Hardening the satellite is wasted money if the ground station stays soft

In short: a satellite is only as resilient as the antennas, modems and operators on the ground that command it. Most operators spend their protection budget on the spacecraft, while the cheapest attack path runs through a fixed dish, a leased fibre line, or a single operations centre. Distributing the ground segment buys more survivability per dollar than any upgrade in orbit.

Ask a program office where the risk sits and the answer points upward. Radiation hardening, orbital manoeuvring, encrypted crosslinks. Then look at the architecture diagram. Three antennas, one network operations centre, and a commercial fibre backhaul that nobody owns.

Read also: One exquisite satellite loses to sixty cheap ones, and revisit rate is why · Jamming does not stop the drone that is not listening · The laser does not run out of ammunition, and that is the whole point

Three segments, three very different costs to attack

Space systems split into a space segment, a link segment and a ground segment. Attacking the spacecraft requires a launch, a co-orbital vehicle or a direct-ascent interceptor, all of which are expensive and politically loud. Attacking a dish requires a truck, a drone, or a contractor with a login.

The asymmetry is the whole problem. A bent-pipe payload worth 300 million dollars becomes useless when its two commanding antennas lose power for six hours. Nothing in orbit was damaged. The mission still stopped.

Why antennas are harder to replace than satellites

Large tracking antennas are custom builds. A 13-metre dish with its pedestal, servo drives and cryogenic low-noise amplifier takes 12 to 24 months to order and install, and the suppliers are few. Spare satellites can sit in storage. Spare antenna farms rarely do.

That lead time is the reason a constellation of cheap satellites only delivers its promised resilience when the ground side is equally distributed. Sixty spacecraft commanded through four dishes concentrate the risk back on the ground, which defeats the point of dispersing the fleet.

What distributing the ground segment actually means

• Geographic spread: commanding sites separated by enough distance that one weather system or one strike cannot cover both.
• Diverse backhaul: two physically separate fibre routes plus a satellite or microwave fallback, not two circuits in the same conduit.
• Mobile terminals: transportable 2.4 to 4.5 metre terminals that restore basic commanding within hours.
• Distributed operations: at least two staffed centres able to take full control, tested by actually switching, not by paperwork.
• Autonomy on board: enough stored commanding and fault management to keep the spacecraft safe through 48 to 72 hours of silence.

Commercial constellations learned this early, which is why many of them run dozens of distributed gateway sites rather than a handful of large ones. Virtualised modems help: when the signal processing runs in software, a lost site can be rebuilt on cloud infrastructure at another location in days instead of years.

Electronic attack starts on the ground too

Uplink jamming is aimed at the satellite receiver but it is executed against the ground link, and the defence is mostly a ground-side engineering problem. Frequency agility, nulling antenna patterns, spread spectrum waveforms and tight link budgets all live in the terminal design. Analysts tracking jamming on the uplink keep finding the same pattern: the receiver that survives is the one with options, not the one with more power.

Detection matters as much as hardening. An operations floor that cannot tell a jammer from a failed amplifier will spend hours troubleshooting hardware while an adversary holds the link. Spectrum monitoring at each site feeds that judgement, and it pairs naturally with sensor fusion practice already used in air defence.

A plain description of the facilities, networks and control functions that make up this layer is set out in the Ground segment entry on Wikipedia.

Run the test rather than the briefing. Pick your primary commanding site, declare it destroyed on a Tuesday morning, and measure how many minutes pass before someone at the secondary site sends a verified command. The number you get is your real resilience figure.