Should nanosat/cubesat operators be encouraged to add propulsion to their satellites? The arguments in favor — space traffic management, collision avoidance, faster de-orbiting — are clear. Here’s a counter argument: a propulsive cubesat in the hands of a malevolent party has the potential to do damage. Credit: Kurzrok/Ramos/Mechentel

LOGAN, Utah — As the debate about whether to force cubesats to carry propulsion continues, a counterargument is emerging that urges zero propulsion on small satellites unless their communications channels are encrypted.

The reason: An unencrypted signal could be hijacked, possibly allowing pirates to do what the want with the satellite, including ramming it into another spacecraft — even one in an orbit far from the cubesat’s operating altitude.

The U.S. Federal Communications Commission (FCC) is debating whether to oblige cubesats operating above 400 kilometers to carry propulsion to enable them to perform collision-avoidance maneuvers if necessary, and to de-orbit on retirement more quickly:

It seems like a good idea. But a satellite with fuel and propulsion is a much more powerful instrument if it falls into the wrong hands.

A team of graduate students at Yale, Stanford and the University of Colorado-Boulder decided to look at the regulatory regime regarding encryption, and to estimate the range of a satellite in low Earth orbit if its controller decided to test the limits. They presented their conclusions here Aug. 9 at the Small Satellite Conference.

The question, said Andrew Kurzrok, is whether a 1-10 kg nanosat equipped with propulsion but no encryption poses a threat.

“The threat in particular would be an unauthorized actor being able to send a spurious command which, in the worst case, could fire the thruster, and could lead to a conjunction,” said Kurzrok, who presented the paper. “But even short of that, what are the long-term risks to the industry if somebody else does take over a satellite?”

The authors concluded that despite their size — and depending on the kind of propulsion they use — there is enough energy in a cubesat to carry it far from its planned orbit into areas populated by many satellites — even as far as geostationary orbit.

The authors scanned several dozen cubesat propulsion systems that are at TRL-6 level or higher, a measure of how close they are to being introduced into the market. There is a wide range of thrust, not only between the different technologies, but within each one.

They had some trouble determining the dry-mass ratios of many of the systems they were looking at.

Depending on your cubesat/nanosatellite mission, you may or may not be required to encrypt your uplinks or downlinks. Credit: Kurzrok/Ramos/Mechentel

Using data from the Aerospace Corp., they were able to set the scene for what kinds of satellites automatically encrypted their data, such as those working with the U.S. Defense Department, and those that did not. Encryption is not inexpensive, and satellites that do not need to prove a data-protection program often don’t include it.

“We believe the primary players who are not encrypting their missions are academic programs,” Kurzrok said. “Data protection is self-preservation for a commercial firm.”

They simulated a 10-kilogram satellite at a 300-kilometer circular orbit, assuming that 50% of the mass is reserved for propulsion. They then calculated the dry-mass ratio to arrive at the amount of on-board propellant.

Kurzrok said they used conservative estimates of a satellite’s ability to travel, assuming for example a constant thrust of a chemical propulsion system throughout a thruster firing.

A little propellant can go a long way. But it does take time, during which a satellite’s operator likely can wrest control from the bad guy. But the damage to a company’s reputation will be real. Credit: Kurzrok/Ramos/Mechentel

Conclusion: a monopropellant chemical thruster reaches 2,000 kilometers in less than two hours. A warm-gas propellant gets to 475 kilometers in 27 hours; cold gas gets to 350 kilometers in three weeks.

Electric propulsion can carry the satellite from 300 kilometers to geosynchronous orbit in about a year, with propellant to spare.

“If something can be hacked, eventually it will be hacked, and if it can be done then it’s something that should be considered. And even if the intruder was kicked out before being able to initialize a command to the propulsion system, the reputational costs to the industry could be signifiant.”

A non-encryption, no-fly policy adopted by the industry is one option. And given the relatively small number of companies active in the area, self-regulation could occur a lot faster than a regulatory regime adopted by, say, the International Telecommunication Union.