Chapter 2 — Critical infrastructure and sector security: advanced seminar

Chapter 2 — Critical infrastructure and sector security: advanced seminar

Lesson map

Lesson 02 published. Map, example, EX008.

flowchart TD
  N0["Learning outcomes and connection"]
  N1["2.1 What the seminar is for"]
  N2["2.2 Sector profiles"]
  N3["2.3 How sector incidents become regional"]
  N4["2.4 Public incident catalogues are samples, not popu"]
  N5["2.5 When the first account is revised"]
  N6["2.6 Reading a sector paper: a worked seminar"]
  N7["2.7 Presenting in the seminar"]
  N0 --> N1 --> N2 --> N3 --> N4 --> N5 --> N6 --> N7
  N7 --> EX["Worked example"]
  EX --> Q["Exercise EX008"]

Logical drawing

flowchart LR
  N0["Learning outcomes and connection"]
  N1["2.1 What the seminar is for"]
  N2["2.2 Sector profiles"]
  N3["2.3 How sector incidents become regional"]
  N4["2.4 Public incident catalogues are samples, not popu"]
  N5["2.5 When the first account is revised"]
  N6["2.6 Reading a sector paper: a worked seminar"]
  N7["2.7 Presenting in the seminar"]
  N0 --> N1 --> N2 --> N3 --> N4 --> N5 --> N6 --> N7 --> Q["EX008"]

[Learning outcomes and connection]
    |
    v
[2.1 What the seminar is for]
    |
    v
[2.2 Sector profiles]
    |
    v
[2.3 How sector incidents become regional]
    |
    v
[2.4 Public incident catalogues are samples, not popu]
    |
    v
[2.5 When the first account is revised]
    |
    v
[2.6 Reading a sector paper: a worked seminar]
    |
    v
[2.7 Presenting in the seminar]
    |
    v
[Worked example] --> [Exercise EX008]

Learning outcomes and connection

By the end of this chapter the learner will be able to:

1. Describe for each major sector its characteristic consequence unit, buffers, governing instruments and the evidence a master's researcher can realistically obtain.
2. Distinguish dependency cascades (a supplier fails and its dependants fail after their buffers) from load-transfer spillover (peers absorb the demand of a failed unit), and recognize which a study measures.
3. Treat public incident catalogues as data with a selection process, and quantify how disclosure that rises with severity inflates apparent severity and how a change in reporting rules creates a spurious trend.
4. Code incidents whose first public account was later revised, without either repeating the first account or erasing it.
5. Read a sector paper with a fixed critical protocol and present it in a seminar so that the discussion is about evidence, not opinion.

This chapter widens the evidence map built in Chapter 1 from one sector to the field. The doctoral book's research-frontier chapter surveys standards as hypotheses and the families of interdependency models; this seminar does not repeat that survey. It concentrates on what a beginning researcher needs: how sectors differ in the consequences they produce and the evidence they leave, how to read the evidence that exists, and how to discuss it with peers.

2.1 What the seminar is for

A research seminar trains three habits that a dissertation needs and that lectures do not: reading a paper for what it can support, presenting another person's work fairly before criticizing it, and accepting criticism of your own reading. Each session in this course follows the same protocol, which you will reuse when you write Chapter 7's literature review:

1. Claim. What does the paper claim, at what scope? Quote the sentence.
2. Evidence. What data, from which units, over which period?
3. Warrant. Why does that evidence support that claim — what design logic connects them?
4. Rivals. What else could have produced the same evidence? Which rivals does the paper address, and how?
5. Transfer. To which other units, sectors or jurisdictions might the result apply, and under what conditions?
6. So what. What decision or later study does it inform?
7. Next study. What one study would most reduce the remaining uncertainty?

The presenter answers questions 1–3 and 5–6 in the paper's own terms, then opens 4 and 7 to the group. Critique of a published paper is not a verdict on its authors; most limitations follow from the data that existed.

2.2 Sector profiles

Sectors differ in what is lost, how fast and for whom, in who regulates them and in what evidence escapes into the public record. The following profiles are a starting point; each instrument is cited with its version and date and should be re-verified before you rely on it.

Two features of the table matter for research design. First, the consequence unit differs by sector, so a cross-sector study that compares "impact" without a common unit is comparing incommensurable things; choose a common functional unit (people without a service for a stated duration) or stay within one sector. Second, evidence availability is inversely related to sensitivity: the sectors whose operational data would answer the best questions are the ones least likely to release them. A realistic master's project chooses a question that aggregate, public or consented data can answer.

2.3 How sector incidents become regional

2.3.1 Two propagation mechanisms

The doctoral book models dependency cascades: a supplier fails, and each dependant fails when its buffer runs out — a hospital loses water pressure hours after a treatment plant loses power. The Spillover Study measures a different mechanism, load-transfer spillover: a unit fails or withdraws, and its demand moves to peers that did not fail. Ambulances diverted from Kestrel arrive at Alder Point; patients who cannot get a prescription filled at one pharmacy go to another; customers of a failed payment processor queue at banks. Load transfer is often faster than a dependency cascade (it begins as soon as the unit withdraws) and is limited by the peers' spare capacity rather than by buffers.

Real events usually involve both. During the Synnovis pathology ransomware attack in June 2024, the dependency was laboratory services on which hospitals depended; NHS England reported that in the first week (3–9 June) King's College Hospital and Guy's and St Thomas' postponed 814 elective procedures and 861 hospital and community outpatient appointments, and work was redirected to other providers — load transfer. A dissertation should name which mechanism it measures, because the design, the outcome and the policy implications differ.

2.3.2 Concentration and shared services

When many organizations depend on one service provider, an incident at the provider becomes simultaneous across them. The AHA survey of nearly 1,000 hospitals in March 2024 reported that 94% experienced a financial impact from the Change Healthcare cyberattack, which disrupted claims and payment processing. A non-malicious example makes the same structural point: Microsoft estimated that a faulty security-software update in July 2024 affected 8.5 million Windows devices — less than one percent of all Windows machines — yet disrupted services widely because the affected machines were concentrated in enterprises running critical services. For researchers, concentration incidents are natural experiments with many simultaneously exposed units, but there may be no unexposed comparison group of the same kind.

2.4 Public incident catalogues are samples, not populations

Most cross-sector evidence comes from catalogues assembled from public reports: news, regulatory breach notifications, company statements and agency advisories. Neprash et al. (2022) built such a database for ransomware attacks on U.S. health care delivery organizations and reported 374 attacks from 2016 to 2021, an annual count that more than doubled from 43 to 91, and operational disruption in 44.4% of attacks, including ambulance diversion in 16 (4.3%). The authors frame their counts as attacks that became publicly known. That framing matters, because a catalogue's contents are shaped by two processes that have nothing to do with the true incidence:

1. Severity-dependent disclosure. Long, visible disruptions are more likely to be reported than short ones absorbed internally. The catalogue's average severity is therefore higher than the population's.
2. Changing reporting rules and attention. A new reporting mandate, a change in a regulator's publication practice or a surge in media attention increases the fraction of incidents that become public. Counts rise even if incidence does not.

Neither process makes catalogues useless. They make them suitable for some questions (what kinds of disruption have occurred; which characteristics appear among reported events; how reported events changed after a rule) and unsuitable for others (how often incidents occur; how severe a typical incident is; whether incidence is rising) unless the disclosure process is modelled. Lab 2 shows the size of both distortions in a synthetic population.

2.5 When the first account is revised

Public records of infrastructure incidents are revised as investigations proceed. Two documented cases show why a researcher must record what was claimed, by whom, when, and how it was later revised.

• Oldsmar, Florida, February 2021. Early public statements described a remote intruder raising the sodium hydroxide setpoint at a water treatment plant, and CISA issued a joint advisory, AA21-042A, "Compromise of U.S. Water Treatment Facility". In April 2023 the city manager at the time said the FBI had concluded the incident was likely caused by an employee, and an FBI spokesperson said the investigation "was not able to confirm that this incident was initiated by a targeted cyber intrusion" (WUSF, 13 April 2023). The incident still appears in many lists of water-sector cyberattacks.
• Düsseldorf, Germany, September 2020. A ransomware attack disrupted the university hospital, a patient was taken to a more distant hospital and died, and prosecutors opened a negligent-homicide investigation that drew worldwide attention as possibly the first death caused by ransomware. In November 2020 prosecutors concluded that the delay was not decisive for the outcome (MIT Technology Review, 12 November 2020).

Neither revision shows that the underlying risk is imaginary. Both show that a catalogue coding the first account as fact — "cyber intrusion at a water plant", "death caused by ransomware" — contains errors that propagate into every analysis using it. A sound coding scheme stores, for each incident, the claim, its source, the source type (official, company, media), the date of the claim, the current status (confirmed, disputed, revised, unknown) and the date of the last check. A secondary source repeating the first account is not independent confirmation of it.

2.6 Reading a sector paper: a worked seminar

The seminar protocol (§2.1) applied to Dameff et al. (2023), using only what the published abstract and article state:

1. Claim. Hospitals adjacent to health care delivery organizations under ransomware attack "may see increases in patient census and may experience resource constraints affecting time-sensitive care", and such attacks should be considered a regional disaster.
2. Evidence. Two academic urban EDs in San Diego County; 19,857 ED visits; three four-week phases around an attack on a separate organization beginning 1 May 2021: before (3–30 April), attack and recovery (1–28 May), after (29 May–25 June). The targeted organization accounted for about a quarter of regional inpatient discharges.
3. Warrant. If nothing else changed between phases, differences between phases are associated with the attack.
4. Rivals (for the group). Seasonal change from April to June; the evolving COVID-19 situation in spring 2021; other regional events; many outcomes compared, raising the chance that some differences arise by chance. The design compares phases within the same EDs; it does not include an unaffected comparison region, which is the main addition a follow-up study could make.
5. Transfer. To regions where one organization holds a large share of capacity, so that its withdrawal moves substantial load; less to regions with many small providers.
6. So what. Regional cyber-disaster planning, mutual aid and EMS diversion protocols — the paper's own conclusion — and the case for measuring regional effects in other events.
7. Next study. A controlled design: the same outcomes in unaffected comparable EDs over the same weeks, plus a distance gradient. That is the Spillover Study's design.

Notice the tone. The paper made the first published measurement of a regional effect; the seminar's critique identifies what a next study can add, not what the authors "got wrong".

2.7 Presenting in the seminar

A ten-minute presentation has a fixed shape: one slide for the question and why it matters; one for the design (units, exposure, comparison, outcome, period); one for the main result in the authors' words with its uncertainty; one for what the design rules out and what it leaves open; one for the next study. Put the rivals on the slide as questions, not accusations. When questioned, separate three kinds of answer: "the paper says…", "I infer…", and "I don't know; it would take…". The same three registers will serve you in the oral defense (Chapter 8).

2.8 Worked example: an apparent contradiction (seminar exercise)

In the seminar, a participant objects: "Ghafur et al. found that WannaCry reduced hospital activity, and the NHS saw no increase in deaths; Dameff et al. found that ransomware increased activity. The evidence contradicts itself." The seminar resolves it with the concept matrix:

The findings are complementary: an attacked unit's activity falls and its neighbours' rises. Together they suggest the Spillover Study's mechanism. The "no mortality change" result is also not evidence of no harm; it is an absence of detected change in one crude outcome over one week. The NAO's investigation adds scope: at least 81 of 236 trusts in England were disrupted, along with 603 primary care and other NHS organizations, and NHS England recorded 6,912 cancelled appointments while estimating that more than 19,000 were cancelled in total — a reminder that recorded counts and estimated totals are different quantities.

2.9 Practical activity: what a catalogue does to severity and trend

The lab creates a synthetic population of 2,400 service-disrupting incidents, 400 per year for six years, so the true incidence is constant. Outage durations are log-normal with a median of 6 hours. Each incident is disclosed with a probability that rises with duration (50% at 24 hours), and a reporting mandate from year 4 multiplies disclosure by 1.8.

# Lab 2 - what a public incident catalogue does to severity and trend (offline, standard library only)
# Synthetic population of service-disrupting incidents over six years. Each has an outage duration (hours).
# Disclosure probability rises with duration; a reporting mandate raises disclosure from year 4.
import math, random

rng = random.Random(42)
TRUE_PER_YEAR = 400                      # constant true incidence: there is NO real trend

def p_report(hours, year):
    base = 1 / (1 + math.exp(-(math.log(hours) - math.log(24)) * 1.5))   # 50% at 24 h
    return min(1.0, base * (1.0 if year < 4 else 1.8))                   # mandate from year 4

pop = []
for year in range(1, 7):
    for _ in range(TRUE_PER_YEAR):
        hours = rng.lognormvariate(math.log(6), 1.2)                       # median 6 h
        pop.append((year, hours, rng.random() < p_report(hours, year)))

def summary(rows):
    h = sorted(r[1] for r in rows)
    n = len(h)
    med = h[n // 2] if n % 2 else (h[n // 2 - 1] + h[n // 2]) / 2
    return n, sum(h) / n, med, sum(x > 24 for x in h) / n

print("set           n     mean_h  median_h  share>24h")
for label, rows in (("population", pop), ("catalogue", [r for r in pop if r[2]])):
    n, mean, med, big = summary(rows)
    print(f"{label:12} {n:5d}  {mean:7.1f}  {med:8.1f}  {big:9.2f}")
print("year  true  catalogued")
for y in range(1, 7):
    print(f"{y:4d}  {sum(r[0] == y for r in pop):4d}  {sum(r[0] == y and r[2] for r in pop):10d}")

Expected output:

set           n     mean_h  median_h  share>24h
population    2400     12.8       6.1       0.13
catalogue      646     29.2      18.4       0.40
year  true  catalogued
   1   400          99
   2   400          73
   3   400          90
   4   400         125
   5   400         133
   6   400         126

Read both tables. The catalogue's mean outage (29.2 h) is more than twice the population's (12.8 h); its median is three times larger; and the share of incidents longer than 24 hours rises from 13% to 40%. A study that described "typical" incidents from the catalogue would greatly overstate them. The yearly counts show a step from about 87 per year to about 128 per year after the mandate — a 47% "increase" in a population whose incidence never changed. An honest analysis of a catalogue either restricts itself to questions the selection does not distort, models the disclosure process with stated assumptions, or uses an external denominator (for example, all incidents reported under a mandate with known completeness).

2.10 Common errors and limits

• Comparing "impact" across sectors without a common consequence unit.
• Confusing dependency cascades with load-transfer spillover, and therefore measuring the wrong outcome.
• Treating counts from a public catalogue as incidence, or catalogue averages as typical severity.
• Reading a rise in reported incidents after a mandate as a rise in attacks.
• Coding an early public account as fact and never revisiting it.
• Treating a secondary source that repeats a first account as independent confirmation.
• Critiquing a paper for not doing what its data could never support, rather than identifying the next study.
• Treating "no detected change" in a crude outcome as evidence of no effect.

The limit of a seminar is that it reads only what was published. Unpublished evidence — incidents never disclosed, operational data never released — remains outside it, and the seminar should say so rather than assume the published record is complete.

Exercises — chapter 2

EX008 — Sector profile. Objective: profile a sector as a research setting. Inputs: the table in §2.2. Constraints: choose a sector other than healthcare; cite at least two primary sources for its instruments and one documented public case. Steps: (1) define the consequence unit; (2) list buffers; (3) name governing instruments with version and date; (4) list evidence a master's student could obtain lawfully; (5) propose one answerable question that this evidence can support. Expected evidence: one-page profile. Rubric: 3 = consequence unit precise, instruments cited exactly, evidence realistic, question matched to evidence; 2 = one element vague; 1 = uncited; 0 = none.

EX009 — Catalogue distortion. Objective: separate the trend bias a reporting mandate creates from the severity bias that selective disclosure creates in an incident catalogue. Inputs: Lab 2 code. Constraints: offline; do not change the seed. Steps: (1) run the lab and record the output; (2) set the mandate multiplier to 1.0 and report the catalogue's mean, median, share above 24 hours and yearly counts; (3) explain why the severity distortion persists without the mandate; (4) propose one question this catalogue can answer without modelling disclosure. Expected evidence: outputs and two paragraphs. Rubric: 3 = correct outputs, severity distortion attributed to severity-dependent disclosure, trend distortion attributed to the mandate, a defensible answerable question; 2 = one explanation missing; 1 = not run; 0 = none.

EX010 — Seminar protocol. Objective: apply the seven-question protocol. Inputs: Ghafur et al. (2019). Constraints: use only what the paper states; quote its claim. Steps: answer the seven questions of §2.1; mark which rivals the paper addresses and how. Expected evidence: one page. Rubric: 3 = claim quoted, design described accurately (data source, comparison, outcomes), rivals specific, next study feasible; 2 = one question thin; 1 = opinion rather than evidence; 0 = none.

EX011 — Mechanism classification. Objective: distinguish propagation mechanisms. Inputs: (a) Colonial Pipeline's shutdown and fuel supply effects (DOE page); (b) Synnovis and postponed procedures (NHS England); (c) Change Healthcare and hospital cash flow (AHA); (d) Kestrel's diversion and Alder Point's arrivals (synthetic). Constraints: use §2.3.1. Steps: classify each as dependency cascade, load-transfer spillover or both; name the consequence unit; name the limiting factor. Expected evidence: table. Rubric: 3 = classifications justified, "both" recognized where substitution follows dependency failure, limiting factors specific; 2 = one misclassification; 1 = no justification; 0 = none.

EX012 — Coding a revised incident. Objective: design a catalogue entry that survives revision. Inputs: the Oldsmar sources in §2.5. Constraints: fields from §2.5 at minimum. Steps: (1) write the entry as it would have stood in March 2021; (2) update it as of April 2023; (3) state how an analysis counting "confirmed intrusions at water utilities" should treat the entry; (4) state how you would check the entry's status before using it in 2026. Expected evidence: two entries and a paragraph. Rubric: 3 = both entries preserve source, date and status, analysis rule explicit, re-check procedure concrete; 2 = history lost in the update; 1 = entry asserts a cause; 0 = none.

EX013 — Apparent contradiction. Objective: resolve conflicting-looking findings. Inputs: the claims "WannaCry reduced activity at infected NHS trusts" and "ransomware increased volume at neighbouring EDs in San Diego". Constraints: use a concept matrix with at least five dimensions. Steps: (1) build the matrix; (2) state whether the findings conflict; (3) state what single study could test the combined mechanism. Expected evidence: matrix and paragraph. Rubric: 3 = units and direction distinguished, harm-measure limitation noted, combined study measures both attacked and neighbouring units; 2 = one dimension missing; 1 = asserts contradiction; 0 = none.

EX014 — Seminar presentation. Objective: present a paper fairly. Inputs: a published sector paper of your choice with a quantitative result. Constraints: five slides as in §2.7; rivals posed as questions. Steps: (1) prepare the slides; (2) write three questions you expect and your answers in the three registers ("the paper says", "I infer", "I don't know; it would take"); (3) after presenting to peers, record one point where your reading changed. Expected evidence: slide outline, question sheet and reflection. Rubric: 3 = fair summary before critique, rivals precise, registers used correctly, honest reflection; 2 = critique precedes summary; 1 = opinion-based; 0 = none.

Chapter synthesis

Sectors differ in what they lose, how fast and for whom; in who governs them; and in what evidence escapes into public view. Choose a common consequence unit or stay within a sector. Distinguish dependency cascades from load-transfer spillover and measure the mechanism you claim. Public catalogues are samples shaped by severity-dependent disclosure and by changing reporting rules: their averages overstate typical severity and their trends can be artifacts. Early public accounts are revised — Oldsmar and Düsseldorf are documented examples — so code claims with source, date and status, and re-check before use. Read papers with a fixed protocol, summarize fairly before critiquing, and turn critique into the design of the next study.

Continue studying — chapter 02 of 08

← Chapter 01 · Course chapter index · Chapter 03 →

Continue to the next authored lesson.