Urban Science Meets Cyber Risk: Quantifying Smart City Downtime with CTMC and H3 Geospatial Data

This work quantifies downtime caused by cyberattacks for eight critical urban services in Milan by coupling sectoral Continuous-Time Markov Chains (CTMCs) with an approximately equal-area H3 hexagonal grid of the city. The pipeline ingests OpenStreetMap infrastructure, simulates coupled failure/repair dynamics across sectors (power, telecom, hospitals, ambulance stations, banks, ATMs, surveillance, and government offices), and reports availability, outage burden (area under the infected/down curve, or AUC), and multi-sector distress probabilities. Cross-sector dependencies (e.g., power→telecom) are modeled via a joint CTMC on sector up/down states; uncertainty is quantified with nested bootstraps (inner bands for stochastic variability, and outer bands for parameter uncertainty). Economic impacts use sector-specific cost priors with sensitivity analysis (PRCC). Spatial drivers are probed via hotspot mapping (Getis–Ord (Formula presented.), local Moran’s I) and spatial regression on interpretable covariates. In a baseline short decaying attack, healthcare remains the most available tier, while power and banks bear a higher burden; coupling increases P(≥ (Formula presented.) and per-sector AUC relative to an independent counterfactual, with paired-bootstrap significance at (Formula presented.) for ATMs, banks, hospitals, and ambulance stations. Government offices are borderline, and telecom shows the same direction of effect but is not significant at (Formula presented.). Under a persistent/adaptive attacker, citywide downtime and P(≥2) rise substantially. Costs are dominated by telecom/bank/power under literature-informed penalties, and uncertainty in those unit costs explains most of the variance in total loss. Spatial analysis reveals statistically significant hotspots where exposure and dependency pressure are high, while a diversified local service mix appears protective. All code and plots are fully reproducible with open data.