DDoS Protection for Government and Critical Infrastructure

Public services face the same attacks as everyone else under constraints that remove several of the standard answers. The most important one is simple and rarely stated: a public service cannot refuse a population to protect itself.

Everything distinctive about this sector follows from that, plus the fact that its downtime is not a commercial inconvenience but a failure of an obligation.

At a glance

Appliance	Constraint	What it removes	What has to replace it
Cannot refuse a population	Geographic blocking as a routine response	Behavioural separation, and rate control per source
Continuity is a duty	Cost-based tolerance for downtime	A stated tolerance agreed by someone accountable
Dependency is a policy matter	Choosing suppliers purely on capability	Documented behaviour when a supplier is unreachable
Evidence reaches an authority	Telemetry that lives only in a console	Local retention and unassisted export

The first row is the structural one. Removing geographic blocking removes the fastest crude countermeasure and forces every other control to be better calibrated.

The countermeasure you cannot use

Geographic and network-level blocking is the fastest crude response available to most estates. A commercial service can decide that an entire country is not worth the trouble for the next four hours and act accordingly.

A public service usually cannot. Citizens travel and use foreign networks. Services are reached through carriers whose addressing does not map neatly to a territory. And a government portal that refuses a region to defend itself has produced a political problem larger than the outage.

There is a second reason, less often noticed: campaigns targeting public services increasingly originate from domestic residential addresses, so geographic filtering removes legitimate users and leaves the attack in place.

The practical consequence is that everything else has to be better. Per-source rate control, behavioural separation, and thresholds calibrated to real traffic are not refinements here; they are what remains when the blunt instrument is unavailable. Calibration discipline — measuring the legitimate peak before setting anything — matters more in this sector than in any other.

Continuity as a duty rather than a target

Commercial estates set availability targets by weighing downtime cost against defence cost. Public services often cannot express the numerator in money, which tends to produce one of two failures: an unstated requirement that everything must always work, or no stated requirement at all.

Both are unfundable. The useful move is to make someone accountable state the tolerance explicitly, per service:

• Which services must not be interrupted at all, and why.
• Which may degrade, how far, for how long.
• Which may be unavailable, and what the public is told while they are.

That document does more for a procurement than any technical requirement, because it is the only thing that turns “critical” into a number a design can be built against. It is also the sixth line of the sizing record, and the one most often left blank.

Dependency becomes a policy question

In a commercial estate, supplier dependency is a risk to be priced. In public infrastructure it is frequently a policy matter, and the two produce different architectures.

The technically honest framing avoids the rhetoric. Three properties are testable, and they are what most sovereignty requirements are actually reaching for:

What stops when an external service is unreachable. Answered per function, not per product. This is the fail-operational question, and in this sector it is asked in its strongest form because the scenario includes degraded international transit rather than only a supplier outage.

Where classification data goes. Detection performed elsewhere requires traffic characteristics to travel there. What travels, in what form, to which jurisdiction, with what retention — worked through in local versus cloud-dependent detection.

Whether the arrangement can be exited. A dependency that cannot be unwound is a concentration, and supply-chain security is an explicit obligation under NIS2 rather than a preference.

Where equipment is manufactured is a separate argument with separate merits, and conflating it with these three testable properties weakens all four. The jurisdictional dimension is treated on its own terms in vendor jurisdiction risk, and the extreme case — no external path permitted at all — in air-gapped and restricted networks.

Visibility attacks and the communications problem

A substantial share of attacks on public services aim at visibility rather than damage. A public-facing page unavailable for twenty minutes is the objective, because the outage itself is the message and will be screenshotted.

This changes the response calculus in a way that is worth planning for rather than discovering. The operational impact may be modest while the reputational impact is not, which means communications preparation is part of the defence rather than an afterthought.

Two cheap measures do most of the work:

A static fallback. A read-only version of essential public information, hosted separately from the systems under attack, on different infrastructure with different addressing. It keeps the public informed and removes the pressure that produces bad decisions at 03:00.

A pre-drafted statement with a named owner. Written before the incident, because the version written during one is always worse and always later.

The structural analysis of these campaigns — how they organise, and what that means for defenders — is in hacktivist DDoS campaigns.

Evidence reaches an authority

Under NIS2 an essential entity reports on a staged timetable, and the report requires material that exists by then or does not.

The requirements are the same ones any regulated estate needs — local retention beyond the reporting window, export your own staff can perform unassisted, synchronised and demonstrable timestamps — with one addition specific to this sector: the recipient may be a national authority whose format expectations differ from a commercial insurer’s. Establish the format before the incident.

What to specify

• Full function with no external connectivity, stated per function.
• Local classification, with what leaves the estate documented.
• Local evidence retention covering the reporting deadline, and unassisted export.
• Per-source rate control and behavioural separation, since geographic blocking is unavailable.
• A stated continuity tolerance per service, agreed by someone accountable.
• A static fallback on separate infrastructure, tested.
• Exit terms with a period, because dependency is a supervisory concern.

Nothing on that list is a capacity figure. Capacity is the part of this problem with a straightforward answer, and it is arithmetic rather than judgement.