Method for determining a cause of a fault in an electrical energy supply network , in which - electrical measurement variables are detected at at least one measurement point of the energy supply network ; and - the electrical measurement variables are fed to at least one protective device , which examines the measurement variables with respect to the presence of a fault in the electrical energy supply network , and generates a fault signal in the event of an identified fault, wherein - after a fault has been identified by the at least one protective device , time profiles of the measurement variables with respect to the presence of specific criteria are examined, said time profiles having been detected immediately before and/or during the fault, wherein possible causes of faults are assigned to the individual criteria and/or combinations of criteria; - one or more criteria that are entirely or partially fulfilled by the examined profiles of the measurement variables are determined; and - a cause of the fault is determined on the basis of the determined criteria and the degree to which they are fulfilled by the profiles; characterized in that - at least some of the criteria are suitable for identifying deliberately caused faults, wherein - a plurality of the following criteria are used as criteria that indicate a deliberately caused fault: - identification of a permanently present fault; - identification of repeated, automatic disconnection and connection of a phase of a line within a predefined time period; - a fault resistance that is below a predefined threshold value; and - if the check reveals that the fault has been caused deliberately, an alarm signal that indicates a possible line theft is generated. - electrical measurement variables are detected at at least one measurement point of the energy supply network ; and - the electrical measurement variables are fed to at least one protective device , which examines the measurement variables with respect to the presence of a fault in the electrical energy supply network , and generates a fault signal in the event of an identified fault, wherein - after a fault has been identified by the at least one protective device , time profiles of the measurement variables with respect to the presence of specific criteria are examined, said time profiles having been detected immediately before and/or during the fault, wherein possible causes of faults are assigned to the individual criteria and/or combinations of criteria; - one or more criteria that are entirely or partially fulfilled by the examined profiles of the measurement variables are determined; and - a cause of the fault is determined on the basis of the determined criteria and the degree to which they are fulfilled by the profiles; characterized in that - at least some of the criteria are suitable for identifying deliberately caused faults, wherein - a plurality of the following criteria are used as criteria that indicate a deliberately caused fault: - identification of a permanently present fault; - identification of repeated, automatic disconnection and connection of a phase of a line within a predefined time period; - a fault resistance that is below a predefined threshold value; and - identification of a permanently present fault; - identification of repeated, automatic disconnection and connection of a phase of a line within a predefined time period; - a fault resistance that is below a predefined threshold value; and - if the check reveals that the fault has been caused deliberately, an alarm signal that indicates a possible line theft is generated. <EOS>