Working together as a society made an impression

A delegation from the NATO Cyber Defence Committee visited the TIETO24 intensive exercise and took with them lessons learned from the Finnish way of cooperating. The delegation was positively surprised by the trust between businesses, organizations and authorities in different sectors, the ability to share information, and the degree of preparedness for different types of disruptions.

”During the day, we were only able to see a little bit of the way Finns prepare for cyber threats and incidents, but we were impressed by what we saw. It was interesting to see how many different industries and sectors were involved in the TIETO24 exercise, and not just in this exercise – they were committed to your preparedness work in general. It is rare for parties with different interests to be able to cooperate at this level. You rarely see a similar intense spirit of cooperation. The entire society stands behind the preparedness work, everyone has a role to play, and the role is taken seriously. It’s interesting and also encouraging,” says Ben Hiller, who is responsible for developing and implementing NATO’s Cyber Defense Policy and Action Plan, among other things.

Hans Nelson, Cyber Policy Advisor for the US Mission to NATO, says he paid attention to the great trust between citizens, authorities and organizations.

”Finns also have a very pragmatic attitude toward resilience. A lot of work is being done to develop resilience before anything bad has even happened. Resilience cannot just be built – it must also be tested in real life. But given how regularly you train and how continuous your cooperation is, your resilience will also develop. Other NATO Allies can also learn from this,” Nelson says.

According to Nelson, preparedness work often involves technical preparedness or infrastructure. The thing he admired about the Finnish model was how businesses also pay attention to mental resilience.

”It feels like you are preparing as well as you can for various disruption situations, but you are not stressing too much. You have some kind of higher goal in mind, a collective consensus that your way of acting and preparing is right. You are realistic about the facts but don’t panic,” Hiller says.

Finland has something to contribute to the NATO community

The TIETO24 intensive exercise focused particularly on the exchange of information. NATO, on the other hand, conducts a lot of military exercises. The visitors believe that cooperation between businesses, authorities and different administrative branches could also be integrated into some of the NATO exercises.

”Finland is a fairly new member of NATO, but it has already presented interesting views at NATO meetings on, among other things, how cooperation between parties focused on cybersecurity could be better integrated into preparedness exercises,” Nelson says.

In addition to military exercises, NATO also conducts various cybersecurity-focused exercises that test technical capabilities, decision-making in different situations and crisis management, for example.

”We also have a platform where different countries can upload information about various kinds of malware and cyber incidents so that other Allies can identify these programs in their own networks.”

Limited resources can also be sufficient if they are allocated correctly

Nelson and Hiller emphasize that, in preparedness training, substantial resources do not necessarily guarantee a better result.

”In Finland, operations are lean, which is interesting and makes training and preparation smoother and easier. Bigger is not always better,” Nelson says.

But should training cooperation between NATO Allies be increased to prepare for cyber incidents and threats? If it were increased, there would undoubtedly be more resources available.

”There is always a need for preparedness exercises. Especially in the current world situation, we should make use of all the preparedness tools we have developed. We should use more real-world scenarios in our exercises so that when a real threat or incident occurs, we will really be ready to act,” Nelson says.

Hiller believes that preparedness training could be even more focused and tailored specifically to NATO.

”There are not many other organization that offers a similar platform for cooperation between cyber experts and their stakeholders. Other international organizations, such as the EU or the UN, could also be involved.”

If Hiller and Nelson were allowed to develop the TIETO exercises, they would make them more international.

”The current exercise is national, but a cyber attack or threat targeted at Finland is likely to have an impact that extends beyond just Finland or other Nordic countries. The exercise could be linked to international countermeasures, and, for example, NATO’s expertise and views could be included in it. On the other hand, we only saw a small fragment of the exercise, so perhaps the international aspect has already been taken into account,” Hiller says.

”You already have preparedness and communications cooperation with Sweden, for example. Strengthening the international aspect is certainly wise. The same applies to the use of existing connections and the development of new ones. If, for example, logistics connections to Finland are impeded and there is a shortage of components or something similar, a neighbor can provide assistance,” Nelson says. 

Despite the threats, collective security has improved

Hiller and Nelson’s message to Finns is encouraging: The accession of Finland and Sweden to NATO has improved the security of the entire Alliance. We can trust that assistance will be provided if we need it.

”Finns may not even realize how excited the entire NATO personnel and Alliance were about Finland and Sweden joining NATO. Some thought it might never happen,” Hiller says.

This is the beginning of a new era, and NATO must also rethink its ways of working.

”Due to its location, Finland has its experience to offer – you increase our capacity. Cooperation also leads to investments on both sides,” Hiller says.

Text. Leena Filpus, photos: Meeri Utti