Capital Area Council of Governments 911 denial-of-service attack

Analyst assessment

A telephony denial-of-service attack impaired Central Texas 911 services Aug. 4, 2024. CAPCOG’s spokesperson attributed the disruption to automated calls overwhelming emergency communications. The affected service was operated through the Capital Area Council of Governments’ regional emergency communications program.

In the district’s Aug. 14 meeting minutes, Emergency Communications Director Richard Morales said calls entered through testing numbers. Austin’s 911 call volume more than tripled, while Round Rock and the Travis County Sheriff’s Office saw increases exceeding 1,000%. Staff redirected excess calls and needed additional personnel to manage the load.

Operational significance

Callers and dispatchers had difficulty hearing each other, automatic location information was missing and some calls rolled to neighboring answering centers. Austin’s original public notice warned of intermittent difficulties and provided an alternative number for emergencies. Other jurisdictions also issued alternate contact numbers.

The extent of failed calls remains disputed. Contemporaneous local reporting described some calls not getting through. Morales later said actual 911 calls were not denied, while documenting extra staffing and rerouting. These accounts establish degraded emergency communications without proving a complete regional shutdown or a quantified loss of emergency responses.

Confidence and uncertainty

Confidence in cyber involvement is high because CAPCOG directly identified the denial-of-service attack and later described its operational effects. The reported mechanism was a robocall flood, not ransomware. Missing caller-location information establishes a data-availability effect; it does not establish theft, encryption or alteration of stored information.

CAPCOG’s executive director reported normal operations restored about 8 p.m. Aug. 4 after work with AT&T. A later Austin update described normalization and continued monitoring without a final all-clear. The incident is recorded as resolved Aug. 4 based on the regional restoration statement, while preserving the differing local recovery accounts.

Analytic gaps

No responsible actor, ransom demand or extortion claim was established. Morales characterized the activity as continuing searches for usable numbers, qualifying initial descriptions of deliberate targeting. The reviewed evidence does not establish a botnet, the distribution of attack sources or an intrusion into administrative systems.

The precise number of legitimate calls lost, delayed or rerouted remains unverified, as does any resulting harm. The region’s full service territory is broader than the locations individually documented as affected. Reports about some dispatch centers cannot establish that every answering center or every resident experienced disruption.