Between 14 and 24 October 2026, Ukrainian forces lost part of the satellite connectivity on which their drone operations depend, in the middle of military operations against Russia. The speed restrictions, reported mainly on Starshield, the government service SpaceX runs on its Starlink constellation, came apparently without warning.

Who decided soon became a dispute in its own right. Elon Musk, founder and CEO of SpaceX, first said that limits on Starshield were decided by the US military and ultimately the President of the United States. He later claimed that SpaceX had restricted Starlink because Ukraine had violated its terms of service. The White House denies any involvement, and US lawmakers have called for an investigation.

The episode shows how heavily a State at war can depend on a single private company. It also raises a question for any company operating in, or entering, the defence market: when a private provider restricts a service critical to military operations, who bears legal responsibility; the company, the State, or both?

What happened

For context, since the beginning of the war in February 2022, Starlink has rapidly become the backbone of Ukraine’s military communications. In February 2026, SpaceX introduced an allow-list system for terminals operating in Ukraine: stationary terminals continued to receive the commercial Starlink service, while terminals used for drone operations were registered for Starshield. The service is funded by various customers, including the Pentagon, the governments of Poland and France, and non-governmental entities.

On 14 October 2026, Ukrainian officials reported that speed restrictions had been imposed on Starshield without prior warning. Terminals lost connectivity when travelling at speeds exceeding approximately 160 km/h, disrupting drone operations and efforts to intercept Russian jet-powered drones.

In the days that followed, a dispute emerged between Elon Musk and the US administration over who had ordered the restrictions. Full speeds were restored only on 24 October, according to Ukraine’s Ministry of Defence. As of early November, responsibility for imposing the restrictions remains disputed.

What the law says about the dispute

On the one hand, the operator initially said the decision belonged to the US government. On the other, the US government denies any involvement, and the operator now says it made the decision itself. The answer matters because each account leads to a different legal regime.

If the US government made the decision, the restriction constitutes State conduct. The United States is responsible for it as its own act, with the legal and diplomatic consequences that follow.

If SpaceX made the decision, the position is different. International law binds States, not companies. Under Article VI of the Outer Space Treaty, the United States must authorise and supervise the space activities of its companies. But supervising a company does not make its decisions acts of the United States: under Article 8 of the Articles on State Responsibility, that would require the State to instruct, direct or control the specific conduct.

So, what does the company risk? It depends first on the commitments it has accepted. A contract with a government customer may guarantee continuity or priority of service, and a restriction in breach of such a commitment may engage the company’s contractual liability. A licence may also impose conditions, breach of which could expose the company to regulatory action.

Where no such clause exists, no rule of international law prevents the company from deciding unilaterally. The decision is not, however, free of consequences. Commercially, customers may turn to other providers. Legally, the licensing State may impose new conditions, and the company may face investigations. Reputationally, a company seen as influencing the course of a war risks damaging its brand. And because such decisions bear on the humanitarian consequences of hostilities, from civilian harm to the destruction of infrastructure, they are likely to attract scrutiny well beyond the company’s own contractual relationships.

Five legal risks for satellite providers 

For companies supplying services that States use in conflict, the exposure is concrete and arises on five fronts.

  1. Contracts and terms of service

In the Ukrainian case, Musk justified the restriction by reference to Starlink’s terms of service, which he claimed Ukraine had violated. The question is whether those terms were the only contractual arrangements that applied. The service used in Ukraine is financed by several governments, including the Pentagon and the governments of Poland and France. Government customers can negotiate their own terms: the Pentagon’s 2024 Commercial Space Integration Strategy states that, where necessary, its contracts may give priority to its requirements over those of other customers.

Two lessons follow. A provider that restricts a service in breach of negotiated contractual terms risks a claim for breach of contract. A customer relying solely on standard terms of service, by contrast, may find its service restricted at any time.

2. Licences

The licensing State can also attach conditions to the operator’s activities, and those conditions are not necessarily permanent. In 2023, the US regulator lifted temporary conditions attached to commercial remote-sensing licences in a single decision. Companies should therefore anticipate that their licensing State may introduce, amend or remove conditions when a conflict engages its interests.

3. Sanctions and export controls

Services reaching a party to a conflict, even through an intermediary, can trigger sanctions exposure. In January 2023, the US Treasury sanctioned Chinese satellite company Spacety and its Luxembourg subsidiary. It alleged that Spacety had supplied Terra Tech, a Russian company, with radar satellite imagery of locations in Ukraine in support of Wagner Group combat operations. The EU’s largest-ever package of listings, adopted on 12 October 2026, further illustrates the trend: restrictive measures increasingly extend deep into the supply chains supporting military capabilities.

4. Targeting

Satellites and ground infrastructure used for military operations may themselves become lawful military objectives. Under Article 52(2) of Additional Protocol I to the Geneva Conventions, an object that makes an “effective contribution to military action” and whose destruction offers a definite military advantage may qualify as a military objective, irrespective of who owns or registers it. Russia warned as early as September 2022 that such “quasi-civilian infrastructure” could become a legitimate target. For the company, the risk is the loss of its assets and, consequently, the services its customers pay for.

5. Investigations and disclosure

As recent events have demonstrated, a decision of this kind can expose a company to public investigations, consuming time and resources and potentially damaging its reputation, whatever their outcome. Members of Congress have called for an inquiry into who authorised the restrictions, while a letter sent to Musk reminded the company of its disclosure obligations to shareholders.

Conclusion 

In a market where private decisions can influence the course of a war, companies must also consider their own legal protection when making those decisions. If their services are used in a conflict, the first step is to identify their relationship with a State: where the service is licensed and registered, and what obligations arise as a result. The next is to review their contractual arrangements, defining permitted uses, continuity of service and notice requirements before any restriction is imposed. They must also anticipate the conditions their licensing State may impose, keep their sanctions screening of customers and intermediaries up to date, and maintain a clear record of who takes each operational decision.

Ukraine spent ten days trying to establish who had cut a service on which its defence depended. For a State at war, that uncertainty can be lethal. For a company whose business depends on decisions it cannot trace, it is a risk no one should accept.

At RPA, we follow these risks as they emerge across today’s conflicts, and advise clients operating in sensitive sectors on how to anticipate and manage them.