Cybersecurity in Space: Threats, Defences and UK Rules

Every card payment you tap, every sat nav route and every weather forecast on the evening news leans on satellites. Most people never give them a second thought. Attackers do. Space cybersecurity is the work of keeping those satellites, their radio links and the ground systems that control them out of the wrong hands. It has moved from a niche defence topic to something that touches households across the UK and Ireland.

The clearest proof came on 24 February 2022. A cyber attack on the Viasat KA-SAT network knocked tens of thousands of satellite modems offline across Europe within hours. Nobody touched the satellite itself. The attackers went through the ground network, which is exactly where most real-world risk sits.

This guide explains what space cybersecurity covers, the five parts of a space system that attackers target, and the incidents that changed the industry. It then covers defences that work in orbit, the UK, Irish, and EU rules operators face, a pre-launch checklist and common questions.

What Is Space Cybersecurity?

Space cybersecurity is the practice of protecting spacecraft, their radio links, the ground stations that command them and the supply chains that build them. It guards against unauthorised access, disruption and data tampering across civil, commercial and defence missions.

The reason it matters is dependence. The UK government lists the loss of positioning, navigation and timing (PNT) services in its National Risk Register. Research by London Economics, published by the government in 2023, estimated that a 24-hour outage of satellite navigation would cost the UK economy £1.4 billion. A seven-day outage would cost around £7.6 billion, with emergency services, road transport and shipping taking most of the hit.

Satellite timing signals also keep mobile networks, energy grids and financial systems in step. That’s why a problem in orbit rarely stays in orbit. New to some of these terms? Our glossary of key cyber definitions explains the basics in plain English.

The Five Parts of a Space System Attackers Target

Security agencies and researchers split a space mission into segments. Each one has different weak points, and a mission is only as secure as its weakest segment, which is rarely the satellite itself.

Segment	What it includes	Common weak points
Ground	Mission control, antennas, cloud ground stations, operator networks	VPNs, remote access, cloud permissions, staff accounts
Link	Uplink, downlink and links between satellites	Jamming, spoofing, eavesdropping, replayed commands
Space	Satellite platform, flight computer, payload	Unauthenticated commands, ageing software, no easy patch route
User	Modems, dishes, receivers, connected devices	Default passwords, firmware flaws, remote management tools
Supply chain	Chips, software libraries, test and launch equipment	Tampered parts, unsigned updates, supplier access

Ground Segment: The Usual Way In

Ground systems are ordinary IT networks with unusual consequences. Operators log in remotely, and antennas are managed online. The phishing emails, stolen passwords, and unpatched VPNs that hit any office can reach a spacecraft’s command chain. Dr Daniel Fischer leads ground segment and cybersecurity engineering at the European Space Agency (ESA). In 2023 he put it plainly: “The main threats that target space infrastructure are not new.”

ESA has since learnt this first-hand. On 30 December 2025, it confirmed that attackers had breached a very small number of servers outside its corporate network, used for unclassified collaborative engineering work. The attacker claimed to have taken around 200GB of data, a figure ESA has not confirmed.

A newer risk comes from Ground Station as a Service (GSaaS). Providers such as AWS Ground Station let operators book antenna time and receive data straight into a cloud account, which cuts costs for small missions. The catch is that a misconfigured permission or leaked API key can expose telemetry, or even command access, to whoever holds it.

Link Segment: Jamming, Spoofing and Eavesdropping

Radio links are the most exposed part of any mission. Anyone in range with the right equipment can transmit on the same frequency. Jamming drowns a signal in noise. Spoofing sends a fake signal that looks genuine, so a receiver calculates the wrong position or time. Meaconing, a close cousin, captures a real navigation signal and rebroadcasts it with a delay.

Older satellites often sent telemetry, and sometimes commands, without encryption, assuming only a government could afford the kit to interfere. Cheap software-defined radios ended that assumption. Mobile networks face a similar problem on the ground, and our guide to 5G technology cyber attacks shows how signalling weaknesses there create comparable openings.

Space Segment: When Code Becomes a Physical Risk

Satellites run flight software on radiation-hardened processors that are slow by modern standards, with little memory to spare for security tools. The hardware can’t be repaired after launch, and updates travel over the same links attackers target.

Here space cybersecurity differs from office IT: a compromised satellite can cause physical damage. An attacker with access to attitude control or propulsion could point sensitive instruments at the Sun, drain the batteries or change the orbit. In crowded low Earth orbit, a satellite nobody can steer also becomes a collision risk, and every collision adds debris that threatens other spacecraft.

User Terminals and the Supply Chain

User terminals are the dishes, modems, and receivers customers own. They are numerous and often poorly maintained, and in the Viasat case, they were the devices that were wiped. Most are managed remotely by the provider, which is convenient until that management system is compromised.

Further back sit the suppliers and integration teams who build and test a spacecraft. A tampered chip or poisoned software library can reach orbit unnoticed. Checking where each part came from and signing all flight software are the main defences. Our article on supply chain blockchain explains one way to track parts across many suppliers.

Real Attacks That Shaped Space Cybersecurity

Publicly confirmed attacks on space systems are rare, partly because operators seldom disclose them. The three cases below are well documented and changed how the industry thinks.

The Viasat KA-SAT Attack, February 2022

On the morning Russia invaded Ukraine, attackers entered the KA-SAT management network through a misconfigured VPN appliance. From there, they used legitimate management commands to push a wiper, later named AcidRain, to customer modems. The malware overwrote each device’s flash memory, leaving tens of thousands of modems unable to restart across Ukraine and parts of Europe.

The damage spread well beyond the war zone. German turbine maker Enercon lost remote control of around 5,800 wind turbines, though they kept generating power. On 10 May 2022, the UK, the EU and allied governments publicly attributed the attack to Russian military intelligence. Viasat found no evidence that normal modem update processes were compromised. The lesson is plain: the ground management layer, not the satellite, was the target.

GNSS Jamming Over the Baltic

Satellite navigation interference has become routine in parts of Europe since 2022. In March 2024, the RAF jet carrying the then Defence Secretary Grant Shapps lost its GPS signal for about 30 minutes near Kaliningrad. In May 2026, Defence Secretary John Healey’s flight home from Estonia reportedly faced around three hours of interference. A UK defence source blamed Russia.

In October 2025, the International Civil Aviation Organization formally condemned Russia and North Korea, ruling that this interference breaches the 1944 Chicago Convention. Aircraft carry backup systems, so flights are rarely in direct danger, but the incidents show how easily a whole region can lose signals from orbit.

The OPS-SAT Ethical Hack, April 2023

At the CYSAT conference in Paris, the European Space Agency invited ethical hackers to attack OPS-SAT, a small demonstration satellite launched in 2019. A four-person Thales team used standard access rights to reach its application environment, then exploited several flaws to plant malicious code. They could alter camera images before they reached the ground and hide selected areas from view. ESA kept overall control throughout.

Afterwards, Thales Vice President of Cyber Solutions Pierre-Yves Jolivet said the industry needs to “take cybersecurity into account at every stage in the satellite’s life cycle”. It sounds obvious, yet plenty of older missions ignored it.

How Attackers Think: The SPARTA Framework

Defenders need a shared language for describing attacks. For space systems, the most widely used public reference is SPARTA, built by The Aerospace Corporation in the United States.

SPARTA, short for Space Attack Research and Tactic Analysis, works much as MITRE ATT&CK does for corporate networks. It sorts public information about spacecraft attacks into tactics (what the attacker wants) and techniques (how they get it). Engineers use it to plan tests and map controls to standards such as NIST SP 800-53 and ISO 27001.

The table below pairs six SPARTA tactics with the parts of a mission most at risk and the countermeasures that address them.

SPARTA tactic	Attacker’s goal	Parts most at risk	Main countermeasures
Reconnaissance	Learn frequencies, orbits, staff and suppliers	Public filings, staff profiles, ground networks	Limit published detail, staff awareness training
Initial Access	Gain a foothold	Ground VPNs, cloud accounts, suppliers	Multi-factor authentication, patching, supplier checks
Execution	Run commands or code	Flight software, command links	Command authentication, code signing
Persistence	Survive reboots undetected	Onboard memory, ground servers	Secure boot, memory integrity checks
Exfiltration	Steal data	Downlinks, payload data	Link encryption, collecting only needed data
Impact	Deny, degrade or destroy	Attitude control, power, payload	Protected safe mode, recovery channel, anomaly detection

Building Defences That Work in Orbit

Good space cybersecurity starts on the drawing board, because a satellite can’t be recalled for repairs. The four areas below give operators the most protection for the effort involved.

Zero Trust on Limited Hardware

Zero trust means no command, user, or device is trusted just because it comes from inside the network. Every request gets checked. In an office, that relies on identity software far too heavy for a radiation-hardened flight computer with tight limits on size, weight, and power.

On a spacecraft, the same idea is applied more simply. Every telecommand is authenticated with a key held in dedicated hardware. Payload software is kept apart from the systems that fly the satellite, and short-lived session keys limit the damage if one leaks. Commands that could change the orbit or switch off safety modes can require a second, independent approval. These are the same core cybersecurity principles used on any network, adapted for hardware nobody can service. An unencrypted, unauthenticated command link on a new commercial satellite is no longer a defensible design choice.

Encryption and the Quantum Question

Satellites launched today may still be working in the 2040s, which creates a specific problem. Data captured from a downlink now could be decrypted later if quantum computers break today’s public-key methods. This tactic is known as harvest now, decrypt later. Long-lived missions should be able to swap cryptographic algorithms by software update rather than having them hard-coded. We cover migration timelines and the new NIST standards in our guide to encryption in the post-quantum era.

Securing Cloud Ground Stations

Cloud ground stations need the same care as any production system. Operators should give each mission its own isolated account, grant only the permissions it needs, rotate API keys regularly, and log every contact request. Telemetry and commands should be encrypted end-to-end, so the cloud provider only ever carries traffic it cannot read or alter.

Spotting Trouble Early With Telemetry

A satellite sends back constant health data: temperatures, power levels, orientation and software status. Unusual patterns are often the first sign of a fault or an intruder. Machine learning models trained on normal behaviour can flag odd readings quickly. Every mission also needs a protected recovery mode that works even if the main flight software has been tampered with.

Who Regulates Space Cybersecurity? UK, Ireland and EU Rules

No single global body regulates space cybersecurity. Obligations come from national licensing law, EU legislation and voluntary standards. Our overview of cybersecurity laws around the world shows how these frameworks fit together.

Jurisdiction	Main instruments	Legal status	What operators must do
UK	Space Industry Act 2018, Space Industry Regulations 2021	Mandatory for licensees	Cybersecurity strategy, risk assessment, CAA monitoring
EU	NIS2 Directive, proposed EU Space Act	NIS2 in force; Space Act under negotiation	Risk management, incident reporting, supply chain security
Ireland	NIS1 rules, National Cyber Security Bill (pending)	NIS2 not yet transposed	NIS1 duties now; NIS2 duties once enacted
US	Space Policy Directive 5, NIST IR 8270	Largely voluntary for commercial operators	Framework-based controls and good practice

Waiting for an international treaty on space cybersecurity is not a plan. National licensing rules are what change operator behaviour today.

The UK: Space Industry Act 2018 and the CAA

The Space Industry Act 2018 governs launches, spaceports and orbital operations from UK soil, with the Space Industry Regulations 2021 setting out the detail. The Civil Aviation Authority (CAA) is the regulator. Every licence applicant must submit a cybersecurity strategy based on a cyber risk assessment and, where required, a safety case. The CAA has adopted the National Cyber Security Centre’s Cyber Assessment Framework and sets out its expectations in its CAP2535 guidance for licence applicants. UK organisations running space activities from overseas are licensed under the Outer Space Act 1986 instead.

Since 1 April 2026, the UK Space Agency has been a directorate within the Department for Science, Innovation and Technology rather than an executive agency, though it keeps its name.

The EU: NIS2 and the Proposed EU Space Act

The EU’s NIS2 Directive lists space as a sector of high criticality. In June 2025, the European Commission proposed an EU Space Act with dedicated cybersecurity rules, including cryptography requirements, supply chain checks and threat-led penetration testing.

Negotiations were still running in 2026. The Council’s compromise would keep space operators inside NIS2 through a sector-specific implementing act. The European Parliament’s industry committee wants space cybersecurity handled entirely through NIS2. Operators selling into EU markets should plan for these rules wherever their satellites were built.

Ireland: Growing Space Activity, Delayed Cyber Law

Ireland is a founding member of the European Space Agency. EIRSAT-1, its first satellite, built by University College Dublin students, flew from December 2023 until it re-entered the atmosphere in September 2025. Its cybersecurity law has lagged behind. The National Cyber Security Bill, which will transpose NIS2, had not been enacted by September 2026. It would also give Ireland’s National Cyber Security Centre a statutory footing. On 8 July 2026, the European Commission referred Ireland to the Court of Justice of the EU over the delay. Until the Bill passes, the older NIS1 rules continue to apply.

US Benchmarks

Space Policy Directive 5 (September 2020) set out cybersecurity principles for space systems. NIST IR 8270 (July 2023) applies the NIST Cybersecurity Framework to commercial satellites. Neither binds UK or Irish operators, but both are common reference points.

A Pre-Launch Space Cybersecurity Checklist

The steps below turn the guidance above into a practical sequence. They follow a mission from design through build to the final weeks before launch.

1. Design: identify the critical functions (command, power, attitude control and propulsion) and threat-model each one against SPARTA.
2. Design: build in a hardware root of trust and authenticate every telecommand.
3. Design: separate payload software from flight control software so one cannot take over the other.
4. Design: plan for cryptographic agility, so algorithms can be replaced after launch.
5. Build: record the origin of every critical component and software library.
6. Build: sign all flight software and keep signing keys in hardware security modules.
7. Build: limit and log supplier access to test and integration systems.
8. Pre-launch: penetration test the ground segment, including cloud ground station accounts and APIs.
9. Pre-launch: test a protected recovery mode that works even if the main software is compromised.
10. Pre-launch: rehearse incident response with the ground team and agree who reports to the CAA or other regulators, and how quickly.

Most of these steps match what the CAA asks to see in a cybersecurity strategy, giving UK applicants a head start.

Why Space Cybersecurity Is Everyone’s Business

The biggest change in space cybersecurity is who carries the risk. Satellites were once mostly government-owned. Now commercial constellations serve millions of customers, and many operators are small firms using cloud ground stations and off-the-shelf parts. The old belief that obscure radio protocols and complex orbits keep attackers out now looks badly dated.

For operators, the priorities are clear. Secure the ground network first, authenticate every command, and know where every component came from. Treat the regulator’s strategy document as a working plan, not paperwork. For everyone else, it helps to understand how much daily life depends on signals from orbit.

Frequently Asked Questions

These are the questions readers ask most often about space cybersecurity, from satellite hacking to who sets the rules.