7.7.4 — Space Warfare Monitoring — maturity: live

On-Orbit Behaviour Forensics

Reconstructing the precise manoeuvre history and intent of any satellite after an on-orbit incident, using multi-source tracking data, RF signatures and optical observation.

Auto-drafted reference page — content reviewed for shape, individual references not yet link-checked.

When a foreign satellite alters its orbit, shadows a national asset, emits unexpected RF, or contributes to a debris-generating event, the victim state has one pressing question: was it deliberate? Without an independent, sovereign record of what happened and when, the answer is whatever the other party says it was. National space surveillance sensors — electro-optical telescopes, RF monitoring payloads, and radar — can continuously log the behavioural fingerprint of every object in the catalogue, building a forensic chain of custody that survives any diplomatic dispute.

The satellite stack for this mission is a layered observer network. Dedicated SSA microsatellites in complementary LEO and MEO orbital shells carry narrow-field electro-optical cameras and passive RF survey payloads tuned across the S-, X- and Ka-bands to capture attitude changes, thruster plume photometry and uplink/downlink anomalies. Ground-based optical and radar sensors feed the same ingest pipeline. Every observation is timestamped against a sovereign atomic reference and cryptographically signed at the point of collection, making the evidence chain court-admissible and manipulation-resistant.

The operational output is a forensic dossier: a reconstructed six-degrees-of-freedom trajectory, a delta-V budget derived from optical photometry and TLE differencing, RF emission logs cross-correlated with known uplink windows, and an intent-scoring algorithm that distinguishes routine station-keeping from proximity approach or electronic attack. That dossier feeds national decision-makers, supports UN-level attribution, and can be declassified selectively for allied sharing or public disclosure — none of which is possible when the raw data lives on a commercial vendor's servers.

What matters

Attribution without sovereign sensor data is hearsay; every delta-V reconstruction depends on who collected the observations and whether that chain of custody is intact.
Commercial SSA providers operate under export-control regimes and investor board decisions that can restrict data delivery precisely when a geopolitical crisis demands it most.
The Cosmos 2499 and SJ-17 precedents demonstrate that on-orbit manoeuvre intent cannot be inferred from orbital elements alone — multi-modal sensor fusion is the minimum evidential standard.
A cryptographically signed, sovereign observation archive is the only artefact that survives escalation to UN Security Council or international arbitration as unimpeachable evidence.

Sovereignty score: 10/10 — A nation without sovereign forensic observation capacity must accept another power's account of any on-orbit incident — ceding the right to independent attribution at the precise moment it matters most.

Commercial SSA vendors are domiciled in adversary-adjacent jurisdictions and subject to export controls, ITAR restrictions, and board-level commercial pressure that can withhold or sanitise data during a crisis.
UN-level attribution and legal claims under the Liability Convention require a state to present its own evidentiary record; third-party data is admissible only at the discretion of the provider and can be withdrawn.
Forensic timelines are irreversible — if sovereign sensors were not collecting at the moment of the incident, the opportunity to reconstruct ground truth is permanently lost, regardless of what commercial archives later release.
Selective declassification and controlled allied sharing of forensic products is only possible when a nation owns the full collection chain; rented data comes with the vendor's terms and geopolitical entanglements attached.

Reference architecture

Payload: Dual payload per satellite: (1) narrow-field electro-optical camera, 15 cm aperture, 0.3 arcsecond pointing stability, capable of resolved imaging of 1m-class objects at 200 km range; (2) passive RF survey receiver, 100 MHz to 40 GHz sweep, 5 kHz frequency resolution, for uplink/downlink anomaly detection and thruster exhaust plasma emission monitoring
Bus class: ESPA-class microsat, 150 kg wet, 600 W end-of-life power, 3-axis stabilised to 0.01° pointing accuracy, propulsion module providing 80 m/s delta-V for orbit-raising and phasing manoeuvres
Orbit: Dual-shell walker constellation: 12 satellites in 1,000 km SSO LEO shell for low-Earth object coverage (94° inclination) plus 6 satellites in 20,000 km MEO inclined orbit (55°) for GEO belt surveillance; combined revisit below 4 hours for any GEO slot
Ground segment: 4-station sovereign network (S-band TT&C, X-band downlink) co-located with national intelligence facilities; secondary uplink at allied partner site for resilience; stratum-1 atomic clock reference at each site for cryptographic timestamp anchoring; SatNOGS-compatible 70 cm backup for TT&C continuity
Software & data
Latency
Cost band
Lead time

References

UN COPUOS: Long-term Sustainability of Outer Space Activities — Guidelines 2019 — UNOOSA's LTS guidelines call on states to share space situational awareness data and investigate on-orbit anomalies, implicitly requiring national observation capability to participate meaningfully in any attribution process.
ESA Space Debris Office — Conjunction and Re-entry Analysis — ESA's conjunction analysis pipeline integrates multi-source tracking data to determine manoeuvre intent; the methodology underpins forensic reconstruction of close-approach events in European national-security assessments.
USSPACECOM: Commercial Integration Cell and Space Domain Awareness — USSPACECOM's Space Domain Awareness programme publicly acknowledges that characterising satellite behaviour — not just tracking position — is the key discriminator between benign and threatening on-orbit activity.
CSIS Aerospace Security Project — Space Threat Assessment 2024 — The CSIS annual threat assessment documents specific manoeuvre patterns by Russian and Chinese satellites assessed as inspector or co-orbital attack platforms, illustrating the real-world demand for forensic behaviour reconstruction.
ITU Radio Regulations — Article 15: Interference and Monitoring Obligations — ITU monitoring obligations require member states to detect and report harmful interference; sovereign RF observation infrastructure supporting on-orbit forensics directly satisfies this treaty commitment.