Space Under Siege: The U.S. Strategy for Safeguarding Commercial Satellites

Satellites are increasingly treated as infrastructure rather than discrete assets. Their functions support navigation, imaging, communication, and early warning.

These capabilities are no longer limited to government payloads. Many are operated by private firms that now serve commercial and defense-related missions.

The rise of dual-use platforms has increased the likelihood that commercial satellites will be targeted during conflicts or geopolitical standoffs.

In response, new detection systems are being developed to give satellites internal awareness of unexpected behavior.

One of these, the Cyber Resilience On-Orbit system, is designed to identify signs of cyber intrusion through telemetry analysis. The project is funded by the U.S. Space Force and is supported by a group of contractors working on both the digital model and the training data.

The development highlights increased attention to the real-world impact of satellite compromise, affecting military operations and civilian systems such as communications and remote sensing.

Why It Matters: A satellite under attack may appear to function normally. Its systems can be altered while still reporting expected data, making it hard to spot a problem. Without an outside way to verify what the satellite is actually doing, operators might not know anything is wrong. Relying on the satellite to report its own status is not always reliable. At the same time, current policies do not clearly state whether commercial operators will get help or compensation if their satellites are targeted. Technical and policy efforts are underway, but they are not moving at the same pace.

• CROO Aims to Identify Behavior that Suggests Intrusion: The Cyber Resilience On-Orbit (CROO) system is software that detects unusual behavior on active satellites. It uses machine learning to analyze real-time telemetry and spot patterns that do not match normal operations. CROO does not rely on alerts from onboard systems. Instead, it checks sensor data to see if the satellite is performing as it should. The project is led by Proof Labs, with support from Big Bear AI and Redwire Space Systems.

• Synthetic Training Data Built from a Model of FireSat: To train the detection model, Big Bear AI built a digital version of the FireSat satellite. They used it to simulate telemetry data under normal conditions and during simulated attacks. The data included reaction wheel speeds, star tracker positions, and sun sensor readings, totaling over 1.2 million rows. Some scenarios involved battery and control system failures to reflect realistic threats. The dataset will be shared publicly to support further research and development.

• System Detects Inconsistencies Between Reported and Actual State: The system is built to catch cases where a satellite has been compromised but still looks normal. This approach is similar to the Stuxnet attack, where equipment kept reporting safe conditions while it was being damaged. CROO compares data from different sensors to see if they match what the satellite should be doing. For example, if orientation seems stable but other data suggests a wheel problem or odd sunlight angles, the system flags it for review.

• Private Satellites Have Become Strategic Targets: The line between commercial and military space systems has blurred. Russia has warned against commercial satellites helping Ukraine, and the 2022 Viasat attack, linked to Russian actors, disrupted service across Europe. These cases show that commercial systems can become targets in conflicts, even if they are not run by the military. This raises the risk for private companies and makes planning a response more difficult.

• Policy Lags Behind Technical Development: Tools like CROO can help detect attacks, but key issues are still unclear. There is no clear policy on when an attack on a commercial satellite should lead to a government response. The U.S. has not said what it would do if these systems were damaged during a larger conflict. Unlike other sectors, there are no war-risk insurance options for satellites. Without clear definitions of hostile actions in space, insurers have not created coverage for these events. As a result, operators face technical and financial risks without guaranteed support.

Go Deeper -> Space Force Building Tools to Detect Cyberattacks on Satellites – Air and Space Forces Magazine

How Can the U.S. Government Safeguard Commercial Satellites from Threats? – Center for Strategic and International Studies