Arrochar Frontiers/Project SpaceChain
Can a collision in orbit be proven?Making a strike in low Earth orbit provable: what hit, when, from where and whose, to a standard a tribunal would accept.
Liability for damage in orbit has depended on proof of fault since 1972, and in fifty-four years no one has produced it. When two satellites collided in 2009 the public prediction that morning had them missing by half a kilometre, and neither owner could show the other was at fault. Project SpaceChain asks whether a small satellite of our own, carrying low-cost impact sensors and a record sealed before it leaves the machine, can make a strike provable: that it happened, when, from where, and whose object it was. The chain in the name is the chain of evidence.
- Field
- Evidence in orbit
- Status
- Problem stated, first experiment specified
- Started
- October 2026
- Current model
- Opportunity brief version 0.1, 18 October 2026
Where the problem stands
Liability for damage in orbit has depended on proof of fault since 1972, and in fifty-four years no one has ever produced it. The Liability Convention does not define fault and sets no standard of proof; the Claims Commission it provides for has never been constituted. When two satellites collided in 2009 and scattered almost two thousand catalogued fragments, the public prediction that morning had them missing by more than half a kilometre, and neither owner could show the other was at fault. The only settlement ever reached under the Convention was for wreckage on the ground, where liability is absolute and nothing has to be proven.
The field's answer so far is to track better and to insure less. Tracking better has limits: public orbital elements are a kilometre out at epoch and tens of kilometres out within a week, the better data is private, and of the objects able to end a mission fewer than one in twenty has a catalogue entry at all. In-situ sensors have flown for forty years to count particles for environment models, not to testify; the one commercial sensor whose data an underwriter accepts proves that a strike happened and stops there. Insuring less is what the market has done: losses often cannot be independently investigated, some underwriters have withdrawn from in-orbit cover citing the difficulty of assigning liability, and most satellites now fly uninsured. The legal literature of 2026 asks for neutral experts, a standard of proof and a standard attribution method, and does not say what evidence a satellite should carry.
The project reads the problem through three bodies of work. The space-law literature on fault and proof, from the 2018 reading of Article III to the 2026 argument for a balance-of-probabilities standard, supplies the test the evidence has to pass. The in-situ measurement record, from LDEF through DEBIE and the Space Debris Sensor to the unflown large-area detectors, supplies what a sensor can and cannot fix about an impact. Arrochar Labs' own evidence chain and the AgentGUARD™ control classes supply the engineering position: a record written and sealed before it leaves the machine, so that no party, including its owner, can alter it afterwards. Where these disagree, the model records the disagreement as an experiment.
The one rule that frames the project
A witness cannot be recruited after the event. The record that proves what happened has to be running before it happens, kept by something that cannot be talked into changing its story. In orbit nobody is watching at the moment of impact, the only instrument present is the victim, and the victim has every reason to be believed and no way to be. So the rule is: evidence must exist before the event it proves, and it must be sealed against the party that holds it. It is the same shape as Project SpaceGuard's rule for decisions. There, a person decides in advance what an agent may do. Here, a machine records in advance what it will later be asked to prove.
C0, the master hypothesis
A small satellite carrying low-cost in-situ impact sensors, its own attitude and orbit telemetry and a sealed, tamper-evident record can establish, after a damaging strike, that the strike occurred, when it occurred and from which direction it came, and can narrow the object responsible to a single catalogued parent or parent event, to a standard that lets a tribunal assign fault on the balance of probabilities, without relying on any one state's tracking data, provided three conditions hold: the sensors fix the time of impact to a millisecond and its direction to a few degrees; the record is written and sealed on board, before transmission, so that no party including the operator can alter it afterwards; and the public catalogue of candidate objects, propagated to the moment of impact with honest uncertainty, admits at most one credible parent.
It can be falsified
C0 fails if, on the public catalogue with realistic propagation error, back-propagation from a measured impact vector cannot single out one credible parent in most real geometries, however good the sensor; or if a low-cost sensor cannot be shown on the bench to fix direction to the accuracy the catalogue demands; or if no standard of proof can be stated that a space lawyer would accept the sealed record as meeting. Any of these closes C0 as stated. The satellite would still be a strike recorder of insurer grade, and the page would say so, but the claim that fault can be proven would be withdrawn.
The evidence is lopsided, and the shape matters
The evidence for C0 is permissive: every element has flown separately. Sensors have triangulated impacts on two films, a satellite's own attitude telemetry has reconstructed a strike vector, and sealed records are routine on the ground. The evidence against is obstructive: catalogue errors are kilometres, most lethal objects are not catalogued at all, the flown in-situ datasets are scarce in usable form, and a fragment of one centimetre closing at ten kilometres a second leaves a sensor microseconds to notice it. Exactly one objection could kill C0 outright: that the uncatalogued population is so dominant that the object responsible for a damaging strike is, in the usual case, one nobody has ever seen, so that the question of whose it was has no answer however good the witness. It is unproven, unrefuted, and the first thing the programme attacks, because it decides whether the project proves fault or only proves injury.
What the hypothesis commits us to
C0 says the witness is unbuilt, not undiscovered, which puts it with Project SpaceGuard rather than Project Chrononaut: the work is engineering and measurement. It also commits the programme to two honest tiers of proof. The first tier, that a strike happened and when, is what insurers lack and one vendor already sells. The second tier, whose object it was, is what the law requires and nobody has. The page will say which tier each result reaches.
The experiments that can start now
The register is ordered so that the cheapest decisive experiment comes first. The first runs on data anyone can download, the second on paper with adversaries, the third on a bench. Only the fourth flies, and it flies last because the first three decide whether it should fly at all.
- 01
Count the suspects
Take the public catalogue and its published accuracy, choose a set of real low-orbit geometries including the Sentinel-1A strike of 2016 and the Iridium and Cosmos collision of 2009, and for each one draw the cone an impact sensor of stated accuracy would report. Propagate every catalogued object into that cone with honest error and count how many fit.
What settles it. Whether a measured vector plus a public catalogue can single out a parent at all, at what sensor accuracy, and how often the honest answer is an object nobody catalogued. A high ambiguity count is the clean negative that reshapes the model early.
- 02
Write the evidence and try to break it
Draft the evidence specification: what the record contains, how it is sealed on board, how it is read, and what standard of proof it is offered to meet. Then put it to two adversaries. A space lawyer argues it before a mock claims commission on the 2009 facts. A red team plays the operator and tries to fake a strike, or hide one, for an insurance claim.
What settles it. Whether anyone would accept the record, and whether a record can be sealed against the party that holds it. This is where the evidence chain is tested in a domain it was not built for.
- 03
Hit it on the bench
Build a one-unit test article with a low-cost dual-layer acoustic and resistive sensor and a sealing recorder, and fire at it in a hypervelocity facility at the velocities and sizes the first experiment says matter. Measure the error in time and direction and compare it with the accuracy the catalogue demands.
What settles it. Whether a cheap sensor is a witness or only a counter, before anything is spent on a bus or a launch.
- 04
Fly the witness
A one-to-three-unit satellite, or the sensor and recorder as a hosted payload on someone else's, on a ride-share under an Australian overseas payload permit, in witness mode only: it records every strike, seals every record and publishes them. Its first attribution target is a fresh fragmentation cloud, whose parent is known, because a cloud produces many small strikes with a shared geometry and a known origin.
What settles it. Whether the whole chain runs in the real environment, and whether a strike can be attributed to a parent event in orbit for the first time.
The objective
The Witness
The programme's near-term objective is a satellite that, for a full year, publishes a sealed record of every strike it takes, with time and direction, and attributes at least one to a parent fragmentation event with the ambiguity count published alongside it. Nothing it reports is offered as proof of fault until a space lawyer has said it would be accepted. Attribution of a damaging strike to another operator's intact satellite remains beyond the horizon of the current roadmap, and the model does not pretend otherwise.
Four gates decide everything
- 1Can a measured vector and a public catalogue single out a parent? If not in most geometries, the claim about whose object it was is withdrawn for catalogued objects and the project keeps what and when.
- 2Can a record be sealed against its own operator? If not, neither an insurer nor a tribunal has a reason to prefer it to the operator's word.
- 3Can a low-cost sensor fix direction to the accuracy the catalogue demands? If not, it is a counting instrument and the project becomes a census.
- 4Can a standard of proof be stated that the record meets? If not, the project becomes a standards proposal to the bodies that are already asking for one.
Where the project stands
An opportunity brief (version 0.1, 18 October 2026) states the problem, the hypothesis and the first experiment against public data. Nothing has been built, nothing has been tested and nothing has flown. Arrochar Labs has never operated a satellite and does not claim to have validated anything in orbit. The project's deepest unknown is whether the object responsible for a damaging strike is, in the usual case, one that nobody has catalogued; the public record is the cheapest place to find out. One commercial sensor already proves that a strike happened for insurance purposes, and this project does not claim to be first at that. The name SpaceChain is also used by others, including a blockchain-satellite venture founded in 2017, and this project makes no claim on it.
What we publish and what we keep
We publish the context, the master hypothesis and the next experiments. The evidence specification, the sealing design, the sensor layout, the attribution code and the encodings stay internal. If C0 falls on the first or second experiment, this page will say so.
The reading behind the project
Every claim on this page traces to one of the sources below. The published books and papers are public. The two Arrochar documents are internal and are not published.
- 1Public
Convention on International Liability for Damage Caused by Space Objects, Articles II and III
United Nations Office for Outer Space Affairs, 1972
- 2Public
State Liability for Space Object Collisions: The Proper Interpretation of 'Fault', European Journal of International Law 29(1)
J. A. Dennerley, Oxford University Press, 2018
- 3Public
The Limits of Liability: How Millions of Untraced Pieces of Space Debris Challenge Attribution and Requirements for Evidence under the Liability Convention
Völkerrechtsblog, 11 May 2026
- 4Public
The space collision crisis: the future of orbital law
Solicitors Journal, 24 March 2025
- 5Public
Analysis of the Iridium 33 and Cosmos 2251 Collision
T. S. Kelso and others, Center for Space Standards and Innovation, 2009
- 6Public
Protocol on the settlement of Canada's claim for damages caused by Cosmos 954
Government of Canada; UNOOSA, 2 April 1981
- 7Public
How long can you trust a Starlink TLE? arXiv:2605.19850
arXiv preprint, 2026
- 8Public
Space debris by the numbers (DISCOS statistics) and the ESA Space Environment Report 2026
European Space Agency, Space Debris Office, 14 September and 14 October 2026
- 9Public
Copernicus Sentinel-1A satellite hit by space particle, and A 1 cm space debris impact onto the Sentinel-1A solar array (Acta Astronautica 137)
European Space Agency; H. Krag and others, 2016, 2017
- 10Public
An In Situ Measurement System for Characterizing Orbital Debris (DRAGONS), arXiv:1612.03971, and the Space Debris Sensor results
NASA Orbital Debris Program Office, 2016, 2019
- 11Public
The space environment particle density in LEO based on two decades of in-situ observation (DEBIE-1), arXiv:2409.13794
European Space Agency, Space Debris Office, 2024
- 12Public
Locating the source of on-orbit fragmentations from in-situ measurements
Frontiers in Space Technologies, 2022
- 13Public
Space insurance updates, first and second quarters of 2026; Space jam: why low orbital claims are bringing insurers back to Earth
Gallagher Specialty; Canadian Underwriter, 2025 to 2026
- 14Public
Apply for an overseas payload permit; Space (Launches and Returns) (General) Rules 2019
Australian Space Agency; Federal Register of Legislation, accessed 18 October 2026
- 15Arrochar-owned
Arrochar Frontiers SpaceChain opportunity brief, version 0.1
Arrochar Labs, 18 October 2026. Internal. Not published.
Working on any of this?
The next experiments need a spectroscopy group, quantum-simulator time, a cryobiology collaborator and a mathematician. If that is you, or you think the hypothesis is wrong and can show why, we want to hear it.