1
00:00:05,790 --> 00:00:07,670
Hi, I'm James Pavore.

2
00:00:07,670 --> 00:00:12,510
I'm a PhD student at Oxford University, where I research satellite cybersecurity.

3
00:00:12,950 --> 00:00:18,390
And today, I want to talk about something called Space Situational Awareness, or SSA.

4
00:00:18,570 --> 00:00:25,610
SSA is a type of data that we use to solve a problem, which is that space is getting crowded.

5
00:00:25,710 --> 00:00:33,290
Today, there are tens of thousands of satellites and pieces of debris and other objects in orbit that will whiz over your head every hour.

6
00:00:33,290 --> 00:00:46,110
And as space gets more congested over the next decade, the number of objects is going to increase dramatically, with the addition of constellations like OneWeb, Blue Origin, and Starlink changing the way we think about low Earth orbit.

7
00:00:46,350 --> 00:00:53,410
As we put more satellites up there, the biggest challenge will be dealing with the increasing risk of space debris collisions.

8
00:00:53,570 --> 00:01:01,790
Space debris are just like bits of metal or rocket fragments or other things that fall off of the satellite during operations or as part of a space mission.

9
00:01:01,930 --> 00:01:03,910
And they move at orbital velocities.

10
00:01:03,910 --> 00:01:10,270
So if they collide with the satellite, they can cause it to break or even disintegrate, depending on the size of the collision.

11
00:01:10,570 --> 00:01:20,830
And it's the second case that can lead to something that we call a cascade effect, whereby a piece of debris crashes into a satellite, which creates more debris, which crash into more satellites.

12
00:01:20,970 --> 00:01:32,670
And the worst case scenario, when space is as crowded as it's going to be in the next decade, a debris cascade can severely constrain our access to either a particular orbit or even the space as a whole.

13
00:01:33,090 --> 00:01:35,110
And that debris is not going anywhere.

14
00:01:35,130 --> 00:01:40,610
It can remain in orbit as a threat to satellites for decades or centuries, depending on where it is.

15
00:01:41,170 --> 00:01:44,990
So to deal with this, we use space situational awareness data.

16
00:01:44,990 --> 00:01:47,530
I'll talk about how that works and who gets it.

17
00:01:47,530 --> 00:01:54,490
And then I'll talk about why a cyber attacker might target this critical data as a route to cause harm to specific satellites in orbit.

18
00:01:54,490 --> 00:02:00,010
We'll run through a scenario where we actually kind of play through one of these attacks in orbital simulations.

19
00:02:00,210 --> 00:02:09,110
And then I'll close by discussing mitigations that both industry players and governments can use to protect and bring more trust into the SSA environment.

20
00:02:09,810 --> 00:02:13,390
So SSA as a concept is very simple at its core.

21
00:02:13,390 --> 00:02:21,990
It's just understanding what's out there, whether that's a satellite or a piece of debris or even a comet or an asteroid, depending on how you define it.

22
00:02:21,990 --> 00:02:25,870
It's essentially a catalog of everything in space and where it's going.

23
00:02:26,010 --> 00:02:40,770
And we use SSA in every step of a satellite mission, from the moment that we decide which orbit that we're going to launch our satellite into, to the moment we retire our satellite into a graveyard orbit and try to avoid crashing into other satellites when we turn it off.

24
00:02:41,030 --> 00:02:46,670
And two particularly important uses of SSA are conjunction analysis and intelligence purposes.

25
00:02:46,710 --> 00:02:53,070
You use SSA to figure out when your satellite is going to collide with a piece of debris so that you can steer it around it.

26
00:02:53,070 --> 00:02:56,230
And this is not trivial because pieces of debris move.

27
00:02:56,230 --> 00:02:59,730
They're affected by friction or collisions with other pieces of debris.

28
00:02:59,730 --> 00:03:05,050
So you need to constantly be updating your catalog so you know when you need to steer your satellite and where.

29
00:03:05,310 --> 00:03:07,830
Additionally, I mentioned intelligence purposes.

30
00:03:07,930 --> 00:03:16,750
SSA is really useful if you want to know if your adversaries are, say, launching a spy satellite that overpasses your territory or testing anti-satellite weapons.

31
00:03:16,810 --> 00:03:21,650
So it's perhaps unsurprising that the dominant source of SSA data today is the U.S.

32
00:03:21,650 --> 00:03:25,490
military, which operates the Space Surveillance Network, or SSN.

33
00:03:25,970 --> 00:03:37,110
The SSN consists of a bunch of ground stations around the world with either radar systems or electro-optical telescopes and even some satellites in orbit that are constantly scanning the sky for space debris.

34
00:03:37,110 --> 00:03:48,570
The reason this is distributed across the globe is because to get a good catalog of space situational awareness data, you need multiple observations of an object from multiple different vantage points in different parts of the planet.

35
00:03:48,870 --> 00:03:49,710
And the U.S.

36
00:03:49,710 --> 00:03:52,430
military gets a huge advantage from this investment.

37
00:03:52,430 --> 00:04:01,470
They're likely the only entity in the world who have access to ground-truth information describing debris objects measuring 10 centimeters in diameter or even smaller.

38
00:04:01,530 --> 00:04:04,410
However, this edge does not come cheap.

39
00:04:04,470 --> 00:04:06,270
We don't know exactly how much the U.S.

40
00:04:06,270 --> 00:04:13,270
military spends in the Space Surveillance Network, but we know that the most recent upgrade to the system exceeded six billion dollars.

41
00:04:13,270 --> 00:04:18,050
And then in fiscal year 2015 alone, they spent 1.6 billion dollars on procurement.

42
00:04:18,090 --> 00:04:21,110
This is all to say that this is not a trivial effort.

43
00:04:21,110 --> 00:04:25,350
This is not picking up a telescope at Walmart and looking for pieces of space debris.

44
00:04:25,390 --> 00:04:32,830
This is a very complicated technological endeavor that is beyond the means of even most nation-states to pull off.

45
00:04:33,230 --> 00:04:39,330
The next most sophisticated SSA capability is probably Russia's through the Russian Space Surveillance System.

46
00:04:39,330 --> 00:04:48,030
We don't know quite as much about like what kind of objects they can see or what size, but we do have a sense of the network's capabilities because we know where the ground stations are.

47
00:04:48,030 --> 00:04:54,470
And they're primarily in former Soviet territories or countries that were friendly with the USSR prior to its collapse.

48
00:04:54,470 --> 00:04:59,050
This makes sense as a lot of the groundwork was kind of laid for the system during the Soviet Union.

49
00:04:59,050 --> 00:05:03,670
But in recent years, Russia has expressed skepticism in third-party data from like the U.S.

50
00:05:03,670 --> 00:05:16,470
military and has been shoring up their own internal capabilities, including through the launch of satellites like this one, which was widely expected to be a space surveillance system, although the Russian military has not confirmed this.

51
00:05:16,730 --> 00:05:25,710
One other thing I just want to note while we're talking about Russian space situational awareness, there is a civilian network that is ostensibly a collaboration between scientists and universities.

52
00:05:25,910 --> 00:05:38,370
It's not super active today, and depending on who you ask, it's like deeply tied to the Russian Academy of Sciences and kind of the Russia's civil military apparatus for space power, or it's entirely independent.

53
00:05:38,570 --> 00:05:45,910
In either case, it's at least worth noting that there are some civilian efforts to get space situational awareness data, as well as military efforts associated with Russia.

54
00:05:46,510 --> 00:05:49,690
The final network I want to talk about is China's.

55
00:05:49,690 --> 00:05:53,510
They run a system through their PLA Strategic Support Force unit.

56
00:05:53,710 --> 00:06:02,830
Interestingly, the PLA SSF is also responsible for China's offensive cyber operations and a lot of other high-tech things that China does in military contexts.

57
00:06:03,030 --> 00:06:04,670
Their network is relatively small.

58
00:06:04,670 --> 00:06:10,030
They are not remotely comparable to Russia or the United States in terms of what they can see in space.

59
00:06:10,030 --> 00:06:22,090
And this makes sense, because unlike Russia and unlike the United States, China has never really had much opportunity to expand beyond its borders, and so it doesn't have those forward-deployed military bases for putting up telescopes.

60
00:06:22,350 --> 00:06:24,350
So what they've been doing is pretty clever.

61
00:06:24,350 --> 00:06:28,530
They've been deploying these ships, which are essentially mobile SSA stations.

62
00:06:28,530 --> 00:06:39,150
They take up international waters so they can get that global perspective on the skies and compete with these other space powers, despite having significantly less territorial reach.

63
00:06:39,970 --> 00:06:44,970
If you're not one of these three countries, you may have your own smaller network.

64
00:06:44,970 --> 00:06:51,370
The EU is the next biggest, and then basically any country with a space program has some degree of SSA capability.

65
00:06:51,730 --> 00:06:56,190
However, there are also some commercial actors that are starting to sell SSA data.

66
00:06:56,210 --> 00:07:00,270
They'll claim that they've made some pretty significant technological breakthroughs to startups.

67
00:07:00,270 --> 00:07:10,770
It's unclear how true that is or to what extent they could ever match the US military's capability, but at least there's kind of a shift towards privatization that's starting to emerge in this sector.

68
00:07:10,970 --> 00:07:22,210
In reality, though, today, if you run a satellite, chances are you get your SSA data through a website like spacetrek.org or from someone who buys it, who gets it from this website, and then resells it to you.

69
00:07:23,030 --> 00:07:33,290
spacetrek.org is a public website that's run by the US military, and anyone with an account can log in and get access to space situational awareness data that's pretty high quality, free of charge.

70
00:07:33,670 --> 00:07:40,470
The fundamental idea here is that if you share SSA data with people, you prevent collisions in orbit, and you protect the environment.

71
00:07:40,550 --> 00:07:46,370
They're like terms of service here, where you check a box that says, I promise I don't work for the North Korean military or whatever.

72
00:07:46,370 --> 00:07:49,290
But fundamentally, the US government doesn't care.

73
00:07:49,290 --> 00:08:02,230
While it would be nifty to see a North Korean satellite get destroyed by a piece of space debris, if the resulting cascade from that collision threatens critical US communications missions or navigation missions, it's not worth the collateral damage risk.

74
00:08:02,230 --> 00:08:10,130
And so there are strong incentives right now to share high quality SSA, even though it costs an inordinate amount of money to get access to.

75
00:08:10,990 --> 00:08:17,190
So right now, the primary format for sharing this data is something called a two-line element set or a TLE.

76
00:08:17,470 --> 00:08:23,670
TLEs were designed to fit on 280-column punch cards, and the format has basically not changed since.

77
00:08:23,670 --> 00:08:29,390
It's very rare in cybersecurity that you access a system that's backwards compatible with punch cards.

78
00:08:29,570 --> 00:08:31,870
So I thought this is a pretty interesting aside.

79
00:08:32,190 --> 00:08:38,250
There are some efforts recently to update the format because you actually have only so many objects you can track.

80
00:08:38,250 --> 00:08:43,310
There's like an ID field in a two-line element set, and it's starting to fill up the space that's too crowded.

81
00:08:43,570 --> 00:08:46,790
However, the core idea is probably always going to be the same.

82
00:08:46,790 --> 00:08:55,090
The two-line element set is intended as input to what we call a propagator, which is essentially a model of how things move in orbit.

83
00:08:55,250 --> 00:08:58,510
And two-line element sets are not physically meaningful on their own.

84
00:08:58,510 --> 00:09:02,010
They're like tied to physical properties, but they're not directly descriptive of them.

85
00:09:02,010 --> 00:09:05,070
But instead, they're intended as inputs into the system.

86
00:09:05,070 --> 00:09:10,330
And so a two-line element set is meaningless without a propagator, and a propagator is useless without the two-line element set.

87
00:09:10,530 --> 00:09:18,730
If you use them together, though, you are able to predict where an object will be in orbit with an accuracy of about a kilometer over 72 hours, which is pretty good.

88
00:09:18,730 --> 00:09:24,170
It can get better in some cases and slightly worse in others, but that's a good kind of rule of thumb for how accurate it will be.

89
00:09:24,810 --> 00:09:27,370
There are other formats that are available.

90
00:09:27,450 --> 00:09:29,610
You can actually get better data from the U.S.

91
00:09:29,610 --> 00:09:32,910
military if you sign a special data-sharing agreement with them.

92
00:09:32,910 --> 00:09:38,990
This agreement is super palatable if you're like a commercial space operator, but it's less attractive if you're a foreign military.

93
00:09:39,250 --> 00:09:42,570
And this kind of starts to hint at the trust problem here, right?

94
00:09:42,570 --> 00:09:49,350
So at its core, there are only a few people, a few organizations in the world, who know what these objects are and where they're going.

95
00:09:49,350 --> 00:09:52,910
And everyone else has to trust whatever they tell them.

96
00:09:53,730 --> 00:09:57,830
So this makes it kind of an intuitive target for a cyber attacker.

97
00:09:58,050 --> 00:10:00,130
So why would you target SSA?

98
00:10:00,230 --> 00:10:02,750
Well, these databases are highly centralized, right?

99
00:10:02,750 --> 00:10:09,870
There are only a few in the world, and if you change a line in one of them, you can affect what thousands of organizations think outer space looks like.

100
00:10:09,930 --> 00:10:13,030
And those organizations probably can't catch you.

101
00:10:13,030 --> 00:10:21,890
They don't have a capability, they don't have the billions of dollars investment needed to double check where a small piece of debris is at any given point in time.

102
00:10:21,890 --> 00:10:29,330
And so they kind of just have to have blind faith that the information in the database is true about what's in space, because they can't see it themselves.

103
00:10:29,650 --> 00:10:43,710
So as an attacker, if you want to harm a satellite by, say, hiding a debris collision and causing it to crash, you have essentially bytes on a computer somewhere that you can change to have a very hard physical effect, blowing something up in outer space.

104
00:10:43,730 --> 00:10:56,510
If we're thinking about ways to blow up satellites, and you compare deploying a couple of zero days against the database, which isn't trivial, but certainly is feasible, versus building a national space program, developing anti-satellite missiles, dealing with the diplomatic follow-up from that,

105
00:10:56,510 --> 00:11:03,990
and deploying them accurately, it's pretty clear why a cyber attack factor might be a more attractive way to target a satellite.

106
00:11:04,770 --> 00:11:10,430
So let's talk about a couple of threat models, the sort of people who would engage in these attacks and what they would do and why.

107
00:11:10,510 --> 00:11:16,570
So the first, I think, is the most intuitive, and that is the owner of the repository decides to start lying to people.

108
00:11:17,090 --> 00:11:29,230
Since they're the only ones with access to a lot of this information, they're the only ones whose sensors pick up these objects, if they start lying, it's very unlikely they'll get caught in the act, and they can deceive whoever they want about the state of orbit.

109
00:11:29,230 --> 00:11:30,310
This comes at a cost, right?

110
00:11:30,310 --> 00:11:40,970
If they get caught in a lie, their database is no longer trusted, and people maybe are unwilling to rely on it, and they accidentally provide a legitimate degree because they don't believe other conjunction assessments.

111
00:11:41,090 --> 00:11:43,310
But at its core, it's something they could do.

112
00:11:44,070 --> 00:11:49,630
And a nation-state attacker who doesn't run one of these databases might say, hey, I want to discredit this database.

113
00:11:49,630 --> 00:11:55,290
It would be great if the US military spent billions and billions of dollars on an SSA network, and nobody believes what it says.

114
00:11:55,430 --> 00:11:58,930
And they could do that by, making the sensors less accurate with malware.

115
00:11:58,930 --> 00:12:07,490
It doesn't need to be particularly targeted, it just needs to change the measurements that are coming off of those radar sensors, such that the predictions are inaccurate.

116
00:12:07,590 --> 00:12:19,670
Or if they have a space program, they could launch objects that are deliberately designed to do nothing other than be difficult to track with radar or electro-optical telescopes, to kind of discredit the overall utility of one of these databases.

117
00:12:20,370 --> 00:12:29,350
Finally, if we're kind of talking about bread and butter cybersecurity, just some rando who wants to hack a database somewhere, fundamentally, this is just aligning a database.

118
00:12:29,370 --> 00:12:33,170
Military databases are hard to hack, but they're hardly unhackable.

119
00:12:33,350 --> 00:12:37,330
And additionally, this data doesn't just go directly from the military to the satellite.

120
00:12:37,330 --> 00:12:45,030
It's often sold to third parties who repackage it and sell it to individual satellite operators to incorporate into their integration processes.

121
00:12:45,290 --> 00:12:52,950
And so if you compromise one of those later recipients' databases, you may have a similar effect that's a little bit more targeted and a little bit easier to pull off.

122
00:12:53,910 --> 00:12:57,030
So when we talk about messing with this data, what does that look like?

123
00:12:57,030 --> 00:12:59,610
What do you have to change to achieve what kind of goals?

124
00:12:59,610 --> 00:13:01,090
And what can you achieve?

125
00:13:01,410 --> 00:13:04,450
So we're going to run through a very simple attack scenario.

126
00:13:04,550 --> 00:13:08,490
Our attacker's goal is to cause harm to a specific satellite in orbit.

127
00:13:08,710 --> 00:13:10,290
There are two ways to go about this.

128
00:13:10,290 --> 00:13:12,570
The first one, you've probably already guessed.

129
00:13:12,650 --> 00:13:22,870
If we see in that database that there's a piece of debris that will collide with the satellite in the future, we can tamper with the contents of that database to make it look like that piece of debris is no longer a threat.

130
00:13:22,890 --> 00:13:31,210
The result is a satellite operator moves along blissfully ignorant of impending doom until a satellite collides with a piece of debris that seems to come out of nowhere.

131
00:13:31,610 --> 00:13:34,450
From a physics perspective, this is trivial.

132
00:13:34,550 --> 00:13:46,410
If you change any component of a two-line element set, there's a really good chance that over a 72-hour forecast window, that debris object is going to be in a radically different place and no longer pose a threat to the satellite.

133
00:13:46,610 --> 00:13:52,270
So we want to focus on a slightly more nuanced version of this attack that's a bit more challenging and a bit more pernicious.

134
00:13:53,090 --> 00:13:57,330
So the idea here is we create a ghost collision.

135
00:13:57,330 --> 00:14:03,570
We take an object that doesn't collide with a satellite and we tamper it just a tiny bit to make it look like it will.

136
00:14:03,670 --> 00:14:11,010
The effect is that we call these guys in at 12 in the morning to deal with an emergency and engage in a debris avoidance maneuver.

137
00:14:11,130 --> 00:14:18,640
This burns fuel on the satellite, it causes mechanical wear and tear, it increases the cost and decreases the lifespan of their space missions.

138
00:14:18,860 --> 00:14:22,580
This is a more credible attack than you might initially think.

139
00:14:22,820 --> 00:14:24,820
You might have trouble imagining the U.S.

140
00:14:24,820 --> 00:14:29,340
military deciding to say, blow up an Iranian satellite by messing with SSA data.

141
00:14:29,340 --> 00:14:34,180
But it's not that hard to believe that someone would just kind of tip the scale a tiny bit.

142
00:14:34,180 --> 00:14:39,980
So that Iranian space missions are particularly unlucky with regard to how many debris objects they have to dodge.

143
00:14:40,200 --> 00:14:53,440
And over time, this has the kind of slow burn effect that we see space use in other contexts, like Stuxnet, which caused mechanical wear and tear on centrifuges for a nuclear power slash weapons program.

144
00:14:53,460 --> 00:14:56,760
And you might imagine a similar thing targeting a space program.

145
00:14:57,460 --> 00:15:00,140
So how do we go about doing this?

146
00:15:00,140 --> 00:15:04,800
Well, first we're going to start with some assumptions to keep the simulation very simple for today.

147
00:15:04,880 --> 00:15:08,020
The first is that we'll assume the database has already been compromised.

148
00:15:08,020 --> 00:15:15,480
Either the owner of the database is the one telling the lie, or someone We're not fundamentally interested in how you compromise the database.

149
00:15:15,760 --> 00:15:18,860
We're going to target data in the two-line element set format.

150
00:15:18,960 --> 00:15:27,320
This is a little bit not real world, in the sense that people tend to use more precise MRIs for their conjunction analysis.

151
00:15:27,480 --> 00:15:32,280
But two-line element sets are publicly available, which makes it easier to work with for research purposes.

152
00:15:32,520 --> 00:15:38,280
And fundamentally, if you can tell a lie with data, the format that data is in doesn't really matter.

153
00:15:39,400 --> 00:15:43,300
We're going to say that people trust the output of their conjunction analysis simulations.

154
00:15:43,460 --> 00:15:46,760
In the real world, if you see a collision, you may call up the U.S.

155
00:15:46,760 --> 00:15:50,080
military and say, hey, can you double check that this is actually going to happen?

156
00:15:50,620 --> 00:15:54,540
We'll assume that either that double checking process has been compromised, you could say the U.S.

157
00:15:54,540 --> 00:15:58,920
military is the attacker, or the victim doesn't do that for some reason.

158
00:15:59,320 --> 00:16:03,580
And then we're going to define the collision pretty generously as a pass within one kilometer.

159
00:16:03,800 --> 00:16:05,080
You can do this much smaller.

160
00:16:05,080 --> 00:16:08,500
We've had success with passes as low as 100 meters.

161
00:16:08,500 --> 00:16:17,880
But the reality is that a wider zone of collision increases the likelihood of finding a candidate quickly from a computational complexity perspective.

162
00:16:18,080 --> 00:16:23,700
And in this case, because two-line element sets are only that accurate anyway, more precise is kind of meaningless.

163
00:16:24,640 --> 00:16:26,160
So here's our target.

164
00:16:26,160 --> 00:16:28,680
It's an Iridium satellite over the Atlantic Ocean.

165
00:16:28,680 --> 00:16:31,660
And it has an orbit that looks something like this.

166
00:16:31,680 --> 00:16:42,650
And we're going to try to an element in this debris field of 10,000 objects taken from spacetrack.org to see if we can make one look like it'll collide with the satellite over the next 72 hours.

167
00:16:42,810 --> 00:16:50,590
To filter down these objects, because we have a lot, we're going to only measure the time of closest approach for objects that pass within this sphere.

168
00:16:50,670 --> 00:16:52,950
So let's go ahead and see what that looks like in the lab.

169
00:16:53,030 --> 00:16:59,070
So what we're doing is we're looking for debris objects that pass within that zone, and then we're seeing where they pass closest to the satellite.

170
00:16:59,270 --> 00:17:11,030
The intuition here is that an object that already looks like it will pass closely would be easy to tamper with to create one of those phantom collisions that we're trying to generate, because you'd have to only make small changes to move its orbit, say,

171
00:17:11,170 --> 00:17:13,570
a couple hundred years in one direction or the other.

172
00:17:14,090 --> 00:17:17,070
Now, the size of our debris field here is 10,000 objects.

173
00:17:17,070 --> 00:17:18,690
You can do this with a larger debris field.

174
00:17:18,690 --> 00:17:26,110
It just takes longer to hunt down candidates, but you're also more likely to find a good candidate that passes closer the bigger the debris field.

175
00:17:26,110 --> 00:17:31,670
So there's a bit of a trade-off between how much computing time you want to put into this and how accurate of a collision you want to find.

176
00:17:32,470 --> 00:17:40,490
Here I'm propagating for just a couple of days, I think 48 hours or something, and we're going to take our top five candidates for manipulation and try to tamper with them.

177
00:17:40,550 --> 00:17:47,410
So if we look at the results here, we see that our best candidate passes within 3.8 kilometers of our target, which is excellent.

178
00:17:47,490 --> 00:17:56,970
This means we only have to modify this object's orbit by three kilometers in the correct direction, and it'll look like it's going to collide with the even when it's not.

179
00:17:56,970 --> 00:17:59,690
So that's the scale of the violin at this hour.

180
00:17:59,830 --> 00:18:01,650
Now this initially sounds easy, right?

181
00:18:01,650 --> 00:18:03,230
You just change the bytes.

182
00:18:03,230 --> 00:18:10,050
But it's a little harder than you would think, because we need to get this specific object into a new orbit over the next 72 hours.

183
00:18:10,050 --> 00:18:14,230
We need to change how it's moving through space pretty substantially in the database.

184
00:18:14,350 --> 00:18:22,570
We also need to have it appear like it'll be in a specific location, that zone of collision, at a specific time when our target satellite is also there.

185
00:18:22,670 --> 00:18:28,390
And we need to do all of this with only making tiny modifications to the line in that database, right?

186
00:18:28,390 --> 00:18:31,130
We want it to look like friction might have caused this object to shift.

187
00:18:31,130 --> 00:18:35,810
We don't want it to look like someone just deleted their own database and created a completely brand new object.

188
00:18:36,530 --> 00:18:39,410
So this is a pretty hard astrophysics problem.

189
00:18:39,410 --> 00:18:42,910
I don't think it's unsolvable, but it's definitely beyond me.

190
00:18:42,970 --> 00:18:45,350
But what I can do is guess and check.

191
00:18:45,390 --> 00:18:51,870
So what I did is input a genetic algorithm, which is essentially a fancy way of saying I threw things at the wall to see what would stick.

192
00:18:51,870 --> 00:19:01,510
And we defined our individuals in this genetic algorithm as a set of characteristics that were changes to four fields in the two-line element set.

193
00:19:01,650 --> 00:19:23,010
And the idea is that in each generation of this genetic algorithm, we determine the likelihood that one of these changes gets passed on to the children of this individual on the basis of a fitness function, which was defined as the distance between our fake ghost debris object and the target we're trying to collide with at the time of closest approach.

194
00:19:23,150 --> 00:19:32,390
Now, we could have added a stealth metric here to minimize the amount we have to change these fields if we were particularly worried about detection, if we were particularly worried that this was being monitored.

195
00:19:32,410 --> 00:19:39,930
But for simplicity purposes, we set this as a very high bound and just a hard cap, that we weren't allowed to modify any of these fields by more than 10%.

196
00:19:39,930 --> 00:19:50,470
In practice, we modify most of these fields by a fraction of a percent , but eccentricity in particular tends to need to be modified a little bit more because of the precision of the format.

197
00:19:50,470 --> 00:19:56,470
Although you can find collisions within much smaller zones, it comes at the cost of more computational time.

198
00:19:57,270 --> 00:20:00,750
Once we've kind of run our scenario, we get an output that looks like this.

199
00:20:00,750 --> 00:20:08,230
So in this case, we found a collision for our targeted object within three generations that passes within a kilometer of our target.

200
00:20:08,250 --> 00:20:13,850
If you look at the malicious two-line element set on the top and the original one on the bottom, you'll see that they're pretty similar.

201
00:20:13,850 --> 00:20:23,070
And if someone wasn't actively looking for data tampering impacts, it'd be pretty hard to identify that this object has been hacked to look like it's going somewhere it isn't.

202
00:20:23,730 --> 00:20:26,230
Let's see what the result of that is in our simulations.

203
00:20:26,430 --> 00:20:40,050
So we'll see the objects kind of move along just like they did before, but over time there's that slight difference such that at the time of closest approach, our malicious debris object passes well within this sphere around the iridium satellite, which is one kilometer across.

204
00:20:40,050 --> 00:20:44,350
And so at this point, we have caused a collision to appear like it will happen.

205
00:20:44,350 --> 00:20:50,870
The iridium operator will steer their satellite, even though they don't have to, and they'll increase their mission cost and decrease their mission lifespan.

206
00:20:51,490 --> 00:20:53,650
So how do we protect against these kinds of attacks?

207
00:20:53,650 --> 00:20:56,010
How do we prevent this kind of manipulation?

208
00:20:56,530 --> 00:21:00,750
If you're a satellite operator and you're thinking, how do I keep my SSA data secure?

209
00:21:00,750 --> 00:21:02,490
There are a couple of things you can do.

210
00:21:02,490 --> 00:21:07,310
The first is to get higher quality data where you can to enter into those data sharing agreements.

211
00:21:07,390 --> 00:21:13,050
This particular demonstration was made much easier by the fact that our zone of collision was one kilometer.

212
00:21:13,050 --> 00:21:27,050
The smaller that zone of collision gets, the more accurate your data is, the more likely an attacker is to have to work hard with like a larger debris field or more genetic algorithm generations or bigger tampering effects to find a collision that will trigger an alert.

213
00:21:27,050 --> 00:21:33,770
So you really increase the cost and the complexity for the attacker, even if you don't fully get rid of the risk of someone lying to you.

214
00:21:34,170 --> 00:21:36,830
You might also want to see if you can vet your data, right?

215
00:21:36,830 --> 00:21:47,250
There aren't any databases that fully match the US militaries, but even something with like 30% coverage at least gives you a second source for truth on those 30% of objects that they do know about.

216
00:21:47,410 --> 00:21:52,670
And you might think about also comparing your internal data with the public data from the US government.

217
00:21:52,670 --> 00:21:59,270
So you can say, hey, my database says a prediction that the US government doesn't, even though the source data should be the same.

218
00:21:59,270 --> 00:22:01,610
That's a pretty good indicator of compromise.

219
00:22:02,410 --> 00:22:06,090
If you're a nation-state actor, there are a couple of different ways to think about this.

220
00:22:06,090 --> 00:22:18,030
If you run an SSA database, so if you're the US, Russia, or China, you need to understand that those bytes on a computer are critical strategic resource that someone might try to mess with from a cybersecurity perspective.

221
00:22:18,030 --> 00:22:23,410
They might do this to discredit your information, to cause harm to one of your own satellites, or someone else's satellite.

222
00:22:23,410 --> 00:22:32,330
But fundamentally, as a nation, you have an obligation to recognize the importance of these specific databases as some of the most important space data you hold.

223
00:22:32,510 --> 00:22:37,290
Additionally, I think it's important to disavow any funny business in SSA.

224
00:22:37,330 --> 00:22:46,670
Right now, the US military has a statement on their website that basically says that the data from spacetrack.org could be manipulated at any time for national security purposes.

225
00:22:46,670 --> 00:22:54,550
And I understand the logic behind this, but I think standing by SSA data is an important step towards protecting the space environment in the future.

226
00:22:54,550 --> 00:23:08,290
And publicly disavowing and ascribing a diplomatic cost to getting caught concealing or manipulating SSA data, I think is an important step towards credibly building a system where people can trust what space looks like.

227
00:23:09,110 --> 00:23:23,470
Finally, if you're a smaller country, you might not have a full space surveillance network, but you may have a couple of telescopes or a couple of radar sensors that you can use to kind of randomly sample and audit specific objects and say there's supposed to be a debris object there today.

228
00:23:23,470 --> 00:23:24,710
Is there anything?

229
00:23:24,710 --> 00:23:30,430
And use that to kind of catch at least some tampering attacks in these databases and get a sense of their reliability.

230
00:23:30,430 --> 00:23:34,890
So to sum things up, SSA is fundamentally about trust.

231
00:23:34,890 --> 00:23:46,690
There is someone out there who is the only person who knows the truth about these objects and is telling it to you, and you have no way fundamentally to get that physical reality and ground truth information for yourself.

232
00:23:46,830 --> 00:23:49,750
This trust is intuitively abusable.

233
00:23:49,750 --> 00:24:02,650
You can change information in an SSA database through some very basic orbital physics operations to make it tell a prophecy that isn't true, to create a phantom collision, or to conceal an impending collision with catastrophic effects.

234
00:24:02,950 --> 00:24:21,570
We think that we can fix this by recognizing that SSA is an information target that can be used to cause physical effects in space, and so as a result, building responsibility and verification into the SSA process is a key step towards recognizing that trust is as important as truth in these databases.

235
00:24:22,410 --> 00:24:27,210
Thank you so much for listening to my presentation, and I'm happy to answer any questions.

236
00:24:27,210 --> 00:24:32,790
Hopefully I've gotten you thinking about kind of interactions between the physics of space and the cybersecurity properties.