Why we made "suspected unlawful" a three-state field, not a checkbox

Building the field guide that mirrors ENISA's Single Reporting Platform, we hit one question early that a naive form would have gotten wrong: "is the incident suspected of being caused by unlawful or malicious acts?"Art. 14⁠(4)⁠⁠(a)⁠ A yes/no toggle is the obvious control for that. It's also the wrong one, and building it that way would have quietly pressured every early warning toward a guess.

The short answer

At the 24-hour early-warning stage, you frequently don't know yet whether an incident was caused deliberately or by an ordinary failure — that's exactly what an investigation is for. ENISA's own guidance says to select "unknown" while the cause remains unresolved, so we built suspected_unlawful as a tri-state field — yes, no, or unknown — rather than a boolean, because a boolean has no way to represent "we don't know yet" without lying in one direction or the other.

What a boolean would have cost

Picture the early-warning stage of a genuine incident, six hours after it started. Nobody yet knows whether it was an external attack or an internal misconfiguration that looks similar from the outside — that's normal, not a process failure, at this stage. A yes/no field forces someone to pick anyway. Answering "no" when the cause is genuinely unresolved understates a live investigation to the authority receiving the report; answering "yes" pre-emptively can mischaracterize what may turn out to be an ordinary outage. Neither is dishonest exactly, but both assert more than is actually known at hour six of a 24-hour clock — which is precisely the situation ENISA's guidance is written to avoid.

The withholding provision that runs alongside it

The same discipline shows up again at the notification stage, in a section of the form we label "particular exceptional circumstances." Article 16(2) lets a manufacturer withhold full dissemination of a vulnerability notification on three specific grounds — among them, that exploitation has so far been confined to the single member state receiving the report, or that wider dissemination would harm essential security or public interests more than it would help.Art. 16⁠(2)⁠ It's an optional field, available only for vulnerabilities and only at the notification stage, and invoking it means ENISA receives partial information until the coordinating CSIRT decides to make the full notification available. We surface the three grounds verbatim from the delegated act rather than paraphrasing them, because a manufacturer deciding whether to invoke a legal ground for withholding information should be reading the actual wording, not our summary of it.

The pattern underneath both of these

Neither of these fields exists because we imagined an edge case — both come directly from ENISA's own SRP glossary and FAQ, aligned field by field in the field guide, with every field carrying the glossary reference and article it rests on. The pattern is the same one that runs through the rest of the packet: don't force a form to know more than the person filling it out actually knows, and don't paraphrase a legal provision when quoting it costs nothing extra. A reporting tool that makes filing feel more certain than the underlying facts are is doing its job worse than one that admits uncertainty plainly — because the person reading the report at the CSIRT is going to notice the difference either way.