By Burak Oktenli
Key Takeaways:
Ukraine’s October 2026 Starlink and Starshield restrictions, which briefly impaired frontline operations, illustrated that a satellite service can remain technically functional while contractual or policy limits suddenly remove authorized access.
The episode underscores three distinct risks—technical compromise (as in the 2022 Viasat attack), malicious use of working terminals by scammers, and abrupt loss of access through provider or government decisions—each requiring different controls.
Governments and operators should pre-negotiate mission-specific service terms, enable targeted rather than blanket suspensions, test independent fallbacks, and treat diversification (including Europe’s future IRIS² constellation) as essential to resilience.
Ukraine’s October service restrictions and international scam crackdowns show why satellite resilience requires more than coverage: secure networks, predictable access decisions and credible alternatives.
On October 24, Ukraine said its Starlink and Starshield connections were again working at speeds needed for frontline operations. The Ukrainian Defense Ministry reported stable service on equipment moving at more than 400 kilometers per hour, following restrictions that had affected drone missions, communications and logistics. The satellites had not fallen out of the sky, and Ukraine was not reporting a hack of the constellation. A service restriction, whatever its disputed origin, had nonetheless become an operational problem for a country fighting a war.
Elon Musk said commercial Starlink service had been restricted because Ukraine was using it contrary to conditions governing weapon-related activity. Ukrainian officials disputed his account. Responsibility for restrictions involving the distinct military-focused Starshield service was also publicly contested. These disputes deserve careful reporting rather than premature verdicts. What they reveal is broader than the argument between any government and provider: a communication service can remain technically functional while the terms under which a user can rely on it change.
Two weeks earlier, the U.S. Justice Department named Starlink among technology companies supporting an international operation against scam centers in West Africa. The participating companies collectively reported removing more than 3.7 million fraudulent accounts, pages and groups. Those collective removals must not be credited to Starlink individually. But its presence among the partners underscores the other side of the dilemma: the same cross-border connectivity that helps emergency responders can also sustain criminal organizations.
Global satellite internet is becoming a tool of national resilience and a channel that states and private providers must sometimes restrict. Cybersecurity policy needs to manage both facts at once. A dish on a roof is not the same thing as dependable, authorized and secure connectivity.
A useful lifeline can become a strategic dependency
Starlink earned its standing as crisis infrastructure through real service, not advertising. A 2025 USAID inspector general review documented how terminals helped restore civilian internet access in Ukraine and supported government and emergency communications after Russia attacked terrestrial networks. The same inspection found that safeguards and oversight for 5,175 U.S.-provided terminals had been insufficient. It called for assessing units at risk of misuse or theft and coordinating narrowly targeted suspension. It did not establish that every terminal in a risky location had been misused.
That experience captures the dilemma better than a demand that a private provider never suspend service. A provider must comply with law, sanctions and contractual conditions and must be able to counter misuse. A government, hospital or emergency operator must also know which service it actually purchased, what uses it authorizes, which changes may affect it and what recourse is available when essential work is interrupted.
Starlink’s published service terms distinguish ordinary commercial connectivity from use in offensive or defensive weapons and describe export-control obligations. Starlink and Starshield do not have identical purposes or contractual arrangements. Treating a commercial subscription as an unconditional military right would be untenable. Treating every consequential service change as an ordinary customer-support matter would be equally shortsighted where governments have built vital functions around the connection.
The cyberattack, the abusive user and the access decision are different risks
The first risk is technical compromise. In February 2022, an attack on Viasat’s KA-SAT network disrupted internet service across Ukraine and parts of Europe. Viasat described intrusion through a misconfigured virtual private network appliance into its management environment and malicious commands that disabled customer modems. This was a Viasat incident, not a Starlink breach, and Viasat reported no evidence that the satellite itself had been compromised. It demonstrated why the ground and management layers can be decisive even when the network has assets in orbit.
A March 2026 joint advisory from the United States, Australia and other partners treats low-Earth-orbit satellite security as a problem spanning spacecraft, ground stations, terminals, user devices, communications links and the supply chain. A remote satellite cannot clean ransomware from a hospital computer. Nor does a functioning antenna protect an organization whose administrator credentials or endpoint devices have been stolen. Availability, integrity and confidentiality require different controls.
The second risk is malicious use of otherwise functioning connectivity. An Associated Press and FRONTLINE investigation found Starlink-linked connections among scam operations in Myanmar even after previous enforcement efforts. A terminal used in fraud is not evidence that the satellite network was penetrated. It is evidence that legitimate infrastructure can be purchased, diverted or concealed by an abusive customer. The October operation in West Africa shows that network providers, financial firms, technology platforms and police can make better progress when they coordinate on specific evidence instead of treating every user in a troubled region as suspect.
The third risk is loss of access through policy or contracts rather than technical failure. Ukraine’s October dispute illustrates this risk, although responsibility for Starshield restrictions remains contested. No hack was reported, and a firewall could not resolve such a service restriction. The response must involve clear contracts, transparent responsibility where feasible, valid emergency contacts and practical alternatives. It must also respect the need for immediate intervention when the service is being used unlawfully or presents serious security risks.
Build a crisis service, not just a backup connection
Governments buying satellite access for essential services should require a mission-specific service annex before a crisis. It should distinguish civilian relief, ordinary government connectivity and security operations, identify the responsible public and private officials, describe lawful restrictions and escalation routes, and state what notice or urgent review is possible when access changes. No agreement can promise continued service regardless of sanctions, attacks or misuse. It can make the decision process less ambiguous and reduce avoidable surprises for legitimate users.
Providers and authorities should also be able to restrict abuse as precisely as the evidence permits. Terminal identity, account verification and a traceable incident process can help isolate suspect devices or activities rather than disconnecting whole populations. Where feasible, especially for protected emergency uses, suspension decisions should allow rapid correction of mistaken identity. Cross-border information sharing must remain consistent with law and data minimization, rather than creating a centralized list of everyone who needs to stay online.
Customers have an equally important duty. A satellite backup should be tested with the principal internet link gone, corporate identity services unavailable and a compromised device removed from the network. Staff should demonstrate that they have trusted devices, independent access credentials, power, procedures and the ability to use a different communications route when necessary. Two providers that depend on the same authentication platform, terminal-management service or local electricity supply may still fail together. The test of resilience is the essential work completed, not the number of antennas purchased.
Diversification is becoming a strategic policy choice. In August, the European Union advanced its 348-satellite IRIS² program to strengthen independently governed secure connectivity for public institutions and emergency services. Its first launches are planned for 2029, so it is not a replacement for today’s emergency links. Its relevance is that governments increasingly regard the governance and availability of satellite service, not only signal strength, as part of infrastructure security. Other regions will need options suited to their resources and laws, not necessarily a copy of Europe’s public investment.
This is not a case for nationalizing Starlink or making any provider an international utility by decree. Competition, innovation and provider discretion have helped bring satellite service to places terrestrial networks cannot reliably reach. The policy opportunity is narrower: public purchasers and providers can agree in advance on authorized use, targeted enforcement, incident notification, safe restoration and independently tested fallbacks.
The next global cyber emergency may involve an attack on a ground control system, the exploitation of terminals by criminal networks, or a legitimate user losing a service on which an urgent operation depends. Those are different failures. A country that treats them all as a question of satellite coverage will prepare for none of them adequately.
Starlink can help keep a nation connected in crisis. Real resilience begins when that nation knows how the connection can be protected, restricted and, when necessary, replaced.
About Burak Oktenli
Burak Oktenli holds an MBA and a Master of Professional Studies in Applied Intelligence from Georgetown University. His research addresses the governance of authority in autonomous and AI-enabled systems, and his writing has appeared at the Modern War Institute at West Point, RUSI, RealClearDefense, RealClearMarkets, and Geopolitical Monitor. He is the author of Authority Architectures for Autonomous Systems, a ten-volume series on how authority in autonomous systems is delegated, monitored and recovered, at authority-architecture.me.
View all posts by Burak Oktenli →
No comments:
Post a Comment