Last week, Propastop published an article on the impact of hybrid attacks and the importance of explaining them to the public.
On 29 September, the Director General of the Estonian Internal Security Service (KAPO) wrote:
“Having assessed KAPO’s intelligence as a whole, we are now convinced that the arson attack on the defence company Milrem on 15 August was a deliberate and premeditated attack carried out on the orders of Russia’s intelligence services. […]
The methods used by the Milrem attackers resemble those employed in other Russian-commissioned attacks across Europe and can be directly linked to the Russian Federation. Defence companies, particularly those working with drone technology, and organizations supporting Ukraine have been targets of Russia’s intelligence services since the start of Russia’s war of aggression.”
This was followed by a statement from Estonia’s prime minister:
“Today, we can say with complete confidence that the arson attack on Milrem in Estonia in the early hours of 15 August was an act of sabotage commissioned by the Russian Federation’s intelligence services. The Internal Security Service reached this conclusion after thoroughly assessing the information it had gathered.”
In other words, the Estonian state attributed the Milrem arson attack to Russia. That evening, KAPO’s Director General told the television news programme Aktuaalne kaamera:
“We are making this attribution solely based on KAPO’s intelligence. We are firmly convinced that Russia was behind this attack.”
This was one of the first instances of political attribution for the acts of sabotage carried out in recent years, and Estonia once again deserves recognition for taking this step. Just as Estonia politically attributed the mass cyberattacks against the country during the Bronze Night unrest in 2007 to Russia, it has now firmly attributed to Russia one of the hybrid attacks that have kept Europe on edge for so long.
What is attribution?
Attribution, or identifying who is responsible for an incident, can broadly take three different forms:
Attribution through official investigations and court proceedings
The process begins with an unlawful act that an authority, such as the police or the Internal Security Service, investigates. Evidence is gathered, people are questioned, and, once sufficient evidence has been collected, the case is brought before a court.
The court then examines the evidence and ultimately determines whether the accused is guilty. As this description suggests, this is a slow and lengthy process. By the time a final judgment is delivered, the world has changed, and society has long since worked through the trauma caused by the incident.
One Estonian example is the KAPO-led investigation into the vandalism of cars belonging to the interior minister and a Delfi journalist.
Public attribution
In this process, a media outlet, think tank, researchers or a group of individuals investigates and analyses the details of an incident, then presents its conclusions.
Responsibility is attributed on the basis of publicly available evidence, background material and logical deductions, without an official investigation necessarily taking place or reaching a conclusion and producing a court judgment within the same period.
What matters here is the body of evidence presented and how it is explained. Readers can assess the material and draw their own conclusions about who is responsible.
There have been hundreds of such attributions over the past decade. Bellingcat, for example, has become known for many of them. Its best-known investigations include identifying those responsible for the downing of Malaysia Airlines flight MH17 over Ukraine in July 2014 and the Skripal poisoning.
Political attribution occurs when a government identifies those responsible based on an initial assessment of the available evidence.
The Milrem case falls into this category. Drawing on the evidence gathered and conclusions reached by KAPO, as well as Russia’s previous pattern of behaviour, the prime minister publicly stated that Russia was behind the attack.
This form of attribution matters when maintaining the public’s sense of security requires a prompt explanation of what happened, how to interpret it and what it means. Waiting until evidence gathering and court proceedings have concluded is not always an option. Germany’s interior and foreign ministers made a similar attribution in early September. On 4 September, they stated, referring to a hybrid attack at Leipzig/Halle Airport a month earlier:
“Taken together, the police investigations, the pattern of the attack and intelligence findings point to Russian responsibility for the attempted attack at Leipzig Airport.”
Their assessment considered the target, the means employed, the technical expertise involved and the use of low-level operatives in the hybrid attack. Together, these factors provided the basis for a clear political attribution.
Attribution plays an important role for both society and international partners. It helps explain the significance of an incident and provides an additional basis for putting pressure on those responsible, whether through new sanctions, countermeasures or steps to strengthen national security.
Russia’s response to Estonia’s attribution was predictable. Kremlin spokesperson Dmitry Peskov called the accusations groundless, ill-considered, completely at odds with reality and unsupported by any evidence. Presenting evidence is a matter for the criminal proceedings taking place in parallel. Even after those proceedings conclude, Russia is unlikely to admit to having orchestrated the Milrem arson attack.
Further reading:

