Method and limits
The whole site is built by a reproducible pipeline that pulls public sources, aggregates by the rule, and exports each map as a self-contained file, in Spanish and English. No step scans, probes, or touches a third-party system.
Sources by layer
| Layer | Source | What is taken |
|---|---|---|
| Structure (gas) | Gas transmission network snapshot, as of September 30, 2025 | Nodes and segments, topology |
| Structure (power) | Energy Secretariat | HV lines ≥220 kV and generation by MW |
| Impact | The gas graph | Directed reachability, downstream node count |
| Incidents | Public register | 14 incidents with province, subsector, actor |
| Exposure | DNS resolution + RIPEstat (BGP) | Autonomous system and holder per operator |
| Activity | NASA GIBS, VIIRS Black Marble | Night-lights composite |
| Who responds | Public bylaws and replicability analysis | Actors and relationships |
The gas snapshot is an in-house reconstruction of the transmission topology from public sources, with data as of September 30, 2025; it is the base of the structure and the cascade.
How each layer is computed
- Structure. The gas network comes from the snapshot; the power network from the official datasets filtered to ≥220 kV plus a curated list of large plants with their capacity; the other facilities from public coordinates. It draws the topology, not the load.
- Cascade impact. Directed graph source → target; for each node a breadth-first walk covers everything reachable downstream and counts the stranded nodes. It is structural connectivity, without flow data, because the load snapshot carries errors.
- Incidents. Read from the public register: one point per province, at the centroid, and a per-year count stacked by actor type. No location finer than the province is aggregated.
- Exposure. Each operator's domain resolves to an IP, RIPEstat is asked which autonomous system announces it and who its holder is, and the holder is classified. The IP is used for that query and discarded. The industrial ports are left out by the paywall on the count that works (see what is visible from outside).
- Activity. The map loads Black Marble tiles directly from NASA's open service and overlays the facilities. No radiance is reprocessed.
- Who responds. The graph is built by hand from the entities' public bylaws and the replicability analysis; the lines come from those bylaws, not from any observed traffic.
The check that runs on every build
The repository's invariant (publish the aggregate, never the operator → host → port tuple) is a check,
pipeline/check_rule.py, that walks every published artifact and fails the build if it finds a literal IP or
a host key in the exposure data. The address resolved to find an autonomous system lives only in memory
during the pipeline and is never written to publishable disk.
Reproducibility
pip install -r requirements.txt
python3 pipeline/build_all.py # pull, aggregate, and export the es/en assets
python3 pipeline/check_rule.py # verify the hard rule
npm run build # mkdocs build --strict, Spanish and English
The input snapshots (gas network, incident register, electric datasets) travel versioned in
pipeline/data/, so a build does not depend on the sources being up at that moment. The layers that query
live services (RIPEstat, GIBS) rebuild when the pipeline runs.
What this cannot claim
- That a named company is vulnerable, or where. Nothing was scanned, probed, or touched: everything comes from public or already-indexed data, aggregated to the sector level.
- Where the target is. The rule forbids publishing the operator → host or IP → port tuple, and the check enforces it on every build.
- That an attack would cause an outage. The structure and the cascade rank nodes by structural criticality; the physical redundancy, storage, and alternate routes that would cushion a real loss are not modeled.
- How many incidents there were. The 14 in the register are the publicly documented ones, and lack of trace does not prove nothing happened.
Each page also closes with the limits of what it shows: structure and impact, incidents, what is visible from outside, and who responds.