At eleven fifty-three in the morning, Greenwich Mean Time, on January 24, 1978, an object the size of a small bus entered the dense layers of the atmosphere over Canada’s west coast, north of the Queen Charlotte Islands. It was heading northeast, breaking apart. By half past eleven, NORAD already knew that atmospheric reentry had occurred. And in Yellowknife, the capital of the Northwest Territories, several people who happened to be outside in that bitter cold saw a whitish luminous trail—a bright falling line across the morning sky.
It was Cosmos 954, a Soviet reconnaissance satellite with a nuclear reactor aboard. Within minutes, fragments of that reactor began falling onto the frozen ground—onto ice, snow, tundra.
By evening, two things were clear. First: shards of radioactive fuel were scattered across another country’s territory, and they had to be found. Second: the USSR had no intention of saying exactly how much radioactive material had been inside, or what had happened to the system that was supposed to send the reactor into a safe orbit.
Three years later, the Soviet Union would pay Canada three million dollars, and another decade and a half after that, the UN would adopt a document called the Principles Relevant to the Use of Nuclear Power Sources in Outer Space. Because this story showed everyone that, in space, not only people and metal fall—legal norms do too.
I stumbled onto this subject by accident—it was sticking out of an old rabbit hole about the Skylab program, in one of the links. Cosmos 954 was mentioned there as one item on a list of things that were falling out of orbit onto people’s heads in the late seventies.
But it was not the fact of the fall itself that hooked me. It was an oddity in the numbers that later became the main story. On one side: a satellite with a “nuclear reactor” that spread radioactivity over an area of 124,000 square kilometers (larger than Iceland). On the other: a dry sentence in an official response from Health Canada—the Canadian health ministry: “It is estimated that approximately 0.1 percent of the Cosmos 954 power source was recovered.” One thousandth.
How did this entire story work from an engineering standpoint? What does “a reactor in orbit” mean, where did it come from, why did the Soviet program have to put nuclear machines into low orbit, and how did the world’s most expensive hundred-dollar objects—that is, coin-sized chunks of uranium—end up on the ice of a lake, where they had to be hunted from helicopters at minus forty?
Then there is the third oddity, the one that turns the story into a legal one: Canada submitted a claim under the Convention on Liability for Damage Caused by Space Objects for six million Canadian dollars, and received three. Even though this was the very episode that ultimately became the precedent cited by all global space-law practice.
It all starts with physics—or, more precisely, the radar equation. A radar signal reflected from an ordinary target weakens in proportion to the fourth power of distance. If you want to see a ship in the ocean from orbit—let alone a submarine periscope or a wake on the waves—you need a low orbit, below 300 kilometers, and a very powerful transmitter.
Then come the engineering contradictions worth unpacking.
Low orbit means significant drag: the atmosphere at 300 kilometers is thin, but over months it gradually eats away at altitude. Solar panels in such an orbit require a large surface area and produce little power, while the satellite spends half its time in Earth’s shadow, where they do not work at all. And spacecraft with large solar wings are slowed by the air even faster.
Soviet engineers took a path that reads like a quotation from another, more serious age: they put a small nuclear reactor aboard their satellites. The program was called US-A (Upravlyaemyy Sputnik Aktivnyy, Controlled Active Satellite); in the West, it was called RORSAT—Radar Ocean Reconnaissance Satellite. Between 1967 and 1988, 38 spacecraft of this series were launched; 33 carried a real operating nuclear reactor.
The reactor was called BES-5, or Buk in Russian. It belonged to the thermoelectric class: it heated semiconductor junctions, producing electric current from the temperature difference. No turbines, no steam—just thermocouple physics in a hostile environment.
The specifications of this machine are horrifying and awe-inspiring at once. Thermal output: around 100 kilowatts. Electrical output: from 1.3 to 5 kilowatts, meaning a conversion efficiency of roughly three percent. The radar transmitter consumed about two kilowatts. Worse still, it was a fast-neutron reactor: a moderator—graphite or water—would have added mass in order to reduce power, so the fuel was enriched to more than ninety percent uranium-235. Essentially, weapons-grade material repurposed as a generator.
The core was a cylinder 24 centimeters in diameter and 67 centimeters long, weighing 53 kilograms as an assembly. Inside were 37 solid cylinders of highly enriched uranium, 35–50 kilograms in total. Six control rods with lithium-hydride inserts, a beryllium neutron reflector, and, as coolant, an alloy of sodium and potassium—NaK, a liquid metal that melts at close to room temperature and can ignite on contact with water or moist air. The entire reactor, with shielding, weighed 385 kilograms.
The safety system rested on one assumption: once its service life was over, the satellite would be raised higher and the reactor core would be shot forward—into a “disposal orbit,” where it would remain for hundreds of years before naturally decaying into uselessness. The ejection operation had been practiced, but it did not always work.
Cosmos 954 launched from Baikonur on September 18, 1977, aboard a Tsyklon-2 rocket. The spacecraft weighed 3,800 kilograms (the documents put it at 3.8 tonnes, while Western reports called it 8,400 pounds—which is the same thing) and entered an orbit inclined at 65 degrees, with a perigee of around 259 kilometers, an apogee of 277, and an 89.5-minute period. It received the COSPAR designation 1977-090A and catalog number 10361, and NORAD began tracking it from that moment.
The first months—nothing unusual. Then the satellite began drifting from its planned orbit. By December 1977, its path had become unstable: the spacecraft was changing altitude erratically, with deviations reaching 50 miles. Soviet operators fought for control and lost: the system meant to send the reactor into disposal orbit had failed.
This is where the part usually omitted from retellings begins: the USSR warned the United States through secret channels that control had been lost. More than a month before the fall, in December 1977, the U.S. National Security Council already knew that an object with a reactor could come down, and began planning for the consequences of an uncontrolled reentry.
Let me jump ahead to the most unpleasant part. Nowadays, satellites with nuclear sources are tracked, notifications are issued, and the odds of a “sudden” fall over a populated area are low. In January 1978, everything was different. Almost nothing could be said in advance: little was known about the object—its mass, its general design, and above all, the exact quantity of radioactive fuel inside. NORAD believed the spacecraft would burn up in the atmosphere. The Soviet side initially said the same.
By design, it could not burn up completely. The core had been engineered so that, upon atmospheric reentry, the beryllium reflector would break apart, followed by the “complete destruction” of the core itself. In Soviet diplomatic notes, it sounded elegant—the reactor was safe by design. In practice, fragments, including pieces of fuel, reached the ground.
Canadian and American services later estimated the debris field at more than 124,000 square kilometers. The fall zone ran from Great Slave Lake northeastward to Baker Lake, crossing the Northwest Territories and the lands of what is now Nunavut, clipping northern Alberta and Saskatchewan. The trail was about 600 kilometers long.
The search operation was called Operation Morning Light. The code name was generated by a computer from a list; in popular memory, it is often confused with a romantic name for dawn, though in fact it was precisely what the Northwest Territories experienced during those freezing months.
Inside the United States, the whole apparatus was mobilized: the National Security Council convened representatives from the State Department, the Pentagon, the CIA, and the Department of Energy. The operation was handled by NEST—the Nuclear Emergency Support Team, the Department of Energy’s nuclear emergency-response group. It was NEST that deployed the equipment and personnel.
Then came the logistics. Three C-141 transport planes moved NEST equipment to the Canadian Forces base in Edmonton; the base photo lab expanded tenfold. A second hub was established in Yellowknife, from which the helicopters operated. Canadian nuclear equipment was not bad, but it had been designed for airborne radiometry in mineral prospecting, not for finding wreckage, so American instruments were mounted aboard Canadian aircraft.
Positioning was handled without GPS—it would not arrive for another ten years. They used an ultra-precise time-based system and a portable microwave radio-beacon network, more accurate than the radio-navigation systems available at the time.
What exactly were they looking for? Among the fuel were fragments that could kill. Canadian and American teams found one such piece, the size of a coin—a roughly 21-millimeter fragment, described in one account as a nickel-colored flake. It was discovered on the ice of Great Slave Lake on February 23 and removed in a container. The dose rate around some fragments reached 1.1 sieverts per hour; some estimates gave 500 roentgens per hour—a dose that would kill someone who remained near the piece for several hours. Of the large fragments found, ten out of twelve were radioactive.
Temperatures at the work site were such that instrument batteries had to be kept inside jackets, otherwise they drained within minutes. The technicians had not only thermometers in their hands, but liquid nitrogen and generators. At minus forty Celsius, in the wind, people worked around the clock.
One incident from the expedition shows what this turned into. A NEST team was working near Baker Lake. One day, a helicopter suffered a hydraulic failure, and the team was stranded. The men built snow igloos, kept a fire going all night, and waited for an airplane. Several people lost fingers to frostbite. Later, one member of that team, Tom Krites, worked as a counselor at a Boy Scout camp in the Sierra Nevada and explained why such nights did not frighten him: “Besides, where else can you look south and see the Northern Lights?”
The public side of the episode was complicated too. Search crews were ordered not to enter settlements and camps in protective suits, and not to alarm local people in general. The fear was simple: someone might find a strange metal fragment in the woods, bring it home, and radioactive contamination would end up in somebody’s dwelling. There were cases like that. A group of young people walking an old pioneers’ route saw a fragment fall onto a frozen body of water near their camp. They examined it closely and picked it up. When the searchers arrived, they decontaminated the site. No one was harmed, but contaminated footwear had to be replaced; new moosehide boots were paid for by the American taxpayer.
It also emerged that some of the debris sank along with the ice: the lake ice was a meter thick, almost four feet, and hot fragments became embedded in it, then went to the bottom with the spring melt.
The search teams worked in two phases. The first ran from January 24 to April 20, 1978, when the spring ice broke up. The second ran from April 21 to October 15, under contract with the Canadian regulator, the Atomic Energy Control Board.
At first, the debris was not appearing where predicted, and the reason proved unexpected: at the moment of reentry, a stratospheric warming was underway, affecting the density of atmospheric layers, so the trajectory diverged from the calculations. It was documented at the U.S. Army meteorological rocket network station at Poker Flat near Fairbanks, Alaska.
By mid-October, they had collected more than four thousand particles, flakes, and pieces; more than 4,700 laboratory analyses had been carried out. Twelve large fragments, ten of them radioactive. At the height of the search, around 220 people were working at once, and search aircraft flew more than 4,500 hours. And one deeply disappointing figure: the regulator estimated that about 0.1 percent of the source had been recovered. Later, estimates of up to 10 percent appeared in the press—a hundredfold discrepancy, and this is one of those cases where it is more honest to say outright: different documents describe different categories—fuel itself or all material, including structural debris—and use different assessment methods. The central fact remains telling: only an absolute minority of the fuel reached the ground in recognizable form; the rest “burned up” in the atmosphere, spreading radioactivity as dust and aerosol, beyond anyone’s ability to do anything about it.
The debris was sent to Edmonton, then to the Whiteshell Nuclear Research Establishment in Pinawa, Manitoba, where it was stored and studied. Cyrillic inscriptions can be made out on one of the fragments—one of those cases where the language on a piece of wreckage serves as evidence. Americans and Canadians reconstructed the Soviet design from this material. Among the discoveries that surprised them: a large object shaped like “a trash can with a dome,” emitting no radiation, turned out to be a klystron—a giant vacuum tube for the radar. And the white metallic splashes that hissed and melted holes in the snow were pure lithium from the reactor’s neutron shield. Neither side of the search was pleased with that design choice.
Canada submitted its claim under the 1972 Convention on International Liability for Damage Caused by Space Objects. It is the document stating that the launching state—that is, the state from whose territory or under whose jurisdiction a spacecraft was launched—bears absolute liability for damage caused by its space object on Earth’s surface.
According to Canadian agency calculations, the first phase cost 12,048,239.11 Canadian dollars, of which 4,414,348.86 was included in the claim. The second phase cost 1,921,904.55, of which 1,626,825.84 was included. Total: 6,041,174.70. The justification included only expenses that were “reasonable, directly related, and capable of calculation with a reasonable degree of certainty.”
Then diplomacy began, and here the description of Canada’s position is worth quoting in substance, because it is so specific. On January 24, Canada asked Soviet diplomats what was aboard the satellite and expressed surprise that the USSR had not notified it of a possible satellite fall near Canadian territory. The questions were repeated on January 27, and an aide-mémoire was submitted on February 8, 1978. The replies did not arrive immediately, or completely: one note came on March 21 and another on May 31. On January 24, the Soviet ambassador said a fall had been expected and that, if parts did not burn up, it might occur near the Aleutian Islands, and that there was no significant danger, only “minor local contamination.” Notes describing the reactor core—fuel elements with a beryllium reflector, destruction of the reflector during reentry, then complete destruction of the core—came later.
The way the Soviet position changed is telling too: first, “everything will burn up”; then, in February 1978, Academician Fedorov, representing the USSR in the Scientific and Technical Subcommittee of the UN Committee on the Peaceful Uses of Outer Space, publicly acknowledged that the recovered debris originated from the satellite, and the embassy note of May 31 formally cemented that acknowledgment.
The matter was settled through regular working channels. The protocol was signed in Moscow on April 2, 1981—by Canadian Ambassador Geoffrey Pearson for Canada and Deputy Foreign Minister N. S. Ryzhov for the USSR; Secretary of State for External Affairs Mark MacGuigan announced the signing. Article One of the protocol: the Soviet Union would pay Canada three million Canadian dollars “in full and final settlement of all matters” connected with the disintegration of Cosmos 954. Article Two: Canada accepted that sum as such a settlement. At the same time, the Canadian claim retained a reservation of the right to submit additional bills for damage that might emerge later.
Half of six million for snow and helicopters. This is one of those cases where numbers matter more than words: the precedent was established, but the price of the precedent was a discount for “not the worst possible outcome.”
There is a layer to this story that almost nobody talks about, but it is still hanging above us—and I mean that literally.
During US-A missions, reactor cores were sent away with a special impulse. According to published analyses, 16 such ejections spilled around 128 kilograms of NaK from the primary cooling loops. The alloy broke up into droplets in the vacuum; some of the small stuff has long since fallen out of orbit, but large droplets—up to 5.5 centimeters in diameter—were still in space as of 2012, and they have not gone anywhere since. The metal was irradiated with neutrons, so it contains radioactive argon-39, with a half-life of 269 years. It is not a risk to Earth’s surface: a droplet will burn up in the atmosphere, and the inert gas will disperse. The risk is different—strikes on active spacecraft.
The second problem: some old spacecraft are still flying in orbits below disposal altitude, where they are struck by space debris. For this class of spacecraft, the calculated probability of a complete puncture over any 50-year period is estimated at 8 percent; if punctured, residual NaK spills into space and once again becomes frozen droplets, becoming debris itself. And several spacecraft, including Cosmos 1900, whose reactor did not reach its intended orbit, remain in low orbit.
That is the price of the decision: to make a radar watch the ocean, they had to build a nuclear generator and operate it in low orbit, where half the safety strategy was lifting it away and ejecting it. Most ejections worked. The failures were Cosmos 954 in 1978, Cosmos 1402 in 1983—it reentered over the South Atlantic—and the 1973 launch accident, when a reactor fell into the Pacific Ocean north of Japan. After that, the spacecraft received a backup ejection mechanism—and in 1988, aboard Cosmos 1900, when the primary mechanism failed, the backup worked and lifted the core almost to the required altitude. Almost—80 kilometers below the planned one.
Now for the most beautiful part: how the story ended at the level of international law.
After 1978, the international community recognized the need for a set of principles and guidelines on the safe use of nuclear power sources in space. In November 1978, the UN instructed its Committee on the Peaceful Uses of Outer Space, COPUOS, to establish a working group on nuclear satellites. In 1992, the General Assembly adopted Resolution 47/68—“Principles Relevant to the Use of Nuclear Power Sources in Outer Space.” The document covers four areas: safety assessment, information-sharing and dialogue between states, responsibility, and compensation. Under the text, the principles were to be reviewed by COPUOS no later than two years after their adoption.
In 2009 came the International Safety Framework for Nuclear Power Source Applications in Outer Space—an international safety framework with a more engineering-oriented focus, aimed at mission designers and operators rather than diplomats alone. It has no binding legal force; the mechanism is integration into national processes. In a draft report from 2023, the working group noted that the framework had been widely adopted and was recognized as useful.
And finally, that very line from the Canadian health ministry: the challenge was not only about law, but also about following standards. Canada’s 1981 claim report refers to Article VI of the convention—the duty of the injured party to observe reasonable standards of care. It is a rule from civil claims, carried over into space.
First, and perhaps most important. This story is not about “Soviet nuclear satellites that fell.” It is about how an engineering solution that is completely logical within its constraints creates risk beyond those constraints. A reactor in low orbit was the only way to build a radar that could see the ocean. Inside the problem, it all came together beautifully: 100 kilowatts of heat, 3 kilowatts of electricity, a year and a half to two years of service life. Outside the problem remained the question of what to do if something went wrong—and who was responsible for the “if.”
Second. The most interesting thing here is not the fall itself, but the gap between official confidence and reality. Soviet notes explained that, by design, the reactor would be completely destroyed in the atmosphere—but highly radioactive pieces reached the ground, and the question was not who was right, but how many there were and where. NORAD believed the object would burn up—but a few years later, fragments capable of killing within hours lay in the snow. That gap is precisely what makes space law necessary at all: it is not about malicious intent, it is about the fact that physics is under no obligation to conform to a diplomatic note.
Third. What is striking is not “how much they paid,” but “how much they did not pay.” Six million claimed, three million paid. Spread across 124,000 square kilometers—pennies. And at the same time, a precedent that still works today. This is often how it goes: norms that later hold up the world are established in a case where justice looked like bargaining.
Fourth, and this is the most personal one for me. There is a scene in this story that I cannot help noting as an engineer. A man who worked on the search team at Baker Lake, after a night in a snow igloo and the loss of fingers to frostbite, went home and began taking children hiking in the Sierra Nevada. He explained it in very human terms: “Where else can you look south and see the Northern Lights?” Those people, not the rockets, are the real reason the world did not suffer a more serious disaster then. Not the technology, not the protocols, but specific specialists who went out in minus forty to search for radioactive debris on the ice.
Fifth. And the most unpleasant point. The debris has not gone anywhere. The belt of NaK droplets in orbit is not a metaphor; it is a real physical object left behind by decisions made in the 1970s, and it will remain there for a long time. Cosmos 954 fell in Canada, and it became a lesson from which UN principles and backup ejection mechanisms grew. But the logic of “a reactor in low orbit” has not disappeared, because the tasks that required it have not disappeared either. And that is a question for us, not for 1978.