  Hyperproperties relate multiple computation traces to each other. Model
checkers for hyperproperties thus return, in case a system model violates the
specification, a set of traces as a counterexample. Fixing the erroneous
relations between traces in the system that led to the counterexample is a
difficult manual effort that highly benefits from additional explanations. In
this paper, we present an explanation method for counterexamples to
hyperproperties described in the specification logic HyperLTL. We extend
Halpern and Pearl's definition of actual causality to sets of traces witnessing
the violation of a HyperLTL formula, which allows us to identify the events
that caused the violation. We report on the implementation of our method and
show that it significantly improves on previous approaches for analyzing
counterexamples returned by HyperLTL model checkers.
