Exclusive: NRO Erects Buy American Barriers Against Allied Satellite Data

WASHINGTON: A new National Reconnaissance Office (NRO) policy limits its pool of potential commercial remote sensing vendors to US firms — eschewing even companies based in allied nations with US operations legally approved to sell weapons to DoD.

“The National Reconnaissance Office (NRO) has made the determination that the solicitation for procurement of commercial imagery for operational support shall be limited to US-owned, US-operated and US-controlled companies,” states a March 18 letter signed by Benjamin Fallon, head of congressional and public affairs. The letter, obtained by Breaking Defense, was addressed to the leaders of the Senate Select Committee on Intelligence (SSCI), Chairman Mark Warner, D-Va., and Ranking Member Marco Rubio, R-Fla.

The decision has raised eyebrows and generated some push back from elsewhere in the national security community, numerous government and independent sources say — including from within the Pentagon and the National Geospatial-Intelligence Agency (NGA), which uses commercial imagery along with that generated by spy satellites and other sources to craft GEOINT analyses for military commanders.

If nothing else, critics say, the NRO policy is at odds with attempts by NGA and DoD to better integrate the allied industrial base into that of the US in order to create stronger and more diverse trusted supply chains. For example, the Space Force’s SpaceWERX innovation hub last November co-sponsored with the UK government an International Pitch Day for US and UK space industry startups. And NGA’s policy on commercial imagery states: “We will rely on foreign partner assessments of commercial capabilities to speed mission application; and the NSG will integrate allied capabilities to fill intelligence gaps and provide early warning advantage.”

NRO has argued that its decision is based on language inserted by Sen. Ted Cruz in the 2021 National Defense Authorization Act (NDAA) aimed at maximizing NRO use of commercial remote sensing, and NGA procurement of commercial GEOINT services. (In 2017, authority to procure commercial satellite imagery for military and intelligence purposes shifted from NGA to NRO; NGA retains the responsibility for acquiring commercial GEOINT analyses and related software capabilities.)

Section 1612, “Leveraging Commercial Satellite Remote Sensing,” states that DoD, in consultation with NRO and NGA, “shall leverage, to the maximum extent practicable, the capabilities of United States industry, including through the use of commercial geospatial-intelligence services and acquisition of commercial satellite imagery.”

But, according to one intel expert who follows the issue closely, some Hill staffers were baffled by the rigid interpretation of the provision by NRO — summoning agency officials up to the Hill in to explain themselves in a closed-door meeting.

Neither Warner’s nor Rubio’s office responded to requests for comment; nor did spokespersons for the SSCI or the House Permanent Select Committee on Intelligence. Likewise, Cruz’s office and spokespersons for the House or Senate Armed Services Committees did not return requests for comments.

“NRO did indeed go further than the Congress in saying they would only buy American, and clearly it is not what the subject clause from the NDAA says,” former DoD head of space policy, Doug Loverro, believes.

“This is a difficult legal proposition for the NRO,” he added. “They absolutely have the right under the FAR [Federal Acquisition Regulation] to issue contracts on other than full and open conditions (FAR 6.302.6) due to national security concerns, but a properly mitigated company with full FOCI protection and internal controls that would eliminate any leakage of classified information to the foreign entity should (in theory) have a legal right to compete.”

Trusted Or Not?

FOCI (Foreign Ownership, Control and Influence) Mitigation Agreements are signed off on by the Defense Counterintelligence and Security Agency (DCSA). The process for receiving approval is complicated and time-consuming, as you’d expect. Still, numerous foreign-owned firms from allied countries do billions of dollars of business with DoD after being approved by DCSA.

Loverro explained that while the FAR “provides pretty wide latitude,” it could be “difficult for the NRO to maintain a position where it says firm XYZ, which might be a US firm, has 35% foreign shareholder/investor ownership, should be eligible for a contract; but not firm ABC which is a full FOCI mitigated US entity.”

The intel expert believes the NRO essentially has “now said DCSA doesn’t count; that going through the entire mitigation of foreign influence, FOCI mitigation, is not sufficient for the NRO. How do they make a new rule for the DoD and the IC? The NRO has no authority to do that,” the expert said.

In an extraordinary joint statement in response to Breaking Defense questions, the NRO and NGA said:

NGA and NRO work closely together to discover, assess, and acquire commercial solutions to support national security requirements. The uses of commercial GEOINT vary across the U.S. government and each agency assesses those solutions to meet different mission needs.

The NRO is responsible for acquiring commercial imagery on behalf of the Intelligence Community. … NRO commercial acquisitions, including the recently proposed EOCL acquisition strategy, are consistent with U.S. policy, the recent U.S. National Space Policy, and the 2021 National Defense Authorization Act that direct the use of U.S. domestic commercial imagery where those sources can satisfy requirements. …The NRO uses the DoD Foreign Operated, Controlled or Influenced (FOCI) process for other procurements where applicable.

NGA purchases GEOINT data, products, and services from both U.S. and foreign companies which meet requirements for mission utility and trustworthiness, to best meet geospatial intelligence mission needs while weighing the security risks of any foreign influence. NGA uses the DoD Foreign Operated, Controlled or Influenced mitigation process. The security risks associated with purchasing foreign capabilities can be mitigated by applying Supply Chain Risk Management and data integrity practices, as well as considering Foreign Operated, Controlled or Influenced factors and applying special security agreements, as needed.

Deep Fakes & Peeping Toms

Meanwhile, NRO has been exploring how to better integrate imagery from American-based commercial firms to a greater extent than it did in the past — in essence abandoning the Intelligence Community’s long-standing monogamous relationship with Maxar Technologies (formerly Digital Globe).

NRO’s Commercial Systems Program Office (CSPO) has signed a series of study contracts with electro-optical imagery providers BlackSky Global, HySpecIQ, and Planet (as well as to Maxar) to review their capabilities against the agency’s future requirements.

For example, on July 15, San Francisco-based Planet announced that NRO has “extended its contract with Planet Federal to provide continued access to Planet’s Dove and SkySat imagery to the US Defense and Intelligence Communities. The contract now also includes early exploration of Planet’s SkySat video capabilities for limited use cases.” (Planet Federal is the firm’s subsidiary handling classified government work.)

NRO had originally planned to issue a formal a request for proposals (RFP) to industry late last year focused on electro-optical imagery, looking to issue contracts through 2025. That RFP now is expected to come out in late summer or early fall, with contracts issued by the end of the year, according to a report by Space News.

The NRO statement explained that a draft RFP was issued in June for the “proposed Electro Optical Commercial Layer (EOCL) acquisition strategy,” and is “subject to change as a result of input received from interested parties.” (Which, at least on the face of it, seems to indicate that the agency may be willing to negotiate on the Buy American policy.)

NRO has similar contracts with Capella Space, which operates synthetic aperture radar (SAR) satellites, and HawkEye 360, which operates satellites that conduct remote sensing of radio frequency (RF) transmissions. An RFP focused on SAR data is expected soon, according to industry reps.

Nonetheless, another intelligence specialist explained, the NRO is nervous about the possibility that using commercial imagery would open the US spy agency up to spoofing or spying by adversaries.

One issue is the potential for an adversary to manipulate the imagery and data to create “deep fakes,” which use a form of artificial intelligence called deep learning to make false videos, photos, or audio tracks, the expert said. Such deep fakes are rampant on online social media, often created by hackers with ties to the Russian and Chinese governments.

Another potential issue with commercial imagery is that adversaries could infiltrate a company’s network and simply “watch” what images NRO uses, via a form of “peeping Tom” software, the source added.

“The fear of intercepted tasking providing ‘indications and warning’ to others/adversaries and perhaps using that knowledge as part of a deception strategy is definitely a concern,” agreed one former US intelligence official.

However, other experts say, there is a large question surrounding whether that risk would be any more substantial for foreign-owned firms than for US-owned firms, especially if the non-US firm has gone through the FOCI process.

Fox Overseeing The Henhouse?

Sources say that another factor that may have played into the decision is that NRO doesn’t like the competition, and instead plans to produce more imagery internally, via its own satellites. 

It is important to remember that NRO develops, acquires and operates its own technologically exquisite and extremely expensive imagery, signals and measurement intelligence gathering satellites, and provides the information gathered not just to military commanders and NGA, but also to the National Security Agency, the Defense Intelligence Agency, the CIA, and others.

Indeed, some supporters of the new NRO policy say that analysts are swamped with with too much imagery already — so it isn’t worth opening up new risks for the limited benefit it would have for users.

Many in industry, however, have long suspected that the NRO might not be inclined to support commercial companies that are effectively in competition with it, and whose success might undercut its internal budget and resource pool. This fear is not without some historical precedence to back it up.

But the fact that NRO is planning to increase its own capabilities shouldn’t really have any affect on buying US versus non-US commercial data, the former official said.

Unless, of course, one believes that non-US firms actually have better capabilities, the intelligence expert mused. In some arenas, the source explained, such as SAR, that isn’t necessarily a far-fetched notion, given that — because of previous NRO policies — US commercial firms are relatively new to the marketplace, whereas a number of European firms, such as Airbus and ICEYE have been up and running for years. Indeed, ICEYE has been looking into whether it would be able to compete for the upcoming NRO contract.

Todd Master, a former DARPA official and now Umbra’s chief operating officer, begs to differ.

“Mitigating foreign influence is one thing, but every dollar spent on SAR built by a foreign-owned company with US subsidiary supports the further development of dual use technologies that are outside of US regulatory control,” he said in an email. “If there were no credible US sources, or if the US sources were prohibitively expensive, I would support those arguments. But there ARE credible US sources (including our competitors) that are equally or more capable than foreign ones.”