The Senate Passed Two Satellite Security Bills in One Day. Only One of Them Has Teeth

On 23 September the Senate cleared two space bills without a single objection. The Secure Space Act of 2026 and the Satellite Cybersecurity Act went through by unanimous consent, one after the other, and were received in the House the next day.

They are easy to lump together. Both are about security, both came out of the Senate Commerce Committee, and both were reported by Senator Cruz on the same day in September. But they are very different pieces of law. One is a hard prohibition written into the statute that governs the FCC’s national security powers. The other is, by its own terms, a set of voluntary recommendations and a study. Anyone advising a satellite operator, an investor in one, or a company that leases ground station capacity should understand the difference, because only one of them will change what a licence application has to prove.

The Secure Space Act: a ban at the licensing desk

The Secure Space Act does not create a new regime. It adds a new section to an existing one, the Secure and Trusted Communications Networks Act of 2019. That is the law behind the FCC’s Covered List and the “rip and replace” programme that paid US carriers to tear Huawei and ZTE equipment out of their networks. The Covered List names equipment and services that the national security agencies have found pose an unacceptable risk. It includes Huawei, ZTE, Hikvision, Dahua, Hytera and Kaspersky, and the US arms of China Mobile, China Telecom and China Unicom.

The new section 10 says the FCC “may not grant” four things if they would be held or controlled by a Covered List entity or its affiliate:

a licence for a geostationary or non-geostationary satellite system; a declaratory ruling giving a foreign-licensed system access to the US market; an authorisation for an individually licensed earth station, which the bill defines to include gateway stations; and a blanket-licensed earth station, the licence type used for large numbers of user terminals.

The market access limb matters most for anyone outside the United States. A satellite system licensed by another country cannot serve US customers until the FCC grants it a declaratory ruling under its Part 25 rules. The Secure Space Act would shut that door for foreign systems in which a Covered List entity has a qualifying stake, wherever the system is licensed.

Three drafting details are worth noticing. The prohibition is prospective: it applies to grants made on or after enactment, so existing authorisations are not revoked, although renewals and modifications will be new grants. The FCC must write implementing rules within a year of enactment, and those rules will decide how much diligence an applicant has to show. And the Senate text adds a power, not a duty, for the FCC to report on supply chain risk where any satellite or earth station licensee uses equipment made by a Covered List entity. The bill says expressly that this does not expand the FCC’s authority. It does, however, invite the Commission to name names.

What the Senate changed from the House version

This is not a new idea. The House passed its own Secure Space Act, H.R. 2458, by voice vote on 28 April 2025, after the Energy and Commerce Committee approved it 52 to 1. The Senate did not simply take up the House bill. It passed Senator Deb Fischer’s companion, S. 1962, with a substitute text, so the House now has to pass the Senate version (or the two chambers have to agree a single text) before anything goes to the President.

The differences are small but they are the kind that end up in due diligence checklists. The House bill caught any entity that “produces or provides” covered equipment or services, and borrowed the definition of affiliate from the Communications Act. The Senate bill ties the ban to entities actually named on the published Covered List, and writes its own affiliate test: to “own” means to hold an equity interest of “not less than 10 percent.” That settles a point the House text left to cross-reference. A 10 per cent stake is enough.

Fischer, who introduced S. 1962 with Senator Ben Ray Luján, framed it in plain terms: “The threat foreign adversaries pose to our satellite infrastructure cannot be overstated.” Given that the House has already passed a near-identical bill once, the odds of it clearing the House again look good. Timing, in the last weeks before the midterm elections, is the real risk.

Who it actually hits

It is worth being honest about the immediate practical effect. The companies on the Covered List are mostly equipment makers and telecoms carriers, not satellite operators, so the bill is largely preventive. It closes a door before anyone on the list tries to walk through it. That is the point of it. Chinese satellite broadband constellations are being built at scale, and Congress would rather the prohibition be in place before one of them, or a company partly owned by one of their suppliers, applies for US market access.

For everyone else, the bite is in the affiliate rule. An operator does not have to be Huawei to be caught. It has to have a Covered List entity as a 10 per cent owner, or be under common control with one. Minority investment structures, joint ventures in ground infrastructure and gateway leasing arrangements are the places to look.

The Secure Space Act also does not stand alone. In January the FCC adopted its foreign adversary control rules (FCC 26-2), which took effect on 9 June 2026. Those rules work on a different axis. They look at countries, not companies: China including Hong Kong and Macau, Russia, Iran, North Korea, Cuba and the Maduro regime in Venezuela. Space station and earth station licensees are in the highest-scrutiny category and will have to attest whether they are owned by, controlled by or subject to the direction of a foreign adversary, again using a 10 per cent ownership trigger, with disclosure of 5 per cent holders where control is found. The FCC has not yet announced the filing deadlines, as Wiley noted when the rules took effect.

So a satellite operator applying to the FCC in 2027 may face two separate ownership filters: a statutory ban tied to named companies, and a disclosure regime tied to named countries. They overlap, but they are not the same test, and a clean answer to one does not answer the other.

The Satellite Cybersecurity Act: guidance, a clearinghouse and a study

The second bill, sponsored by Senators Gary Peters and John Cornyn, has had a long road. This is the third Congress in which Peters has pushed it, and it had twice cleared the Homeland Security Committee before stalling without a floor vote. This time it went through Commerce instead, and through the full Senate.

What it does is modest and specific. Within 180 days of enactment, the Commerce Department, working with Homeland Security, has to set up a public online clearinghouse of cybersecurity resources for commercial satellite operators, with material aimed specifically at small businesses. Commerce also has to consolidate the voluntary recommendations that already exist across government into one set. The bill lists what those recommendations should cover, and the list reads like a threat model: retaining or recovering positive control of a satellite after a cyber incident; protection against jamming, eavesdropping, hijacking and spoofing; physical protection of command and telemetry receivers; supply chain risk; and, notably, the risks of foreign ownership and of putting ground control infrastructure in foreign countries.

Within 120 days, Commerce, the National Space Council and the National Cyber Director must give Congress a strategy for coordinating federal work on satellite cybersecurity. Within two years, the Government Accountability Office must report on what the government has actually done, how far critical infrastructure depends on commercial satellites, and how far federal agencies rely on satellite systems that are foreign-owned or have infrastructure abroad. The Congressional Budget Office puts the cost at about $14 million over 2026 to 2031.

Then comes section 6, which is the most important part of the bill for lawyers. It says nothing in the Act may be read to designate satellites as a critical infrastructure sector, to change any agency’s authority, or to authorise “any rulemaking or regulatory requirement, including by way of enforcement action or condition on any license or permit.” The GAO is even told not to recommend new regulations. That is a deliberate choice. The Cyberspace Solarium Commission 2.0 had recommended making space a critical infrastructure sector. This bill takes the other path.

I would not dismiss it for that reason. Voluntary government guidance has a way of becoming the standard of care. Once Commerce publishes a consolidated set of recommendations, it becomes the obvious benchmark for insurers pricing cyber cover on a constellation, for government customers writing security clauses into service contracts, and for anyone arguing in litigation about whether an operator took reasonable precautions. The bill does not make those recommendations binding. The market probably will.

Why both bills are really about the ground

Read the two texts side by side and they share a focus that is easy to miss. The Secure Space Act spends most of its definitions on earth stations: gateway stations, individually licensed stations, blanket-licensed terminals. The Satellite Cybersecurity Act singles out ground control infrastructure located abroad. Neither bill is much concerned with the satellites themselves.

There is a reason. The best-known cyber attack on a commercial satellite network did not touch a satellite. On 24 February 2022, the morning Russia invaded Ukraine, attackers disabled tens of thousands of user modems on Viasat’s KA-SAT network across Europe. Viasat’s own incident overview says the attackers got in through a misconfigured VPN appliance in the ground network and then pushed malicious commands to the modems. The knock-on effects reached well beyond Ukraine, including the remote monitoring of thousands of wind turbines in Germany. The United States, United Kingdom and European Union formally attributed the attack to Russia in May 2022.

The lesson most regulators took from Viasat is that a satellite system is only as secure as its least protected ground connection. Under US law, the ground segment has mostly been treated as a spectrum licensing question: does this earth station cause interference? These bills are the first serious attempt to treat it as a security question too.

How this compares with the EU Space Act

Europe is attempting something much more ambitious, and the contrast is instructive. The EU Space Act, proposed by the Commission in June 2025, would impose binding cybersecurity obligations across the whole life of a mission: risk management, continuous monitoring, encryption, penetration testing and supply chain controls. It would also reach operators outside the Union. A non-EU operator providing space-based data or services to EU customers would have to register with EUSPA, obtain certification and appoint a legal representative in the EU.

The three EU institutions do not yet agree on how that cybersecurity chapter should work. Gleiss Lutz summarises the split: the Commission wants the Space Act to be a specialist rulebook that displaces the NIS 2 Directive for space operators; the Council would run the two in parallel with aligned obligations; and the Parliament’s draft report would delete the chapter and fold space into NIS 2 altogether. Ministers received a progress report in May rather than agreeing a Council position, and the US government is still reviewing and pushing back on the compromise text. Adoption before 2028 looks unlikely.

So the two systems are heading in opposite directions. Europe is moving towards binding, horizontal cybersecurity rules with extraterritorial reach. The United States is moving towards targeted ownership bans enforced through licensing, and voluntary guidance for everything else. An operator serving both markets will need two compliance programmes built on different assumptions, and nothing in either bill does anything to bridge them.

What I would watch

Four things will show how much these bills matter in practice.

The first is whether the House takes up S. 1962 before the end of the Congress. It has passed the idea once already. If the session runs out, both bills die and the process starts again in January.

The second is the FCC’s implementing rules. The statute bans grants to Covered List entities and their 10 per cent affiliates, but it does not say what an applicant has to certify, how far up an ownership chain the FCC will look, or whether gateway leasing arrangements count as control. Those answers will come in the rulemaking, and they will decide whether this is a box-ticking exercise or a real diligence burden.

The third is how the Secure Space Act and the FCC’s foreign adversary attestations are fitted together. Two overlapping ownership tests, one statutory and one regulatory, will produce inconsistent answers at the edges. Someone will have to decide which one governs a borderline case.

The fourth is what Commerce actually puts in the clearinghouse. If the consolidated recommendations are specific, they will quickly become the reference point for insurers and government buyers. If they are a list of links to existing frameworks, the bill will have done very little.

Neither bill will change what a satellite looks like in orbit. What they change is the question a licence application has to answer. For most of the history of US satellite regulation, that question was about spectrum and interference. It is now, increasingly, about who owns the company and who can reach its ground stations.

Anuj KumarEditor-in-Chief

Anuj Kumar is the founder of Legal Desire Media and publishes Fashion Law Journal and Space Law Journal.

Space Law Journal is a joint initiative of Legal Desire Media and Odyogeek. Spotted something we got wrong, or want to respond? Write to space@legaldesire.com.