Urban Science Meets Cyber Risk: Quantifying Smart City Downtime with CTMC and H3 Geospatial Data

This work quantifies downtime caused by cyberattacks for eight critical urban services in Milan by coupling sectoral Continuous-Time Markov Chains (CTMCs) with an approximately equal-area H3 hexagonal grid of the city. The pipeline ingests OpenStreetMap infrastructure, simulates coupled failure/repair dynamics across sectors (power, telecom, hospitals, ambulance stations, banks, ATMs, surveillance, and government offices), and reports availability, outage burden (area under the infected/down curve, or AUC), and multi-sector distress probabilities. Cross-sector dependencies (e.g., power→telecom) are modeled via a joint CTMC on sector up/down states; uncertainty is quantified with nested bootstraps (inner bands for stochastic variability, and outer bands for parameter uncertainty). Economic impacts use sector-specific cost priors with sensitivity analysis (PRCC). Spatial drivers are probed via hotspot mapping (Getis–Ord Gi*, local Moran’s I) and spatial regression on interpretable covariates. In a baseline short decaying attack, healthcare remains the most available tier, while power and banks bear a higher burden; coupling increases P(≥ksectorsdown) and per-sector AUC relative to an independent counterfactual, with paired-bootstrap significance at α=0.05 for ATMs, banks, hospitals, and ambulance stations. Government offices are borderline, and telecom shows the same direction of effect but is not significant at α=0.05. Under a persistent/adaptive attacker, citywide downtime and P(≥2) rise substantially. Costs are dominated by telecom/bank/power under literature-informed penalties, and uncertainty in those unit costs explains most of the variance in total loss. Spatial analysis reveals statistically significant hotspots where exposure and dependency pressure are high, while a diversified local service mix appears protective. All code and plots are fully reproducible with open data.