Method: how incidents are assessed
How it works
- Collect. A collector (
sbcti) reads news feeds and searches: national and regional media, the NCSC and Google News searches on drones, sabotage, reconnaissance, cyberattacks and more. Reports with the right keywords go into a queue. Nothing is published automatically. - Select. I choose which reports go on the map. Only what I consider relevant to the resilience of vital infrastructure is added.
- Extract. A language model (Claude) reads the chosen report and extracts only facts it states: what, where, when, which sector, and whether, for example, there were arrests or a service went down. It also writes a short summary in its own words and says whether the report is about an incident already on the map.
- Assess. The program computes the letters and numbers below with fixed rules. The language model does not judge how serious or reliable anything is.
Each incident gets a permanent reference, for example SB-2026-000012.
Incident types
Each incident has exactly one type:
| Type | Meaning |
|---|---|
| Drone | Drones or unknown aircraft at a site. |
| Reconnaissance | Suspicious people or vehicles observing, photographing or mapping a site; on-site espionage. |
| Sabotage | Deliberate damage or disruption of physical infrastructure: cables, railways, installations, arson. |
| Intrusion | Unauthorised entry to a site or building. |
| Cyberattack | Digital intrusion, ransomware, wipers or manipulation of industrial systems. |
| DDoS | Denial-of-service attack. |
| Data breach | Stolen or leaked data. |
| Threat | Bomb threat, threatening letter or announced attack. |
| Maritime | Suspicious ships near cables, pipelines, wind farms or ports. |
| Influence | Disinformation or influence campaign. |
| Other | Fits nowhere else. |
Each incident also has one or more sectors (energy, water, telecom, transport, government, defence, nuclear, health, finance, digital, chemicals) and a domain: physical, cyber, or hybrid when both meet.
Reliability
Each incident gets a code in the Admiralty system intelligence services use, for example B2: the letter says how reliable the best source is, the number how well the incident is corroborated.
Source reliability
| Letter | Meaning | Examples |
|---|---|---|
| A | completely reliable | official sources: police, NCSC, NCTV, Defence, Dutch government |
| B | usually reliable | national and regional media with a corrections policy: NOS, ANP, AD, PZC, Omroep Zeeland and other regional broadcasters |
| C | fairly reliable | e.g. DutchNews, NL Times, trade media |
| D | not usually reliable | sources of unclear origin |
| E | unreliable | |
| F | cannot be judged | sites not on the list |
An article gets the letter of the site it appears on, also when a search found it. Known disinformation sites are not used.
Credibility of the incident
| Number | Meaning | Rule |
|---|---|---|
| 1 | confirmed | an official source plus another independent source, or three independent sources with one rated A or B |
| 2 | probably true | two independent sources, or one news or official source rated A or B |
| 3 | possibly true | one source rated C |
| 4 | doubtful | only D or E sources, or one source the language model was unsure about |
| 5 | improbable | sources contradict each other |
| 6 | cannot be judged | only sources that cannot be rated |
Sources count per organisation: two articles from the same site are one source. The same ANP report on several sites currently still counts as several sources.
Impact
The impact (low, medium, high) says how much an incident weighs for vital infrastructure. It follows fixed rules too:
- Base: medium for sabotage, intrusion, cyberattack, DDoS and maritime; low for the other types.
- To high when a source reports that a service or process actually went down (disruption), that there is damage, or that there are casualties.
- To at least medium for a critical site (nuclear plant, defence site, main energy grid, major port or airport, flood defence), an arrest, a military response, closed airspace, attribution to a state actor by a government body, or a repeat: an earlier incident within 5 km in the 90 days before.
- A police investigation or a claim by a group is shown but does not raise the impact.
Signals only count when a source states them. Who the perpetrators are or what drives them plays no part, unless a government body reports it.
Location
| Precision | Meaning |
|---|---|
| site or building | the named site, such as a nuclear plant or air base |
| address or street | an address from the source, looked up in the PDOK Locatieserver |
| town | only the town is known; the pin is in its centre |
| municipality | only the municipality is known |
| country | only the country is known; the incident is not on the map |
Places in the Netherlands are looked up in the PDOK Locatieserver, sites and places elsewhere in OpenStreetMap. For well-known fixed sites that cannot be found there, the program uses coordinates from the language model, but only when they lie within 15 km of the named place. A pin with a dotted border is approximate.
Connections
- Same incident: several reports about one incident are merged into one incident with all sources. Its credibility can rise as a result.
- Related: incidents that belong together, such as the same type at the same spot earlier, or a wave of similar incidents.
- Earlier at this spot: an earlier incident within 5 km in the 90 days before.
Related means incidents look alike, not that the same people are behind them.
Data
All incidents are available as JSON at /data/incidenten.json, with times in Dutch time and UTC.
Limitations
- The map is a selection: what I read and consider important. More pins in one place does not necessarily mean more incidents; it can also mean more media attention.
- Automatic extraction can get the place, date or type wrong. The source is always authoritative; please report errors.
- Names of private individuals, suspects or victims are not published.