Many recorded shutdowns are ambiguous. A country goes dark for eight hours — was it a state-ordered censorship action, a DDoS, a fiber cut, a BGP misconfiguration, weather, or planned maintenance? A confirmed-censorship attribution carries journalistic weight; misattributing a natural outage as censorship is reputation-damaging. This finding ships a meta-classifier that takes an incident or arbitrary window and returns category probabilities.

What ships

• POST /v1/atlas/attribute-outage — score a country / time window
• GET /v1/atlas/attribute-outage/info — sidecar metrics + honest caveats

Request body: {`{country, start_time, end_time?, duration_hours?, features?}`}. Response: a probability map across censorship, natural_outage, four natural_outage:* sub-cause hints (ddos / infrastructure / weather / maintenance), and mixed_unknown — plus a verdict, a band (high / medium / low / very_low), and the top-5 contributing features with their current values.

Model

• Algorithm: GradientBoostingClassifier (200 trees, depth 4, lr 0.05)
• Training set: 2,696 incidents — 399 censorship+mixed positive, 2,297 IODA disruption negative
• Features (52): declared incident fields (severity, mechanism, multi-source flags, measurement count), temporal shape (duration, time-of-day, weekday, weekend-start, very-long flag), evidence-window shape (signal-type mix, ASN diversity, source diversity, domain category distribution including NEWS / ANON / GRP, blocking-method count, critical-signal fraction)
• Cross-validated AUC (stratified 5-fold OOF): 0.9974
• Honest baseline (same model, source-identity features dropped): 0.9978 — even with has_ioda_source, has_ooni_source, etc. removed, the shape signal alone separates the classes

Promote-floor check

• Censorship recall at P(censorship) ≥ 0.60: 99.2% (out-of-fold) / 100% (in-sample) — floor was 80%
• Natural-outage correct at P(censorship) < 0.40: 99.8% (out-of-fold) / 100% (in-sample) — floor was 60%
• Per-incident-type recall on the 343 confirmed censorship rows: 100% predicted with P(censorship) ≥ 0.6 in-sample, > 99% OOF
• Per-incident-type recall on the 43 mixed rows: 100%
• Per-incident-type correctness on the 2,297 IODA disruption rows: 100% predicted with P(censorship) < 0.4 in-sample, 99.8% OOF
• PASSED both promote floors

Sub-cause hints

We do not have ground-truth labels for ddos / infrastructure / weather / maintenance. The four sub-causes are emitted as heuristic feature-shape hints, not supervised classes. The natural-outage probability mass is allocated across them using rules of thumb: short + bursty + weekend → nudge ddos; long + IODA-dominant + few ASNs → infrastructure; business-hours + short → maintenance; weather currently has no live signal (small fixed prior pending NWS / OpenWeather integration). Treat them as hints, not verdicts.

Live samples

{`# Iran (censorship-heavy window, multi-source evidence)
curl -X POST https://api.voidly.ai/v1/atlas/attribute-outage \\
  -H 'Content-Type: application/json' \\
  -d '{"country":"IR","start_time":"2026-03-01T00:00:00Z","end_time":"2026-03-05T00:00:00Z"}'

# → verdict: censorship,  band: high,  P(censorship): 0.9997

# Afghanistan (long IODA-dominated outage)
curl -X POST https://api.voidly.ai/v1/atlas/attribute-outage \\
  -H 'Content-Type: application/json' \\
  -d '{"country":"AF","start_time":"2026-01-08T05:45:00Z","end_time":"2026-03-04T00:00:00Z"}'

# → verdict: natural_outage,  band: high
#    natural_outage:infrastructure: 0.68, ddos: 0.05, weather: 0.14, maintenance: 0.14`}
      

Honest caveats

• Sub-cause discrimination is heuristic, not learned. We have no labeled ground truth for ddos / fiber / weather / maintenance on our 2,297 IODA disruption rows — the upstream IODA alert just says "outage." Sub-cause hints come from feature-shape rules, not supervised classification.
• Negative class is a prior, not ground truth. We treat IODA-only disruption incidents as a natural-outage prior. Some of them were probably state-ordered shutdowns that didn't leave OONI / CensoredPlanet fingerprints — those rows are mislabeled negative in our training set. This is a known limitation that will get fixed when we wire in BGP route-count change correlation, submarine-cable cut calendars (Telegeography), and weather event feeds.
• Headline AUC is partly recovering the labeling rule. Top feature is has_ioda_source (87.6% importance) — the classifier is partly learning that disruption rows come from IODA and censorship rows come from OONI / CensoredPlanet. We report a separate honest_auc_no_source_features (0.9978) — the shape-signal-only AUC, computed by retraining with the eight source-identity features dropped. That is the genuine cross-source generalization number.
• Many real outages are genuinely ambiguous. The endpoint exposes probability bands (high / medium / low / very_low) and reserves the [0.40, 0.60) range as mixed_unknown. Journalists and researchers should show the band, not collapse to argmax, especially for novel events outside the training distribution.
• Low-evidence windows are low-confidence. If ev_n in the response is near zero, the model has nothing to discriminate on — the response will lean toward the prior. The top_features array exposes which features fired.

What this does NOT replace

Human judgment. Government statements. Civil-society confirmation from inside the country. This is a triage layer for the firehose of IODA / OONI / CensoredPlanet signals — not a replacement for the journalist asking "did a minister announce the shutdown" or "are there fiber cut reports from the cable operators." Use the meta-classifier to focus attention; confirm with humans.