Method for determining a cause of a fault in an electrical energy supply network (11, 21a, 21b), in which - electrical measurement variables are detected at at least one measurement point of the energy supply network (11, 21a, 21b); and - the electrical measurement variables are fed to at least one protective device, which examines the measurement variables with respect to the presence of a fault in the electrical energy supply network (11, 21a, 21b), and generates a fault signal in the event of an identified fault, wherein - after a fault has been identified by the at least one protective device, time profiles of the measurement variables with respect to the presence of specific criteria are examined, said time profiles having been detected immediately before and/or during the fault, wherein possible causes of faults are assigned to the individual criteria and/or combinations of criteria; - one or more criteria that are entirely or partially fulfilled by the examined profiles of the measurement variables are determined; and - a cause of the fault is determined on the basis of the determined criteria and the degree to which they are fulfilled by the profiles; characterized in that - at least some of the criteria are suitable for identifying deliberately caused faults, wherein - a plurality of the following criteria are used as criteria that indicate a deliberately caused fault: - identification of a permanently present fault; - identification of repeated, automatic disconnection and connection of a phase of a line within a predefined time period; - a fault resistance that is below a predefined threshold value; and - if the check reveals that the fault has been caused deliberately, an alarm signal that indicates a possible line theft is generated. - electrical measurement variables are detected at at least one measurement point of the energy supply network (11, 21a, 21b); and - the electrical measurement variables are fed to at least one protective device, which examines the measurement variables with respect to the presence of a fault in the electrical energy supply network (11, 21a, 21b), and generates a fault signal in the event of an identified fault, wherein - after a fault has been identified by the at least one protective device, time profiles of the measurement variables with respect to the presence of specific criteria are examined, said time profiles having been detected immediately before and/or during the fault, wherein possible causes of faults are assigned to the individual criteria and/or combinations of criteria; - one or more criteria that are entirely or partially fulfilled by the examined profiles of the measurement variables are determined; and - a cause of the fault is determined on the basis of the determined criteria and the degree to which they are fulfilled by the profiles; characterized in that - at least some of the criteria are suitable for identifying deliberately caused faults, wherein - a plurality of the following criteria are used as criteria that indicate a deliberately caused fault: - identification of a permanently present fault; - identification of repeated, automatic disconnection and connection of a phase of a line within a predefined time period; - a fault resistance that is below a predefined threshold value; and - identification of a permanently present fault; - identification of repeated, automatic disconnection and connection of a phase of a line within a predefined time period; - a fault resistance that is below a predefined threshold value; and - if the check reveals that the fault has been caused deliberately, an alarm signal that indicates a possible line theft is generated.