Skip to content
safemode.space
All incidents
2017-03-05 (approximate)
signal hijacking
link

Reported Gaddafist hijack of a Libyan television signal (5 March 2017, single-source claim)

Confidence in this reading:
low

What happened

SPARTA's bibliography carries one entry for a 5 March 2017 hijack of a Libyan television signal by Gaddafi loyalists, credited to The American Gaddafist. The corresponding artefact is an Internet Archive item uploaded on 10 December 2020 by an account named nrowatcher, containing footage the uploader describes in a single sentence as a television interruption of a news broadcast during which the old Libyan national anthem was played. That is the entirety of the record: no channel is named, no satellite, transponder or uplink is named, no mechanism is described, and the item carries no provenance for the footage beyond the uploader's assertion. Targeted searching found no independent account of a 2017 Gaddafist hijack of a Libyan television signal; the well-documented Libyan satellite material from 2011, on state jamming of satellite signals and on strikes against broadcast facilities, is a separate subject.

HOLD, do not import in this state. The sole source is an anonymous self-published video upload made three years after the fact, with a one-sentence description, no named broadcaster and no corroboration; it does not meet the standard applied elsewhere on the platform. The record exists rather than being silently dropped because SPARTA cites it and because the platform's discipline is to document a weak source as weak rather than omit it. Kept honestly, this is a record of a claim, not of an established event.

Attack vector

Not established. No source describes any mechanism, and nothing places the substitution on a satellite path rather than elsewhere in the distribution chain.

Operational impact

Not established. The uploader describes an interruption of a news broadcast; no duration, broadcaster or audience is given.

Affected segments

link, user

Disclosed

2020-12-10

SPARTA techniques evidenced

Each row is a technique this record evidences, with the reasoning and the source that attests to it.

What relationship, confidence, and evidence mean on the rows below
Relationship

What kind of link this is between the technique and the target.

Mitigates: the target actively prevents, detects, or recovers from the technique.

Addresses: the target governs the technique or is relevant to it, without interdicting it. Most governance and policy obligations sit here.

Triggers obligation: the technique occurring is what triggers the duty the target imposes.

Relates to: related to the technique, but the target neither interdicts nor governs it. Used sparingly.

Confidence

How strongly the source supports this mapping, not how severe the technique is.

High: the source supports the mapping squarely.

Moderate: supported, with a qualification such as a cross-tactic reading that stays operationally sound.

Low: the source reaches the technique only in part.

Evidence

How close to the source text the mapping was made.

Direct: a verbatim excerpt of the cited source was read against the technique, and the rationale argues from that excerpt.

Derived: the mapping follows from the source's scope or structure, with no on-point excerpt addressing the technique.

Inferred: reached by composition through another framework, or by domain reasoning the source does not support on its face.

  • If the footage is what the uploader says it is, a news broadcast was interrupted and replaced, which is disruption of service to the intended audience. Held at low confidence and derived because the only evidence is a single uploader's one-sentence description: no broadcaster is named, no duration is given, and nothing establishes that the substitution occurred on a satellite path rather than anywhere else in the distribution chain.

    https://archive.org/details/gaddafists-hack-libyan-tv-signal-march-5-2017

Considered and not mapped

These techniques were considered for this record because a source, a related record or SPARTA's own catalogue pointed at them. Each was read against what the sources say and not mapped. The reason is given in full.

Sources

The published accounts this record rests on. The tier is SafeMode Space's own assessment of the source, and the reason for it is given beside it. What the tiers mean and how they are assigned: the source tiers.

A source is listed when a mapped technique rests on it, or when it disputes the account. One the curators read but neither cited nor recorded as disputing the record is not listed, so an absence here means neither is true rather than that nobody looked.

  • Internet Archive (self-published item) · nrowatcher (Internet Archive uploader) · 2020-12-10

    Tier 3: A self-published video upload by an anonymous account, made three years after the event it purports to show, with a one-sentence description and no stated provenance. The Internet Archive is the host, not the publisher, and applies no editorial check. The lowest-authority source in the batch.

Every source SafeMode Space reproduces, and on what terms: sources and attribution.

Corpus 2026.08.24-1, built 2026-08-24 from 226 techniques, 308 regulation articles, 125 ENISA controls, 2,610 framework controls, and 90 countermeasures.