Orbits and Obligations: Jurisdictional Limits and Reform Pathways in India's Satellite Cybersecurity Framework

In February 2022, a cyberattack on Viasat's KA-SAT network disabled tens of thousands of satellite modems across Europe within hours – a preview of the vulnerabilities now surfacing in India's own satellite market. As foreign constellations from Starlink to OneWeb begin serving Indian users, and government connectivity programmes route traffic through leased foreign capacity, India's 2026 CERT-In SatCom Guidelines mark its first serious attempt at satellite-specific cybersecurity regulation. This paper examines whether that framework can actually reach the operators carrying the most sensitive traffic. It traces the jurisdictional architecture governing satellite regulation, the Outer Space Treaty's registration-based authority over spacecraft, and the territorial predicate underlying India's IT Act, and asks what happens when the two frameworks are mapped onto the same commercial reality. The paper finds that compliance obligations fall disproportionately on Indian-domiciled entities, while foreign operators managing the infrastructure at greatest risk remain largely outside enforcement reach. Drawing on comparative regulatory practice, including the FCC's licensing conditions and the EU's NIS2 Directive and proposed Space Act, the paper considers several possible paths forward such as market-access conditionality, bilateral cooperation, and multilateral coordination through the ITU and evaluates the tradeoffs, timelines, and constitutional constraints attached to each.