We're starting off today's event, with @HeliKlaar giving the context for Estonia's early adoption of digital tech. "We've moved government services online - every citizen has an ID card that allows them to access these services, from getting married to registering a birth."

"This early adoption sets Estonia apart from the rest of the world," she says. "We had e-banking in the mid-90s, for instance. In a way, we've been like an experiment, and some of the lessons we've learned have been useful for the rest of the world."

"In 2007, when we started to focus on cyber security, there were no international fora to discuss this. We were early in calling for a structure for normative state behavior in this space, and we're glad to see so many processes now in place in international organizations."

"There are now more than 20 diplomats working on cyber full-time," says @DuncanHollis. "What are the key challenges you see as the most serious threats in cyberspace right now?"

"Attacks on healthcare are a concern for all humanity," says @HeliKlaar. "But we're also seeing large organized crime groups move into the cyber realm. State actors know there is a process by which other countries could call them out, but criminals don't have those boundaries."

"In 2017, we saw many European countries experience serious difficulties due to WannaCry and NotPetya. Cybersecurity is still not considered a mainstream policy issue, but we have made a lot of progress over the last five years."

What is the role of a cyber diplomat? "We're facilitating negotiations at the UN and other orgs on safe behavior in cyberspace. This normative stability framework - how do we implement this? How do we promote this issue, so all countries & larger society understand cyber norms?"

"In 2019, the UN General Assembly endorsed the work by its first committee on applying international law to cyberspace. Why was that such an important affirmation?" asks @DuncanHollis.

"Our PM once said that international law is the nuclear weapon of a small country," says @HeliKlaar. "We have rules-based world order, and we need to preserve that by following the rules and ensuring others do too."

"Authoritarian states want there to be gaps in the law, because they feel that gives them - or proxies working with them - room to maneuver."

Can international law really be implemented in cyberspace? "As we've said, some countries want to maintain some room to maneuver. But when I look at the UN membership, almost 85% of countries would like to abide by existing rules, they know this protects them too in long term."

There are debates about international law & cyber space among even like-minded countries. Has Estonia formulated a position on concepts like due diligence? "Our President articulated this due diligence concept in the past - to say countries have a duty to prevent harm to others."

What about sovereignty in cyberspace? "Sovereignty is not just about rights, but obligations. Sovereignty is certainly a foundation of international law."

What are cyber norms? "States should agree on norms, and then follow them. We cannot enforce them in the same way as we can things like arms control, we can't monitor every laptop in the world. So we need to assist international law and set norms of acceptable state behavior."

"We have some norms established already, but some states do not wish to follow them; others may not have the capacity to do so; others are not aware of them. So we're still in the process of mainstreaming these norms, so all countries who wish to follow them can follow them."

Has there been progress in mainstreaming norms? "We have processes at the UN committee level, we have agreed norms. But we need to communicate what responsible, safe behavior looks like to the wider public, to governments who are not as engaged in the process."

. @DuncanHollis references the 2015 UNN norms on cyber space, learn more about these here: https://ccdcoe.org/incyder-articles/2015-un-gge-report-major-players-recommending-norms-of-behaviour-highlighting-aspects-of-international-law/

Do we have good attribution processes in place at the international level? "Attribution is complex - there are technical, political, and legal issues. It is up to each government to attribute attacks as they see fit, so they could not accept a third party org doing this."