Who governs cybersecurity in orbit? Not states. As satellite broadband providers like Starlink become critical wartime infrastructure, the normative vacuum is being filled not by treaty, but by the engineering choices and contractual practices of private corporations. Drawing on research on satellite broadband governance and technology's role in international norm development, this talk maps how operators function as de facto lawmakers through three mechanisms: technical standard-setting, contractual cascades across jurisdictions, and crisis behaviour (Viasat 2022 as norm emergence under fire). The result is an accountability gap: rules exist, but no state agreed to them, no tribunal can review them. The talk proposes reintegrating private norm-making into the international legal order via due diligence and requirements and asks what existing guidance for states (including the 2025 CCDCOE/Japan MFA Handbook on National Positions) misses when private actors write the rules first.