Starlink as National Security Infrastructure —
The Data Governance Framework Nobody Is Building
Starlink is no longer a commercial satellite internet service competing with fiber broadband providers. It is active military communications infrastructure in active conflict zones, the backbone of battlefield communications for a US-allied military, a strategic national security asset being evaluated for expanded US government applications, and a commercial service with tens of millions of users across jurisdictions with directly conflicting data sovereignty requirements. The data governance framework required to manage that reality at public company scale does not yet exist — and a SpaceX IPO will require it to.
I spent 19 years at Shell managing operations across multiple jurisdictions with conflicting regulatory requirements — data privacy frameworks, export controls, anti-corruption laws, and government disclosure obligations that pointed in different directions simultaneously. I know what it takes to build governance infrastructure that navigates that complexity without creating catastrophic exposure in any single jurisdiction.
What I am describing in this article is not a hypothetical future problem. Every governance gap I identify exists today, inside Starlink's operational infrastructure, at a scale that will be scrutinized by SEC examiners, institutional investors, government counterparties, and foreign regulators the moment SpaceX becomes a public company.
What Starlink Actually Is in 2026
The public narrative about Starlink focuses on its commercial success — connecting remote communities, disrupting traditional internet service providers, generating the revenue that funds SpaceX's broader mission. That narrative is accurate and incomplete.
Starlink is simultaneously: a commercial internet service with over 100 million users worldwide; active military communications infrastructure documented as essential to Ukrainian battlefield operations; a service operating in sanctioned jurisdictions where US companies face OFAC exposure; a data network subject to data localization laws in dozens of jurisdictions with conflicting requirements; and a national security asset that the US government has a direct strategic interest in protecting, influencing, and potentially regulating more formally post-IPO.
The Six Data Governance Questions Nobody Has Documented Answers To
These questions do not have obvious answers. What they have is a requirement — a public company operating at Starlink's scale and national security profile needs documented answers to all of them before the SEC examiner, the DOJ National Security Division, and the institutional investor governance screen ask for them simultaneously.
The Sanctions Exposure Nobody Is Talking About
OFAC — the Office of Foreign Assets Control — administers US sanctions programs that prohibit US companies from providing services to sanctioned individuals, entities, and jurisdictions. Starlink operates globally. The intersection of a global satellite internet service and OFAC sanctions requirements creates a compliance problem that has no clean solution and requires a documented governance framework regardless.
When a Starlink terminal is activated in a sanctioned jurisdiction, the AI systems managing terminal authentication, traffic routing, and service provisioning are making decisions that have OFAC compliance implications. The question is not whether those decisions are being made — they are being made constantly, at machine speed. The question is whether they are being made within a documented OFAC compliance framework, with human oversight of edge cases, and with an audit trail demonstrating the decisions were made consistently with US sanctions law.
A public SpaceX will be required to disclose material OFAC compliance risks. The absence of a documented framework is itself a material risk — not because violations are occurring, but because the absence of documentation makes it impossible to demonstrate that violations are not occurring.
"In financial compliance, the standard is not that no violation occurred. The standard is that you can demonstrate, with a documented audit trail, that your controls were designed to prevent violations and operated as designed. The same standard applies to OFAC compliance for AI systems making sanctions-relevant decisions."
The Military-Commercial Segregation Problem
Starlink's documented use as Ukrainian military communications infrastructure creates a governance problem that no commercial satellite internet provider has ever had to solve before. The same physical constellation, the same ground station infrastructure, and potentially the same AI systems manage both commercial consumer traffic and active military communications.
Is military communications traffic physically or logically segregated from commercial traffic? What governance framework governs that segregation? Who has oversight authority over decisions that could affect military communications quality or availability? What is the incident response framework when commercial service decisions conflict with military communications requirements? What is the audit trail for AI systems that make routing decisions affecting both commercial and military traffic simultaneously?
These questions require documented answers. Not because SpaceX has done anything wrong — but because a public company operating infrastructure with national security implications cannot tell institutional investors and government counterparties that it manages these conflicts by instinct and operational judgment.
Data Sovereignty at Scale — The Impossible Problem That Needs a Framework
More than 40 countries have enacted data localization laws requiring that data about their citizens be stored and processed within their borders. The EU's GDPR imposes transfer restrictions on personal data leaving the EU. China's data security laws create sovereignty requirements that directly conflict with US government disclosure obligations. Russia's data localization requirements existed before the sanctions environment made compliance with them a sanctions violation.
Starlink operates in most of these jurisdictions simultaneously. There is no clean compliance answer that satisfies all of them. What there is — what a public company requires — is a documented governance framework that makes defensible decisions about how conflicts are resolved, documents those decisions, and maintains an audit trail demonstrating the framework is operating as designed.
At Shell, we operated across jurisdictions with conflicting data privacy requirements, conflicting disclosure obligations, and conflicting anti-corruption frameworks. The solution was never to find a path that satisfied every requirement simultaneously. The solution was to build a governance framework that made documented, defensible decisions about how conflicts were resolved, maintained independent oversight of those decisions, and created an audit trail that could survive regulatory scrutiny in any single jurisdiction.
What Starlink Data Governance Actually Requires
Government disclosure request framework
A documented framework for evaluating, responding to, and logging government requests for user data across every jurisdiction where Starlink operates. Modeled on the frameworks that major cloud providers have built — but adapted for Starlink's unique combination of commercial, military, and national security exposure.
OFAC compliance layer for AI-driven service decisions
An automated OFAC screening layer that classifies service decisions involving sanctioned jurisdiction traffic, documents the decision logic, flags edge cases for human review, and maintains an audit trail demonstrating consistent application of sanctions compliance policy.
Military-commercial traffic governance framework
A documented framework for how military communications traffic is managed relative to commercial traffic — segregation architecture, oversight authority, incident response, and the AI governance requirements for systems that touch both simultaneously.
Data sovereignty conflict resolution framework
A documented decision framework for how Starlink resolves conflicts between competing data sovereignty requirements — which jurisdiction's requirements take precedence under which circumstances, who has authority to make those decisions, and how the decisions are documented and reviewed.
AI routing decision audit trail for conflict zones
Every AI-driven routing decision affecting conflict zone or sanctioned jurisdiction traffic documented with the decision parameters, the model version, the output, and the human oversight record. The forensic accounting standard applied to satellite routing rather than financial flows.
Does your organization have documented answers to the data governance questions regulators will ask?
Free FAIG assessment — 15 questions, 5 minutes, scored against NIST AI RMF, COSO, and ISO 42001. Or message Monte directly to discuss data governance frameworks, aerospace AI governance advisory, or board-level GRC roles.
US Citizen · Independent forensic CPA · No vendor agenda · 19 years Shell GRC · Board-level experience · Consulting and senior roles considered