RAZAN

A1The volume

Avoidance stopped being an event.

That operator's fleet passed 10,000 satellites in June 2026 and now accounts for close to two of every three active spacecraft. Its avoidance system is autonomous and runs at a collision-probability threshold far more conservative than the industry norm — with limited external transparency. Everyone else coordinates by email.

The growth is not levelling. A second constellation is scaling toward 3,236 satellites, a third has filed for up to 14,000, and projections put the active population between 30,000 and 60,000 by 2030. Manoeuvre counts have roughly tripled in two years.

The stakes are not two lost satellites. A collision at orbital speed produces thousands of fragments that stay up for decades — the 2009 collision between two satellites left debris clouds that are tracked to this day. Enough debris, and collisions start causing collisions. Past a point, whole orbits become unusable for everyone.

Manoeuvre totals are the operator's own regulatory filings: 207,152 in the six months to May 2026, 148,696 in the six before. Satellite counts vary by catalogue and by date, so read every number here with its source and date attached. The trend is what is not in dispute.

A2The coordination gap

Two operators, one close approach, no record.

A warning arrives as a conjunction data message — a collision alert carrying the time of closest approach and the probability of collision. When the other object is debris, the operator decides alone. When it is another active satellite, two organisations have to agree which of them moves — and that agreement is reached by email and telephone, when it is reached at all.

This is documented, not rhetorical. In September 2019, a space agency manoeuvred its own satellite out of the path of a constellation spacecraft after the other operator missed the follow-up emails — a bug in its paging system, by its own account. And the UN Office for Outer Space Affairs has twice in fourteen months been asked to broker a close approach directly, once because one operator would not answer repeated messages from another. A UN office is the escalation path.

The missing artefact is precise: not who was warned — the alert proves that already — but who undertook to move, by when, by how much, and whether they did.

A US traffic-coordination service has been sending warnings since 2024 — by August 2026, seventy operators and more than eleven thousand satellites. It warns. It does not decide who yields, and it belongs to one state, which is why it cannot be the shared record. Sources: the 2019 incident is on record from both agencies involved; the UN cases are from the UNOOSA director's 2026 remarks; manoeuvre totals from regulatory filings.

A3No shared regulator

Nobody has jurisdiction over both of you.

Every other collision has a referee. Two ships that meet at sea sit under maritime law. Two aircraft sit under an air-traffic authority. Two companies in a dispute end up in front of some court one of them chose. Somewhere, there is a body with the power to decide — and to hold the parties to the decision.

A close approach has no such centre. The two satellites answer to different licensing authorities, and no single jurisdiction covers them both. There is no regulator empowered to appoint a keeper of the record, and each operator's own servers are exactly the record its counterparty will not accept.

The hard part is legal, not technical. Signing an undertaking to move is written evidence that you were the one who had to move — so the incentive runs against any record existing at all. An honest design has to make signing cheaper than not signing.

B1The gap

Authentication is not authorisation.

Where the space-industry link security standard is deployed, a command frame is encrypted, authenticated and protected against replay. Flight software then checks the command against its dictionary, its parameter ranges and the vehicle's mode.

Every one of those checks answers one question: did a holder of the key produce this frame? None answers the second: was whoever sent it entitled to send this, now? Authorisation exists on the ground, as a procedure between people. It has never existed as a property the spacecraft can verify for itself.

February 2022 is the case usually cited. An intruder reached a satellite operator's trusted management network through a misconfigured VPN appliance and ran legitimate management commands against tens of thousands of modems. This architecture would not have stopped it — no spacecraft was commanded, the target was a ground fleet. The case is kept because the missing property is identical: every command was well formed, and nothing in the path could ask whether anyone had approved it.

Sources: the operator Viasat's own incident report, 30 March 2022; and a 2023 IEEE study that examined the flight software of three satellites and found standard protections absent. Where even authentication is missing, authentication comes first — it is the cheaper fix.

B2The check

Nine seats. Six signatures. One gate.

The operator, its ground stations, independent technical seats and an insurer with a restricted vote hold seats on one chain. A command is authorised when six of the nine sign it, and the certificate travels with the command. The spacecraft keeps its link security and gains a single check: verify the post-quantum signature, then the quorum certificate. Absent or invalid, the command does not execute.

Six ML-DSA-87 signatures come to 27,762 bytes, and that does not fit a command uplink: a standard command frame carries at most 1,024 octets, and uplinks commonly run between 1 and 64 kbit/s. So the unit of authorisation is not the command. A Merkle root over a command batch is signed once and each command carries a short inclusion proof — one certificate per pass, not per command.

Why the signatures are this large: the US national-security suite approves only the strongest parameter set, which costs 40% more bytes than the middle one. Verifying is cheap — under 3 KB of memory in an optimised implementation. The real constraint on board is storing the certificate, not checking it.

B3The limits

What refuses by default can lose a spacecraft.

An unavailable quorum becomes a mission risk the moment refusal is the default. This is the first question a flight operations director asks, so it belongs here rather than in a design review.

The six signatures bind to a command's fingerprint. They do not prove that six institutions understood what they signed. Presenting a command in a form a human can genuinely review is the harder half of this work — and it is not cryptography.