Should space be designated as critical infrastructure?

As of March 5th, 2025, using the satellite tracking website Orbiting Now, there are 11,833 active satellites in various Earth orbits. Over 60% of them are commercial spacecraft. And increasingly, we're becoming reliant on their support for everyday occurrences. Given that reliance, should space be designated as critical infrastructure? Are we doing enough to protect our space-based assets? Welcome to T-Minus Deep Space from N2K Networks. I'm Maria Varmazis. Our guest today is Jake Braun, Executive Director of the Cyber Policy Initiative at the University of Chicago. And Jake is the former White House Principal Deputy National Cyber Director and Chairman of DEF CON Franklin. And I wanted to ask his opinion on designating space as critical infrastructure and get an overview of its attack surface. My name is Jake Braun. I am currently the Executive Director of the Cyber Policy Initiative at the University of Chicago, but maybe more relevant for this conversation. I was most recently, as of about six months ago, eight months ago, the Acting Principal Deputy National Cyber Director in the White House, which essentially means I was the COO of this new cyber office they set up in the White House that was actually created in the Trump administration. But it was so new they hadn't hired any people into the office until Biden. And the first employee, I think, was hired in '21. And by the time I left, we were up to about 100 people. So running a startup is interesting. Running a startup in government is particularly unique. And then running a startup in the White House is something that I have a lot of scars from, but I would have never given up for the world. Wow. Yeah. So I want to hear more about that. Not the scars. That's up to you, obviously. But the work that you were doing in the White House, please tell me a bit more about the efforts that you are working on. Sure. So Congress created this office, essentially, because while there's a bunch of offices around the federal government that do cyber, there wasn't one that was at a level, meaning White House level, that could kind of compel other agencies to implement government-wide policies and programs in cyber. And so this group in Congress, the Cyberspace Solarium Commission, created this. And our first task that was assigned to us by the president was to write or really update the national cyber strategy, which the first one was written in Bush, the second term of W. Bush. And it's been updated. We did the fourth iteration of it. So our office rewrote or updated the national cyber strategy. And then I was brought in to oversee implementation across the federal government of that strategy. And space was a key component of it, as well as a whole host of other things, including AI and mundane things like workforce and sexy things like cybercrime and cartels and stuff like that. But it ran the gamut. Yeah. And given what I often focus on, I'm clearly biased. I really want to hear more about the space side of things. Because as I mentioned before we started recording, I have a number of conversations with people in various parts of the space industry, where we talk about space as critical infrastructure, what that means and what that would affect. And I don't think this is a very well-understood thing. So I'd love to hear a bit more about your thoughts on that and why the effort to get space designated as critical infrastructure is so important. Sure. So actually our role in that conversation, the role of my office in the White House, the Office of National Cyber Director, was actually not kind of a foregone conclusion. Initially the space council and the National Security Council were going to work to decide what, how things should unfold as it relates to space as critical infrastructure and kind of key recommendations on security of space infrastructure and so on. However, we kind of rose our hand as kind of the new kid on the block and said, "Hey, cyber's kind of a key component of all this. We should really be at the table." And after some hemming and hawing and typical government turf battles and everything else, agreed that not having the cyber office involved in this conversation was a big missed opportunity. And so we had a great team of folks who worked on this for me and the director. And it kind of boiled down to the fact that so much of our lives are governed by the satellites that are up in space. And the obvious example is GPS, but also a million other things. And so over time, we made a strong push as did others to designate space as critical infrastructure officially. I know that there's been some disagreement on that designation, but I think in practice, people have largely kind of come to agree that space is critical infrastructure regardless of its formal designation by the government. Yeah, and that's a really good point. I think you're right that I think unofficially a lot of people are thinking of it that way. Would there be a really super big material difference if it was more officially designated? I mean, I know there is, but how big a difference would that really make at this point? Well, part of the reason I think the space industry was somewhat less excited about it was that it can doesn't always but can come with increased regulations and scrutiny from government, which of course industry generally doesn't like for obvious reasons. That being said, also more resources often come with it. So there's the government will often fund the way it does with with other industries. Information sharing groups to share threat intelligence. They'll often fund the SZA and other entities. Folks that will go out and do free cybersecurity assessments. SZA does this and a whole host of entities like state and local governments in the energy sector and water and so on. Other parts of critical infrastructure. And so those types of resources would be available. Maybe we try not to subsidize major corporations who have the financial wherewithal to do it themselves. SZA is not out there doing free cyber assessments for JP Morgan or Bank of America, which are also critical infrastructure designated for more such. But you could certainly envision that being applicable to many of the smaller companies in space. And so there's a little bit of a yin and yang here. You may get more regulation, but you also get more resources and so on. So that's kind of the push and pull as to why industry may want or not want something designated officially as critical infrastructure. Absolutely. Yeah. I think some of the tenor of the conversations I've had also have been, we're fine. We're good. We've got this. But my question is often the follow up. Do you actually have it? Are you actually fine? Is the nature of the threat really fully understood? I'm not an expert here. I don't know. I often wonder, though, do people quite understand what threats look like in the realm of space? Is it even all that special and all that different from the threats that we see terrestrially? I'm just so curious your thoughts on sort of the nature of what's going on in the space domain. So first off, just to answer your question, absolutely not. They don't got it. And that's not their fault. Like no one does. And if you've got a nation state actor after you, just remember Stuxnet. Stuxnet was US and Israeli attacks on the Iranian nuclear program. The Iranians put their centrifuges in concrete vaults in the desert, buried underground, zero connection to the internet or anything else. And we were still able to hack into those centrifuges and shut them down and make them break in a whole bunch of creative ways and so on and so forth. And so if somebody can get into your infrastructure that's not connected to the internet, that's buried underground in the desert in a concrete vault, then they absolutely, a nation state of similar capability like China or Russia or Iran or whoever, could get into your satellite, which by definition is connected to networks all over the planet. And by the way, in fact, I'll give you an example. So in my current capacity at the University of Chicago, we've partnered with DEF CON, the largest and longest running hacker conference in the world, to put out an annual report on the top findings at DEF CON. One of those findings this year was around space. And since this is a little bit more technical than I am, I'm just going to kind of read it off to you. So a group of hackers figured out that they could reverse engineer efforts to exploit V-SAT satellite modems from Earth. And they focused on the NewTek MDN 2200 from iDirect. So as far as they could tell, this was the first successful demonstration of a signal injection attack on a V-SAT modem using software-defined radios from Earth. And so essentially they were able to attack V-SAT modems from Earth with these software-defined radios. And that's pretty-- I mean, these hackers are doing this on a shoestring budget. I mean, they're spending hundreds or single-digit thousands of dollars just messing around. Now granted, these are brilliant people. So they're messing around. There's a lot more advance than most people's messing around. But nonetheless, if they can do it on a shoestring budget, imagine what China, Russia, Iran, or some other bad actor could do when they have millions or billions of dollars to throw in it. And considering that China itself has said that we're going to be a war over Taiwan in 2027, which is hopefully none of us-- hopefully that doesn't happen. And hopefully that's all bluster and everything. But as we know from the Ukraine war, the first shot across the bow was against satellites. And we would presume the first shot fired in a war with China would be in space at our satellite infrastructure. I'll be right back. I'm just curious, can you give me a sense of what kind of attacks are sort of typical for the space domain? Sure. I think that to your point you made earlier, it's nothing new. Folks are even doing very basic attacks. What these guys did against the modems is pretty standard. I think you look at your typical network attacks that are used against other computer systems, even basic things like SQL injections and so on, depending on the attack surface that we're talking about are even applicable here. And that's the most mundane, lowest grade attack. But folks should know that the folks in China and Iran and Russia and so on, and I guess North Korea for that matter, they spend all day every day looking for zero days in this infrastructure. I don't know how much your listeners are familiar with this type of stuff, but they know what a zero day is. Do I need to explain that? Yeah. If you want to explain a zero, that would be great. Yeah. Okay. So a zero day refers to basically a new vulnerability that nobody knew about before. Often when they talk about patches, they'll say, "Oh, well, this was seven days since we've patched seven days since we found the vulnerability." In this case, they're saying, "Well, there's no patch. No one knows about this vulnerability, so it's a zero day." We may have found it six months ago, but nobody knows about it. And so once we use it or release it, that'll be the first time it was ever used, and thus a zero day. And so these nation states stockpile these zero days, and we can all be sure that they are absolutely doing that for space infrastructure. So if I'm a space company, large or small, I'm sure if I'm a large company, I would hope a good understanding of some of the things that I would need to do. But no company can deal with this alone. Nobody can deal with it in a vacuum. Collaboration is key. Threat information sharing is key. What needs to be done? I know there are some efforts underway. I'm thinking of the Space ISAC is one of them in terms of sharing threat and tell in the space industry and the space domain. But if there's something going on, if there's a threat that's... If something is underway, how do people in this space domain share that information with each other in a meaningful way? Right. So first off, your initial point is the exact right one. Join the Space ISAC. Even if you're a small company, I forget exactly what their fee structure is like, but usually the little guys and gals get to join for free or very reduced rate, and it's worth it. Secondly, particularly if you're a startup and you don't have a CISO, hire a CISO. That's really important. Chief Information Security Officer. No, it's the Chief Information Security Officer. And look, that's important not just for your security, but it's also important for your valuations and so on. I mean, a lot of these folks in China and elsewhere will look at what companies most recently got major investments from private equity firms or venture capital firms or whoever else, and then those will be the ones they target. In fact, we found several years ago at Homeland Security, or Homeland Security found several years ago that attacks from China on IP were directly correlated to press releases of $20 million of investment or more. And so, yeah, like we could see that within weeks or whatever, after a press release saying they got $20 million in investment, they were getting hacked and their IP was getting pulled out the back door. So it's not just that you should do this for the good of the security of our space infrastructure. It's also for the good of the security of your company's IP. So number one, join the Space ISAC. Number two, if you don't have a SISO, hire a SISO. And then number three, if you have a SISO, they're going to know most of the things that you need to, the basics that you need to do. But a huge challenge in cyber that often prohibits folks from hiring cyber staff is how expensive they are. And if you want somebody with a master's or even a bachelor's in computer science with a focus on cyber, they're incredibly expensive. However, if you've already got a SISO, you probably don't need people at that level. And one of the things we've really pushed for in the national cyber strategy was for companies to think about how they could bring on folks and do that are maybe not super-duper cyber experts with a PhD in cyber or whatever, but somebody who they can do on-the-job training, there's a lot of certifications, online classes and so on, where you could plus up your cyber workforce, meaning you could do more cybersecurity if you were to bring on people who maybe have less qualifications from a degree perspective, but could quickly gain the hands-on knowledge they would need from working with your SISO, taking some online classes, getting a certification here or there. Or by the way, attending DEF CON, who we partner with on the Hackers-Allman Act. But again, I encourage everybody to Google and read because it's a fun read. I will definitely be doing that because I've gone to DEF CON a bunch of times and I'm hoping to go again this year. I have always learned a ton and I'm very much not a technical expert, but I learned a great deal just from going. As you said, it's a very educational, in ways you may not expect, very educational. Yes. Well, Jake, I've learned a ton from you and I really appreciate you taking the time. So thank you for joining me today. If there's anything you want to leave the audience with, please, but the floor is yours. I'll go back to my shameless plug of the Hackers-Allman Act and the intro, which I wrote. I talk about the fact that we're in the middle of a new great game. And so what you may remember from your history 101 in college class, the great game was a struggle between Russia and the British over Central Asia. Many of us believe that we're in a similar struggle today, but instead of a conflict over Central Asia, it's over the internet. And really it's between authoritarian countries like Russia, China, Iran, North Korea, and so on, and democracies. And space is clearly one of the main parts of the terrain or so on that we're dealing with here. And everybody who's listening to this call, we're reading about this, should know that they are all players in this new great game, whether you know it or like it or not. And we're either going to protect our infrastructure to ward off authoritarian states and so on who are trying to make the internet and our lives not free, fair, and secure. And that's kind of where we're going to find ourselves from probably the next 20 years is in the middle of this conflict between authoritarian states and the democracies of the world over cyberspace to include cyberspace and outer space. That's it for T-Mine is Deep Space, brought to you by N2K Cyberwire. We'd love to know what you think of this podcast. You can email us at space@n2k.com or submit the survey in the show notes. Your feedback ensures that we deliver the information that keeps you a step ahead in the rapidly changing space industry. N2K Senior Producer is Alice Carruth. Our producer is Liz Stokes. We're mixed by Elliot Peltzman and Tre Hester with original music by Elliot Peltzman. Our executive producer is Jennifer Eiben. Peter Kilpie is our publisher. And I am your host, Maria Varmazis. Thanks for listening. See you next time. [MUSIC PLAYING] . .