, business development head for defense and technology businesses in the Estonian Investment Agency.

Part of the formula for Estonia includes cooperation between different actors in the technology defense ecosystem and government support through funding. In the specific case of this country, part of the success toward producing an innovation that can be deployed in battlespaces is around making small improvements to technologies that are already in use.

Officials from both countries mentioned the European Defense Fund (EDF), an endowment that finances new technologies for common defense (see sidebar). The EDF is especially attractive for smaller countries with larger threats, as is the case with these two nations.

An approach that integrates different actors and crosses borders within NATO and European Union countries not only diversifies risks and widens the talent pool but also responds to the way small countries have to cope with big threats.

“As we don’t order too much stuff for our military that needs to be invented and developed specifically for our military, then that’s not so much a military problem but an economic problem, of course, for our companies,” said Tsarski. This forces Estonian cyber-defense companies to look for markets abroad, as their military budget is small and their domestic market cannot always sustain businesses.

When trying to export their products, these companies find another hurdle, despite offering legal and military guarantees.

“We see that there is some protectionism in the defense market for many nations,” Tsarski told SIGNAL Media.

To lower impediments, the country capitalizes on the EDF as well as other initiatives, including NATO’s Defense Innovation Accelerator for the North Atlantic (DIANA). The initiative is an investment agency with 1 billion euros for early-stage startups in emerging and disruptive technologies.

Estonia hosts six DIANA sites, including a joint Estonian-United Kingdom regional office, as well as labs and other facilities.

Finland only joined the alliance in April and, despite having been a partner for many years, access to initiatives like these is new. Still, with access to other sources of funding and its own indigenous development, the country sees an avenue for future development.

“Finland is very good in wireless technology, so we see the five technologies evolving towards the 6G and also the mesh-based radios, and also wireless communication technologies; it’s something that we see is very strong in Finland,” Pussinen said and added that post-quantum cryptography was another field for his country.

Cybersecurity is the other area where Estonia and Finland will continue development as threats seem to increase with time.

The European Defense Fund

The European Union (EU) supports small and medium enterprises, supplying new military technology with grants budgeted close to $8.6 billion between 2021-2027, according to its official webpage.

About 66% of these funds are earmarked for collaborative projects pooling member-states investments, and 34%—almost $3 billion—for developing future capabilities.

Projects must include companies from at least three countries and funding supporting initial phases until contracts are signed. While non-EU entities can potentially be eligible, the aim is to benefit companies based, owned and managed in regional block members.
The program has the nondefense market viability built-in, as it houses a dual-use incubator to encourage innovations for general adoption.

The fund was established formally through publication in the Official Journal of the European Union,
L 170, on May 12, 2021. Each member-state has a designated individual who serves as a “national focal point” and should assist candidates in their application process.

These focal points should advise and inform:

• Administrative procedures at EU level
• National administrative requirement
• Promotional activities

They may also offer additional services, but these may differ from country to country, according to the EU.
Since the beginning of the war in Ukraine, both Finland and Estonia have seen significant increases in cyber attacks. Together with a renewed interest in security, both countries are seeing their sectors grow.

“Cybersecurity is really booming,” Stig Rogenbaum, business development head for defense and technology businesses in the Estonian Investment Agency, told SIGNAL Media in an interview. The Estonian Ministry of Defence confirmed that the country is currently working on many projects using these funds and leveraging them to achieve maximum results.

Estonia ranks third in the world, and Finland 13th, in the National Cybersecurity Index. This ranking “measures the preparedness of countries to prevent cyber threats and manage cyber incidents,” according to its website and is compiled by a Tallinn-based organization, the e-Governance Academy, which is a joint initiative by the Estonian government, the Open Society Institute and the United Nations Development Program.

The future for the continent and whoever leads in the sector is also promising. In 2021 the European cybersecurity market was worth $27.5 billion, and it is expected to grow to $52.4 billion in 2027, according to Market Data Forecast.                                               
 

Estonia Comes to Silicon Valley

Estonia’s investment agency does not look for any capital; it searches for dollars linked to technology. The location of their office in the United States suggests that too.

“It’s the biggest sector for capital, for sure; and these days, I have to say, that activities are really concentrating back again in San Francisco, and Silicon Valley or the Bay Area,” said Maris Prii, head of investor relations in the U.S. at the Estonian Investment Agency, who is based in San Francisco.

According to Prii, there are specific sectors her country is interested in.

“[Artificial intelligence] is one of the up-and-coming things and, because the Estonian government is into innovation as well, not just our private sector technology companies, the Estonian government is looking heavily into AI and how to use it to provide better services for the citizens,” Prii explained.

The country is a full EU member, as well as a NATO ally, and is bound by laws and treaties to guard its defense technologies against unlawful exports.

As an EU member, the country participates in the U.S.-EU Trade and Technology Council established in 2021. In their inaugural statement, the reexport of defense technologies—especially artificial intelligence—was addressed.

“We have determined shared principles and areas for export control cooperation, including in export control capacity-building assistance to third countries, and recognize the importance, where appropriate and feasible, of prior consultations to ensure that the application of export controls is transparent and equitable for U.S. and EU exporters,” said the statement when the council was established.