Public data already says who is exposed. It cannot say whether this facility's failure reaches them, or how fast. That coupling is the one field a plant can supply from memory, and it is the field that makes a lives-denominated risk figure defensible.
Ask the operator a single question: from loss of control, how long until someone outside the fence is harmed?
One number, in hours. It is a process characteristic rather than a prediction, the plant engineer knows it without looking it up, and it discloses nothing an adversary could use, because it describes chemistry and physics rather than architecture.
Counts of people inside the harm geography, published by agencies whose job is to warn communities.
Hours from loss of control to first offsite harm. Falls straight out of the existing hazard analysis.
Exposure counted, coupling declared. Neither term is guessed, so the result survives a hostile review.
The window ends at harm outside the fence. A death inside the facility does not move this number. That is a scoping choice rather than a discovery, so it is stated here instead of left to be inferred.
Contamination reaching the distribution network. Loss of power reaching a ward or a home ventilator. A release crossing the property line. Every one of these has a travel time, and travel time is what the window measures.
The operator standing beside the vessel is hurt at T = 0. There is no margin to consume, so the metric has nothing to discriminate with. Onsite harm is governed by whether the safety instrumented system holds, which is a different mechanism needing a different term.
In most real OT incidents the people most likely to die are inside the fence. A metric that excludes them systematically understates harm, and it does so in the direction that flatters the facility. Anyone reviewing this adversarially will say so, and they will be right.
There is an audience risk underneath it. This work exists because an OT practitioner said his people count lives rather than dollars, and the lives an OT practitioner thinks about first are usually his own operators. Answering "lives" by counting only the neighbours may land wrong with exactly the audience it was built for.
The defence is scope, not merit. This is the right boundary for a clearinghouse telling third parties what a facility's failure does to them, and it is the wrong boundary for a plant safety tool. If worker harm belongs in the output, it enters as a second declared field with its own denominator, not as a change to this one.
There is also a practical constraint. Both halves of the equation are offsite by construction: emPOWER counts residents, RMP counts residential population inside the endpoint, Census counts the neighbourhood. None of them know how many people are on shift. Onsite exposure has no public denominator, so including it would require asking the operator for a second number as well as the window.
Four candidates were considered. Three fail for reasons worth recording, so nobody re-proposes them in six months.
The rule that governs this map: consequence data is public where the law exists to tell a community how badly a facility can hurt them, and sealed where the law exists to protect the facility. Every safety and environmental regime surveyed opens part of it. Every cyber regime seals it, without exception.
| Jurisdiction | Instrument | Spine | Status | What it yields |
|---|---|---|---|---|
| United States | HHS emPOWER | Health | Open | Electricity-dependent Medicare beneficiaries, ZIP level, monthly. The strongest single exposure source found. |
| United States | EPCRA Tier II & LEPC plans | Safety | Open | Facility chemical inventory on public request; each LEPC holds a community emergency plan built from it. |
| United States | EPA RMP offsite consequence analysis | Environment | Reading room | Residential population inside the worst-case release endpoint. Reference-grade, not scrapeable. |
| United States | HIFLD | Geospatial | Moved | 400+ infrastructure layers. Open portal closed Aug 2025; preserved via HSDL and HIFLD Next. Treat as a live dependency. |
| United States | AWIA s.2013 risk & resilience assessments | Cyber | Sealed | FOIA-exempt by statute. Only the certification and its date. Criminal penalties for official disclosure. |
| United States | NERC CIP-002 impact ratings | Cyber | Derivable | Per-asset ratings unpublished, criteria public. A derived tier must be labelled as derived. |
| United Kingdom | COMAH 2015 | Safety | Open | Upper-tier safety reports publicly available subject to commercial redaction, plus a public establishment search. The most open jurisdiction found. |
| European Union | Seveso III, Article 14 | Safety | Open | All establishments publish Annex V permanently online; upper tier adds main accident scenarios and external emergency plan information. |
| European Union | eSPIRS | Safety | Gated | ~11,000 major-hazard establishments. Non-confidential read still requires Commission ECAS authentication. |
| European Union | NIS2, Article 21 | Cyber | Unverified | Measures are specified; disclosure regime not established either way. Assume sealed until checked. |
| UNECE region | Industrial Accidents Convention 1992 | Treaty | Open | Parties must inform the public in areas an accident could affect. Canada to Central Asia. The best single citation for disclosure as an international norm. |
| India | MSIHC Rules 1989 | Safety | Open | Explicit duty to inform persons outside the site, directly or via the District Emergency Authority, before the activity begins. |
| India | NCIIPC, IT Act s.70A | Cyber | Sealed | The clearest two-spine split inside one country: chemical side open, cyber side closed. |
| South Africa | Major Hazard Installation Regs 2022 | Safety | Open | In force Jan 2023, referencing SANS 1461 risk assessments. High-hazard licensing began Jan 2026. |
| South Africa | Critical Infrastructure Protection Act 2019 | Security | Verify | Replaced the secrecy-era National Key Points Act. Sources found say commencement not proclaimed; status needs a direct check. |
| Australia | SOCI Act, CIRMP annual report | Cyber | Sealed | Board-approved report to the regulator, not the public. Asset register publicness unconfirmed. |
| Canada | Critical Cyber Systems Protection Act | Cyber | Sealed | Vulnerability and protection information confidential; improper disclosure is an offence. |
| China | CII Security Protection Regs 2021 | Cyber | Sealed | Sealed with a state-secrets layer above it, carrying its own penalty regime. |
| Saudi Arabia | NCA CSCC-1:2019 | Cyber | Sealed | Mandatory controls for national critical systems, no public consequence disclosure. No public floor in this market. |
| Brazil | PLANSIC 2022 · CONAMA 398/2008 | Mixed | Partial | Oil-spill emergency plans specified; national survey found many municipalities lack contingency plans at all. |
| Nepal | DRRM Act 2074 (2017) | Disaster | Absent | Institutions and duties exist; no facility-level public disclosure for water or power. This is the global median, not an edge case. |
| Kenya · Nigeria · Indonesia | None established | — | Absent | No community right-to-know framework found. Capacity constraint rather than deliberate secrecy. No public floor does not mean no hazard. |
Coverage is uneven by sector and country, so a lives axis must never be promised as universal. What it can promise is that the declared field carries the model wherever the public floor thins out.
Exposure is counted from federal sources. The declaration is checked against it, and a facility can be scored before it ever talks to you.
Reading rooms, authenticated databases, derived ratings. Fine for a report, wrong as a product dependency. Label derived values as derived.
The declared window is the entire model. Nothing to cross-check against, so provenance and attestation carry the weight instead.
Note what the output does not say. It does not predict deaths. It says the protective window closes before the response completes, names who is inside it, and cites where each number came from. That is a claim that survives a hostile reviewer, which a fatality count is not.