- Sam Visner: Hello.
Dr. Peter Sharfman and I are honored to be able
to give this presentation regarding
the development of cybersecurity norms for space systems.
We're going to try and cover quickly the current
and emerging situation and the threat environment
that is posed to these space systems.
Some alternative approaches that should be useful
in developing norms and our findings and recommendations.
Space systems are expanding in number and mission,
with thousands of new satellites being launched,
sometimes in a year.
Cyber vulnerability,
cyber vulnerabilities can place at risk, these systems,
and just as important,
the infrastructures that depend on them
And this poses a couple of really tough questions.
Can international norms mitigate the threats and risks
to these systems?
And if so, what path should the United States pursue
to the development and implementation of these norms?
The current and emerging situation
is actually pretty significant.
We are seeing a fundamental change based
on the proliferation of, of numbers
and types of space systems.
And already over 3000 satellites are now active
with tens of thousands on the drawing board
or actually being built.
And many of these systems are being developed
and operated by the private sector,
which has shifted the sort of center of gravity
of a lot of space activity from the government
to the private sector.
And disruption, both cyber and physical,
of these space systems can jeopardize our economy,
the safety and wellbeing of our people
and everybody in this country,
who depends on our critical infrastructure.
These systems exist in a trans-national environment
in which a satellite belonging to one country can transit
over the territory of others
and perhaps many other countries.
And the disruption of any space system,
belonging to one country can affect the communication,
the commerce, the navigation and infrastructure
in other countries.
Policy exists,
Space Policy Directive Five of the White House Space Council
says that,
"It is the policy of this country to place emphasis
on the need to improve cyber protections
when developing space systems." ,
which they define as a combination
of ground control network space vehicles,
and use their mission networks
that provide a space-based based service.
But the question is, how to get that done?
The threat environment is, becomes far more significant.
GPS signals can be jammed leading
to their erroneous navigation,
satellites and uplinks can also be jammed,
which denies users access to these systems.
False command and control information can be sent,
allowing attackers to alter satellite dynamics
and take control of them.
And as satellites become more and more a part of
global 5G networks,
the ability of billions of IOT, internet of things,
devices to perform correctly, maybe put at risk,
and these devices will also increase the,
the significant attack surface of space systems.
And we've already seen that Russia has disrupted GPS,
NATO GPS satellites during a 2018 exercise.
And they're working that capability
into their concepts of operation.
Many space systems are subject to,
are vulnerable to cyber-attack
and hacking tools are going to continue to get stronger,
which will make the vulnerability of these systems,
even more of a problem.
Most space systems derive their value from an ability
to communicate with many end users on the ground,
which means that there are many avenues of potential attack.
And we've tried of course,
to develop highly reliable technical solutions
for cyber security, to deter attackers by denial
for terrestrial systems.
And it hasn't really worked, doing it for space systems
is likely to be even harder,
in part because these systems are harder to,
for us to repair being on orbit already.
Let me turn the discussion now over to Dr. Sharfman. Peter?
-Peter Sharfman: Thank you, Sam.
And Sam says hardening and defending the system
is not likely to work,
increasing the resilience of the system
might work in a technical sense,
but doing it sufficiently would be prohibitively expensive,
which leaves manipulating the perceptions
and incentives of potential attackers in such a way
that they will choose not to attack the system.
How you do this?
In the present international environment,
we're not going to get to a situation
in which nobody thinks they have any reason
to attack US space system,
but interdependence, which is strong
has created a situation
in which most potential attackers would themselves suffer
to a degree from the effects of the attack.
And so they would have to weigh that suffering
against any benefits they derive from the attack.
There is also traditional deterrence,
the threat of severe punishment against an attacker.
And finally there is creating and sustaining norms
against cyber-attacks on space systems.
And we find that these last three approaches
reinforce each other.
Interdependence and norms go together.
A norm makes it appear safer
to be dependent on somebody else.
And the fact of interdependence over time,
strengthens norms.
And deterrence and norms are mutually reinforcing,
because it's easier to deter the violation of a norm
than to deter some arbitrary crossing of a red line.
So how to look at norms?
Do we view a cyber-attack on space systems
as a kind of cyber-attack?
or do we view it as a kind of an attack on space system?
or do we view it, as something completely unique in itself?
Well, if we look at it as an extension
of norms on cyber-attacks,
we find a progress on cyber norms has been pretty uneven.
cyber-attacks for the purpose of stealing money,
are widespread cyber-attacks
for disrupting normal functioning of information systems
are infrequent.
US is trying to establish a norm
that you don't attack in a way
that disrupts critical infrastructure.
Several authoritarian governments are trying
to establish a norm that cyber should not be used
to challenge their monopoly on the information
their own citizens receive.
And there does seem to be a strong norm
against cyber-attacks that directly kill people.
We haven't seen and don't expect
to see a cyber-attack on a commercial airline or in flight.
With regard to space, however, there's a very strong norm.
There has never been a publicly acknowledged
cyber-attack against a space system.
But the proliferation of space systems
and cyber-attacks means that this enormous fragile,
which raises the question of how to reinforce?
If extension of norms regarding cyber-attack
is not promising, and the Outer Space Treaty
codifies a norm against kinetic attack on space systems,
the best approach is to extend the previous norm
to cyber-attacks on other countries, space systems.
How? By doing nothing might work,
but we can do better than that.
A public statement of policy that the us believes
that the principles embodied in the Outer Space Treaty
should be understood to include cyber,
based on the fact that when the treaty was ratified in 1967,
no one was thinking about cyber, would strengthen the norm.
Actually amending article 7 of the Outer Space Treaty
to make this explicit, would strengthen the norm even more.
So,
to summarize, a norm is reinforced
by both independence and deterrence,
and we've used such norms as beneficial.
Therefore, what should the US do?
One, strengthen interdependence
by encouraging the operators of commercial space systems
to manage them in a way that clearly benefits
multiple countries, not just the US.
Two, should there be a cyber-attack on US space system?
Respond in a way that will create a great deal of deterrence
in the future.
Three, initiate informal consultations
with the other major space and cyber powers
regarding amending article 7 of the Outer Space Treaty
to explicitly prohibit cyber-attack on space systems.
But if that does not work,
if the consultation show that others are not interested,
then issue a unilateral statement of policy,
that the US believes that cyber-attacks on space systems
are and should be out of that.
Thank you very much.