What evidence may show deliberate service disruption?¶
The practical answer¶
Deliberate service disruption should be supported by evidence linking intentional activity to the outage or degradation.
The key evidential caution¶
The dangerous assumption is that impact alone proves intent.
It does not.
Evidence may include:
Key points¶
- attack commands
- repeated abusive requests
- service-stop actions
- configuration changes
- resource-exhaustion patterns
- operator communications
- extortion threats
- malware tasking
- timed or repeated attacks
- activity continuing after warnings or blocking
What investigators should establish¶
Investigators should establish:
Key points¶
- who or what initiated the activity
- the mechanism
- the affected resource
- the timing
- the system response
- whether the disruption was the likely or intended result
Automation may carry out deliberate disruption without a human issuing each request.
Conversely, a reckless or misconfigured process may cause serious harm without a clear intention to disrupt.
Evidential limits¶
Do not infer intent solely from technical effect.
Intent may also be inferred from persistence after mitigation, target selection, threats or repeated adaptation. That inference should be explained rather than hidden behind the technical label. A failed attempt can still be deliberate even where the service remained available.
Where communications accompany the disruption, preserve the exact wording and timing. A threat sent before the outage may support intent and linkage differently from a claim made afterwards by someone seeking credit.
Repeated attacks against the same target, changes made after mitigation and requests designed to maximise cost may also support deliberate intent. Preserve the progression because adaptation can show that the actor observed the effect and changed method in response.
Operational takeaway¶
Link the disruptive action, method and result, and support any conclusion about intent with command, communication, repetition or contextual evidence.