In general, there are no infrastructural limitations to internet access in Estonia. According to data from Statistics Estonia, the state statistics agency, 92.4 percent of households had internet connections in 2022, while 98 percent of people aged 16 to 44 use the internet daily or almost daily as of 2019.1 According to the EU’s latest Digital Economy and Society Index (DESI), 83.2 percent of households had fixed-line broadband connections in 2021, while mobile broadband penetration reached.87.3 percent.2 Both rates outperform EU averages.

Speeds are reliable in Estonia. According to Ookla, the median fixed-line broadband download speed stood at 55.73 megabits per second (Mbps) in May 2022, while the median mobile download speed stood at 55.95 Mbps.3

The government continues to enhance information and communications technology (ICT) infrastructure. The EstWin project, run by the Estonian Broadband Development Foundation, a state-supported foundation, is working to improve fixed-line broadband access. By May 2020, EstWin had delivered 7,000 kilometers of backhaul network.4

The Estonian Recovery and Resilience Plan (RRP) allotted €24.3 million ($27.5 million) to launching very high-capacity networks (VHCN) in rural areas. These funds are part of a €208 million ($235.5 million) investment project to improve ICT services between 2021 and 2027.5

Public Wi-Fi connections are commonplace,6 including at cafés, hotels, hospitals, schools, and gas stations.7 According to Economist Impact’s 2022 Inclusive Internet Index, 3G mobile networks cover 100 percent of Estonia’s population, while 4G mobile networks cover 99 percent.8 The government adopted a “5G Roadmap” in 2019 which envisions the commercial rollout of 5G services in cities by 2023.9 The distribution of radio frequencies for 5G mobile services was launched at a public auction after the Electronic Communications Act was passed by the parliament in November 2021 (see A4).10

There are no significant digital divides in the country. According to DESI, Estonia has one of the highest shares (89 percent) of e-government users in Europe.11

In general, internet connections are affordable. The 2022 Inclusive Internet Index ranks Estonia 23rd in terms of affordability of prices for connections.12 A variety of packages offering internet connections are available at low prices, while very high-speed connections are available at somewhat higher prices. In 2021, the International Telecommunication Union (ITU) put the cost of a monthly fixed-line broadband subscription at .95 percent of the gross national income (GNI) per capita, while 2 gigabytes (GB) of mobile data cost 0.24 percent of the GNI per capita.13 According to the World Bank, in 2021, Estonia’s GNI per capita was $27,280.14

According to DESI, prices for fixed-line and mobile broadband plans in Estonia are below the EU average.15 However, the pricing policies of Telia, the leading service provider, have been criticized in the media. Telia offers connections that exceed 100 Mbps, but at much higher prices than in neighboring countries where the company also operates.16 This has resulted in slower take-up of very high-speed fixed-line broadband services. As of 2021, VHCNs covered 71 percent of households, but only 19 percent of households have adopted very high-speed connections, which is below the EU average.17 The Consumer Protection and Technical Regulatory Authority (TTJA), the telecommunications regulator, admits that broadband connection at the speed of 100 Mbps or more exceeds the average European price range.18

There is no significant urban-rural digital divide. According to Statistics Estonia, 90.2 percent of households in urban areas had internet connections in 2020, while 89.5 percent of those in rural areas were connected.19

In 2020, slightly fewer men (88.5 percent) used the internet than women (89.6 percent).20 There is a larger gap in usage in terms of age: 99.7 percent of 16-to-24-year-olds use the internet, while just 56.1 percent of 65-74-year-olds do, per 2020 figures.21

The government does not exercise technical or legal control over the domestic internet, although the Cybersecurity Act,22 which implemented the EU’s Network and Information System Directive,23 gives it limited powers to restrict the use of or access to information systems in the event of a cybersecurity incident. As an exceptional and temporary measure, the government can also restrict internet connections in “emergency situations”24 and “states of emergency,”25 though this would not necessarily entail a total shutdown of internet connections. There were no government-imposed restrictions or disruptions to connectivity during the coverage period.

There are no undue legal, regulatory, or economic restrictions on Estonia’s ICT market. The Electronic Communications Act aims to develop and promote a free market and fair competition in telecommunications services.26 Information society services, meaning economic or professional activities involving the processing, storing, or transmitting of information by electronic means upon a recipient’s request, are regulated by the Information Society Services Act.27

There are over 200 operators offering telecommunications services, including six mobile service providers and numerous internet service providers (ISPs) in Estonia. The ICT market is relatively diverse with no significantly dominant companies. Sweden’s Telia is the leading fixed-broadband and mobile service provider, controlling 50 percent of the mobile market and 51 percent of the fixed-line broadband market according to the company’s 2021 annual report.28

Legally, service providers are required to register with the TTJA. There is a registration fee depending on the service provided; the amount is regulated by the State Fees Act.29

The distribution of radio frequencies for 5G mobile services was launched at a public auction in May 2022 after the parliament passed the Electronic Communications Act in November 2021 (see A1).30 The act, which came into force in March 2022,31 bans the use of Huawei technology in Estonian networks and harmonizes consumer rights regulations. Proposed amendments relating to the storage of communications data were initially removed from the bill but are likely to be submitted separately by the Ministry of Justice (see C6).32

The main regulatory bodies for the Estonian ICT sector are the TTJA and the State Information System Authority (RIA). Both operate under the Ministry of Economic Affairs and Communications. The TTJA monitors the fixed-line and mobile broadband markets,33 ensuring compliance with EU Regulation 2015/2120,34 which outlines open-internet access requirements and user rights relating to electronic communications networks and services. Meanwhile, the RIA manages state ICT resources.35 Both have a reputation for professionalism and independence. There were no reported cases of undue interference in the ICT sector or abuse of power by these bodies during the coverage period.

The Estonian Internet Foundation, which represents a broad group of stakeholders in the Estonian internet community, manages Estonia’s top-level domain (.ee).36

Score Change: The score declined from 5 to 4 to reflect the government’s blocking of Russian state-linked websites, as well as the implementation of a European Union regulation ordering member states to block the websites of RT, Sputnik, and RT’s local subsidiaries.

There are very few blocked websites in Estonia, and the vast majority of political, social, and cultural content is freely available to users. However, during the coverage period, the regulator blocked a number of websites in response to Russia’s brutal invasion of Ukraine.

On February 25, 2022, one day after the Russian military invaded Ukraine, the TTJA ordered telecommunications operators to restrict online broadcasting of six pro-Kremlin TV channels, including RTR-Planeta, RTVI, Rossiya 24, REN TV, NTV Mir, and PBK, for twelve months in an effort to limit Russian war propaganda.37 In March 2022, the TTJA ordered the blocking of another TV channel RBK (RBC TV), seven websites (ntv.ru, ren.tv, 5-tv.ru, 78.ru, 1tv.com, lenta.ru, and tass.ru.),38 and 12 internet channels, whose “content incites to commit offenses towards national security and national defense, to the detriment of the security of society,” according to a TTJA press release.39

In early March 2022, the EU issued Regulation 2022/350, ordering member states to “urgently suspend the broadcasting activities” of RT, RT France, RT Germany, RT Spanish, RT UK, and Sputnik, and block their websites because they “engaged in continuous and concerted propaganda actions targeted at civil society.”40 In total, more than 40 TV channels and more than 50 websites were blocked in Estonia between February 2022 and the end of the coverage period.41 In June 2022, after the coverage period, the EU adopted a new package of sanctions, which suspended the distribution of five Russian news outlets, including Rossiya RTR/RTR-Planeta, Rossiya 24/Russia 24, and TV Centre International.36

The primary restriction on internet content remains a ban of online illegal gambling websites (see B3). As of January 2021, the Tax and Customs Board (MTA) had more than 1,600 URLs on its list of illegal online gambling sites that Estonian ISPs are required to block.42

Online content is sometimes removed following a court order, although this is not a widespread issue.

Comments on news websites and discussion boards are sometimes removed by website administrators. Most popular websites have codes of conduct for the responsible and ethical use of their services and enforcement policies that allow certain content to be taken down.

At times, social media content is removed. Between January and December 2021, Facebook restricted access to 91 items that were in violation of Estonian law, and one item in response to a consumer policy report submitted by the Consumer Protection and Technical Regulatory Authority.43 Twitter received no content removal requests during that same period. 44 Google received 13 takedown requests in 2021, removing 100 percent of the 6 requests made in the first half of the year, and 85.7 percent of the 7 requests made in the latter half of the year.45

Russian social media platforms Odnoklassniki and VKontakte are also popular in Estonia, but their parent companies do not release data about content removal requests.

Restrictions on online content are transparent and grounded in the law. The Gambling Act, one of the few laws that imposes restrictions, requires domestic and foreign gambling websites to obtain a special license.46 Unlicensed websites are subject to blocking by the MTA (see B1). The MTA’s list of blocked websites is transparent and available to the public.

Under the Information Society Service Act and pursuant to the EU’s E-Commerce Directive, service providers are generally not liable for illegal content transmitted by users.47

However, in 2015, the European Court of Human Rights (ECtHR) upheld a controversial 2009 Estonian Supreme Court decision in the case of Delfi v. Estonia, which established intermediary liability for third-party defamatory comments on news sites.48 The ECtHR confirmed that holding intermediaries responsible for third-party content published on their website or forum is not against Article 10 of the European Convention on Human Rights (ECHR) guaranteeing freedom of expression.

In December 2021, the EU Directive on Copyright in the Digital Single Market was adopted into Estonian law.49 The directive, among other things, establishes ancillary copyright for digital publishers and makes “online content sharing service providers” partially liable for copyright violations on their platforms.50

Similarly, the EU Audio-Visual Media Services Directive (AVMSD)51 was adopted in March 2022.52 The AVMSD requires “video-sharing platform services” to take “appropriate measures” to protect minors from content “which may impair their physical, mental or moral development” and the general public from content involving child sexual abuse, racism, or xenophobia as well as content inciting hatred, terrorism, or violence.53 According to the AVMSD, service providers must apply for a license to operate, submit reports on the structure of the program, and disclose their ownership structure. The regulatory changes mainly affect Estonian audiovisual media service providers.54

In general, self-censorship is not prevalent, and online debates are active and open.

Estonians value freedom of speech highly. According to a 2020 Eurobarometer survey, Estonians consider protecting freedom of speech one of the key tasks of the European Parliament.55

Reporters Without Borders’ 2022 Press Freedom Index ranks Estonia as the fourth freest country. Press freedom is guaranteed on both legal and political levels. However, journalists may self-censor in response to cyberbullying or because of potential penalties from anti-defamation legislation (see C2). According to the report, online threats by private individuals have increased, with the most severe cases being reported to the police and investigated.56

Manipulation of the online information landscape was evident during the coverage period, especially concerning the Russian invasion of Ukraine. For example, false information about Ukrainians attacking Russians in Estonia was shared across Facebook and Instagram.57

Russian information campaigns have historically sought to manipulate public opinion in Estonia.58 An April 2020 report from the cybersecurity company Recorded Future identified an apparent Kremlin-backed disinformation operation aimed at undermining Estonia’s relationship with the EU, including by disseminating forged government communiqués.59

Members and groups affiliated with the Conservative People’s Party of Estonia (EKRE) have continued to publish and disseminate provocative statements and biased information via partisan-funded online channels, such as Uued Uudised and Objektiiv.60 The content is widely disseminated on social media.

Generally, disinformation is evident in the online channels. According to Global Disinformation Index (GDI), one quarter of Estonia’s sites present a high risk of disinforming their online readers. These sites are outside Estonian mainstream media market, with some based in Russia.61

There are few economic or regulatory barriers to posting content online. News websites do not need to register with the government to operate.62

In line with the EU, Estonia supports net neutrality. Providers found to be in violation can be fined up to €9,600 ($10,870).63 Estonia has not implemented separate rules on net neutrality and follows the EU’s regulatory framework on open internet access and user rights relating to electronic communications networks and services.64 The TTJA regularly analyzes the ICT market for zero-rating plans that may be in violation of net neutrality, along with other net neutrality violations; in its latest report, it did not identify any violations.65

A diverse range of content is available online. The websites Delfi, Postimees, and ERR were the country’s 4th, 5th, and 11th most popular sites in 2020.66 Estonians upload and share user-generated content more frequently than the average user in the EU.67

Knowledge of foreign languages among Estonians is high, which facilitates access to diverse content.68

Estonians use social media platforms to share news and information, as well as to generate public discussion about current political issues. No restrictions to online mobilization tools were put in place during the coverage period.

In 2014, the official platform Rahvaalgatus.ee was launched, enabling people to compile petitions, send them to the parliament if they gather at least 1,000 digital signatures, and monitor lawmakers’ responses.69 As of February 2022, 242 petitions had been launched, out of which 109 gathered the necessary support to be sent to the parliament.70 The platform also accepts and facilitates petitions to local governments. By law, the petition needs to gather signatures from at least 1 percent of residents in a given locality to warrant the official procedure in the local council.71

All citizens have the constitutional rights to freely obtain information and to freely disseminate ideas, beliefs, and facts.72 There are no obstacles to people exercising their right to freedom of expression online.

The judiciary in Estonia is independent, and there have not been any instances of political interference with the judiciary. According to a 2021 survey, 66 percent of Estonians trust the judiciary.73

In March 2022, the parliament adopted amendments to the Public Sector Information Act submitted by the Ministry of Justice. The amendments align Estonian law with the EU’s revised Public Sector Information Directive, which governs public access to state data.74

Protections for journalists, which include the right to the confidentiality of sources, are strong.75

On paper, there are few limits on freedom of expression online. Speech that publicly incites hatred, violence, or discrimination on the basis of nationality, race, color, gender, language, origin, religion, sexual orientation, political opinion, or financial or social status is punishable by a fine of up to €3,200 ($3,600) under the penal code.76 Such speech is also punishable by up to three years in prison if it leads to the “death of a person or results in damage to health or other serious consequences.”

Defamation was decriminalized in 2002.77 Civil defamation cases can be brought under the Law of Obligations Act,78 though damages are usually moderate (see C3).79

In February 2021, Minister of Justice Maris Lauri stated that penalties in hate speech cases should be re-evaluated, specifying that a one-to-three-year prison sentence could be a fair penalty in criminal cases.80 The coalition government has since shelved these plans.81

In October 2017, the Court of Justice of the European Union (CJEU) considered whether a defamation case could be brought before a court in Estonia if the company affected is based domestically, despite the infringing content being published on a Swedish website.82 The CJEU clarified that the party affected may sue in the country where its center of interest resides but noted that it is not possible to bring cases in any country where the online information is accessible.83

There were no criminal prosecutions or detentions for online activities during the coverage period.

In April 2022, two Eesti Ekspress journalists, Tarmo Vahter and Sulev Vedler, as well as their employer were fined €1,000 ($1,100) each for publishing an article about alleged money laundering conducted by managers of a major Swedish bank84 . Though the case generated a wider public discussion about press freedom, Justice Minister Maris Lauri insisted that leaking information about ongoing investigations can potentially help criminals conceal crimes and is thus not protected by laws related to press freedom.85 The decision prompted pushback from both private and public media organizations in Estonia, as well as Prime Minister Kaja Kallas, former president Kersti Kaljulaid, and current president Alar Karis.86 In June 2022, after the coverage period, the fines were dismissed by an appeals court.87

In February 2022, a first instance court dismissed a libel claim from media mogul Margus Linnamäe against former prime minister Siim Kallas. The claim concerned an interview Kallas gave in which he suggested that Linnamäe could dictate the policy of the Isamaa opposition party. The court found Kallas’ statement to be neither derogatory nor defamatory. The plaintiff had not filed an appeal with the second instance court as of the end of the coverage period.88

A previous defamation case concerning two journalists in 2018 prompted the Estonian Data Protection Inspectorate (AKI) to call for “all authors operating in the public sphere,” including social media users, to abide by journalistic principles “when publishing current, social or other public interest texts.”89

There are no governmental restrictions on anonymous communication or encryption, and no SIM card registration requirements.90 However, in October 2020, the Ministry of Interior and the Ministry of Economic Affairs and Communications proposed amendments to the Electronic Communications Act, suggesting stricter verification processes for users of pre-paid SIM cards, which would have also required WhatsApp, Viber, and Skype to register as communication service providers.91 The provisions were ultimately abandoned in a revised version of the bill, which was approved in November 2021 (see A4).92

Some major news sites have limited anonymous commenting on their articles in reaction to the establishment of intermediary liability for third-party defamatory comments on internet news portals (see B3).

Historically, government surveillance has not been intrusive, and the constitution guarantees the right to the confidentiality of messages sent or received.93

Parliament’s Security Authorities Surveillance Select Committee oversees surveillance and security agencies. The committee monitors the activities of these bodies to ensure conformity with the constitution, the Security Authorities Act,94 and other regulations, which include necessity and proportionality requirements.

The prosecutor's office monitors surveillance activities and reports regularly to the parliamentary select committee. In its annual report for 2020, the prosecutor’s office disclosed that it had granted law enforcement bodies permission to use surveillance tools in cases concerning organized crime and crimes relating to drugs and taxes.95

The Chancellor of Justice, who serves as the state ombudsperson, verifies whether state agencies that organize the interception of phone calls and conversations, surveil correspondence, and otherwise covertly collect, process, and use personal data operate lawfully. In her 2020–21 annual report, the Chancellor of Justice noted that the office reviewed 135 surveillance files from police stations, the findings of which showed that “surveillance authorizations were reasoned and surveillance was necessary to verify suspicion of a criminal offense.” The Chancellor’s advisors also confirmed that requests in criminal proceedings for the submission of data from communications service providers, including telecommunications companies, had been lawful (see C6).96

A December 2020 investigation by the Citizen Lab, a University of Toronto-based research center, identified the Estonian government as a likely customer of Circles, a surveillance company that allows customers to monitor calls, texts, and cell phone geolocation by exploiting weaknesses in mobile telecommunications infrastructure. Following the revelation, the Ministry of Defense refused to comment.97

In May 2020, the Riigikogu adopted the Act Amending the Defense Forces Organization Act, the Security Authorities Act, and the Chancellor of Justice Act, which allow the military to access private data and surveil citizens under certain emergency circumstances.98

Estonia has strong laws protecting citizens’ personal information, although service providers are mandated to retain user data. The General Data Protection Regulation (GDPR), which came into force in all EU member states in May 2018,99 puts limits on how interested parties can use and store Estonians’ data.

The Personal Data Protection Act (PDPA) was amended in 2018 and entered into force in January 2019.100 The law contains the provisions left by the GDPR to EU member states' legislation, which includes certain exceptions like those identifying instances when the media can use personal data if it is in the public interest. Laws regulating databases and data collection by public and private registries were also updated during this process. The AKI is the supervisory authority for the PDPA.101

Service providers are required to collect and retain a substantial amount of metadata. These requirements were established under the Electronic Communications Act, which aligned with EU legislation. They were cast into doubt by the CJEU in April 2014, when the court found the European Data Retention Directive (2006/24/EC) to be invalid.102

Article 111 of the Electronic Communications Act outlines various restrictions on how this data can be stored and used.103 Data shall be kept for one year, unless there are special circumstances determined by the government that justify keeping it longer, such as maintaining public order and national safety. Article 112 regulates how requests by law enforcement authorities or other agencies can be made in relevant situations, such as criminal investigations, as provided by law. Judicial approval is not always required. These requests for data are kept by the requesting agency for two years. Article 112 also stipulates that operators shall inform the TTJA of requests made and measures undertaken. The Electronic Communications Act has been criticized for allowing requests for metadata in too many situations. While Estonia’s Chancellor of Justice has found that the system does not contradict constitutional guarantees, the office has questioned the proportionality of the law.104 Pursuant to the Electronic Communications Act, the Cybersecurity Act also requires companies to monitor communications, mainly to ensure the security of their own systems; companies are required to inform the RIA of “actions or software compromising the security of the system.”105

The Chancellor of Justice can make suggestions regarding data protection. In its 2021-2022 annual report, the Chancellor of Justice noted that the office “did not identify any violations in the work of surveillance and security agencies” based on claims submitted by citizens.106

In October 2020, the Ministry of Interior and the Ministry of Economic Affairs and Communications proposed amendments to the Electronic Communications Act. The amendments, which were later abandoned,107 would have forced messaging services such as WhatsApp, Viber, and Skype to register as service providers113 (see C4).108

In November 2018, Estonia’s Supreme Court made a referral for a preliminary ruling to the CJEU to find out whether EU law, such as the Charter of Fundamental Rights, prevents the state from using people’s metadata during investigations into crimes other than serious crimes and whether this process should include judicial review.109 The CJEU’s preliminary ruling outlined that the tracking of movement and communication through metadata from telecommunication providers is permissible only in cases of terrorism or serious crime.110 This preliminary ruling affected many ongoing criminal proceedings as this type of evidence may be considered inadmissible.

In June 2021, the Supreme Court ruled that neither the prosecutor’s office nor the court can request communications data from companies in certain criminal investigations, following an October 2020 ruling from the CJEU in the LaQuadrature du Net case, which held that “indiscriminate” collection and retention of communications data in cases involving non-serious crimes does not align with the EU’s ePrivacy Directive. However, under the Estonian ruling, “surveillance and security authorities” still have the right to access communications data, so long as the measure is within the scope of the law.111

There have been no registered physical attacks against users or online journalists, though online discussions are sometimes inflammatory. Both critics and supporters of the EKRE have faced online harassment, including threats of violence, for their views.112 Online harassment can be reported to the social media administrators or to the police, which has a designated web patrol unit with a presence on Facebook.113

In recent years, several defamation cases have incited public debate on the accepted code of conduct in the digital space and the appropriate sanctioning for breaches such as verbal threats, intimidation, and harassment.114

During the coverage period, online users were subject to harassment on social media platforms. In the context of the COVID-19 pandemic, police officers who were on duty at an anti-vaccination protest were identified by protesters and later attacked on social media.115

In October 2020, the European Commission launched infringement proceedings against Estonia, as the country had not opted for the criminalization of public incitement to violence or hatred directed at vulnerable groups and had not defined adequate penalties for this offense.116 While the new coalition government has pledged to criminalize hate speech, the prosecutor general has opposed this motion, because he believes it restricts freedom of speech.117

According to the ITU’s 2020 Global Cybersecurity Index, Estonia ranked third in the world regarding its commitment to ensuring cybersecurity.118 In 2018, the government allocated additional funds to advancing the country’s online security and adopted a new Cyber Security Strategy for 2019–22.119 Despite this, government agencies experienced significant cyberattacks during the coverage period.

Following Russia’s invasion of Ukraine, cyberattacks originating from Russia120 have intensified, however the low level of sophistication of the attacks as well as countermeasures taken by Estonian cybersecurity specialists have limited the impact. For example, in April 2022, a Distributed Denial of Service (DDoS) attack targeted websites belonging to the president, the Ministry of Foreign Affairs, and the Police and Border Guard Board, as well as the online portals for digital state services. Although the attacks persisted for almost a week, the websites were fully operation a few hours after the initial attack.121

In November 2020, the websites of the Ministry of Economic Affairs and Communications, the Ministry of Social Affairs, and the Ministry of Foreign Affairs were attacked, and personal data was leaked. The Ministry of Social Affairs’ website suffered the most serious attack, as personal data concerning the spread of infectious diseases was obtained from the Health and Welfare Information Systems Center (TEHIK); TEHIK, however, nullified the attack after eight hours.122

Estonia’s cybersecurity strategy is built on strong private-public collaboration and a unique voluntary structure through the National Cyber Defense League.123 With more than 150 experts participating, the league has simulated different security threat scenarios in defense exercises, with the aim of improving the technical resilience of telecommunication networks and other critical infrastructure.124

As an additional measure to ensure the security of public electronic data, Estonia established the first of several planned “data embassies” in 2019. The first embassy, based in Luxembourg, stores public data and information systems critical to the functioning of the state, including its state gazette, land registry, and business register, in the cloud, enabling the Estonian state to function in the event of a cyberattack or other political crisis within the country. The bilateral agreement between the two governments to establish the embassy was signed in June 2017 and it was ratified by both parliaments. The data embassy is granted the same privileges bestowed upon traditional embassies.125

The Estonian e-governance infrastructure suffered one of its first major challenges in 2017, when a chip malfunction that could lead to potential security breaches was discovered in government-issued ID cards.126 In response, the government recalled security certificates for more than 760,000 ID cards, which made their electronic use impossible until the certificates were renewed.127

In late 2021, a declassified document revealed that a vulnerability had been detected in the Estonian ID card software back in 2011. The vulnerability affected 120,000 cards issues in 2011 and allowed the cards to be used without their respective pin codes. The public was not notified of the problem at the time and government authorities were criticized for merely asking users to update their certificates.128

The cybersecurity law implements EU Directive 2016/1148 on measures for a high common level of security of network and information systems.129 It includes requirements to have a computer security incident response team (CSIRT) and a competent national network and information security (NIS) authority (which Estonia previously had) and strengthens cooperation among EU member states. Businesses identified as operators of essential services are required to take appropriate security measures and to notify serious incidents to the relevant national authority. The supervisory authority under the Estonian Cybersecurity Act is the RIA.130

The North Atlantic Treaty Organization (NATO) Cooperative Cyber Defence Center of Excellence is located in Tallinn. Since its founding, the center has supported awareness campaigns and academic research, and hosted several high-profile conferences, among other activities. The center organizes an annual International Conference on Cyber Conflict, or CyCon, bringing together international experts from governments, the private sector, and academia, with the goal of ensuring the development of a free and secure internet.