Business Continuity Management / Disaster Recovery
,
Geo-Specific
,
Governance & Risk Management
Orbital Frontier Is the Next Ungoverned Internet, and We Have Left It Open to Attack
As a cybersecurity professional, I have spent decades watching humanity build digital castles without moats. We did it with the internet, with artificial intelligence and with critical infrastructure. Now, we are doing it again, this time in orbit. We are racing to commercialize space to connect the unconnected and monetize orbit, yet we are ignoring the most important question: Who owns the cybersecurity of space?
See Also: Thwarting Cyberthreats in the Power Sector
There is no comprehensive and binding international cybersecurity framework governing satellites, orbital systems or ground-to-space communications. Australia’s growing space sector, spanning manufacturing in South Australia, launch facilities in the Northern Territory and emerging tracking infrastructure in Queensland, is expanding quickly. Yet these assets rely on software supply chains, radio uplinks and cloud-based ground stations that are still one well-timed exploit away from chaos.
The Orbit Is Crowded, But the Rules Are Empty
As of mid-2025, over 11,000 active satellites orbit Earth, with some sources estimating as many as 14,900 in including inactive satellites. Projections suggest that this number could exceed 100,000 within the next decade as mega satellite constellations such as Starlink, OneWeb and Kuiper expand. Each satellite carries firmware and protocols written by human hands, often without imagining the cosmic consequences of a single unpatched vulnerability.
Yet the Outer Space Treaty of 1967, which forms the foundation of global space law, is silent on digital resilience or cybersecurity. It governs debris and liability but not data. It defines orbits but not ownership of digital responsibility.
If a hostile actor compromises a shared satellite such as weather, GPS or communications, who investigates, who prosecutes and who pays? The Budapest Convention on Cybercrime stops at the edge of the atmosphere, and the Outer Space Treaty never envisioned code as a weapon.
The New ‘Man in the Middle’ Is 300 Kilometers up
Many satellites, especially those launched before 2020, lack encryption or rely on outdated telemetry protocols. A single compromised ground station could trigger cascading effects across dependent systems. A man-in-the-middle attack in orbit would not simply exfiltrate data. It could spoof navigation, interrupt emergency communications or feed falsified intelligence to defense networks. We saw a warning sign in the ViaSat KA-SAT attack during the early stages of the Russia-Ukraine conflict, which temporarily crippled satellite communications across Europe.
In space, the stakes are higher because there is no easy patching in orbit. Updates, where possible, are slow, expensive and risky. In practice, most vulnerabilities are permanent once launched.
Australia’s Space Ambition Meets Cyber Reality
Australia is emerging as a Southern Hemisphere space power, collaborating with NASA, the European Space Agency and AUKUS partners on launch, manufacturing and data sharing projects. But Australia’s policy framework focuses on launch safety and debris mitigation, not digital resilience.
If Australia wants to lead responsibly, it must build security into its orbital ambitions. That means developing a national space cyber framework that mandates encryption, zero trust ground station design, vulnerability assessments and incident reporting for orbital assets. Australia should also advocate for integration with international incident response mechanisms, perhaps even a “Cyber NORAD for Orbit” – to detect and respond to orbital intrusions in real time.
The Case for a Global ‘Cyber Orbit Accord’
If cyberspace was the unregulated frontier of the 20th century, orbit is the unregulated frontier of the 21st century. What the world now needs is a “Cyber Orbit Accord” – an international treaty that defines baseline cybersecurity requirements for all orbital operators.
The treaty should include:
- End-to-end encryption between satellites and ground systems;
- Independent pre-launch penetration testing and risk certification;
- Cross-border incident response protocols for space assets;
- Shared orbital threat intelligence networks between commercial, civil and defense stakeholders.
Such an initiative should not be left to superpowers alone. Australia is well placed to act as a mediator between Western alliances and the Asia Pacific region, bridging regulatory divides before a global incident forces action.
Takeaways for Cybersecurity Professionals
For cybersecurity professionals, space is now a part of your threat landscape. Whether you work in defense, telecommunications, energy or government, your organization likely depends on orbital networks. Strengthening your organization’s resilience in this emerging domain requires:
- Integrating space assets into the organization’s risk management and incident response plans;
- Demanding transparency across the aerospace supply chain;
- Embedding cyber clauses in all space and insurance contracts;
- Building partnerships and fostering intelligence sharing;
- Treating space cyber as strategic foresight, not niche engineering.
Australia has a rare opportunity to lead with foresight and integrity. It can insist that security, not speed, defines its rise into orbit. Because the question is no longer if an orbital cyberattack will occur – it is when, and whether we will be prepared.
Until we secure the sky, every digital system on Earth continues to be connected to a fragile, unguarded frontier.