Lawmakers Propose Bill to Strengthen Cybersecurity of Commercial Satellites

Lawmakers have proposed legislation seeking to strengthen the cybersecurity of space systems that support critical infrastructure.

Introduced by Reps. Tom Malinowski and Andrew Garbarino, the Satellite Cybersecurity Act would require the Cybersecurity and Infrastructure Security Agency to develop standards for the commercial satellite sector.

The bill would require the Government Accountability Office to assess how well the government is protecting the commercial satellite sector. GAO would also be tasked with identifying vulnerabilities that might put critical infrastructure at risk, Malinowski’s office said.

Malinowski said that commercial space systems are still vulnerable to cyberattacks despite how much Americans depend on them.

Garbarino noted that most of the U.S. satellites in orbit are controlled by the private sector. He said that the proposed bill will enable CISA to fulfill its role as the sector risk management agency for the communications sector.

In May 2021, CISA announced the launch of a Space Systems Critical Infrastructure Working Group, a public-private organization tasked with coming up with ways to minimize risks to space systems that support critical infrastructure.

CISA said that the working group will improve the resilience of commercial space systems, identify areas that need improvement and offer risk management recommendations for space-based assets and critical functions. 

The Department of Homeland Security currently recognizes 16 critical infrastructure sectors. The list includes the communications and defense sectors, both of which rely on satellite communications in some form.

Lawmakers have previously pushed for legislation that would add space systems to the list of critical infrastructure sectors. 

According to the Space Infrastructure Act, space systems include satellites, space, vehicles, space-related terrestrial systems, launch infrastructure, space-related production facilities and relevant information technology.