Chapter 4 — Critical infrastructure and sector security: competing explanations

Lesson map

Lesson 04 published. Map, example, EX021.

flowchart TD
  N0["Learning outcomes and connection"]
  N1["4.1 Multiple working hypotheses and strong inference"]
  N2["4.2 What the spillover hypothesis predicts"]
  N3["4.3 Rivals in the Spillover Study"]
  N4["4.4 Causal diagrams"]
  N5["4.5 Discriminating tools and their assumptions"]
  N6["4.6 Competing explanations in documented cases"]
  N7["4.8 Practical activity: the season that looked like"]
  N0 --> N1 --> N2 --> N3 --> N4 --> N5 --> N6 --> N7
  N7 --> EX["Worked example"]
  EX --> Q["Exercise EX021"]

Logical drawing

flowchart LR
  N0["Learning outcomes and connection"]
  N1["4.1 Multiple working hypotheses and strong inference"]
  N2["4.2 What the spillover hypothesis predicts"]
  N3["4.3 Rivals in the Spillover Study"]
  N4["4.4 Causal diagrams"]
  N5["4.5 Discriminating tools and their assumptions"]
  N6["4.6 Competing explanations in documented cases"]
  N7["4.8 Practical activity: the season that looked like"]
  N0 --> N1 --> N2 --> N3 --> N4 --> N5 --> N6 --> N7 --> Q["EX021"]

[Learning outcomes and connection]
    |
    v
[4.1 Multiple working hypotheses and strong inference]
    |
    v
[4.2 What the spillover hypothesis predicts]
    |
    v
[4.3 Rivals in the Spillover Study]
    |
    v
[4.4 Causal diagrams]
    |
    v
[4.5 Discriminating tools and their assumptions]
    |
    v
[4.6 Competing explanations in documented cases]
    |
    v
[4.8 Practical activity: the season that looked like]
    |
    v
[Worked example] --> [Exercise EX021]

Learning outcomes and connection

By the end of this chapter the learner will be able to:

1. Apply the method of multiple working hypotheses: list every explanation that could produce the observed data before favouring one.
2. Derive, for each rival, a prediction that differs from the main hypothesis's prediction, and choose data that can tell them apart.
3. Draw a causal diagram for an infrastructure event, identify paths that would bias a comparison, and name what must be measured or designed around.
4. Use comparison populations, negative controls, placebo dates, dose–response gradients and timing alignment as discriminating evidence, and state the assumption each relies on.
5. Analyse documented public cases in which a cyber explanation competed with another explanation, and say what evidence decided between them.
6. Run a lab in which a naive comparison attributes a seasonal rise to an incident, and show how a comparison region and placebo windows expose it.

Chapter 3 chose a design; this chapter attacks it. The rival table built here becomes the robustness section of Chapter 6, the limitations of Chapter 7 and the examiners' questions of Chapter 8.

4.1 Multiple working hypotheses and strong inference

In 1890 the geologist T. C. Chamberlin warned against the "ruling theory": once a researcher has a favourite explanation, evidence is unconsciously selected to fit it. His remedy was to hold multiple working hypotheses at once, so that every observation is weighed against all of them (Chamberlin, reprinted 1965). Platt (1964) turned this into a procedure he called strong inference: devise alternative hypotheses; devise a crucial experiment whose possible outcomes exclude one or more of them; carry it out; repeat. Infrastructure researchers rarely run experiments, but the logic survives: for each rival, find an observation the rival predicts differently from your hypothesis.

The practical rule for this course: a rival explanation is not addressed until you have stated what it predicts that your hypothesis does not, and looked. "We controlled for seasonality" is not an answer; "a seasonal rise would also appear in Wexmoor, and the estimate is net of Wexmoor's change" is.

4.2 What the spillover hypothesis predicts

Before listing rivals, write the main hypothesis's full pattern of predictions. If Kestrel's ambulance diversion moved load to its neighbours, then:

1. Timing: arrivals at neighbours rise when the EMS diversion log says diversion started, not before, and fall back when it ends (perhaps with a short tail).
2. Place: the rise is larger at nearer EDs (a distance gradient).
3. Population: there is no corresponding rise in an unaffected region over the same days.
4. Channel: ambulance arrivals rise more than walk-in arrivals, if Kestrel's ED stayed open to walk-ins.
5. Mechanism: EMS destination records show transports that would normally have gone to Kestrel going to neighbours; staff describe the redistribution.

A rival that reproduces all five predictions cannot be distinguished by these data. Most rivals fail at least one, and that failure is the test.

4.3 Rivals in the Spillover Study

Lesson table; scroll horizontally to read all columns →

Note R9's role. If Kestrel's ordinary diversions for crowding also move load to Alder Point, that supports the mechanism and suggests that what matters is diversion, not ransomware — which narrows the claim honestly. The study's exposure is "ransomware-induced diversion"; whether a ransomware diversion differs from an ordinary one (longer, less predictable, with information systems down at the diverting hospital) is a further question.

4.4 Causal diagrams

A causal diagram (directed acyclic graph, DAG) draws variables as nodes and assumed causal effects as arrows. Its value is that it makes assumptions visible and tells you which comparisons are biased by which paths (Greenland, Pearl and Robins, 1999; Hernán and Robins, Causal Inference: What If). For the Spillover Study, think of the "exposure" as being in the diversion period and the outcome as arrivals at Alder Point on that day:

Attack ──► Diversion ──► EMS destination choices ──► Arrivals at AP
                                                       ▲   ▲
Calendar time ──► Season ──────────────────────────────┘   │
      │                                                     │
      └──────────► (period: before vs during) ── Trend ─────┘

Season ──► Arrivals in Wexmoor          Distance (AP, BF, CG) modifies EMS destination choices

Text description of the diagram: the attack causes diversion, which changes EMS destination choices, which raise arrivals at Alder Point. Calendar time determines both whether a day is in the diversion period and the season; the season also raises arrivals at Alder Point and in Wexmoor. Distance modifies how strongly diversion changes destinations at each neighbour.

The diagram shows why a before-and-after comparison is biased: "before versus during" is tied to calendar time, and calendar time reaches the outcome through the season — a back-door path from the exposure period to the outcome that does not pass through diversion. Adjusting for the season directly is impossible (it is not measured precisely), but Wexmoor's arrivals are caused by the season and not by the diversion, so subtracting Wexmoor's change removes the seasonal path if the season affects both regions alike. That "if" is the parallel-trends assumption of Chapter 3, now visible as an assumption about arrows.

4.5 Discriminating tools and their assumptions

Lesson table; scroll horizontally to read all columns →

Two cautions. First, negative controls need arguments, not labels. Walk-in arrivals at Alder Point look like a negative-control outcome for an ambulance diversion, but if patients who would have walked into Kestrel also went elsewhere, walk-ins are partly exposed; use them as a channel comparison (prediction 4), not as a pure negative control. Second, interviews conducted after an incident are subject to hindsight bias: knowing the outcome changes people's judgement of how foreseeable it was (Fischhoff, 1975). Ask about what was known and decided at each point, anchored to dated records, rather than "what went wrong".

4.6 Competing explanations in documented cases

Public infrastructure incidents repeatedly show a cyber explanation competing with another. The cases below are described only at the level their public sources report.

Lesson table; scroll horizontally to read all columns →

The Colonial row deserves emphasis for the Spillover Study. Kestrel's diversion was a decision made in response to the attack, not a mechanical consequence of it. The same attack at a hospital with different leadership, procedures or information could have led to a shorter diversion or none. The study's exposure is therefore the diversion, and its claim is about the consequences of diversion; it should not be read as estimating the effect of ransomware as such.

4.7 Worked example: the rival table in the proposal (synthetic)

The candidate's first rival paragraph read: "Possible confounders such as seasonality were controlled for by using a comparison region." The supervisor asked for each rival's distinct prediction and test. The revised section of the proposal:

• R1 Season. Predicts a rise in Wexmoor as well. Test: report Wexmoor's own pre/post change (a negative-control population); estimate effects net of Wexmoor; run placebo windows. If it fails: if Wexmoor's change is as large as Alder Point's, the spillover estimate is near zero and the study says so.
• R3 EMS policy. Predicts a change starting on a policy date and persisting. Test: request the EMS policy log for days −60 to +90; ask EMS supervisors (RQ3). If it fails: report the policy change as a co-intervention and narrow the claim.
• R4 Measurement. Predicts a step in all outcomes from Alder Point's system. Test: ask the custodian about system changes; inspect walk-ins and waiting times for the same step.
• R6 Anticipation. Predicts a change before day 0. Test: inspect days −14 to −1 in the event-study plot; ask interviewees when they learned of the attack.
• R7 Chance. Test: the real estimate's rank among placebo windows; intervals.
• R8 Comparison shock. Test: estimate against each Wexmoor ED separately and pooled (Chapter 8's specification curve); ask the Wexmoor custodian about events.

A rival the study cannot test — for example, an unrecorded change in how Kestrel's own ambulances were dispatched — goes into the limitations with its likely direction (Chapter 7).

4.8 Practical activity: the season that looked like spillover

Save the following file as lab4_data.py; Labs 6 and 8 import it. It generates the synthetic Tamsin Valley and Wexmoor data for days −180 to +89 with day-of-week variation, extra day-to-day variation, two regional holidays and a respiratory season that starts rising near day 0 in both regions. The true spillover effects are fixed in the TRUE dictionary: +22% at Alder Point during days 0–20 (+5% in days 21–34), +10% at Brookfield (+2%) and none at Calloway. The script then compares a naive before-and-after estimate (28 days before versus days 0–20) with the same change expressed relative to Wexmoor, and runs the naive comparison at 19 fake 21-day windows in the baseline.

# Lab 4 - competing explanations for a post-incident rise in ambulance arrivals (offline, standard library only)
# Save as lab4_data.py: Labs 6 and 8 import make_region() from it.
# Synthetic Tamsin Valley (treated region) and Wexmoor (comparison region); day 0 = start of the
# 21-day ambulance diversion at the attacked Kestrel hospitals. Days -180..89.
import math, random

DOW = [1.08, 1.02, 1.00, 0.98, 1.00, 0.96, 0.96]
BASE = {"AP": 40, "BF": 30, "CG": 22, "W1": 35, "W2": 28}           # ambulance arrivals per day
DIST_KM = {"AP": 6, "BF": 14, "CG": 38}                            # distance from Kestrel
TRUE = {"AP": (0.22, 0.05), "BF": (0.10, 0.02), "CG": (0.0, 0.0)}  # (days 0-20, days 21-34)
HOLIDAYS = {-100, 45}                                              # regional holidays, both regions
DAYS = range(-180, 90)

def poisson(rng, lam):
    L, k, p = math.exp(-lam), 0, 1.0
    while True:
        p *= rng.random()
        if p <= L:
            return k
        k += 1

def season(t, amp):
    return 1 + amp / (1 + math.exp(-(t - 10) / 6))

def effect(site, t):
    during, tail = TRUE.get(site, (0.0, 0.0))
    return during if 0 <= t <= 20 else tail if 21 <= t <= 34 else 0.0

def make_region(seed=2026):
    rng = random.Random(seed)
    data = {}
    for site, base in BASE.items():
        amp = 0.18 if site in TRUE else 0.17
        series = {}
        for t in DAYS:
            lam = base * DOW[t % 7] * season(t, amp) * (1 + effect(site, t))
            lam *= (0.85 if t in HOLIDAYS else 1.0) * rng.gammavariate(60, 1 / 60)
            series[t] = poisson(rng, lam)
        data[site] = series
    wait = {}                                                     # AP median minutes to provider
    for t in DAYS:
        wait[t] = max(5.0, rng.gauss(28 + (4 if 0 <= t <= 20 else 0) + 3 * (season(t, 0.18) - 1) / 0.18, 6))
    data["AP_wait"] = wait
    return data

def mean(xs):
    xs = list(xs)
    return sum(xs) / len(xs)

def naive(series, pre=(-28, -1), ev=(0, 20)):
    return mean(series[t] for t in range(pre[0], pre[1] + 1)), mean(series[t] for t in range(ev[0], ev[1] + 1))

if __name__ == "__main__":
    d = make_region()
    comp = {t: d["W1"][t] + d["W2"][t] for t in DAYS}
    print("site  km  pre28  event  naive_change  relative_to_Wexmoor")
    cp, ce = naive(comp)
    for s in ("AP", "BF", "CG", "W1", "W2"):
        p, e = naive(d[s])
        rel = (e / p) / (ce / cp) - 1
        km = DIST_KM.get(s, "-")
        print(f"{s:4}  {str(km):>2}  {p:5.1f}  {e:5.1f}  {e / p - 1:+12.3f}  {rel:+19.3f}")
    print(f"Wexmoor pooled pre/post change: {ce / cp - 1:+.3f}  (no exposure: a negative-control population)")
    # placebo-in-time: the same naive comparison at 21-day windows that end before day 0
    pl = []
    for start in range(-150, -21, 7):
        p, e = naive(d["AP"], pre=(start - 28, start - 1), ev=(start, start + 20))
        pl.append(e / p - 1)
    print(f"AP naive placebo windows: n={len(pl)} min={min(pl):+.3f} max={max(pl):+.3f}")

Expected output:

site  km  pre28  event  naive_change  relative_to_Wexmoor
AP     6   38.4   51.1        +0.330               +0.246
BF    14   30.4   33.8        +0.112               +0.042
CG    38   22.6   24.5        +0.081               +0.013
W1     -   33.5   37.0        +0.106               +0.036
W2     -   28.1   28.7        +0.022               -0.043
Wexmoor pooled pre/post change: +0.067  (no exposure: a negative-control population)
AP naive placebo windows: n=19 min=-0.064 max=+0.091

Read the output as a seminar would:

• Naive estimates overstate everywhere. Alder Point appears to rise by 33.0% when the generator's truth is 22%; Calloway, 38 km away and truly unaffected, appears to rise by 8.1%.
• The negative-control population exposes the bias. Wexmoor, which cannot be affected by Kestrel's diversion, "rose" by 6.7% (W1 by 10.6%). Any method that finds an effect in Wexmoor is measuring something other than spillover — here, the season.
• Relative to Wexmoor, a gradient appears: +24.6% at 6 km, +4.2% at 14 km and +1.3% at 38 km. Alder Point's estimate is close to the truth. Brookfield's is less than half its true 10% — single-ED estimates are noisy, as Lab 3 warned.
• Placebo windows calibrate the naive method. In 19 fake windows during ordinary baseline periods, the naive change at Alder Point ranged from −6.4% to +9.1%. A +33% change is far outside that range, so chance (R7) is an unlikely explanation for Alder Point — but the placebo windows lie in a season-free baseline, so they do not test R1. That is why both tools are needed.

The relative-to-Wexmoor figures in this lab are crude ratios of means. Chapter 6 replaces them with a controlled interrupted time series that also models the trend and gives autocorrelation-robust intervals.

4.9 Common errors and limits

• Naming a rival and declaring it "controlled for" without stating its distinct prediction.
• Treating a comparison region as automatically valid; parallel trends is an assumption that can fail.
• Labelling an outcome a negative control without arguing that the exposure cannot affect it.
• Using placebo windows from a different season and treating them as a test of seasonal confounding.
• Interviewing for "what went wrong" and receiving hindsight.
• Claiming the effect of "ransomware" when the exposure was a human decision taken in response to it.
• Repeating an early public account of a case (Oldsmar, Düsseldorf) as if it were settled.
• Stopping the search for rivals when the first one is addressed.

The limit of this chapter's tools is that each relies on an assumption that cannot be fully tested with the same data. The defence against that limit is triangulation: when timing, place, population, channel and mechanism evidence all point the same way, the remaining rivals must explain all of them at once.

Exercises — chapter 4

EX021 — Rival table. Objective: list rivals with distinct predictions. Inputs: a synthetic finding: "after a ransomware attack on a regional pharmacy chain, prescription fills at independent pharmacies within 10 km rose 18% in the following two weeks." Constraints: at least six rivals. Steps: (1) state the main hypothesis's five predictions (timing, place, population, channel, mechanism); (2) for each rival, state what it predicts differently; (3) name the data that would discriminate. Expected evidence: table. Rubric: 3 = rivals include season, concurrent events (for example insurer changes), measurement and comparison-region shock, each with a distinct and testable prediction; 2 = one rival without a distinct prediction; 1 = generic list; 0 = none.

EX022 — Baseline length and the naive estimate. Objective: show why a longer pre-period shifts the naive before-after estimate while the Wexmoor-relative estimate barely moves. Inputs: Lab 4 code. Constraints: offline; do not change the seed. Steps: (1) run the lab and record the output; (2) change the naive baseline from 28 to 56 days (pre=(-56, -1)) for every site including the pooled comparison, and report the naive and relative-to-Wexmoor changes; (3) explain why the naive estimates changed but the relative estimates changed little. Expected evidence: outputs and a paragraph. Rubric: 3 = correct values, explanation that the season reaches both regions so the ratio cancels most of its effect, while the naive estimate depends on how much pre-season baseline it includes; 2 = one value wrong; 1 = not run; 0 = none.

EX023 — Causal diagram. Objective: make assumptions explicit. Inputs: the Spillover Study with an added fact: during the diversion, the county also opened a temporary urgent-care tent near Brookfield. Constraints: text or drawn DAG with a text description. Steps: (1) add the tent to the diagram; (2) identify how it biases Brookfield's estimate and in which direction; (3) propose data or design to address it; (4) state whether it threatens Alder Point's estimate. Expected evidence: diagram, description and paragraph. Rubric: 3 = tent shown as a co-intervention affecting Brookfield's arrivals (likely reducing walk-ins and possibly ambulance arrivals), direction reasoned, response concrete (channel analysis, tent attendance data, sensitivity), Alder Point assessed by distance and catchment; 2 = direction unstated; 1 = diagram without reasoning; 0 = none.

EX024 — Negative controls. Objective: argue, not label. Inputs: candidate negative controls: (a) Wexmoor ambulance arrivals; (b) Alder Point walk-in arrivals; (c) Alder Point scheduled outpatient infusions; (d) Calloway ambulance arrivals. Constraints: use Lipsitch et al.'s logic. Steps: for each, state whether it is a negative-control population or outcome, whether the exposure could affect it, whether it shares the confounders, and your verdict. Expected evidence: table. Rubric: 3 = (a) accepted as population with parallel-season caveat, (b) rejected as pure negative control but useful for the channel, (c) unaffected by diversion but probably not by the season either, so weak, (d) rejected because Calloway is part of the hypothesis's distance gradient; 2 = one verdict unjustified; 1 = labels only; 0 = none.

EX025 — A documented competing explanation. Objective: analyse a public case. Inputs: the Düsseldorf sources in §4.6 and §2.5. Constraints: do not speculate beyond the sources. Steps: (1) state the two competing explanations; (2) state what evidence decided between them, as reported; (3) explain why an individual-death claim and a population-level claim about diversion and outcomes require different designs; (4) propose a population-level question that could be studied ethically. Expected evidence: one page. Rubric: 3 = explanations stated, autopsy-based conclusion reported with source, individual versus population counterfactual distinguished, ethical population design proposed (for example time-sensitive emergencies during diversions using aggregate registry data); 2 = one element missing; 1 = speculation; 0 = none.

EX026 — The decision as exposure. Objective: separate attack from response. Inputs: the Colonial Pipeline row in §4.6 and Kestrel's diversion. Constraints: half a page. Steps: (1) explain why the Spillover Study's exposure is the diversion; (2) list two ways the same attack could have produced a different diversion; (3) rewrite the study's claim so that it does not overstate the role of ransomware; (4) propose a question about diversion decisions for a later study. Expected evidence: paragraph and claim. Rubric: 3 = response-as-cause articulated, plausible alternative decisions, claim scoped to diversion, decision question answerable; 2 = claim still about ransomware generally; 1 = confuses attack and diversion; 0 = none.

Chapter synthesis

Hold several explanations at once and look for observations that separate them. Write the main hypothesis's full pattern — timing, place, population, channel, mechanism — and require each rival to explain all of it. A causal diagram shows why a before-and-after comparison is biased by the season and what assumption a comparison region needs. Comparison populations, negative controls, placebo dates, dose–response and timing alignment each discriminate under an assumption you must argue. Public cases show cyber explanations competing with operator error, underlying illness, precautionary decisions and faulty updates; the lesson is to record status and to model decisions. Lab 4 shows a naive method finding "spillover" 38 km away and in an unaffected region, and a comparison region revealing a gradient close to the truth.