Cross-domain layer

Where the four datasets meet

This page reads the records of the four Faultline platforms side by side and shows where they connect. Every link comes from a field that already exists in the source data, and every link states its basis. Nothing here is added by hand.

In plain terms: one incident, the Viasat KA-SAT attack, is recorded in two domains (cyber and orbital). Five more cyber cases connect to that orbital record only because both name the Sandworm intrusion set. Everything else the datasets share is a state or an infrastructure category that both include, shown as facets rather than links.

Cyber: 33records
Orbital: 28records
Lunar governance: 31records
Nuclear: 86records
Same event: 1one incident in two datasets
Same intrusion set: 5same threat group named
Shared entities: 25states and categories in two or more datasets
Snapshot: v2.1.0, 2026-10-30
Fictional records excluded: 4

Connection map

Each dot is a record in one of the four platforms. A line is drawn only where two records are about the same thing. One incident, the Viasat KA-SAT attack of February 2022, is recorded in two domains (cyber and orbital): that is the only same-event link. Five other cyber cases attributed to Sandworm link to the same orbital record because it names Sandworm too; they are the same intrusion set, not the same event. Shared states and infrastructure categories are not drawn as lines. Click a dot, or use the node list, to follow a record.

Selected: Cyber Viasat KA-SAT (AcidRain), 1 link shown with current filters. See its connections

Nodes in the graph

Only records with a link

7 nodes listed. Select one to highlight it in the graph and follow it below.

Cyber

Orbital

Link type

Same event (1)One incident recorded in two datasets: same name and year, a cited source naming both, or the same named target in the same year.Same intrusion set (5)Both records list the same MITRE ATT&CK group. They can be different operations by that group.

6 links name the same intrusion set; one of them, Viasat, is also the same event and is counted under same event. Shared states and infrastructure categories are not drawn as lines; they are listed as facets in the record follower.

Links by domain pair

Number of cross-domain links between each pair of domains, with the current link type filters. Select a cell to show only that pair in the network.
	Cyber	Orbital	Lunar	Nuclear
Cyber	·
Orbital		·
Lunar			·
Nuclear				·

Large number: links shown with the current filters. Small line: same event (E) and same intrusion set (I) links for the pair. A zero means the coded fields give no such link for that pair. It does not mean the two domains are unrelated.

Follow an incident

Pick any record to see its record links, and the states and infrastructure categories it shares with the other datasets. The default is the Viasat KA-SAT attack, the one incident recorded in both the cyber and the orbital data.

Pick a record

Cyber · Case

cyber:viasat-kasat

Viasat KA-SAT (AcidRain)

February 2022

Destructive cyber attack against Viasat's KA-SAT satellite broadband network, timed to coincide with Russia's invasion of Ukraine on 24 February 2022. AcidRain wiper malware bricked tens of thousands of satellite…

Operation type: destructive
Attribution (country field): Russia
Attribution confidence: confirmed
Group names: Sandworm
Target sectors: telecommunications, defense, energy, critical-infrastructure
Target countries (ISO codes): UA, DE, FR, IT
Geographic scope: central-europe
MITRE ATT&CK groups: G0034
State organ: GRU
Named targets: Viasat KA-SAT

Open in Cyber Escalation Atlas (record page)

Record links (1)

Same event (1)

One incident recorded in two datasets: same name and year, a cited source naming both, or the same named target in the same year.

Orbital (1)

Same incident recorded in two datasets (1)

Same event: One incident recorded in two datasets: cyber case "Viasat KA-SAT (AcidRain)" and orbital incident "Viasat KA-SAT AcidRain Cyberattack" share the name "Viasat KA-SAT" and the year 2022. The orbital record also names the malware AcidRain, listed in the cyber case malwareFamilies.
Same event: A cited source names both records (https://www.sentinelone.com/labs/acidrain-a-modem-wiper-rains-down-on-europe/), recorded in the relatedRecords field.
Same event: The cyber case target entity "Viasat KA-SAT" and the orbital incident target operator "Viasat" are the same organisation, in the same year.
Same intrusion set: Both records list MITRE ATT&CK group G0034 (cyber aliases: Sandworm; orbital actor: "Russia (GRU Sandworm)").
Open in Orbital Risk Tracker (record page)(opens in a new tab)

Shared states and categories (6)

States and infrastructure categories this record shares with other datasets. Each line says how many records in each dataset include the same entity. It is not a link between those records.

4 datasets include Russia:
- Cyber: 8 records (8 records name it as the actor)
- Lunar governance: 1 record (1 country profile: state profiled in lunar data)
- Nuclear: 5 records (5 plants are hosted there)
- Orbital: 14 records (14 records name it as the actor)
3 datasets include Communications (infrastructure category):
- Cyber: 9 records (9 records in this category)
- Lunar governance: 1 record (1 record in this category)
- Orbital: 4 records (4 records in this category)
3 datasets include Energy and power (infrastructure category):
- Cyber: 11 records (11 records in this category)
- Lunar governance: 1 record (1 record in this category)
- Nuclear: 86 records (86 records in this category)
Both datasets include France:
- Cyber: 2 records (2 records list it as a target country)
- Nuclear: 6 records (6 plants are hosted there)
Both datasets include Germany:
- Cyber: 2 records (2 records list it as a target country)
- Nuclear: 1 record (1 plant is hosted there)
Both datasets include Ukraine:
- Cyber: 6 records (6 records list it as a target country)
- Nuclear: 3 records (3 plants are hosted there)

States

Russia (named as actor)
Ukraine (listed as a target country)
Germany (listed as a target country)
France (listed as a target country)
Italy (listed as a target country)

Infrastructure categories

Energy and power (also used by Lunar governance, Nuclear)
Cyber case targetSectors includes "energy".
Communications (also used by Lunar governance, Orbital)
Cyber case targetSectors includes "telecommunications".

Instruments referenced

Tallinn Manual 2.0
Rule 93, Distinction
UN Charter
Article 2(4), Prohibition on the Use of Force
Geneva Conventions / IHL
Principle of Distinction
UN GGE Voluntary Norms (2015)
UN GGE 2015 Norm 13(f)

Dataset check

Viasat KA-SAT: cyber and orbital records compared

Date: cyber dateRange "February 2022" (escalation phases 2022-02-24, 2022-02-24, 2022-02-24) vs orbital date 2022-02-24: consistent. Acting state: cyber "Russia" vs orbital "Russia (GRU Sandworm)": consistent. Sources: cyber cites 3, orbital cites 4. Shared (same URL): Viasat: KA-SAT Network Cyber Attack Overview; Guerrero-Saade & Chen (SentinelOne Labs): AcidRain — A Modem Wiper Rains Down on Europe; Council of the EU: Declaration by the High Representative on Russian cyber operations against Ukraine (Viasat/KA-SAT). Orbital only: CISA/FBI AA22-076A: Strengthening Cybersecurity of SATCOM Network Providers and Customers.

Instrument coverage in the datasets

For each record link, this view lists the legal and normative instruments each dataset associates with the records on either side. Orbital incident and nuclear plant records reference no instrument at record level: those datasets have no field for it. So a junction marked “no instrument referenced” mostly reflects the schema of the source dataset. It is not a legal finding that no rule applies, and not evidence of a governance gap.

Cyber and Orbital

6 record links (junctions) between the two datasets, same event first.

Instruments that appear in both datasets

None. No instrument is referenced by both datasets.

Shared entities

States in both: Russia, United States, North Korea, China, India.
Infrastructure categories in both: Communications.

Instruments on both sides, none in commonSame event link, by: Same event, Same intrusion set
Cyber
Tallinn Manual 2.0; UN Charter; Geneva Conventions / IHL; UN GGE Voluntary Norms (2015)
Orbital
No instrument referenced in the dataset
State level (Actor state, orbital treaty matrix): Outer Space Treaty (1967); Liability Convention (1972); Registration Convention (1975); COPUOS LTS Guidelines (2019); ITU Coordination
Instruments on both sides, none in commonSame intrusion set link, by: Same intrusion set
Cyber
Geneva Conventions / IHL; Tallinn Manual 2.0; UN GGE Voluntary Norms (2015)
Orbital
No instrument referenced in the dataset
State level (Actor state, orbital treaty matrix): Outer Space Treaty (1967); Liability Convention (1972); Registration Convention (1975); COPUOS LTS Guidelines (2019); ITU Coordination
Instruments on both sides, none in commonSame intrusion set link, by: Same intrusion set
Cyber
Tallinn Manual 2.0; Geneva Conventions / IHL; UN GGE Voluntary Norms (2015)
Orbital
No instrument referenced in the dataset
State level (Actor state, orbital treaty matrix): Outer Space Treaty (1967); Liability Convention (1972); Registration Convention (1975); COPUOS LTS Guidelines (2019); ITU Coordination
Instruments on both sides, none in commonSame intrusion set link, by: Same intrusion set
Cyber
Tallinn Manual 2.0; UN Charter; Geneva Conventions / IHL; UN GGE Voluntary Norms (2015)
Orbital
No instrument referenced in the dataset
State level (Actor state, orbital treaty matrix): Outer Space Treaty (1967); Liability Convention (1972); Registration Convention (1975); COPUOS LTS Guidelines (2019); ITU Coordination
Instruments on both sides, none in commonSame intrusion set link, by: Same intrusion set
Cyber
Tallinn Manual 2.0; UN Charter; UN GGE Voluntary Norms (2015); UN OEWG 2021 recommendations
Orbital
No instrument referenced in the dataset
State level (Actor state, orbital treaty matrix): Outer Space Treaty (1967); Liability Convention (1972); Registration Convention (1975); COPUOS LTS Guidelines (2019); ITU Coordination
Instruments on both sides, none in commonSame intrusion set link, by: Same intrusion set
Cyber
Tallinn Manual 2.0; UN GGE Voluntary Norms (2015)
Orbital
No instrument referenced in the dataset
State level (Actor state, orbital treaty matrix): Outer Space Treaty (1967); Liability Convention (1972); Registration Convention (1975); COPUOS LTS Guidelines (2019); ITU Coordination

Method

How links are derived, and what they do not show

A build script (scripts/build-crossdomain.mjs) reads the data files of the four platform repositories, without changing them, and writes the snapshot used on this page. Snapshot faultline-crossdomain-2.1.0-2026-10-30 was generated on 2026-10-30. The site does not recompute anything at runtime.

Each record keeps a stable id made of its platform and its id in that platform (for example cyber:viasat-kasat or orbital:21). Records also connect to shared entities: states, infrastructure categories and instruments. Values from different platforms are compared only through the three crosswalk tables listed below, which are published inside the snapshot.

Link types

Same event (1 links): One incident recorded in two datasets: same name and year, a cited source naming both, or the same named target in the same year.
Same intrusion set (5 links): Both records list the same MITRE ATT&CK group. They can be different operations by that group.

Pairwise links are kept only where two records are about the same incident or name the same intrusion set. Earlier versions of this snapshot also linked every pair of records that named the same acting state, and every energy-sector cyber case to every nuclear plant in a listed target country. Those links said only that two records sit in the same context, and the energy pairing read more into the data than it holds: the cyber atlas lists target sectors and target countries separately, so a case listing energy and Germany does not say it targeted the German energy sector.

Shared states and categories (facets)

A facet lists a state or infrastructure category that records in two or more datasets connect to, with the records and their role in each dataset (actor, target, host, profiled, category). It says the datasets both include the entity, not that the records are related. The snapshot has 25 facets (22 states, 3 infrastructure categories). A state counts for an actor field only when the record's attribution confidence is high or confirmed and no qualifier says the actor is criminal, individuals or otherwise not the state (13 actor fields are left unresolved for these reasons; they are listed in the dataset checks). Lunar country profiles count as “state profiled in lunar data”: a profile is not an actor in an event.

Link rules

Same incident recorded in two datasets (1 links) Same event
Cyber case and orbital incident, on any of three bases: the cyber case name appears as whole words in the orbital incident title and both give the same year; a cited source names both records (relatedRecords field); or the cyber case's named target entity is the orbital incident's target operator in the same year.
Same intrusion set named in both records (6 links) Same intrusion set
Cyber case and orbital incident that list the same MITRE ATT&CK group ID (intrusionSetIds in both datasets). Where a record has no IDs, a cyber alias appearing as a whole word in the orbital actor field is used instead. The two records can describe different operations by the same group.

One pair of records can have both bases (Viasat), so the counts above add up to more than the 6 links.

Instrument references

Cyber: the legal framework table (rule to case lists) and the norms table (anchor instruments to case lists).
Lunar: the document behind each discretion point, and the documents listed in each country profile.
Orbital: incident records name no instrument. The treaty compliance matrix gives state level context for the acting state.
Nuclear: plant records name no instrument. The country governance table gives host state treaty obligations as state level context.

State level context is shown separately from record level references and is never presented as a record level citation. Because two of the four datasets have no record-level instrument field, the instrument coverage view reflects the schemas as much as the records.

Limitations

All four source datasets are analyst-coded from public sources. Coding choices in those datasets carry into this layer.
The datasets are not exhaustive. A missing link means no link can be derived from the coded fields, not that no relationship exists.
Facets (a state or infrastructure category present in two datasets) show co-occurrence in the data, not causation, coordination or a relationship between the records.
The cyber atlas lists target sectors and target countries separately, so a case that lists energy and Germany does not say it targeted the German energy sector.
Instrument references show which instruments each dataset associates with a record. Orbital incident and nuclear plant records reference no instrument at record level, so instrument coverage reflects the schema of each dataset, not a legal conclusion that no law applies.
Free-text fields (summaries, policy responses) are not parsed for links, except the short keyword rules listed in the sector crosswalk.
This layer describes recorded events. It makes no prediction.

Sources in this snapshot

Cyber Escalation Atlas (33 records)
33 case
cyber-escalation-atlas @ claude/gtc-hardening 8bc0031 (2026-10-29)
Not the deployed branch. Record links open https://cyber-escalation-atlas.vercel.app, built from claude/setup-cyber-atlas-scaffold-ieuDR; those pages can differ from this snapshot.
Orbital Risk Tracker (28 records)
28 incident
Orbital-Risk-Tracker @ claude/gtc-hardening e219b82 (2026-10-29)
Not the deployed branch. Record links open https://orbitalrisktracker.vercel.app, built from claude/space-incidents-dashboard-HOnqa; those pages can differ from this snapshot.
Lunar Governance Tracker (31 records)
16 discretion point, 8 country profile, 7 infrastructure link
lunar-mandate-atlas @ claude/gtc-hardening d3d48a1 (2026-10-30)
Not the deployed branch. Record links open https://lunar-mandate-atlas.vercel.app, built from claude/lunar-governance-tracker-txA5R; those pages can differ from this snapshot.
Global Nuclear Infrastructure Atlas (86 records)
86 plant
Global-Nuclear-Infrastructure-Atlas @ claude/gtc-hardening daadd82 (2026-10-29)
Not the deployed branch. Record links open https://globalnuclearinfrastructureatlas.vercel.app, built from claude/nuclear-infrastructure-atlas-IIjPg; those pages can differ from this snapshot.

The Orbital Risk Tracker holds 32 incident records. 4 of them are fictional samples titled ILLUSTRATIVE and are excluded from all links and counts:

orbital:901 ILLUSTRATIVE — Co-orbital Inspector Shadows Foreign GEO Comsat
orbital:902 ILLUSTRATIVE — Destructive Direct-Ascent ASAT Test
orbital:903 ILLUSTRATIVE — Disputed Close Approach Framed as 'Due Regard' Failure
orbital:904 ILLUSTRATIVE — Contested Signal Outage, No Prevailing Framing

Crosswalk tables

States

A field is linked to a state only when its value, with any parenthetical removed and split on '/', matches a listed spelling exactly. Values such as 'Unknown', 'Multiple', 'Global' or 'Central Europe' are not linked. An actor field is not linked when a parenthetical says the actor is criminal, not the state, individuals or similar, or when the record's attribution confidence is below high.

United States [United States, USA, US]; Russia [Russia]; China [China]; United Kingdom [United Kingdom, UK]; France [France]; Germany [Germany]; Ukraine [Ukraine]; Japan [Japan]; South Korea [South Korea]; North Korea [North Korea]; India [India]; Pakistan [Pakistan]; Iran [Iran]; Israel [Israel]; United Arab Emirates [United Arab Emirates, UAE]; Luxembourg [Luxembourg]; European Union / ESA [ESA / European Union, EU / ESA]; Canada [Canada]; Australia [Australia]; Taiwan [Taiwan]; Italy [Italy]; Netherlands [Netherlands]; Sweden [Sweden]; Switzerland [Switzerland]; Brazil [Brazil]; Belgium [Belgium]; Saudi Arabia [Saudi Arabia]; Bangladesh [Bangladesh]; Egypt [Egypt]; Finland [Finland]; Czech Republic [Czech Republic]; Hungary [Hungary]; Spain [Spain]; Argentina [Argentina]; South Africa [South Africa]; Mexico [Mexico]; Romania [Romania]; Slovenia [Slovenia]; Armenia [Armenia]; Belarus [Belarus]; Turkey [Turkey]

Infrastructure categories

Energy and power: cyber infrastructure.targetSectors (energy); nuclear (record type) (every commercial nuclear power plant record); lunar INFRA_GOVERNANCE_LINKS.infrastructure (power)
Communications: cyber infrastructure.targetSectors (telecommunications); orbital target or subtype (text contains: communication, satellite internet, broadband, Starlink, KA-SAT, SATCOM); lunar INFRA_GOVERNANCE_LINKS.infrastructure (comms)
Navigation and timing: orbital type, subtype, target (type is spoofing, or subtype or target text contains GNSS or GPS); lunar INFRA_GOVERNANCE_LINKS.infrastructure (nav)

Instruments

Instrument strings are mapped to a canonical instrument when they match a listed pattern or source id. Unmatched strings keep their own instrument node.

Outer Space Treaty (1967); Liability Convention (1972); Registration Convention (1975); COPUOS LTS Guidelines (2019); Artemis Accords; ITU Coordination; Tallinn Manual 2.0; UN Charter; Geneva Conventions / IHL; UN GGE Voluntary Norms (2015); NPT; IAEA Additional Protocol; EURATOM; Treaty of Tlatelolco; Treaty of Pelindaba

Dataset checks (7)

Differences between or within the source datasets, found while building the snapshot. They are reported here and left for the platform maintainers to resolve.

Note: Viasat KA-SAT: cyber and orbital records compared
Date: cyber dateRange "February 2022" (escalation phases 2022-02-24, 2022-02-24, 2022-02-24) vs orbital date 2022-02-24: consistent. Acting state: cyber "Russia" vs orbital "Russia (GRU Sandworm)": consistent. Sources: cyber cites 3, orbital cites 4. Shared (same URL): Viasat: KA-SAT Network Cyber Attack Overview; Guerrero-Saade & Chen (SentinelOne Labs): AcidRain — A Modem Wiper Rains Down on Europe; Council of the EU: Declaration by the High Representative on Russian cyber operations against Ukraine (Viasat/KA-SAT). Orbital only: CISA/FBI AA22-076A: Strengthening Cybersecurity of SATCOM Network Providers and Customers.
Mismatch: Cyber Escalation Atlas was read from branch claude/gtc-hardening, not the deployed branch
The snapshot read cyber-escalation-atlas at claude/gtc-hardening (8bc0031). The production site https://cyber-escalation-atlas.vercel.app, which record links open, is built from claude/setup-cyber-atlas-scaffold-ieuDR. Records, fields and counts on the linked pages can differ from this snapshot until that branch is deployed.
Mismatch: Orbital Risk Tracker was read from branch claude/gtc-hardening, not the deployed branch
The snapshot read Orbital-Risk-Tracker at claude/gtc-hardening (e219b82). The production site https://orbitalrisktracker.vercel.app, which record links open, is built from claude/space-incidents-dashboard-HOnqa. Records, fields and counts on the linked pages can differ from this snapshot until that branch is deployed.
Mismatch: Global Nuclear Infrastructure Atlas was read from branch claude/gtc-hardening, not the deployed branch
The snapshot read Global-Nuclear-Infrastructure-Atlas at claude/gtc-hardening (daadd82). The production site https://globalnuclearinfrastructureatlas.vercel.app, which record links open, is built from claude/nuclear-infrastructure-atlas-IIjPg. Records, fields and counts on the linked pages can differ from this snapshot until that branch is deployed.
Mismatch: Lunar Governance Tracker was read from branch claude/gtc-hardening, not the deployed branch
The snapshot read lunar-mandate-atlas at claude/gtc-hardening (d3d48a1). The production site https://lunar-mandate-atlas.vercel.app, which record links open, is built from claude/lunar-governance-tracker-txA5R. Records, fields and counts on the linked pages can differ from this snapshot until that branch is deployed.
Note: Actor fields not resolved to a state
13 records name a state in the actor field but are not linked to it: cyber:stuxnet ("United States / Israel": attribution confidence "moderate" is below high); cyber:colonial-pipeline ("Russia (criminal, not directly state-sponsored per US assessment)": qualifier says the actor is not the state); cyber:costa-rica-conti ("Russia (criminal, not directly state-sponsored per public assessments)": qualifier says the actor is not the state); cyber:shamoon-aramco ("Iran (assessed)": attribution confidence "moderate" is below high); cyber:iran-nuclear-cyber ("Israel (attributed by Iran; not officially confirmed)": attribution confidence "low" is below high); cyber:taiwan-telecom ("China (assessed)": attribution confidence "moderate" is below high); cyber:scattered-spider-mgm ("United States / United Kingdom (individuals; not state-sponsored)": qualifier says the actor is not the state); cyber:change-healthcare ("Russia (criminal, possible state nexus)": qualifier says the actor is not the state); cyber:india-pakistan-cyber ("India / Pakistan (reciprocal)": attribution confidence "moderate" is below high); cyber:flame-flamer ("United States / Israel": attribution confidence "moderate" is below high); orbital:1 ("China": attribution confidence "medium" is below high); orbital:4 ("China": attribution confidence "medium" is below high); orbital:5 ("Iran": attribution confidence "medium" is below high).
Note: Kori / Shin-Kori Nuclear Power Plant: reported cyber incident has no cyber atlas case
The nuclear atlas records 2014 incident (Documents leaked from operator network; no control-system compromise reported) with source https://nextgov.com/cybersecurity/2014/12/breach/143556. The cyber atlas has no case for it, so no link is drawn.

Data

Download the snapshot

One JSON file with every record, shared entity, link, facet and basis shown on this page, plus the crosswalk tables, source branches and commits, dataset checks and the excluded fictional records. It holds 254 nodes (178 records and 76 shared entities), 407 record to entity edges, 6 record links (1 same event, 5 same intrusion set) and 25 facets. Each link carries a tier field.

Download JSONfaultline-crossdomain-2.1.0-2026-10-30.json