(Cth) Define Space Technology Assets as Critical Infrastructure
Author: Lucy Leutchford, Miya Latham, Dynuk Devamulla, Gowri Rajmohan, Blake Allan, Ishaan Jivani & Julian Henry Raymundo | Publish date: 2/10/2026
P: In Australia, space technology assets are not defined as critical infrastructure assets.
S: The Minister for Home Affairs should amend Section 5 of the Security of Critical Infrastructure Act 2018 (Cth) to define and include space technology as a ‘critical infrastructure asset’.
E: Australian Centre for Space Governance (2024): ‘Space technology assets should be defined and included in the security of critical infrastructure regime’.
Problem Identification:
The Security of Critical Infrastructure Act 2018 (Cth) (SOCI Act) establishes that once an asset is classed as a critical infrastructure (CI) asset, organisations must meet obligations to ‘provide operational and ownership information’, ‘report cyber incidents’, and ‘adopt, maintain and comply with a written risk management program.’ However, Section 5 of the SOCI Act does not define space technology assets as CI assets.
According to law firm Lander & Rogers (L&R), this means that cybersecurity obligations are not ‘switched on’ for space technology assets unless they ‘fall within other deemed critical infrastructure sectors’. The Space Industry Association of Australia (SIAA) stated that this means that ‘the [SOCI] Act’s objectives are not yet being fully realised in practice’, as it ‘creates a gap between the intent of the Act and its operational coverage.’
Context:
According to HWLE Lawyers, space technology assets generally compromise of the ‘ground segment’ (launch facility, ground station and control centre), the ‘space segment’ (satellites and payloads), and the ‘link segment’ (ground-to-space, space-to-space and ground-to-ground signal transmission).
In 2026, Dr Jill Slay AM highlighted Australia’s ‘systemic reliance’ on space technology services. She stated that ‘interdependencies mean that disruption to one sector can cascade into others and thus disrupt the complete Australian economy and its social cohesion.’ For example, Nick Leake, Head of Optus Satellite and Space Systems, described the potential consequences of space infrastructure disruptions, including ‘ATM networks going down, emergency services losing their situational awareness, aircraft navigation degrading, Defence losing secure communications and remote communities being entirely cut off.’
The Australian Signals Directorate (ASD), in their Annual 2023-2024 Cyber Threat Report, outlined how reporting obligations under the SOCI Act work in practice. They described an incident in 2024, where a ‘critical hospital’ faced a cyberattack which ‘triggered an alert’. They explained that ‘the hospital, which is designated under the [SOCI Act], quickly reported the incident to ASD through its [managed service provider, and] fulfill[ed] its obligations under the SOCI Act.’ ASD explained that this reporting ‘assist[ed] in the mitigation of similar incidents.’
Arguments:
SIAA stated that ‘without such [mitigation] mechanisms, a growing portion of Australia’s critical infrastructure dependency remains outside the practical reach of the SOCI framework’. In a 2025 Law Society Journal article, Cat Woods explained that ‘without classification of space technology assets, [Australia] has failed to … [become] prepared for increasing, sophisticated attempts at hacking systems that govern our national security and commercial sectors.’ RMIT’s Centre for Cyber Security Research and Innovation (CCSRI) highlighted an example, where there is an ‘expansion of malware trends, insider threats … and other cyber threats … against space-based systems.’ Adam Bartly, in an article for the Australian Strategic Policy Institute, explained that this can make ‘space systems low-hanging fruit: high-value targets with uneven protections.’ He asserted that ‘existing frameworks to lift baseline cyber expectations and incident reporting’, are not being used as ‘space [is not treated] as critical infrastructure in practice’.
Jason Sprague, a partner at law firm Bartier Perry, argued that ‘low orbit satellites that are used by the agricultural sector or mining sectors … do not, likely, affect national sovereignty and therefore would not be considered critical.’ However, SIAA argued that space assets should be assessed according to their ‘criticality to Australia’s economy and society.’
Advice/Solution Identification:
The Australian Centre for Space Governance, CCSRI, L&R and Rob Nicholls have called for space technology assets to be defined as critical infrastructure assets. CCSRI explained that this could ‘prescribe space sector assets with obligations under the SOCI Act’ and ‘ensure all commercial satellite providers servicing the Australian Government or defence clients implement robust cyber security measures such as data segregation and appropriate encryption.’
Precedent:
There is an international precedent for defining space technology as critical infrastructure assets. The EU’s Critical Entities Resilience Directive defines the space sector to include ‘operators of ground-based infrastructure ... that support the provision of space-based services’.
Public Support of the Solution
(This list reflects publicly stated positions and should not necessarily be taken as endorsement of this specific brief.)
Broad Support
Dr Jill Slay - She recommended expanding ‘what counts as critical infrastructure (corporate groups, space assets, energy systems, healthcare/food supply).’ However, she did not explicitly call for space technology assets to be defined as critical infrastructure.
News Coverage:
PV Magazine - “Energy sector in spotlight as cyberattack threat grows”. This article examined the growing cyberattack threat to Australia's energy sector as information and operational technology systems converge. By: Jason Pearce | 26 August 2026 - Read the article here.
The Guardian - “How will Australia’s emergency services cope if satellites go down? With a sextant and a street directory”. This article interviewed experts, such as Jackie Craig AM and Nick Leake, and discussed how a cyberattack could knock out satellites and critical space infrastructure. By: Tory Shepherd | 23 July 2026 - Read the article here.
Australian Strategic Policy Institute - “Hack-proofing our space infrastructure”. This article examined how hacking poses a threat to Australia’s space infrastructure and called for space systems to be treated as critical infrastructure. By: Adam Bartley | 5 February 2026 - Read the article here.
LSJ Online - “Cybersecurity and space: is Australia keeping up with international standards?”. This article examined Australia’s growing dependence on space technology and the vulnerability it faces from hackers as a result of the lack of cybersecurity measures. By: Cat Woods | 4 March 2025 - Read the article here.
Where to go to learn more:
(2024) Securing Australia Through Space: Space Technology as Critical Infrastructure | Stacey Henderson and Joel Lisk, Australian Centre for Space Governance - This report discussed the vulnerabilities of Australia’s space technology. They have recommended that ‘space technology assets should be defined and included in the security of critical infrastructure regime’. Read the article here.
(2025) Australia Space Cyber Security Report: Challenges, Anticipated Readiness, and Future Directions | Centre for Cyber Security Research and Innovation (RMIT) - This report explored how exposed Australia's space-based infrastructure is to disruption. They recommended ‘formally designat[ing] critical infrastructure assets in the space technology sector as “critical infrastructure.”’ Read the article here.
(2024) CyberSight 360: Is space the forgotten sector in critical infrastructure cyber security? | Lander & Rogers - This article explained the current regulations in the space technology sector. They stated that ‘safeguarding space assets as part of critical infrastructure needs to be a priority for government and should not be further delayed.’ Read the article here.
(2026) Submission on the Security of Critical Infrastructure Act 2018 review | Rob Nicholls - This submission explained that despite multiple reforms since 2021, the SOCI Act still leaves critical gaps. Nicholls stated that ‘space technology assets require Application Rules defining satellites, ground stations, and related systems as critical infrastructure.’ Read the article here.
(2023) Space systems as critical infrastructure assets – understanding the security obligations for space assets | HWLE Lawyers - This article explained the current regulations surrounding space systems within the context of critical infrastructure. They stated that ‘the SoCI Act does not specifically define any categories of critical space technology assets.’ Read the article here.
(2016) Hackers corrupt satellite company IT | SBS News - This article described the 2016 incident where an Australian satellite company, Newsat, had its computer systems so comprehensively hacked that experts described their network as the most corrupted they had ever seen. Read the article here.
Security of Critical Infrastructure Act 2018 (Cth) - Read the full Act here.
Human Perspective:
CW: Medical emergency, apocalyptic themes, critical infrastructure failure
Maria runs a small regional pharmacy in outback QLD. For years she's trusted the EFTPOS machine without a second thought: swipe, beep, done. One afternoon, a satellite disruption hundreds of kilometres away interferes with the GPS timing signal that underpins the payment network her EFTPOS terminal relies on. She doesn't know that's the cause. All she sees is a screen that won't process transactions and a queue of frustrated customers, one of whom needs urgent asthma medication and no cash to pay for it. Maria waves the woman through without payment, promising to sort it later, but she's rattled by how fragile the whole system suddenly feels. Later that evening, Maria caught up for dinner with her mother and watched her as she struggled with her portable medical monitor, which stopped receiving signals. She learnt that this had happened because the launch facility, ground station and control centre for the satellite which supported the EFTPOS machine was hacked. She investigated and later on found out this had already happened multiple times in the last few months in different areas around the country. She then came to understand that the actors responsible for this technology were not required to monitor and report any incidents. This made it rather difficult, she thought, to remedy the circumstances that allowed this to occur in the first place. Suddenly, the space technology assets she’d never given a second thought to felt terrifyingly important. Now she can't stop wondering what would happen if it lasted longer than an afternoon.
To protect the anonymity of those involved, this is a fictionalised account drawn from an amalgamation of real-life stories, experiences and testimonials gathered during the research process for this brief. Any resemblance to actual individuals is purely coincidental.
Conflict of interest/acknowledgment statement:
N/A.
Support
If your organisation would like to add your support to this paper or suggest amendments, please email Info@foreaustralia.com.
Disclaimers
Please review all FORE disclaimers here.
Reference list:
Australian Signals Directorate. (2024). Annual Cyber Threat Report 2023-2024. Commonwealth of Australia. https://www.cyber.gov.au/sites/default/files/2024-11/asd-cyber-threat-report-2024.pdf
Bartley, A. (2026, February 5). Hack-proofing our space infrastructure. Australian Strategic Policy Institute. https://www.aspistrategist.org.au/hack-proofing-our-space-infrastructure/
Centre for Cyber Security Research and Innovation. (2025). Australia Space Cyber Security Report: Challenges, Anticipated Readiness, and Future Directions. RMIT University. https://www.rmit.edu.au/assets/au/en/news/ccsri/2025-rmit-university-final-space-cyber-security-report.pdf
Critical Infrastructure Security Centre. (2024). Security of Critical Infrastructure Act 2018 (SOCI). Australian Government. https://www.cisc.gov.au/legislation-regulation-and-compliance/soci-act-2018
Directive (EU) 2022/2557. (2022). Directive (EU) 2022/2557 of the European Parliament and of the Council of 14 December 2022 on the resilience of critical entities and repealing Council Directive 2008/114/EC (Text with EEA relevance). EUR-Lex. https://eur-lex.europa.eu/eli/dir/2022/2557/oj
Henderson, S., & Lisk, J. (2024). Securing Australia Through Space: Space Technology As Critical Infrastructure. Australian Centre for Space Governance. https://static1.squarespace.com/static/68b7efbc4a6cf376335c3e37/t/68bf98eaf13ee7276caa21e8/1757386986698/Henderson+and+Lisk+-+Space+Technology+as+Critical+Infrastructure.pdf
Kiley, D., & Heath, N. (2023). Space systems as critical infrastructure assets – understanding the security obligations for space assets. HWLE Lawyers. https://hwlebsworth.com.au/space-systems-as-critical-infrastructure-assets-understanding-the-security-obligations-for-space-assets/
Lander & Rogers. (2024). CyberSight 360: Is space the forgotten sector in critical infrastructure cyber security? https://landers.com.au/legal-insights-news/is-space-the-forgotten-sector-in-cyber-security
Nicholls, R. (2026). Submission on the Security of Critical Infrastructure Act 2018 review. https://ses.library.usyd.edu.au/bitstream/handle/2123/35284/nicholls-2026-submission-on-the-security-article.pdf?sequence=1&isAllowed=y
Parliament of Australia. (2020, November 11). 3. Growing the Space Industry [Inquiry]. https://www.aph.gov.au/Parliamentary_Business/Committees/House/Former_Committees/Industry_Innovation_Science_and_Resources/SpaceIndustry/Report/section?id=committees%2Freportrep%2F024732%2F77072
Pearce, J. (2026, August 26). Energy sector in spotlight as cyberattack threat grows. PV Magazine. https://www.pv-magazine-australia.com/2026/08/26/energy-sector-in-spotlight-as-cyberattack-threat-grows/
SBS News. (2016, August 29). Hackers corrupt satellite company IT. https://www.sbs.com.au/news/article/hackers-corrupt-satellite-company-it/z23dl8kga
Security of Critical Infrastructure Act 2018 (Cth). https://www.legislation.gov.au/C2018A00029/2026-06-04/2026-06-04/text/1/epub/OEBPS/document_1/document_1.html
Shepherd, T. (2026, July 23). How will Australia’s emergency services cope if satellites go down? With a sextant and a street directory. The Guardian. https://www.theguardian.com/australia-news/2026/jul/23/australia-emergency-services-satellites-down
Slay, J. (2026). Independent Review of the Security of Critical Infrastructure Act 2018. https://www.homeaffairs.gov.au/cyber-security-subsite/files/independent-review-soci-act-final-report.pdf
Space Industry Association of Australia. (n.d.). Consultation on the Independent Review of the Security of Critical Infrastructure Act 2018. https://www.homeaffairs.gov.au/cyber-security-subsite/files/submissions-independent-review-soci/space-industry-association-australia.pdf
Swope. C., Bingen., K. A., Young. M., & Lafave. K. (2025). Space Threat Assessment 2025. Centre for Strategic and International Studies. https://csis-website-prod.s3.amazonaws.com/s3fs-public/2025-04/250425_Swope_Space_Threat.pdf?VersionId=orhySgjISemJLjhdQKKes2OVb35jwkU5
Woods, C. (2025, March 4). Cybersecurity and space: is Australia keeping up with international standards?. LSJ Online. https://lsj.com.au/articles/cybersecurity-and-space-is-australia-keeping-up-with-international-standards/
Comments