Why we need increased cybersecurity for space services

While space activities generate multiple benefits for Earth by supporting the United Nations SDGs, providing weather forecasts and innovating to stop climate change, they are also exposed to potential vulnerabilities and security risks that must be managed.

Space communication technology will change the lives of millions of people by enabling connectivity in places not accessible by terrestrial broadband connectivity today. space exploration expected to create $1.2 trillion retail revenues in 2020-2030. The potential of space services has led to an influx of private players into what was once considered a predominantly government-dominated environment.

Traditionally, space and ground systems have been largely isolated from each other, each serving a different set of users and requirements. This pattern has changed in recent years, with systems becoming more complex with greater interconnections between Earth-Space networks. Future generations of smartphones, for example, may well have satellite messaging capabilities for emergency communications where there is no terrestrial connectivity.

Digital transformation has also resulted in the establishment of interfaces between systems and, more importantly, beyond the traditional boundaries of trust (partners, customers, etc.). Additionally, the adoption of large satellite constellations results in the number and complexity of ground control and service support infrastructures, increasing the potential attack surface.

Just as space services are central to modern life, they also support essential services such as military, utilities, aviation and emergency communications. This makes them particularly attractive, especially in times of geopolitical unrest, for cyberattacks whose impact is unpredictable.

In 2022 we have seen that cyberattacks on satellites serving one country could disrupt critical national infrastructure in another. In February 2022, just at the start of the Russian invasion of Ukraine, a large number of satellite modems in Ukraine and elsewhere in Europe were subjected to a cyberattack and disabled, forcing global operator Viasat to perform a hard reset after which it could continue to provide life-saving communications, including to Ukrainian refugees in neighboring Slovakia. In March 2022, SpaceX sent thousands of Starlink Satellite Internet Terminals to Ukraine to allow Ukrainian citizens access to communication.

Historically, the majority of satellites can be considered like curved pipes in space (meaning the uplink signal is received, amplified, translated to a downlink frequency, amplified again and directed to earth using a high gain antenna). They received data from Earth, such as television signals, amplified them, and sent them back to Earth. They are now becoming more complex with the advent of software-defined satellites. Satellites are built to be resilient and robust and can operate in isolation from each other. They are connected to private networks which are not per se accessible from the Internet. The advent of software-defined satellites means that satellites can be reconfigured in space, allowing space services to be adjusted in response to changing demand and to react dynamically to threats as they emerge.

With the influx of new market players, many more satellites are being launched into orbit, especially with large constellations of hundreds or even thousands of satellites. Ignoring ongoing discussions about the sustainability of space, the number of satellites in these networks means that if one satellite is compromised, a new path can be arranged, but at the same time, however, potentially opens the door to take advantage of the satellite network due to their widely deployed terrestrial infrastructure and commonplace spacecraft design.

Satellites play a vital role in communications on Earth and are already an integral, albeit invisible, part of communications networks and systems dependent on position and timing information, such as GPS. In the future, consumer services will move between terrestrial and space systems as technical standards for integrating NTNs with terrestrial networks are implemented. For example, mobile phone signals can seamlessly transition from ground tower signals to satellites without citizens noticing the transition. These technological changes will increase the interdependencies between satellites and technologies on Earth.

In the future, we can be sure that the resilience of critical services on Earth will be more and more closely linked to the resilience of satellites in space. Satellite operators, however, have experience in cybersecurity. They have long been proficient in hardware and network security and have experience in industries with stringent security requirements such as government, military, oil and gas, shipping and finance. Additionally, satellite operators are increasingly using cybersecurity tools and products to provide enhanced security to their key customers, differentiate themselves and create competitive advantage. Some satellite operators are working on new data encryption methods such as QKD which are perfectly suited to the space environment.

The conflict in Ukraine has nonetheless demonstrated that space has been and will continue to be extremely relevant in times of geopolitical conflict. As these trends are likely to continue, we will see new threat actors targeting space systems to impact the critical services made possible by satellites. In this context, how to ensure that the growing interest in space services does not expose society to more cyber vulnerabilities? What can be done to ensure that developments of new space technologies and services are safer?

Discussions between the World Economic Forum’s Global Future Councils on Cybersecurity and Space, held in April 2022, suggest that governments, alongside those who exploit, use and benefit from space-dependent technologies, should identify the critical space services and prioritize ensuring their end-to-end cyber resilience.

Added to this is the complexity introduced by relations with third parties. As satellite service infrastructures become more complex and evolve towards full end-to-end services, they involve more stakeholders operating different parts of the infrastructure. The hardware and software supply chain depends on multiple components, making it difficult to identify responsibility and liability for the ultimate security and resilience of the services provided. Where do the roles and responsibilities of hardware manufacturers, software developers, satellite manufacturers, operators and commercial users begin and end?

Another aspect relates to regulatory frameworks that have not been able to keep pace with technological change. This is a problem for cyber resilience in all sectors, not just in space. Appropriate regulatory frameworks are part of the solution, but these take time to develop, especially if they are to be harmonized internationally, and action is needed now.

In the longer term, clear lines of communication to support information sharing before, during and after cyber incidents should be created to complement the work of the ISAC area (Space Information Sharing and Analysis Center), and to improve the cyber-resilience of space services that depend on satellite networks. This will require collaboration between governments, satellite manufacturers, operators, software developers and service users. Everyone has a role to play, including sharing lessons and experiences from each area. As ground and space systems become increasingly tightly integrated and distinctions blur, a collaborative and informed exchange is needed between what have traditionally been seen as separate domains of cyber threat management.