Orbital Estimate

Executive Estimate

Small drones derive much of their battlefield value from an electromagnetic chain connecting an operator to an aircraft. A control link carries steering commands. A video link returns the scene. Satellite navigation may stabilize the route. Electronic attack can break any part of that chain without damaging the airframe. The operational measure that matters is therefore mission completion under interference, rather than the number of drones purchased or destroyed.

This report assesses three consequences. Mass drone employment creates emissions that can expose operators and shared radio dependencies. Reusable jammers can alter the cost exchange that normally favors cheap aircraft. Greater autonomy can preserve a mission after link loss, though it transfers risk into onboard perception and software assurance. The resulting contest rewards forces that can observe hostile changes and distribute countermeasures quickly. A warehouse full of airframes may look majestic on a briefing slide; an enemy jammer is less moved by pageantry.

The Drone as an Electromagnetic System

An FPV attack drone appears mechanically simple, yet its combat effect emerges from a continuous feedback loop. The camera shows the operator what the aircraft sees. The operator chooses a correction. A radio carries the command to the receiver, and the flight controller translates it into motor output. The camera then reports the result. This loop repeats until impact or abort. If the loop fails during the terminal approach, the aircraft may remain airborne while the mission has already ended.

Jamming works by reducing the receiver’s ability to distinguish the desired signal from competing energy. The wanted transmission does not have to disappear. It must merely fall below the receiver’s usable threshold. Distance helps the jammer because received power declines sharply as the drone moves away from its controller. Terrain and antenna direction can change the outcome, which is why laboratory range claims say little about combat performance. Joint Publication 3-85 treats electromagnetic spectrum control as an operational requirement because friendly access and hostile denial occur in the same physical medium.[1]

Figure 1. Range reduces the reserve available to overcome interference. Model uses free-space path-loss behavior with normalized starting conditions.

Navigation links present a related weakness. GPS signals arrive at Earth at very low power, making local interference disproportionately influential. Official U.S. GPS guidance warns that interference can degrade or deny positioning and identifies intentional jamming as a threat to dependent systems.[2] A drone with inertial navigation may continue briefly. A less capable aircraft may drift or trigger a failsafe. Spoofing adds another danger by supplying counterfeit navigation information that a receiver could accept as genuine.

The defender gains an important advantage from this mechanism. Traditional air defense normally expends a round against each target. A jammer can affect repeated aircraft while it remains powered and correctly positioned. The effect is neither free nor universal. Emission reveals the jammer, and a poorly placed system may block friendly links. Yet the possibility of reusable denial changes the economics. The attacker must price the cost of a completed mission, including failed sorties and operator time, rather than comparing one drone with one interceptor.

Geometry Governs the Contest

Electromagnetic combat remains tied to terrain. A ridge can block a jammer while giving a controller a clean path to the aircraft. A wooded depression may conceal the crew from visual observation but trap its signal close to the ground. Urban structures create reflections that produce usable pockets beside abrupt dead zones. The boundary between control and failure can therefore move as the aircraft turns, even when the distance to its pilot changes very little.

Antenna direction sharpens this geometry. An omnidirectional antenna spreads energy broadly and supports a moving aircraft without careful aiming, though much of its power travels where it is not needed. A directional antenna concentrates energy along a narrower path. That concentration can extend control or resist interference, but it asks more from the crew. The operator must keep the beam aligned while the aircraft moves and the tactical situation changes.

Emission control creates a second geometric problem. The jammer wants to affect the drone without becoming an easy target for enemy direction finding. It may radiate only when an aircraft approaches the defended area, then move or fall silent. The attacker faces the same dilemma. A stronger control transmission improves the link while making the operator easier to locate. Every increase in electronic reach casts a longer shadow for hostile sensors.

Mass Creates Opportunity and Signature

Drone mass is often described as a physical saturation problem. Enough cheap aircraft can exhaust a defender’s expensive missiles. That claim assumes the aircraft retain the connections needed to threaten the defended asset. Concentrated launches place several control links into the air at once. Those emissions can reveal a launch sector or expose a common technical pattern. A defender may then attack the shared dependency instead of engaging every aircraft separately.

The Department of Defense Counter Small Unmanned Aircraft Systems Strategy describes the threat as rapidly changing and calls for common solutions that can adapt across operating environments.[3] The Government Accountability Office likewise identifies radio-frequency jamming as one counter-drone method while noting legal and technical limits.[4] Those limits matter near civilian infrastructure, where broad interference can affect legitimate users. On a battlefield, the same constraint appears as electromagnetic fratricide: one unit’s protective jammer can blind another unit’s reconnaissance drone.

For commanders, this means spectrum management becomes part of force protection. A transmission should be treated as an observable event. Units need to know which signals are friendly and how long they must remain active. They also need procedures for resolving interference without waiting for a distant headquarters. The spectrum ignores unit boundaries with almost comic indifference.

Adaptation Becomes the Enduring Advantage

Neither side should expect a permanent technical answer. Drone crews can move to a different frequency or replace a radio. Defenders can record the new emission and update their detection equipment. The resulting cycle resembles defensive cyber operations: observe behavior, distinguish hostile activity from background traffic, create a response, then distribute that response before the adversary changes again.

This cycle favors organizations that connect front-line observation with technical analysis. A crew that experiences unexplained video loss needs a way to preserve the evidence. Analysts need enough context to determine whether the cause was jamming, poor equipment, or friendly interference. Their finding must then return to other units as a changed procedure or updated configuration. If any link in this learning chain stalls, the same failure repeats across the force.

Conventional acquisition struggles with this tempo because it treats the fielded system as a finished object. In spectrum combat, the radio configuration is closer to perishable intelligence. Its usefulness begins decaying once the enemy observes it. Contract structures should permit rapid component substitution and software revision while preserving safety controls. A perfectly documented fix delivered after the adversary has moved again is merely an elegant fossil.

Autonomy Moves the Risk

The strongest answer to link denial is selective autonomy. A drone can receive a route before launch, use onboard sensors to estimate movement, and continue toward a designated point after communic…

This is a public episode. If you would like to discuss this with other subscribers or get access to bonus episodes, visit orbitest.substack.com

There is something faintly strange about the phrase “human in the loop.” It sounds reassuring. Somewhere between the sensor and the weapon, presumably, sits a responsible adult.

Yet the location of the human tells us remarkably little about who is really making the decision.

Suppose an AI system collects twenty sensor feeds, ranks three possible targets, suppresses several alternatives as unlikely, assigns one target a 94 percent confidence score, recommends a munition, estimates collateral damage, and flashes a green box around the preferred choice. A lieutenant colonel then clicks APPROVE.

The human was in the loop.

The machine built the loop.

That distinction is going to matter enormously as the American military pushes AI deeper into targeting, intelligence, cyber operations, logistics, battle management, and command and control. The Pentagon’s 2023 Data, Analytics and Artificial Intelligence Adoption Strategy placed “decision advantage” at the center of the project. Deputy Defense Secretary Kathleen Hicks described AI-enabled systems as a means to accelerate commanders’ decisions while improving their quality and accuracy.

The Pentagon’s January 2026 AI strategy goes further. Among its priority projects is an “Agent Network” aimed at AI-enabled battle management and decision support from campaign planning through kill-chain execution.

Speed matters. Sometimes seconds decide whether an interceptor leaves the rail before its target disappears.

But there is another use for military AI that deserves far more attention.

The machine should sometimes argue back.

A Faster Kill Chain Can Also Be a Faster Mistake

The attraction of AI to a military staff officer is obvious. War produces an absurd amount of information.

Radar returns arrive. Satellites collect imagery. Electronic warfare systems detect emitters. Drones stream video. Intelligence databases accumulate reports. Logistics systems track fuel, ammunition, spare parts, vehicles, crews, and maintenance histories.

Some human being is eventually expected to turn that ocean into a sentence beginning with the words, “Sir, I recommend.”

Software can compress the process dramatically.

Project Maven provides a striking example. Emelia Probasco’s 2024 CSET study of Maven and XVIII Airborne Corps found that the corps developed an AI-enabled targeting process capable of artillery targeting performance comparable to one of the strongest American examples from Operation Iraqi Freedom, while requiring nearly 2,000 fewer servicemembers.

That is a remarkable compression of manpower. It also changes the character of human oversight.

When thousands of people become dozens, software is no longer a clerical assistant sitting politely beside the decision process. It is constructing a large portion of the process itself.

Former Chief Digital and AI Officer Craig Martell made the objective explicit when discussing the Pentagon’s AI vision: commanders should be able to move through information far faster than traditional staff processes allow. The department’s strategy calls for superior battlespace understanding and “fast, precise and resilient kill chains.”

That sounds excellent until the wrong conclusion enters the chain.

Military systems operate in an environment where deception is part of the furniture. Adversaries camouflage equipment, spoof signals, jam communications, alter signatures, distribute decoys, conceal weapons among civilian infrastructure, and deliberately feed misleading information toward enemy collection systems.

AI does not abolish that problem. Under the wrong conditions, it can industrialize it.

A model can become exceptionally good at identifying patterns while remaining fragile when reality wanders outside the conditions it learned. A damaged sensor, unfamiliar vehicle configuration, deceptive emitter, corrupted database, or adversarial input can give the software a false picture of the battlespace.

The danger grows when several downstream systems inherit the same original assumption.

The classifier says hostile. The prioritization engine raises the target. Planning software builds a strike option. The interface puts it at the top of the commander’s screen.

By the time the human enters the picture, the original uncertainty may have disappeared beneath five layers of polished software.

Computers are rapidly acquiring one of mankind’s older talents: sounding awfully sure while standing on rotten floorboards.

Human Oversight Can Become Ceremonial

The Pentagon already recognizes this danger in principle.

Defense Department Directive 3000.09 on autonomy in weapon systems requires appropriate human judgment over the use of force and establishes review, testing, reliability, and governability requirements for autonomous weapons.

Those safeguards matter.

They do not answer the harder question: what counts as meaningful judgment?

There is a large difference between a commander independently assessing evidence and a commander approving a recommendation whose framing has already been constructed by software.

Human-factors researchers have studied versions of this problem for decades. Automation bias describes the tendency to place too much weight on automated recommendations. Algorithm aversion describes the opposite problem, where people discount machine advice too aggressively.

The distinction matters because better software can still generate new human errors.

A 2014 study of clinical decision-support systems placed British general practitioners in simulated prescribing scenarios. Their average accuracy rose from 50.38 percent before computerized advice to 58.27 percent afterward. Yet in 5.2 percent of all prescribing cases, clinicians who had initially reached the correct answer switched to an incorrect answer after receiving machine advice.

That is the uncomfortable shape of the problem.

The software made the group better on average while creating a class of errors that would not have occurred without it.

Military organizations will encounter the same trade.

Refusing a system because it occasionally fails would make little sense if it vastly improves overall performance. Treating higher average accuracy as though it had abolished uncertainty would be considerably more dangerous.

The real objective is calibrated trust.

A commander has to know when the machine deserves confidence, when it deserves suspicion, and when the evidence itself is too poor for anybody in the room to sound certain.

Build the Machine as an Argumentative Staff Officer

Most AI decision support is imagined as a recommendation engine.

There is another architecture worth pursuing: the dissent engine.

Instead of asking one model for its preferred interpretation, a military system could assign machine agents different jobs. One develops the primary assessment. Another searches for contradictory evidence. Another attacks the assumptions supporting the first recommendation. Another asks whether current conditions resemble cases where the main model historically performed badly.

The commander receives something closer to an argument.

Consider the difference.

A conventional display might say:

Hostile air-defense vehicle. Confidence: 94 percent.

A dissent-oriented system might instead report:

Primary assessment: hostile air-defense vehicle, 94 percent confidence.

Then it could flag that the infrared signature conflicts with the expected configuration, radar confidence is much lower, secondary imagery is stale, and adversary decoy activity in the area has risen.

Now the human has something to judge.

The machine has stopped behaving like an oracle and started behaving like a staff officer.

DARPA has spen…

This is a public episode. If you would like to discuss this with other subscribers or get access to bonus episodes, visit orbitest.substack.com

I. The Military That Learns Faster Than Its Enemies

The next revolution in warfare may arrive without a revolutionary weapon. It may arrive when an army learns to change its software faster than its enemy can change tactics.

Israel appears determined to become that army.

On January 1, 2025, the Israeli Ministry of Defense announced the establishment of an AI and Autonomy Administration under its Directorate of Defense Research & Development. The new organization would coordinate artificial intelligence and autonomous systems across the country’s land, air, naval, intelligence, and space capabilities.

This was more consequential than another military office acquiring another impressive acronym. Israel was attempting to bring research, software development, autonomous platforms, and operational requirements under a common authority.

The distinction matters.

Most modern militaries already employ artificial intelligence in some capacity. They use algorithms to process satellite imagery, identify anomalies in intelligence databases, assist maintenance crews, and prioritize information for commanders. These applications can improve particular tasks without substantially changing the military organization around them.

An AI-native military would go further. Intelligence collection, battlefield decisions, weapons development, and operational feedback would become parts of a continuously adapting technological system.

Whether Israel has achieved that ambition remains uncertain. Ukraine, the United States, and China are pursuing their own models of software-enabled warfare, making any claim of global primacy difficult to establish.

Yet Israel presents an unusually revealing case because its technological ambitions have been tested against the demands of sustained combat.

Since the Hamas-led attacks of October 7, 2023, Israel has fought across several operational theaters while confronting rockets, missiles, drones, subterranean networks, and dispersed armed organizations. Its military has confronted serious intelligence failures, operational uncertainty, and intense scrutiny over civilian casualties in Gaza.

The resulting pressure has encouraged Israel to reconsider how quickly it can identify threats, develop countermeasures, and place equipment in soldiers’ hands.

In December 2025, Yaron Sarig, head of the ministry’s AI and Autonomy program, reported that Israel had deployed tens of thousands of autonomous systems across the battlefield, including aerial and ground platforms.

That number is impressive, although it tells us little about how independently those machines operate or how well they perform.

The more important development is organizational. Israel is trying to shorten the interval between encountering a battlefield problem and deploying a technological response.

For the United States, whose military possesses enormous resources but frequently struggles with acquisition schedules, that experiment deserves serious attention.

The future of military power may depend increasingly on which state can learn, verify, manufacture, and adapt while the enemy is still preparing its next move.

II. Inside Israel’s Emerging AI War Machine

The phrase artificial intelligence conceals several technologies with very different military functions.

An algorithm that identifies unusual movement in surveillance footage differs considerably from a drone capable of navigating without continuous human input. Both differ from a weapon authorized to select and engage targets independently.

These distinctions are essential when evaluating Israel’s military capabilities.

Consider intelligence processing. Military organizations receive information from satellites, reconnaissance aircraft, electronic intercepts, human sources, ground sensors, and operational reports. Much of that information is incomplete. Some is outdated. Some is deliberately deceptive.

A suspected weapons shipment, for example, might appear in satellite imagery, intercepted communications, and reports from human sources. Analysts must determine whether these observations describe the same activity, whether the sources are reliable, and whether the information remains current.

Machine-learning systems can assist with portions of this process by correlating observations, identifying similarities, and directing analysts toward potentially important records.

Israel’s Habsora system, sometimes translated as the Gospel, offers an instructive example.

In its June 2024 explanation of military data technologies, the Israel Defense Forces described Habsora as a system that combines information from multiple datasets and recommends physical objects for further intelligence examination.

The IDF states that the system does not independently approve targets. Analysts are supposed to investigate its suggestions before an authorized officer can validate a proposed military objective.

Lavender, another controversial system, is described by the IDF as a database that organizes information about suspected members of armed organizations.

Investigative reporting has challenged whether the distinction between automated recommendations and human authorization was always meaningful in practice. The disagreement deserves examination rather than a convenient declaration that every algorithm is either infallible or sinister.

The strategic value of these systems lies in their potential to reduce the time intelligence personnel spend retrieving, comparing, and organizing information.

A military that receives thousands of observations daily must decide which deserve immediate attention. If software can reliably identify the records worth reviewing, trained analysts can concentrate on questions requiring judgment.

Those gains can compound across large organizations.

An aircraft detects suspicious activity. A ground unit contributes another observation. Intelligence databases provide historical context. Analysts evaluate the results and pass relevant findings to operational commanders.

Each stage contains opportunities for delay, confusion, and error.

Artificial intelligence may reduce some of those difficulties. It may introduce others.

From intelligence software to autonomous machines

The second major application concerns physical autonomy.

Military robotics generally begins with simpler functions: navigation, obstacle avoidance, route planning, stabilization, and maintaining communication links. More sophisticated platforms can coordinate with other systems or conduct portions of a mission when communication is interrupted.

Israel’s reported deployment of tens of thousands of autonomous systems must be understood within that broad spectrum.

An unmanned ground vehicle carrying supplies, a reconnaissance quadcopter following programmed waypoints, and a weapon that independently selects a person for attack represent profoundly different degrees of autonomy.

The ministry’s aggregate deployment figure does not establish how many systems possess each capability.

Still, widespread use of unmanned equipment could alter the economics of military operations.

Small reconnaissance drones can distribute surveillance across more locations. Ground robots may reduce the exposure of soldiers performing hazardous tasks. Autonomous navigation can reduce operator workload in environments where communications are unreliable.

The physical dependencies remain stubbornly ordinary. Batteries must hold a charge. Motors must survive dust. Cameras must work in darkness. Radios must resist interference. Navigation systems must cope with degraded satellite signals.

A magnificent algorithm attached to a dead battery is merely an expensive object on the ground.

The defining question is whether Israel can combine these technologies into an operational feedback cycle that repeatedly improves battlefield performance.

This is a public episode. If you would like to discuss this with other subscribers or get access to bonus episodes, visit orbitest.substack.com

The Moon will become military terrain before it becomes a conventional battlefield. Communications relays will determine whether distant spacecraft can receive commands. Navigation services will shape how safely they move. Surveillance systems will decide whether unusual behavior is detected early enough to interpret it.

The supporting architecture is already taking form. NASA’s LunaNet Interoperability Specification defines common interfaces for communications and navigation services around the Moon. China’s Queqiao-2 relay satellite supports far-side exploration and planned activity near the lunar south pole. The United States Space Force is developing the Oracle-M pathfinder to improve tracking across cislunar space.

None of these programs constitutes a lunar weapons base. Their military importance arises from the access they provide and the dependencies they create. A state that supplies reliable communications or trusted position data can shape how other actors operate without claiming territory on the lunar surface.

Washington should preserve an open lunar architecture while identifying defense missions that require independent support. It should also establish strong security requirements for commercial providers. The first meaningful military boundary near the Moon may never be visible from its surface. It may be encoded inside the receiver that decides which network a spacecraft trusts.

Cislunar Space as Strategic Geography

Cislunar space is often described as the region between Earth and the Moon. That definition is serviceable, but it hides the character of the operating environment. The region is governed by the gravitational relationship between two moving bodies. Spacecraft follow curved paths shaped by both.

Terrestrial military language must therefore be used with care. An army can occupy a pass or fortify a hill. A spacecraft cannot hold an orbital point in the same manner because orbital motion is continuous. Even a vehicle operating near a useful gravitational region must manage its trajectory.

The Earth-Moon Lagrange regions still possess strategic value. They are locations where the gravitational relationship between Earth and the Moon permits useful orbital patterns. The L2 region beyond the lunar far side is especially important for communications. A relay placed in a suitable orbit near that region can maintain contact with far-side missions while retaining a path back toward Earth.

The relay does not own the far side. It can still become indispensable to activity there. The Moon blocks a direct radio path between Earth and a far-side lander. Without a relay, the lander may continue to function internally while losing its connection with human operators.

This is strategic geography created through relationships rather than borders. A useful orbit resembles a sea lane more than a plot of land. A relay resembles a port whose value comes from the traffic it supports.

The Space Force has already acknowledged that traditional surveillance methods face new problems beyond geosynchronous orbit. Guardians assigned to the 19th Space Defense Squadron have discussed the difficulty of tracking objects in this extended region. Cislunar geography is vast. The Moon can obstruct observation, while changing illumination complicates optical tracking.

The actor that understands this geometry best will enjoy more than scientific prestige. It will gain time to recognize unusual movement and more confidence when interpreting another spacecraft’s intent.

The Infrastructure That Creates Access

Sustained lunar activity requires dependable communications. It also requires accurate position data. An individual mission can carry specialized equipment for both tasks, but shared services reduce the burden placed on each spacecraft.

NASA describes LunaNet as a framework rather than a single government-owned constellation. Under its published specification, public agencies or commercial companies could provide compatible services. A user would connect through common interfaces rather than designing a private communications system for every mission.

NASA’s Lunar Communications Relay and Navigation Systems program applies this model to future lunar operations. Interoperability allows users to receive service from more than one provider. In principle, this can improve resilience because the failure of one node need not isolate a mission.

Shared infrastructure also produces dependence. Early missions may adopt LunaNet-compatible services because they reduce cost. Later spacecraft will be designed around the available network. Once the receiver and mission software assume that service exists, losing it can cripple operations even when the vehicle remains physically intact.

This is how technical architecture acquires political weight. The choice of communications protocol appears narrow when engineers make it. Years later, that choice may determine which coalition can support the spacecraft during a crisis.

Standards can divide cislunar space before formal boundaries emerge. A vehicle designed around an American-led framework will enter one network of providers. A spacecraft designed around Chinese services may enter another. Some users may operate across both systems, but compatibility will depend upon political decisions as much as engineering.

The resulting division will be difficult to see. A border drawn through software has no fence, yet it can determine who receives the signal.

China’s Developing Lunar Architecture

China’s Queqiao program demonstrates how support architecture can extend a nation’s reach. Queqiao-2 was launched in 2024 to relay communications for missions on the lunar far side. It also supports China’s wider plans near the south pole.

The system serves legitimate exploration goals. Far-side operations require a relay because the Moon blocks direct communication with Earth. Still, the same capability establishes experience that can support later activity.

China is also organizing the International Lunar Research Station with Russia and additional partners. The China National Space Administration’s description includes Earth-Moon transportation and energy supply. It also includes communication and navigation under a centralized control structure.

These features do not prove that the station conceals a military purpose. A large scientific program requires coordination. The strategic issue is who supplies that coordination and which partners become dependent upon it.

A smaller space power may lack the funds to build an independent lunar relay. Joining the Chinese framework offers access at a lower cost. Once its spacecraft is designed around Chinese services, withdrawal becomes expensive.

That dependence may later influence diplomacy. A partner whose scientific program relies upon Beijing may hesitate to support measures that place its access at risk. China would not need to issue an explicit threat. The possibility of losing service can discipline behavior by itself.

The Department of Defense’s 2025 report on Chinese military power places these programs within Beijing’s wider cislunar ambitions. China’s success in returning far-side lunar samples shows that it can execute complex operations across the Earth-Moon system.

The competition will therefore concern membership as much as hardware. The system that offers dependable service at a tolerable cost will attract users. Speeches about leadership will matter less than whether a relay works when a lander descends behind a ridge.

Space Domain Awareness Beyond GEO

Military activity near the Moon begins with awareness. A state cannot protect its spacecraft if it cannot track nearby objects. It cannot attribute interference if it lacks a record of ordinary activity.

Surveillance systems designed for Earth orbit are poorly suited to the full cislunar region. The volume is immense. Objects appear faint at great distance. Earth-based telescopes also face periods when geometry or lighting prevents useful observation.

Oracle-M is int…

This is a public episode. If you would like to discuss this with other subscribers or get access to bonus episodes, visit orbitest.substack.com

Cybersecurity systems increasingly rely on machine learning to distinguish suspicious activity from ordinary behavior. These systems develop behavioral baselines from historical observations and adjust their judgments as conditions change. That capacity helps security teams monitor environments too large for manual review. It also creates an opening for adversaries capable of manipulating what a model learns.

Data poisoning occurs when an attacker influences the information used to train or update an algorithm. Instead of directly disabling a defensive system, the attacker alters its understanding of acceptable behavior. A compromised account can gradually become associated with unusual activity until genuinely hostile actions no longer generate meaningful concern.

The risk extends beyond individual networks. Security vendors may depend on shared telemetry when refining detection models, creating potential supply-chain exposure. Organizations that treat algorithmic judgments as authoritative may therefore inherit vulnerabilities that remain hidden behind reassuring dashboards.

The strategic issue is straightforward: a defensive system cannot reliably identify malicious behavior when an adversary has influenced its definition of normal.

The Security Problem Inside Adaptive Detection

Traditional detection rules identify conditions specified in advance. A rule might flag an employee account that authenticates from geographically distant locations within an impossible travel window. The logic is visible and relatively easy to inspect.

Behavioral models operate differently. They study historical activity and estimate whether a new event resembles established patterns. An unexpected login might receive a higher risk score because it departs from an account’s previous behavior.

That approach helps identify attacks that do not match a known signature. A criminal using stolen credentials may appear legitimate to a password-based control while still behaving differently from the actual account owner.

The weakness emerges when the baseline itself becomes an attack surface.

The National Institute of Standards and Technology’s adversarial machine learning taxonomy identifies poisoning as a distinct category of attack against learning systems. Its 2025 guidance explains that adversarial activity must be assessed according to the stage of the system’s life cycle and the attacker’s practical access.

An attacker does not always need direct control over a model. In some environments, influence over the observations reaching that model may be sufficient.

Consider an employee who normally accesses internal resources during business hours. An attacker using the employee’s credentials begins authenticating occasionally at unusual times. Each event appears questionable but remains explainable.

If the system adapts to repeated observations, the account’s established pattern may slowly expand. Activity previously considered abnormal becomes familiar.

Whether this occurs depends on the product’s design. Some systems retrain periodically. Others update scoring thresholds or incorporate analyst feedback. The vulnerability is conditional rather than universal, but the underlying concern remains consistent: an adaptive model can inherit manipulated assumptions from its environment.

From Direct Poisoning to Hidden Backdoors

The most direct poisoning attack targets training data before deployment.

Suppose a security vendor builds a classifier using examples of legitimate network traffic and known malicious activity. If an attacker can alter the labels attached to selected samples, the model may learn that particular hostile behaviors belong in the harmless category.

A successful attack does not require the entire dataset to become unreliable. Carefully chosen samples may influence the model’s treatment of a narrow behavior while leaving its overall performance largely intact.

That selective outcome is strategically attractive. A detection system that fails constantly attracts investigation. A system that misses one carefully prepared intrusion can continue appearing effective.

The United Kingdom’s National Cyber Security Centre guidance on machine learning supply chains explains that poisoned datasets can degrade model performance or introduce targeted backdoors.

A backdoor operates through a hidden trigger. During training, the attacker conditions the model to associate a particular feature with a benign outcome. Later, that feature appears inside otherwise suspicious activity.

The model responds as trained.

A malicious script might contain a characteristic that repeatedly appeared in harmless training examples. If the model assigns excessive importance to that characteristic, the script could receive a favorable classification despite performing hostile actions.

The dangerous behavior may remain invisible during standard testing. A model can score well against conventional benchmarks while failing when the attacker introduces the specific trigger.

This creates a difficult procurement problem. A customer reviewing published accuracy figures may learn little about whether the model contains narrow weaknesses deliberately embedded during development.

Behavioral Baselines as a Target

Postdeployment poisoning can be more difficult to recognize because it occurs within ordinary operations.

Imagine a defense contractor using behavioral analytics to monitor access to sensitive engineering documents. An employee normally works within one project environment. An attacker compromises the employee’s credentials but avoids immediately reaching for protected material.

Instead, the account begins accessing a small number of files associated with an adjacent project.

The activity produces an alert. A security analyst finds a plausible business explanation and closes the case.

Several weeks later, the account accesses additional material. Again, nothing appears immediately damaging. If the product incorporates recent behavior into its baseline, the account gradually becomes associated with broader access.

By the time the attacker approaches genuinely sensitive documents, the activity may appear less unusual than it would have at the beginning.

This scenario is illustrative. It does not establish that every commercial behavioral analytics product updates its models in this manner. The practical risk depends on how a particular system weighs historical activity and whether analyst decisions influence future classifications.

The distinction is important because legitimate adaptation is necessary. An employee’s duties can change. A security tool that never adjusts would generate unnecessary warnings whenever normal work patterns evolve.

The problem arises when adaptation happens without adequate historical context.

A model that evaluates recent activity in isolation may mistake a carefully managed intrusion for ordinary professional development. The attacker exploits the system’s willingness to believe that repeated behavior deserves acceptance.

Poisoning the Human Feedback Loop

The learning system is only one part of the defensive structure. Human analysts also develop expectations about which alerts deserve attention.

An attacker can exploit those expectations even without directly modifying training data.

Suppose an account repeatedly triggers warnings through unusual but ultimately harmless activity. Each investigation consumes time. After enough repetitions, analysts may begin treating similar alerts as routine.

If the organization reduces the alert’s severity, an attacker benefits from the adjustment.

Where analyst decisions feed back into automated scoring, the effect may become more serious. Repeated dismissals can reinforce the conclusion that similar activity is acceptable.

The NCSC’s secure AI development guidance explicitly recognizes that attackers may corrupt training data or user feedback. This matters because feedback represents institutional judgment translated into machine-readable form.

A sophisticated adversary can atte…

This is a public episode. If you would like to discuss this with other subscribers or get access to bonus episodes, visit orbitest.substack.com

The next contest for computing power may be decided by who can connect a data center to the grid before its processors grow old.

An AI company can order chips, sign a lease, and announce a campus. None of those acts delivers a dependable megawatt to a particular parcel of land. That requires generation, transmission capacity, transformers, substations, cooling equipment, and a contract that settles who pays when the grid must be rebuilt. The physical work is stubbornly indifferent to the speed of a software release.

My estimate is that electricity will increasingly determine where American AI capacity is built and who can afford to build it. It does not follow that the United States is running out of power. The problem is matching large, concentrated, nearly continuous loads to power that is available at the right location and on the right schedule. That distinction will decide whether today’s data center announcements become operating machines.

A national forecast meets a local socket

The scale is real, even if the precise destination is uncertain. Lawrence Berkeley National Laboratory’s 2024 data center study estimated that U.S. facilities consumed 58 terawatt-hours of electricity in 2014 and 176 terawatt-hours in 2023. Its 2025 update, published in June 2026, places 2030 demand at 649 terawatt-hours in its reference case, with a broad compounded uncertainty range of 521 to 843 terawatt-hours. That reference case would account for 11.8 percent of U.S. electricity use, according to the laboratory. These are estimates and forecasts for all data centers, not a meter reading for AI alone.

The multiplication deserves attention. Relative to the 2023 estimate, the 2030 reference case is about 3.7 times as large. A terawatt-hour is a billion kilowatt-hours; an annual total gives a sense of the fuel and generation required. It does not say whether a proposed campus can be served on a hot afternoon in northern Virginia, or whether a transmission line can deliver power to an Ohio substation without an upgrade. Electricity is delivered through a network with addresses, limits, and neighbors.

Berkeley Lab builds its forecast from expected equipment shipments, the power each device draws, cooling performance, and the types and locations of facilities. Its range reflects consequential uncertainty. The report’s sensitivity cases include different assumptions about graphics-chip shipments, chip lifetimes, and the amount of electricity AI servers draw while idle or in use. A forecast this wide should discipline anyone announcing an inevitable national shortage. It should also discipline anyone treating the lower bound as comfortable spare capacity.

For a developer, the first question is not whether the nation produces enough electricity over a year. It is whether a utility can deliver the requested load to the site at the promised date, including during a regional peak or an equipment failure. A large campus can need new transformers and high-voltage work. New generation may have to enter the system. The developer’s timetable, the utility’s construction schedule, and the grid operator’s reliability test have to meet on the same calendar. They frequently do not.

Even the word power hides several separate jobs. Generation makes electricity. Transmission carries large quantities over long distances. Substations change voltage and direct the flow. Distribution and site equipment deliver it to the building. Backup systems and cooling keep a brief fault from becoming a failed service. A new gas plant can address one problem and leave a transmission constraint untouched. A transmission line can reach a region while the last substation serving a chosen parcel remains full. A data center is therefore built twice: once as a computing facility, and again as a claim on the electrical system around it.

The queue contains a political decision

PJM, the grid operator serving much of the Mid-Atlantic and Midwest, offers a useful test. Its January 2026 long-term forecast projects a summer peak of 160,451 megawatts in 2027 and 191,017 megawatts in 2031. Those figures cover the entire PJM system, including homes, businesses, and industry. They must not be described as data center demand. PJM does identify data centers among the major sources of expected growth, while acknowledging uncertainty about which proposed projects will materialize.

PJM has already revised its near-term outlook downward from the prior year’s forecast after changing its treatment of electric vehicles, economic growth, and large-load requests. Its new process demands firmer commitments for nearby years and discounts less certain projects farther out. That is a healthy correction. A company can ask several utilities about several sites while intending to build only one. If each inquiry becomes an assumed future load, the grid may plan around a ghost population of server halls. If planners discount serious projects too aggressively, they can fail to build capacity that customers really need. Either error costs money.

This is where an engineering problem becomes an argument about authority. Who gets a firm reservation on scarce capacity? What proof of construction should be required? When a new customer triggers a substation or transmission upgrade, how much should that customer pay, and how much should be charged to existing households and businesses? Those choices determine who enters the computing market. A large firm can hold land, fund studies, sign long contracts, and consider building its own power supply. A smaller competitor has a shorter financial runway.

Federal regulators have begun to confront the issue directly. In December 2025, the Federal Energy Regulatory Commission directed PJM to clarify its rules for data centers and other large customers located alongside power plants. In June 2026, FERC told six regional grid operators to justify or revise rules governing how large users connect. Its stated concerns include the speed of studies, the allocation of transmission costs, power plants built near large customers, and service for customers able to reduce their grid draw.

The question of a data center beside a power plant sounds simple until the grid needs that plant on a difficult day. Does the new facility take output that would otherwise reach other customers? Does it buy backup service from the network? What happens when its private generator trips? A campus can be physically close to generation yet remain electrically and financially connected to everyone else. FERC’s intervention is evidence that the bottleneck includes rules about reliability and payment, not merely the ability to pour concrete.

The strongest objection is also a plan

There is a serious case against treating electricity as a lasting brake on American AI. High prices attract investment in generation and grid equipment. Developers can choose sites with available capacity, contract for power, phase a campus’s opening, or build generation nearby. Better chips and software may deliver more computation for each unit of electricity. Some computing tasks can move in time or place. America’s capital markets and large technology firms can finance projects that few rivals could attempt.

I take that objection seriously. In fact, it helps explain why the American advantage is substantial. The United States has companies prepared to buy extraordinary amounts of equipment and pay for the physical plant around it. But the o…

This is a public episode. If you would like to discuss this with other subscribers or get access to bonus episodes, visit orbitest.substack.com

Executive Summary

Generative artificial intelligence threatens strategic warning by weakening the relationship between collected evidence and justified belief. Its danger is broader than the production of convincing deepfakes. Once synthetic media becomes common, genuine imagery and authentic recordings become easier to deny. At the same time, AI-assisted intelligence systems may assign unwarranted confidence to manipulated inputs. Governments could possess more information than any previous generation while becoming less certain about an adversary’s intentions during the period when delay carries its highest cost.

The threat is no longer speculative in its basic components. The 2024 Annual Threat Assessment of the U.S. Intelligence Community warned that Russia was developing deepfakes capable of fooling experts. NATO’s revised AI strategy likewise treats AI-enabled information operations as a military problem capable of spreading confusion and weakening trust during conflict.

The proper response is neither blind faith in automated detection nor a retreat into permanent suspicion. Strategic warning must be redesigned for contested evidence. Consequential intelligence needs protected provenance from collection through presentation. Analytical models require adversarial testing. Military exercises must expose commanders to synthetic warning incidents. Decision procedures should also distinguish protective measures from actions that cannot be reversed once ordered.

Strategic Warning Is an Interpretive Process

Strategic warning rarely arrives as one unmistakable alarm. Intelligence services collect fragments and compare them with an adversary’s doctrine. Analysts then judge whether unusual activity reflects routine behavior or preparation for attack.

Consider a mobile missile unit leaving its garrison. The movement could precede a strike. It could also represent an exercise. The unit may be dispersing because its commanders fear attack. The observable event gains meaning only when it is placed within a wider political context.

This interpretive structure creates an opening for AI-enabled deception. A synthetic image need not depict an impossible event. It can alter one operationally significant detail within a genuine scene. Adding a support vehicle beside an authentic missile launcher could make protective dispersal appear to be launch preparation. The deception succeeds by cooperating with the analyst’s expectations.

The Department of Defense seeks what its Data, Analytics, and Artificial Intelligence Adoption Strategy calls “decision advantage.” Machine systems can examine imagery faster than human staffs. Yet analytical speed becomes hazardous when confidence in source integrity fails to keep pace. A faster warning system can produce a faster mistake.

This problem differs from traditional information overload. Earlier intelligence failures often arose because important signals were lost among ordinary noise. AI allows an adversary to manufacture the precise signal that a warning system has been trained to find. Collection itself becomes contested ground.

Synthetic Evidence and the Liar’s Dividend

Synthetic evidence creates two related dangers. A forgery can persuade leaders that an attack is approaching. Awareness of forgery can also make authentic evidence easier to reject.

Robert Chesney and Danielle Citron described the second effect as the “liar’s dividend” in their foundational study, Deep Fakes: A Looming Challenge for Privacy, Democracy, and National Security. As the public becomes familiar with fabricated media, a guilty actor gains plausible grounds to dismiss genuine recordings as artificial.

Applied to strategic warning, the liar’s dividend can operate between rival states. A government confronted with authentic evidence of military preparation can claim that the evidence was generated. The denial need not persuade every observer. It may be enough to fracture an alliance or delay a coordinated response.

The same effect can develop inside a national decision process. Officials who favor restraint may challenge authentic intelligence. Officials who favor action may embrace questionable evidence because it supports their prior judgment. Technical uncertainty becomes fuel for a bureaucratic contest.

The NIST Generative AI Risk Management Profile notes that subtle alterations can manipulate human perception as well as machine perception. This point matters because the most effective military deception may be modest. A spectacular fabrication invites scrutiny. A small alteration embedded inside otherwise authentic material can pass through an analytical workflow unnoticed.

Even an exposed forgery can achieve a strategic effect. Discovery teaches officials that their collection streams are vulnerable. The next genuine warning may receive less confidence. The first lie poisons the well; the second event suffers the thirst.

A Taiwan Strait Warning Crisis

The Taiwan Strait offers a plausible setting for this danger because exercises can resemble preparations for war. The Department of Defense’s 2025 report on Chinese military power describes a People’s Liberation Army focused on improving readiness for operations around Taiwan. Repeated exercises give Beijing opportunities to signal resolve. They also make hostile preparation harder to distinguish from coercive theater.

Suppose a major Chinese exercise begins after a political confrontation. American intelligence detects mobile missile units outside their normal garrisons. One commercial satellite image is authentic except for a synthetic support vehicle placed beside a launcher. An automated system classifies the vehicle as evidence of launch preparation.

Soon afterward, an intercepted transmission appears to contain the voice of a known commander ordering “decisive operations before dawn.” The phrase resembles language found in Chinese military writing. The speaker’s cadence matches previous recordings.

Neither item must be flawless. Each must remain credible long enough to influence the next briefing.

American commanders disperse aircraft to reduce their vulnerability. Beijing observes the movement and raises its own readiness level. The original deception has now produced genuine military activity. Each government begins reacting to its estimate of what the other government believes.

This feedback loop converts synthetic warning into a real security dilemma. A defensive act by one side appears offensive to the other. The false image supplies the initial reason for fear, while both governments provide the escalation that follows.

The deceiver does not need to fabricate an entire battlefield. One false indicator placed among authentic events may be enough. Nor must the deception produce consensus. Disagreement inside Washington could consume decision time. One agency may trust the image while another questions its metadata. Military commanders may favor immediate action while civilian leaders demand verification.

In such a crisis, uncertainty is not an unfortunate byproduct. It is the weapon.

When Machines Interpret Machine-Made Evidence

The danger grows when AI systems interpret collected intelligence. Modern sensors generate more imagery than human analysts can inspect. Automated object detection can direct attention toward unusual activity, but the model itself can be attacked.

Research on adversarial attacks against visual tracking in satellite imagery shows that carefully designed changes can degrade remote-sensing models. Related work on synthetic-aperture radar target detection demonstrates that subtle interference can cause a model to produce high-confidence errors.

Return to the missile image. An attacker may not need to add a vehicle. A small visual pattern placed near an ordinary truck could cause the recognition model to classify it as missile-support equipment. A human analyst might see nothing remarkable because the alteration targets the machine’s internal method of recognition.

The resulting confidence score…

This is a public episode. If you would like to discuss this with other subscribers or get access to bonus episodes, visit orbitest.substack.com

Executive Summary

Firm-fixed-price contracting can discipline costs when the government buys a mature product or an operating commercial service. The contractor knows the work. Competing suppliers can estimate the requirement from experience. A firm price then rewards the company capable of delivering at lower cost while protecting the government from routine overruns.

Experimental spacecraft present a different problem. Their cost depends upon technical questions that testing has yet to answer. Assigning those questions a fixed price transfers financial liability to the contractor, but it does not remove the underlying uncertainty. The uncertainty remains inside the vehicle until a failed test forces it into the open.

NASA’s Commercial Crew Program demonstrates both sides of this arrangement. SpaceX developed Crew Dragon under a fixed-price contract and began carrying astronauts to the International Space Station in 2020. Boeing accepted a larger contract for Starliner, encountered persistent technical failures, and had yet to obtain human-rating certification as of March 2026. Boeing absorbed substantial financial losses. NASA still carried the operational consequences of delayed competition.

The lesson is narrower than the familiar contrast between SpaceX and Boeing. Fixed-price development can work when a contractor possesses relevant technical evidence and expects customers beyond the government. It becomes hazardous when the customer seeks an unproven spacecraft whose design remains unsettled.

For the Space Force, contract form should follow technical maturity. Early experiments should expose uncertainty through flight evidence. Once the design has demonstrated its central functions, the government can impose firmer pricing on production or recurring services. A fixed price is most useful after discovery has reduced the number of surprises left inside the hardware.

What a Fixed Price Actually Transfers

A firm-fixed-price contract places responsibility for performance costs upon the contractor. The price ordinarily does not change because the company discovers that its own labor or engineering assumptions were too optimistic. If performance costs more than expected, the contractor’s profit shrinks. A severe overrun can turn the entire program into a loss.

The attraction is plain. Government programs have a long history of schedule delay accompanied by rising expense. Fixed pricing appears to close the public purse before the contractor’s appetite can learn new tricks.

The Federal Acquisition Regulation describes firm-fixed-price contracting as appropriate when the government can establish a fair price at the outset. The regulation points toward commercial offerings and supplies governed by reasonably definite specifications. Adequate competition can give the contracting officer further confidence that the proposed price reflects reality.

Those conditions matter more than the label placed upon the agreement.

A fixed price transfers the financial consequence of an overrun. It does not transfer the military consequence of late delivery. If a missile-warning spacecraft arrives five years behind schedule, the contractor may lose money while the government remains exposed to the threat the satellite was meant to address.

This produces an odd result. The contractor can suffer an accounting defeat while the government suffers an operational defeat. The contract has punished both parties without producing the required capability.

Cost-reimbursement arrangements accept a different distribution of risk. The government pays allowable costs because it recognizes that the work cannot yet be estimated with sufficient accuracy. Such contracts can weaken pressure upon the contractor to control spending. They remain useful when the customer is purchasing an engineering attempt rather than a settled product.

The decision should therefore turn upon the maturity of the work. When a supplier repeats a known manufacturing process, firm pricing can sharpen cost discipline. When the supplier must discover whether an unfamiliar design will work, a rigid price can turn every technical surprise into a financial crisis.

Commercial Crew as a Natural Experiment

NASA launched the Commercial Crew Program after the Space Shuttle retired in 2011. The agency needed to restore an American means of carrying astronauts to the International Space Station. Rather than owning the vehicles under the traditional model, NASA would certify privately operated transportation systems and purchase crew flights as a service.

In September 2014, NASA awarded Commercial Crew Transportation Capability contracts to Boeing and SpaceX. Boeing’s Starliner agreement carried a maximum potential value of $4.2 billion. SpaceX’s Crew Dragon agreement carried a value of $2.6 billion. Both were firm-fixed-price contracts, according to NASA’s original contract announcement.

NASA expected each contractor to complete an integrated crewed flight test. After certification, each company would fly operational missions to the station. The companies would retain ownership of their transportation systems and could sell flights to customers beyond NASA.

This broader market was central to the commercial model. A provider with several customers could spread development costs across future missions. Government demand would become an anchor rather than the whole harbor.

SpaceX reached human-rating certification in 2020. Crew Dragon then became NASA’s operational means of transporting astronauts from American soil. By June 2026, SpaceX had completed twelve crewed missions covered by the NASA inspector general’s latest review.

Boeing’s experience followed a harsher course.

Starliner’s first uncrewed orbital test launched in December 2019. A software timing error prevented the spacecraft from reaching the station. Investigators also found another software defect that could have caused a collision between the crew capsule and its service module during separation.

Boeing financed a second uncrewed flight. That mission reached the station in May 2022. The company then prepared Starliner for its first crewed test, which launched in June 2024.

The flight was originally expected to last between eight and fourteen days. Propulsion anomalies extended the mission to 93 days. NASA ultimately returned Starliner without astronauts Butch Wilmore and Suni Williams, as described in the agency’s 2026 investigation report. The astronauts returned aboard a SpaceX vehicle.

The decision revealed the boundary of financial risk transfer. Boeing carried much of the cost associated with correcting Starliner. NASA still carried responsibility for astronaut safety. Once uncertainty surrounded the propulsion system, the government had to decide whether the spacecraft could be trusted to bring its crew home.

The contract could assign an overrun. It could not assign away NASA’s duty.

What the 2026 Inspector General Report Found

The June 2026 NASA inspector general assessment of Commercial Crew found that Boeing still had not obtained human-rating certification. Helium leaks and propulsion failures remained unresolved as of March 2026. The report stated that flight testing since 2020 had produced six further years of delay.

The inspector general traced the trouble partly to confidence based upon Boeing’s aerospace history. NASA expected the company’s heritage systems and long spaceflight record to translate into a more predictable development program. That expectation contributed to aggressive schedules that the actual engineering could not support.

This finding matters because fixed-price acquisition depends heavily upon realistic estimates at contract award. If the buyer assumes that corporate reputation has already reduced technical risk, it may accept a price and schedule unsupported by the design itself.

A famous contractor can still encounter an unfamiliar problem. Spacecraft do not salute résumés.

The report also found that NASA made too little use of its contractual data rights…

This is a public episode. If you would like to discuss this with other subscribers or get access to bonus episodes, visit orbitest.substack.com

Artificial intelligence is changing how satellite operators interpret spacecraft telemetry. As orbital constellations expand, automated systems increasingly help engineers recognize equipment anomalies before they interrupt a mission. These capabilities offer considerable operational advantages. They also create an emerging vulnerability when organizations accept algorithmic judgments without independently verifying the information behind them.

A hostile actor who compromises a terrestrial telemetry-processing system could alter the measurements reaching an automated diagnostic model. The model might then identify a nonexistent equipment problem and recommend protective action. If operators approve that recommendation, they could temporarily disable a healthy spacecraft through an otherwise legitimate command.

The strategic consequences depend on the satellite’s mission. An unnecessary interruption affecting a commercial imaging platform could become significant if military customers depend on its observations during an international confrontation. The spacecraft would remain physically intact. The damage would occur within the chain of trust connecting its reported condition to human decisions.

This scenario should be treated as a plausible analytical assessment rather than a description of a confirmed incident. Publicly available evidence establishes that adversaries target commercial satellite infrastructure and that machine learning already supports spacecraft anomaly detection. It does not establish that an AI-driven telemetry deception attack has caused a documented strategic satellite outage.

The Operational Pressure Behind Automation

The growing population of active satellites makes manual oversight increasingly difficult. The European Space Agency’s 2024 space environment assessment identified approximately 9,100 active payloads. Its 2025 assessment placed that figure near 11,000. The agency’s current orbital statistics report approximately 16,000 functioning satellites.

These figures represent different reporting snapshots rather than a continuous dataset. Their strategic significance is still apparent. More operational spacecraft generate more measurements that ground personnel must interpret correctly.

A satellite’s temperature reading does not explain itself. The significance of a change depends on orbital position and spacecraft activity. A value that appears alarming during one phase of a mission may be entirely ordinary during another.

Machine learning can identify relationships that conventional threshold-based alarms overlook. NASA distributes an LSTM-based anomaly detection system for spacecraft telemetry, demonstrating that automated spacecraft-health analysis has moved beyond theory. NASA research concerning automated anomaly detection for Mars Science Laboratory telecommunications likewise shows how machine learning can support interpretation of operational telemetry.

These systems can help operators recognize developing equipment problems before obvious failures occur. Their value depends on whether the information entering the model accurately represents the spacecraft’s actual condition.

The Ground Segment as a Strategic Vulnerability

Spacecraft telemetry begins with measurements collected onboard. Those measurements are transmitted to terrestrial infrastructure and processed by ground applications before reaching operators.

The National Institute of Standards and Technology addresses these dependencies in its guidance for commercial satellite cybersecurity. Its separate publication on satellite ground-segment cybersecurity focuses directly on the infrastructure supporting spacecraft command and control.

A secure transmission from the satellite does not guarantee that every subsequent processing step remains trustworthy.

Suppose a spacecraft transmits an authentic battery-temperature measurement. The ground station receives the message correctly. Cryptographic protections confirm its origin. A downstream application then modifies the value before presenting it to an AI-driven diagnostic platform.

The original telemetry remains legitimate. The information displayed to operators does not.

This distinction matters because many discussions of satellite security concentrate on preventing unauthorized access to the spacecraft itself. An adversary may instead target the terrestrial software responsible for interpreting spacecraft behavior.

The Aerospace Corporation’s Space Attack Research and Tactic Analysis framework documents potential pathways through which space systems can be compromised. Its usefulness lies in connecting terrestrial cyber activity to physical mission effects.

A compromised processing application may never issue commands directly. It can still influence spacecraft behavior if operators act on the misleading information it supplies.

Operational Deception and Adversarial Machine Learning

Attacks against artificial intelligence do not all occur at the same stage.

Training-data poisoning involves manipulating the examples used to develop a model. An adversary who influences those examples may alter how the system interprets future observations.

Operational deception occurs after deployment. The attacker modifies the information presented to an otherwise functioning model.

NIST’s adversarial machine learning taxonomy distinguishes attacks according to their position in the machine learning lifecycle. That distinction is essential for spacecraft operators because a model trained on reliable information can still reach a false conclusion when its live inputs are compromised.

Consider a diagnostic platform trained to recognize an overheating power component. An attacker who alters incoming telemetry to reproduce that pattern may cause the model to identify a failure that does not exist.

The system has not necessarily been retrained or directly compromised. It is responding correctly to misleading evidence.

This problem is particularly dangerous because realistic deception can exploit the model’s strengths. A system that accurately recognizes subtle equipment failures may also respond convincingly to a fabricated pattern designed to resemble one.

Why Algorithmic Confidence Can Produce False Assurance

Automated diagnostic platforms frequently express conclusions through confidence scores. A system might report a high probability that a spacecraft component is approaching failure.

That number can influence operators more strongly than the underlying evidence deserves.

The confidence score generally reflects how closely the available measurements match patterns associated with a particular condition. It does not necessarily measure whether the data remained trustworthy throughout the processing chain.

A model can therefore express substantial confidence in a false diagnosis.

NIST’s AI Risk Management Framework emphasizes that AI systems must be evaluated within their actual operating environment. Its guidance concerning human oversight of AI systems recognizes that personnel need clear responsibilities when interpreting automated judgments.

In spacecraft operations, that responsibility includes distinguishing diagnostic confidence from data authenticity.

An operator who sees a persuasive warning may assume that the supporting information has already been verified. If every display depends on the same compromised application, apparent agreement between systems can create false reassurance.

Two screens repeating the same corrupted reading provide presentation variety. They do not provide independent confirmation.

A Plausible Mission Disruption Scenario

Consider a commercial imaging satellite supporting military observation during an international crisis.

A hostile actor compromises a terrestrial application that prepares spacecraft telemetry for an automated diagnostic platform. The attacker gradually alters a reported temperature associated with the satellite’s power system.

The modified reading remains consistent with a plausible mechanical problem. The diag…

This is a public episode. If you would like to discuss this with other subscribers or get access to bonus episodes, visit orbitest.substack.com

Large satellite constellations are approaching a scale at which human operators cannot investigate every suspicious event within an operationally useful period. A proliferated fleet may produce an immense stream of authentication records, command histories and software alerts. Its spacecraft will also pass through intermittent contact windows. By the time a ground team understands an anomaly, malicious activity may have crossed a satellite link or reached another part of the mission system.

Artificial intelligence offers a plausible response to this timing problem. An onboard or ground-based defensive agent could establish a picture of normal behavior, identify an anomalous command sequence and restrict a suspect credential before the threat spreads. NASA already requires certain missions to consider autonomous telemetry monitoring for unexplained interference under its Space System Protection Standard. The technical step from monitoring to automated containment is substantial, but the operational pressure behind it is clear.

The central difficulty concerns authority rather than detection accuracy alone. Finding a cyber anomaly is an analytic act. Isolating a spacecraft changes the mission architecture. A quarantine might preserve the constellation by containing a genuine compromise. A false alarm could remove a healthy satellite during combat. An adversary could also manufacture suspicious behavior in order to provoke the defender’s own system into denying service.

Autonomous cyber defense should therefore be treated as delegated command. Its permissions must be bounded by mission purpose. Its consequential actions should be reversible. Every automated intervention should create an intelligible record for human review. A separate rule-based safeguard should prevent the defensive model from exceeding a defined operational envelope. These controls impose friction, but friction is often wise when software is permitted to alter military capability.

The near-term path will favor narrow authority. Defensive agents will gain permission to revoke a credential, reject a malformed command or place a short hold on a crosslink. Broader powers will follow only after exercises show that these systems can contain actual threats without becoming an attacker’s remote control for self-inflicted mission loss.

The Operational Requirement for Machine-Speed Defense

The case for autonomy begins with constellation arithmetic. A fleet of several hundred spacecraft contains many endpoints whose software states change over time. Each vehicle participates in a larger mission system that includes a ground segment and external service providers. CISA’s Recommendations to Space System Operators for Improving Cybersecurity treats cyber risk across this full system because an attack does not need to begin in orbit. A compromised administrator account on Earth may become the path to a spacecraft command interface.

Traditional security operations assume that analysts can inspect an endpoint through a stable network connection. Orbital systems violate that assumption. A spacecraft may communicate with a particular ground station for only a short interval. The operator can receive an alert after the relevant event has already ended. This delay changes the value of speed. A brilliant diagnosis delivered after a malicious command has propagated is an autopsy with nicer stationery.

Autonomous defense can place judgment closer to the event. A local agent could compare a command against the spacecraft’s current state. It could determine whether the requesting identity normally issues that kind of command. If the sequence falls outside a permitted pattern, the agent could impose a temporary restriction. The response would occur while the anomaly remains containable.

NASA’s 2026 survey of Ground Data Systems and Mission Operations advises projects to incorporate security early in mission planning and points toward established NIST and CCSDS guidance. That engineering sequence matters. A mission cannot bolt autonomous defense onto the flight computer during its final security review. The vehicle needs trustworthy telemetry. The system needs a defined source of time. Command paths must expose enough context for the defensive agent to distinguish an unusual action from an impossible one.

Constellation scale also changes the purpose of automation. The aim is not to replace every analyst. It is to reserve human attention for decisions that warrant it. Software can process the first wave of routine anomalies. Human operators can examine the smaller set that carries serious mission consequences. This division of labor resembles damage control aboard a ship. Automatic systems may close a valve immediately, while the decision to abandon a compartment remains with command.

The requirement becomes sharper during conflict. An adversary may deliberately create simultaneous disturbances across a fleet. Even harmless alerts can exhaust the ground team’s attention when presented in sufficient volume. An autonomous system that filters those alerts may preserve command capacity. Yet the same filter can hide a genuine intrusion if its assumptions have been poisoned. Scale makes autonomy necessary while giving a single mistaken policy a much wider blast radius.

Detection Is Easier Than Interpretation

An AI model can recognize statistical departure without understanding operational meaning. This distinction is especially dangerous in space systems because legitimate spacecraft behavior may change abruptly. A safe-mode entry can produce an unfamiliar telemetry pattern. A contingency maneuver can alter power demand. A software update can create a new command rhythm. Each event may look hostile to a model trained on routine flight.

The scarcity of representative attack data sharpens the problem. Commercial network defenders can draw upon large collections of observed malware behavior. Orbital systems provide far fewer public examples of confirmed cyber compromise. Mission-specific hardware also limits the value of general datasets. The model is asked to judge rare events using an incomplete history, which is rather like appointing a magistrate whose legal education consisted of reading the courthouse fire drill.

NIST’s Artificial Intelligence Risk Management Framework recognizes that human and machine roles can range from fully manual judgment to autonomous action. The proper arrangement depends on consequence. For constellation defense, a model’s confidence score cannot settle the matter by itself. Operators must define what a particular confidence level permits the system to do.

This requirement leads toward tiered response. A defensive agent might first restrict a single credential. It could then require stronger authentication for a sensitive command. Only a more severe condition would permit isolation of a spacecraft crosslink. Each step should correspond to a known mission cost. The response ladder converts uncertainty into bounded action.

Reversibility is part of this design. A credential restriction can expire after a specified period unless renewed by another trusted authority. A quarantined data path can reopen through a protected recovery channel. The system should preserve enough evidence for the ground team to reconstruct why the action occurred. NIST’s AI Risk Management Framework Playbook stresses defined human oversight and documentation of operational limits. Those concerns become concrete when the model can remove a satellite from service.

Explainability in this setting does not require a philosophical account of machine cognition. The operator needs a concise operational reason. The system should identify the command that triggered its response. It should show which rule or behavior boundary was crossed. It should also state when the restriction will expire. A bare anomaly score is inadequate because commanders cannot compare that number against mission need.

The proper measure of a defensive agent is therefore w…

This is a public episode. If you would like to discuss this with other subscribers or get access to bonus episodes, visit orbitest.substack.com