Military Satellite Ground Stations Use 1990s-Era Software With Known Exploits

Ground control segments for several U.S. military satellite constellations still run on software architectures designed in the 1990s and early 2000s, including legacy operating systems and custom middleware with known cybersecurity vulnerabilities. The GPS Operational Control Segment (OCS) ran on systems that required security waivers because they could not meet current DoD cybersecurity standards. The replacement system, OCX, has been delayed by over a decade and has exceeded its original budget by more than $2 billion. This matters because the ground segment is the most attackable part of any space system. You don't need an ASAT missile to disable a satellite — you can hack its ground station. In 2023, during the early days of the Ukraine conflict, the Russian GRU-linked group Sandworm compromised Viasat's KA-SAT ground infrastructure, knocking out satellite internet for thousands of Ukrainian military and civilian users simultaneously. If a similar attack targeted U.S. military satellite ground stations, adversaries could inject false commands, corrupt ephemeris data, or simply take constellations offline. The operational pain is that satellite operators must maintain dual systems — keeping legacy ground stations running because the replacement isn't ready, while also patching and defending software that was never designed for an adversarial cyber environment. Operators at Schriever Space Force Base describe running satellite commands through interfaces that look like 1990s DOS terminals, with manual processes that take hours for tasks that modern systems could automate in seconds. Human error rates increase with antiquated interfaces, and one wrong command can send a billion-dollar satellite into an unrecoverable spin. This persists because satellite ground systems are procured as part of the satellite program itself, which means ground software requirements are locked in 10-15 years before the system reaches initial operating capability. By the time a ground segment is deployed, its software architecture is already a generation behind commercial state of the art. The OCX replacement for GPS ground control was contracted in 2010 and won't be fully operational until approximately 2026 — by which point its core architecture will already be 16 years old. The deeper structural issue is that the DoD treats ground segments as afterthoughts to the satellite hardware. Roughly 80% of a satellite program's budget goes to the space vehicle and launch; the ground segment gets what's left. This creates a perverse incentive where contractors gold-plate the satellite but deliver the minimum viable ground system, knowing that ground segment upgrades will be funded as separate, lower-priority programs years later.