When Defense Secretary Pete Hegseth stood before a room of defense industry CEOs in November 2025, his message was blunt: “We’re going to make defense contracting competitive again. Those who are too comfortable with the status quo to compete are not going to be welcome.”

It was a declaration of war—not against America’s adversaries, but against the Pentagon’s own procurement culture. And if you’ve been following defense acquisition for any length of time, you might be forgiven for rolling your eyes. After all, we’ve heard this song before. Multiple times. For decades.

But here’s what makes Hegseth’s reform push different: it’s not just another bureaucratic reshuffling. It’s a frontal assault on what he calls the Pentagon’s “backwards culture”—one that rewards schedule overruns, prioritizes paperwork over battlefield needs, and has turned defense contractors into risk-averse partners more focused on process compliance than delivering cutting-edge capabilities.

The question isn’t whether the Pentagon’s procurement system is broken. Everyone agrees it is. The question is whether Hegseth’s commercial-first revolution can succeed where Robert McNamara, David Packard, and countless others have failed—and whether fixing procurement is even enough to solve the deeper cultural rot.

The Backwards Culture Problem

Let’s start with what we’re actually trying to fix. The Pentagon’s procurement culture isn’t just inefficient—it actively rewards the wrong behaviors.

Consider this stunning admission from Lockheed Martin CEO Jim Taiclet earlier this year: “We don’t have any must-win programs with Lockheed Martin anymore.” Think about that for a moment. The nation’s largest defense contractor is openly saying it won’t take on programs where failure could be catastrophic for national security, simply because the Pentagon’s contracting approach makes such programs too risky.

This is the backwards culture in action. When your biggest suppliers are more concerned about protecting their margins than delivering critical capabilities, you’ve created a system that prioritizes financial security over mission success.

The root of the problem lies in decades of what experts call “pendulum swings” between different contracting philosophies. Fixed-price contracts were supposed to shift risk to contractors and save taxpayer money. But as Northrop Grumman’s CEO Kathy Warden explained in a recent earnings call, her company has “passed on some high-profile programs as a result of the risk balance that the customer put forward.” Boeing’s $7 billion in overruns on a $4.9 billion KC-46 tanker contract shows why contractors are gun-shy.

Meanwhile, cost-plus contracts—which guarantee contractors their costs plus a fee—remove the financial incentive to control expenses. It’s a classic Catch-22: fixed-price contracts drive away bidders, while cost-plus contracts eliminate cost discipline.

But the cultural problem runs deeper than contract types. As Hegseth noted in his reform memo, the current system rewards “schedule overruns and backlogs” while prioritizing “process and paperwork over the urgent and evolving needs of forces in the field.” When program managers get promoted for following procedures rather than delivering results, you’ve created a culture where compliance matters more than capability.

Hegseth’s Commercial-First Revolution

Enter Hegseth’s radical prescription: flip the entire incentive structure by defaulting to commercial solutions and commercial-style competition.

The core insight is elegant: instead of assuming military requirements are so unique that only bespoke, defense-specific solutions will work, start with the assumption that commercial technologies can meet most needs faster and cheaper. Only deviate from commercial solutions when absolutely necessary.

This isn’t just about buying more commercial products. It’s about fundamentally changing how the Pentagon thinks about requirements and acquisition. Hegseth’s reforms include several game-changing elements:

Portfolio Acquisition Executives will replace the traditional Program Executive Office structure. Instead of managing individual programs in isolation, these new executives will oversee entire capability portfolios, with authority to shift funding between programs based on performance and urgency. Their compensation will be tied to delivery speed, competition levels, and mission outcomes—not process compliance.

Speed as the primary metric represents a philosophical revolution. For decades, the Pentagon has optimized for cost control, risk mitigation, and regulatory compliance. Hegseth’s approach explicitly accepts trade-offs in cost and perfection to accelerate fielding timelines. The new mantra: “good enough now” beats “perfect eventually.”

Time-indexed incentives will reward contractors for early delivery and penalize delays. This creates a direct financial incentive for speed—something notably absent from traditional defense contracts.

The Economic Defense Unit represents perhaps the most innovative element: a new organization designed to deploy capital through grants, loans, and investment partnerships, blurring the lines between government procurement and venture capital. This could unlock private investment in defense technologies while reducing government risk.

The early signs are promising. Even before formal implementation, the Space Force has demonstrated the potential of this approach, using fixed-price contracts and commercial competition to dramatically reduce satellite costs and delivery times.

Space Force Leads, Congress Follows

The Space Force has become the poster child for acquisition reform, and for good reason. Frank Calvelli, the service’s acquisition chief, has championed fixed-price contracting as a way to “add a level of discipline, prevent the constant rethinking of programs and scope changes with each yearly budget build, avoid changes from cost re-estimating, stop requirement changes and promote competition from more commercial-like/non-traditional space companies.”

The results speak for themselves. Space Force programs are consistently delivering faster and cheaper than traditional acquisition programs, largely because they embrace commercial technologies and processes from the start.

Congressional alignment provides crucial political cover for Hegseth’s reforms. The bipartisan SPEED Act (Streamlining Procurement for Effective Execution and Delivery) includes provisions for requirements process overhaul, commercial technology emphasis, and efficiency over regulation. The Senate’s FORGED Act (Fostering Reform and Government Efficiency in Defense) goes even further, calling for the elimination of dozens of obsolete regulations and requiring commercial-first acquisition strategies.

This bipartisan support is significant because it addresses one of the key failure modes of past reform efforts: lack of sustained political backing when things inevitably go wrong.

Arnold Punaro, a former Senate Armed Services Committee staff director, calls Hegseth’s plan “without question, the most sweeping reforms and changes in the way the Department of Defense determines requirements, acquires those requirements, budgets for those requirements, and deals with the industrial base of any we’ve seen in 50 years.”

The Ghost of McNamara’s Failures

But here’s where history offers a sobering lesson. Every generation of Pentagon leaders discovers the acquisition system is broken and announces sweeping reforms to fix it. Most fail—not because their diagnoses are wrong, but because bureaucratic systems have remarkable immune responses to change.

Robert McNamara’s experience is particularly instructive. In the 1960s, McNamara centralized defense management, introduced the Planning Programming and Budgeting System (PPBS), created rigorous source selection processes, and established new oversight organizations. Sound familiar?

Many of McNamara’s innovations survived—PPBS remained virtually unchanged until 2001, and the organizations he created (Defense Contract Audit Agency, Defense Contract Administration Service) persist today, albeit with different names and missions. But the reforms didn’t solve the core problems. McNamara’s own tenure saw massive overruns on programs like the C-5A and F-111.

The pattern is depressingly consistent: well-intentioned reforms get “severely modified” over time until they’re “virtually unrecognizable from their original form.” McNamara’s Total Package Procurement policy, designed to control costs through fixed-price contracts, was abandoned by the Nixon administration when engineering change proposals and implementation failures made the fixed-price constraint meaningless.

The bureaucratic survival instinct is powerful. As one Pentagon veteran noted, “Only the agencies and organizations that McNamara created survived, though the latter in many cases with different names—which is a testimony to the tenaciousness of the bureaucracy when it comes to matters concerning its ongoing existence.”

This suggests that Hegseth’s reforms, however well-designed, will face the same institutional resistance that has neutered previous efforts. The question is whether the current reform push has elements that can overcome this historical pattern.

Why Procurement Reform Isn’t Enough

Even if Hegseth’s reforms succeed beyond all historical precedent, they won’t be sufficient to fix the Pentagon’s strategic problems. Procurement is a symptom, not the disease.

The deeper issue is what defense strategist Andrew Marshall identified decades ago: “Technology makes possible the revolution, but the revolution itself takes place only when new concepts of operation develop.” In other words, buying better widgets faster doesn’t matter if you’re still thinking about warfare in outdated ways.

The mismatch runs deep: The Pentagon’s structure remains “frozen in a Cold War mold—built for regional conflicts, linear escalation, conventional force-on-force fights, and prolonged procurement and modernization time horizons.” Meanwhile, today’s adversaries operate across geographic boundaries, coordinate below the threshold of war, and exploit the convergence of nuclear, cyber, space, and conventional capabilities.

Consider the current threat environment: Chinese satellites enable Russian targeting in Ukraine, Iranian drones support Russian operations, North Korean troops deploy alongside Russian forces, and all of this coordination happens in real-time across multiple domains. The U.S. response? Geographic combatant commands that can’t easily coordinate across regions, acquisition programs optimized for single-domain solutions, and decision-making processes designed for Cold War threat timelines.

Strategic culture matters as much as procurement culture. As military historian Brent Ziarnick observed, “the strategic culture of the service is every bit as important as its weapons or operations.” You can’t procure your way out of conceptual obsolescence.

The Pentagon needs what some experts call “DoD 3.0”—a fundamental restructuring that goes beyond acquisition reform to address command structures, authorities, budgeting processes, and strategic concepts. Without these broader changes, even the best procurement reforms will be constrained by outdated operational concepts and institutional structures.

The Verdict: Necessary But Not Sufficient

So can procurement reform fix the Pentagon’s backwards culture? The answer is nuanced: it can catalyze meaningful change, but it can’t complete the transformation alone.

Hegseth’s commercial-first approach has several advantages over previous reform attempts:

• Clarity of vision: Commercial-first is easier to understand and implement than complex bureaucratic reorganizations

• Measurable outcomes: Speed and competition are concrete metrics that resist bureaucratic gaming

• External pressure: Market forces and commercial competition provide ongoing pressure for efficiency

• Congressional support: Bipartisan backing reduces political risk

But the historical record suggests three critical success factors:

1. Sustained leadership commitment: Reforms fail when leadership changes and successors revert to old patterns

2. Cultural reinforcement: New processes must be reinforced by training, personnel policies, and organizational incentives

3. Operational integration: Procurement changes must be tied to new operational concepts and strategic frameworks

The good news is that Hegseth seems to understand these requirements. The transformation of the Defense Acquisition University into the “Warfighting Acquisition University” signals attention to cultural change. The emphasis on portfolio management and operational integration shows awareness that procurement can’t be separated from strategy.

The ultimate test will come when something goes wrong—and something always goes wrong in defense programs. Will senior leaders provide top cover for program managers who took smart risks that didn’t pay off? Will Congress resist the temptation to impose new oversight requirements after the first high-profile failure? Will the bureaucracy resist the urge to add “just a few more” process requirements for “better oversight”?

If Hegseth’s reforms can survive their first major crisis, they might actually stick. Combined with broader institutional changes—new operational concepts, updated command structures, and strategic culture evolution—they could represent the beginning of a genuine Pentagon transformation.

But if history is any guide, the bureaucracy is already working on ways to preserve the status quo under the guise of implementing change. The revolution in military affairs requires more than revolutionary procurement—it requires revolutionaries willing to keep fighting long after the first victory declarations.

The Pentagon’s backwards culture took decades to develop. Fixing it will require not just new processes, but new ways of thinking about warfare, competition, and institutional change. Procurement reform is a crucial first step. Whether it becomes the foundation for broader transformation or just another failed reform attempt will depend on leaders’ willingness to keep pushing when the bureaucracy pushes back.

The stakes couldn’t be higher. With China, Russia, Iran, and North Korea increasingly coordinated in their challenges to American power, the U.S. can’t afford another generation of incremental procurement tinkering. The question isn’t whether the Pentagon needs to change—it’s whether it can change fast enough to matter.

A Comparative Analysis of China and the United States Industrial Military Base

There is a fictional account in the 1965 movie “Battle of the Bulge” in which a German military officer finds a chocolate cake for an American Soldier and comes to the sudden realization that the Germans have lost the war, as they will be unable to keep up with the far superior industrial base and logistic capacity of the Americans. While the Germans were starving in their own country, The US had the capacity to ship birthday cakes across the ocean to individual soldiers. This account is fictional, but it captured the mood of German soldiers during WW2 and highlighted that even the bravest and most experienced soldiers in the world cannot fight off superior logistics and supplies in a conventional war. B.H. Lidell Hart’s book “Strategy” while mainly highlighting the historical effectiveness in taking the indirect approach to warfare, could secondarily serve as an exercise and guide in attacking the “strategic heart” of the enemy, which in nearly all his examples translates to attacking supply lines and the industrial base (Hart, 2009). Whilst the underlying logic of military strategy remains consistent, the grammar has changed to fit the advancements in technology (Ziarnick, 2014, #L260).

To fully grasp the complexity of comparing the two largest space powers in the world we have to develop a framework in which to analyze them by. The United States military branches generally abide by the DIME model (Diplomatic, Informational, Military, and Economic) (Ziarnick, 2014, #L1450), which in general has been an accurate measure for judging the power base of any nation. China on the other hand has a secret methodology in which they rank countries and designate a score, whilst it is only possible to verify the algorithm used by the most elite members of the CCP, it could be assumed the rationale for their national initiatives are results of attempting to increase this number (Rolland, 2024). China has an increased focus on its manufacturing base, with Xi Jinping even stating that China will never deindustrialize (Wang & Kroeber, 2025) and that a large part of that is access to space (Drozhashchikh, 2018, #176), so we can assume that industrial capacity is a large part of the power calculation.

The “Economic” pillar could arguably be the most valuable aspect of DIME, as mentioned earlier, economic power has the ability to dominate militaries, tear down political and diplomatic systems, and in conjunction with the “Informational” pillar we create an unshakeable foundation that the “Military” pillar stands on and bolsters the “Diplomatic” to have actual legitimacy. If the DIME pillars are used as a measure of power, with Economic and Informational (arguably) being the most relevant to power currently, this sets the standardized target for which a framework can start to be developed for a comparative analysis. It can now be assumed we are looking for strong indicators of optimizing for those pillars, and the most powerful technologies today have big data and AI as their backbone, which then build into “smart systems” like IoT connected sensors, devices, and manufacturing tooling. This tech then builds into advanced manufacturing concepts and capabilities such as additive manufacturing (i.e. 3D printing) and capacity to build computer chips, which flow back into the industrial base to build more smart systems.

Big Data systems are those defined as extremely large datasets that grow exponentially over time (Big Data Defined: Examples and Benefits) and usually are measured with the “3 V’s”; volume, variety, velocity, i.e. “how big is it?”, “how diverse is it?”, and “how fast is it being generated?” (Kleppmann, 2017, #45). The industrial foundation of big data is a “datacenter” which is a large building that houses large computer servers, either owned and wholly used by a business or can be rented out virtually such as with Amazon AWS or Microsoft Azure. Currently, the US has 53.7 Gigawatts of datacenter capacity to China’s 31.9, but the gap is rapidly closing as China has a significant amount of unused capacity (BN, 2025). McKinsey analysts predict this need to increase by 3.5x with most of the demand being driven by AI (Jean, 2025). With limitations in regards to power and environmental concerns of datacenters, businesses like Lonestar & Phison have already landed a datacenter the size of a shoebox on the moon (Jean, 2025). Increasingly, the demand for datacenters will come from off world needs, too, and the US already has a head start. More importantly, datacenters are the biggest input and success criteria for the AI revolution.

AI is the next step in the technology revolution and has already caused military strategists to realize we are on the cusp of not just a Military Technical Revolution (MTR), but a Revolution in Military Affairs (RMA). Nowhere has this been more publicly prevalent than the PLA (Peoples Liberation Army) as they are starting to give over control of their satellite systems to AI for traffic management purposes (Husain, 2024). This confidence is unprecedented, as the smallest miscalculation could cause a cascading debris field to wipe out several hundred satellites and cause certain portions of orbits to be uninhabitable. Yet, China was able to successfully prove that AI can manage orbital dynamics with ease. This should cause great concern for the US military, even if we had humans capable of piloting satellites better than AI, the latency of transmission due to distance would cause a disadvantage that Chinese AI could utilize in an adversarial situation. The US has tried to stop the progress of Chinese AI by limiting exports of GPUs (Graphics Processing Unit) to China, but this has only made the Chinese more resourceful, producing AIs trained on a small number of apple computers, like DeepSeek, or AliBaba reducing GPU usage 82% with a new GPU pooling system (Chow, 2025). While China is catching up fast in the AI space and has shown to be far more resourceful than the US, it still lags in hardware and commercial prowess, but again, is catching up very quickly.

Just as there is the current “So what?”-isms about the actual impact of AI, given that Gartner in 2018 had previously estimated that 85% of AI projects would fail to produce any value by 2022 (Gartner, 2025), we are seeing poorly implemented AI get beaten out by companies that have successfully built either AI software or hardware get valued in the trillions of dollars. We are in the Edisonian phase of finding 1000 ways not to make a light bulb, and for better or worse are on the cusp of finding the correct way of doing it.

This will culminate in the digital world manipulating the physical. Digital Threads/Digital twins is a systems architecture that is more and more focused on implementing AI to manipulate and predict the creation of a digital version of the physical world. Ultimately, this will be a natural outcropping of using AI to efficiently manage real world systems. Early concepts of “Golden Dome” will heavily utilize the MBSE (Model Based Systems Engineering) philosophy of a digital twin, being able to simulate real-time conditions digitally, analyze it, then take real-world actions based upon digital simulations (Kelly, 2025). Due to these big data and AI systems integrations, we are already seeing large-scale manufacturing changes, where companies like Relativity Space are 3D printing their rockets (Terran R).

A comparative analysis then comes down to what can be best summed up as Andrew Marshall’s prediction of future warfare, which is dependent on Precision Strike capabilities and “Informational” warfare (Jones, 2025, #L1833). While the US has the current upper hand with AI Hardware and Software, their constant export controls on China have made China more resilient and independent, and have not hurt them as much as both Biden and Trump have intended. China can also take advantage of the stability in their political leadership, given that Xi Jinping wholly controls the country and Chinese Communist Party. If there is a conflict between the US and China, it won’t start with a bang, but a silent destruction of defense software.

References

Big Data Defined: Examples and Benefits. (n.d.). Google Cloud. Retrieved November 23, 2025, from https://cloud.google.com/learn/what-is-big-data

BN, A. (2025, August 3). U.S. and China Carry the Weight of Global Data Center Growth. Digital Information World. https://www.digitalinformationworld.com/2025/08/us-and-china-carry-weight-of-global.html

Chow, V. (2025, October 18). Alibaba Cloud claims to slash Nvidia GPU use by 82% with new pooling system. South China Morning Post. https://www.scmp.com/business/article/3329450/alibaba-cloud-claims-slash-nvidia-gpu-use-82-new-pooling-system

Drozhashchikh, E. (2018, November 8). China’s National Space Program and the “China Dream”. Astropolitics, (16), 175-186. 10.1080/14777622.2018.1535207

Gartner. (2025, February 13). Gartner Says Nearly Half of CIOs Are Planning to Deploy Artificial Intelligence. Gartner. https://www.gartner.com/en/newsroom/press-releases/2018-02-13-gartner-says-nearly-half-of-cios-are-planning-to-deploy-artificial-intelligence

Hart, B. H. L. (2009). Strategy. Editorial Benei Noaj.

Husain, A. (2024, November 14). China’s Fast Growing Military Space Capabilities. Forbes. https://www.forbes.com/sites/amirhusain/2024/11/14/chinas-fast-growing-military-space-capabilities/?

Jean, S. (2025, August 18). The future of data storage? Look up. The Space Review. https://www.thespacereview.com/article/5043/1

Jones, S. G. (2025). The American Edge: The Military Tech Nexus and the Sources of Great Power Dominance. Oxford University Press, Incorporated.

Kelly, K. (2025, August 26). Aerial defense 2.0: Why speed, scale and survival define the Golden Dome era. SpaceNews. https://spacenews.com/aerial-defense-2-0-why-speed-scale-and-survival-define-the-golden-dome-era

Kleppmann, M. (2017). Designing Data-intensive Applications: The Big Ideas Behind Reliable, Scalable, and Maintainable Systems. O’Reilly Media.

Rolland, N. (2024, September 12). “Positioning” China: Power and Identity. Mapping China’s Strategic Space. https://strategicspace.nbr.org/positioning-china-power-and-identity/

Terran R. (n.d.). Relativity Space. Retrieved November 23, 2025, from https://www.relativityspace.com/terran-r

Wang, D., & Kroeber, A. (2025, August 19). The Real China Model: Beijing’s Enduring Formula for Wealth and Power. Foreign Affairs. Retrieved November 12, 2025, from https://www.foreignaffairs.com/china/real-china-model-wang-kroeber

Ziarnick, B. (2014). Developing National Power in Space: A Theoretical Model. McFarland, Incorporated, Publishers.

NASA’s cost and schedule headwinds on Artemis—centered on SLS and Orion—are now strategic risks, not mere programmatics. Even NASA’s leadership has flagged affordability, noting that “at $4 billion a launch, it becomes very challenging to have a moon program,” a tension between politics and economics that keeps widening.

Low flight rates compound risk. NASA’s independent safety advisors have repeatedly warned that programs with infrequent launches—explicitly including SLS and Orion—carry elevated safety and schedule exposure, while commercial systems learn faster through high cadence.

Former administrator Jim Bridenstine told Congress it is “highly unlikely that we will land on the Moon before China,” pointing at Artemis complexity and timelines. Current leadership has pushed back, but the underlying economics and tempo remain unresolved.

Meanwhile, China is executing a tight, purpose-built lunar stack. The Long March 10 has completed a seven-engine static fire toward crewed lunar missions, alongside pad abort tests for the Mengzhou spacecraft and takeoff/landing trials for the Lanyue lander—hardware steps aligned to a landing before 2030.

This methodical, cost-focused approach—building lunar capability incrementally and designing a lunar rocket for the mission—contrasts with America’s politically constrained architecture choices. If the U.S. optimizes for “first,” China may still win by optimizing for “sustainable and affordable.”

Unless NASA pivots to lower-cost, higher-cadence pathways that leverage commercial innovation, Beijing’s patient, economically rational plan could put taikonauts on the surface first—and keep them there longer.

SpaceX recently entered into a $17B deal with EchoStar to purchase spectrum, decreasing the reliance on mobile providers to provide telecom to SpaceX customers1. This is a prudent business move for SpaceX and opens up the opportunity to provide 5G like speeds and services via satellite connected to terrestrial networks. From SpaceX’s humble beginnings as a reusable rocket company, we are starting to see a pattern that is matched by several other startup space companies that are building launch platforms. Not only are they going to provide launch, but also other opportunities for generating revenue from space systems, like 3D printing, manufacturing in outer space, cloud compute/storage, and space mining. These revenue opportunities are significantly more risky and complex and will have a smaller user base then communications arrays. That is why “Direct to Device” (D2D) provides the best opportunity for space companies and governments to generate revenue to explore more risky, but potentially more financially rewarding opportunities elsewhere in space.

Beside SpaceX, we are also seeing the Amazon Founder, Jeff Bezos, backed Blue Origin focus on developing a launch platform in New Glenn for Amazon’s Project Kuiper2, which also promises to be a fast and reliable broadband/communications constellation and have already partnered with Jet Blue to provide free in-flight WiFi. China is also deploying their very own Guowang/Qianfan mega‑constellation3 and will most likely start exerting more soft-power over the global south by providing free and reduced (and censored and closely monitored) internet, that will no doubt push and favor Chinese propaganda4. Not to be left out, Europe has also joined the field with their IRIS5 (Interconnectivity and Security by Satellite) which they claim “isn’t a mega-constellation”, but will serve the same purpose as Starlink/Kuiper/Guowang with the network being shared by commercial, civil, and military applications.

What is interesting is that Apple will be funding6 48 more Globalstar satellites that underpins their SOS network. If we start to see more phone hardware providers cut more deals to fund their own infrastructure with mega-constellation providers, we could see a crash in the traditional telecom companies that continue to increase billing without increasing their underlying infrastructure or service. Rural customers are already starting to sing the praise of SpaceX’s Starlink as a way to get affordable, high-speed internet in areas that traditionally were reliant on slow and overpriced cell provider networks.

Consider also that these satellite communications providers have also clashed with the more totalitarian regimes (such as Iran, China, Russia) given that they are able to provide censored material directly to the phone user without passing through the traditional nationwide firewalls that would block them. While these regimes have non-kinetic ASAT (Anti Satellite) options, even the most stringent of regimes is not looking to risk destroying or altering the space infrastructure of other nations, especially that of the United States, but that has changed drastically in recent years as China has gained more international legitimacy. We may see a very near future in which the most damaging weapon the US can provide against a regime is secure, non-firewalled devices with unlimited internet access to an enemies disaffected population.

If space based hybrid communications networks end up only capturing 1% of the worldwide revenue from telecom companies, it would still be $15.3 billion dollars. In reality, we are looking at a much higher number as space companies build and refine more of their products and infrastructure. It is getting cheaper, easier, and more reliable to launch space systems and we should expect rapid innovation to come along with that, especially when Space companies start capturing some of the annual $1.53 trillion in telecommunications revenue7.

NASA has been at the forefront of American Spacepower and exploration for decades, but there is also a retreat from funding NASA and related advisory committees of private and public sector leaders that help push forward progress in space for America (Foust, 2025). This isn’t to say that America is not attempting to shape International Relations in its own image and hold on to its hegemon, Trump believes he can take a more “Realpolitik” approach to diplomacy (Dolman, 2002, L#3894) and is applying old school, brown water tactics to spacepower (Dolman, 2012, #82) with the advent and creation of the “Golden Dome” space defense system, but this does not, a “Space Race” make.

What about from the Chinese perspective? China has been a silent and background member of the first (and arguably only) Space Race since nearly the USA and USSR have been a part of it. China’s space program began when scientist Qian Xuesen was returned to China from the United States (Drozhaschikh, 2018, #176). One of the major differences between China and the USSR/USA was that China viewed space systems (like satellites) as a way to modernize and develop their economy, especially when it came to communications that were able to enable government operations and education and also observational satellites to monitor weather and optimize agriculture (Drozhaschikh, 2018, #178). In modern times there has been a drastic uptick in the amount of space related development in China, but it is not necessarily related to a “Space Race”. China sees these developments as a natural evolution of their earlier space objectives of increasing national prestige and power from a geographic and economic standpoint (Husain, 2024). This rapid development can also be attributed to the rise in big data and AI systems that are revolutionizing how fast complex systems can be built and integrate hardware with software and China has invested heavily in this infrastructure (Wang & Kroeber, 2025). This has inevitably bled over into their military strategy and technology, and has become an integral part of how the PLA views its operations (Husain, 2024). US restrictions on China to prevent their AI technology from becoming on par with US AI technology has actually caused China to become more resourceful in developing AI, which in turn has given them an advantage in resource constrained space environments where every watt of power used counts (Wang & Kroeber, 2025). America only has a 15% energy reserve while China has a 100% energy reserve that could continue to power high tech and energy hungry AI resources in the rapidly developing sector (Horowitz & Kahn, 2025).

It is better to view the current competition of China vs the USA not as a “Space Race” but as the natural output of a rising power compared to a declining power, or at least one that is looking to hold onto the post Cold War 20th century power structure in which it enjoyed its hegemonic advantage (Carlson, 2020, L#131). China on the other hand has the advantage of time on its side, it is investing heavily into modernizing its infrastructure to combat future issues of energy consumption of data centers and network farms, both terrestrially and in space with Space Based Solar Power (Carlson, 2020, L#621), it is competing with GLONASS and GPS with its BeiDou constellation (Drozhaschikh, 2018, #178). These could hardly be considered elements of a “Space Race” as defined earlier, these are investments, at least on the part of China, while America’s reasons for space exploration could potentially fall within the bounds of a “Space Race”.

A main point that could define America’s space initiatives as engaging in a race is NASA acting administrator and Transportation Secretary Sean Duffy making a point of timelines being dependent on when China plans to land on the moon (Foust, 2025). America is running a short sprint alongside China’s marathon and pretending like we are ahead. China has been making these plans since 1949 and have been hitting their milestones regularly since that time (Pillsbury, 2016, #19). America has aimed to slow down Chinese progress industrially, but has ultimately accidentally done the opposite by making them more resourceful.

America does have reason to be concerned about Chinese Space Supremacy, so even if deadlines are arbitrary, they help to establish goals. Even the more innocuous technologies like communications systems and integrated networks are becoming more prevalent in the determination of great powers. China is aiming to deploy a communications array (Guowang LEO network) that could break SpaceX’s monopoly on providing global satellite based internet access and provide it at a lower cost or even for free (Jones, 2025). Bill Clinton once stated controlling the internet is like “trying to staple jello to a wall”, but China has actually found the internet to be an amazing tool for control, social manipulation, and surveillance, and building out LEO satellite networks essentially means it can take its surveillance state worldwide (Wang & Kroeber, 2025).

There is a potential argument that America in certain aspects is in a Space Race against the shadow of China and is seeing ground ceded on a daily basis, but what is interesting is that this ground isn’t being ceded in the Space domain, but the domain of Software, Hardware, Cybersecurity, Big Data, AI, and advanced manufacturing. All of these are the bellwether of a dominant future world economy where space infrastructure will be like the advent of littorals to sail, coal to steam, oil to combustion, or Ford to the automobile. China is in a goal oriented holistic march towards regional dominance based on well crafted decades old plans and are slowly, but surely starting to surpass America.

References

Arms Race: Definition, Cold War & Nuclear Arms | HISTORY. (2009, October 14). History Channel. Retrieved October 2, 2025, from https://www.history.com/articles/arms-race

Carlson, J. (2020). Spacepower Ascendant: Space Development Theory and a New Space Strategy. Independently Published.

Dolman, E. C. (2002). Astropolitik: Classical Geopolitics in the Space Age. Frank Cass.

Dolman, E. C. (2012, Spring). New Frontiers, Old Realities. Strategic Studies Quarterly, 6(1), 78-96. http://www.jstor.org/stable/26270791

Drozhaschikh, E. (2018, November 8). China’s National Space Program and the “China Dream”. Astropolitics, 16(3), 175-186. 10.1080/14777622.2018.1535207

Faulconer, W. (2025, August 22). NASA needs bold leadership — or we'll be watching on TV while Beijing lands on the moon. SpaceNews. Retrieved October 10, 2025, from https://spacenews.com/nasa-needs-bold-leadership-or-well-be-watching-on-tv-while- beijing-lands-on-the-moon/

Foust, J. (2025, August 15). FAA removes membership of space transportation advisory committee. SpaceNews. Retrieved October 1, 2025, from https://spacenews.com/faa- removes-membership-of-space-transportation-advisory-committee/

Foust, J. (2025, September 5). Duffy pushes back against testimony that NASA is falling behind China in lunar exploration. SpaceNews. Retrieved October 10, 2025, from https://spacenews.com/duffy-pushes-back-against-testimony-that-nasa-is-falling-behind- china-in-lunar/

SPST563 China’s Space Program - Comparative Essay 1 Trevor Barnes

Horowitz, M. C., & Kahn, L. (2025, September 26). The Cost of the AGI Delusion: By Chasing Superintelligence, America Is Falling Behind in the Real AI Race. Foreign Affairs. Retrieved October 10, 2025, from https://www.foreignaffairs.com/united- states/cost-delusion-artificial-general-intelligence

Husain, A. (2024, November 14). China’s Fast Growing Military Space Capabilities. Forbes. Retrieved October 3, 2025, from https://www.forbes.com/sites/amirhusain/2024/11/14/chinas-fast-growing-military-space- capabilities/

Jones, A. (2025, September 2025). spacenews.com/china-boosts-broadband-iot-and- weather-satellite-fleets-with-flurry-of-launche. SpaceNews. spacenews.com/china- boosts-broadband-iot-and-weather-satellite-fleets-with-flurry-of-launche

Miller, G. D. (2023). Sun Tzu in Space: What International Relations, History, and Science Fiction Teach Us about Our Future. Naval Institute Press.

Pillsbury, M. (2016). The Hundred-Year Marathon: China's Secret Strategy to Replace America as the Global Superpower. St. Martin's Publishing Group.

Prescott, J., & Gewirtz, J. (2025, September 29). China Goes on Offense: Beijing's Plans to Exploit American Retreat. Foreign Affairs. Retrieved October 3, 2025, from https://www.foreignaffairs.com/united-states/china-goes-offense

Sciutto, J. (2020). The Shadow War: Inside Russia's and China's Secret Operations to Defeat America. HarperCollins Publishers.

Wang, D., & Kroeber, A. (2025, August 19). The Real China Model: Beijing's Enduring Formula for Wealth and Power. Foreign Affairs. Retrieved October 2, 2025, from https://www.foreignaffairs.com/china/real-china-model-wang-kroeber

SPST563 China’s Space Program - Comparative Essay 1 Trevor Barnes

What Was the Space Race? | National Air and Space Museum. (2023, August 23). National Air and Space Museum. Retrieved October 1, 2025, from https://airandspace.si.edu/stories/editorial/what-was-space-race

Zhao, M. (2019). Is A New Cold War Inevitable? Chinese Perspectives On US–China Strategic Competition. The Chinese Journal of International Politics, 371-394. 10.1093/cjip/poz010

This is a response to the following article:
spacenews.com/nearly-4000-nasa-employees-opt-for-voluntary-buyouts/

It would be interesting to see the breakdown of the demographics of those that have left NASA according to the article above. It mentions a significant portion of senior personnel leaving, but it would be good to see the roles and experience in an accurate breakdown. Considering NASA has been plagued by budget overruns and management challenges, this may or may not be a good thing. The performance NASA has been less than lackluster, so this may be a blessing in disguise. We have to keep in mind that the main push of NASA recently has been the Artemis program and returning man (woman?) to the moon, of which it seems we are falling behind China, and even India in this space (pardon the pun). This raises concerns about the future of the American Space program and liberal democracies place in a space-faring future. The geopolitical implications are significant. We can not have the likes of Russia and China dominating all of the prime spots on the moon, or being the first to start asteroid mining.

If NASA was supposed to be the world leader in space exploration, it might be a good thing that their funding is cut, but the question then becomes, what was cut and where will those funds go? If we are really losing top talent from NASA that are specialized in fields that are necessary for space exploration, maybe the many private corporations will pickup these talented individuals. While I do believe that the federal government should be funding and creating strategic direction for the future of space, we can also agree that the wrong people could be in place to do so, which will only exacerbate the failing NASA's programs. Strategic reforms are needed. A coherent national space strategy should be developed that breaks past NASA and military thinking.

It is important to measure the future of a space faring nation against the the Space Development Theory of Dr. Joshua Carlson as stated in his book [[Spacepower Ascendant]]. This breaks the development of national space strategy into different phases (they don't necessarily need to be concurrent but generally are); Exploration, Expansion, Exploitation, and Exclusion (Sovereignty). The issue with NASA is that it solely focuses on the exploration phase of Space Development Theory (SDT from here on out). If the exploration phase is not leading to expansion, exploitation, or exclusion then the value of the exploration is a sunk cost. We are simply throwing good after bad. The American people deserve a space program that actually benefits them. At this point in time, the molecular makeup of Pluto and studying its orbit to determine whether it is a planet or not is not a good use of resources.

This is why NASA should be focused explicitly on supporting commercial operations in space. Space companies should help guide the direction of NASA for mutual benefit of the American people. It could help to answer questions about orbital periods of asteroids and chemical compositions for mining operations, same with the moon. While projects like Voyager and the James Webb telescope help us to answer deep scientific questions, what is the real value they provide in return? NASA should act in a similar capacity to the FAA and NOAA, providing more regulatory guidance, traffic management, and operating information for commercial operations. NASA could also act as a more focused DARPA for space operations, or even be absorbed by DARPA, providing highly beneficial research for space exploration that would guide commercial company operations and strategies.

It is not a stretch to say that the American people have lost interest in NASA and landing some people on the Moon 60 years after we already did that is not going to spark any additional interest, and that is okay. NASA can fall into the background and act as a critical component for future space-faring operations as another (metaphorical) 3 letter agency.

Securing Cyberspace in Space Systems: The Value of Information Security in Space Power

Securing communications via cryptography has been around far longer than the computer has been, in fact most of the earliest documentation on ciphers and encryption are dated back to ancient history, most prominently the Caesar Cipher (Holden, 2017). The Caesar Cipher worked by shifting a letter a number of spaces in the alphabet (Military Dispatches Editorial, 2024). So a Caesar Cipher with an offset of 3 made the letter ‘A’  become the letter ‘D’, therefor ‘Apple’ became ‘Dssoh’. While this was effective in the ancient world, better techniques became required. A more modern example is during WWII where the German Enigma machines instituted a complex electro-mechanical device to encrypt their messages and made them nearly unbreakable (Military Dispatches Editorial, 2024). Assuming the historical necessity is carried forward to modern day, we would expect one of the backbones of military communications, space systems, would require the same level of secure communication.

Background

Clausewitz had come up with the theory around the “fog” and “friction” that is found in war (von Clausewitz, 2008). An important factor in the friction of war was the lack of information surrounding the enemy, the elements that cannot be easily measured when in the planning phase. It is what distinguishes what Clausewitz considered “real” war versus that of war “on paper”. Reducing the friction in war reduced the possibility of Clausewitz’s version of “chance” playing a part and allowing for operations to go as closed to planned as possible. To this end, Clausewitz stated that “accurate recognition” was one of the biggest frictions in war and that accurate intelligence is what increases accurate recognition (von Clausewitz, 2008).

While the “logic” of strategy used to define national power may be pointed out as a “Delta” configuration consisting of the Military, Economic, and Political points, the Pentagon has routinely used DIME (Diplomatic, Information, Military, and Economic) as a way to describe the core elements of national power (Ziarnick, 2015). Space power theorists have used DIME to extend their definition of Space Power Theory (SPT). It would be hard to find a situation in which the Military, Diplomatic, or Economic instruments of national power could exist without the Information instrument. Our modern world has made sure that the overwhelming majority of information is processed digitally, and nefarious actors look to exploit cyberspace. The complexity of cyberspace cannot be understated, the Pentagon has had 13 separate definitions (as of 2014) of cyberspace and this will likely increase as the landscape becomes ever more complex and developed (Singer, 2014). Another issue compounding this problem is the leaders responsible for creating laws and regulations around cyberspace did not grow up using computers, many don’t understand that if you have access to the internet, then it also has access to you. Adding in the complexity that is space systems on the already complex topic of cyberspace further exponentiates this problem of fundamentally grasping the various computer, electrical, physics, astronomy, engineering, mathematical, and cryptographic fundamentals needed to understand the system they are responsible for protecting.

The Gulf War in 1991 was widely believed to be the first “Space War” due to the advantages gained and the power projected through space in a foreign territory (Ahumada & Del Canto Viterale, 2024). At the time, satellite communications was little understood by the Iraqi forces and thus there was no effort to intercept any communications, regardless, the going concern of satellite communications was the complexity in the system was the security, prioritizing function of the satellite instead (Ahumada & Del Canto Viterale, 2024). This had drastically changed and by the time U.S. Forces had returned to Iraq, the remnants of the Iraqi Republican guard were spoofing American guided missiles to miss their targets with a decoy device built in China for only $25 (Pillsbury, 2016). One of the 5 major areas of Space Hybrid Operations is Cyber Operations (the rest being; Directed Energy Operations, Orbital Operations, Electronic Operations, and Economic Operations (Ahumada & Del Canto Viterale, 2024)), yet as has been pointed out by Satellite Cybersecurity researchers, little attention is paid to the topic (Schalk et al., 2022). This has led smaller, less developed countries like Iran and North Korea have the means to attack our space systems via antagonistic cyber operations.

Adversarial Threats to Space Systems

Space systems as defined by space cybersecurity researcher, Gregory Falco, are “the assets that exists in suborbital or outer space or ground control systems, including launch facilities for these assets” (Falco, 2019). Space systems are the backbone of Command, Control, Communications, Computer, Intelligence, Surveillance, and Reconnaissance (C4ISR) capabilities for the military. Adversaries aiming to “level the playing field” against great powers have strong incentives to undermine these capabilities by damaging space systems (Pavur, 2021, p. 20). China has already implemented this strategy in their People’s Liberation Army (PLA) Strategic Support Forces (SSF) and have single responsibility for both counter-space weapons and offensive cyber operations (Pavur, 2021, p. 21). This is rather telling of the belief the Chinese have. This can only be interpreted as space and cyber being so necessarily interlinked that a single responsibility of command for both needs to be granted to a single authority within their military apparatus. China knows that America is highly dependent on its space systems and it is viewed as a critical system to attack to remove American power (Pillsbury, 2016). Without space systems America loses its GPS, surveillance, guided missiles, unmanned drones, and a lot more. China has even invented parasitic drone satellites that can attach to American satellites to either disable them or steal its information (Pillsbury, 2016).

Table 1. Types of Counterspace Capabilities (Fanning et al., 2024)

It could be stated that a cyber threat is no greater than a kinetic, non-kinetic, or electronic attack, but there is quite a large difference in the ends which leads one to believe that cyber will always be the first means of attack on a space system as viewed in Table 1. Firstly, kinetic attacks will require physical actions with known states or organizations that would be responsible for (or easily deduced as responsible) the attack and couldn’t be considered anything short of an act of war (especially when targeting a ground station). The cost to carry out these attacks would be very high, either in lives attacking ground stations, or monetarily in launch costs and space weapons development. There is also the cascade effect in which the destruction and resulting space debris from an attack could set off a chain reaction, also destroying the attackers satellites in space and even potentially making it impossible to travel to space. Secondly, Non-Kinetic attacks suffer from a lot of limitations of kinetic attacks, in which the cost is very high, especially in regards to nuclear attacks, and the cost of Directed Energy weapons is immense. Thirdly, the Electronic means while potentially harder to attribute, are not necessarily impossible, like in the case of Russia and spoofing GPS information in the Black Sea in 2017 (Falco 2019). Electronic attacks are non-permanent means of attacking a space system. This leaves the final form of attack that is arguably both quantitatively and qualitatively the best option to attacks a space system. The reason being, it is cheap, requires no domain knowledge, its very difficult to attribute the attack to a specific attacker, and you can choose how damaging the attack is. If you just need to get some information from the downlink of the satellite, the operator of the space system would be non the wiser (Pavur, 2021). Or if the space system is viewed as a threat that needs to be destroyed, you can brick the satellite to turn it into nothing more than a piece of useless space junk (Schalk et al., 2022).

With the establishment of cyber operations as the most approachable form of space systems attack and the evidence backed up in the form of PLA organizing their cyber-ops and space-ops under the SSF, it is prudent to look at the current state of the development of cyber operations in regards to developing national power in America. In fact, China disproportionately targets the cyber infrastructure of America precisely because of its reliance on critical infrastructure that depends on weakly secured cyber-physical systems (Pillsbury, 2016). China calls this their “Assassin’s Mace” and link naval power directly to space power and in the future plan on exploiting weaknesses in space systems to exploit naval operations (Pillsbury, 2016).

Current State of Cyberspace in Space Systems

The lack of value placed on cybersecurity for space systems is concerning considering the world is increasingly dependent on satellite communications for communication, banking, infrastructure, and much more day-to-day critical operations. The U.S. Department of Homeland Security has defined critical infrastructure across 16 different sectors, and most of this critical infrastructure relies on Space Systems. There are over 2,000 operational satellites that have a market worth of $150 billion annually, that include nearly 10 Tb/s of global internet capacity that will grow to 100 Tb/s by 2035 (Pavur, 2021). In our increasingly interconnected world, we place more and more trust into the hands of infrastructure that is facing drastically increased threats to its operations. Satellite cybersecurity doesn’t just affect the military and government, they only account for 30% of satellite operations, commercial operations account for 40% of operations and account for everything as mundane as getting the weather to broadcasting important news to over 100 million satellite TV subscribers to validating banking operations and combating fraud (Pavur, 2021). A simple way to ensure that satellite operations operate safely from a information security (InfoSec) perspective is to implement strong encryption in its communication.

Traditionally, satellites have been a closed source and proprietary system that has allowed for very little research to be conducted into the inner workings of the technology. As an example, when the Iridium satellite constellation was deployed it provided services to the Pentagon, but no cybersecurity was implemented in the system because it was believed that it was too complex to hack (Falco, 2019). While Iridium allows their users to encrypt their traffic, White Hat German hackers were able to prove that users trying to encrypt their own traffic isn’t enough and were able to get very sensitive texts and location data for high ranking DoD officials (Tereza Pultarova, 2025). There has been a rapid change with the reduced cost of space launches and increases in CubeSat manufacturing, allowing for even the most budget conscious commercial, educational, and government institutions to launch satellites into space and develop their own space systems (Pavur, 2021, p.19).

With this increase in space systems, NASA has found it amenable to create an open source software (OSS) tooling that helps users to create software for their space systems called core Flight System (cFS) (NASA’s Goddard Space Flight Center, 2017/2025). This software is a framework written in C that has been used on flagship spacecraft, human flight systems, cubesats and Raspberry PIs. While NASA does state that out of the box it is not flight ready and needs some additional programming, they also mention nothing about the cybersecurity of the framework, and it has been documented that many that use this framework do not actually implement cybersecurity (Schalk et al., 2022) and that space systems that implement this framework can easily be taken down with a couple lines of Python code, opening up major space systems attacks to “script kiddies”. At most, users were implementing simplistic encryption schemes that were easily broken and had no fallback encryption key (Oakley, 2020).

Analyzing many of the cyber attacks on space systems, researchers such as Gregory Falco at the Aerospace Adversary at Cornell University, James Pavur at Oxford, and many industry leaders that attended the Aerospace Village at DEF CON 32 (DEF CON 32, 2024) have pointed to unencrypted satellite networks that can be accessed via equipment you can buy on Amazon for a couple hundred dollars. The USSF CSO General Chance B. Saltzman is warning that the Unite States needs to prepare for a cyber conflict in space  (Ahumada & Del Canto Viterale, 2024). His belief is that space and cyber are inextricably linked and if data integrity is not ensure then all of the USSF’s systems are worthless. The major idea being pushed is that the USSF needs more cybersecurity training directed at their guardians, but humans are always prone to err and while training is beneficial, the focus should be on implementing industry standards that are already in place. Like 2 Factor Authentication (2FA), strong passwords, etc… but it is also important to build robust infrastructure and utilize modern network protocols like QUIC and Performance Enhancing Proxies (PEP) across Virtual Private Networks (VPN)

Securing Communications in Satellite Operations

Virtual Private Networks (VPN) make transferring data from a host machine to a server secure across the internet by creating an encrypted tunnel between the two (How Does a VPN Work?, 2025). The VPN ensures that only the users who are suppose to have access to the data or systems within a companies (or users) network do so. While describing the varying details such as protocol selections, firewall setup, NATs, OSI, and encryption schemes are out of the scope of this paper, it is necessary to define some elements in order to solidify a model to work from for this topic. Firstly, we will only be discussing UDP (User datagram Protocol) which is generally defined as an unreliable, unordered, but blazingly fast transport protocol and TCP/IP (Transmission Control Protocol/Internet Protocol) protocol. TCP requires a “3-Way Handshake” between a host and server, which given latencies in satellite communications, this would turn a https request that takes 0.5 seconds to reach the satellite 1.5 seconds in order to start the request, UDP does not require this handshake (Davies, 2020). Secondly, a Performance Enhancing Proxy (PEP), is a proxy server (essentially a computer that handles your https request for you) that allows to avoid some of the time consuming sitting and waiting for request by automatically maintaining a connection with a server and already in use by many satellite providers today. QUIC (Quick UDP Internet Connection) is a relatively new transport protocol that uses UDP, 0-RTT (Zero RoundTrip Time), TLS by default, and HTTP/3 which allows for faster connections via multiplexing.

Earlier was discussed the ability to eavesdrop on sensitive information from Iridium satellites that were managing and handling DoD data. This issue still hasn’t been fixed in a significant amount of satellite communications. The main reason for this being is because to deploy applications that encrypt data and communications requires additional CPU power and will increase latency on already latency burdened satellite data connections. This is where a novel approach has been invented by James Pavur out of Oxford University. He has combined the safety and reliability of VPN connectivity with the performance enhancing properties of PEP via a QUIC Session called QPEP (QUIC PEP). This allows for end to end secure and encrypted data to be transferred via satellite without all of the latency and insecurity.

FiguRE 1: QPEP (Pavur, 2021)

When engaging in this research Mr. Pavur had to alert the FBI to his findings due to the amount of encrypted traffic from the 4 largest VSAT providers. He accidentally gathered information that jeopardized national security, for example in one transmission he received the manifest of a ship that was carrying hydrogen sulfide, which the Islamic State does their best to manufacture for the development of chemical weapons (Pavur, 2021). Extremely private information was also transferred unencrypted, being of both a financial and personal nature. He was also able to access data from services that typically cost thousands a month to use, all for a couple hundred dollars in commercial off the shelf (COTS) equipment.

Without disparaging the hard work that Mr. Pavur has done to design and implement this new protocol for satellite communications, this work also highlights how far behind the United States is on taking cybersecurity seriously whilst also claiming that it is developing national space power. The reason being the code base that has been developed for QPEP is rather small and barring the research going into it, the amount of code written would be expected to be completed by a mid-level network software engineer to write over a couple of sprints (sprints are anywhere from 2-4 week cycles) (Ssloxford/Qpep, 2019/2025). An advantage of this code being opened source is that it allows users to look at the code and make an informed decision on whether or not they want to implement the protocol, versus proprietary black-boxes that operate as a take it or leave it situation. Also, one of the security flaws in proprietary tooling that was highlighted by the Salt Typhoon attacks from China (Segal, 2025), is that they have built in backdoors that are supposed to be used by law enforcement, but lead to exploits by nefarious actors.

What this provides based on benchmarking data is a much faster and secure satellite network experience. Running 100 connections to the Alexa Top 20 internet domains resulted in 54% faster load times for QPEP than the proprietary competitor, averaging 13.77 seconds to the competition’s 30.5 seconds (Pavur, 2021).

If the United States wants to continue to count itself among the space powers and prevent certain nefarious state(s) from becoming a hegemon in space, it needs to start moving towards the less focused on aspects of maintaining the infrastructure of a great space power in its cybersecurity and more explicitly investing in technologies and a workforce that develop the most advanced communications and cyber systems in the world.

Works Cited

Ahumada, A., & Del Canto Viterale, F. (2024). Securing the Final Frontier: United States Space Force Cybersecurity Capabilities. Astropolitics, 22(3), 145–169. https://doi.org/10.1080/14777622.2024.2439802

Davies, G. (Ed.). (2020). Networking fundamentals: Develop the networking skills required to pass the microsoft MTA networking fundamentals exam 98-366. Packt Publishing.

DEF CON 32. (2024, August 11). Aerospace Village. https://www.aerospacevillage.org/defcon-32

Falco, G. (2019). Cybersecurity Principles for Space Systems. Journal of Aerospace Information Systems, 16(2), 61–70. https://doi.org/10.2514/1.I010693

Fanning, E., Swope, C., Young, M., Chang, M., Songer, S., & Tammelleo, J. (2024). Space Threat Assessment 2024.

Holden, J. (2017). Introduction to Ciphers and Substitution. In The Mathematics of Secrets (NED-New edition, pp. 1–28). Princeton University Press. https://doi.org/10.2307/j.ctvc775xv.5

Military Dispatches Editorial. (2024, June 12). Exploring Historical Cryptographic Devices in Military History—Military Dispatches. https://militarydispatches.com/historical-cryptographic-devices/

NASA’s Goddard Space Flight Center. (2025). Core Flight System (cFS) [CMake]. https://github.com/nasa/cFS (Original work published 2017)

Oakley, J. G. (2020). Cybersecurity for Space: Protecting the Final Frontier. Apress L. P.

How Does a VPN Work? (2025). Palo Alto Networks. https://www.paloaltonetworks.com/cyberpedia/how-does-a-vpn-work

Pavur, J. (2021). Securing New Space: On Satellite Cyber-Security [Oxford University]. https://www.proquest.com/docview/2647158963?pq-origsite=primo

Pillsbury, M. (2016). The Hundred-Year Marathon: China’s Secret Strategy to Replace America as the Global Superpower. St. Martins Griffin.

Pultarova, Tereza. (2025, February 12). Hackers Expose Iridium Satellite Security Issues—IEEE Spectrum. https://spectrum.ieee.org/iridium-satellite

Schalk, A., Brodnik, L., & Brown, D. (2022). Analysis of Vulnerabilities in Satellite Software Bus Network Architecture. MILCOM 2022 - 2022 IEEE Military Communications Conference (MILCOM), 350–355. https://doi.org/10.1109/MILCOM55135.2022.10017967

Segal, A. (2025, January 21). China Has Raised the Cyber Stakes. Foreign Affairs. https://www.foreignaffairs.com/united-states/china-has-raised-cyber-stakes

Singer, P. W. (2014). Cybersecurity and Cyberwar: What Everyone Needs to Know. Oxford University Press.

Ssloxford/qpep. (2025). [Python]. SSL Oxford. https://github.com/ssloxford/qpep (Original work published 2019)

von Clausewitz, C. (2008). On War (M. E. Howard & P. Paret, Eds.). Princeton University Press. https://doi.org/10.1515/9781400837403

Ziarnick, B. D. (2015). Developing national power in space: A theoretical model. McFarland & Company, Inc., Publishers.

What is the purpose of the author?

The authors are trying to assess the vulnerabilities present in modern satellite software. There are several major concerns in regards to basic cyber-security practices that are not implemented in modern satellite systems. The authors hope to provide some basic guidance on building a robust cybersecurity process to protect the Software Bus on satellite systems from cyber attacks. In the past, security professionals believed that the obscurity of flight software and the complexity of it would deter would be bad actors from exploiting the software. This is no longer the case and poses a major security concern (Schalk et al., 2022, p. 350).

What is being researched?

NASA's OSS (open Source Software) cFS (core Flight System) is a generic software architecture framework used on several spacecraft, satellites, and even Raspberry Pi's. The GitHub repository consists of several submodules that anyone can use to build their own flight software with the framework already provided (https://github.com/nasa/cFS). NASA has many goals for cFS that mainly focus on efficiency and cost effectivity for anyone with an interest or goal to utilize flight software for satellites. This will increase collaboration and accelerate development for many individuals as well as businesses (Schalk et al., 2022, p. 352)[2]. It is mentioned that security is not stated anywhere in the cFS design documents, but instead it is recommended that you build your own security alongside your software (Schalk et al., 2022, p. 352)[2]. Since this is the primary software that is used on satellite Software Bus', the authors believe that this will provide the most coverage with their recommended results.

The SPP (Space Packet Protocol) was developed by the CCSDS (Consultative Committee for Space Data Systems) and was built as a reliable communication standard for satellites and is widely adopted by the industry. It does not provide any security function, but security functions can be implemented at the SDLS (Space Data Link Security) protocols at the network layer. SDLS should be implemented if you are aiming for secure communications (as everyone should) (Schalk et al., 2022, p. 351). This still requires cryptographic keys on both ends of the ground station and satellite to be secure.

The authors will be using a tool called OSK (OpenSatKit). OSK is an open source software package used to test out starting up new satellite missions and learning how to operate a ground station and controlling a satellite (Schalk et al., 2022, p. 351). It will be as close to implementing a cyber attack on a real satellite as possible.

Why is researching this problem important?

Most ASAT (Anti-Satellite) research focuses on the electronic and jamming aspects via hypothetical scenarios on unsecured satellites, but when it does focus on cyber security vulnerabilities in satellite systems has mainly focused on protocols, encryption, and credential management, which means the focus is on the data-link side and not in the systems architecture. There are opportunities to focus on cyber ASAT as it is cheap and can take place in "non-hypothetical" scenarios in which real satellites are accessed (Schalk et al., 2022, p. 350). The world is growing more dependent on satellites and with the rise of Reusable Rockets, CubeSats, and OSS (Open Source Software) driving down the cost of a launch, we are going to see a boom in the industry (Schalk et al., 2022, p. 350) and if we are unable to protect these extremely valuable and critical assets, we face major ramifications on national security.

Theory

What is the major theory that the author is proposing?

Up until the recent commercial boom in the space industry and the open sourcing of cFS, most of the details about satellite hardware and software was limited to the government and military. This closed system had a high barrier to entry and significantly limited the amount of research possible into satellite systems (Schalk et al., 2022, p. 351). Now, we have more open source systems that allow for more people to access space.

The Air Force's recent hackathon had a project that showed how easy it is to exploit faulty encryption schemes. Even when it was setup properly it acted as a single point of failure that could easily be exploited. More layers of security are needed than just encryption (Schalk et al., 2022, p. 350). Being able to disable a satellite by non-kinetic means can pose a significant advantage for countries with limited arsenals, but strong cyber capabilities. The threat is very cost advantageous relative to kinetic or electronic ASAT means and can be done by an individual or group of individuals (Schalk et al., 2022, p. 350). The Authors believe that this is a very possible reality in which a small group of nefarious actors with limited resources would be able to disable satellites using the cFS framework.

What is the hypothesis?

Putting all of that together, the authors believe that they can simulate a real satellite operation (OSK) using Open Source and extremely popular flight software (cFS) and use the basic satellite communication protocol (SPP) to do so. If they are able to show at least one exploit that allows them to simulate taken a satellite offline in the same way that a nefarious actor would, they prove the hypothesis of critical cyber-security flaws in open source software.

The authors will do this by attacking the Software Bus in the simulated system. It will be useful to understand some of the common software architecture before moving on further.

The basic architecture of a satellite system is a ground station that transmits commands via up-link and listens for satellite telemetry via down-link. The satellite in space receives the commands form the ground station and executes them then sends back the data (Schalk et al., 2022, p. 352).

Previous versions of satellites had customized and complex hardware that was used to transmit data throughout the satellite. New versions streamline the process by using a Network/Software Bus that receives the data then transmits to other systems/hardware of the satellite, which has helped streamline the satellite manufacturing process (Schalk et al., 2022, p. 351). Also, older satellites would be configured based on their mission, but the cFS allows for "plug and play" opportunities that allow for changing the software and mission via the cFS framework via the cFE. While this is very powerful in its flexibility, you are now able to move data via the Software Bus where in previous architectures you were unable, this opens the door for exploitation (Schalk et al., 2022, p. 353).

The cFE (Core Flight Executive Service) is the backbone of the cFS architecture which relies on the Software Bus. When the satellite starts a number of applications automatically subscribe to the Software Busand start to receive messages. The ground station send a command to the satellite, which then receives it via its communication application and sends the message to the Software Bus. Once all applications that are supposed to receive the message receive it, the command executes. Reverse the process to send data back to the Ground Station (Schalk et al., 2022, p. 353).

![[cFE.png]]

Data Collection and Analysis

What/How was the data collected?

Schalk, Brodnik, and Brown collected data via their testing of a simulated satellite network using NASA's open source and widely popular cFS framework. With some Python programming and computer architecture familiarity they were able to exploit and attack simulated satellite networks that currently several government, military, and commercial launch providers and satellite operators use (Schalk et al., 2022, p. 351).

The data was collected as a response to the actions of the simulated nefarious actors. If the cFS stopped responding, the logs were checked to determine what the failure issue was in the framework. It was a binary response for success criteria, either the satellite continued to work after the cyber attack or it didn't.

What did the analysis show?

Schalk, Brodnik, and Brown were able to simulate 4 different exploits on cFS via OSK; a Replay Attack, a cyber based DoS Satellite attack, an exploit command that deletes the ingest module, and an systematic brute force exploit that sends cFS commands to delete an application of any name (Schalk et al., 2022, p. 353).

In the "Replay" attack Schalk, et al. where able to send a no-op (no operation) command to the health and safety module that did nothing. They were able to repeat this process and insert their own commands into the module and the module was unable to tell a difference between the commands. This means that an adversary could attack the module be putting a nefarious script into a command sent to any module (Schalk et al., 2022, p. 354).

A DoS attack is a "Denial of Service" where you overwhelm the cpu and prevent it from being able to process all of the data coming into the satellite. This is very similar to electronic jamming of a satellite, but significantly cheaper and easier. Jamming requires big, complex equipment that requires a lot of power to jam the external systems. A DoS attack just needs to overwhelm the Software Bus and no other systems (Schalk et al., 2022, p. 354). The Python code on this was extremely simplistic and I didn't have enough room in this paper to explain it and same with the other examples.

The exploit command that deleted the ingest module vulnerability was severe enough the Schalk et al., named this the Cyber-ASAT attack. This is an exploit in the cFS command that deletes the command ingest module that is responsible for receiving commands from a ground station. There is an actual command that deletes applications running on cFS in the cFS framework. This is a major vulnerability. The only way to fix this is to manually reset the software, which is impossible unless you do it from space (Schalk et al., 2022, p. 354). It is equivalent to being able to run a command on your computer that deletes the program that reads input from your mouse and keyboard, and then the only way to reset it is to climb Mount Everest to hit a button.

Schalk et al. were able to exploit the cFS via a brute force attack that iterates through the Software Bus guessing the name and version of applications and deleting them. This is far less sophisticated than their exploit command that deletes the ingest module attack, but just as effective. Since the Software Bus can only handle so many commands at a time this will take quite. while to exploit (Schalk et al., 2022, p. 354).

When dealing with the Software Bus in a satellite, every application has the ability to send and receive commands over the Software Bus with the highest level of permissions. That means that a security exploit in say, an x-ray sensor, has the ability to access and change the software and messages sent to the avionics or data storage. Every message on the Software Bus will be assumed to be a message from an authorized ground station. Stack on-top of this issue that the satellite is using SPP, which has no built-in security mechanisms (Schalk et al., 2022, p. 353).

These 4 types of attacks were very effective against satellites where users would assume that the software was secure.

Results

What were the outputs? Did it prove the authors hypothesis?

A major vulnerability in satellite systems that are using a Software Bus for communication is the fact that if the Software Bus goes down, then the whole satellite goes down. This is also true for the command ingestion module, if that goes down, communications via uplink are unable to be received and the whole satellite is lost (Schalk et al., 2022, p. 353). Security should be developed beyond believing that the data link layer of the network architecture will always be secure (Schalk et al., 2022, p. 355).

There should be an implementation of tools that will scan for vulnerabilities on the system. There also should be command validations that verify the commands will not harm the system or that they are not malicious. Also, there should be remote reset tools that allow the system to be reset to initial mission settings in the case of a compromise (Schalk et al., 2022, p. 355). The architectures that are deployed on satellites need to have the most recent principles of cyber-security employed. They need to rely on Zero-Trust Networks and layered permissions (Schalk et al., 2022, p. p. 355).

Critique

Do you agree with the conclusions drawn from the research? Why or Why Not?

I agree that the lack of security around open source satellite systems is highly exploitable and poses a major risk to national security. This is one of the major reasons that I am in the Master's Program for Space Studies. Technological advantage means nothing if it can easily be disabled cheaply and anonymously from a computer anywhere in the world. These brilliant students in cyber security have laid a foundation for people like myself to go and deploy and simulate similar scenarios in industry. This might be a situation in which I pitch the idea in my day job to setup a simulation lab for satellite operations. The relative cost to doing this is cheaper than procuring a new coffee machine.

Are there any other callouts? Was the data gathered correctly, too much/too little? Where the underlying principles of the research sound?

I would have liked to see some concrete examples of applying some of their recommendations or at least a diagram. That may be a follow up item for them in their research, but just naming cyber security best practices doesn't go as far as showing them. I would say for their process it is very similar to my day to day work as a software developer. I.e. I need to create/add a feature to an application or module, I search GitHub to see if there is already open source software that is similar, if there is I pull or fork the repo into a company managed git account, then I start deploying from the cloned or forked repo. They did exactly that in their research which is highly aligned with industry standards. At bigger companies you may have to go through an additional cyber security review if you are deploying to prod, but with some fancy "word-salading" you can get around most concerns.

Future Work

What future work should come from this research?

Researchers that are leading the field in satellite cyber security are Gregory Falco, who runs Cornell's Aerospace Adversary group that works on research related to satellite cybersecurity and has had dozens of papers to the teams names. James Pavur is also another leading researcher and wrote his thesis on developing security for the new space race (Schalk et al., 2022, p. 351). While this is a great start, we need to have significantly more time and funding security research into open source satellite systems. While these vulnerabilities are the easiest to exploit and have a major impact, they are also the easiest and most cost effective for researching as the simulation environments that replicate the real world are nearly identical and can easily be setup. You could have fleets of university researchers with a couple grand in funding for some cloud or lab resources to constantly learn and combat new threats.

Do I have any outstanding questions?