“Trust cannot be built in the middle of a crisis” – Digital preparedness in the Baltic Sea requires cutting red tape alongside technology
A crisis does not stop at national borders, nor do corporate supply chains. Although the Nordic and Baltic countries are currently building joint capabilities to detect and counter cyber threats, what truly matters in a real situation is whether you know your counterpart in the neighbouring country, and whether critical information flows smoothly across borders without bureaucratic hurdles.
‘You cannot start searching for trust or contacts in the middle of a crisis. That groundwork has to be laid in advance,’ summarises Carmen Raal, Head of International Cyber Security Cooperation at Estonia’s Ministry of Justice and Digital Affairs. She attended the TIETO26 preparedness exercise at the end of September.
Finland and Estonia share the same threat perception in the Baltic Sea region, the same values, and a long history of cooperation. According to Raal, the political will to protect regional cyber security and critical infrastructure already exists. Now, it must be translated into practical operational action and shared technical tools.
Alongside technological capabilities, Raal emphasises the human factor and regular face-to-face meetings.
‘We cannot underestimate the power of knowing the person behind the screen. When a crisis strikes, it is vital to know who to call.’
In her view, when planning crucial cyber security initiatives, one cannot simply stay at home. Meeting in person is essential.
From political will to operational cooperation
A concrete example of operational cooperation is the Nordic-Baltic Cyber Consortium (NBCC). This is a joint initiative between the Nordic and Baltic countries, led by Denmark. The countries have decided to invest jointly in technical capabilities to share information on cyber threats, enhance situational awareness and detection, and prevent attacks. According to Raal, an extensive shared situational picture helps develop analytical capabilities so that the cyber security landscape is no longer as fragmented as in the past. Through the initiative, the countries will collect information together, interpret threats more effectively, and respond faster to both cyber and hybrid threats.
Trust must also extend to businesses
Trust between public authorities alone is not enough, as a large proportion of critical infrastructure, such as fibre-optic cables, is held by the private sector. Raal highlights Project Merikarhu, coordinated by The National Emergency Supply Agency (NESA), as a prime example. In this project, stakeholders from Finland, Sweden, and Estonia are working alongside the private sector to improve their readiness to repair subsea cables in the Baltic Sea swiftly.
‘Merikarhu is a prime example of regional public-private partnership. This kind of pragmatic, hands-on action is precisely the direction for the future,’ says Raal.
In the TIETO26 exercise, however, businesses highlighted an issue for which, according to Raal, there is not yet an adequate solution. When a company is remediating an incident that affects the entire region, it has to communicate simultaneously with authorities in multiple countries. Furthermore, sharing confidential information can require separate security clearances in each country.
‘Does information get bogged down in bureaucracy when time is of the essence?’ Raal asks.
During the panel discussion, she illustrated the scenario from a company’s perspective: if Estonia, Finland, Sweden, and Latvia are all asking the same questions at the same time, cooperating with the authorities can feel like opening Pandora’s box. According to Raal, the Nordic and Baltic nations should resolve this regionally first, and the plan is to involve the private sector in the work of the NBCC as well.
Next step: a major regional cross-border exercise
According to Raal, it is exercises in particular that turn trust from paper into practice. They are where colleagues get to know the individuals they will call during an emergency, and where bottlenecks in information sharing are identified.
The TIETO26 exercise made a strong impression on her. Raal notes that bringing the private and public sectors together for a multi-day joint exercise is a significant achievement.
Raal is already looking ahead: alongside national exercises, genuinely multinational scenarios are required. In June, Estonia hosted the large-scale ILVES exercise with nearly 4,000 participants, testing the capability of authorities and operators critical to the security of supply to respond to extensive hybrid threats.
‘In the future, we should consider combining the TIETO and ILVES exercises. Supply chains are complex, and a disruption in one country is unlikely to remain local. We need shared cross-border scenarios where businesses and authorities from several countries practise joint decision-making and information flow.’
Secure information-sharing channels cannot be built through paperwork alone, according to Raal.
‘If we do not test this in practice, we risk losing valuable time and intelligence when a business needs to reach counterparts across multiple countries simultaneously.’
Text: Matti Lintulahti Images: Meeri Utti
Head of international cybersecurity cooperation
Carmen Raal
Until October 2026, Carmen Raal served as Head of International Cyber Security Cooperation at Estonia’s Ministry of Justice and Digital Affairs.
She took part in the TIETO26 exercise and the accompanying panel on Nordic-Baltic cyber security cooperation.
At the end of October, Raal moved to the Estonian Ministry of Economic Affairs and Communications to lead economic policy portfolios.