The fact that they arrested one 20-year old ethnic Russian is hardly conclusive proof that he was solely, or even largely, responsible. That's like arresting some low-level drug mule in Miami and concluding that he and his frat buddies were responsible for all the cocaine in America, and that all this talk about Colombian cartels is just so much media hype.

Absence of proof is not proof of absence. The attacks in Estonia were highly organized, targeted, and sustained. Maybe it was just a group of disguntled ethnic Russian or maybe it was something more serious/sinister; we'll probably never know for sure.

What we can say is that, as long as critical infrastructure is vulnerable to cyber-attack, both terrorist organizations and national governments will be investigating ways to exploit this weakness. We'd be fools to assume otherwise.