Who will sue the police? Who will investigate the police?

LEA and intelligence agencies operate in legally grey areas because the know they can get away with it and the politicians are happy that results can be shown.

Parallel construction is often used, involving private sector 3rd parties.

Depends on what laws you're considering. So not knowing exactly which country the server was located in or the country the police that enacted the DDoS are from it is hard to say if it's legal or not.