By Christopher Rice

Space-based technology empowers American leadership—economic, cultural, and military.  Further, as Part I of this essay noted, the nation’s rivals have made significant investments towards targeting the vulnerabilities of her space sectors, both in orbit and online.  Part II will outline current space cybersecurity policy at the national level and identify some of its risks.  Finally, this essay will suggest another way for American policymakers to secure the nation’s space infrastructure:  a renewed system of letters of marque and reprisal empowering American space and cyber firms to better protect themselves.

Fortress America?

The emphasis competitors have placed on contesting American space dominance has not gone unnoticed in American policy-making circles.  Recent policy documents have reflected the importance of space systems and their related cyber and information infrastructure to American economic and military success.  While such policy measures are certainly a step in the right direction, the current policy structure encodes structural weaknesses and ambiguities that threaten the security of the commercial space sector, and national security more broadly.

The United States has long recognized the importance of space systems in maintaining its national security; however, attention to cyber threats is comparatively new.  Broad support for space development within the U.S. government stretches back to the Eisenhower administration.¹  In contrast, the Department of Defense did not produce a comprehensive cybersecurity plan until 2011.²  In the decade since, American policymakers have struggled to keep pace with accelerating technology development and proliferating, network-borne threats.

American space operations have a reasonably strong base in government policy and have received high-profile attention in recent years.  The Trump Administration’s series of Space Policy Directives (SPD) offer a helpful foundation for understanding the importance of American space infrastructure and the threats it faces.  The seven directives cover a variety of topics from space traffic management to the establishment of the Space Force.  The directives most relevant to the security of American space systems are SPD-5 and SPD-7. 

SPD-5 establishes a basic policy framework for space cybersecurity.  It notes that space systems are vulnerable to cyber and information attacks throughout their lifecycles, from supply chain through design, construction, and launch, as well as in operation.³  Every stage of a satellite’s lifecycle is controlled through complex information networks, offering hostile actors a profusion of potential vectors through which to attack.  In response to such thoroughgoing vulnerability, the directive goes on to call for space system owners and operators “to collaborate to promote the development of best practices, to the extent permitted by applicable law,” while also “shar[ing] threat, warning, and incident information within the space industry.”⁴  This emphasis on cooperation is a necessary precondition of securing U.S. space infrastructure.

SPD-7’s focus is sharper, centering on importance of the U.S. Global Positioning System (GPS) constellation.  SPD-7 identifies the “widespread and growing dependence on GPS by military, civil, and commercial applications, systems, and infrastructure” and the critical role of GPS in maintaining situational awareness in space itself.⁵  It further emphasizes the interconnectedness of space systems, information, and security, by identifying the threat of navigation warfare (NAVWAR).  Mirroring aspects of  Chinese thinking on informationized warfare, NAVWAR “refers to the deliberate defensive and offensive action to assure and prevent positioning, navigation, and timing information through coordinated employment of space, cyberspace, and electronic warfare.”⁶  SPD-7 also calls for increased attention to cyber and electromagnetic security measures to ensure the continued operation of the GPS constellation in the face of opponents’ NAVWAR efforts.⁷  While the SPD series is not the first set of government policies concerning space and information security, it does provide valuable insights into current U.S. policy thinking.

Other policy documents help further define the current U.S. approach to ensuring the security of its space infrastructure in the face of information threats.  The 2017 National Security Strategy identifies both space and cyberspace as key security sectors, calling for the greater attention to maintaining American leadership in space and development of enhanced cyber “attribution, accountability, and response” abilities.⁸  The DOD’s 2018 Cyber Strategy acknowledges the importance of “defend[ing] forward to disrupt or halt malicious cyber activity at its source,  including activity that falls below the level of armed conflict.”⁹  Given the tremendous interpenetration of networks and space systems into all aspects of American life and the proliferation of both human and artificially intelligent threats, there is simply no possibility of fortifying the nation completely against cyber-attack.  Instead, malign actors must be identified and actively deterred or defeated.  The 2020 National Space Policy builds on the aforementioned documents, reinforcing the importance of total-lifecycle cyber security, public-private and interagency collaboration, and resilience.¹⁰  These documents clearly illustrate the importance of space cyber security, but some critical vulnerabilities remain.

While seemingly resolute in its promotion of space cyber security, current U.S. policy remains dangerously vague in key areas.  First, U.S. policy is ambiguous about what actions might be authorized in response to hostile cyber action against American space systems or infrastructure.  Although current policy reflects the possibility of NAVWAR and identifies the systemic vulnerability of the space sector to cyber exploitation, it fails to set forth a range of possible responses.  It is even unclear whether the United States views cyber-attacks against critical infrastructure as more or less escalatory than a more traditional, kinetic attack on the same systems.  Compounding the ambiguity, U.S. policy fails to clarify the position of U.S. commercial space sector assets within American retaliatory decision making.  With U.S. firms providing everything from digital communication and imaging to the launch of GPS satellites, the commercial space sector is a source of irreplaceable capacity—and a high-payoff target to America’s enemies.¹¹ 

Ambiguity, like that built into U.S. space cybersecurity policy, may inadvertently invite miscalculation.  An opponent’s perception of American commitment matters: “if we[, the United States,] leave ourselves loopholes through which to exit—our opponent will expect us to be under strong temptation to make a graceful exit.”¹²  Given the critical importance of space in U.S. economic stability and national security, a graceful response to provocation may not be possible.  Although they may appear less threatening than other forms of conflict, cyber operations may be, as Thomas Schelling described limited war generally, “like fighting in a canoe. [Any] blow hard enough to hurt is in some danger of overturning the canoe.”¹³  The risk of aggression is magnified further because, unlike traditional means of limited warfare, cyber-attacks—especially those directed at space sector targets—need not involve the clarifying shock of bloodshed.  An opponent, like China whose views of deterrence are heavily shaded with coercion and fundamentally distinct from those of the United States, might see cyber action against American commercial space firms as both useful and minimally escalatory, only to be met by an unanticipated, forceful response.¹⁴  In such a situation, the ambiguity of American space cybersecurity policy inadvertently catalyzes dangerous escalation.  The risks of ambiguity are too high.  To preserve American leadership in space and establish more effective deterrence, policy makers must communicate more clearly.

The United States must ensure the security of critical space systems and infrastructure, whether government- or commercial-sector.  To close the nation’s space security gaps and reduce the risk of miscalculation by potential adversaries, America must begin to marshal the resources and design regulations to protect all of its space infrastructure, including the commercial space sector.  U.S. policy makers must identify the American commercial space sector’s networks and infrastructure as defended assets. 

Not All Smooth Sailing

While there are obvious advantages to a clearer and more expansive national space policy, there are also notable risks.  Critics might suggest that such a broad expansion of the number of defended entities will be prohibitively expensive or potentially hazardous in itself.  The United States government assuredly cannot actively secure every single computer terminal in every firm that participates in the commercial space industry and its suppliers.  While rigorous cybersecurity standards, like zero trust frameworks, are necessary across government and commercial sectors alike, they are unlikely to change an opponent’s risk calculus on their own.¹⁵

Across such an expansive and potentially porous ecosystem, a successful defense must rely on deterring threats before they attack.  Credibility is necessary for effective deterrence.  The capacity to deter an opponent is based on the “[t]he willingness to hurt, the credibility of a threat, and the ability to exploit the power to hurt.”¹⁶  Unfortunately, as incidents like the recent Colonial Pipeline hack suggest, the United States may not have the capacity to defend its critical non-space infrastructure now, much less to make credible a significant expansion of its defensive cyber perimeter to encompass the commercial sector.¹⁷  Worse, it remains unclear whether the government can gather the talent necessary to ensure security.  Although the defense establishment is beginning to take meaningful steps to attract personnel with high-value abilities, including cyber security and other high-tech skills, doubt remains.¹⁸  The average personnel cost of the active-duty force increased by 64% between 2000 and 2012—a period where counterinsurgency operations emphasized large numbers of comparatively affordable dismounted infantry.¹⁹  An exponential growth in demand for exquisitely-trained technical specialists may impose insurmountable financial demands on the all-volunteer force, given the intense competition to attract specialized talent playing out across the economy.  Worse, the establishment of an implausible threat could undermine the perceived sincerity of the United States’ other deterrence arrangements, leaving it in even greater danger than before. 

Navigating clear of these obstacles will not be easy, but it is nonetheless necessary.  Given the deep integration of commercial space infrastructure into all aspects of American life, there is simply no option.  A more limited approach will not meaningfully address the magnitude of the potential risks.  Efforts to secure a limited number of “trusted partners” in the commercial sphere will leave significant vulnerabilities within the space and space-cyber environment, leaving opponents free to threaten the entire ecosystem. 

Half-measures simply will not suffice, nor will business as usual.  As General Paul Nakasone, the former Commander of U.S. Cyber Command and Director of the National Security Agency, recently noted, America’s habitual approach to deterrence imagines a “‘binary world’ of ‘yes or no’ in regards to conflict.”²⁰  While useful in managing the Cold War, this model is a poor fit for a world “where much of the nefarious activity — whether by nation-states, cybercriminal ransomware gangs, or other threat actors — plays out non-stop in an ambiguous strategic gray zone.”²¹  It is only a matter of time before threat actors turn their attention on America’s space industries with their growing economic value and central importance to national power.  The United States must identify a new approach that will enable it to simultaneously deter a multitude of threats each pursuing its own unique goals.

Luckily, there is a better way.  Policy makers can chart a new course, magnifying the impact of the limited resources available within the government itself, while still increasing the commercial sector’s security.  Just as maritime strategy—with its attention to the complex interrelations of sea, land, culture, technology, global politics, and economics²² across a hazardous domain that resists permanent control—offers a valuable model for visualizing interactions in space, American maritime history suggests a way to address the challenges of the nation’s future in space.²³

Back to the Future

Although the threats to America’s space industries are many and capable, its commercial firms are hamstrung by federal law.  Under current U.S. law, American companies are limited to passive defense; they have no ability to take more proactive measures.  Companies are forbidden from conducting even the most basic back-tracing in response to hostile action.²⁴  These restrictions create an environment full of soft targets and lay the burden for all but the most trivial cyber defense activities on the U.S. government.  Just as increasing the slope of an armor plate improves its protective capacity without requiring additional material and weight, resurrecting a time-obscured fragment of American law can provide a significant improvement in the nation’s security posture at minimal public cost.

A key to securing American space infrastructure can be found in the Constitution itself.  Article I, Section 8 authorizes the U.S. Congress to declare war and to establish regulations for the nation’s military forces, among other well-known powers.  It also gives legislators the ability to “grant Letters of Marque and Reprisal, and make Rules concerning Captures on Land and Water”—a little remembered power but one that has the potential to restore and even improve America’s position of leadership in space.²⁵

A renewed system of letters of Marque and Reprisal offers a way to dramatically shift the cost structure of space and cyber warfare in America’s favor.  Letters of Marque and Reprisal are legal documents that “authorize private actors to seek international justice and use force in a public cause.”²⁶  During the War of 1812, the United States issued letters of marque and reprisal to authorize American privateers, or privately-owned armed ships, to harass British vessels.²⁷  While the British remained the dominant naval power, American privateers provided a valuable augmentation to America’s small navy.  Changes in the material demands of warfare made private entities acting on their own direction appear less beneficial in the intervening two centuries.²⁸  However, a renewed system of letters of marque and reprisal can be used to magnify U.S. capability in space and cyberspace by empowering America’s vibrant high-tech industries to defend themselves.

The rebirth of letters of marque and reprisal would rapidly change the cost-benefit analysis of any hostile actor considering action against the United States.  Under such a system, private actors would have the legal authority to defend themselves, raising the cost of hostile action and, in some cases, likely deterring it completely.²⁹  While maintaining international stability requires meaningful oversight and regulations governing the acceptable conduct of cyber or space privateers, even limited authorities would be a step in the right direction.  In the cyber domain, such authorities might consist of a tiered system of threat responses running from a mere trace-back identifying the source of an attack, through a blockade or sanction limiting traffic involving the hostile servers, to “employment of an electronic force as a countermeasure directed at the source of a cyberattack immediately terminating the attack or preventing it from attacking again.”³⁰  These responses would be overseen by the modern equivalent of the prize courts that governed maritime privateers.  Instead of establishing legitimate ownership of seized property,³¹ these courts would ensure that American commercial cyber defense activities conform to proper evidentiary standards and relevant areas of the law of war.  With greater authority to defend themselves, American space- and cyber-technology companies would simultaneously impose greater risk of detection and threat of response on malign actors, reducing the attractiveness of cyber-attack. Although the construction of a fully established system of legitimate cyber privateering is beyond both the scope of this essay and the ability of its author, the utility of such a system—once wholly developed—appears clear.

The principles of letters of marque and reprisal apply to the space domain as well.  Given both the key role of space systems in maintaining networks and their vulnerability to network-based threats, cyber privateers would likely play a valuable role in a more integrated system of space infrastructure defense.  American commercial actors may be able to provide improved additional security for themselves and the nation in the physical domain as well.  Private companies could offer orbital security-as-a-service, utilizing constellations of small satellites to deny opponents the ability to endanger critical assets with direct ascent ASAT weapons or threatening RPO approaches.  Stronger physical measures, like the potential use of commercial space debris removal systems against threatening satellites, are likely limited by the 1967 Outer Space Treaty’s (OST) assignment of jurisdiction and control for orbiting objects to the state that launches and registers them.³²  Yet, it is clear that many nations—and an increasing number of commercial players—have the capacity to weaponize their RPO capabilities, if not currently the intent.  Use of such systems before the outbreak of outright hostilities is certainly not in keeping with the spirit of reserving space for “peaceful purposes,” as the OST repeatedly insists.  The legitimacy of on-orbit counter-space operations in response to an overt hostile act in space is less clear.  In any case, a robust and responsive retaliatory capability remains a reliable means of raising the costs of aggression and upholding international law.  The dual-use orbital capabilities of America’s space and cyber technology sectors—if empowered by a well-regulated system of letters of marque and reprisal—can make an invaluable contribution to maintaining national security and global stability.

 Conclusion

Powering its vibrant economy and unsurpassed military capabilities, U.S. capacity in space is second to none, yet its vulnerability is equally peerless.  The borders of the U.S. space and cyber remain largely unpatrolled.  While efforts to develop and implement best practices are certainly valuable, they are not enough.  No wall can be built around America’s space industry to defend it from external threats, but no wall is truly necessary.  As Carl von Clausewitz noted, “the defensive form of war is not a simple shield, but a shield made up of well-directed blows.”³³  The United States has the resources and talent to construct such a shield.  Letters of marque and reprisal are a time-proven approach to address today’s security challenges. 

As with their maritime forbearers in the Age of Sail, America’s unequaled high-technology industries have the talent and the capacity to contribute to securing their own perimeters.  The nation’s legal experts, civil servants, and diplomats are no less competent than those who fought for desegregation or implemented the Marshall Plan.  The nation can create a legal and diplomatic framework able to safeguard American security, while respecting the security of other nations and the principles of international law.

To do so, America must take stock not so much of its vulnerabilities, but of its incredible strengths.  It must unite the foresight and will to leverage those strengths with the courtesy and discipline to regard the safety of others.  In short, America must lead.  Should it choose to do so, American space and cyber industries will be, as its maritime economy once was, “the dagger which strikes at the heart of the enemy,” deterring aggression and upholding a stable, free world.³⁴

Chris Rice is a US Army veteran. A graduate of the United States Military Academy and Georgetown University’s Security Studies Program, he has overseas experience in both South Korea and Afghanistan.

He works as a consultant in Northern Virginia, assisting in the delivery of critical technologies to the warfighter. When not at work,  Chris is typically cooking various dals for his wife and two children, carrying around a large bag full of sand, or (p)reenacting future battles with small, plastic robots.

References

1. Robert Pfaltzgraf, “Space and U.S. Security:  A Net Assessment,” X.

2. John T. Bennett, “Pentagon declares the Internet a war domain,” The Hill, July 14, 2011, https://thehill.com/policy/technology/171531-pentagon-declares-the-internet-a-domain-of-war.

3. Executive Office of the President, “Space Policy Directive-5—Cybersecurity Principles for Space Systems,”  https://trumpwhitehouse.archives.gov/presidential-actions/memorandum-space-policy-directive-5-cybersecurity-principles-space-systems/. 

4. Ibid.

5. Executive Office of the President, “Memorandum on Space Policy Directive-7,” https://trumpwhitehouse.archives.gov/presidential-actions/memorandum-space-policy-directive-7/.

6. Ibid.

7. Ibid.

8. Executive Office of the President, National Security Strategy, December 18, 2017, https://trumpwhitehouse.archives.gov/wp-content/uploads/2017/12/NSS-Final-12-18-2017-0905.pdf, 31-32.

9. U.S. Department of Defense, Summary:  Department of Defense Cyber Strategy 2018, September 18, 2018, https://media.defense.gov/2018/Sep/18/2002041658/-1/-1/1/CYBER_STRATEGY_SUMMARY_FINAL.PDF, 1.

10. Executive Office of the President, National Space Policy, 18-19.

11. Sandra Erwin, “Falcon 9 launches GPS satellite in first national security mission with reused booster,” Space News, June 17, 2021, https://spacenews.com/falcon-9-launches-gps-satellite-in-first-national-security-mission-with-reused-booster/.

12. Thomas C. Schelling, Arms and Influence (Kindle Edition), (New Haven, CT:  Yale University Press, 2008), 46.

13. Schelling, Arms and Influence, 123.

14. Cheng, Cyber Dragon, 16.

15. Scott Rose, Oliver Borchert, Stu Mitchell, and Sean Connelly, “NIST Special Publication 800-207:  Zero Trust Architecture,” National Institute of Standards and Technology, August 2020, https://doi.org/10.6028/NIST.SP.800-207, ii.

16. Schelling, Arms and Influence, 3.

17. David E. Sanger and Nicole Perlroth, “Pipeline Attack Yields Urgent Lessons About U.S. Cybersecurity,” New York Times, Updated June 8, 2021, https://www.nytimes.com/2021/05/14/us/politics/pipeline-hack.html.

18. Headquarters Marine Corps, “Talent Management 2030,” November 2021, https://www.hqmc.marines.mil/Portals/142/Users/183/35/4535/Talent%20Management%202030_November%202021.pdf?ver=E88HXGUdUQoiB-edNPKOaA%3D%3D, 9.

19. Seamus P. Daniels, “Accounting For The Costs Of Military Personnel,” War On The Rocks,  September 22, 2021, https://warontherocks.com/2021/09/accounting-for-the-costs-of-military-personnel/.

20. Brad D. Williams, “Nakasone: Cold War-style deterrence ‘does not comport to cyberspace,’” Breaking Defense, November 4, 2021, https://breakingdefense.com/2021/11/nakasone-cold-war-style-deterrence-does-not-comport-to-cyberspace/.

21. Williams, “Nakasone: Cold War-style deterrence ‘does not comport to cyberspace.’”

22. John J. Klein, “Corbett in Orbit,” Naval War College Review, Volume 57, Number 1 (Winter), 2004, https://digital-commons.usnwc.edu/cgi/viewcontent.cgi?article=2073&context=nwc-review, 4.

23. Julian S. Corbett, Some Principles of Maritime Strategy, Project Gutenberg, https://www.gutenberg.org/files/15076/15076-h/15076-h.htm, 16, 91.

24. Michael T. Hopkins, “The Exceptionalist’s Approach to Private Sector Cybersecurity: A Marque and Reprisal Model,” George Washington University Law School, August 15, 2011, https://scholarspace.library.gwu.edu/concern/gw_etds/rf55z794d, 16

25. U.S. Const. art. I, § 8.

26. Theodore M Cooperstein, “Letters of Marque and Reprisal: The Constitutional Law and Practice of Privateering,” April 2009, http://citeseerx.ist.psu.edu/viewdoc/download?doi=10.1.1.1008.6588&rep=rep1&type=pdf, 45.

27. Jonathan L. Still, “Resurrecting Letters of Marque and Reprisal to Address Modern Threats,” United States Army War College, March 2012, https://apps.dtic.mil/sti/pdfs/ADA590294.pdf, 7.

28. Hopkins, “The Exceptionalist’s Approach to Private Sector Cybersecurity: A Marque and Reprisal Model,” 43.

29. Ibid., 88.

30. Ibid., 50, 52-54.

31. Ibid., 37.

32. “Treaty on Principles Governing the Activities of States in the Exploration and Use of Outer Space, including the Moon and Other Celestial Bodies,” opened for signature January 27, 1967, https://www.unoosa.org/oosa/en/ourwork/spacelaw/treaties/outerspacetreaty.html.

33. Carl Von Clausewitz, On War (Kindle Edition), (Princeton:  Princeton University Press, 1976), 357.

34. “Thomas Jefferson to James Monroe, 1 January 1815,” Founders Online, National Archives, https://founders.archives.gov/documents/Jefferson/03-08-02-0150.

Featured image: Tracy Caldwell Dyson in the Cupola module of the International Space Station observing the Earth below during Expedition 24. (Wikimedia Commons)