Cyber Incident Victim: Essex Police
Date:
Sep 2015
Location:
United Kingdom
Summary
A Brazilian teenager claimed responsibility for a distributed denial of service (DDoS) attack that temporarily disrupted the Essex Police website, causing approximately 30 minutes of downtime. The attacker, operating under the Twitter handle @n0w1337, described themselves as a bored individual with free time after graduating high school and asserted no fear of repercussions, incorrectly stating their actions were not unlawful. The police confirmed the incident and collaborated with other law enforcement agencies to investigate, while UK legislation cited potential legal consequences for such attacks.
| CIA Posture | Motives | Tactics, Techniques & Procedures |
|---|---|---|
| Available to members | 2 motives | 1 technique |
| Threat Actor | Type | Location |
|---|---|---|
| 1 actor | Available to members | Available to members |
Description
On September 3, 2015, before 1:00 PM local time, Essex Police's website became unavailable for approximately 30 minutes due to a distributed denial of service (DDoS) attack. The same Twitter account (@n0w1337) that claimed responsibility for a prior DDoS attack against Greater Manchester Police's website earlier that week publicly asserted involvement in this incident. Essex Police confirmed the outage and characterized it as a suspected denial of service attack in statements to The Register. Investigators from the force initiated an inquiry, coordinating with other law enforcement agencies to pursue potential leads. The attacker communicated directly with journalists during the incident, stating "They are trying to restart maybe in a few minutes I stop" shortly before service restoration. A tweet from @n0w1337 featured a screenshot of the Essex Police website with an "Offline" hashtag, timestamped September 3, 2015.
The individual behind @n0w1337 identified as a Brazilian teenager who would soon turn 19 years old, describing themselves as a high school graduate with idle time before college. Despite the account's self-declared location in Lithuania, the attacker clarified this was a misdirection, stating "Yes I am Brazilian but I like Lithuania." They exhibited no concern about legal consequences, rhetorically asking "But who's going to get me?" while dismissing the criminality of DDoS attacks by comparing them to legitimate protests and accusing institutions of corruption. UK legislation explicitly criminalized such acts under Section 36(3) of the Police and Justice Act 2006, carrying penalties of up to 10 years imprisonment. The attacker's Twitter activity showed a pattern of primarily following Brazilian accounts despite targeting UK law enforcement websites. Essex Police restored normal website operations within the 30-minute disruption window while maintaining investigative efforts with partner agencies.