Training the Next Generation of Space Cybersecurity Experts

Training the Next Generation of Space Cybersecurity Experts

A Q&A with Scott Shackelford

• By Mary Grush
• 05/12/25

In a few short decades, since the first signals from our experimental satellites broke the stillness at the edge of space, more and more of the world's critical technology infrastructure has occupied the crowded regions of low earth orbit (LEO). Thousands of satellites from countries around the globe now serve every type of communications, from top-secret defense programs, to weather imaging, to basic science research, and so much more. From government and research agencies to commercial entities, large and small, securing those assets means more than incrementally pumping up existing cybersecurity resources and practices. Space cybersecurity is a field that must grow and mature significantly to keep up with the pace of change. Here, we ask Scott Shackelford, Indiana University professor of law and director of the Ostrom Workshop Program on Cybersecurity and Internet Governance, about some of the efforts — globally, nationally, and locally — that may help launch a separate discipline that will support changing practices and foster future space cybersecurity leadership.

Speakers at the workshop "Toward an Integrated Theory of Space-Cyber Power," held this spring in Washington D.C. by Indiana University's Space Governance Lab. (Image courtesy Indiana University. With permission.)

Mary Grush: Certainly cybersecurity has existed for some time around our space infrastructure and related digital technology. It has been here in some form, even if not called out as a separate, specific "space cybersecurity" discipline. What's new or on the horizon that might cause us to rethink space cybersecurity, redefine it, and restructure how we implement it?

Scott Shackelford: Our reliance on space infrastructure has been around for a long time now. We've been reliant on satellites for decades, especially since the '80s when the technology took off in a big way with a lot of different services. Of course, in the beginning it started off mostly in national security with early surveillance satellites taking pictures during the Cold War as part of our nuclear deterrence. But it did not take long for the first commercial satellites to be launched, originally for weather forecasting and telecommunications. And these days, we get a host of satellite-based services, from Internet access from space, to GPS, to all the geospatial applications like Google Maps — you name it. Just having this conversation right now, all of this is dependent on space and the infrastructure that we've launched into orbit (as we're continuing to do), along with the ground-based services that make it possible. Securing all of that is really challenging and important.

We've been focused on space as a vulnerability for a long time. Traditionally that meant basically not making it too easy to knock out satellites with missiles. And originally only the U.S. and the former Soviet Union, then Russia, were able to do that. China joined the club in the early 2000s when they very publicly took down an aging weather satellite and in so doing caused a cascade of orbital debris that continues to ricochet around LEO, still causing headaches for the International Space Station and for the other satellites that have to move out of the way.

And now, it's gotten easier for bad players to launch cyber attacks instead of missiles. Those cyber attacks are coming from countries or criminal organizations, and they're designed to go after satellites without the need to launch kinetic vehicles to interfere physically with the satellite. It's a lot easier for them when they can just punch a few keystrokes. We've seen countries do it, like Iran. We've seen groups do it to target different types of satellites or even in some cases to launch ransomware attacks against them.