6. Conclusion
This paper addresses the subject of potential vulnerabilities of space-dependent strategic systems to cyberattacks. With the awareness that NATO and the NCI Agency are already working on protecting NATO’s space-dependent systems, this paper has provided complementary analysis and insights regarding the issues at stake.
Today, norms around space security are considered lax: this also applies to those around cybersecurity. The Manual on International Law Applicable to Military Uses of Outer Space (MILAMOS), which is similar in scope to the Tallinn Manual (see above), was launched in 2016 through a civil society initiative, aiming to clarify the rules applicable to the military use of outer space.74 The United Nations has appointed GGEs on cyber and space developments. Unfortunately, the most recent space GGE failed to reach agreement (not in itself an uncommon occurrence for either group in their successive forms).75 It is imperative to create ongoing efforts and synergy between the cyber GGE and space GGE. Establishing norms of secure cyberspace would also improve space security.
It is important to realize that the conduct of warfare has changed drastically in the 21st century. The definition of peacetime and conflict time activities is becoming increasingly blurred. There is no consensus on how to interpret attacks on space-based systems or on cyber networks, whether in crisis or in peacetime.
Russia continuously tests NATO’s maritime and air domains in multiple geographies, including through space means. Deciding on what would be the threshold of hostile intent in space could help to synchronize efforts among NATO allies. Moreover, NATO’s defence posture cannot only rely on how to win the next conflict or how to manage vulnerabilities: it should make sure that threats do not materialize through effective deterrence postures.
NATO has not yet defined space as a domain, though some allies recognize it as such. Current political structures at NATO, however, err on the side of caution, and it is claimed that NATO will recognize space as a domain in the upcoming London Summit.76 After the adoption of the Space Policy, perhaps there would be a window of opportunity to define space as a domain. It could kick off a future study on what constitutes such a domain, what type of similarities and divergence cyber shares with space, and whether a similar approach could be modelled for space. For instance, if NATO declares space as a domain, it could create a joint Bilateral Strategic Commands (Bi-SC) – NATO Allied Command Transformation and NATO Allied Command Operations – vision of space. A Bi-SC vision would set out minimum requirements, conduct capability analysis, and assess collective assets vis-à-vis the command structure.
Protection of critical national infrastructure would not only improve civilian preparedness and resilience: it would also help to minimize impacts on the military sector. The NATO Pipeline System, for instance, that NATO forces rely on for refuelling and storage, uses a command and control structure to link ‘storage depots, military air bases, civilian airports, pumping stations, truck and rail loading stations, refineries and entry/discharge points.’77 This command and control structure relies on civilian ground and satellite communications; hence there is reliance on the GPS/GNSS systems. As a result, the security of civilian sectors is directly linked with protecting military objectives. The EU, for instance, budgeted €6.5 billion to support dual-use infrastructure for the transportation sector, with the aim of adapting Europe’s transportation sector to military requirements.78 Inclusion of the space element in existing infrastructure considerations within the EU could help improve resilience.
An assessment of the extent to which NATO can access Galileo – the EU global satellite-based navigation system – and what such a configuration would look like, would be helpful for protecting operations. NATO should also consider how space technology could strengthen deterrence postures, ensuring that serious threats would not materialize at times of crisis.
If capabilities remain in national hands NATO’s role in the space realm should be considered. It could have the following functions:
- Intelligence;
- Creating dialogue with the space components industry;
- Operational planning; and
- Coordination/liaison with the allies on personnel requirements, in order to improve alliance knowledge and capacity on the use of space technology in NATO operations.
In many areas, NATO allies that have either not invested in space technology or do not have sufficient capability to protect their systems, look to NATO as an informative entity that could guide them towards the best approach for space security. If NATO’s role in the space realm were to be clarified as discussed above, this could help those allies to perform their obligations.
NATO’s level of ambition for defence is to be able to have real-time Command, Control, Communications, Computer, Intelligence, Surveillance and Reconnaissance (C4ISR) capability in all four domains. Protection of space services should be at the core of this ambition.
Today, commercial ISR capabilities rival military capabilities. Thus, working effectively with industry to ameliorate and strengthen ISR capabilities, and seeking out innovation in a cross-disciplinary environment, would help NATO to project its power and improve its response speed to threats. The industry could also be held accountable in case of cyber breaches and potential misconduct. Industry could also play a fundamental role in incorporating safe and secure technologies into the space realm.
It is clear that human societies are dependent on space, but it is less clear how to mitigate cyber risks and protect space assets. To improve resilience, those designing mitigation measures should consider:
- Technological aspects, such as incorporating terrestrial back-ups for guidance systems, or investing in quantum systems for secure communication.
- The value of investing in assurance/redundancy systems.
- Recovery capacity, including how quickly a system could be fixed or what type of forensic applications may help to aide attribution problems, how quickly NATO could achieve full operational readiness, and so forth.
- Organizational culture and human resources aspects, such as training and education and human-in/on-the-loop considerations,79 while incorporating emerging technologies, especially artificial intelligence.
74 McGill University Institute of Air & Space Law (n.d.), https://www.mcgill.ca/iasl/milamos (accessed 10 May 2019).
75 The draft report of the space GGE was made public as an annex to the following working paper submitted by Nigeria on behalf of the UN African Group: see UN Disarmament Commission (2019), ‘Recommendations to promote the practical implementation of transparency and confidence-building measures in outer space activities with the goal of preventing an arms race in outer space, in accordance with the recommendations set out in the report of the Group of Governmental Experts on Transparency and Confidence-Building Measures in Outer Space Activities’, Working Paper A/CN.10/2019/WP/1, https://digitallibrary.un.org/record/3801525 (accessed 10 May 2019).
76 Emmott, R. (2019), ‘Exclusive - NATO aims to make space new frontier in defence’, Reuters, 21 June 2019, https://uk.reuters.com/article/uk-nato-space-exclusive/exclusive-nato-aims-to-make-space-new-frontier-in-defence-idUKKCN1TM17F (accessed 27 Jun. 2019).
77 NATO (2017), ‘NATO Pipeline System’, https://www.nato.int/cps/en/natohq/topics_56600.htm (accessed 10 May 2019).
78 European Commission (2018), ‘EU Budget: Commission proposes increased funding to invest in connecting Europeans with high-performance infrastructure’, press release, 6 June 2018, http://europa.eu/rapid/press-release_IP-18-4029_en.htm (accessed 10 May 2019).
79 Human in/on the loop is a concept that explains human-machine interaction and the role of humans and human control in (semi) autonomous systems.