Trust but Verify: Autonomous Spacecraft and the Verification Challenge

Enabling Orbital Verification: Innovations in Spacecraft Autonomy

On November 25, 2024, China announced the launch of what it described as the world’s first operational “self-driving” Earth-observation satellites, equipped with autonomous navigation capabilities. These Siwei satellites are designed to independently maintain and adjust their orbital configurations without routine ground control intervention. Following China’s announcement, developments in Europe during 2025 further illustrated the broader trend toward increasing spacecraft autonomy. For example, researchers at Julius-Maximilians-Universität Würzburg demonstrated an AI-based satellite attitude capable of autonomously executing spacecraft orientation maneuvers in orbit, representing an important step toward adaptive and intelligent spacecraft control systems.¹ A satellite with the capability to reposition itself when there is an opportunity to capture a better measurement offers the potential for in-orbit monitoring of objects and maneuvers.

An autonomous satellite with advanced maneuverability capabilities can improve operational resilience against cyberattacks targeting the ground segment by maintaining mission operations with reduced dependence on ground-based control.² Furthermore, on-board autonomy can extend a satellite’s operational lifetime by enabling real-time orbital maneuvers to avoid space debris and other satellites conducting potentially hazardous or aggressive maneuvers. This autonomy represents a crucial step toward distributed satellite constellation architectures that underpin resilient space defense postures and, by extension, det-by-den.³

Advances in autonomous satellite navigation and rpo, combined with sensors tailored to internationally recognized verification missions, could enable spacecraft to conduct in-orbit verification activities, opening up verification approaches that were previously considered beyond practical technical reach. The UN First Committee could task an open-ended working group, in consultation with technical verification bodies such as the IAEA, with developing proposals for a fleet of internationally sanctioned inspector satellites.

Recent U.S. research⁴ has proposed using detectors to exploit naturally occurring cosmic-ray protons to infer the presence of fissile material aboard satellites, with possible applications in the development of future nuclear warhead verification concepts. Although this work demonstrates the feasibility of the underlying concept through modeling, it remains exploratory and does not yet constitute a mature nor internationally accepted verification capability. The political feasibility of orbital verification processes within the international community remains fiercely contested, with no agreed norms governing their conduct, scope, or legal status. In the present context, the capabilities afforded by current technology outpace international governance and cooperation in this area.

Existing On-Orbit Inspection Capabilities

AeroAstro Inc. Escort satellite project⁵ proposed a small satellite inspector concept in which an inspector satellite would trail a primary satellite stationed in geostationary equatorial orbit (GEO) to analyze its performance. The inspector satellite’s orbit would be optimized to slow its approach, thereby enabling safe RPO by reducing the risk of collision. The inspector could then perform a departure and move into a hibernation upon completion of an inspection flyby. Several projects have operationalized the mechanism of an Escort-type inspector satellite, demonstrating autonomous RPO and in-orbit satellite servicing. Notably, Northrop Grumman’s MEV missions performed life-extension and proximity operations in GEO, Starfish Space’s Remora mission demonstrated autonomous RPO in low-Earth orbit (LEO), and Astroscale’s ELSA-d mission validated safe close-proximity approaches and docking maneuvers. Europe’s e.Inspector project, a space debris inspection technology, is under development with a demonstration mission scheduled for 2027.

Orbital Behavior as an Object of ­Verification

The hovering/trailing companion satellite concept has also been generalized to other proximity operations, commonly referred to as “guardian” satellites. While both inspector and guardian satellites rely on controlled proximity operations, their design philosophies diverge fundamentally. Inspector satellites prioritize carefully shaped approach trajectories and strict collision avoidance to enable nonintrusive inspection. In contrast, guardian satellites may adopt persistent close-range positioning, where the capacity for rapid interception, or even collision, is not merely a risk but an intentional feature leveraged as a form of deterrence.⁶ Evidently, the RPO associated with guardian satellites is more applicable to defense strategies than to orbital verification.

Differentiating between peaceful and harmful RPO intent requires discerning orbital mechanics, particularly to identify anomalous behavior. Newman and Tate⁷ remark that RPO with nefarious intent might exhibit a higher relative velocity, which is uncharacteristic of routine operations in that orbit. Kelecy et al.⁸ employ machine learning techniques to infer the intent of RPO behavior from observed relative motion. Their work advances an innovative approach based on real-time imagery without requiring detailed tracking analytics. This approach could enable the verification of orbital behavior whilst maintaining the necessary information barriers, an important principle of effective verification practice. Space-faring states should establish agreed limits on verification sensors and inspection activities (information barriers) to ensure that orbital verification can be conducted without enabling intrusive surveillance.

Dual-Use Orbital Behavior and the ­Feasibility of Verification

Autonomous RPO operations could compress what would previously have required multiple levels of authorization⁹ into a single automated decision-making process, thereby complicating the attribution of culpability and liability. This challenges the concept of liability under the Outer Space Treaty. The accompanying uncertainty heightens the risk that routine or ambiguous maneuvers could be interpreted as hostile. Some analysts argue that the central concern is the potential for aggression¹⁰ rather than the mere existence of the capability, suggesting that risk mitigation should focus on observable behavior, such as trajectories and operational patterns. Verification-related maneuvers, trajectories, and approach velocities should be transparent and observable to minimize ambiguity and reduce perceptions of threat.

Autonomous RPO could enable an aggressor to preposition a spacecraft in a seemingly benign orbit for peaceful purposes, only to activate it later and maneuver into the orbital plane of a target. From there, it could follow an optimized trajectory to conduct a close-approach attack. A commonly cited example of such co-orbital behavior is the Russian spacecraft Kosmos 2499, which was initially cataloged as space debris before later demonstrating active maneuvering capabilities. Based on repeated close approaches and orbital matching with its associated Briz-KM upper stage, several secondary studies (orbital tracking analyses) have interpreted the mission as demonstrating capabilities consistent with a potential co-orbital anti-satellite system. Although no official designation confirms a weapons-related purpose, the case highlights the ambiguity that arises from the dual-use nature of RPO. Autonomy may then amplify the strategic instability inherent in such scenarios by enabling spacecraft to transition rapidly between maneuvering states.

Constraints on Verification Imposed by Orbital Regimes

These risks are not uniform across orbital regimes. Attacks involving RPO may be more plausible in GEO than in LEO, as high-value, dual-use assets in GEO occupy predictable orbital slots,¹¹ making them more susceptible to targeting. These satellites often support strategic communications and early-warning functions, meaning that interference (electronic, cyber, radiofrequency) could be interpreted as a precursor to a disarming strike, carrying significant escalatory risks. In this context, the distinction between conventional and nuclear signaling becomes increasingly blurred. More specifically, Egeli¹² argues that U.S. doctrine already implies the possibility of nuclear retaliation in response to nonnuclear attacks on nc3 systems.¹³ Although often described as a U.S. “threat,” this is better understood as an inferred signal derived from broader doctrinal ambiguity. This concentration of strategic value and escalation sensitivity in GEO stands in contrast to the more distributed and resilient architecture of LEO systems.

This does not, however, preclude the use of RPO in LEO altogether. Autonomous systems may still enable selective targeting, intelligence collection, or coercive signaling. However, these applications are more consistent with limited or ambiguous interference than with the high-impact, prepositioned attack scenarios that are more feasible in GEO. As a result, while autonomy increases the operational flexibility of RPO across orbital regimes, its most destabilizing applications are likely to manifest in GEO rather than LEO, with important implications for the feasibility of orbital verification.