start	end	text
6500	12280	Hello, I'm Pam Melroy and I'm delighted to be here today for Aerospace Village to talk about
12280	18440	cybersecurity lessons learned from human spaceflight. So I'll start out by introducing
18440	29460	myself. I am a retired Air Force test pilot and a NASA astronaut. I flew three times in space
29460	34760	on the space shuttle to the International Space Station. My first two missions I was the pilot
34760	40040	in the right seat. And on my final mission, I was the mission commander of the space shuttle.
40420	46200	Now, all of my missions were to the International Space Station. And this is a picture of what it
46200	52120	looks like now in space orbiting above us at about 400 kilometers. It's an international
52120	58620	laboratory. Now, there's lots of very interesting science that you can do in microgravity
58620	65900	as you're whizzing around in low Earth orbit, experiencing a balancing of all the forces. So
65900	70280	it feels like there's no gravity. You don't feel the effects of gravity, even though they're there.
71980	76260	We discovered we could do a lot of really interesting science on the space shuttle,
76260	82420	like fluid mechanics, combustion, and even studying the human body and biology. But
82420	88280	flying on the shuttle, we only flew about six or seven times a year for about 10 days to two
88280	95480	weeks at a time. And so the United States joined with our partners, Russia, Japan, Canada,
95480	101280	and Europe to build the International Space Station so that we could do science 24-7,
101280	108480	365 days a year. And now, of course, if you look at the space station, you realize it's far too big
108480	113960	to put on the top of a rocket and launch it. We had to bring it up a piece at a time
113960	121680	and build it as we went along. If you look in the upper left-hand corner, you can see Atlantis
122260	129360	from my second flight with part of the truss segment that the solar arrays sit on, filling
129360	135580	up the entire payload bay. So we carried up an element at a time and then using the robotic arm
135580	142040	of the space shuttle and the space station, maneuvered it into position and then bolted
142040	149060	it down. And then we sent spacewalkers outside to make the power, cooling, and data connections.
149060	155720	And then inside the space station, we would activate the element. Now, most of the time,
155720	162780	we actually had to upgrade the software each time that we did that on the ISS because we had new
162780	169380	mass properties, new capabilities. And so it wasn't just activating a new element, it was actually
170260	175520	constantly evolving the International Space Station command and data handling system.
177510	186510	Now, after I left NASA, I went on to a variety of opportunities in industry and government,
186510	193390	including spending a couple of years with the FAA's Office of Commercial Space Transportation,
193390	200070	learning all about space policy and the new emerging commercial space industry.
200070	205510	And I spent four years at DARPA as a deputy of the Tactical Technology Office overseeing the air
205510	211650	and space research portfolio. Space is incredibly important in our daily lives.
212030	218030	The GPS navigation that we have on our phone is just the beginning. Think of all the apps
218030	225750	that use GPS, agriculture, most importantly, financial transactions. When you use an ATM,
225750	231950	the timing signal is set by GPS. We also use space for national security communications
231950	237850	throughout the world. Think about remote sensing of our Earth to study the weather,
237850	242510	be able to predict it, and have other indicators of the health of the Earth.
242510	248710	We've had a very complacent attitude about our satellites because physical access was basically
248710	254770	impossible once the satellite was launched. But now we know that our key infrastructure is at
254770	260530	threat on the ground, and it is in space as well from both physical and cyber threats.
260690	267210	Space systems have always focused on safety and mission assurance because you can't access them,
267210	273270	you can't repair them, and it's expensive to launch things. So we've spent a lot of time
273270	280650	focusing on redundancy and testing and mission assurance. Now we have the commercial world coming
280650	289530	into play, doing things faster and cheaper. And we have the potential for lunar exploration.
289610	295250	And we also have nation-states competing for achievements and resources in space.
295250	300570	So the threat is evolving. We need to understand the implications and prepare for the challenges
300570	305510	ahead. I'm going to talk a little bit about the lessons learned from the software approach to
305510	310970	human spaceflight for both a space shuttle and a space station. But first I'd like to actually
310970	316330	address, so what is the real threat? What could a hacker actually do to a satellite?
316710	322330	Well, the simplest hack, of course, is a denial of service. Pretty straightforward. And it's
322330	329390	actually happening today. Jamming of signal. Sometimes it's inadvertent, just having a
329390	334030	transmitter tuned too loudly so it's drowning other transmitters out. And sometimes it's
334030	342210	completely intentional. You could intercept commands and data. So you could understand what
342210	347390	things the satellite is pointing at, what it's taking pictures of, see that data stream for
347390	355830	yourself, and also intercept communications. There's also the potential for the man-in-the-middle
355830	361310	type of attacks. That's quite a bit harder, actually, with most space systems now, because
361930	366510	you would have to really understand the data stream in order to alter it.
367050	372730	Now, could you do something crazy like send it over to hit another satellite? So if you think
372730	377270	about a self-driving car and hacking that, you could drive it off the road. Well, not really.
377270	382630	Most satellites don't actually carry enough propellant to maneuver over to another satellite.
382630	388570	But what you could do is run the satellite out of fuel. You could shut down a critical system
388570	395510	like cooling or pointing the solar arrays at the sun. Now, there are roughly 5,000 active
395510	401510	satellites in space, but only the International Space Station has humans on board permanently.
401770	406070	So even back in the 70s, when the shuttle was being designed, there was a recognition
406650	412170	that it was going to be different. Lives were going to be at stake. So a much higher level
412170	417530	of attention needed to be paid to software errors that could have catastrophic consequences.
417530	424510	So I'd like to talk about some of the lessons that we can learn from the shuttle and from ISS.
428220	434100	Now, it's kind of easy to make fun of the space shuttle. Yes, this is a picture from my first
434100	441180	flight. And you can see that we interfaced with the shuttle computers using a cathode ray tube
441180	448220	screen. And that's a blow-up of what it looks like. It's black with green letters on it.
448220	456240	Absolutely no graphics processing units or, you know, any kind of artistry at all. It's anything
456240	462600	that you could make with numbers and lines. And that was pretty much it. We also were very limited
462600	468060	in the way that we could communicate. We didn't have a full keyboard the way most computers do.
468060	474560	We had a small hexadecimal keyboard. Now, this actually wasn't that bad. One of the
474560	480240	very clever things that was done with shuttle software was the extensive use of
481280	486800	bundled commands, what I would, in my simplistic mind, think of as a macro.
487540	494840	So there were many, many things that needed to have multiple tasks done, say to configure the
494840	503040	entire vehicle for a different phase of flight or to prepare for another activity. So rather than
503940	511440	throwing switches, which were limited space, or pressing in a number or an action for every
511440	518440	single one, you had the capability to hit item and a number and then execute on a given page,
518440	524400	and it would set off a whole string of bundled commands. So it actually wasn't as bad to
524400	531080	interface with as you might think. Now, here's one of the areas that I really didn't like.
531080	536800	The fault summary. So if something went wrong, this is the page that you went to. And it had
537000	543700	a maximum of 15 faults displayed, which most of the time was pretty okay. But worse, it doesn't
543700	550280	have any scrolling capability. So on my first flight, we had a malfunction. We had an electrical
550280	556760	bus short on a payload bus that provided about one-third of the power to the payload and the
556760	562620	systems aboard the space shuttle. Now, you can imagine when that happened, every bell and whistle
562620	568140	went off inside the space shuttle. And when I went back to look at this fault sum, I didn't have
568140	572920	very many choices. I had to either write everything down, because when I hit reset, it was gone and I
572920	579140	could never see it again. And the messages would stack up and get lost behind each other. So
579140	586100	definitely, you can see some real weaknesses in the interface area. I think that was a real
586100	591660	challenge, I think, but probably very reflective of the capabilities of the 70s.
592500	601900	The Shuttle General Purpose Computer, or GPC, was a marvel. Really, incredibly rugged. So carrying
602360	608660	a whole whopping megabyte of RAM, but very, very rugged. It had to be rugged. It had to withstand
608660	615860	the intense vibration and g's of launch. It also had to be very radiation tolerant, compared to
615860	623080	the laptops that we carried that I'll talk about in a little bit, which had constant cosmic ray
623080	631480	hits and corruption of data, requiring you to reboot them typically once a day. That was not
631480	637340	the case with the GPC. It was very, very rugged, and it was meant to be radiation tolerant. It was
637340	646980	also highly efficient. Only 400,000 lines of code to operate the entire space shuttle. Pretty
646980	653920	amazing, actually, that we could do that. Part of the reason for that is that code in space has
653920	661340	weight implications. That's right. If you're doing more computations, you need more power and more
661340	669340	cooling, which is more mass and more volume. And so efficiency in software is incredibly important
669340	676200	in space, and the space shuttle definitely reflected that. One of the cool things about the
676200	684740	space shuttle software was it had a very, very low error rate. So I'm showing here a table from
684920	691120	a great paper that's got the link at the bottom, reflective of the space shuttle
691120	698120	software history. If you look back to the right-hand side there, the total error rate per
698120	708700	case lock in 1981 was about eight to nine. That's pretty darn good. And within seven years,
708700	714720	it was consistently down around one, which is an order of magnitude better than commercial
714720	720400	software. Some would say two orders of magnitude, depending on the software. And you can see that
720400	726800	by the time we got close to the end of the space shuttle, flying the space shuttle, we had gotten
726800	737100	the error rates in our new updates down to zero. Now, how in the world did we do this? Well, we kind
737100	745220	of had to brute force it, right? It was a lot of verification and testing. So each space shuttle
745220	752980	mission had unique software on it. Now, there was the core software, which was the same, but it was
752980	758600	actually a unique software load because you had a different payload. You had different mass
758600	762580	properties. Maybe you were going to the space station, or maybe you were going to a different
762580	770100	inclination. So for each shuttle mission, months were spent on that unique software load doing
770100	777440	verification in SAIL, the Shuttle Avionics Integration Laboratory. And the idea behind
777440	782160	that is you would have crews and engineers who would run through tons and tons of scenarios,
782160	789420	lots of procedures, to verify that there were no unwanted changes to the software.
789420	796200	This is pretty amazing, considering that there were no auto debugging capabilities at that time.
796200	802860	So it was very manual intensive, but it does show that it is possible to get very, very low error
802860	808700	rates. One of the other interesting things about the shuttle software program was that
808700	817100	not only was verification very intense, but if a bug or an error was found,
817100	825440	the program would go back and take a look at what process escape allowed that bug to slip through.
825680	832280	So in addition to just checking the software, they were also looking at the entire coding process
832280	838400	to go back and see if they could trap any other bugs that were from the same process escape,
838400	843980	and plug that process escape so that future bugs would not be introduced to the system.
845140	851580	Another aspect of the Space Shuttle that was really interesting and added to the resiliency of
851580	859000	the system was the flexible redundancy in the software systems put into the general purpose
859000	866480	computers. So we carried five GPCs aboard the Space Shuttle. Four of them were loaded with
866480	873360	the primary avionics software system, known as PASS, and one computer was loaded with backup
873360	881880	flight software, or BFS. That software was developed completely independently. It was a
881880	887240	separate company, a separate group of people, there was no interaction or interfacing between them.
887240	894520	That backup flight software was there to protect in case there was a flaw in the primary avionics
894520	901080	software system that affected the four primary computers that were used. Now, backup flight
901080	908200	software didn't have all the same capability as PASS. It had basically what you needed to
908200	915380	complete an ascent and get to orbit safely, or if you had a problem occur on entry, to get down to
915380	924960	the ground. So on ascent and entry, we flew with four computers running in parallel with each other
924960	933120	and the backup ready to go. And if there were any failures that you lost confidence in either the
933120	939780	software or the GPCs, the crew could press a red button on the stick and instantly jump over to the
939780	946680	backup flight software and then get into a safe place with that software. Any computer could take
946680	953500	any of that software. If you got on orbit and realized that the BFS computer that had BFS
953500	961920	loaded into it had a hardware problem, that was fine. You could load BFS for entry into any one of
961920	970300	the other GPCs. The mass memory unit on board had several copies of both sets of software.
970880	978720	So if you found an error in the software, maybe there was a coding problem or a corruption,
978720	985100	in one of the GPCs you could reload the software from the mass memory unit and you had actually
985100	991100	several copies to select from in case again somewhere on the mass memory unit
991100	997140	there was a corruption or a failure. Incredibly flexible, incredibly redundant.
998940	1005440	The other key aspect that I think had a very positive impact on resiliency but also on security
1005440	1010500	is a distributed architecture and the space shuttle was one of the first vehicles
1010500	1016180	to use this capability. So the idea is that you separate critical functions
1016180	1022300	and then you're very careful and limit what information is allowed to pass between them
1022300	1029640	and there are checks to make sure that you protect that. So on orbit we would
1029640	1039400	shut down three of the GPCs into basically into a warm mode and so that we could restart them
1039400	1044240	if we needed to. We had one actually was warm as a warm backup and the other two were shut down
1044240	1050240	completely. And then in one computer we had guidance, navigation, and control. Very critical
1050240	1057020	software controlling the vehicle, knowing where its navigation state was, knowing where you were
1057020	1062900	pointed, all very very critical aspects of operating the vehicle. And then in another
1062900	1069720	computer we loaded systems management software or SM software and that had critical functions
1069720	1075840	having to do with the systems but the communications between these were very tightly structured.
1077320	1083840	Well we found pretty quickly that three CRTs was not enough information for the crew especially as
1083840	1090840	our missions began to get more complex on in the shuttle program. And so we added a third tier
1090840	1100020	to the distributed architecture, a payload general support computer or PGSC. And that's a picture of
1100020	1107500	the IBM ThinkPad that I flew on my missions as a PGSC. Each crew would carry somewhere between
1107500	1114840	five and seven PGSCs. They performed functions like a world map so that you could just glance
1114840	1120160	at the map and know exactly where over the earth you were. You could see critical things like if
1120160	1125500	there was a loss of communications coming up, a comm outage, or something like that. But we used
1125500	1131220	them heavily for mission support. In the bottom left picture is me and my friend Koichi Wakata
1131220	1139040	had just completed a very complex robotics operation using the two PGSCs mounted behind us.
1139040	1143200	Of course in microgravity it was pretty easy to mount those anywhere that you wanted to. They just
1143780	1152840	would stick with a little bit of velcro on a platform. And those PGSCs would take data from
1152840	1159560	the GNC and the SM computers but could not send anything back. So it was a one-way flow of data
1159560	1166980	from the GNC computer or the SM computer to the PGSC. Now in the bottom right hand corner you see
1167280	1174400	a picture of the Rendezvous and Proximity Operations Program, or RPOP, which is an app that we used
1174400	1181280	to visualize the orbital mechanics between the shuttle and the station. And that picture was
1181280	1188400	taken shortly after I docked to the space station showing my approach, my line of approach.
1188400	1198800	Now we also used these laptops for email, but the email wasn't directly connected. In fact,
1198800	1204660	what would happen is the ground would sync up our mail three times a day. So you know,
1204660	1210020	three times a day we'd get a message from the ground, basically mail call, and you know,
1210020	1215860	everybody would scramble for a computer to check their email. We could do that because we were
1215860	1221420	only in space about 10 days to two weeks at a time. We also used it for file sharing and other
1221420	1227220	things like that. The PGSCs were absolutely essential, but they were also very isolated
1227220	1236020	and very protected. Now this is a pretty happy story about the overall security of the shuttle
1236020	1241540	software system and how we approached it, but that doesn't mean that we didn't have unanticipated
1241540	1250140	issues, almost all of them resulting from complexity. So we used for many, many years
1250140	1257740	on the space shuttle, inertial navigation units were the primary form of maintaining the navigation
1257740	1264200	state, you know, where are you in space? And the ground could uplink information from a radar pass
1264200	1269940	or something that gave us more precise information. But when the opportunity came to integrate a GPS
1269940	1276660	receiver, when they started to become lightweight enough and ubiquitous enough, that was a great
1276660	1283020	opportunity because we were doing highly precise navigation maneuvers like rendezvousing with the
1283020	1290100	space station. Now the first time we tested it was on STS-91 and of course we were smart enough
1290100	1296780	not to make the GPS receiver be the only generation of the nav state. In fact, we disconnected
1297550	1304980	the GPS receiver from the primary nav state of the GNC computer. So we didn't want to influence or
1304980	1311300	upset that, but we wanted to monitor it. So there was an aiding state, basically a secondary state
1311300	1317140	that the GPS receiver would periodically update. And that way we could sort of measure and see what
1317140	1323600	the nav state would look like if the GPS receiver was updating it. Well, we had a little hiccup.
1323600	1329480	The GPS receiver had a software anomaly and basically went into a control-alt-delete type
1329480	1337000	reboot situation. And unfortunately, at exactly the same time, the GNC computer sent a message
1337000	1343640	to the GPS receiver asking for an update to the aiding state. Well, the GPS receiver never saw it.
1343640	1353880	When it came back up on board, it was not a flag that was set. And so as far as the GPS
1353880	1358140	receiver was concerned, it had never been asked for the information and never provided it.
1358140	1364860	So the GNC computer at that point said, uh-oh, GPS receiver is down. So stopped asking for updates
1364860	1372100	from the GPS receiver. Now that aiding state began to degrade, right? You're propagating a navigation
1372100	1379440	state without putting any corrections in. And sooner or later, the numbers started to go pretty
1379440	1386240	funky and math errors began to be generated. No problem, right? No problem. I told you already,
1386240	1391720	very limited information flows between the GNC computer and the systems management computer.
1391720	1397540	Everything should be just fine. Well, there are two very important things that are communicated
1397540	1404040	between the GNC computer and SM. The first one is the nav state. So the systems management
1404040	1410540	computer knows where to point the antenna to talk to the ground. Unfortunately, when those math
1410540	1418600	errors started to generate, the other type of information came into play, which is error codes.
1418600	1424660	Of course, the systems management computer wants to know if there's a problem on the GNC computer.
1424660	1431660	Well, the intercomputer communication bus got flooded with these math errors, which essentially
1431660	1438600	choked out passing the nav state. So the systems management computer did not receive any updated
1438600	1447140	shuttle state vectors. And eventually, this antenna lost lock with the satellite that linked
1447140	1452700	it to the ground. And one of the most serious problems that can happen in space is a loss of
1452700	1459360	communications. And it happened while the crew was asleep. Well, MCC to the rescue, mission control
1459860	1469140	was able to actually get in and figure out how to manually... they eventually got a lock
1469140	1475020	over a ground station. They sent a command to manually point the antenna at the TDRS satellite
1475580	1481960	and then were able to fix the problem. But it just points out that
1482660	1488460	it was really incredibly resilient and they thought through as many
1488460	1492820	errors as they could. But in a complex system like this, you can still have problems.
1493700	1499580	Now, we learned a lot for the International Space Station. I'd like to say we really upped our game.
1499880	1504840	We learned a lot about security, starting all the way with the ground system.
1504840	1511280	Even back in the Apollo days, there was not the capability to talk straight from Houston up to
1511280	1517840	the spacecraft. But instead, a large set of antennas in White Sands, New Mexico, talking
1517840	1523840	to the tracking and data relay satellite, which then communicates low data rate S-band audio
1523840	1530600	information and high data rate KU-band video and payload data. This entire network is completely
1530600	1539380	owned by NASA. So this is not going through open internet. There's no cloud. This is completely
1539380	1545980	controlled to NASA. And of course, it's been updated. So just another aspect of the security.
1548060	1553100	Another interesting issue was around mission control commanding.
1553100	1557100	Now, people weren't really thinking about hacking, but what they were thinking about
1557100	1563320	is making mistakes. So an innocent mistake could send a bad command. Now, that was true for the
1563320	1569640	space shuttle, too. But we had fewer controllers for the space shuttle, all hands on deck,
1569640	1574560	the six times a year or seven times a year that the shuttle was flying. So a high level of
1574560	1580220	proficiency in a very small pool of people. Well, with the International Space Station
1580220	1590620	operating 365 days a year and 24-7, we needed a lot more controllers. So there's a very rigorous
1590620	1597940	certification process required for controllers in the International Space Station Mission Control
1597940	1604800	Center to allow them to send commands to the space station. In addition, there are screening
1604800	1612640	protocols, both before it ever leaves MCC, going up to the ISS, and once it's on board ISS,
1612640	1620100	to check and make sure that that command will not inadvertently do some damage to the station.
1620240	1627100	And so, again, really all of these characteristics were really there for safety,
1627100	1632560	but they have the added capability of adding to the cybersecurity as well.
1633520	1639460	Now, distributed architecture. This is at a whole new level on the space station.
1639460	1646160	So starting with the command and control computers, multiplexer, demultiplexer, or MDMs, there's three
1646160	1655460	command and control MDMs that control the station. And just like the GNC and the SM computers on the
1655460	1663100	shuttle, in this case, there are multiple separate payload and ISS element MDMs to control the
1663100	1669340	system. So highly distributed in that regard. And again, with very strict rules about bus traffic
1669340	1675900	between them. Now, the crew on board the space station does not have cathode ray tubes, I'm very
1675900	1682200	happy to report. Instead, they use a laptop called the portable computer system. I apologize for all
1682200	1689000	the acronyms. This is what NASA does, though. Anyway, the PCS is used for the crew to send
1689000	1696980	commands to the ISS MDMs. It's essentially a remote terminal. It plugs in. They are not networked to
1696980	1704440	each other. They are plugged directly into the station and can send commands. Now, they have the
1704440	1710600	same issues that we did on the space shuttle, wanting more screens, more apps, more capability.
1710600	1717760	And so there is an ops LAN. It is a local area network using station support computers.
1719080	1726600	These computers are used for procedures, email, and everything else. Including Twitter. Now, you
1726600	1732680	may be wondering, because I told you on the space shuttle, we didn't have real-time access to the
1732680	1739160	internet. Well, that's a real hardship on the space station, if you stop and think about that for a
1739160	1744940	moment. Because there are people living up there for six months. And, I mean, just even really
1744940	1749040	simple things. Like, if you were up there for six months, and maybe you wanted to go on the
1749040	1754800	internet and buy your husband a birthday present. And lots and lots of other things. So, and of
1754800	1762480	course, the onset of Twitter, which astronauts have embraced completely. So, it took a fair
1762480	1768020	amount of work to set up the cyber security. Because that was already a consideration even by
1768020	1773740	then. So, there's a computer inside the firewall at the Johnson Space Center that is the proxy
1773740	1779740	computer. So, the space station support computers talk to the proxy computer, which then goes out
1779740	1786260	onto the internet. Now, of course, just like any computer, it's still subject, potentially,
1786260	1792760	to malware. But the most important thing is the station support computers, in no way, shape,
1792760	1799700	or form, are networked to the actual commanding of the station. They're completely separate systems,
1799700	1806640	and they don't talk to each other. And so, a hacker might be able to get at, with great
1806640	1811700	difficulty, but might be able to get at somebody's email on board the space station. But they
1811700	1818200	couldn't take over controlling the station. Sort of the ultimate in a distributed architecture.
1818760	1823880	So, the use of computers is so important on the International Space Station. I just want to show
1823880	1830380	an example, actually, of how they're used operationally. And this is a picture from
1830380	1836060	my third flight in space, where we had a lot of important robotics operations. So, in the center
1836060	1843820	of the screen, you will see three videos. And then, underneath the one on the left, and on the right,
1843820	1850580	are two hand controllers. They control the robotic arm of the space station. So, that's how you move
1850580	1858660	the arms with those hand controllers. Now, I talked about the PCS, which does command, and it actually
1858660	1864940	can send commands to the big arm. Turn it on, turn it off, switch power sources, and so forth. And so,
1864940	1871060	the PCS on the right was set up for ISS commands. And then, there's a backup PCS set up in the
1871060	1879680	middle. It enables you to quickly, if there's a hardware or software failure on the primary PCS,
1879680	1885220	you could go to the backup PCS very quickly. And in addition, it allows you to monitor other
1885220	1892040	critical systems that interact with the robotic arm. And then, the other three computers, the two
1892040	1897720	above and the one to the left, are part of the OPSLAN. They're station support computers. They
1897720	1903380	provide extra camera views, procedures, file sharing, etc., etc.
1905800	1913060	Now, areas of concern in space systems for me. I'd like to shift gears a little bit and say,
1913060	1919980	this is what I see out there that is worrying me. First of all, uplink and downlink to most
1919980	1929980	satellites is encrypted, but the data on the bus itself is not. So, of course, it's easy to say,
1929980	1935980	well, there's no way to access it. It's just out there. It's in space. But in fact, I think it is
1935980	1940760	an area of concern. It's something that we should be thinking about encrypting onboard traffic as
1940760	1946300	well. Ground system vulnerabilities is probably the one place that if you're talking to a space
1946300	1952520	person, they will acknowledge there is a cyber risk. Our ground systems are very vulnerable.
1952520	1960160	They're just as vulnerable as any enterprise computer, as part of any enterprise IT system.
1960320	1966640	Something interesting, particularly in DoD, is that all of the constellations and all of the
1966640	1972840	satellites, most of them have completely unique ground systems. Now, DoD is moving away from that.
1972840	1977940	They're having a common ground system going forward. But what that means is that they're all different.
1977940	1984040	Now, the good news is, well, if you figured out an exploit in one, it wouldn't necessarily work
1984040	1990220	on another one. But the flip side to that, from an enterprise IT management standpoint, is
1990220	1997660	configuration management, patching, and so forth, is a nightmare. So, that is a real concern.
1997660	2005760	And fortunately, it's being addressed in DoD. Edge computing. Well, the challenge
2006460	2011960	there is, you know, I had talked a little earlier about how man-in-the-middle attacks are kind of
2011960	2017680	hard on satellites, because real-time, you have to see the data stream and then figure out what
2017680	2026120	you want to inject into it. Well, edge computing is becoming increasingly important. Now, I mentioned
2026120	2032180	the fact that in the past, it's been minimized to do computations on board. There was really
2032180	2038640	just enough code and just enough hardware to run the satellite, run its payload, and then
2038640	2044880	communicate all the data to the ground. And that's, as I said, because it had weight implications.
2044920	2051240	Well, with the advent of Moore's Law, satellites are becoming smaller and more efficient because
2051240	2057240	their electronics are more efficient. So, one of the challenges in low-Earth orbit is, as you whiz
2057240	2063400	around the Earth every 90 minutes, you really can only downlink your information when you happen to
2063400	2069100	be within sight of a ground station. And any one ground station, you're only in sight of between
2069100	2074740	5 and 10 minutes. So, you could take a picture, but you might actually end up waiting a half an
2074740	2082260	hour before you can downlink it. Well, that's actually a challenge if you've got very short
2082260	2087800	periods of time to get a lot of data down. And so, increasingly, we're moving into a place where
2087800	2095040	there's more and more computation moving on board and really getting high-quality edge computing so
2095040	2101680	that you can do all the data management, and that minimizes the amount of information that you have
2101680	2107620	to downlink. I'm just going to send you a notification that something has occurred, or I'll send you a
2107620	2113140	highly processed picture of what you're most interested in instead of a giant data stream.
2113140	2119000	Well, that is also going to make it a lot easier for man-in-the-middle attacks.
2119000	2127140	Finally, the most serious problem I think we have in aerospace is complacency. As I said,
2127820	2134640	many people in space think that their systems are not vulnerable to cyber. We have an attitude in
2134640	2140580	aerospace. It's part of our culture and our values to think about safety. Safety is integral from
2140580	2148880	design to test and verification and operations. We just think that way. We are going to have to
2148880	2155640	figure out how to insert cybersecurity and an awareness of that into the values and the culture
2155640	2162160	of aerospace, all the way from the beginning in design and all the way through to operations.
2162160	2168780	I really think we are going to need to do that. Now, fortunately, there's some exciting work being
2168780	2175840	done on cyber-physical systems. One of my favorite demonstrations was in the Information Innovation
2175840	2183980	Office, or I2O, at DARPA when I was there. It's the DARPA High Assurance Cyber Military Systems
2183980	2191100	Program, or HACMS. So the picture you see there is an optionally crewed helicopter called Little
2191100	2199100	Bird, built by Boeing. Now, the HACMS program gave a group of hackers access to the flight data
2199100	2205260	recorder. And within 30 minutes, they had hacked their way into critical systems on the Little
2205260	2213140	Bird, which really surprised everyone. So the HACMS program funded several performers to develop
2214040	2221240	security capability and a secure kernel. So I'm not a software person, but to me, a secure kernel
2221800	2226580	is very much like the distributed architecture that I talked about for the shuttle and station.
2226580	2233160	You have a separation of critical functions, and then you have a high level of restrictions about
2233160	2238840	what information and checks that go on for information that flows in and out of that
2238840	2246360	critical area. This secure kernel was loaded into Little Bird. Those same hackers were given
2246360	2251740	access in the same way, and all they could do was shut down the flight data recorder,
2251740	2260240	not very important, and point the camera. So it is possible to develop secure cyber physical
2260240	2267160	systems. Now, the HACMS program is over, but the System Security Integrated Through Hardware and
2267160	2273640	Firmware program, or SIF, is still active. And those of you who were at DEF CON last year
2273640	2282180	may remember that DARPA, through the SIF program, brought a voting box, a voting computer,
2282540	2290540	to DEF CON to work on the vulnerabilities and challenges of how to protect that hardware system
2290540	2296560	from software exploits. So I have high hopes. There's a lot of really good work going on.
2296560	2304080	I would like to see these best practices and these technologies proliferate into space.
2305440	2310200	So a lot of interesting trends in space that are going to have an impact on this.
2310780	2317260	Some of you may be familiar with some of these proliferated low-earth orbit, or PLEO, constellations
2317260	2324060	like Starlink or OneWeb. Now, I talked about low-earth orbit and having to wait until you
2324060	2330420	came over a ground station. Well, the idea here is to have enough satellites which are also
2330420	2337380	connected through cross-links, through a mesh network, such that if one satellite takes a
2337380	2343400	picture, it can send the information through the mesh network to another satellite that's over a
2343400	2350980	ground station. And so this would greatly increase the persistence and, in fact, make
2351960	2357060	data ubiquitous at any time. Now, there's some real challenges with mesh networking.
2358800	2365560	So the Space Defense Agency is working on that right now. I think you're going to see a lot
2365560	2371120	more of these cross-links and these mesh networks, which, of course, will increase the attack vectors
2371120	2379040	as well. NASA's working on going to the Moon and on to Mars. Their Moon-to-Mars program
2379760	2386080	is a program that, just like the Space Station, they've reached out to international partners. So
2386080	2392880	far, Europe, Japan, Canada, and Australia have all expressed interest in joining in going to the Moon
2392880	2399900	to prepare and develop the technologies that will allow us to go on to Mars. And there will be an
2399900	2406780	orbiting logistics platform called Gateway in lunar orbit. And then, not too different from
2406780	2413480	the International Space Station, a Moon village made up of different elements that different
2413480	2419630	countries have doing whatever science they're most interested in, but having shared infrastructure.
2421900	2427440	As we push out into the solar system, we're going to need a lot more logistics hubs.
2427440	2434320	So the most efficient way to get from point A to point B in space is through careful transfers
2434320	2441440	of orbits. Low Earth orbit to geosynchronous orbit. Geosynchronous orbit to lunar orbit.
2441440	2449240	Geosynchronous orbit to Mars orbit. And you're going to see these logistics hubs that allow us
2449240	2459440	to refuel or even build new satellites, store and supply logistics, and transfer not just
2460320	2465820	data, but also goods and supplies out into the solar system.
2466540	2472100	NASA's already thinking about solar system internet, but there's a big challenge with that.
2472620	2480280	Communications is done through RF. And what that means is it's prone to blockouts and fading. Now,
2480280	2487180	the way internet protocol works today is a packet that cannot show that it has connection all the
2487180	2492940	way to its destination never gets sent. Well, you can't have that in space because you're going to
2492940	2498580	have these blockages, this fading of signal periodically. So NASA has been working on
2498580	2507720	delay-tolerant networking that allows data to be cached as it pushes out. And so that way,
2507720	2513560	if there is a loss of signal, that's fine. It can tolerate microseconds up to seconds
2513560	2520540	and then pass along the information once the network is re-established. Interestingly,
2520540	2526360	this has implications as well. DARPA has also been working on it for disruption-tolerant
2526360	2534700	networking, and that's more for emergencies, disasters, humanitarian disasters, and things
2534700	2540380	like that where there's not a consistent capability for the internet. And so
2541900	2548200	delay or disruption-tolerant networking is going to be incredibly important as we develop
2548460	2558260	a solar system internet. So I just want to say how wonderful it is to be here,
2558260	2563660	and thanks for inviting me to participate at the Aerospace Village. I'm very excited about
2563660	2569520	HACCASAT. I think it's a really great idea. It's a way to get insight into what the actual
2569520	2575700	vulnerabilities are, just like we did the demonstration for HACCAMS. But it's important
2575700	2582760	to remember that the implications for space cybersecurity are huge. Even today, I talked
2582760	2589740	about how much of our economy depends on GPS, weather, and so many other pieces of data that
2589740	2596000	we get from space. But there are bigger implications as we build out a solar system internet.
2596000	2603080	We're really going to have the opportunity to completely think this through again and go on to
2603080	2609580	internet 2.0 technologies, like delay-tolerant networking, and build in security from the
2609580	2617560	beginning, which is something that we didn't do with internet 1.0. So I'm hopeful that someone
2617560	2624400	out there that's listening today will have some ideas about how to build a more secure
2624400	2630080	internet for the solar system. And I'm just going to ask you to get cracking on that. Thank you.