WEBVTT 00:05.790 --> 00:07.670 Hi, I'm James Pavore. 00:07.670 --> 00:12.510 I'm a PhD student at Oxford University, where I research satellite cybersecurity. 00:12.950 --> 00:18.390 And today, I want to talk about something called Space Situational Awareness, or SSA. 00:18.570 --> 00:25.610 SSA is a type of data that we use to solve a problem, which is that space is getting crowded. 00:25.710 --> 00:33.290 Today, there are tens of thousands of satellites and pieces of debris and other objects in orbit that will whiz over your head every hour. 00:33.290 --> 00:46.110 And as space gets more congested over the next decade, the number of objects is going to increase dramatically, with the addition of constellations like OneWeb, Blue Origin, and Starlink changing the way we think about low Earth orbit. 00:46.350 --> 00:53.410 As we put more satellites up there, the biggest challenge will be dealing with the increasing risk of space debris collisions. 00:53.570 --> 01:01.790 Space debris are just like bits of metal or rocket fragments or other things that fall off of the satellite during operations or as part of a space mission. 01:01.930 --> 01:03.910 And they move at orbital velocities. 01:03.910 --> 01:10.270 So if they collide with the satellite, they can cause it to break or even disintegrate, depending on the size of the collision. 01:10.570 --> 01:20.830 And it's the second case that can lead to something that we call a cascade effect, whereby a piece of debris crashes into a satellite, which creates more debris, which crash into more satellites. 01:20.970 --> 01:32.670 And the worst case scenario, when space is as crowded as it's going to be in the next decade, a debris cascade can severely constrain our access to either a particular orbit or even the space as a whole. 01:33.090 --> 01:35.110 And that debris is not going anywhere. 01:35.130 --> 01:40.610 It can remain in orbit as a threat to satellites for decades or centuries, depending on where it is. 01:41.170 --> 01:44.990 So to deal with this, we use space situational awareness data. 01:44.990 --> 01:47.530 I'll talk about how that works and who gets it. 01:47.530 --> 01:54.490 And then I'll talk about why a cyber attacker might target this critical data as a route to cause harm to specific satellites in orbit. 01:54.490 --> 02:00.010 We'll run through a scenario where we actually kind of play through one of these attacks in orbital simulations. 02:00.210 --> 02:09.110 And then I'll close by discussing mitigations that both industry players and governments can use to protect and bring more trust into the SSA environment. 02:09.810 --> 02:13.390 So SSA as a concept is very simple at its core. 02:13.390 --> 02:21.990 It's just understanding what's out there, whether that's a satellite or a piece of debris or even a comet or an asteroid, depending on how you define it. 02:21.990 --> 02:25.870 It's essentially a catalog of everything in space and where it's going. 02:26.010 --> 02:40.770 And we use SSA in every step of a satellite mission, from the moment that we decide which orbit that we're going to launch our satellite into, to the moment we retire our satellite into a graveyard orbit and try to avoid crashing into other satellites when we turn it off. 02:41.030 --> 02:46.670 And two particularly important uses of SSA are conjunction analysis and intelligence purposes. 02:46.710 --> 02:53.070 You use SSA to figure out when your satellite is going to collide with a piece of debris so that you can steer it around it. 02:53.070 --> 02:56.230 And this is not trivial because pieces of debris move. 02:56.230 --> 02:59.730 They're affected by friction or collisions with other pieces of debris. 02:59.730 --> 03:05.050 So you need to constantly be updating your catalog so you know when you need to steer your satellite and where. 03:05.310 --> 03:07.830 Additionally, I mentioned intelligence purposes. 03:07.930 --> 03:16.750 SSA is really useful if you want to know if your adversaries are, say, launching a spy satellite that overpasses your territory or testing anti-satellite weapons. 03:16.810 --> 03:21.650 So it's perhaps unsurprising that the dominant source of SSA data today is the U.S. 03:21.650 --> 03:25.490 military, which operates the Space Surveillance Network, or SSN. 03:25.970 --> 03:37.110 The SSN consists of a bunch of ground stations around the world with either radar systems or electro-optical telescopes and even some satellites in orbit that are constantly scanning the sky for space debris. 03:37.110 --> 03:48.570 The reason this is distributed across the globe is because to get a good catalog of space situational awareness data, you need multiple observations of an object from multiple different vantage points in different parts of the planet. 03:48.870 --> 03:49.710 And the U.S. 03:49.710 --> 03:52.430 military gets a huge advantage from this investment. 03:52.430 --> 04:01.470 They're likely the only entity in the world who have access to ground-truth information describing debris objects measuring 10 centimeters in diameter or even smaller. 04:01.530 --> 04:04.410 However, this edge does not come cheap. 04:04.470 --> 04:06.270 We don't know exactly how much the U.S. 04:06.270 --> 04:13.270 military spends in the Space Surveillance Network, but we know that the most recent upgrade to the system exceeded six billion dollars. 04:13.270 --> 04:18.050 And then in fiscal year 2015 alone, they spent 1.6 billion dollars on procurement. 04:18.090 --> 04:21.110 This is all to say that this is not a trivial effort. 04:21.110 --> 04:25.350 This is not picking up a telescope at Walmart and looking for pieces of space debris. 04:25.390 --> 04:32.830 This is a very complicated technological endeavor that is beyond the means of even most nation-states to pull off. 04:33.230 --> 04:39.330 The next most sophisticated SSA capability is probably Russia's through the Russian Space Surveillance System. 04:39.330 --> 04:48.030 We don't know quite as much about like what kind of objects they can see or what size, but we do have a sense of the network's capabilities because we know where the ground stations are. 04:48.030 --> 04:54.470 And they're primarily in former Soviet territories or countries that were friendly with the USSR prior to its collapse. 04:54.470 --> 04:59.050 This makes sense as a lot of the groundwork was kind of laid for the system during the Soviet Union. 04:59.050 --> 05:03.670 But in recent years, Russia has expressed skepticism in third-party data from like the U.S. 05:03.670 --> 05:16.470 military and has been shoring up their own internal capabilities, including through the launch of satellites like this one, which was widely expected to be a space surveillance system, although the Russian military has not confirmed this. 05:16.730 --> 05:25.710 One other thing I just want to note while we're talking about Russian space situational awareness, there is a civilian network that is ostensibly a collaboration between scientists and universities. 05:25.910 --> 05:38.370 It's not super active today, and depending on who you ask, it's like deeply tied to the Russian Academy of Sciences and kind of the Russia's civil military apparatus for space power, or it's entirely independent. 05:38.570 --> 05:45.910 In either case, it's at least worth noting that there are some civilian efforts to get space situational awareness data, as well as military efforts associated with Russia. 05:46.510 --> 05:49.690 The final network I want to talk about is China's. 05:49.690 --> 05:53.510 They run a system through their PLA Strategic Support Force unit. 05:53.710 --> 06:02.830 Interestingly, the PLA SSF is also responsible for China's offensive cyber operations and a lot of other high-tech things that China does in military contexts. 06:03.030 --> 06:04.670 Their network is relatively small. 06:04.670 --> 06:10.030 They are not remotely comparable to Russia or the United States in terms of what they can see in space. 06:10.030 --> 06:22.090 And this makes sense, because unlike Russia and unlike the United States, China has never really had much opportunity to expand beyond its borders, and so it doesn't have those forward-deployed military bases for putting up telescopes. 06:22.350 --> 06:24.350 So what they've been doing is pretty clever. 06:24.350 --> 06:28.530 They've been deploying these ships, which are essentially mobile SSA stations. 06:28.530 --> 06:39.150 They take up international waters so they can get that global perspective on the skies and compete with these other space powers, despite having significantly less territorial reach. 06:39.970 --> 06:44.970 If you're not one of these three countries, you may have your own smaller network. 06:44.970 --> 06:51.370 The EU is the next biggest, and then basically any country with a space program has some degree of SSA capability. 06:51.730 --> 06:56.190 However, there are also some commercial actors that are starting to sell SSA data. 06:56.210 --> 07:00.270 They'll claim that they've made some pretty significant technological breakthroughs to startups. 07:00.270 --> 07:10.770 It's unclear how true that is or to what extent they could ever match the US military's capability, but at least there's kind of a shift towards privatization that's starting to emerge in this sector. 07:10.970 --> 07:22.210 In reality, though, today, if you run a satellite, chances are you get your SSA data through a website like spacetrek.org or from someone who buys it, who gets it from this website, and then resells it to you. 07:23.030 --> 07:33.290 spacetrek.org is a public website that's run by the US military, and anyone with an account can log in and get access to space situational awareness data that's pretty high quality, free of charge. 07:33.670 --> 07:40.470 The fundamental idea here is that if you share SSA data with people, you prevent collisions in orbit, and you protect the environment. 07:40.550 --> 07:46.370 They're like terms of service here, where you check a box that says, I promise I don't work for the North Korean military or whatever. 07:46.370 --> 07:49.290 But fundamentally, the US government doesn't care. 07:49.290 --> 08:02.230 While it would be nifty to see a North Korean satellite get destroyed by a piece of space debris, if the resulting cascade from that collision threatens critical US communications missions or navigation missions, it's not worth the collateral damage risk. 08:02.230 --> 08:10.130 And so there are strong incentives right now to share high quality SSA, even though it costs an inordinate amount of money to get access to. 08:10.990 --> 08:17.190 So right now, the primary format for sharing this data is something called a two-line element set or a TLE. 08:17.470 --> 08:23.670 TLEs were designed to fit on 280-column punch cards, and the format has basically not changed since. 08:23.670 --> 08:29.390 It's very rare in cybersecurity that you access a system that's backwards compatible with punch cards. 08:29.570 --> 08:31.870 So I thought this is a pretty interesting aside. 08:32.190 --> 08:38.250 There are some efforts recently to update the format because you actually have only so many objects you can track. 08:38.250 --> 08:43.310 There's like an ID field in a two-line element set, and it's starting to fill up the space that's too crowded. 08:43.570 --> 08:46.790 However, the core idea is probably always going to be the same. 08:46.790 --> 08:55.090 The two-line element set is intended as input to what we call a propagator, which is essentially a model of how things move in orbit. 08:55.250 --> 08:58.510 And two-line element sets are not physically meaningful on their own. 08:58.510 --> 09:02.010 They're like tied to physical properties, but they're not directly descriptive of them. 09:02.010 --> 09:05.070 But instead, they're intended as inputs into the system. 09:05.070 --> 09:10.330 And so a two-line element set is meaningless without a propagator, and a propagator is useless without the two-line element set. 09:10.530 --> 09:18.730 If you use them together, though, you are able to predict where an object will be in orbit with an accuracy of about a kilometer over 72 hours, which is pretty good. 09:18.730 --> 09:24.170 It can get better in some cases and slightly worse in others, but that's a good kind of rule of thumb for how accurate it will be. 09:24.810 --> 09:27.370 There are other formats that are available. 09:27.450 --> 09:29.610 You can actually get better data from the U.S. 09:29.610 --> 09:32.910 military if you sign a special data-sharing agreement with them. 09:32.910 --> 09:38.990 This agreement is super palatable if you're like a commercial space operator, but it's less attractive if you're a foreign military. 09:39.250 --> 09:42.570 And this kind of starts to hint at the trust problem here, right? 09:42.570 --> 09:49.350 So at its core, there are only a few people, a few organizations in the world, who know what these objects are and where they're going. 09:49.350 --> 09:52.910 And everyone else has to trust whatever they tell them. 09:53.730 --> 09:57.830 So this makes it kind of an intuitive target for a cyber attacker. 09:58.050 --> 10:00.130 So why would you target SSA? 10:00.230 --> 10:02.750 Well, these databases are highly centralized, right? 10:02.750 --> 10:09.870 There are only a few in the world, and if you change a line in one of them, you can affect what thousands of organizations think outer space looks like. 10:09.930 --> 10:13.030 And those organizations probably can't catch you. 10:13.030 --> 10:21.890 They don't have a capability, they don't have the billions of dollars investment needed to double check where a small piece of debris is at any given point in time. 10:21.890 --> 10:29.330 And so they kind of just have to have blind faith that the information in the database is true about what's in space, because they can't see it themselves. 10:29.650 --> 10:43.710 So as an attacker, if you want to harm a satellite by, say, hiding a debris collision and causing it to crash, you have essentially bytes on a computer somewhere that you can change to have a very hard physical effect, blowing something up in outer space. 10:43.730 --> 10:56.510 If we're thinking about ways to blow up satellites, and you compare deploying a couple of zero days against the database, which isn't trivial, but certainly is feasible, versus building a national space program, developing anti-satellite missiles, dealing with the diplomatic follow-up from that, 10:56.510 --> 11:03.990 and deploying them accurately, it's pretty clear why a cyber attack factor might be a more attractive way to target a satellite. 11:04.770 --> 11:10.430 So let's talk about a couple of threat models, the sort of people who would engage in these attacks and what they would do and why. 11:10.510 --> 11:16.570 So the first, I think, is the most intuitive, and that is the owner of the repository decides to start lying to people. 11:17.090 --> 11:29.230 Since they're the only ones with access to a lot of this information, they're the only ones whose sensors pick up these objects, if they start lying, it's very unlikely they'll get caught in the act, and they can deceive whoever they want about the state of orbit. 11:29.230 --> 11:30.310 This comes at a cost, right? 11:30.310 --> 11:40.970 If they get caught in a lie, their database is no longer trusted, and people maybe are unwilling to rely on it, and they accidentally provide a legitimate degree because they don't believe other conjunction assessments. 11:41.090 --> 11:43.310 But at its core, it's something they could do. 11:44.070 --> 11:49.630 And a nation-state attacker who doesn't run one of these databases might say, hey, I want to discredit this database. 11:49.630 --> 11:55.290 It would be great if the US military spent billions and billions of dollars on an SSA network, and nobody believes what it says. 11:55.430 --> 11:58.930 And they could do that by, making the sensors less accurate with malware. 11:58.930 --> 12:07.490 It doesn't need to be particularly targeted, it just needs to change the measurements that are coming off of those radar sensors, such that the predictions are inaccurate. 12:07.590 --> 12:19.670 Or if they have a space program, they could launch objects that are deliberately designed to do nothing other than be difficult to track with radar or electro-optical telescopes, to kind of discredit the overall utility of one of these databases. 12:20.370 --> 12:29.350 Finally, if we're kind of talking about bread and butter cybersecurity, just some rando who wants to hack a database somewhere, fundamentally, this is just aligning a database. 12:29.370 --> 12:33.170 Military databases are hard to hack, but they're hardly unhackable. 12:33.350 --> 12:37.330 And additionally, this data doesn't just go directly from the military to the satellite. 12:37.330 --> 12:45.030 It's often sold to third parties who repackage it and sell it to individual satellite operators to incorporate into their integration processes. 12:45.290 --> 12:52.950 And so if you compromise one of those later recipients' databases, you may have a similar effect that's a little bit more targeted and a little bit easier to pull off. 12:53.910 --> 12:57.030 So when we talk about messing with this data, what does that look like? 12:57.030 --> 12:59.610 What do you have to change to achieve what kind of goals? 12:59.610 --> 13:01.090 And what can you achieve? 13:01.410 --> 13:04.450 So we're going to run through a very simple attack scenario. 13:04.550 --> 13:08.490 Our attacker's goal is to cause harm to a specific satellite in orbit. 13:08.710 --> 13:10.290 There are two ways to go about this. 13:10.290 --> 13:12.570 The first one, you've probably already guessed. 13:12.650 --> 13:22.870 If we see in that database that there's a piece of debris that will collide with the satellite in the future, we can tamper with the contents of that database to make it look like that piece of debris is no longer a threat. 13:22.890 --> 13:31.210 The result is a satellite operator moves along blissfully ignorant of impending doom until a satellite collides with a piece of debris that seems to come out of nowhere. 13:31.610 --> 13:34.450 From a physics perspective, this is trivial. 13:34.550 --> 13:46.410 If you change any component of a two-line element set, there's a really good chance that over a 72-hour forecast window, that debris object is going to be in a radically different place and no longer pose a threat to the satellite. 13:46.610 --> 13:52.270 So we want to focus on a slightly more nuanced version of this attack that's a bit more challenging and a bit more pernicious. 13:53.090 --> 13:57.330 So the idea here is we create a ghost collision. 13:57.330 --> 14:03.570 We take an object that doesn't collide with a satellite and we tamper it just a tiny bit to make it look like it will. 14:03.670 --> 14:11.010 The effect is that we call these guys in at 12 in the morning to deal with an emergency and engage in a debris avoidance maneuver. 14:11.130 --> 14:18.640 This burns fuel on the satellite, it causes mechanical wear and tear, it increases the cost and decreases the lifespan of their space missions. 14:18.860 --> 14:22.580 This is a more credible attack than you might initially think. 14:22.820 --> 14:24.820 You might have trouble imagining the U.S. 14:24.820 --> 14:29.340 military deciding to say, blow up an Iranian satellite by messing with SSA data. 14:29.340 --> 14:34.180 But it's not that hard to believe that someone would just kind of tip the scale a tiny bit. 14:34.180 --> 14:39.980 So that Iranian space missions are particularly unlucky with regard to how many debris objects they have to dodge. 14:40.200 --> 14:53.440 And over time, this has the kind of slow burn effect that we see space use in other contexts, like Stuxnet, which caused mechanical wear and tear on centrifuges for a nuclear power slash weapons program. 14:53.460 --> 14:56.760 And you might imagine a similar thing targeting a space program. 14:57.460 --> 15:00.140 So how do we go about doing this? 15:00.140 --> 15:04.800 Well, first we're going to start with some assumptions to keep the simulation very simple for today. 15:04.880 --> 15:08.020 The first is that we'll assume the database has already been compromised. 15:08.020 --> 15:15.480 Either the owner of the database is the one telling the lie, or someone We're not fundamentally interested in how you compromise the database. 15:15.760 --> 15:18.860 We're going to target data in the two-line element set format. 15:18.960 --> 15:27.320 This is a little bit not real world, in the sense that people tend to use more precise MRIs for their conjunction analysis. 15:27.480 --> 15:32.280 But two-line element sets are publicly available, which makes it easier to work with for research purposes. 15:32.520 --> 15:38.280 And fundamentally, if you can tell a lie with data, the format that data is in doesn't really matter. 15:39.400 --> 15:43.300 We're going to say that people trust the output of their conjunction analysis simulations. 15:43.460 --> 15:46.760 In the real world, if you see a collision, you may call up the U.S. 15:46.760 --> 15:50.080 military and say, hey, can you double check that this is actually going to happen? 15:50.620 --> 15:54.540 We'll assume that either that double checking process has been compromised, you could say the U.S. 15:54.540 --> 15:58.920 military is the attacker, or the victim doesn't do that for some reason. 15:59.320 --> 16:03.580 And then we're going to define the collision pretty generously as a pass within one kilometer. 16:03.800 --> 16:05.080 You can do this much smaller. 16:05.080 --> 16:08.500 We've had success with passes as low as 100 meters. 16:08.500 --> 16:17.880 But the reality is that a wider zone of collision increases the likelihood of finding a candidate quickly from a computational complexity perspective. 16:18.080 --> 16:23.700 And in this case, because two-line element sets are only that accurate anyway, more precise is kind of meaningless. 16:24.640 --> 16:26.160 So here's our target. 16:26.160 --> 16:28.680 It's an Iridium satellite over the Atlantic Ocean. 16:28.680 --> 16:31.660 And it has an orbit that looks something like this. 16:31.680 --> 16:42.650 And we're going to try to an element in this debris field of 10,000 objects taken from spacetrack.org to see if we can make one look like it'll collide with the satellite over the next 72 hours. 16:42.810 --> 16:50.590 To filter down these objects, because we have a lot, we're going to only measure the time of closest approach for objects that pass within this sphere. 16:50.670 --> 16:52.950 So let's go ahead and see what that looks like in the lab. 16:53.030 --> 16:59.070 So what we're doing is we're looking for debris objects that pass within that zone, and then we're seeing where they pass closest to the satellite. 16:59.270 --> 17:11.030 The intuition here is that an object that already looks like it will pass closely would be easy to tamper with to create one of those phantom collisions that we're trying to generate, because you'd have to only make small changes to move its orbit, say, 17:11.170 --> 17:13.570 a couple hundred years in one direction or the other. 17:14.090 --> 17:17.070 Now, the size of our debris field here is 10,000 objects. 17:17.070 --> 17:18.690 You can do this with a larger debris field. 17:18.690 --> 17:26.110 It just takes longer to hunt down candidates, but you're also more likely to find a good candidate that passes closer the bigger the debris field. 17:26.110 --> 17:31.670 So there's a bit of a trade-off between how much computing time you want to put into this and how accurate of a collision you want to find. 17:32.470 --> 17:40.490 Here I'm propagating for just a couple of days, I think 48 hours or something, and we're going to take our top five candidates for manipulation and try to tamper with them. 17:40.550 --> 17:47.410 So if we look at the results here, we see that our best candidate passes within 3.8 kilometers of our target, which is excellent. 17:47.490 --> 17:56.970 This means we only have to modify this object's orbit by three kilometers in the correct direction, and it'll look like it's going to collide with the even when it's not. 17:56.970 --> 17:59.690 So that's the scale of the violin at this hour. 17:59.830 --> 18:01.650 Now this initially sounds easy, right? 18:01.650 --> 18:03.230 You just change the bytes. 18:03.230 --> 18:10.050 But it's a little harder than you would think, because we need to get this specific object into a new orbit over the next 72 hours. 18:10.050 --> 18:14.230 We need to change how it's moving through space pretty substantially in the database. 18:14.350 --> 18:22.570 We also need to have it appear like it'll be in a specific location, that zone of collision, at a specific time when our target satellite is also there. 18:22.670 --> 18:28.390 And we need to do all of this with only making tiny modifications to the line in that database, right? 18:28.390 --> 18:31.130 We want it to look like friction might have caused this object to shift. 18:31.130 --> 18:35.810 We don't want it to look like someone just deleted their own database and created a completely brand new object. 18:36.530 --> 18:39.410 So this is a pretty hard astrophysics problem. 18:39.410 --> 18:42.910 I don't think it's unsolvable, but it's definitely beyond me. 18:42.970 --> 18:45.350 But what I can do is guess and check. 18:45.390 --> 18:51.870 So what I did is input a genetic algorithm, which is essentially a fancy way of saying I threw things at the wall to see what would stick. 18:51.870 --> 19:01.510 And we defined our individuals in this genetic algorithm as a set of characteristics that were changes to four fields in the two-line element set. 19:01.650 --> 19:23.010 And the idea is that in each generation of this genetic algorithm, we determine the likelihood that one of these changes gets passed on to the children of this individual on the basis of a fitness function, which was defined as the distance between our fake ghost debris object and the target we're trying to collide with at the time of closest approach. 19:23.150 --> 19:32.390 Now, we could have added a stealth metric here to minimize the amount we have to change these fields if we were particularly worried about detection, if we were particularly worried that this was being monitored. 19:32.410 --> 19:39.930 But for simplicity purposes, we set this as a very high bound and just a hard cap, that we weren't allowed to modify any of these fields by more than 10%. 19:39.930 --> 19:50.470 In practice, we modify most of these fields by a fraction of a percent , but eccentricity in particular tends to need to be modified a little bit more because of the precision of the format. 19:50.470 --> 19:56.470 Although you can find collisions within much smaller zones, it comes at the cost of more computational time. 19:57.270 --> 20:00.750 Once we've kind of run our scenario, we get an output that looks like this. 20:00.750 --> 20:08.230 So in this case, we found a collision for our targeted object within three generations that passes within a kilometer of our target. 20:08.250 --> 20:13.850 If you look at the malicious two-line element set on the top and the original one on the bottom, you'll see that they're pretty similar. 20:13.850 --> 20:23.070 And if someone wasn't actively looking for data tampering impacts, it'd be pretty hard to identify that this object has been hacked to look like it's going somewhere it isn't. 20:23.730 --> 20:26.230 Let's see what the result of that is in our simulations. 20:26.430 --> 20:40.050 So we'll see the objects kind of move along just like they did before, but over time there's that slight difference such that at the time of closest approach, our malicious debris object passes well within this sphere around the iridium satellite, which is one kilometer across. 20:40.050 --> 20:44.350 And so at this point, we have caused a collision to appear like it will happen. 20:44.350 --> 20:50.870 The iridium operator will steer their satellite, even though they don't have to, and they'll increase their mission cost and decrease their mission lifespan. 20:51.490 --> 20:53.650 So how do we protect against these kinds of attacks? 20:53.650 --> 20:56.010 How do we prevent this kind of manipulation? 20:56.530 --> 21:00.750 If you're a satellite operator and you're thinking, how do I keep my SSA data secure? 21:00.750 --> 21:02.490 There are a couple of things you can do. 21:02.490 --> 21:07.310 The first is to get higher quality data where you can to enter into those data sharing agreements. 21:07.390 --> 21:13.050 This particular demonstration was made much easier by the fact that our zone of collision was one kilometer. 21:13.050 --> 21:27.050 The smaller that zone of collision gets, the more accurate your data is, the more likely an attacker is to have to work hard with like a larger debris field or more genetic algorithm generations or bigger tampering effects to find a collision that will trigger an alert. 21:27.050 --> 21:33.770 So you really increase the cost and the complexity for the attacker, even if you don't fully get rid of the risk of someone lying to you. 21:34.170 --> 21:36.830 You might also want to see if you can vet your data, right? 21:36.830 --> 21:47.250 There aren't any databases that fully match the US militaries, but even something with like 30% coverage at least gives you a second source for truth on those 30% of objects that they do know about. 21:47.410 --> 21:52.670 And you might think about also comparing your internal data with the public data from the US government. 21:52.670 --> 21:59.270 So you can say, hey, my database says a prediction that the US government doesn't, even though the source data should be the same. 21:59.270 --> 22:01.610 That's a pretty good indicator of compromise. 22:02.410 --> 22:06.090 If you're a nation-state actor, there are a couple of different ways to think about this. 22:06.090 --> 22:18.030 If you run an SSA database, so if you're the US, Russia, or China, you need to understand that those bytes on a computer are critical strategic resource that someone might try to mess with from a cybersecurity perspective. 22:18.030 --> 22:23.410 They might do this to discredit your information, to cause harm to one of your own satellites, or someone else's satellite. 22:23.410 --> 22:32.330 But fundamentally, as a nation, you have an obligation to recognize the importance of these specific databases as some of the most important space data you hold. 22:32.510 --> 22:37.290 Additionally, I think it's important to disavow any funny business in SSA. 22:37.330 --> 22:46.670 Right now, the US military has a statement on their website that basically says that the data from spacetrack.org could be manipulated at any time for national security purposes. 22:46.670 --> 22:54.550 And I understand the logic behind this, but I think standing by SSA data is an important step towards protecting the space environment in the future. 22:54.550 --> 23:08.290 And publicly disavowing and ascribing a diplomatic cost to getting caught concealing or manipulating SSA data, I think is an important step towards credibly building a system where people can trust what space looks like. 23:09.110 --> 23:23.470 Finally, if you're a smaller country, you might not have a full space surveillance network, but you may have a couple of telescopes or a couple of radar sensors that you can use to kind of randomly sample and audit specific objects and say there's supposed to be a debris object there today. 23:23.470 --> 23:24.710 Is there anything? 23:24.710 --> 23:30.430 And use that to kind of catch at least some tampering attacks in these databases and get a sense of their reliability. 23:30.430 --> 23:34.890 So to sum things up, SSA is fundamentally about trust. 23:34.890 --> 23:46.690 There is someone out there who is the only person who knows the truth about these objects and is telling it to you, and you have no way fundamentally to get that physical reality and ground truth information for yourself. 23:46.830 --> 23:49.750 This trust is intuitively abusable. 23:49.750 --> 24:02.650 You can change information in an SSA database through some very basic orbital physics operations to make it tell a prophecy that isn't true, to create a phantom collision, or to conceal an impending collision with catastrophic effects. 24:02.950 --> 24:21.570 We think that we can fix this by recognizing that SSA is an information target that can be used to cause physical effects in space, and so as a result, building responsibility and verification into the SSA process is a key step towards recognizing that trust is as important as truth in these databases. 24:22.410 --> 24:27.210 Thank you so much for listening to my presentation, and I'm happy to answer any questions. 24:27.210 --> 24:32.790 Hopefully I've gotten you thinking about kind of interactions between the physics of space and the cybersecurity properties.