All techniques
REC-0007
ST0001Reconnaissance

Monitor for Safe-Mode Indicators

Description

Adversaries watch for telltale signs that the spacecraft has entered a safed or survival configuration, typically sun-pointing or torque-limited attitude, reduced payload activity, conservative power/thermal setpoints, and low-rate engineering downlink. Indicators include specific mode bits or beacon fields, changes in modulation/coding and cadence, distinctive event packets (e.g., wheel unload aborts, brownout recovery), elevated heater duty, altered load-shed states, and operator behaviors such as emergency DSN requests, longer ground passes, or public anomaly notices. This reconnaissance helps time later actions to coincide with periods of reduced bandwidth, altered monitoring, or maintenance command availability. It may also reveal how safing affects authentication (e.g., whether rapid-response paths or recovery consoles differ from nominal).

Mappings

EU regulation articles

  • eu-space-actArt. 85(1)
    addresses
    low
    direct

    Safe-mode indicators leak through RF emissions; 85(1)'s cryptographic concept can extend to telemetry encryption that obscures mode-bit information from passive observers.

ENISA controls

  • Cybersecurity-safe mode design governs which indicators are exposed during safing; a well-designed safe mode minimises the leak of attacker-useful indicators.

  • Traffic flow security on health/state-of-health beacons reduces the value of safe-mode-indicator monitoring by obscuring beacon cadence and metadata.

Cross-reference controls

SPARTA countermeasures

Cite as SafeMode Space, REC-0007 (SPARTA v3.2).

Built 2026-07-25 from 216 techniques, 334 regulation articles, 125 ENISA controls, 2,610 framework controls, and 90 countermeasures.