New Times,
New Thinking.

UK Space Agency security chief: “Space is a ubiquitous enabler for modern life”

Stephen Straughan discusses how a major cyberattack on space-based services could cause chaos.

By Samir Jeraj

The UK Space Agency (UKSA) was established in 2010 in the final weeks of Gordon Brown’s government, taking over from the British National Space Centre. It is responsible for the UK’s civil space programme. The space sector is worth £16.5bn to the UK and employs around 47,000 people, according to the UKSA. One of its roles is to work with the sector to support and improve its cybersecurity.

“We work with the owners and operators of space-based services, providing support and guidance to help them understand the nature of the risks from cyber-threats and encouraging appropriate and proportionate action,” Stephen Straughan, head of security and resilience at the UKSA, told Spotlight. However, he pointed out that cybersecurity risks to the agency itself are managed by the Department for Business, Energy and Industrial Strategy (BEIS), which is its parent department in government.

Space-based services basically entail the communication of data, often audio and video, around the globe. These can be used to transmit TV programmes, make phone calls, track the weather, or even remotely control military drones – added to this are services that depend on these communication networks, such as energy and transport. Space-based services are run out of the approximately 4,500 operational satellites orbiting the Earth, which quietly work away to make sure the modern world runs smoothly. “Space is a ubiquitous enabler for modern life in the UK, and worldwide,” Straughan said. “Space-based services are so embedded in our everyday activities that most people do not realise how reliant they are on them.”

In 2021 the German Space Agency made a video that invited the viewer to imagine what would happen if satellites stopped working. TV and phone lines go down, flights are cancelled and blackouts sweep the planet as energy management becomes impossible. Emergency services and the military would struggle to find locations, bank withdrawals and transactions would grind to a halt, and modern weather forecasts would be unavailable. In short, it would be chaos.

One of the biggest challenges in protecting satellites is that hardware cannot be changed once it has launched. “It is important that any cyber-threat is recognised early in the development life cycle of new services,” Straughan said, hence why his security and resilience team work to promote security “by design” across the sector. Fortunately, so far, the sector has avoided any specific attacks or suffered from any “major attacks” – but the vulnerabilities are there.

Select and enter your email address Your weekly guide to the best writing on ideas, politics, books and culture every Saturday. The best way to sign up for The Saturday Read is via saturdayread.substack.com The New Statesman's quick and essential guide to the news and politics of the day. The best way to sign up for Morning Call is via morningcall.substack.com
Visit our privacy Policy for more information about our services, how Progressive Media Investments may use, process and share your personal data, including information on your rights in respect of your personal data and how you can unsubscribe from future marketing communications.
THANK YOU

[See also: Data is the crux of your organisation’s security]

Satellites are also in operation for up to 15 years, which means they can quickly become out of date. Straughan said this can be mitigated by things such as software programmable radios, or through the “mega-constellation route” in which large numbers of short-lived satellites are put in low-Earth orbit and replenished with new ones as they reach their end of life, perhaps every five years rather than 15. He acknowledged that replacing hardware is “still outside current capabilities”, but that it may be possible in future with the development of “in-orbit servicing”.

During an average working day, the security and resilience team at UKSA will be working with operators of space services, helping them secure their systems and monitoring for emerging threats. They also run exercises to test their own responses and those of space service companies to cybersecurity incidents.

According to Straughan, the main challenges for cybersecurity in space are that the systems and networks are “highly distributed”, meaning that space-based services exist in a large network with many potential weaknesses that can be exploited. Combined with a long lifespan, the speed of technological change and fixed hardware, space services are relatively vulnerable. However, he said, “the benefits of our work in cyber are that we can help UK owners and operators understand the risks they may face and support them in mitigating these risks.” This means more reliable services and reduced risks. The UKSA currently runs security working groups that bring together companies and experts to discuss issues and share advice and guidance on cyber-threats. Straughan would not be drawn on specific cybersecurity projects, saying it would be “inappropriate to discuss specifics of any activities that might reveal details about risks and mitigations”.

When asked about what lessons other public services could learn from UKSA’s experiences, Straughan underlined that “mitigating the threat of cyberattacks is not something that can be done in isolation”. Because the world is becoming “increasingly interconnected”, risks will cross through networks around the world and not just within a single nation state. Straughan said it is “vital” that the international aspects are addressed, and added that the UKSA is in discussions with other space agencies on “collaborative working, mutual assurance mechanisms and establishing norms of behaviour”.

“Space is no longer the purview of governments and monolithic corporations,” Straughan said. “The cyber-threat is keeping pace and companies need to understand this risk and be proportionate in their activities. Even start-ups can be subject to cyber-risks, but it is too late to try and address these once their systems are developed, in operation and relied upon.”

[See also: Is the UK’s cyber-space more secure after Boris Johnson?]

Content from our partners
An energy skills boost can power UK growth
Homes for all: how can Labour shape the future of UK housing?
The UK’s skills shortfall is undermining growth

Topics in this article : , , ,