About CYBER

• Nothing is invented. Every record links to its original publication; every statistic names its source, reporting period and definition. Missing values are shown as Unavailable.
• Allegations stay allegations. Charges, indictments and arrests are labeled as allegations; pleas, convictions and sentencings are labeled as announced by the source.
• Vulnerabilities are not incidents. KEV entries and advisories are kept apart from crime reports.
• No fake activity. Radar sweeps, scan lines and pulses are decoration. Freshness is shown only by real retrieval timestamps.
• No mixing of metrics. Annual IC3 complaint statistics, indexed report counts and third-party crypto estimates are always shown separately.

• The FBI does not publish a live, public database of individual IC3 complaints. State and national IC3 numbers are annual report figures, not live counts.
• FTC Consumer Sentinel data: ftc.gov refused automated requests from CYBER's build environment (HTTP 404 to scripted clients, October 2026). Rather than copy second-hand figures, CYBER links to ReportFraud.ftc.gov and does not display FTC statistics.
• The FBI's Cyber-division news page exposes an empty RSS feed, so CYBER filters the FBI national press-release feed by keyword. Field-office releases are not yet indexed.
• The DOJ API only supports searching headlines. Releases about cybercrime whose headlines lack the search terms will be missed.
• Location means the announcing U.S. Attorney's Office (prosecuting district) or a state named in the headline. It is never the location of an attack, and many reports have no location.
• Categories and evidence status come from transparent keyword rules applied to headlines and summaries. They can be wrong; the original report is always authoritative.
• DeFiLlama's dataset is global and its losses are estimates. It is shown only on the Crypto Crime page and never combined with U.S. government figures.
• CVSS scores come from the official CVE record and are not available for every KEV entry; missing scores are shown as “Not published”.

1. Each deploy runs a snapshot of every live source, so the site always ships with a real dataset for first load.
2. In the browser, CYBER requests /api/intel, a serverless function that queries every source in parallel with time limits.
3. Responses are cached at the CDN for 10 minutes. A failing source falls back to its last snapshot and is marked as such in the status panel.
4. Records are normalized into one model, classified, and de-duplicated: the same announcement from several offices becomes one record that keeps every source link.

id · title · summary · org · source · url · publishedAt · incidentAt · category · categories · crypto · cryptoType · status · locations[state, basis] · amountUsd · amountBasis · severity · tags · attributions[] · ingestedAt