Critical Dependency Atlas

A critical dependency atlas is the missing object beneath three briefs this site already carries. Infrastructure Resilience measures how built networks fail and recover; Economic Resilience measures how shocks propagate through prices, inventories and balance sheets; Civilization Resilience Planning asks what survives when both stop. Each of them, independently, runs into the same wall: nobody has an audited map of what actually depends on what. This brief owns that wall. The question is whether cross-sector dependency is a measurable object — and the answer assembled below is that every analytic primitive it needs has now been measured at least once, somewhere, and never together.

Established The atlas needs five primitives, and they are in very different condition. First, a typing of the dependency itself — what kind of coupling connects a gas compressor to a substation. Second, correlated failure: the joint probability that many links fail from one cause, which single-sector standards do not test. Third, substitutability: how fast and at what cost the economy routes around a severed input. Fourth, recovery time: the empirical distribution of time-to-restore, which the infrastructure literature optimises in detail and has never published. Fifth, risk transfer: whether anyone will price the residual and pay out on it. Sections 2 and 3 take these in order against the measured record.

Established Scope boundary. The failure physics of individual networks stays with Infrastructure Resilience; price propagation and reserve policy stay with Economic Resilience; the dependence structure among natural hazards stays with Compound Climate Hazards, which supplies the correlated driver where this brief supplies the correlated exposure. What is owned here is the graph itself: its measurement, its validation against real events, and the small but real record of dependency maps changing an actual decision.

Established A note on sourcing. This brief was commissioned in September 2026 from the Institute’s research base. Reading-list entries without links are cited from the bibliographic record rather than re-fetched, and claims are dated no later than early 2026 unless carried by a linked source.

Established The vocabulary is a quarter-century old and still load-bearing. Rinaldi, Peerenboom and Kelly (IEEE Control Systems, 2001) founded the field’s taxonomy, and its four interdependency classes — physical (one system’s output is another’s input), cyber (the coupling runs through information systems), geographic (co-location under one hazard footprint), and logical (coupling through markets, policy or human behaviour) — remain the working typology. Established The Institute’s infrastructure brief declined to print the typology because it could verify only the paper’s bibliographic record; this brief prints it from the author’s own knowledge of the paper and flags the difference deliberately. Frontier The theory limb was added in 2010: Buldyrev and colleagues showed in Nature that two networks coupled by dependency links can fail abruptly — a first-order percolation transition — where either alone would degrade gracefully. Hines, Cotilla-Sanchez and Blumsack showed the same year that topological abstractions of real power grids mislead about vulnerability unless the physics is carried along, which is the standing caution against reading the elegant theory as a forecast.

Established Winter Storm Uri, 14–17 February 2021, is the reference measurement for geographic interdependency. One temperature field of 0 to −19 °C across Texas took out four sectors at once: about 4.5 million electricity customers, 322 boil-water notices as power failure propagated into water treatment, an official state death count of 246 with excess-mortality estimates running two to three times higher, and a gas system whose supply failures fed back into gas-fired generation while its own compression depended on grid power. Established The joint FERC–NERC inquiry counted 1,045 generating units suffering outages, derates or failures to start, and ERCOT’s roughly 20,000 MW of firm load shed was described as the largest controlled load-shed event in US history. Frontier The risk-transfer layer failed in its own way: the market monitor put the cost of holding scarcity prices at the $9,000/MWh cap for days after the physical emergency at roughly $16 billion, and the state chose not to reprice — a measured demonstration that the pricing instrument meant to fund resilience can itself become the largest loss line.

Established The CrowdStrike outage of 19 July 2024 is the reference measurement for cyber interdependency. One faulty content update to a single vendor’s endpoint sensor crashed what Microsoft (the platform owner, reporting on its own estate) estimated at 8.5 million Windows machines — under 1% of the fleet, concentrated in exactly the enterprises that buy premium security. Established Delta Air Lines cancelled about 7,000 flights over five days and pursued litigation claiming losses around $500 million (the airline’s own figure). Frontier A cyber-insurance modeller, Parametrix, estimated $5.4 billion in direct losses to US Fortune 500 companies excluding Microsoft, with only 10–20% insured — an interested party’s estimate, quoted here as the only public attempt at the number, and as a measurement of the risk-transfer gap rather than of the loss.

Established The Ever Given, March 2021, is the reference measurement for a physical chokepoint. One hull aground for six days closed a canal carrying a commonly cited 12% of global trade; more than 350 vessels queued; Lloyd’s List estimated roughly $9.6 billion per day of goods held up — a value-at-delay figure, not a loss figure, and repeatedly misquoted as one. Established The canal authority’s compensation demand, initially about $916 million and later reduced to roughly $550 million, settled confidentially — so the event that best measured chokepoint exposure produced no public price for it. Established Colonial Pipeline, May 2021, measured the cyber–physical hybrid: ransomware on the billing IT system led the operator to shut a pipeline carrying roughly 45% of East Coast liquid fuels (the company’s own share figure) for about five days, with panic buying emptying thousands of stations — the physical asset was never touched.

Established Propagation through firm networks has been measured with identification, not just narrated. Carvalho, Nirei, Saito and Tahbaz-Salehi (QJE, 2021) traced the 2011 Tohoku earthquake through Japan’s inter-firm transaction network and put the propagation cost at about 0.47 percentage points of real GDP growth in the following year. Barrot and Sauvagnat (QJE, 2016) showed US customers of disaster-struck suppliers losing 2–3 percentage points of sales growth, with the damage concentrated where inputs are specific — substitutability, measured by its absence. Established The 2021 semiconductor–automotive squeeze was measured independently by the Cleveland Fed: transport-equipment capacity utilisation at 68.5% in May 2021, a fifteen-year low outside the pandemic trough, from a missing input costing a few dollars per vehicle. Established And in orbit, Kessler’s own correction stands as the model dependency argument done honestly: the debris feedback is a slow statistical process over decades, not the film-speed cascade — a correlated-failure claim with its time constant stated.

Established The fifth primitive — risk transfer — has a measured record of interventions misfiring on both sides. The EU’s post-2022 gas storage obligation compelled eighteen member states to fill about 105 billion cubic metres to 90% by a fixed date; the legally synchronised buying contributed to the very price spikes it insured against, drove summer–winter spreads to roughly minus 8 euros per megawatt-hour by January 2025 — destroying the commercial case for the refilling the mandate required — and forced a 2025 amendment widening the date to a range. Frontier On the paying-out side, the instruments that match recovery clocks exist but remain marginal: parametric covers pay on a trigger in days where indemnity claims settle in months, yet the CrowdStrike insured share of 10–20% and Merck’s seven-year NotPetya coverage fight are the current measure of how correlated-failure losses actually move — slowly, through litigation, after the recovery they were meant to fund is over. Established A dependency atlas is upstream of both failures: an insurer cannot price a correlated exposure it cannot see, and a mandate designer cannot anticipate a synchronisation externality on a graph nobody has drawn.

Frontier The live dispute is whether the enforced standard tests the failure mode that actually occurs. The reliability tradition enforces N-1: survive the loss of any single element. Every reference event above was N-k under a common cause — one temperature field, one software update, one hull. Established That N-1 compliance and correlated-failure exposure are different properties is no longer seriously disputed; Uri-compliant units failed in their hundreds together. Frontier What is contested is the remedy: probabilistic resilience standards exist in the literature, but no jurisdiction has yet replaced its deterministic criterion with an enforced correlated-failure test, and whether one can be written auditable is open.

Frontier Substitutability is the least measured primitive. Adam Rose’s computable-general-equilibrium tradition supplies substitution elasticities under disruption, but they are calibrated, not observed. The observed cases run the other way: the 2010–2011 rare-earth episode saw prices spike roughly tenfold, then collapse within three years as thrifting, substitution and new supply responded — high substitutability revealed on a three-year clock. Frontier China’s 2023 gallium and germanium export licensing, against a refining share near 99% for gallium, roughly doubled prices with substitution still limited into 2025 — low substitutability, so far, on the same clock. Nobody can yet predict, in advance, which of these two curves a given severed input will follow; that prediction is the atlas’s hardest deliverable.

Frontier Recovery time has an observable but no published distribution. Nighttime-lights remote sensing now measures outage extent and duration independently of the operator being assessed — the one instrumentation problem that solved itself. The tails are documented case by case: most of the 2003 Northeast blackout’s 50 million affected customers were restored within two days; Auckland’s 1998 cable failures left the business district on generators for about five weeks; Puerto Rico after Maria took roughly eleven months to full reconnection, with an analyst estimate near 3.4 billion customer-hours lost. Frontier Between anecdote and distribution stands nobody: the infrastructure brief’s finding that time-to-restore data sits unpublished in operator records is adopted here as this brief’s single largest evidence gap.

Established The binding bottleneck is inventory, not theory. An audited cross-sector dependency inventory — which substations feed which pumping stations, which fibre routes share which duct banks, which gas compressors are electric — exists for no region on Earth, a finding this brief inherits from Infrastructure Resilience and confirms nothing has changed by early 2026. The blockage is institutional: the data exists, distributed across operators who face liability, security review and competitive exposure for disclosing it, and no incentive to.

Established Deep-tier opacity is the economic mirror of the same problem. As Economic Resilience records, US auto-sector reliance on Chinese inputs rises from roughly 5% to nearly 20% once indirect links are counted; a map built from tier-1 relationships measures the wrong graph, and no jurisdiction requires tier-2 or tier-3 reporting. Frontier Commercial supply-chain-mapping vendors claim to reconstruct deep tiers from shipping manifests and payments data, but their accuracy has never been independently scored against ground truth, because the ground truth is the thing that does not exist.

Frontier Model validation is stuck behind the inventory. Interdependent-network models produce cascade forecasts nobody can score; Hines and colleagues showed a decade and a half ago that topology without physics misleads, and the corrective — out-of-sample scoring of cascade models against realised events — requires exactly the event-and-inventory data that is unpublished. Established The one instrumentation gain is real: satellite nighttime lights give an operator-independent outage observable, which converts validation from impossible to merely unfunded.

Established This brief consumes rather than re-derives three bodies of work. From Infrastructure Resilience: the cascade formalism, the N-1 record, and the restoration-optimisation literature whose unmeasured outputs this brief treats as a gap. From Economic Resilience: the propagation and reallocation measurements, and the standing warning that the most popular resilience policy — reshoring — tests as resilience-reducing. From Compound Climate Hazards: the dependence structure among the natural drivers that make exposures correlated in the first place.

Frontier Two research dependencies lie outside the corpus. Network reconstruction under partial observation — inferring the dependency graph from transaction, shipping and outage traces — is an active statistics problem whose error bars determine whether a commercial atlas can substitute for an audited one. Frontier And confidential computation matters more than it sounds: if operators will never pool raw dependency data, the atlas must be computable as queries against data that never leaves them, a mechanism demonstrated in finance and census settings but not yet in infrastructure. Speculative If neither arrives, the atlas remains what it is today: a vocabulary, a theory, and a casebook.

Frontier The decisive test is an audited cross-sector dependency inventory for one mid-sized region, scored against the next real event. Enumerate, under audit, the power–water–gas–communications dependency graph for a single service territory; register in advance the failure set the map predicts for a defined hazard; then let the region’s next severe event adjudicate. The map either predicted the realised failure set or it did not, and either result is publishable. Established Nothing about this requires new science; nobody has commissioned it, and the sibling briefs’ shared finding is that everything downstream is conditioned on it.

Frontier Three supporting measurements would each move the field on their own. A published empirical time-to-restore distribution by event and damage class, from operator records or from nighttime-lights series — the recovery-time primitive, finally measured. Frontier A blinded accuracy audit of commercial supply-chain maps against a firm’s actual deep-tier bill of materials, volunteered under NDA to an independent scorer — the cheapest test on this page. Frontier And a preregistered correlated-failure stress test: take one N-1-compliant system, publish beforehand the common-cause scenario and predicted survivors, and run it cold — the winterisation analogue of a fire drill, which no operator has volunteered to fail in public.

Speculative The substitutability experiment can only be quasi-experimental. Export-control episodes are the running natural experiment: each new licensing regime against a concentrated input yields, within about three years, a revealed substitution curve of the rare-earth type or the gallium type. A registry that logged each episode’s concentration, stockpile cover and observed price-and-substitution path prospectively would convert an argument-by-anecdote into a dataset within a decade.

Established The atlas is an engineering object with known parts. An ontology (Rinaldi’s classes are the seed); a graph store scaled to perhaps 10⁵–10⁶ nodes per region — trivial by database standards; ingestion from operator GIS systems, shipping manifests and outage feeds; and an audit trail, because an unaudited dependency map is an opinion with a user interface. Frontier The genuinely hard component is access control: the same map is a resilience plan to a regulator and a target folder to an adversary, so the engineering requirement is graduated disclosure — aggregate risk metrics public, edge-level data compartmented — which is a solved problem in intelligence systems and an unsolved one in civilian regulation.

Frontier Precedents exist at the single-sector scale. The UK’s National Underground Asset Register has assembled buried-asset data from hundreds of owners into one queryable map, with a claimed benefit around £350 million per year (the programme’s own figure) and a statutory footing since 2025 — proof that the institutional assembly problem is tractable when liability is settled by statute. Established Texas’s post-Uri mapping committee, created by Senate Bill 3 in 2021, produced the first state map of the electricity supply chain and a critical-designation regime under which mapped gas facilities are exempted from load shed — discussed further in section 9. Neither is cross-sector; both show the parts working.

Established The nearest neighbours are the three parents: Infrastructure Resilience (failure physics), Economic Resilience (price propagation), and Civilization Resilience Planning (the tail where substitutability goes to zero). Compound Climate Hazards supplies the correlated drivers; Autonomous Supply Chains supplies the automation layer whose telemetry could feed the atlas; Future Trade Systems owns the reallocation the maps would be used to steer; Energy Corridors owns the interconnector assets increasingly sold on resilience grounds without a published price; and Megaproject Governance contributes the outturn-database method — the discipline of scoring forecasts against realised outcomes — that this brief wants applied to cascade models. Frontier A sibling commission on digital chokepoints is in preparation and will take the software-concentration thread from where section 2’s CrowdStrike record leaves it.

Established The regulatory scaffolding arrived before the measurement did. The EU’s Critical Entities Resilience Directive (2022/2557), applying from October 2024, obliges member states to run cross-sector risk assessments across eleven sectors; the US catalogued 55 National Critical Functions in 2019; post-Colonial, pipeline cybersecurity moved from voluntary guidelines to TSA security directives within months. Frontier All three mandate assessment; none yet mandates the audited edge-level inventory the assessments would need to be checkable, and early CER transposition has produced documents rather than graphs.

Established Texas is the honest case study of mapping meeting incentives. SB3’s critical-designation rule for gas facilities initially allowed opt-out for a $150 filing fee — and facilities used it — before the loophole was narrowed in 2022; the map now exists and load-shed lists are built from it, which makes it the clearest documented instance of a dependency map changing an operational decision. Frontier It is also the clearest instance of the general law: every entry in a dependency atlas assigns somebody a liability, so the atlas fills exactly as fast as the liability question is settled and no faster. Established The risk-transfer institutions are being reshaped by the same events: Merck’s NotPetya coverage litigation ended in 2024 with the war exclusion failing to bar a $1.4 billion cyber-cascade claim, and the post-CrowdStrike insured-loss gap (10–20% insured, on the Parametrix estimate) is the standing measure of how little correlated cyber risk the market currently absorbs.

Established A dependency atlas is a dual-use document by construction. The map of what to protect is the map of what to hit; Estonia’s ROCA episode — roughly 800,000 national ID cards, over half the population, invalidated by one chip vendor’s flaw — shows how a single mapped dependency reads simultaneously as an audit finding and as targeting advice. The graduated-disclosure requirement of section 7 is an ethical requirement before it is an engineering one.

Established Restoration order is a distributive decision that is currently made without being stated. Shah, Carvallo, Hsu and Taneja measured the distribution of outages during Uri and found it inequitable; a critical-load list is a ranking of neighbourhoods by implied worth, assembled today from circuit topology and historical accident. Frontier An atlas makes that ranking explicit and therefore contestable — which its builders should count as a feature and its operators will experience as exposure. Speculative The insurance analogue is redlining: edge-level dependency data, once priced, could make some districts uninsurable for correlated risk before any public process has agreed that the map is accurate.

Frontier The civilizational claim at stake is that coupling is an unpriced debt. Fifty years of optimisation added dependency edges wherever they were locally efficient — electric gas compression, just-in-time inventories, one vendor’s kernel driver on every airline workstation — and the reference events of section 2 are the interest payments. If that framing is even directionally right, the atlas is the balance sheet the debt has never had. Established The alternative framing has real evidence too, and this brief carries it rather than suppressing it: Economic Resilience records that diversified interdependence attenuated past shocks, and that severing links raised measured volatility. Dependency is not the pathology; unmapped dependency is.

Speculative At the tail, substitutability is the quantity that decides whether Civilization Resilience Planning’s restart question is answerable: a civilization’s depth is roughly the length of the longest severed chain it can rebuild from what remains. Handwave The strong version — that a complete atlas would let a society steer its own coupling, adding and removing edges deliberately the way a portfolio manager rebalances — assumes a governance capacity to act on maps that nothing in the Texas or Brussels record yet demonstrates.

These horizons track the five primitives becoming measured, published and priced.

• 10 yr: Frontier At least one audited regional cross-sector inventory exists and has been scored against a real event; nighttime-lights restoration series are published as standard; the export-control registry of section 6 has a handful of prospective entries; deep-tier disclosure remains voluntary.
• 25 yr: Speculative A correlated-failure standard with teeth operates alongside or instead of N-1 in at least one major jurisdiction; insurers price edge-level dependency data in commercial policies; the accuracy gap between commercial maps and audited ground truth is a published number.
• 50 yr: Speculative Cross-sector dependency reporting reaches the status financial disclosure reached in the twentieth century: mandatory, audited, comparable — contingent on the liability settlement of section 9, for which no current trajectory can be extrapolated.
• 100 / 250+ yr: Handwave Deliberate management of a civilization’s dependency graph as a steered quantity; nothing in the present record grounds a forecast at this range.

• Depends on Three results carried by siblings: the cascade-and-restoration machinery of Infrastructure Resilience, including its finding that the audited dependency inventory exists nowhere; the propagation and reallocation measurements of Economic Resilience; and the hazard-dependence estimates of Compound Climate Hazards, without which correlated exposure cannot be given a probability.
• Requires (not on this map) Five constraints. An audited cross-sector dependency inventory for at least one region, the institutional keystone everything downstream waits on; mandatory deep-tier supply-chain dependency disclosure, without which the economic half of the graph is reconstructed from vendors’ unscored guesses; published time-to-restore distributions by event and damage class, the recovery primitive still sitting in operator records; an out-of-sample scoring convention for cascade models, so the modelling literature can tell its good work from its bad; and an insurance market that prices correlated failure rather than average loss, which the measured 10–20% CrowdStrike insured share shows does not yet exist.
• Enables A checkable basis for resilience-justified capital spending; a load-shed and restoration order that is stated rather than inherited; a substitutability registry that turns export-control episodes into forecasts; and the analytical spine of the Institute’s planned Constraint Atlas, for which this brief’s five primitives are the candidate schema.
• Adjacent Civilization Resilience Planning at the tail; Autonomous Supply Chains and Future Trade Systems on the economic flank; Energy Corridors and Megaproject Governance on the asset-and-appraisal flank.

Handwave “Everything is connected, so one failure can take down everything.” The measured record says the opposite twice over. The CrowdStrike event — as close to a universal common cause as the digital economy has produced — hit under 1% of Windows machines and was substantially remediated in days; Uri, the worst US correlated-failure event of the decade, stayed inside one interconnection. Cascades in the record are bounded by the very heterogeneity the doom framing assumes away. The Buldyrev result says abrupt transitions are possible in coupled networks, not that every coupled network sits at its critical point.

Handwave “The Kessler cascade will trap us on Earth within hours.” Kessler’s own correction is on the record: the debris feedback is a statistical process over decades. It appears in this brief as the exemplary dependency argument precisely because its author policed its time constant while the popular version discarded it.

Established “N-1 compliant means resilient.” Uri’s 1,045 failed units were overwhelmingly owned by entities meeting single-contingency planning standards. N-1 tests element loss, not common cause; conflating the two is how a system passes every audit it is given and still fails four sectors at once.

Frontier “Reshoring is the resilience policy.” The best available measurements, carried by Economic Resilience, run against it: localisation cuts global real GDP by more than 5% in the OECD model while increasing price volatility under shock, and the achieved US reallocation raised import unit values while leaving indirect China exposure largely intact. A dependency atlas would have predicted that outcome from the deep-tier graph; the policy was made from the tier-1 map.

Speculative “A real dependency atlas is impossible — the data cannot be assembled.” Wrong category of impossibility. NUAR assembled hundreds of owners’ buried-asset data once statute settled liability; Texas mapped its electricity supply chain in under a year once a freeze killed 246 people. The atlas is unbuilt because no institution has yet been made to want it, which is a fact about incentives, and incentives have been changed twice in this brief already.