Nature top threat to space cybersecurity, Estonia’s space chief warns

Nature, inexperienced operators, and hackers are the top three threats to consider when it comes to cybersecurity in space networks, Estonia’s space policy and technology head Paul Liias says.

From satellite communications and navigation to environmental monitoring, space-based systems are a silent workhorse of modern-day civilization, playing an increasingly important role in the world’s economy and our day-to-day lives.

As such, companies and national governments have a responsibility to manage and protect these systems with proper cybersecurity measures, says Liias ahead of this year’s three-day Software Defined Space Conference starting October 31st in Tallinn, Estonia.

While the scenario in which thousands of active satellites now orbiting the Earth suddenly go offline would result in a “huge mess” comparable to the onset of a global pandemic, chances of it ever materializing are slim, Liias says.

State-supported services could bring down the cost barrier standing in the way of bolstering cybersecurity in space and regulation has also a part to play.

While space networks remain vulnerable, the changing mindset – and satellite design that allows for more frequent hardware updates – will help mitigate the risks, Liias says in an interview with Cybernews.

It is estimated that there are just over 7,700 active satellites orbiting the Earth. Some are reportedly easier to hack than a Windows computer. What would happen if all of them were suddenly taken offline?

I'm not that pessimistic because the likelihood that all of them can be taken down in a day or even longer period is very slim. So, this scenario is very unlikely. If it did happen, it would be a disaster. The first day would be a huge mess.

According to the European Commission, 7% of Europe’s GDP depends on GNSS, or satellite navigation. This means that losing satellite navigation alone could lead to a huge economic disaster, similar to what we’ve seen when the Covid started.

It affected mainly the tourism sector, but also many other sectors. In this case, we would have a real crisis in the technology sector and all the logistics would be affected as well.

Many of the satellites orbiting the Earth form constellations that belong to a single organization. If something happens to one constellation, then it will have quite a huge effect on the economy.

Satellite internet is the rising star. Many new services are built in a way that they have to use satellite communication. Many new businesses will get more dependent on it.

A year ago, the head of the US Space Operations Command, Lieutenant General Stephen N. Whiting, said that cybersecurity is the “soft underbelly” of space networks. Is it still, and what has changed since then?

In the space domain, not that much has happened in a year because all the space projects take much longer. So we are still in the same situation.

Just to understand the space cyber domain better, it’s worth noting that even four or five years ago, most of the people I discussed this topic with were very critical of it. Why would anyone hack a satellite, they asked. What’s the benefit? There was no economic value in the space segment.

The second point was – why should the industry even think about space cybersecurity? There’s so many things to do on the ground.

Now, people really started thinking about it. While there are still critical voices, they are few and far between. The issue is now central, and the threat of attacks on satellites is taken seriously. There’s an understanding that we need to prepare for it.

So, there’s been a shift in the mindset that space infrastructure is important. And we need to protect it. And what we are doing in Estonia is exactly that. With all the knowledge that we have gathered on the ground about how to protect our e-government systems, we can bring this knowledge to the space domain to make space systems more secure and safe.

Another thing to keep in mind is that the way satellites are designed is different than before. Today, the satellites are being launched mainly to low-Earth orbit, meaning that the missions are meant to last for up to five years, maybe even shorter, and the hardware will be updated more frequently. The satellites will be relaunched after one year, two years, five years. So, for the industry, it's easier to update the missions.

Some of the earlier satellites were designed for 15 years. You can imagine there is a 15-year-old computer somewhere in orbit, and you cannot do much ten years later. But the space segment is changing, and it makes it safer for the operators and owners because you can update the hardware faster, and you can be prepared for potential threats that may occur in the next days, weeks, or months.

Price can be an obstacle when it comes to cybersecurity – here on Earth and in space alike. This is especially true for smaller businesses. You previously said that accessibility and affordability are key to ensuring necessary levels of cybersecurity in space. How do you bring the price down?

The main challenge is how to access this knowledge and how to access the services. If a service or a product is unique, of course, it is expensive. The question today is why. And then the second question is, how can I access it? Therefore, it's very important to have clear services that will help with the design and operation of the satellite.

There are different ways to do it. In Estonia, we are developing different services that can be used by satellite operators and developers. These include the protection of the ground stations and software security testing, making sure that the mission is safe and secure even before the satellite is launched.

The idea is to focus not only on the defense sector but also on the commercial sector so that all satellite owners think about safety requirements and potential flaws so that their missions are safe from attacks.

We also need to raise awareness and learn how to behave in situations where something happens in orbit, so the satellite developers should simulate crisis situations. A space cyber security exercise is a very good tool to prepare for the unknown.

According to the FBI, space industry espionage is a growing cyber threat, with both China and Russia named as actively trying to steal research and trade secrets. What are some of the other emerging threats you foresee in the short and longer terms?

The main threat for space systems is still nature. Space weather is one of the main threats.

As more and more people go to space and we have more and more satellite operators, then a human factor is also an increasing threat. If the satellite was designed in the wrong way or operated in a way it shouldn’t have been, it may lead to collisions. The more operators we have, the bigger it becomes an issue.

Therefore, it is very important that every government gets involved. We regulate space in Europe. Many European countries are doing it already. Estonia is working on the national space law with the aim of regulating exactly how satellite registration works, how to design a satellite, and how to operate the satellite.

There's also the threat of hackers who operate on the orders of a state actor or simply want to prove they can hack a satellite. While by way of espionage, you can predict the goals of a hostile country, it is still very difficult to control.

Nature, inexperienced operators, and hackers are the three main challenges that are very hard to predict.

The global space economy could grow to more than a $1 trillion business in a decade or so, with the US being the main driver of this growth. How can smaller countries take advantage of this boom?

If there is an economic boom, it means that everyone who has an ambition is able to make some money and benefit from it, especially the small countries. The size of the country or company doesn’t even matter. What’s important is to find the right niche and to understand one’s capabilities, to find the right way to spin from the ground technology to the space domain.

And what I have always said is that the Estonian space policy helps to create a market for the Estonian technology industry, and what we are doing, or what I'm doing here in the Ministry of Economic Affairs, is that I'm learning how the space domain develops and also finding the new niches for the Estonian industry.

We have the technology and the capabilities to solve space safety and security issues. That is our niche, and it’s very important. Everyone has a chance to grow in the space domain. And there are many good opportunities out there.