In May 2026, a panel at Geneva Cyber Week brought together a technologist, a disarmament practitioner and a diplomat to discuss the diplomacy of outer space and the security of information and communications technologies (ICTs). It opened with a spoiler: the two domains are closely linked in practice, yet they rarely cross paths in diplomatic discussions. Then, in September, UNIDIR’s Outer Space Security Conference devoted a panel to securing space data and ICT infrastructure.
The conversations are beginning, but the processes remain separate. And there are real costs to having these two expert communities operate in silos. The mechanisms needed to connect the dots already exist. What we need now is to build the right bridges between them.
Two distinct yet related non-kinetic threats
Words matter in multilateral governance because ideas are necessarily converted into practices and processes. But when it comes to non-kinetic threats to space systems, two distinct phenomena are often lumped together: electromagnetic interference with radio-frequency links, and malicious ICT activity directed at the computers and networks on which those systems run.
The first is the more visible, because the jamming and spoofing of global navigation satellite systems can have cascading effects on civil aviation, maritime navigation, energy grids, financial systems and humanitarian operations. It is also the better governed: the International Telecommunication Union (ITU) addresses it under its Radio Regulations. It is a regular feature of national statements in the Conference on Disarmament and in the current Open-Ended Working Group (OEWG) on the Prevention of an Arms Race in Outer Space (PAROS) in all its aspects.
The second is the less visible: the security of the ICTs that form the backbone of space infrastructure. Indeed, such counterspace capabilities “can target data and the systems that use, transmit, and control the flow of data. Information and communication technologies can be used to target satellites as well as ground stations or even end-user components, such as modems, with the objective of interfering with services (such as Internet coverage), intercepting information, or inserting false or corrupt data into a system”.
The two should be kept apart, not least because the law already blurs them. The ITU Constitution defines “harmful interference” as interference which “endangers the functioning of a radionavigation service or of other safety services or seriously degrades, obstructs, or repeatedly interrupts a radiocommunication service operating in accordance with Radio Regulations”, a definition confined to radio frequencies.
Article IX of the Outer Space Treaty uses the same words without defining them. There, the notion can be read as turning on the activity disrupted rather than on the means of disruption. That is, as “the external blocking or lessening of services provided by space systems, which can be accidental or intentional”, which is broad enough to cover a close approach, jamming or spoofing, and a malicious ICT operation. The same words imply varying scopes in different legal regimes, which is a source of confusion rather than a safeguard against it.
Understanding the full spectrum of vulnerabilities
Space infrastructure comprises a space segment, a ground segment, a link segment and a user segment. ICTs are embedded in all four: in space-based assets, throughout the interconnected computers and networks at ground stations, across the links, and in every user terminal.
Every ICT vulnerability has the potential to become a space vulnerability, and the pattern of malicious ICT activity against the space sector confirms this.
Such operations are increasing, and most target the ground and user segments rather than the satellites themselves.
The dependence runs the other way too. Satellite links carry internet and telephone traffic to places that fibre fails to reach. They also act as backup for terrestrial links. Navigation constellations, meanwhile, supply the precise timing that synchronizes mobile networks, power grids and financial transactions.
A degraded space system is, potentially, a degraded ICT service on Earth.
Nor are vulnerabilities confined to satellites in operation. They may be created at the design stage, through the software tools and manufacturing systems used to build satellites and ground equipment. They can accumulate during assembly, testing and launch, every step of which depends on networked computers. And they may outlive the mission, since decommissioned satellites retain residual data and emissions long after anyone is paying for their protection.
Supply chains are littered with weaknesses as well. Single-source dependencies, reliance on off-the-shelf components from foreign suppliers, component shortages and the well-documented existence of backdoors can all build in significant risks years before a system ever gets off the ground.
When communications and operations overlap in orbit
To understand why the security of space infrastructure is so distinctive, it helps to stop treating satellites monolithically and to analyse them instead in terms of their components and functions.
Industry security practitioners have long relied on a useful divide between information technology (IT) and operational technology (OT). Translated into UN terms, with ICT in place of IT, the distinction makes the same analytical clarity available to multilateral discussions, even though there is no single, universally binding UN-wide definition of either category.
- IT/ICT generally refers to systems whose purpose is the processing, storage and communication of information. In orbit, this means the hardware, software and connectivity that enable satellite communications. A satellite is, in this sense, a functional node of a global network, “a router that happens to fly”, whose performance is measured in the native metrics of networking (throughput, latency and availability). Its weaknesses are network vulnerabilities, from interception and denial of service to the hijacking of links and the compromise of ground-based infrastructure.
- OT generally refers to systems that sense and act upon the physical world. In orbit, this means the hardware and software behind the essential functions of a satellite other than communications: the technology and instruments behind applications ranging from Earth observation to in-orbit servicing, but also the on-board electronics for power, propulsion and station keeping.
The two types of technology are neither protected nor assessed in the same way by those who build and operate them. ICT calls for defences appropriate to a network, OT for those of an industrial control system.
Seen in this way, the problem is unforgiving. On board a satellite the two converge: the command and data handling chain that carries communications is also the chain through which the platform and its payload are controlled. Compromising the ICT can therefore provide a path to adverse effects against the OT, such as corrupting the flight software. Standard terrestrial cybersecurity practices fall down here, just when they are needed most: one cannot refresh hardware or physically reset a server on systems one cannot reach.
There is a second difficulty.
From the ground, a malfunction and an attack can look identical. The space environment offers a degree of natural cover that no terrestrial domain can match.
Radiation events, debris impacts, component failures and software anomalies occur constantly, and a malicious ICT operation can be concealed among them. Distinguishing between an accidental and an intentional incident is therefore challenging. This blurs the line between an accident and a hostile act, complicates attribution, and carries a risk of escalation through misunderstanding or miscalculation.
Reactive fixes being extremely difficult in orbit, security must be built in on the ground, by design and through rigorous standards. Yet because space networks are globally distributed, those standards are only as strong as their weakest link. For them to work in practice, standards, geopolitical understanding and implementation capacity must evolve together.
Why terminology matters
In multilateral practice, word choice carries weight. Referring to “the security of ICTs” rather than “cyber” aligns with the language of the United Nations. There, the operative term is security of and in the use of ICTs, and the malicious use of ICTs is the formulation that has found its way into space security documents.
The point that matters at the join is simple: the threat under discussion uses ICTs as its means and space systems as its target. The means is digital, the consequence physical.
The competing terms are not interchangeable. “Information security”, preferred by some States, includes content and data as well as systems. “Cyber”, preferred by others, points to infrastructure and to a domain of activity. Each choice encodes a different view of what is being protected.
The compromise has nonetheless proved workable. The 11 norms of responsible State behaviour were agreed by consensus in 2015 and reaffirmed by consensus in the final reports of the two OEWGs in 2021 and 2025. The phrasing that they use centres on ICT activity and its effects rather than a particular domain. They were accepted by States on every side of the terminological divide. This precedent is one that space discussions can use to their advantage.
The many tools already within reach
Several avenues are open, and none requires resolving the disagreement between those who favour a legally binding instrument and those who favour norms of responsible behaviour. The issue may be addressed within the OEWG on PAROS in all its aspects or within the Working Group on the Long-Term Sustainability of Outer Space Activities of the Committee on the Peaceful Uses of Outer Space. It may also be addressed within the Global Mechanism on developments in the field of ICTs in the context of international security, established by the 2025 OEWG’s final report as the permanent successor to the ICT processes.
But transparency and confidence-building measures (TCBMs) represent the most readily available tools. The 2013 Group of Governmental Experts on TCBMs in outer space activities agreed by consensus on a range of such measures: information exchange, risk-reduction notifications, points of contact, visits to facilities and consultative mechanisms. Their implementation would soften some differences of opinion and alleviate mistrust, particularly where an anomaly cannot easily be distinguished from an attack.
Helpful legal instruments are also hiding in plain sight. The consultation mechanism of Article IX of the Outer Space Treaty, almost never invoked, could be used discreetly to address incidents of interference. By asking States to inform the Secretary-General, the public and the scientific community of their space activities, Article XI also offers a treaty basis in which information sharing about the security of space systems could be anchored. The points-of-contact directory that the ICT process spent years building shows what such sharing can look like in practice.
Real trust-building needs every channel to be working in parallel: formal processes with a UN mandate, minilateral efforts between States, and the informal, discreet settings that non-governmental conveners can provide. The latter in particular can allow questions too sensitive for any formal plenary, such as real-world incidents, to mature in Track 1.5 and Track 2 formats.
Getting out of our silos
What that Geneva Cyber Week event back in May demonstrated is modest yet important: put a technologist, a disarmament practitioner and a diplomat versed in both space and ICT security in the same room, and the silos soon dissolve.
Reproducing that effect in the multilateral processes requires no new machinery. The international community has the space TCBMs agreed in 2013, the norms and points of contact already agreed in the ICT processes, and the Outer Space Treaty articles awaiting operationalization. What we need now is to forge more deliberate connections between the mechanisms we already have.
