APOGEE STAFF
With their growing reliance on outer space to ensure national security, the U.S. and its allies are turning to the commercial space sector for its speed, innovation and flexibility. One result: Adversaries are viewing the space-based systems that enable communications, observation and other facets of civilian life as military targets, making the protection of these “dual-use” assets a top defense priority.
The war on Ukraine has added urgency to the effort. The day that Russian tanks first rolled in, a cyberattack targeted satellite internet provided by U.S.-based Viasat, blocking service for up to two weeks for tens of thousands of civilians across the region — even for a German wind-turbine operator — in an apparent attempt to disrupt the Ukrainian military’s command and control. The military successfully substituted portable Starlink system devices from U.S.-based SpaceX, so Russian hackers took aim at them, too. This time, they were unsuccessful.
The fighting at their doorstep gives the 27 nations of the European Union a major stake in developing protection for satellites, ground systems and the links between them. The policymaking EU Council adopted its first Space Strategy for Security and Defence in November 2023, featuring four action steps: increase understanding of space threats, enhance resilience of space systems and services, better respond to space threats, and enhance the use of space for security and defense. In announcing the new strategy, the council heralded “the strategic nature of space, and the necessity for the EU, as a global space power, to address current and upcoming security challenges linked to the recent intensification of irresponsible and hostile behaviours in the space domain.”
Spacefaring nations worldwide are moving to incorporate commercial capabilities into space defense and to shield them from attack. One example: The United Kingdom Space Operations Center joined the Joint Commercial Operations (JCO) cell established by U.S. Space Command (USSPACECOM) and the U.S. Space Force to improve space domain awareness (SDA) and the protection of space assets. “JCO-UK has been leading the charge into global commercial operations, and our lessons learned together will help us deploy new capabilities faster for our combined missions,” Barb Golf, a strategic advisor with the Space Force’s Space Systems Command (SSC), said in a July 2023 news release. Soon afterward, Australia’s Space Defence Force joined the JCO construct, and three cells — America, Pacific and Meridian — were established to provide continuous, global operations. Australia and the U.K., as well as commercial and defense space interests from a host of other nations, also take part through USSPACECOM in Sprint Advanced Concept Training (SACT), an exercise series that enables commercial vendors of space data and analytics to integrate their products in a realistic space operations environment. These nations include Australia, France, Japan, New Zealand and the United Arab Emirates. Companies, too, are taking a proactive approach to securing defense space business worldwide. Intelsat, the 60-year-old satellite communications firm with headquarters in Luxembourg, established a new global government and satellite services business unit in January 2023 to work with international customers who worry about threats from Russia and the People’s Republic of China (PRC), DefenseNews reported.
In a growing number of nations, the need to employ and protect commercial assets has been working its way into space defense plans. As of January 2023, USSPACECOM had reached agreements with companies from nearly 30 nations — from Azerbaijan to Vietnam — on sharing SDA data. NATO allies sought to protect space assets when they invited commercial partners in June 2023 to sign up for NATO’s Defence Innovation Accelerator for the North Atlantic, or DIANA. In its 2023 Defence Strategic Review, Australia said, “Commercial capabilities will … play an increasingly important role in complementing and augmenting Defence’s Space Command structure.” Centauri CubeSats built by Australia’s Fleet Space Technologies have played a role in the SACT space defense exercises. The 2022 National Security Strategy of Japan sets out similar dual-use goals. Speaking at the April 2023 Space Symposium in Colorado Springs, Colorado, Gen. Hiroaki Uchikura, chief of staff of the Japan Air Self-Defense Force, said, “We need to consider conducting mission assurance against various threats, including on private and commercial assets.” Among the Japan-based companies offering space defense capabilities is Astroscale, a pioneer in on-orbit servicing that is working with the U.S. Space Force on a refueling vehicle. At the 2023 Space Symposium, Lt. Gen. Eric Kenny, commander of the Royal Canadian Air Force, highlighted lessons to be learned from Ukraine, saying the Russian internet attack “showcases the potential viewed by adversaries for dual use and the reality that they won’t really distinguish between what is military and what is commercial.” Kenny asked, “How do we get after that and protect that mission set?”
Today, commercial, civil and defense space interests are trying to answer that question on a number of fronts. Agencies from allied nations, for example, are accessing threat data gathered by the Space Information Sharing and Analysis Center, or Space ISAC — a public-private partnership created in 2019 in response to recommendations from a White House space security forum. The center hit the ground running, issuing 577 alerts in 2022, Executive Director Erin Miller said at the SpaceCom 2024 commercial space conference in Orlando, Florida. “That’s a lot of actionable information,” Miller said. About 20 people staff the Space ISAC Watch Center in Colorado Springs, including representatives from USSPACECOM and the intelligence community, as well as Microsoft, defense technology firm Kratos, and Aerospace Corp. A federally funded research and development group, Aerospace Corp. created technology that the Watch Center relies upon — the Space Attack Research and Tactic Analysis matrix, or SPARTA, helping identify and share information on adversaries’ tactics, techniques and procedures. “We’re paying attention to what’s happening physically in space — where are the satellites supposed to be versus where they are — and monitoring for interference and strange behaviors in areas like GPS,” Kevin Coggins, senior advisor with Space ISAC and a NASA administrator, told the Kratos Constellations podcast in October 2023. GPS, operated by the Space Force, is the U.S. system of more than 30 satellites that enables global location and navigation.
Space ISAC membership includes more than 50 U.S. government agencies and 81 companies, and it is working with agencies from countries including Australia, France, Greece, Israel and the U.K. One of the first commercial members from an allied nation was France-based aerospace security consultant CyberInflight. “There’s a lot of pockets around the world where there’s international discussion on security for space,” Miller said. Space ISAC operates the Cyber Vulnerability Lab, in part to help isolate security weaknesses in commonly used space system components. Conducting exercises is key to its work as well, “especially when the threat is so global,” Miller said. The center’s first international tabletop exercise was conducted during April 2024 in Paris, including a scenario featuring a multinational corporation whose parent is in one country, clients in another and ground station in still another. France also hosted its fourth AsterX Military Space Exercise in March 2024, featuring 190 participants from France and 15 partner countries with the U.S. Space Force playing the part of an adversary who threatens communications and other satellites.
Owner-operators in Space ISAC have asked the center for help in learning how to implement another federal initiative aimed at protecting commercial space systems from attack: the Department of Defense Cybersecurity Maturity Model Certification (CMMC) program. “So, if you’re wondering if the commercial space community is taking security seriously, that’s a good sign that they definitely are,” Miller said. Companies must meet baseline security requirements to achieve different levels of CMMC certification and qualify for DOD contract awards. One provision of the program is ensuring a secure supply chain, in part so adversaries cannot insert malware into the parts that make up systems serving military and intelligence customers. As part of the program, the DOD also aims to reach agreements ensuring that foreign companies supporting U.S. warfighters are equipped to safeguard sensitive national security information. The SSC launched a program in 2022 to help protect commercial satellite communications used in DOD systems, called Infrastructure Asset Pre-Assessment (IA-PRE). Commercial assets ranging from single satellites to entire space architectures will undergo review by the SSC’s Commercial Space Office and by designated agents for placement on an approved product list. This listing will be required by the end of 2025 for satellite companies hoping to do business with the military.
Companies that operate space sensors gathering intelligence for the U.S. government also get protection through an information-sharing initiative known as the Commercial Space Protection Tri-Seal Strategic Framework. Created in July 2023, the framework was established by USSPACECOM, the National Geospatial-Intelligence Agency (NGA) and the National Reconnaissance Office (NRO) so that “commercial imagery providers are aware of, and can plan for, the threats caused by a more congested and contested space environment.” In addition, the national Counterintelligence and Security Center provides guidance on resisting foreign intelligence entities, including a pamphlet titled, “Safeguarding the U.S. Defense Industry/Keeping Your Intellectual Property in Orbit.” Among the advice offered: “Identify your ‘crown jewels’ that are key to your company’s competitiveness and develop strategies to prevent or mitigate their loss.” In addition, a small but growing number of satellite owner-operator partners exchange real-time information with the Space Force on critical unplanned space events or other activities through the service’s Commercial Integration Cell.
On another front, the Department of Commerce, through its National Institutes of Standards and Technology, published a 45-page report in July 2023 titled, “Introduction to Cybersecurity for Commercial Satellite Operations.” The report aims to help companies create a cybersecurity program for space operations, in part by providing a cybersecurity framework that consists of five functions: identify, protect, detect, respond and recover.
An additional layer of protection may come in the form of indemnifying commercial providers who contribute to military missions, similar to the government reimbursements afforded to companies whose aircraft or ships suffer damage in support of military reserve fleets. Applying the idea to space is an idea under discussion among military and intelligence leaders, Deputy Defense Secretary Kathleen Hicks told the Intelligence and National Security Summit in September 2022. Still, the fear of attack doesn’t appear to dissuade many potential contractors from seeking to provide the military with space-based services, Bruce McClintock, lead of the Space Enterprise Initiative at the Rand Corp. research group, told Apogee in April 2023. “Most commercial providers, when they do their business case analysis, what they find is they need the U.S. government to establish themselves in the market. And then once they’ve established themselves … provide commercial services. What they find is that their business model requires they have some percentage of their activity through the U.S. government.”
To ensure that commercial providers continue delivering vital services, even under threat, requires the careful crafting of contracts, military leaders have said. Without such assurances, “they’re not something we can rely on in wartime,” Air Force Secretary Frank Kendall told the Air and Space Force Association convention in Maryland during September 2023. Debate over the issue was stoked when SpaceX founder Elon Musk acknowledged he had declined a Ukrainian request to activate Starlink in Crimea, the Russian-occupied peninsula in Ukraine, for an attack on Russia’s fleet there. Musk said he feared the move would constitute complicity in a “major act of war.” Aiding in such an attack did not appear to fall under existing government contracts. Meantime, Starlink has been providing satellite communications throughout Ukrainian-occupied territory since June 2023 under a contract with the DOD.
Conversations about the nature of defense-commercial agreements are happening within the Space Force, its leaders said. “We need to write contracts to ensure service will be available when we need it,” Lt. Gen. DeAnna Burt, deputy chief of space operations with the Space Force, said in a January 2024 interview with the Mitchell Institute for Aerospace Studies. “Combatant commands like SPACECOM will develop a critical asset list, and from there, a defended list of priorities based on capacity and capability to defend. Where do those commercial capabilities fall on that list?” In some cases, a commercial provider might have clients in two countries in conflict. “Some say, ‘Defend me, I’m doing defense work.’ Others have a different view,” Burt said. “Not everyone is going to want to be defended.” In still other cases, a commercial provider may feel part of the military mission. Matt O’Connell, whose Silicon Valley venture capital firm invests in space technology, recalled a family conversation at Thanksgiving when his daughter asked why he was working so hard. “My wife said, ‘Your father believes that he is personally helping to defend Ukraine,’” O’Connell, the operating partner with DCVC, told Constellations in July 2023. “And I believe that we are.”
Should adversaries threaten commercial space assets in time of war, the U.S. would defend those assets, Space Force Gen. B. Chance Saltzman, chief of space operations, told reporters in September 2023. Saltzman was answering questions during the Advanced Maui Optical and Space Surveillance Technologies Conference (AMOS) in Hawaii that were prompted by the Russian threats against Starlink. “There are going to be commercial entities, commercial organizations, commercial capabilities and assets that get caught up in the conflicts,” Saltzman said at AMOS, according to the technology website Ars Technica. “Space is no different than sea lanes. It’s no different than civilian airliner traffic in Europe right now. The U.S. has a long history of saying we’re going to protect the things that we need to be successful. So, it would stand to reason that that same philosophy would extend into space.” Adversaries won’t stop to determine who owns and operates a satellite in time of war, Saltzman told the Air and Space Forces Association Warfare Symposium in March 2023. “In space, you cannot leave the war zone,” he said, and cannot “physically separate civil, commercial, military satellites from one another because the laws that govern orbits are immutable.”
Underlying many of these levels of protection for commercial space interests is “Space Policy Directive 5 — Cybersecurity Principles for Space Systems,” issued by the White House in September 2020. “It is critical,” the directive said, “that cybersecurity measures, including the ability to perform updates and respond to incidents remotely, are integrated into the design of the space vehicle before launch, as most space vehicles in orbit cannot currently be physically accessed. For this reason, integrating cybersecurity into all phases of development and ensuring full life-cycle cybersecurity are critical for space systems.”
Historically, the commercial space industry has developed without the attention to security that is baked into systems created exclusively for military and intelligence use. A satellite contains parts that are numerous and complex, “like the brain,” crowding out features like cybersecurity that were seen in the past as a lower priority, said Kimberly King, senior cyber engineer with the Aerospace Corp., speaking during an August 2023 company podcast. “In the DOD and the IC [intelligence community], you’ll see encryption and authentication,” King said. “However, in industry, it’s pretty much across the board unprotected.” German researchers detailed the tradeoff of security for capability in a study of three commercial satellite systems published in 2023. Small satellites essentially are computer systems with wireless connections to a ground station, so they’re potentially as vulnerable to attacks as any other information platform on Earth, according to the study by Ruhr University Bochum and the CISPA Helmholtz Center for Information Security. But until recent years, operators enjoyed a kind of passive security because access to ground stations was expensive and limited to large satellite operators. Now, products like Microsoft Azure — used by Space ISAC — and Amazon Web Services offer ground stations as a service, lowering the entry barrier.
To help decide when and how quickly an alert should be issued, Space ISAC aims to define in 2024 what constitutes an attack on space assets. Such an incursion can take many forms. “Space Threat Assessment 2023,” from Washington, D.C.-based policy research group the Center for Strategic and International Studies (CSIS), breaks the threats into four broad categories. These are kinetic physical (or motion related), including ground-launched missiles; kinetic non-physical, such as laser interference; electronic, such as spoofing with misdirection signals; and cyber, including seizure of control. The PRC and Russia, along with the U.S. and India, have demonstrated that they can blast satellites with missiles, but the U.S. is enlisting nations in a moratorium on the use or testing of such capabilities. Of more immediate concern, the PRC and Russia “are designing, testing, and demonstrating counterspace weapons to deny, disrupt, or destroy satellites and space services,” according to the Air Force/Space Force report “Competing in Space,” released in early 2024. “They often mask or conceal these activities to avoid international condemnation.” The PRC is developing, testing and fielding capabilities that include many of the threats outlined in the CSIS report. These include a PRC Shijian-21 satellite that docked with a derelict PRC satellite and towed it to a graveyard orbit, and satellites that are testing space maintenance and debris cleanup using a robotic arm. All are theoretically capable of dual use as attack vehicles.
Recent threats from Russia and the PRC make clear that they intend to use these kinds of capabilities. Chinese military academic writings stress the necessity of “destroying, damaging, and interfering with the enemy’s reconnaissance … and communications satellites” to “blind and deafen the enemy,” the “Competing in Space” report says. And Konstantin Vorontsov, a deputy director in the Russian foreign ministry, complained to the United Nations in October 2022 that the use of Western satellites to help Ukraine fight back is “an extremely dangerous trend.” Vorontsov declared, “Quasi-civilian infrastructure may be a legitimate target for a retaliatory strike.” In May 2023, a Russian delegate again lashed out at the West during a meeting of the U.N. Committee on the Peaceful Uses of Outer Space, pointing to a drone attack on Moscow that also disrupted internet access and saying it was carried out through the use of the GPS system. “Those who perpetrated this terrorist attack and in particular those who provided access for the terrorists to the GPS system understand quite well how this will end,” the Russian delegate said. “They’re using civilian satellites … for military purposes.”
Russia had already launched its attack on the Viasat system when these threats were issued. Even before the invasion of Ukraine, the GPS system had been targeted for attack from one side of the globe to the other, Lt. Col. Robert Wray, commander of the Space Force squadron responsible for the system’s operations, told Newsweek in May 2023. Russia jammed GPS signals near its border with Norway during a 2018 military exercise in the area, disrupting civilian navigation, Wray said. And GPS spoofing has been detected in the East China Sea, where the PRC flouts international rulings about sovereign borders. More recently, in February 2024, the threat from Russia made headlines when the White House confirmed the detection of new anti-satellite capabilities with a possible nuclear component.
With its expansion into a national security role, the commercial space industry follows on the heels of operators in other warfighting domains. In an oft-cited analogy, German U-boats targeted cargo vessels delivering supplies from the U.S. to Europe during World War II. “I don’t think this is new, but it has certainly sparked a conversation … about the use of commercial companies — if they are participating in a war scenario, whether they become targets themselves,” Paul Godfrey, then commander of the U.K. Space Command and now air marshal and assistant chief of space operations for U.S. Space Force, said at the 2023 Space Symposium. The war in Ukraine, with the Viasat system targeted by a malware attack and a deluge of false service requests, shows how vital commercial space has become, Lt. Gen. Burt told the symposium. “We saw the Russians attack a commercial capability right out of the gate. Why? Because it’s pivotal to warfighting.” Satellite images from companies such as Maxar Technologies of Colorado helped reveal the Russian military buildup that portended an invasion and put the lie to early Russian claims that bodies lying in the streets of the town of Bucha were killed by Ukraine’s own forces. “Do not underestimate the deterrent effect that had on the Russians, from trying that again,” Godfrey said. COMSPOC Corp., a space observation company based in Pennsylvania, first revealed during early 2022 that the PRC’s Shijian-21 satellite had towed a derelict Beidou position-and-navigation satellite from the much-used geostationary orbit belt some 36,000 kilometers above the equator into a higher graveyard orbit. “This is precisely what I am looking for in new commercial mission partners — information-sharing, provision of state-of-the-world capabilities and design of state-of-the-art capabilities with the rapidly changing competition environment in mind,” James A. Dickinson, now retired and then the Army general commanding USSPACECOM, told an October 2022 space industry conference in Los Angeles.
That top military leaders can even discuss cases like these points to another benefit of involving commercial space in national security: The information that industry generates is largely unclassified and can be shared with the public to reveal an adversary’s hostile intent. “I think the massive advantage here is the fact that these are unclassified images that we can just put out there, the whole time,” Godfrey said. Information gathered through satellites operated by, say, the NRO rates a classified designation and cannot be released publicly. “In the past, there were things that government would be aware of, but they couldn’t share because the sources and methods made it highly classified,” Rand’s McClintock told Apogee. “But now we have commercial providers that have unclassified capabilities nearly as good as, and in some cases better than, (government systems) in terms of their fidelity. And that information can be shared very quickly.”
The U.S. and its allies look to the commercial sector to help provide a host of space defense capabilities: satellite communications; intelligence, surveillance and reconnaissance; space situational awareness; weather; launch services; and in the future, on-orbit refueling, maintenance and even protection. “These capabilities can augment Space Force systems or provide a means to restore a lost or degraded functionality if an adversary successfully attacks a military system,” wrote Mitchell Institute fellow Charles Galbreath in the June 2023 paper, “Building U.S. Space Force Counterspace Capabilities.” The Space Force is buying about $4 billion per year in commercial space capabilities, the paper said. The head of the service’s Commercial Space Office, Col. Richard A. Knisely, praised the industry during the Space Mobility Conference for keeping its eye on the future. “You’re coming up with great ideas that we haven’t even thought of yet,” Knisely said. His office oversees SpaceWERX, the Space Force’s innovation arm; the SSC Front Door, an online portal for companies seeking connection with the acquisition community; and the creation of a Commercial Augmentation Space Reserve to scale up commercial capabilities during time of conflict. The service is also working to streamline the sharing of commercial space data with warfighters, in conjunction with agencies including the DOD’s Defense Innovation Unit (DIU), which fields and scales commercial technology across the military, and with the NGO and the NRO.
“The pluses of leveraging dual-use satellites is it helps, really, any country,” McClintock said. “You expand the capacity, and from a targeting perspective, you also make it difficult for the adversary to defeat your capability.” Technological advancement driven by space commerce makes launching into orbit cheaper and easier, enabling the deployment of more and smaller satellites launched dozens at a time as swarms — some as small as a school lunchbox — into a domain once dominated by expensive, government-owned assets that could be the size of a school bus. “You can now proliferate onto other platforms, and you no longer have just a handful of large lucrative targets,” McClintock said. “You have more than the adversary can target, or you have enough resilience through proliferation, which simply means that you can still accomplish your mission because you have a lot more of something and it’s harder to take it all out.” The need to stay ahead of adversaries in space has led to an “exploit, buy, build” approach within the DOD: Exploit or leverage any existing assets, buy from the commercial space industry when possible, and build only when necessary. Said Burt, “I just buy a contract and own a certain level of service from you, rather than have to own and operate the entire satellite.” This trend toward proliferation has helped tilt the balance in spending on space, Thomas E. Zelibor, then CEO of the Colorado-based advocacy group the Space Foundation, told Apogee in April 2023. Foundation research shows that of the $469 billion spent on space during 2022, 77% was commercial.
Pushing for greater involvement by commercial space interests is the only way the U.S. and its allies will meet the military’s “pacing challenge,” as U.S. Defense Secretary Lloyd J. Austin has called the security threat posed by the PRC, said Douglas Beck, director of the DIU and a senior advisor to Austin. “We simply must find a way to harness the capability of our commercial tech innovation, which is really one of the birthrights of us here as Americans as well as our partners around the world,” Beck told the July 2023 Aspen Security Forum. “We’re just not going to do it otherwise on the time frame we need to.” This involvement represents an evolution from government-forward approaches of the past, he said. “Who ‘we’ are is actually pretty different.” The U.S. and its allies are in a “symbiotic relationship” with commercial space interests, said John E. Shaw, now retired and then the Space Force lieutenant general serving as deputy commander of USSPACECOM, during a July 2023 Mitchell Institute interview. Citing the Russian invasion of Ukraine, Shaw said, “Commercial imagery has made it difficult for malign actors to conceal their activity.” This relationship, though, is a two-way street, he said. “There’s a dependence we have upon them that is part of our broader force set that we bring. But the reverse is also true. Commercial has to consider security now in ways they did not have to before.”