start	end	text
5790	11370	Hi, I'm James Pavore. I'm a PhD student at Oxford University, where I research satellite
11370	17130	cybersecurity. And today, I want to talk about something called Space Situational Awareness,
17130	23690	or SSA. SSA is a type of data that we use to solve a problem, which is that space
23690	29630	is getting crowded. Today, there are tens of thousands of satellites and pieces of debris
29630	35050	and other objects in orbit that will whiz over your head every hour. And as space gets more
35050	39050	congested over the next decade, the number of objects is going to increase dramatically,
39050	44510	with the addition of constellations like OneWeb, Blue Origin, and Starlink changing the way we
44510	49630	think about low Earth orbit. As we put more satellites up there, the biggest challenge
49630	54650	will be dealing with the increasing risk of space debris collisions. Space debris are just like
54650	60290	bits of metal or rocket fragments or other things that fall off of the satellite during operations
60290	64810	or as part of a space mission. And they move at orbital velocities. So if they collide with
64810	70270	the satellite, they can cause it to break or even disintegrate, depending on the size of the collision.
70570	74910	And it's the second case that can lead to something that we call a cascade effect, whereby
75630	79910	a piece of debris crashes into a satellite, which creates more debris, which crash into more
79910	85810	satellites. And the worst case scenario, when space is as crowded as it's going to be in the next decade,
85930	91690	a debris cascade can severely constrain our access to either a particular orbit or even the space
91690	97130	as a whole. And that debris is not going anywhere. It can remain in orbit as a threat to satellites
97130	103850	for decades or centuries, depending on where it is. So to deal with this, we use space situational
103850	108990	awareness data. I'll talk about how that works and who gets it. And then I'll talk about why a cyber
108990	114490	attacker might target this critical data as a route to cause harm to specific satellites in orbit.
114490	118590	We'll run through a scenario where we actually kind of play through one of these attacks in
118590	123830	orbital simulations. And then I'll close by discussing mitigations that both industry players
123830	131370	and governments can use to protect and bring more trust into the SSA environment. So SSA as a concept
131370	137970	is very simple at its core. It's just understanding what's out there, whether that's a satellite or a
137970	142490	piece of debris or even a comet or an asteroid, depending on how you define it. It's essentially
142730	148970	a catalog of everything in space and where it's going. And we use SSA in every step of a satellite
148970	153630	mission, from the moment that we decide which orbit that we're going to launch our satellite
153630	158670	into, to the moment we retire our satellite into a graveyard orbit and try to avoid crashing into
158670	164310	other satellites when we turn it off. And two particularly important uses of SSA are conjunction
164310	169790	analysis and intelligence purposes. You use SSA to figure out when your satellite is going to
169790	174670	collide with a piece of debris so that you can steer it around it. And this is not trivial because
174670	179730	pieces of debris move. They're affected by friction or collisions with other pieces of debris.
179730	183950	So you need to constantly be updating your catalog so you know when you need to steer your satellite
183950	189870	and where. Additionally, I mentioned intelligence purposes. SSA is really useful if you want to know
189870	194730	if your adversaries are, say, launching a spy satellite that overpasses your territory or
194730	200470	testing anti-satellite weapons. So it's perhaps unsurprising that the dominant source of SSA data
200470	207110	today is the U.S. military, which operates the Space Surveillance Network, or SSN. The SSN consists
207110	211550	of a bunch of ground stations around the world with either radar systems or electro-optical
211550	217110	telescopes and even some satellites in orbit that are constantly scanning the sky for space debris.
217110	222350	The reason this is distributed across the globe is because to get a good catalog of space situational
222350	226890	awareness data, you need multiple observations of an object from multiple different vantage points
226890	232430	in different parts of the planet. And the U.S. military gets a huge advantage from this investment.
232430	237470	They're likely the only entity in the world who have access to ground-truth information describing
237470	243530	debris objects measuring 10 centimeters in diameter or even smaller. However, this edge does not come
243530	248450	cheap. We don't know exactly how much the U.S. military spends in the Space Surveillance Network,
248450	253630	but we know that the most recent upgrade to the system exceeded six billion dollars. And then in
253630	259170	fiscal year 2015 alone, they spent 1.6 billion dollars on procurement. This is all to say that
259170	264070	this is not a trivial effort. This is not picking up a telescope at Walmart and looking for pieces
264070	269610	of space debris. This is a very complicated technological endeavor that is beyond the means
269610	276550	of even most nation-states to pull off. The next most sophisticated SSA capability is probably
276550	281150	Russia's through the Russian Space Surveillance System. We don't know quite as much about like
281150	285890	what kind of objects they can see or what size, but we do have a sense of the network's capabilities
285890	290610	because we know where the ground stations are. And they're primarily in former Soviet territories or
290610	295670	countries that were friendly with the USSR prior to its collapse. This makes sense as a lot of the
295670	300650	groundwork was kind of laid for the system during the Soviet Union. But in recent years, Russia has
300650	305550	expressed skepticism in third-party data from like the U.S. military and has been shoring up their
305550	310350	own internal capabilities, including through the launch of satellites like this one, which was
310350	315630	widely expected to be a space surveillance system, although the Russian military has not confirmed
315630	319750	this. One other thing I just want to note while we're talking about Russian space situational
319750	325010	awareness, there is a civilian network that is ostensibly a collaboration between scientists
325010	330930	and universities. It's not super active today, and depending on who you ask, it's like deeply tied to
330930	336430	the Russian Academy of Sciences and kind of the Russia's civil military apparatus for space power,
336430	340790	or it's entirely independent. In either case, it's at least worth noting that there are some
340790	345110	civilian efforts to get space situational awareness data, as well as military efforts associated with
345110	351690	Russia. The final network I want to talk about is China's. They run a system through their PLA
351690	357730	Strategic Support Force unit. Interestingly, the PLA SSF is also responsible for China's offensive
357730	362830	cyber operations and a lot of other high-tech things that China does in military contexts.
363030	367850	Their network is relatively small. They are not remotely comparable to Russia or the United States
367850	372830	in terms of what they can see in space. And this makes sense, because unlike Russia and unlike the
372830	378490	United States, China has never really had much opportunity to expand beyond its borders, and so
378490	383030	it doesn't have those forward-deployed military bases for putting up telescopes. So what they've
383030	386690	been doing is pretty clever. They've been deploying these ships, which are essentially
386690	392650	mobile SSA stations. They take up international waters so they can get that global perspective
392650	397630	on the skies and compete with these other space powers, despite having significantly less
397630	404350	territorial reach. If you're not one of these three countries, you may have your own smaller
404350	408630	network. The EU is the next biggest, and then basically any country with a space program has
408630	414450	some degree of SSA capability. However, there are also some commercial actors that are starting to
414450	419390	sell SSA data. They'll claim that they've made some pretty significant technological breakthroughs
419390	425110	to startups. It's unclear how true that is or to what extent they could ever match the US military's
425110	429710	capability, but at least there's kind of a shift towards privatization that's starting to emerge
429710	435990	in this sector. In reality, though, today, if you run a satellite, chances are you get your SSA data
435990	440430	through a website like spacetrek.org or from someone who buys it, who gets it from this
440430	447150	website, and then resells it to you. spacetrek.org is a public website that's run by the US military,
447150	451350	and anyone with an account can log in and get access to space situational awareness data that's
451350	457470	pretty high quality, free of charge. The fundamental idea here is that if you share SSA data with
457470	461450	people, you prevent collisions in orbit, and you protect the environment. They're like terms of
461450	465530	service here, where you check a box that says, I promise I don't work for the North Korean military
465530	470670	or whatever. But fundamentally, the US government doesn't care. While it would be nifty to see a
470670	475450	North Korean satellite get destroyed by a piece of space debris, if the resulting cascade from
475450	480930	that collision threatens critical US communications missions or navigation missions, it's not worth the
480930	486590	collateral damage risk. And so there are strong incentives right now to share high quality SSA,
486590	492630	even though it costs an inordinate amount of money to get access to. So right now, the primary
492630	498550	format for sharing this data is something called a two-line element set or a TLE. TLEs were designed
498550	504590	to fit on 280-column punch cards, and the format has basically not changed since. It's very rare
504590	509930	in cybersecurity that you access a system that's backwards compatible with punch cards. So I
509930	514810	thought this is a pretty interesting aside. There are some efforts recently to update the format
514810	519610	because you actually have only so many objects you can track. There's like an ID field in a
519610	523310	two-line element set, and it's starting to fill up the space that's too crowded.
523570	528590	However, the core idea is probably always going to be the same. The two-line element set is intended
528590	535090	as input to what we call a propagator, which is essentially a model of how things move in orbit.
535250	539270	And two-line element sets are not physically meaningful on their own. They're like tied to
539270	542650	physical properties, but they're not directly descriptive of them. But instead, they're
542650	547110	intended as inputs into the system. And so a two-line element set is meaningless without a
547110	551550	propagator, and a propagator is useless without the two-line element set. If you use them together,
551550	555970	though, you are able to predict where an object will be in orbit with an accuracy of about a
555970	560930	kilometer over 72 hours, which is pretty good. It can get better in some cases and slightly worse
560930	566190	in others, but that's a good kind of rule of thumb for how accurate it will be. There are other
566190	571110	formats that are available. You can actually get better data from the U.S. military if you sign a
571110	574950	special data-sharing agreement with them. This agreement is super palatable if you're like a
574950	579950	commercial space operator, but it's less attractive if you're a foreign military. And this kind of
579950	584990	starts to hint at the trust problem here, right? So at its core, there are only a few people, a few
584990	589890	organizations in the world, who know what these objects are and where they're going. And everyone
589890	596990	else has to trust whatever they tell them. So this makes it kind of an intuitive target for a cyber
596990	602910	attacker. So why would you target SSA? Well, these databases are highly centralized, right? There are
602910	607230	only a few in the world, and if you change a line in one of them, you can affect what thousands of
607230	613170	organizations think outer space looks like. And those organizations probably can't catch you. They
613170	617810	don't have a capability, they don't have the billions of dollars investment needed to double
617810	622890	check where a small piece of debris is at any given point in time. And so they kind of just
622890	627750	have to have blind faith that the information in the database is true about what's in space,
627750	632550	because they can't see it themselves. So as an attacker, if you want to harm a satellite by, say,
632550	637590	hiding a debris collision and causing it to crash, you have essentially bytes on a computer somewhere
637590	643710	that you can change to have a very hard physical effect, blowing something up in outer space.
643730	647350	If we're thinking about ways to blow up satellites, and you compare deploying a couple of
647350	652510	zero days against the database, which isn't trivial, but certainly is feasible, versus building a
652510	656250	national space program, developing anti-satellite missiles, dealing with the diplomatic follow-up
656250	661330	from that, and deploying them accurately, it's pretty clear why a cyber attack factor might be
661690	666910	a more attractive way to target a satellite. So let's talk about a couple of threat models,
666910	670430	the sort of people who would engage in these attacks and what they would do and why.
670510	675090	So the first, I think, is the most intuitive, and that is the owner of the repository decides to
675090	679890	start lying to people. Since they're the only ones with access to a lot of this information,
679890	684910	they're the only ones whose sensors pick up these objects, if they start lying, it's very unlikely
684910	689230	they'll get caught in the act, and they can deceive whoever they want about the state of orbit.
689230	693610	This comes at a cost, right? If they get caught in a lie, their database is no longer trusted,
693610	698670	and people maybe are unwilling to rely on it, and they accidentally provide a legitimate degree
698670	702450	because they don't believe other conjunction assessments. But at its core, it's something
702450	707410	they could do. And a nation-state attacker who doesn't run one of these databases might say,
707410	711650	hey, I want to discredit this database. It would be great if the US military spent billions and
711650	717150	billions of dollars on an SSA network, and nobody believes what it says. And they could do that by,
717150	720910	making the sensors less accurate with malware. It doesn't need to be particularly targeted,
720910	725970	it just needs to change the measurements that are coming off of those radar sensors, such that the
725970	730110	predictions are inaccurate. Or if they have a space program, they could launch objects that are
730110	735270	deliberately designed to do nothing other than be difficult to track with radar or electro-optical
735270	741090	telescopes, to kind of discredit the overall utility of one of these databases. Finally,
741090	744890	if we're kind of talking about bread and butter cybersecurity, just some rando who wants to hack
744990	750870	a database somewhere, fundamentally, this is just aligning a database. Military databases are hard
750870	755790	to hack, but they're hardly unhackable. And additionally, this data doesn't just go directly
755790	760370	from the military to the satellite. It's often sold to third parties who repackage it and sell
760370	765750	it to individual satellite operators to incorporate into their integration processes. And so if you
765750	770610	compromise one of those later recipients' databases, you may have a similar effect that's a little bit
770610	776110	more targeted and a little bit easier to pull off. So when we talk about messing with this data,
776110	779850	what does that look like? What do you have to change to achieve what kind of goals? And what
779850	785370	can you achieve? So we're going to run through a very simple attack scenario. Our attacker's goal
785370	790970	is to cause harm to a specific satellite in orbit. There are two ways to go about this. The first one,
790970	795990	you've probably already guessed. If we see in that database that there's a piece of debris that will
795990	800330	collide with the satellite in the future, we can tamper with the contents of that database to make
800330	804910	it look like that piece of debris is no longer a threat. The result is a satellite operator moves
804910	809730	along blissfully ignorant of impending doom until a satellite collides with a piece of debris that
809730	815610	seems to come out of nowhere. From a physics perspective, this is trivial. If you change any
816090	820950	component of a two-line element set, there's a really good chance that over a 72-hour forecast
820950	825530	window, that debris object is going to be in a radically different place and no longer pose a
825530	829850	threat to the satellite. So we want to focus on a slightly more nuanced version of this attack
829850	836430	that's a bit more challenging and a bit more pernicious. So the idea here is we create a ghost
836430	842030	collision. We take an object that doesn't collide with a satellite and we tamper it just a tiny bit
842030	846750	to make it look like it will. The effect is that we call these guys in at 12 in the morning to
846750	852410	deal with an emergency and engage in a debris avoidance maneuver. This burns fuel on the
852410	857460	satellite, it causes mechanical wear and tear, it increases the cost and decreases the lifespan of
857460	863220	their space missions. This is a more credible attack than you might initially think. You might
863220	868120	have trouble imagining the U.S. military deciding to say, blow up an Iranian satellite by messing
868120	873500	with SSA data. But it's not that hard to believe that someone would just kind of tip the scale a
873500	878680	tiny bit. So that Iranian space missions are particularly unlucky with regard to how many
878680	883960	debris objects they have to dodge. And over time, this has the kind of slow burn effect that we see
883960	890200	space use in other contexts, like Stuxnet, which caused mechanical wear and tear on centrifuges for
890320	895840	a nuclear power slash weapons program. And you might imagine a similar thing targeting a space
895840	901760	program. So how do we go about doing this? Well, first we're going to start with some assumptions
901760	906860	to keep the simulation very simple for today. The first is that we'll assume the database has
906860	911020	already been compromised. Either the owner of the database is the one telling the lie, or someone
911560	916520	We're not fundamentally interested in how you compromise the database. We're going to target
916520	923780	data in the two-line element set format. This is a little bit not real world, in the sense that
923780	928380	people tend to use more precise MRIs for their conjunction analysis. But two-line element sets
928380	933780	are publicly available, which makes it easier to work with for research purposes. And fundamentally,
933780	938280	if you can tell a lie with data, the format that data is in doesn't really matter.
939400	943300	We're going to say that people trust the output of their conjunction analysis simulations.
943460	947340	In the real world, if you see a collision, you may call up the U.S. military and say,
947340	951880	hey, can you double check that this is actually going to happen? We'll assume that either that
951880	956080	double checking process has been compromised, you could say the U.S. military is the attacker,
956080	960800	or the victim doesn't do that for some reason. And then we're going to define the collision
960800	965820	pretty generously as a pass within one kilometer. You can do this much smaller. We've had success
965820	973000	with passes as low as 100 meters. But the reality is that a wider zone of collision increases the
973000	977880	likelihood of finding a candidate quickly from a computational complexity perspective.
978080	981300	And in this case, because two-line element sets are only that accurate anyway,
981300	987940	more precise is kind of meaningless. So here's our target. It's an Iridium satellite over the
987940	992910	Atlantic Ocean. And it has an orbit that looks something like this. And we're going to try to
992910	998930	an element in this debris field of 10,000 objects taken from spacetrack.org to see if we can make
998930	1004030	one look like it'll collide with the satellite over the next 72 hours. To filter down these
1004030	1008570	objects, because we have a lot, we're going to only measure the time of closest approach for
1008570	1012950	objects that pass within this sphere. So let's go ahead and see what that looks like in the lab.
1013030	1016570	So what we're doing is we're looking for debris objects that pass within that zone,
1016570	1020610	and then we're seeing where they pass closest to the satellite. The intuition here is that
1020610	1025330	an object that already looks like it will pass closely would be easy to tamper with to create
1025330	1029330	one of those phantom collisions that we're trying to generate, because you'd have to only make small
1029330	1034950	changes to move its orbit, say, a couple hundred years in one direction or the other. Now, the size
1034950	1038950	of our debris field here is 10,000 objects. You can do this with a larger debris field. It just
1038950	1044130	takes longer to hunt down candidates, but you're also more likely to find a good candidate that
1044130	1047590	passes closer the bigger the debris field. So there's a bit of a trade-off between how much
1047590	1051670	computing time you want to put into this and how accurate of a collision you want to find.
1052470	1056290	Here I'm propagating for just a couple of days, I think 48 hours or something,
1056290	1060490	and we're going to take our top five candidates for manipulation and try to tamper with them.
1060550	1065510	So if we look at the results here, we see that our best candidate passes within 3.8 kilometers
1065510	1070450	of our target, which is excellent. This means we only have to modify this object's orbit by
1070450	1075030	three kilometers in the correct direction, and it'll look like it's going to collide with the
1075490	1079690	even when it's not. So that's the scale of the violin at this hour.
1079830	1084350	Now this initially sounds easy, right? You just change the bytes. But it's a little harder than
1084350	1089230	you would think, because we need to get this specific object into a new orbit over the next
1089230	1094230	72 hours. We need to change how it's moving through space pretty substantially in the database.
1094350	1099310	We also need to have it appear like it'll be in a specific location, that zone of collision,
1099310	1103930	at a specific time when our target satellite is also there. And we need to do all of this
1103930	1108830	with only making tiny modifications to the line in that database, right? We want it to
1108830	1112190	look like friction might have caused this object to shift. We don't want it to look like someone
1112190	1117610	just deleted their own database and created a completely brand new object. So this is a pretty
1117610	1122910	hard astrophysics problem. I don't think it's unsolvable, but it's definitely beyond me.
1122970	1127650	But what I can do is guess and check. So what I did is input a genetic algorithm,
1127650	1131870	which is essentially a fancy way of saying I threw things at the wall to see what would stick.
1131870	1138010	And we defined our individuals in this genetic algorithm as a set of characteristics that were
1138010	1143990	changes to four fields in the two-line element set. And the idea is that in each generation
1143990	1148110	of this genetic algorithm, we determine the likelihood that one of these changes gets
1148110	1153810	passed on to the children of this individual on the basis of a fitness function, which was
1153810	1160410	defined as the distance between our fake ghost debris object and the target we're trying to
1160410	1164970	collide with at the time of closest approach. Now, we could have added a stealth metric here
1164970	1169490	to minimize the amount we have to change these fields if we were particularly worried about
1169490	1173190	detection, if we were particularly worried that this was being monitored. But for simplicity
1173190	1178170	purposes, we set this as a very high bound and just a hard cap, that we weren't allowed to modify
1178170	1183990	any of these fields by more than 10%. In practice, we modify most of these fields by a fraction of a
1183990	1189050	percent, but eccentricity in particular tends to need to be modified a little bit more because of
1189050	1194390	the precision of the format. Although you can find collisions within much smaller zones, it comes at
1194390	1199670	the cost of more computational time. Once we've kind of run our scenario, we get an output that
1199670	1205290	looks like this. So in this case, we found a collision for our targeted object within three
1205290	1209490	generations that passes within a kilometer of our target. If you look at the malicious two-line
1209490	1213850	element set on the top and the original one on the bottom, you'll see that they're pretty similar.
1213850	1218290	And if someone wasn't actively looking for data tampering impacts, it'd be pretty hard to
1218290	1224350	identify that this object has been hacked to look like it's going somewhere it isn't. Let's see what
1224350	1228590	the result of that is in our simulations. So we'll see the objects kind of move along just like they
1228590	1232650	did before, but over time there's that slight difference such that at the time of closest
1232650	1237710	approach, our malicious debris object passes well within this sphere around the iridium satellite,
1237710	1243530	which is one kilometer across. And so at this point, we have caused a collision to appear like
1243530	1247750	it will happen. The iridium operator will steer their satellite, even though they don't have to,
1247750	1250870	and they'll increase their mission cost and decrease their mission lifespan.
1251490	1256010	So how do we protect against these kinds of attacks? How do we prevent this kind of manipulation?
1256530	1260750	If you're a satellite operator and you're thinking, how do I keep my SSA data secure?
1260750	1265250	There are a couple of things you can do. The first is to get higher quality data where you can to
1265250	1270370	enter into those data sharing agreements. This particular demonstration was made much easier by
1270370	1274490	the fact that our zone of collision was one kilometer. The smaller that zone of collision
1274490	1279690	gets, the more accurate your data is, the more likely an attacker is to have to work hard with
1279690	1284470	like a larger debris field or more genetic algorithm generations or bigger tampering effects
1284470	1289250	to find a collision that will trigger an alert. So you really increase the cost and the complexity
1289250	1293770	for the attacker, even if you don't fully get rid of the risk of someone lying to you.
1294170	1298130	You might also want to see if you can vet your data, right? There aren't any databases that
1298130	1303450	fully match the US militaries, but even something with like 30% coverage at least gives you a second
1303450	1308250	source for truth on those 30% of objects that they do know about. And you might think about
1308250	1313890	also comparing your internal data with the public data from the US government. So you can say, hey,
1313890	1317730	my database says a prediction that the US government doesn't, even though the source
1317730	1323570	data should be the same. That's a pretty good indicator of compromise. If you're a nation-state
1323570	1327890	actor, there are a couple of different ways to think about this. If you run an SSA database,
1327890	1332390	so if you're the US, Russia, or China, you need to understand that those bytes on a computer are
1332390	1338030	critical strategic resource that someone might try to mess with from a cybersecurity perspective.
1338030	1342070	They might do this to discredit your information, to cause harm to one of your own satellites,
1342070	1346710	or someone else's satellite. But fundamentally, as a nation, you have an obligation to recognize
1346710	1352330	the importance of these specific databases as some of the most important space data you hold.
1352510	1358590	Additionally, I think it's important to disavow any funny business in SSA. Right now, the US
1358590	1363150	military has a statement on their website that basically says that the data from spacetrack.org
1363150	1367910	could be manipulated at any time for national security purposes. And I understand the logic
1367910	1373090	behind this, but I think standing by SSA data is an important step towards protecting the space
1373090	1379170	environment in the future. And publicly disavowing and ascribing a diplomatic cost to getting caught
1379170	1385370	concealing or manipulating SSA data, I think is an important step towards credibly building a system
1385370	1391530	where people can trust what space looks like. Finally, if you're a smaller country, you might
1391530	1395630	not have a full space surveillance network, but you may have a couple of telescopes or a couple
1395630	1401230	of radar sensors that you can use to kind of randomly sample and audit specific objects and
1401230	1405770	say there's supposed to be a debris object there today. Is there anything? And use that to kind of
1405770	1410430	catch at least some tampering attacks in these databases and get a sense of their reliability.
1410430	1416830	So to sum things up, SSA is fundamentally about trust. There is someone out there who is the only
1416830	1421510	person who knows the truth about these objects and is telling it to you, and you have no way
1421510	1426690	fundamentally to get that physical reality and ground truth information for yourself.
1426830	1432130	This trust is intuitively abusable. You can change information in an SSA database
1432130	1437510	through some very basic orbital physics operations to make it tell a prophecy that isn't true, to
1437510	1442650	create a phantom collision, or to conceal an impending collision with catastrophic effects.
1442950	1448990	We think that we can fix this by recognizing that SSA is an information target that can be used to
1448990	1454670	cause physical effects in space, and so as a result, building responsibility and verification
1454670	1460250	into the SSA process is a key step towards recognizing that trust is as important as truth
1460250	1466570	in these databases. Thank you so much for listening to my presentation, and I'm happy to answer any
1466570	1470210	questions. Hopefully I've gotten you thinking about kind of interactions between the physics
1470210	1472790	of space and the cybersecurity properties.