Alice Gruth (6:54)

Thanks, Maria. I'll be joining you again after your chat with Brandon to update you on the results from the last week's irec. But before then, the stories that we've included in today's Selected Reading section cover Starlink's Access, which is now available in Iran, Black Sky's plan to expand its Constellation, and AST Space Mobile's access to mid band Spectrum, which has been a point of contention for a while.

Maria Varmazas (7:15)

A lot of moving pieces in those stories, so please remind us where we can find those.

Alice Gruth (7:19)

We include links to all the original sources of all the stories we mentioned throughout the show in the Selected Reading section of our show notes. Those links can also be found on our website space.n2k.com and I'll be seeing.

Maria Varmazas (7:30)

You again shortly at Minus Crew. If you'd like daily updates from us directly in your LinkedIn feed, be sure to follow the official N2K T minus page over on LinkedIn. And if you're more interested in the lighter side of what we do here, we are T minus daily on Instagram and that is where we post videos and pictures from events, excursions and even some behind the scenes treats. Links are in the show Notes. Hope you'll join us there. The Hoover Dam wasn't built in a.

Dave (8:13)

Day and the GMC Sierra lineup wasn't built overnight. Like every American achievement, building the Sierra.

Maria Varmazas (8:20)

1500 heavy duty and EV was the result of dedication. A dedication to mastering the art of engineering. That's what this country has done for 250 years and what GMC has done for over 100. We are professional grade. Visit GMC.com to learn more. Assembled in Flint, Hamtranc, Michigan, in Fort Wayne, Indiana of US and globally sourced parts. And today we have our monthly segment with Brandon Karpf about vulnerabilities in space. I wanted to get your thoughts on agentic AI and you had a whole bunch of thoughts. So tell me a bit about your thinking about what we're doing here because this is sort of metagaming, but I want to hear it.

Brandon Karp (9:05)

Yeah, and I think this is valuable to the audience because I'm showing up in their feeds about once a month and ostensibly to talk about the intersection of cybersecurity and space and a Pattern has emerged where we tend to have a conversation around. Here's an opportunity. The first conversation we had was on accelerating the pathways for delivering software to the DoD and to space Force. Right, that was the first conversation. That's an opportunity. Our most recent conversation last month was around implementing DevSecOps and integrating GRC with DevSecOps, especially for the space industry and how challenging that could be, but also what that opens up. And it was a very practical recommendation for space technology companies to think about how they implement that. And so I think bouncing between here's an interesting challenge, industry challenge, or industry opportunity, and then here's a practical, practical thing that you can do at your organization. And we'll keep bouncing between those two types of topics every single month.

Maria Varmazas (10:05)

So today is going to be a setting the scene, describing the situation and getting some of your take, but we'll save the solutions for next time. All right, so the agentic AI was sort of the lead into this because I had been noticing at all of the conferences I've been to that that is the phrase everybody's using. But of course it can mean a lot of different things. And also how you implement it within the space realm can be very different depending on what trying to do. And you had some specific thoughts about agentic AI and network architecture as it relates to space? Walk me through this.

Brandon Karp (10:39)

Sure. So obviously agentic and anything AI is way overhyped. And in general, I think that the large companies themselves are overhyped, but the actual implementations and uses of the technology I actually think is underhyped. The other thing that is underhyped right now is the security implications of actually applying agentic technologies and of agentic technologies are really just allowing a computer and a model to run workloads and do things autonomously by themselves for you for a specific purpose. It's the dream. It's the dream, right? We all just sit back, do nothing, and AI makes all the money that we need. And although we're probably pretty far away from that future, we're not far away from a future where organizations and individuals start chaining these systems together to talk to each other at machine speeds. And I think the industry has talked a lot about the security implications of AI in general. They have not talked about the higher level security implications of what happens when we start chaining these tools together and chaining these models together in an agentic system and opening up APIs and other standards of communication between AI to AI systems. And that opens up a whole new can of worms that I don't think anyone in this world is prepared for.

Maria Varmazas (12:01)

Right. Because usually when that conversation starts going places, people start going, okay, well, we're doomed.

Brandon Karp (12:09)

Or they go, yeah, well, we just put our normal security framework on and data loss prevention and everything's fine. And encryption and firewalls and just like what we've been doing for the last 30 years. Because that's been going so well.

Maria Varmazas (12:21)

Super great. It's been going super well. Yeah. There's definitely not an industry about how well it's going to. So where is that middle path?

Brandon Karp (12:29)

Yeah, well, and I think to get to that middle path, we actually need to talk about what the risk is. And then I will relate it to the space industry, I promise. This is related to the space industry.

Maria Varmazas (12:38)

We'll get there, we'll get there, friends.

Brandon Karp (12:39)

We will get there. So bear with me. But the threat here isn't actually the content of those communications. Right. Typically when we talk about data security and information security, we're talking about the actual content. Your Social Security number, your bank transaction data, your private personal data, your interactions with family and friends and messages. Actually, the real risk here is the metadata of those communications. And I'll explain why. So as Agentic AI and as these models are starting to accelerate, we're starting to standardize how they talk to each other. So Anthropic released a standard in the fall called MCP Model Context Protocol that is essentially a dynamic wrapper around the API interfaces of models and other systems that models would want to interact with that creates a standard of communication, essentially a protocol that allows those models and other models to talk to each other. It's a middleman, right? It's a middleman handling. Right, exactly. It's the Tower of Babel handing messages back and forth. But what that's done is it's created a standard that a lot of folks, I mean, we're talking about most of the large organizations in the world who have their own models and their own systems that want to chain to create agentic workflows. It's now a standard of how they talk to each other. And how they talk to each other is releasing a tremendous amount of information in the form of metadata, and it's not actually the details of the communication. And so it's now totally reasonable to say that an adversary who's looking at network traffic and looking at data flow from an organization out into the dirty Internet could see the specific traffic going from your model, your agentic model, to all of the other agentic models and micro models and systems and microservices that that model is reaching out to at machine speed. And when we talk about machine speed, we're talking about extraordinary amounts of data every second. Going from your organization's model or agentic system to thousands of other systems and services on the dirty Internet and opening up what databases are being accessed, what services are being accessed, when the timing, the frequency of those things, potentially even who as an organization or an individual is using those systems. And when you start thinking about all of that metadata, it creates a very clear picture. And the clear picture it's creating is what you are doing, what your strategy is, what your agentic system is trying to achieve on your behalf, what your intent is. So the adversaries no longer need to decrypt your data to figure out what you're doing and why you're doing it. They just need to capture the traffic, which is actually a pretty trivial activity. And so that opens up a whole new set of vulnerabilities that the world is not prepared for as we implement the model context protocol and implement agentic workflows within our organizations, that even if you secure all the data, the content is secure, but the context of your communication, the metadata is not secure, and the metadata becomes the message.

Maria Varmazas (15:49)

That's interesting. So content versus contacts is a great framework. The devil's advocate would say, and I don't know if I believe this, but I'm thinking it is. Okay, but how much can you really glean from context?

Brandon Karp (16:01)

It really, really, really is enough, and it's even enough today in a lot of use cases prior to the implementation of AI systems. I'll give you a couple anecdotes. There's a research group out of UC San Diego called the CADA Caida Research Group. They do a lot of Internet measurement activities, which essentially is the academia word for signals intelligence. And a couple years ago they published a paper where they were just by doing network analysis, just by looking at metadata of publicly available Internet traffic, they were able to identify the physical locations of, of Comcast's most critical network exchange points and fiber points around the United States. And from that you can actually determine the couple nodes that you need to knock offline with. Like a car accident running into a telephone pole that would drop Comcast off of the Internet entirely that was using just metadata. Wow. Another great example is this fall, Ben Gurion University released a proof of concept hack where they did a side channel attack, just measuring packets going from an individual user on ChatGPT and ChatGPT's servers. And just by collecting that data the packets themselves were encrypted, but just because how they knew how ChatGPT tokenizes data. And again, model Context protocol provides a standard for how data is transmitted between AI models. So very similar. But just knowing how OpenAI tokenizes data, Ben Gurion University was able at a greater than 50% accuracy, determine the topic of the communications between a person and ChatGPT, and at a greater than 20% accuracy, get perfect word replication of the prompts and the responses from OpenAI.

Maria Varmazas (17:49)

Oh, dang.

Brandon Karp (17:50)

The issue is there and you can get a lot of information about metadata. So now let's think about 10 years in the future. You've got a company that is thinking about doing M and A in your space and it's identifying M and A targets, it's finding the exact organization that you're trying to acquire and why, it's developing the strategy, it's sending data to a pricing model, a very specific kind of micro model. Think about microservices, but a micro model, that micro model's only job is to develop a pricing model to acquire this one opportunity. There's another market analysis model that's doing your go to market once you acquire. There's another model that is out there whose whole purpose is how you integrate a company into your organization. Your agent is doing all of this analysis in real time, figuring out the ip, trade secret issues, et cetera. An individual who's looking at your agent doing all of those transactions could actually figure out ahead of time what your strategy is, who your acquisition target is, what your proprietary technology is, what your go to market strategy will be. Right. Just based on the frequency of those things and can tell that you're about to make a move. And imagine if you're a public company that is now information that can move a stock price.

Maria Varmazas (19:02)

Okay, so this is. So, all right, I'm going to ask the obnoxious question.

Brandon Karp (19:06)

Yeah.

Maria Varmazas (19:07)

How does this relate to space?

Brandon Karp (19:08)

Yeah, yeah. So of course, and we'll tease this and we'll dive into this more. I think the only two viable markets in the space industry in terms of the space segment are telecommunications and Earth observation. That might change in the future, but to me, that's the only two viable markets today for the space segment. So set aside Earth observation verse for a moment. But talk about the telecommunications segment, right? And the fact that communication architectures have been up there for decades now and it's only increasing now. We're getting the direct to cell capabilities, ASD, Space Mobile and SpaceX. Everyone's kind of moving in this Direction of massively increasing the Internet backbone capability of the space segment and actually the efficiency of transmitting packets from ground to space and using the space segment as part of the Internet backbone and the Internet exchange points for the large scale autonomous systems. I think that the fact that there's such a barrier to entry to actually getting those essentially routers and servers and processes running on low earth orbit or medium earth orbit satellites, there's a huge barrier to entry that makes it much more difficult for an adversary to get a measurement capability in a space segment, but also how the space segment functions. From a telecommunications perspective, those are essentially relays. They're a little more sophisticated than a Internet based router in a large data center at an Internet exchange point where you've got fiber lines coming in. It's by adopting. We don't have time today to go into the details, but next time we talk, we should go into the details about how I think you can do this. But actually adopting a space segment component of your backbone of your wide area network. So instead of going directly from your network to the dirty Internet, you go from your network to a space segment and you essentially relay your communications into the space segment and then out into the dirty Internet provides a layer of obfuscation for your metadata, where it could potentially hide the true source and destination, the true frequency and velocity and activity of your data, and the real metadata of what's happening inside your wide area network for your organization. And so, by relaying and essentially proxying your data first through a space segment before going terrestrial into the Internet backbone, I think could actually provide one layer of protection against these types of network analysis attacks and reconnaissance attacks.

Maria Varmazas (21:45)

So we have to put a pin in that because we do have to conclude. But I'm just thinking, okay, how would that work and why? So the how and the why of that will definitely be next time. We'll be right back. Summer's here and Nordstrom has everything you need for your best dress season ever. From beach days and weddings to weekend getaways in your everyday wardrobe. Discover stylish options under $100 from tons of your favorite brands like Mango skims, Princess Polly and Madewell. It's easy too, with free shipping and free returns in store order pickup and more. Shop today in stores online@nordstrom.com or download the Nordstrom app. Welcome back. All right, so, Alice, welcome back. Okay, thank you. So, IREC 2025, how was it?

Alice Gruth (22:55)

Amazing. It's always amazing. I get blown away every year by the creativity of these students, Their engineering knowledge and Their ability to come up with new ideas, so problems that have been around for ages. So it was a very rewarding but very tiring and very hot week in the West Texas desert.

Maria Varmazas (23:12)

Oh, how hot? Okay, how hot was it? But seriously, how hot was it?

Alice Gruth (23:17)

You know, day one was pretty good. It was in the 90s, so it wasn't too hot. But by day two of launches, we were over a triple dig. And, you know, there's not much shade out there or coverage, so it does get very uncomfortable very quickly.

Maria Varmazas (23:30)

Oh, God. As soon as you said, it's not too bad in the 90s, I was instantly like, nope, I'm out. You are tougher than me, that is for sure. All right, so this is an event, I know, that is very near and dear to you. So if you had to pick your favorite moments, because there's a lot of good moments in there and a lot of good human drama and good engineering. But what were your faves?

Alice Gruth (23:52)

Yeah, you're right. It's near and dear to me. And I love every single launch. I get very excited. I probably saw at least 80 of them myself. I, you know, were left earlier in the afternoons most days just because I had to get out of the sun. But, yeah, I think to me, the highlight this year was probably seeing a lot of the payloads that were designed to go into the launches. There was a lot more thought put into it this year. I saw a lot of live feeds of cameras on board launches, which was. Just blew my mind. The University of Arizona was the first one that came to mind. I got to see their camera that launched from the ground up and back down again. Completely perfect signal the whole way. And it had graphics on screen and live telemetry. So the feed was just like watching a professional. That blew my mind, because you and I know how much has to go into all of that ahead of time.

Maria Varmazas (24:36)

My goodness. You know, they're gonna give SpaceX a run for their money with those great presentations. That's amazing. My goodness. Okay, that alone is just like, kudos. There's gotta be others. What else. What else caught your eye?

Alice Gruth (24:48)

There were others. The other payload that comes to mind, and I wish I could remember the university name. I will look it up and I'll bring it at some point. It was a university that had a biosciences major that designed the payload, and she got. How can we put this? She was a fertility major, and she decided to study what microgravity did to sperm. And so they got sea urchin sperm.

Maria Varmazas (25:12)

Oh, okay.

Alice Gruth (25:12)

Sea urchin Sperm, not human, and decided to do a controlled batch, which she kept with her on the ground, and then sent a batch up on the rocket launch to see how the microgravity affected the sperm count. Which just amazed me that they're thinking already as students, you know, what this opportunity can present to them outside of the realm of engineering. So that one, I think, really was a highlight.

Maria Varmazas (25:35)

That is really cool. That is just. Yeah, that they're exactly what you just said. That they're thinking beyond that. And this is not just like people who like rockets, which is great. There's nothing wrong with that. But we're opening it up to thinking about that. Oh, that's a great sign of where things are going too. So that just fills me with a lot of joy to hear that. That's awesome. So when. This morning when you and I were University of Houston.

Alice Gruth (25:58)

That's it. I remember that.

Maria Varmazas (25:59)

There you go. University of Houston. It's your shout out. Nicely done. So sometimes it's not always clear who the winner is. I mean, there's multiple winners of this event. Are they still working on figuring that out right now? Cause the event was last week. But I mean, how does this work?

Alice Gruth (26:15)

No. So they announced them on Saturday and I again missed the AW board ceremony, which always breaks my heart because I had another event I had to get back for. But I wrote them down. So 10k cots, which is commercial, off the shelf to 10,000ft. University of Virginia, which was team 184, won that 30k cots was team 208, Mississippi State University, 10k SRAD, which is student research and design, which means that they basically built their engines. Yeah. From scratch. So the 10k category was won by the Federal University of ABC in Brazil.

Maria Varmazas (26:46)

Wow.

Alice Gruth (26:47)

Yeah.

Maria Varmazas (26:47)

Amazing.

Alice Gruth (26:48)

Came over and built all that. 30k SRAD was Team 410 from West Virginia University. And then we go into the more complex categories because we have SRAD hybrid. So that means when they. They're using the liquid and solid hybrid engines. So the 10k SRAD Hybrid was won by Team 704, University of Sydney. The 30k SRAD was won by Team 800, which was rice University again in Houston.

Maria Varmazas (27:13)

Houston. There you go.

Alice Gruth (27:14)

Then they had the multi stage category. So they had two stage ROC rockets, which is amazing. They went to much higher altitudes. Yeah, me too. So the 30k category for multi stage was won by team 502, which is university of Laval, which is Canada. And then the 45,000ft category because they went above that, which is just, again, amazing.

Maria Varmazas (27:35)

Wow.

Alice Gruth (27:35)

Was won by Team602 from the University of Akron. So that's over here in the U.S.

Maria Varmazas (27:41)

There you go, Ohio. Nice.

Alice Gruth (27:42)

Of course, yes, Ohio. And then they have this new category which is the new big cup as it used to be. It's called the New Horizons Trophy. And so basically they pick the team that really stands out amongst all of those winning categories and that was won by Team 704, the University of Sydney. So it went to Australia, which is amazing to see an international team come and do so well.

Maria Varmazas (28:03)

That's so great. It is an international competition and as it should be. That's so. Man, that's so great. The future is bright for all those, all the students. That's just amazing. And yeah, well, so the sponsors like all the people on the ground, what was it like this year? Because it's in a new location, right?

Alice Gruth (28:20)

Yeah, it was different. We had to learn a lot on the fly. There were a couple of technical issues. We got hit by a haboob on day one, just before everything was starting. It's a dust storm everybody to deal with.

Maria Varmazas (28:29)

Dust storm, yeah, dust storm.

Alice Gruth (28:30)

But the sponsors were Great. We got SpaceX came this year for the first time in a long time. Blue Origin was there. Proto Space, who I know we've spoken to before, do a lot of components. There was a ton available to the students and I do think they really showed themselves to be ready to be able to enter the industry. I think it really gives them this great hands on experience. And if anybody is interested in getting involved in the IRAC for 2026, they've announced the dates. It's going to be June 14th, the 19th next year. Location is still, still TBD. This is the first year at Midland. I think they're going to go back and sort of review. I mean overall an incredible experience at that location. They just want to make sure that everybody's happy before they start saying yes, we're definitely coming back next year. So when we know exactly where they're going to be, we'll announce that. And I do encourage, you know, I met people there, that industry that work for Lockheed and Northrop Grummans and the Blue Origins and the Airbuses of the world. We encourage all these organizations to really start thinking now, get involved in it for next year because this is really your future workforce are going through this and you get to see them work through the whole spectrum of design, launch and recovery. And I do think seeing the ones that even don't go to plan and see how they deal with that I mean, I was with the University of Strathclyde, which is one of the two UK universities. They were going for a 30,000 foot launch and their motor blew up as it came off the rail. And their faces, they were devastated. But you know what? They recovered the vehicle and figured out that they could stick another motor in it and they were gonna go and see if they could launch it again. And to see the fact that they figured it out that quickly, this is what went wrong. This is how we can correct it. And, oh, look, we can actually possibly even try again. That, to me, is where you really see teamwork, which is key in space. And how these students figure the problems out as a team together is just amazing. Great recruitment opportunity for a lot of companies.

Maria Varmazas (30:19)

Absolutely. Oh, Alice, I can tell why this is every year when you go, you have the best stories from this amazing event. So I'm glad that you were there. It sounds like it was amazing as it always has been. So thank you for sharing. That's it for T minus for June 16, 2025, brought to you by N2K Cyberwire. For additional resources from today's report, check out our show notes@spare.n2k.com we would love to know what you think of this podcast. Your feedback ensures we deliver the insights that keep you a step ahead in the rapidly changing space industry. If you like the show, please share a rating and review in your podcast app. Please also fill out the survey in the show notes or send an email to space2k.com we're privileged that N2K CyberWire is part of the daily routine of the most influential leaders and operators in the public and private sector. From the Fortune 500 to many of the world's preeminent intelligence and law enforcement agencies, N2K makes it easy for companies to optimize your biggest investment, your people. We make you smarter about your teams while making your teams smarter. Learn how@n2k.com N2K Senior Producer is Alice Carruth. Our producer is Liz Stokes. We were mixed by Elliot Peltzman and Trey Hester with original music by Elliot Peltzman. Our executive producer is Jennifer Ivan. Peter Kilpe is our publisher and I'm your host, Maria Varmazes. Thanks for listening. We'll see you tomorrow.

Alice Gruth (32:03)

T.

Dave (32:17)

Hey everybody. Dave here. I've talked about Delete Me before and I'm still using it because it still works. It's been a few months now and I'm just as impressed today as I was when I signed up. Up Deleteme keeps finding and removing my personal information from data broker sites. And they keep me updated with detailed reports so I know exactly what's been taken down. I'm genuinely relieved. Knowing my privacy isn't something I have to worry about every day. The Delete Me team handles everything. It's the set it and forget it peace of mind. And it's not just for individuals. Deleteme also offers solutions for businesses, helping companies protect their employees personal information and reduce exposure to social engineering and phishing threats. And right now, our listeners get a special deal. 20% off your delete me plan. Just go to JoinDeleteMe.com N2K and use promo code N2K at checkout. That's JoinDeleteMe.com N2k code N2K.