A Guide to Network Topology Investigation Through Disease Vectors
- the Institute
- Dec 26, 2025
- 29 min read
Network Theory Applied Research Institute Educational Article | December 2025
In 1854, London physician John Snow faced an impossible problem. Cholera was killing hundreds. Medical consensus blamed "miasma"—poisonous air. But Snow suspected something else. He didn't have microscopes to see bacteria. He didn't have antibiotics to stop infection. What he had was a map.
He plotted every death on a street map of Soho. He marked water pumps. And suddenly the invisible became visible: every victim drew water from the same pump on Broad Street. The disease wasn't in the air—it was in the network.
Remove the pump handle, stop the outbreak. Snow didn't need to understand Vibrio cholerae to solve the epidemic. He needed to understand the network topology: how things connect, what pathways exist, which nodes matter most.
This article teaches you to see networks the way Snow did—not as abstract theory, but as practical analytical tools for decoding how anything propagates through connected systems. We'll learn to identify network topologies through disease patterns, then apply those tools to decode a medieval text that conceals its true transmission network beneath euphemistic miracle stories.
By the end, you'll be able to read network structure in everything from biological epidemics to digital infrastructure to historical documents that deliberately obscure their meaning. The topology doesn't lie—even when the narrative does.
What Networks Actually Are
A network is any system where things (nodes) connect to other things (edges). Your social circle is a network. The internet is a network. Disease transmission is a network. The shape of those connections—the topology—determines everything about how the system behaves.
The fundamental insight: You can't understand what propagates without understanding the structure it propagates through.
Think about water flowing through pipes. The same volume of water behaves completely differently depending on pipe topology. A single main feeding many branches delivers water everywhere simultaneously but creates single point of failure. A mesh of interconnected pipes routes around blockages but costs more to build. A linear chain of pipes means downstream users only get what upstream users don't use. The water doesn't change—the topology determines its behavior.
Disease, information, malware, capital, power—all behave like water. The medium propagates according to the container's shape.
Four questions reveal any network's topology:
How many connections does each node have? (Degree distribution) Is it evenly distributed (everyone has roughly the same number of connections) or is there a hub structure (a few nodes have many connections, most have few)?
How tightly do neighbors connect to each other? (Clustering coefficient) If your friend knows your other friend, clusters form. If your friends don't know each other, the network is more like a tree with branches that don't reconnect.
How many steps to reach any node from any other? (Path length) In a small-world network, you can reach anyone in 6 steps. In a hierarchical network, some paths require dozens of hops through intermediate nodes.
Which nodes are structurally critical? (Centrality measures) Remove a random person from your social network—nothing changes. Remove the person who introduced everyone else—the network fragments.
Different answers create radically different propagation patterns—from diseases that smolder locally for months to pandemics that cross continents in days. Let's learn to identify these patterns.
Topology Type 1: Hub-and-Spoke Networks (Star Topology)
Visual signature: One central node connected to many peripheral nodes. The periphery doesn't connect to itself—all paths flow through the hub.
Propagation pattern: Explosive spread from hub to all periphery simultaneously. Peripheral nodes don't infect each other directly.
Case Study: Legionnaires' Disease (1976)
In July 1976, 182 American Legion convention attendees developed pneumonia at Philadelphia's Bellevue-Stratford Hotel. Twenty-nine died. The disease announced itself three days after the convention ended, when veterans began showing up at emergency rooms with fever, cough, and confusion—symptoms that rapidly progressed to respiratory failure.
Epidemiologists descended on Philadelphia expecting to find a contagious disease spreading person-to-person. They interviewed every attendee, mapped every interaction, traced every handshake and shared meal. They looked for Patient Zero—the first infected person who spread disease to others. They found none.
Network topology revealed: The building itself was the hub. Legionella pneumophila bacteria colonized the cooling tower, aerosolized into microscopic droplets in the mist, broadcast through the HVAC system to every room, every corridor, every conference hall. Every guest breathed contaminated air. The network looked like this:
Cooling Tower (Hub)
|
-------------------------
| | | | | |
Guest1 Guest2 Guest3 ... Guest182
Here's what made this topology so dangerous: Victims shared no interpersonal contact. They didn't need to. Some attended different events. Some never met. One was a doorman who only briefly entered the lobby. What they shared wasn't social contact—they shared infrastructure. The transmission network had one source broadcasting to hundreds of receivers—classic hub-and-spoke topology.
The bacteria were discovered six months later by CDC microbiologist Joseph McDade, who re-examined tissue samples under electron microscopy and found rod-shaped bacteria that hadn't grown in conventional bacterial cultures. Legionella required specialized growth media that hadn't existed when the outbreak began. The network was visible before the pathogen was.
Intervention strategy: Quarantining patients does nothing—they're not contagious to each other. Isolating attendees doesn't stop spread because person-to-person transmission isn't the mechanism. Shutting down the hub (cooling tower, HVAC system) stops all transmission instantly. You're not isolating infected nodes—you're removing the broadcast source.
Modern prevalence: Legionnaires' cases increased 900% between 2000-2018 in the United States, from approximately 1,000 to 10,000 reported cases annually. This isn't because the bacteria are more virulent—it's because modern buildings create more hub-and-spoke networks: large centralized water systems serving hundreds of fixtures, cooling towers that aerosolize water to cool commercial buildings, HVAC systems broadcasting to hundreds of rooms through shared ductwork. One colonized water heater in a hotel infects guests who never meet each other. One contaminated hot tub at a county fair infects hundreds of attendees across multiple days.
The topology scales with building size. A 20-story hotel with centralized climate control creates a hub serving thousands of people daily. A cruise ship creates a floating hub with 5,000+ passengers breathing processed air through shared ventilation. A hospital creates the most dangerous hub of all—elderly and immunocompromised patients exposed to aerosolized bacteria they can't fight off.
Generalized pattern: Hub-and-spoke topology appears whenever one central infrastructure node connects to many endpoints that don't connect to each other. Cloud computing follows this topology—AWS, Google Cloud, and Microsoft Azure are hubs broadcasting services to millions of applications that don't directly communicate with each other. Applications connect to AWS, not to each other. Take down the hub, fragment the entire network.
In December 2021, AWS us-east-1 region (Northern Virginia) experienced outage. Netflix, Disney+, Robinhood, Tinder, Coinbase—thousands of services stopped functioning simultaneously. The services didn't fail—their shared hub failed. That's star topology: one point of failure disables the entire periphery.
The same structure that enables efficient service delivery (one source, many receivers) creates catastrophic single-point failure. Snow's pump, Philadelphia's cooling tower, AWS's data center—remove the hub, stop the entire system.
Topology Type 2: Behavioral Modification Networks (Dynamic Reconfiguration)
Visual signature: Nodes actively change their connection patterns based on network influence. The topology itself transforms as propagation occurs.
Propagation pattern: The disease doesn't just use existing connections—it creates new ones by modifying how nodes behave.
Case Study: Toxoplasmosis (The Parasite That Rewrites Fear)
Toxoplasma gondii infects up to 50% of humans globally—possibly more than any other parasite species on Earth. In most people it causes mild flu-like symptoms or no symptoms at all, then forms dormant cysts in muscle and brain tissue. Harmless, according to medical consensus for decades. But in rats, it does something remarkable: infected rats lose their fear of cats.
Uninfected rats flee from cat urine—hard-wired survival instinct shaped by millions of years of predator-prey evolution. Place a rat in maze with cat urine in one arm and neutral odor in another, it avoids the cat urine 90%+ of the time. Infected rats reverse this. They're attracted to cat urine. They linger near it. They approach cats. They get eaten.
And that's the point: Toxoplasma reproduces sexually only in cat intestines. Asexual reproduction happens in any warm-blooded host, but sexual reproduction—genetic recombination, evolution, adaptation—requires cats. The parasite must get its rodent host eaten by a cat to complete its lifecycle.
Network topology revealed: The parasite forms cysts in the brain, particularly the amygdala (fear processing) and regions associated with pleasure and reward. But here's the precision: it doesn't suppress all fear. Infected rats still fear open spaces, loud noises, other predators. The parasite specifically converts cat-odor fear into attraction while leaving other fears intact. It's surgical modification of one network connection.
Studies by Stanford parasitologist Robert Sapolsky showed infected rats have increased dopamine in brain regions processing smell. Cat urine, normally triggering fear response, now triggers sexual arousal pathways. The rats don't lose fear—they experience sexual attraction to the smell of their predators.
Key network insight: Most diseases passively exploit existing connections. Influenza uses whoever you're near. HIV requires fluid exchange but doesn't make you seek fluid exchange. Toxoplasma actively rewrites the network topology by changing how nodes behave. A rat that would never approach a cat now does—creating a transmission edge that wouldn't naturally exist.
The parasite doesn't just need transmission—it needs a specific transmission pathway (rat eaten by cat, not rat dying in burrow). So it engineers behavior that increases probability of that specific pathway. Network modification serves propagation strategy.
Human effects: Toxoplasma cysts appear in human brains too, same locations. Studies show correlations with:
Increased traffic accident rates (2.65x higher in infected men in one Czech study)
Slower reaction times (measured in lab settings)
Increased risk-taking behavior
Altered odor perception and preferences
Possible correlations with schizophrenia (though causation unclear)
The parasite may be modifying human behavior to increase transmission probability, just as it does in rats. Humans can't complete Toxoplasma's lifecycle (we're dead-end hosts—cats don't eat us), but the parasite's behavioral modification mechanisms still activate because they evolved in rodent brains structurally similar to human brains.
Most concerning: we have no idea how many other parasites modify behavior. Toxoplasma got discovered because its endpoint is obvious—rats approach cats, which is spectacularly unnatural. Subtler modifications (slightly increased sociability, marginally altered risk assessment, modified sexual preferences) might never be detected even if common.
Generalized pattern: Dynamic reconfiguration topology appears when propagation actively changes node behavior. Social media algorithms do this—they don't just use your existing connections, they modify your behavior (engagement patterns, attention, emotional responses, content consumption) to create new connection patterns that serve platform propagation goals.
You start clicking on content you wouldn't naturally seek because the algorithm has modified your behavior. TikTok's recommendation algorithm doesn't show you what you explicitly request—it modifies what you want to request by showing you content that triggers engagement, then more content similar to that, recursively training you toward content that maximizes your time on platform. The algorithm modifies the node (you) to serve the network (ByteDance's attention economy).
Facebook's 2014 "emotional contagion" experiment demonstrated this explicitly: they manipulated 689,000 users' news feeds to show more positive or negative content, then measured whether users' own posts became more positive or negative. They did. The platform modified user emotional expression by modifying what users saw. Network reconfiguration for propagation of engagement.
Unlike Toxoplasma, which needs millions of years to evolve behavioral modification, social media algorithms can modify behavior in weeks through machine learning optimization. The topology reconfigures in real-time.
Topology Type 3: Temporal Networks with Environmental Memory
Visual signature: Edges persist across time, connecting past nodes to future nodes through environmental reservoirs. The network includes connections to nodes that don't exist yet.
Propagation pattern: Infection outlasts any individual host because the environment itself becomes a permanent reservoir.
Case Study: Chronic Wasting Disease in Deer
Chronic wasting disease (CWD) is a prion disease—misfolded proteins that convert normal proteins into more misfolded copies through contact. The prion twists the brain's native proteins into the same pathological shape, creating holes in brain tissue until the structure resembles a sponge. Infected deer become emaciated ("wasting"), show behavioral changes (loss of fear, repetitive movements), drool excessively, and eventually die.
Here's what makes CWD unprecedented: Prions bind to soil minerals and remain infectious for decades. Scrapie prions (related sheep disease) stayed infectious in soil for 16+ years in field studies. CWD may persist longer.
Infected deer shed prions in saliva, urine, feces, decomposing tissue. Prions enter soil through these fluids and through decomposition. Once in soil, they bind to clay particles and organic matter. Soil acts as "prion replicator"—binding preserves the protein structure better than exposure in open air. Freeze-thaw cycles don't destroy them. UV radiation doesn't reach them. Microbial breakdown is ineffective—prions aren't alive, so they can't be killed.
Network topology revealed:
Infected Deer (2010) → Soil Deposition → Soil (2010-2040+) → Future Deer (2035)
The disease propagates through time itself. Deer graze on contaminated grass, inhale contaminated dust particles while bedding down, lick mineral deposits (salt licks) contaminated years earlier. Fawns born a decade after the original infected animal died still encounter infectious prions in the soil.
Research by USGS wildlife biologist Michael Samuel showed CWD prions remain infectious in soil for at minimum 2.5 years, but laboratory studies suggest 15-30 year persistence. In areas with high clay content soil (which binds prions strongly), persistence may extend beyond current measurement capabilities.
Key network insight: The network includes temporal edges—connections from past to future that exist independent of living hosts. Every infected deer creates transmission pathways lasting 10-30 years beyond its death. The infectious period isn't the animal's lifespan—it's the environmental persistence time.
Modeling studies show this makes R₀ (basic reproduction number—average number of new infections from one infected individual) far higher than direct-transmission-only models predict. Traditional disease modeling assumes infection requires contact with infected host. CWD breaks that assumption. An infected deer dying in 2010 can infect deer born in 2025 who never overlap with any living infected animal.
Intervention failure: Wildlife managers tried aggressive culling in Wisconsin and Illinois—removing 50-75% of deer in affected zones. CWD prevalence temporarily declined, then rebounded within 3-5 years as new deer migrated in and encountered decades of accumulated environmental contamination. Culling infected deer reduces direct transmission but doesn't eliminate the reservoir. Prions accumulated over decades continue infecting new deer regardless of current population management.
In some areas of Wyoming, CWD prevalence in adult male deer exceeds 50%. These are population-level infection rates comparable to endemic diseases, sustained not by host-to-host contact but by environmental reservoir. The land itself is infectious.
Attempts to decontaminate soil have largely failed. Prions resist:
Incineration at temperatures below 900°F
Autoclaving (standard sterilization)
Bleach, formaldehyde, radiation
Standard disinfection protocols
One area in Wisconsin attempted soil removal—excavating contaminated areas to bedrock. Cost: millions of dollars per acre. Effectiveness: unknown, because you can't be certain you removed every contaminated particle, and deer from adjacent areas continuously reintroduce prions.
Generalized pattern: Temporal memory networks appear whenever information persists in environmental substrates independent of current participants.
Blockchain works this way—transactions recorded in 2010 remain accessible indefinitely, creating temporal edges to future users who weren't born when the transaction occurred. Every Bitcoin transaction ever executed is stored permanently in the blockchain. Future nodes access past data without the original nodes being present.
Digital waste creates environmental memory: abandoned social media accounts, forgotten databases, cached web pages, email server archives. Information deposited years ago remains accessible to future actors. The network includes edges to nodes that existed years ago, preserved in environmental substrate (servers, hard drives, Internet Archive).
Nuclear waste works this way—radioactive contamination persists for centuries. Future humans will encounter hazards created by people who died generations before. The environment remembers what the social network forgot.
Topology Type 4: High-Clustering Networks (Dense Local Subgraphs)
Visual signature: Nodes cluster in tight groups where everyone connects to everyone. High density within clusters, sparse connections between clusters.
Propagation pattern: Explosive spread within clusters, slow spread between clusters. The disease burns through local groups rapidly but struggles to escape.
Case Study: White-Nose Syndrome in Bats
In February 2006, a caver photographing hibernating bats near Albany, New York, noticed something wrong: white fungus crusting the muzzles, ears, and wing membranes of bats clustered on the cave ceiling. He took photos. Within two years, the hibernaculum that once housed 15,000 bats had fewer than 2,000. By 2012, an estimated 6.7 million bats died across eastern North America. Some populations declined 90-100%. Entire species approached extinction.
Pseudogymnoascus destructans—the white-nose fungus—thrives at hibernation temperatures (2-15°C). It colonizes bat wing membranes during hibernation when bats enter torpor (metabolic shutdown to conserve energy). Wing membranes are thin layers of skin stretched between elongated finger bones—critical for flight but also respiratory gas exchange. Bats "breathe" through wing membranes, absorbing oxygen and releasing carbon dioxide through the thin tissue.
Fungal colonization damages the wing membrane, causes dehydration, triggers immune response. Infected bats wake frequently from hibernation—metabolic cost of immune response and tissue repair forces them out of torpor. Each awakening burns precious fat reserves. They starve before spring. Researchers find dead bats clustered near hibernaculum entrances, emaciated bodies weighing 40-60% less than normal, wing membranes tattered with fungal lesions.
Network topology revealed: Bat hibernation creates extreme clustering. Little brown bats (Myotis lucifugus) hibernate in colonies of hundreds to tens of thousands, packed body-to-body in caves and mines for 5-7 months. They cluster for thermoregulation—shared body heat reduces metabolic cost of maintaining hibernation temperature. Touch is constant. One bat can contact dozens of neighbors.
[Hibernaculum 1: 5,000 bats in physical contact]--sparse connection--[Hibernaculum 2: 3,000 bats]
| |
[Individual bats connected [Individual bats connected
in dense local network] in dense local network]
Key network insight: Within each cave, clustering coefficient approaches 1.0—nearly every bat contacts every other bat across the winter. But between caves, connections are sparse and only occur during specific periods:
Summer dispersal: Bats leave hibernacula, travel to maternity colonies (females) or solitary roosts (males), 50-300km from hibernation sites
Fall swarming: Mating occurs at hibernaculum entrances in fall, creating temporary high-contact periods
Spring emergence: Bats leave hibernacula, may briefly visit other caves before dispersing to summer range
The rest of the year—the 5-7 months of hibernation—bats are locked in dense local clusters with minimal movement. This creates 70-90% mortality within hibernacula but slow spread between sites. The disease burns through each cave rapidly (entire colony dead within 2-3 years) then waits for migratory connections to jump to new sites.
White-nose spread across eastern North America followed this pattern: approximately 250km per year, tracking known bat migration corridors and cave networks. Fastest spread occurred along corridors with multiple caves used during migration (swarming sites where bats from multiple hibernacula mix). Slowest spread occurred across regions with isolated hibernacula separated by unsuitable habitat.
Human contrast: Humans don't cluster in cold enclosed spaces for months at suppressed body temperatures with thousands of others breathing through thin membranes. The topology enabling 90% mortality simply doesn't exist in human populations.
Even crowded human spaces (subway cars, concert venues) involve:
Hours of exposure, not months
Normal metabolic function, not torpor
Regular hygiene opportunities
Ability to leave
Bat hibernation requires continuous contact for months in environments that suppress immune function. It's the difference between standing in a crowded elevator for two minutes and being sealed in that elevator for six months.
Generalized pattern: High-clustering networks appear in any system where dense local groups have sparse inter-group connections.
Centralized server architectures create this topology—thousands of applications cluster on one data center with sparse connections between data centers. One compromised server can infect the entire cluster because everything connects to everything locally. AWS availability zones are designed to prevent this: dense local clusters (many servers in one zone) with controlled connections between zones and regions.
Social networks show clustering: high-school friend groups have near-complete internal connection (everyone knows everyone) but sparse connections to other schools. Disease, information, social movements burn through tight clusters then jump sporadically to other clusters via sparse inter-cluster edges.
Workplace clustering creates similar patterns. One sick employee in open-plan office infects entire floor (dense local contact) but slower spread to other floors/buildings (sparse inter-cluster contact). COVID-19 spread within workplaces followed this pattern exactly—explosive local outbreaks, sporadic jumps to new workplaces.
Topology Type 5: Structured Long-Distance Networks (Migration Pathways)
Visual signature: Sparse connections spanning long distances, organized into structured pathways rather than random distribution. Network has preferred routes.
Propagation pattern: Disease jumps between distant locations following predictable corridors while maintaining distinct regional populations.
Case Study: Avian Influenza via Flyways
Every spring and fall, billions of birds migrate between breeding and wintering grounds following ancient routes called flyways—Pacific, Central, Mississippi, Atlantic in North America; similar structures exist globally. These aren't random wandering. They're structured pathways refined over millennia of evolution, following topography (coastlines, mountain ranges, river valleys) and food availability (wetlands, agricultural fields, coastal mudflats).
Avian influenza viruses infect waterfowl asymptomatically, replicating in intestinal tracts and shedding into water where ducks, geese, and swans congregate. Infected birds travel thousands of miles, stopping at wetlands along migration routes where massive congregations enable inter-species transmission. One infected mallard from Siberia can transmit to thousands of other birds at a single stopover site in Alaska. Those birds continue south, carrying virus to new regions.
Network topology revealed: Transmission rates are 4-5x higher within flyways than between them. Birds don't migrate randomly—they follow structured pathways with predictable stopover sites where massive congregations enable transmission.
Pacific Flyway birds migrating from Alaska to California stop at predictable wetlands: Klamath Basin (Oregon/California border), Central Valley wetlands, Salton Sea. Millions of birds concentrate at these sites over weeks, creating transmission opportunities that don't exist during flight or at dispersed breeding/wintering sites.
The network structure looks like this:
Siberian Breeding Grounds → Bering Strait → Alaska → British Columbia →
California Central Valley → Mexico
↓ ↓ ↓
[Stopover site: [Stopover: [Stopover:
high density] moderate] high density]
Each stopover is a temporary hub where sparse long-distance connections (migrating birds) create dense local networks (thousands of birds concentrated in small areas).
The 2021-2024 H5N1 Outbreak: In December 2021, highly pathogenic H5N1 avian influenza appeared in Newfoundland—first North American detection in this outbreak cycle. Genetic sequencing traced the virus to northwestern Europe. How did it cross the Atlantic?
Waterfowl migrate trans-Atlantic routes through Iceland and Greenland. Northern gannet, common eider, barnacle geese, pink-footed geese—multiple species use this corridor. One infected bird departing western Europe, stopping in Iceland (major congregation site for North Atlantic seabirds), continuing to Greenland, then reaching Newfoundland can introduce virus to entire Atlantic Flyway.
By March 2022, H5N1 appeared in Atlantic Flyway birds along the eastern seaboard. By April 2022, it jumped to Central and Mississippi Flyways—likely via birds using multiple flyways during migration (some species shift between flyways depending on wind, weather, food availability). By 2024, H5N1 had spread across North America following flyway structure: Atlantic → Mississippi → Central → Pacific, reaching Alaska (completing the trans-Pacific loop back to Asian populations).
Key network insight: The network enables hemispheric transmission in weeks while maintaining structured propagation. Viruses don't spread randomly—they follow predictable pathways like scheduled airline routes.
Europe → Iceland → Greenland → Newfoundland → Mississippi Flyway →
[predictable propagation southward following established waterfowl routes]
Surveillance can anticipate where virus will appear based on flyway topology. If H5N1 appears in Central California wetlands, expect it in Pacific Northwest within 2-4 weeks (northward spring migration) and southern California/Mexico within 2-4 weeks (continued southward movement of late migrants).
Intervention challenge: You can't close flyways. Birds migrate instinctively along routes shaped by millions of years of evolution. Interventions must work with network structure:
Surveillance at stopover sites: Monitoring wetlands where millions of birds congregate reveals which strains are circulating
Protection at flyway interfaces: Preventing contact between wild waterfowl and domestic poultry near major stopover sites
Vaccination of commercial flocks: Particularly those near flyway corridors
Early warning systems: Genetic sequencing at northern stopover sites (Alaska, Canada) provides advance warning of strains heading south
The topology is permanent—birds will follow these routes as long as wetlands exist. Managing disease requires understanding and working within that structure, not fighting it.
Generalized pattern: Structured long-distance networks appear whenever sparse connections follow predictable pathways.
Internet routing follows this topology—BGP (Border Gateway Protocol) creates preferred paths between autonomous systems. Your data packet from New York to London doesn't take random routes—it follows established peering arrangements between ISPs, transiting through specific backbone providers. Cyberattacks propagate along these routes predictably. Network administrators can predict where attacks will appear next based on BGP routing topology.
Highway systems create structured long-distance networks for invasive species. Emerald ash borer spread across North America following interstate highways—larvae survive in firewood transported by vehicles, creating long-distance jumps along established routes. Random forest-to-forest spread would take centuries; highway-facilitated spread covered the eastern US in 15 years.
Historical trade routes worked this way—Silk Road connected Asia to Europe via structured pathways through Central Asia. Diseases, goods, ideas propagated along these routes for millennia. Bubonic plague reached Europe via established trade networks, not random movement.
Understanding the pathway structure reveals where threats will appear next. The topology is visible before the propagation occurs.
Topology Type 6: Broadcast/Field Effect Networks (Area-Based Propagation)
Visual signature: No direct node-to-node edges. Instead, all nodes within a boundary are simultaneously affected by a field.
Propagation pattern: Instant propagation to all nodes within range. No sequential transmission—everyone in the field is affected simultaneously.
Case Study: The Shimmer (Alex Garland's Annihilation)
In Annihilation (2018 film, based on Jeff VanderMeer's novel), a mysterious zone called "The Shimmer" emerges from a lighthouse on the US Atlantic coast. Everything inside undergoes radical biological transformation—DNA mutates continuously, species boundaries dissolve, organisms exchange genetic information promiscuously. Flowers grow in humanoid shapes. Deer sprout flower antlers. A bear incorporates its victim's screaming voice into its own vocalizations. Plants develop humanoid forms. The environment itself becomes a biological mixing medium.
Network topology revealed: This isn't a contact network where infected individual A transmits to susceptible individual B through physical interaction. It's a broadcast field—all nodes within the boundary receive and transmit genetic information simultaneously.
Traditional epidemic model:
Infected Node A → Physical Contact → Susceptible Node B → Infected
The Shimmer topology:
All nodes within boundary ← Field Effect → All nodes within boundary
↓
Continuous genetic exchange
↓
Simultaneous transformation
Key network insight: There are no "infected" vs "susceptible" nodes. Everything inside broadcasts and receives constantly. The network isn't a graph—it's a broadcast medium where all receivers get the signal simultaneously.
The boundary expands at constant rate (geometric expansion, not exponential epidemic curves). Once you're inside, you're affected immediately—no incubation period, no infectious dose. The field is binary: inside or outside.
What's biologically fascinating about this fictional topology is that it mirrors real broadcast-field phenomena:
Radiation exposure: Nuclear fallout doesn't spread person-to-person. Everyone within the exposure zone receives radiation simultaneously. Distance from source determines dose, but there's no contact-based transmission chain. One contaminated person doesn't infect another through proximity—both are affected by field presence.
Electromagnetic fields: Power lines create electromagnetic fields affecting all electronic devices within range simultaneously. One device doesn't "catch" the interference from another—both receive the field directly.
Chemical contamination: Toxic gas release creates exposure zone where everyone breathes contaminated air simultaneously. No contact-based chain of infection exists. You don't catch chemical poisoning from another victim—you're exposed to the same field.
The Shimmer literalizes this with genetic information: the field broadcasts and receives DNA continuously, creating simultaneous transformation across all organisms within the boundary. It's what would happen if genetic exchange worked like WiFi—constant broadcast/receive across all nearby nodes.
Intervention: In the film, when the source (the lighthouse entity) is destroyed, the entire field collapses. The Shimmer vanishes. Despite appearing distributed, the topology had centralized dependency. Like taking down DNS root servers—the distributed network stops functioning without coordinating infrastructure.
This reveals something critical about broadcast topologies: they often mask centralization. The field appears to affect everything simultaneously (distributed), but the field itself emanates from a source (centralized). Remove the source, the field vanishes.
Generalized pattern: Broadcast networks appear whenever propagation doesn't require contact between nodes.
Wi-Fi works this way—all devices within range receive the signal simultaneously. One laptop doesn't "infect" another with internet access—both receive broadcast from the router.
Radio/TV broadcasting: One transmitter, millions of receivers, no receiver-to-receiver transmission required. You don't catch the radio signal from your neighbor—you both receive the same broadcast.
Misinformation on social media has broadcast properties when algorithmic amplification makes content visible to millions instantly without sequential person-to-person sharing. One tweet doesn't propagate through contact chains—the platform broadcasts it to millions of feeds simultaneously via recommendation algorithm.
Traditional word-of-mouth misinformation spreads via contact networks (you tell your friends, they tell theirs). Algorithmic amplification creates broadcast topology (platform shows it to millions simultaneously regardless of social connections).
The critical distinction: contact-based transmission requires chains of infection, sequential spread. Broadcast transmission affects all receivers simultaneously, no chains required. Different topologies require different interventions. You can't quarantine people to stop a broadcast field—you need to shut down the transmitter.
Topology Type 7: Multi-Vector Attack Networks (Parallel Propagation Pathways)
Visual signature: Multiple simultaneous transmission mechanisms. If one pathway fails, others succeed. Multiple edges connect the same nodes through different mechanisms.
Propagation pattern: Dramatically accelerated spread because infection uses whichever pathway works fastest for each target.
Case Study: The Morris Worm (1988)
On November 2, 1988, Robert Tappan Morris released a program to measure internet size. He was a Cornell graduate student curious about how many computers were actually connected to this new network. The program was supposed to propagate slowly, install on each system, count it, and move to the next one. Within 24 hours, it infected 6,000 of 60,000 internet-connected computers—10% of the entire internet.
What went wrong reveals everything about multi-vector topology.
Network topology revealed: The worm used three attack vectors simultaneously:
Vector 1: Password Cracking The worm carried a dictionary of 432 common passwords plus username variations. It attempted:
The username itself (many users set password = username)
Username reversed
Common passwords (password, guest, admin, root)
Dictionary words
For each vulnerable account, it logged in via remote shell protocols and executed itself. This worked on systems with weak passwords but failed on systems with strong password policies.
Vector 2: Finger Daemon Buffer Overflow The finger daemon (a service that reported information about users) had a buffer overflow vulnerability. Send it more data than its input buffer could hold, the excess overwrites adjacent memory, including the return address pointer. The worm crafted input that overwrote the return address to point to its own code.
This worked on unpatched systems but failed on systems that had updated finger daemon or disabled the service.
Vector 3: Sendmail Debug Backdoor Sendmail (email server software) shipped with a debug command that allowed remote code execution—intentional backdoor for developers. The worm used this command to execute shell commands remotely.
This worked on systems running vulnerable Sendmail versions but failed on updated systems and non-Sendmail mail servers.
Key network insight: Multiple propagation vectors dramatically accelerate spread. If Vector 1 fails (strong passwords), Vector 2 or 3 succeeds. The worm reaches new hosts through whichever pathway is available.
Target Node
↑ ↑ ↑
| | |
Vector1 Vector2 Vector3
↑ ↑ ↑
Source Node
The probability of infection per contact = P(Vector 1 succeeds) + P(Vector 2 succeeds) + P(Vector 3 succeeds) - P(overlaps). Even if each individual vector has low success rate (say 20%), three vectors create much higher aggregate success rate (approximately 50-60% depending on independence).
The Fatal Design Flaw: Morris programmed 14% reinfection probability to bypass false infection reports. The worm checked if a system was already infected by looking for a specific process. If found, it had 86% chance of exiting, 14% chance of infecting anyway.
Why this created catastrophe: once the worm spread to hundreds of systems simultaneously (via multi-vector attack), those systems began reinfecting each other. Each reinfection spawned new processes. Within hours, infected systems had dozens or hundreds of worm processes running simultaneously, consuming all processor time and memory. Systems crashed from resource exhaustion—fork bomb effect.
The multi-vector topology enabled rapid initial spread. The reinfection probability created exponential process multiplication on each infected system. Combined, they brought down 10% of the internet in 24 hours.
Intervention: Network administrators couldn't patch all three vectors fast enough. Instead, regional networks disconnected from the internet backbone to prevent recontamination. UC Berkeley's Okbridge, MIT's network, military installations—they isolated themselves, cleaned infected systems, then carefully reconnected.
The only way to stop multi-vector propagation was temporarily destroy the network's fundamental property: interconnection. Fragment the network, isolate the pieces, disinfect, reconnect.
Cost: Estimated $100,000-$1,000,000 in productivity losses, system administrator time, and security improvements. Morris became the first person convicted under Computer Fraud and Abuse Act—400 hours community service, 3 years probation, $10,050 fine. He later became MIT computer science professor and co-founded Y Combinator.
Generalized pattern: Multi-vector topology appears whenever attack has multiple simultaneous mechanisms.
Biological diseases with multiple transmission routes spread faster than single-route diseases:
COVID-19: airborne droplets + aerosols + fomite transmission + close contact
Ebola: bodily fluids + contaminated surfaces + burial practices
HIV: sexual contact + blood transfusion + vertical transmission (mother to child) + needle sharing
Each route creates independent transmission probability. Even if airborne transmission is blocked (masking), fomite transmission continues (contaminated surfaces). Even if safe injection practices stop needle sharing, sexual transmission continues.
Phishing campaigns use multi-vector topology:
Email + SMS + phone calls + social media messages + fake websites
If you don't fall for email phishing, maybe you click SMS link
If you ignore both, maybe you answer phone call claiming to be bank
If you're skeptical on phone, maybe you see convincing social media post
Attackers don't rely on single vector—they deploy multiple simultaneously, knowing some targets will be vulnerable to at least one vector.
Modern malware routinely uses 5-10 attack vectors:
Known software vulnerabilities
Zero-day exploits
Social engineering (phishing)
Supply chain attacks
Stolen credentials
Physical device access
Insider threats
Misconfigured cloud services
Security teams must defend against ALL vectors. Attackers only need ONE to work. That asymmetry explains why multi-vector attacks succeed so frequently.
The topology is fundamentally adversarial to defense: defenders must achieve 100% coverage, attackers need 1% success rate.
Topology Type 8: Hierarchical Nested Networks (Fractal Propagation)
Visual signature: Networks nest inside networks—local subnets within regional networks within global infrastructure. Infection can cascade through all levels simultaneously.
Propagation pattern: One infected node in a subnet infects the entire subnet, which then infects connected subnets, creating exponential propagation through nested levels.
Case Study: WannaCry Ransomware (2017)
On May 12, 2017, hospitals across Britain's NHS began reporting ransom demands on their screens. Within hours: FedEx, Deutsche Bahn (German railways), Renault, Nissan, universities, governments across 150+ countries. Over 200,000 computers in one day. The ransom message demanded $300 in Bitcoin to decrypt files. For many organizations, the choice was: pay ransom or lose years of data.
What WannaCry did: It encrypted files on infected computers and demanded ransom for decryption key. But unlike typical ransomware (spread via email attachments or malicious downloads requiring user action), WannaCry was a worm—it spread automatically across networks without human interaction.
WannaCry exploited EternalBlue—an NSA-developed exploit leaked by hacker group "Shadow Brokers" on April 14, 2017, one month before WannaCry launched. EternalBlue targeted Windows' SMB (Server Message Block) protocol, used for network file sharing, printer access, inter-process communication. Microsoft patched it on March 14, 2017 (MS17-010), but millions of systems remained unpatched—organizations delay patches to avoid disrupting operations, older systems never receive updates, some administrators never saw the patch announcement.
Network topology revealed: Hierarchical nested structure:
One infected hospital computer → Entire hospital network (all computers communicating via SMB)
↓
Hospital VPN connections → Corporate partners, insurance companies, medical suppliers
↓
Partner networks → Their partners, subsidiaries, contractors
↓
Global propagation through nested interconnections
Key network insight: One infected machine on a network could infect the entire network automatically—no human clicks required. The worm scanned for other computers with SMB ports open (port 445), attempted EternalBlue exploit, and if successful, installed itself and continued scanning.
The network topology is fractal: local networks nest within regional networks nest within global internet. A worm exploiting this topology cascades through all levels simultaneously.
Why NHS was devastated: Britain's National Health Service operated legacy Windows XP systems (no longer receiving security updates) and Windows 7 systems (often unpatched due to operational constraints—hospitals can't afford downtime for patching). Hospital networks connect to each other (sharing patient records, coordinating care) and to external partners (insurance, suppliers, government systems).
One infected computer in one hospital propagated to every connected computer in that hospital, then to connected hospitals, then to connected partner organizations. The hierarchical structure amplified propagation exponentially:
1 infected computer in IT department
→ 50 computers in that hospital
→ 1,000 computers across hospital network (multiple facilities)
→ 5,000 computers in connected hospitals
→ 25,000 computers in NHS partner organizations
The nested topology created cascading failures. Each level of hierarchy added another order of magnitude to infection count.
The Accidental Kill Switch: Security researcher Marcus Hutchins (handle: MalwareTech) was analyzing WannaCry code on May 12. He noticed something odd: before encrypting files, the worm checked if iuqerfsodp9ifjaposdfjhgosurijfaewrwergwea.com resolved. If yes, halt propagation. If no (domain doesn't exist), continue.
This is standard malware sandbox detection—security researchers analyze malware in isolated environments (sandboxes) that simulate internet connectivity. If malware checks for internet connection and finds none, it knows it's in a sandbox and stops execution to avoid analysis. By checking for a nonsensical domain that definitely doesn't exist, the malware confirms it's on real internet.
But here's what the WannaCry authors got wrong: they didn't register the domain. It was unregistered, available for $10.69.
Hutchins registered it at 3 PM GMT on May 12. Every WannaCry infection worldwide queried the domain, received response (domain exists!), stopped spreading.
Global attack neutralized in hours because the worm included centralized dependency despite appearing distributed.
Network insight: The hierarchical nested topology appeared distributed—infections cascading through autonomous networks worldwide. But the worm had single point of failure: domain query. The nested topology amplified propagation; the centralized dependency enabled defensive intervention.
Why this happened: Theory is the domain check was intended as kill switch by the authors—if law enforcement got close, register the domain and halt the attack. Or it was researcher sandbox detection that accidentally created kill switch. Either way, distributed propagation met centralized control point.
Estimated Damage: $4 billion globally in productivity losses, recovery costs, and security improvements. NHS reported £92 million in direct costs plus cancelled appointments, diverted ambulances, delayed surgeries. One WannaCry infection on one computer cascaded through nested network topology to impact healthcare for millions of people.
Generalized pattern: Hierarchical nesting appears in all infrastructure systems:
Electrical grids nest local → regional → national:
One substation failure
→ Cascades to regional grid
→ Triggers regional blackout
→ Overloads adjacent regions trying to compensate
→ August 2003 Northeast blackout: 50 million people, started with overgrown trees in Ohio
Supply chains nest suppliers → manufacturers → distributors:
One semiconductor fab contamination (Taiwan, 2021)
→ Automakers can't build cars (chips shortage)
→ Dealerships have no inventory
→ Global vehicle shortage, price increases
Social networks nest friend groups → communities → platforms:
Misinformation starts in small group
→ Spreads to connected groups
→ Algorithmic amplification broadcasts to platform
→ Media coverage propagates to other platforms
Corporate networks nest departments → divisions → company → partners:
One employee clicks phishing link
→ Department network compromised
→ Division file servers encrypted
→ Partner networks accessed via VPN
→ Supply chain partners compromised
One failure cascades through levels. The nested topology amplifies both benefits (efficiency, coordination) and risks (catastrophic propagation).
Defending nested networks requires security at every level:
Endpoint security (individual computers)
Network segmentation (isolate critical systems)
Perimeter defense (firewall, intrusion detection)
Zero-trust architecture (verify every connection)
Patch management at all levels
Incident response plans that account for cascade effects
But perfect defense is impossible—there's always unpatched systems, always misconfigured firewalls, always human error. The nested topology guarantees that one breach at any level can cascade to all levels.
That's why WannaCry infected 200,000 computers in 24 hours. The topology did most of the work.
The Broader Pattern: Topology Determines Everything
From Legionnaires' broadcasting through HVAC systems to WannaCry cascading through nested corporate networks to medieval plague following pilgrimage routes, the principle remains constant:
You can't understand what propagates without understanding the network topology it propagates through.
We've identified eight core topologies:
Hub-and-spoke: Single source broadcasts to many receivers (Legionnaires', cloud computing, social media platforms)
Behavioral modification: Network actively changes node behavior (Toxoplasma, social media algorithms, targeted advertising)
Temporal memory: Environmental reservoirs create edges across time (CWD prions, blockchain, nuclear waste)
High clustering: Dense local subgraphs with sparse inter-cluster connections (bat hibernacula, data centers, workplace outbreaks)
Structured migration: Sparse long-distance pathways following predictable routes (avian flu flyways, internet routing, highway systems)
Broadcast field: Area effect where all nodes within boundary are affected simultaneously (radiation, WiFi, algorithmic amplification)
Multi-vector: Multiple simultaneous transmission mechanisms (Morris Worm, COVID-19, phishing campaigns)
Hierarchical nesting: Networks within networks enabling cascading propagation (WannaCry, electrical grids, supply chains)
Every real-world network combines multiple topologies. Understanding which topologies are present reveals how propagation will occur—and where interventions will succeed.
The internet, for example, combines:
Hub-and-spoke (cloud services)
Hierarchical nesting (local → regional → national networks)
Structured migration (BGP routing)
Multi-vector attacks (malware using multiple exploits)
Broadcast fields (algorithmic content distribution)
Different parts of the same network exhibit different topologies. Your home network is nested within your ISP's regional network (hierarchical), which connects to internet backbone via preferred routes (structured migration), while your devices connect to each other locally (high clustering) and some services broadcast to all devices (field effect).
Understanding topology means recognizing:
Where vulnerability concentrates (hubs, environmental reservoirs, inter-cluster bridges)
How failures cascade (nested levels, behavioral modification)
Which interventions work (remove hub vs. reduce clustering vs. block migration pathways)
What propagates successfully (depends entirely on topology match)
John Snow removed a pump handle in 1854 because he understood hub-and-spoke topology—one contaminated source, many receivers, zero receiver-to-receiver transmission.
Marcus Hutchins registered a domain in 2017 because he understood centralized dependency within distributed topology—WannaCry spread through hierarchical networks but checked one domain, creating single point of intervention.
Both interrupted disease propagation by understanding network topology and finding the intervention point.
Applying This to Digital Infrastructure
These aren't just biological curiosities or historical artifacts. NTARI applies network topology analysis to cooperative internet infrastructure.
Mesh networks avoid hub-and-spoke vulnerability by creating distributed pathways—no single point of failure can fragment the network. Every node can route around damage. During Hurricane Sandy (2012), Red Hook, Brooklyn's community mesh network kept running while Verizon towers failed because the topology didn't depend on centralized broadcasting infrastructure.
AGPL-3 licensing prevents behavioral modification by platform algorithms—communities maintain control over their network participation rather than having behavior modified to serve corporate propagation goals. When source code must be shared for network services, users can fork and modify the platform rather than being subject to algorithmic manipulation. The topology stays democratic rather than extractive.
Federated systems create natural clustering that limits malicious propagation while enabling beneficial cooperation—dense local communities with controlled inter-community connections. Mastodon instances exemplify this: within an instance, users have high interaction (clustering), but instance admins control which other instances to federate with (controlled inter-cluster connections). Malicious actors can't broadcast to the entire network—they're limited to their local cluster until other clusters choose to federate.
Municipal broadband creates public hub infrastructure instead of corporate hubs—when the community owns the central broadcast node, rent extraction stops flowing to distant shareholders. The hub-and-spoke topology still exists (efficient service delivery), but ownership determines whether surplus value circulates locally or extracts to Wall Street.
Community mesh + municipal fiber combines topologies: mesh provides resilient local connectivity (distributed pathways, high clustering), municipal fiber provides long-distance backbone (structured migration with democratic ownership). Neither topology alone is optimal—combining them creates infrastructure that's both resilient and efficient.
The same analytical tools that decode cholera propagation through water networks, plague transmission through pilgrimage routes, malware cascading through corporate hierarchies, and medieval hagiographies concealing disease vectors reveal how information, capital, power flow through digital networks.
The topology you build determines what propagates through it.
NTARI builds topologies that:
Resist single-point failure (no critical hubs)
Prevent behavioral exploitation (transparent algorithms, forkable code)
Enable community sovereignty (federated clustering, municipal ownership)
Route around damage (mesh resilience, multiple pathways)
Keep value local (economic circulation within communities, not extraction to distant shareholders)
These aren't arbitrary design choices—they're applications of network topology principles to digital infrastructure. We learn from what worked (telephone cooperatives, rural electric co-ops, public libraries, municipal water systems) and what failed (AT&T monopoly, utility holding companies, platform monopolies). History teaches topology; topology informs architecture.
Learn More
Network Theory Fundamentals:
Disease Network Analysis:
Historical Networks:
Computer Network Contagion:
Specific Case Studies:
Join the Network (The Cooperative Kind)
You now have the analytical toolkit to identify network topologies and decode propagation patterns—from medieval hagiographies that euphemize transmission vectors to modern ransomware exploiting nested network architectures.
NTARI applies these same principles to build cooperative internet infrastructure that resists extraction, manipulation, and catastrophic propagation while enabling genuine community coordination.
If you're interested in the technical work—developing mesh networks with distributed resilience, creating quantum community detection algorithms, building federated systems with transparent topology and democratic governance—join the development discussions: https://join.slack.com/t/ntari/shared_invite/zt-39injdzvr-a7jY2FVU00fYPopG7gyP4w
If this analytical approach to network architecture resonates with you, support the research and development work that makes cooperative alternatives viable: https://ntari.org/#give
For press inquiries, partnership opportunities, or questions: info@ntari.org
The topology you build determines what propagates through it. Choose architectures that preserve autonomy while enabling cooperation—not systems that extract, manipulate, or enable attackers to weaponize the network's own connectivity.
The topology doesn't lie. Even when the narrative does.
Comments