Francesca Giannoni-Crystal

Attribution for cyberattacks is hard both factually and legally, but under the Articles on Responsibility of States for Internationally Wrongful Acts, the route the traffic takes is beside the point. A non-state group's conduct can be attributed to a state in several ways: if the group operates as part of the state apparatus, acts on the state's instructions or under its direction or control, or the state later acknowledges and adopts the conduct as its own.

Reporting said the group Handala, linked by cybersecurity researchers to Iran's intelligence apparatus, carried out or claimed attacks while using Starlink satellite internet and threatened retaliation after U.S. and Israeli military actions.

• Giannoni-Crystal writes that using Starlink connectivity is essentially irrelevant to legal attribution, then lists the routes under the articles by which Handala's conduct could be attributed to Iran.
• They leave one point open: whether running an operation through a U.S. commercial network increases the technical evidence available to investigators in the United States.

The post draws a line Francesca Giannoni-Crystal also draws elsewhere: attacks through satellites are a different legal case from attacks against satellites, the subject of an earlier 2024 article on cyberattacks on lunar satellites.

Read original

Charles Stotler asks whether Article VI of the Outer Space Treaty offers an attribution advantage.

• Article VI makes states internationally responsible for national activities in outer space, including activities by non-governmental entities, which could offer an easier path to state accountability than the general rules of state responsibility.
• Giannoni-Crystal does not oversell it: key terms remain unsettled, including what counts as national activities and what counts as activities in outer space, and technical attribution problems do not disappear in orbit—they may be compounded there.

The chapter, Cybersecurity in Space: The Attribution Advantage?, was accepted for a Cambridge University Press volume and presented at the Colloquium on Space-Cyber Power, a project of Indiana University's Space Governance Lab, on January 29-30, 2026.

Read original · Original 2

Industry guidelines, shared facilities, pooled resources, and cooperative frameworks can help manage the problems and keep disputes over interference from hardening into conflicts. The work offers solutions, not just a list of risks to avoid.

The 2025 Georgia Journal of International and Comparative Law article on lunar servicing, assembly, and manufacturing (ISAM) examines how these activities can enable resource utilization, large-scale construction, and movement on and around the Moon. It proposes collaborative mechanisms to navigate legal uncertainties, support sustainability, and reduce the risk of interference conflicts.

Read original · Original 2

Their answer is economic: the strongest argument for the Moon is the long-term potential of sustained lunar operations, particularly space resource utilization, a case they say has not fully crystallized.

In notes on a program titled From the Moon to Earth: The Trillion-Dollar Helium-3 Frontier, Giannoni-Crystal makes both points and lists three of their papers with citations: on jurisdictional choice for space resource utilization projects (22 Santa Clara Journal of International Law 1, 2024), lunar refueling (2025 Journal of Law and Mobility 24), and the ISAM article. The post becomes a short reading list for the topic.

Read original

As companies explore placing data infrastructure in Earth's orbit, on the Moon, at sea, and on the seabed, the question becomes what happens to data-protection law when the data and the servers processing it move beyond traditional national territory.

• The talk covers how the GDPR and U.S. state privacy laws may apply to these unconventional data centers, alongside the international frameworks governing outer space and maritime areas.
• Having jurisdiction to regulate is one thing; being able to enforce those rules is another.

The program The Final Frontier of Data Privacy: Servers in Space and at Sea was hosted by the Beverly Hills Bar Association's Privacy and Cybersecurity Law Section on Friday, October 30, 2026, at 10:00 a.m. Pacific.

Read original

They emphasize coordination among private initiatives, government support and incentives, and common instrumentalities that reduce regolith impacts and support sustainability.

After the helium-3 program, Giannoni-Crystal writes that it was encouraging to hear other experts offer solutions that closely align with those advocated in the ISAM article, and names the mechanisms that matter. The post thanks program organizer Chris Salvino.

Read original · Original 2 · Original 3

Start here before the shorter posts.

The post announces a published law journal article on ISAM — in-space servicing, assembly, and manufacturing — and outlines its scope: the role of these activities in a lunar economy, enabling resource use, large-scale construction, and movement on and around the Moon, as well as the legal and environmental issues they raise.

• Its distinctive argument is that legal uncertainty need not slow lunar development if the issues are handled collaboratively.
• The article proposes industry guidelines, shared facilities, pooled resources, and cooperative frameworks to keep interference disputes from becoming conflicts.
• The post presents Giannoni-Crystal as a practitioner who writes about solutions, not just risks, and sees coordination among private actors, backed by governments, as a workable path.

For brands planning a campaign

For a client webinar or expert analysis, the article offers a specific, sourced position: what a cooperative lunar-operations framework should include. A space-law firm or satellite operator could use it as the spine of a session on interference risk and shared-facility governance, with the journal article as pre-read.

The post previews a co-authored chapter and the conference session where it was presented, then lays out the argument.

• Attribution is difficult in cyber operations generally, and harder when attacks are routed through non-state actors.
• The chapter asks whether Article VI of the Outer Space Treaty offers an easier path, since it places international responsibility on states for 'national activities in outer space,' including activities by non-governmental entities.
• But key terms remain unsettled, including what counts as 'national activities' and 'activities in outer space'; technical attribution problems also persist in orbit and may worsen.
• A companion post by the same author restates the question and gives the full citation for the forthcoming chapter.

For brands planning a campaign

This is a natural anchor for a client webinar or expert analysis on space cybersecurity attribution. The session could compare Article VI with general state-responsibility rules, then examine the open definitional questions that shape a satellite operator's exposure.

The post responds to reporting that Handala, a group linked by cybersecurity researchers to Iran's intelligence apparatus, carried out or claimed attacks while using Starlink satellite internet, and threatened retaliation after U.S. and Israeli military actions.

• Giannoni-Crystal separates two questions.
• The first is evidentiary and remains open: if an operation runs through a U.S. commercial satellite network operated by SpaceX, does that increase the technical evidence available to U.S. investigators?
• The second is legal, and the answer is definite: Starlink connectivity is essentially irrelevant to legal attribution.
• The post lists the routes under the Articles on Responsibility of States for Internationally Wrongful Acts by which a non-state group's conduct could be attributed to Iran: Article 4 if the group is part of the state apparatus, Article 8 if it acts on instructions or under the direction or control of the state, and Article 11 if the state later acknowledges and adopts the conduct.
• It also cites the author's own 2024 Creighton Law Review article on cyberattacks on lunar satellites, noting that in this case the attacks go through satellites rather than against them.

For brands planning a campaign

For expert analysis aimed at operators, this post offers ready-made commentary: it distinguishes technical from legal attribution in a live case and flags the ARSIWA tests a client would be assessed against. A webinar segment based on it would give a legal audience concrete tests rather than abstractions.

They also identify the practical gap between regulating and enforcing, an observation newcomers can apply to other topics.

The post announces a program hosted by the Beverly Hills Bar Association's Privacy and Cybersecurity Law Section and sets out the talk's question: what happens to data privacy law when data and the servers processing it move beyond traditional national territory — into orbit, onto the Moon, at sea, and on the seabed?

• The presentation analyzes how the GDPR and U.S. state privacy laws may apply to these unconventional data centers, alongside international frameworks governing outer space and maritime areas.
• Its sharpest distinction is between having jurisdiction to regulate and being able to enforce those rules.
• The concrete locations make the post a useful introduction to the topic.

For brands planning a campaign

Useful for a session aimed at companies exploring off-territory data infrastructure: it moves beyond 'which law applies' to 'who can actually enforce it,' a question that shapes siting and compliance decisions.

It is a convenient entry point to their work.

The post reports on a panel discussion about lunar helium-3 and argues that the space sector still struggles to explain its value to the wider public — the plain 'what is in it for me' question.

• It asks whether competition with China and fear of falling behind can sustain long-term support.
• The post's answer is economic: the Moon's strongest argument is the long-term potential of sustained operations, particularly space resource utilization, a point the discussion had not fully crystallized.
• The program also covered the legal framework for lunar development and the Outer Space Treaty.
• The post lists three of the author's papers with citations: jurisdictional choice for space resource utilization projects (22 Santa Clara Journal of International Law 1, 2024), lunar refueling and its legal issues (2025 Journal of Law and Mobility 24), and the ISAM article in the Georgia Journal of International and Comparative Law.
• It offers a compact map of Giannoni-Crystal's lunar work.

For brands planning a campaign

A concise client briefing: it pairs the sector's public-support problem with a three-paper reading list for an analyst or policy team preparing for a session on lunar resource governance.

In this post, Giannoni-Crystal reports hearing solutions from other experts at the same helium-3 program that closely match those advocated in the ISAM article.

• They highlight coordination among private initiatives, government support and incentives, and common instrumentalities for activities that reduce regolith impacts and support sustainability.
• The post points readers back to the published article and presents its recommendations as aligned with what practitioners are already saying, naming coordination, government incentives, and shared infrastructure as key mechanisms.

For brands planning a campaign

Useful for clients weighing how much of this work is settled ground versus contested: the post places the ISAM recommendations close to a broader expert consensus, reducing the risk of building a session around a fringe position.

In a post about the Handala group's reported use of Starlink connectivity, they argue that the satellite route is legally beside the point.

• Attribution to Iran, they write, would run through the ARSIWA framework instead — Article 4 if the group functions as part of the state apparatus, Article 8 if it acts on the state's instructions or under its direction or control, and Article 11 if the state later acknowledges and adopts the conduct.
• A co-authored chapter with Charles Stotler pushes the question further: whether Article VI of the Outer Space Treaty, which makes states internationally responsible for "national activities in outer space" carried out by governmental or non-governmental entities, offers an "attribution advantage" over the general rules of state responsibility.
• They flag the uncertainties that remain, including what counts as "national activities" and "activities in outer space," and note that technical attribution problems do not disappear in orbit.

A close reading of treaties and articles, applied step by step to a specific reported incident so readers can see which provision would support each argument.

For brands planning a campaign

A client webinar or expert analysis built around one incident and one treaty article would showcase the strongest part of this work: they can walk an operator, insurer, or law firm through the attribution paths and what each means for risk. The value is legal education, not a product demonstration, so the format should leave room for them to explain where the law remains unsettled.

Examples: Source 1 · Source 2 · Source 3

Their 2025 Georgia Journal of International and Comparative Law article on lunar servicing, assembly, and manufacturing (ISAM) examines what is needed for resource utilization, large-scale construction, and mobility on and around the Moon.

• It argues that the legal and environmental problems are manageable through collaboration — industry guidelines, shared facilities, pooled resources, and cooperative frameworks that reduce the risk of conflicts over interference.
• In posts tied to a program on lunar helium-3, they make two related points: the economic case for sustained lunar operations, especially space resource utilization, has not been communicated well to the public, and competition with China or fear of falling behind is a weak substitute for that case.
• They also list related publications on jurisdictional choice for space resource projects and on lunar refueling.

For brands planning a campaign

A panel or written analysis on lunar governance gives Giannoni-Crystal a clear position to argue: collaboration over confrontation, and economics over geopolitics. That angle suits an audience of space companies, policy staff, or investors, and invites pairing them with an engineer or program operator who can speak to feasibility.

Examples: Source 1 · Source 2 · Source 3

The program covers how the GDPR and U.S. state privacy laws might apply to these unconventional data centers, the international frameworks governing outer space and maritime areas, and a distinction they treat as central: having jurisdiction to regulate is different from being able to enforce the rules. This extends their space-law work into commercial privacy compliance, for data-protection and legal teams rather than space engineers.

For brands planning a campaign

For a privacy, cloud, or satellite-communications brand, this is a bridge topic connecting infrastructure decisions to compliance obligations. A briefing or co-hosted webinar on where data physically sits versus where regulation bites would suit buyers weighing off-territory compute.

Examples: Source 1

Many follow a talk, colloquium, or bar program.

• Co-authors are named, as in the chapter with Charles Stotler, and publication details — journal, volume, and year — are precise enough to locate the work.
• Settings range from academic colloquia, such as the Colloquium on Space-Cyber Power at Indiana University's Space Governance Lab, to bar association sections.

Translate a scholarly argument into a short post, anchor it to the published source, and clearly connect the public version to peer-reviewed or edited work.

The posts here announce and summarize the underlying articles and chapters, but those full texts are not included here, so the descriptions above rest on the creator's own summaries rather than on the articles themselves.

For brands planning a campaign

A brand can work with a scholar-practitioner who brings published work and named collaborators. Tie deliverables to that output — an explainer, a recorded session, or an authored piece derived from a paper — rather than an open-ended posting arrangement.

Examples: Source 1 · Source 2 · Source 3 · Source 4 · Source 5 · Source 6 · Source 7

The program covers GDPR and U.S. state privacy law as they apply to data infrastructure in orbit, on the Moon, at sea, and on the seabed.

View example

Charles Stotler's co-authored paper, “Cybersecurity in Space: The Attribution Advantage?”, on January 29, 2026. The paper asks whether Article VI of the Outer Space Treaty offers an “attribution advantage” for state accountability.

View example

Shackelford, and Robert Templeman. The chapter is forthcoming.

View example

The article argues that legal and environmental challenges in the emerging lunar economy are manageable through industry guidelines, shared facilities, pooled resources, and cooperative frameworks.

View example

Rev.

• 663 (2024).
• They cite it while discussing legal attribution for cyber operations routed through commercial satellite networks.

View example

Int'l L. 1 (2024), is among their writing on lunar development and space resource use.

View example

L.

• Mob.
• 24, is among their writing on lunar development and space resource use.

View example

The posts examine how organizations handle a cyber incident once it is discovered — reporting clocks, when to bring in counsel and who owns each decision.

• That is the practical counterpart to Giannoni-Crystal’s questions about legal responsibility and applicable rules.
• Both write for people who have to act on an incident, not just observe it.

The focus is the client-facing side of an incident: mandatory reporting duties, privilege over legal advice, internal decision-making and the long tail of a data compromise.

• Giannoni-Crystal also works from treaty text and state responsibility, extending the discussion to lunar and privacy governance.
• The posts are tied to industry events and roundtables; ask for published legal scholarship if that is important to your campaign.

Read original · Original 2

The posts also address how international rules, including the Tallinn Manual, should govern cyber conflict. Readers following cyber risk and its governance will recognize the subject matter.

The tone and method are very different.

• These posts are dramatic, first-person announcements built on sweeping claims; Giannoni-Crystal’s are calm summaries tied to named articles, chapters and citations, and specify which parts of the law remain unsettled.
• Follow Dr Khalid A. for alarm and provocation, Giannoni-Crystal for sourced legal reasoning.

Read original · Original 2

Readers following the space economy alongside its rules will find familiar subject matter.

The focus is economic development and trade rather than law: where a company should locate, which incentives and partners are available, and how to frame a trade and innovation partnership. Giannoni-Crystal analyzes legal uncertainty and proposes governance mechanisms; these posts advocate for a place as a business destination.

Read original · Original 2

Their posts describe a panel at INMA’s Congress honoring 30 years of the FBI’s InfraGard program, where many of the 200-plus attendees had three or more mandatory cyber-incident reporting requirements.

• They recommend mapping those requirements in advance, securing cyber counsel and privilege immediately, establishing internal decision-making for each workstream, and documenting when the reporting clock starts because a regulator may see it differently.
• In a CyberSat post, Joe describes serving as a supporter and adviser since the event was forming, a background that includes the FBI, Mandiant, and Google Cloud, and current work as an attorney at Wiley Rein LLP serving critical infrastructure clients including telecom, satellites, and government contractors.
• The roundtable topic is the long tail of handling a data compromise, including reporting specifics about exposed data for satellite and defense industries.
• For a client webinar on what to do in the first 72 hours, or on post-incident reporting and privilege, Joe is the more directly operational choice.

Erin Joe’s posts focus on incident-response and regulatory-reporting practice, not legal attribution or lunar governance.

• For a campaign on those topics, ask for a separate briefing covering ARSIWA Articles 4, 8, or 11, Outer Space Treaty Article VI, and lunar servicing, assembly, manufacturing, resource utilisation, or interference governance.
• The tradeoff is operational readiness versus the doctrinal space-law analysis in Giannoni-Crystal’s posts.

Examples: Source 1 · Source 2

The two posts make economic-development arguments: Ohio was named the best place in the U.S. for business by CNBC, with Wright-Patterson Air Force Base and the Air Force Research Laboratory, the National Space Intelligence Center, Starlab at Ohio State’s VISTA Space Park, the Blue Abyss astronaut training facility near NASA Glenn, more than 640 aerospace supply companies, and America Makes for additive manufacturing.

• One post points to Ohio House Bill 188, the Ohio-Israel Trade and Innovation Partnership, and the new Ohio Defense Commission.
• The other answers “why should I care about Ohio?” with low taxes, incentives, infrastructure, workforce, cost of doing business, and sectors including aerospace and defense, drones, outer space, and quantum computing.
• For a webinar or analysis on U.S. expansion, site selection, or connecting Israeli spacetech to Midwest ecosystem partners, this is the closer match.

The posts focus on economic development, not legal analysis.

• For a campaign on who is legally responsible when a satellite is attacked or how lunar operations should be governed, ask for a separate briefing on attribution, state responsibility, the Outer Space Treaty, lunar governance, and space resource law.
• The tradeoff is market-entry and ecosystem access versus legal doctrine and risk analysis.

Examples: Source 1 · Source 2

The posts cover AI-driven cyber warfare, self-propagating malware, deepfake disinformation, critical infrastructure and national security risk, AI-driven defense, the Tallinn Manual, and international cooperation on AI governance.

• One post announces an article on “Cyber Armageddon” and describes the AI arms race.
• The other describes building an AI system on a high-spec PC that is learning to become a British lawyer, raising questions about automated AI development and oversight.
• For a general executive audience, the posts offer an awareness-raising, provocative take on the AI threat landscape and governance questions rather than doctrine.

The posts offer general AI/cyber commentary and a personal project narrative, not analysis of satellite attribution, ARSIWA, Outer Space Treaty Article VI, lunar servicing, or space resource governance.

• For a campaign on legal attribution and lunar governance risks for a satellite operator or space-law firm, Giannoni-Crystal remains the specific fit.
• Ask for evidence of satellite-specific legal expertise.
• Dr Khalid A. is an alternative only if the session pivots to AI risk and governance, not space-cyber attribution.

Examples: Source 1 · Source 2