Unmanned aerial vehicles, more commonly known as “drones,” pose a growing danger to people, enterprises and infrastructure. Just last month, on January 17, 2022, Houthi rebels from Yemen used explosive-laden aerial drones to attack a strategic oil facility in the United Arab Emirates (UAE) and start a fire at Abu Dhabi International Airport. These attacks killed three people and prompted the UAE to pose an immediate ban on all types of recreational drones. This attack was very similar to two drone attacks launched against oil refineries in Saudi Arabia on September 14, 2019.
In the U.S., a swarm of four, unauthorized drones appeared above the Palo Verde Nuclear Generation Station near Phoenix, Arizona, after dark on September 29 and again on September 30, 2019, just days after the similar attacks in Saudi Arabia. Eight months earlier, a similar incursion was reported at Pennsylvania’s Limerick nuclear generating facility. In July 2020, a small recreational drone carrying copper coils and nylon cords was used to successfully attack an electric utility substation in Hershey, Pennsylvania. In each of these examples, inexpensive recreational drones have been used to facilitate criminal activity.
In October 2021, U.S. authorities from the Federal Bureau of Investigation (FBI), Department of Homeland Security (DHS) and National Counterterrorism Center (NCTC) published advisories for law enforcement warning of the increased threat drones pose to critical infrastructure. This warning from U.S. authorities echoes concerns raised by Marine General Kenneth McKenzie, then the head of U.S. Central Command, who saw the threat of inexpensive “Costco” drones early on. In July 2020, at an event hosted by the Middle East Institute, General McKenzie said, “I’m not talking about large, unmanned platforms which are the size of a conventional fighter jet that we can see and deal with, as we would any other platform. I’m talking about the one you can go out and buy at Costco right now in the United States for a thousand dollars, four quad, rotorcraft or something like that that can be launched and flown. And with straightforward modifications, it can be made into something that can drop a weapon like a hand grenade or something else.”
“Drone” is a broad term that includes toys for kids, recreational drones for hobbyists, professional drones for agriculture, e-commerce, entertainment, emergency management and research and weaponized devices for military use. Military drones have been used for surveillance and direct action to destroy enemy personnel and property for more than 20 years. During this time, drones have become more advanced, more networked, and now fly faster and farther with more sophisticated capabilities. Like many technologies, drones have become more capable, but they have also become less expensive. Today’s abundance of low-cost recreational drones provides extremists, criminals, drug cartels, and anyone interested in sowing discord with the ability to assassinate people, destroy property, and deliver military-style attacks anywhere in the world.
How Drones Work
The most common type of drone is an unmanned aerial vehicle, or UAV for short, which is typically constructed of lightweight composite materials, so they are easy to fly and maneuver. While most aerial drones are controlled using radio waves, recent developments in wireless connectivity have made it possible to pilot a drone using a smartphone or tablet. This makes it easier for a pilot to use the drone’s camera to see from the drone’s perspective. A drone’s built-in cameras are arguably its most valuable feature. Not only do cameras make it easier for a pilot to navigate a drone, but they allow people to do anything from shooting video to shooting a gun.
When we think of drones, we typically imagine a small, remotely piloted aircraft. Unmanned aerial vehicles span from microdrones, which are as small as the nail on your pinky finger, to larger drones that could conceivably carry a person. Increasingly, aerial drones are being deployed in swarms where multiple drones, networked with each other, fly in unison. Swarms of microdrones are particularly worrisome because they are more challenging to detect. But drones aren’t always aerial.
Unmanned marine vehicles, or UMVs, are submersible devices that can “swim” in water. While their buoyancy limits their weight capacity, they threaten submerged infrastructure. On land, we come across unmanned ground vehicles (UGVs), like NASA’s Mars rovers. These drones can climb, walk and crawl over rugged terrain while carrying significant payloads. With Tesla and other auto manufacturers creating self-driving technology, we aren’t far off from a future with self-driving UGVs on the road with manned vehicles.
All unmanned vehicles could pose a threat whether a drone is in the air, in the water or on land. With a drone, someone can disrupt an entire facility without ever setting foot on the property.
Drones and Hostile Reconnaissance
Incidents with hostile drones have increased significantly over the last two years. The Federal Aviation Administration (FAA), which tracks unmanned aircraft sightings (UAS), now receives more than 100 UAS reports each month. Most of the UAS incidents tracked by the FAA are reported near airports by commercial pilots. A cursory review of recent drone incidents underscores the problem.
On January 28, 2022, two people were injured when a drone fell on them at a stadium in Jabalpur, India. On January 24, 2022, an English Premier League soccer match was stopped because of an illegal drone overflight. On January 15, 2022, an invasive drone was seen above the NFL playoff game between the Cincinnati Bengals and the Las Vegas Raiders. In March of last year, the police arrested a man in Simi Valley, California for allegedly using a drone to deliver heroin. A man was arrested for flying a drone in temporarily restricted airspace in Miami Beach, Florida, in the week leading up to last year’s Super Bowl. We also see a lot of drone activity around airports, such as when the Piedmont Triad International Airport in Greensboro, North Carolina, had to divert, suspend and hold flights due to illegal drone activity over the airfield.
As IoT (Internet of Things) capabilities expand, we have many more devices connected to a wireless network in government facilities, hospitals and commercial and financial buildings. Because these IoT networks can be accessed with proximity connections, drones can get close enough to connect to the network, hack into IoT devices, and potentially gain access to sensitive information. A hacker could even use a drone to set up jammers that block the network and render IoT devices useless, interrupting operations that rely on the network.
As more manufacturers enter the drone market and develop faster ways to produce these machines, there are more drones in the world than ever before. While drones are not inherently hostile, the greater issue is that most organizations do not pay attention to their airspace and are unequipped to deal with a drone incident, hostile or not.
How to Protect Airspaces from Drones
In the U.S., it is illegal in most places to use brute force, like guns or nets, to take down a drone, even if it’s near your property. While the Federal Aviation Administration (FAA) has put restrictions in place to regulate drone flights, these regulations will not stop bad actors’ intent on damaging property or harming people.
While most drones are operated by hobbyists who just want an open space to try out their new toy, drones have increasingly become a tool to perform hostile acts against people, critical infrastructure, and vulnerable property. Today, most drones are used just for reconnaissance. But organizations need to prepare for the inevitable future where drones are used to drop poisons or explosives and bypass typical security to fly into buildings, transmit video, jam electronic signals, or leave something behind.
Virtually no one is paying attention to their airspace, and that is a gap organizations need to close quickly to defend against hostile drones. Here are the steps enterprise security can take to protect their airspace from drone overflights:
Understand the Scope of the Problem
First and foremost, organizations and their security leaders need to be able to conduct surveillance of the airspace of the site. Most buildings include about 100 feet of airspace; the FAA controls anything above that. Without surveillance capabilities of the airspace, organizations won’t have eyes to tell if there is a drone nearby.
With today’s technology, organizations have many ways to track drones. The most common method is using radar to identify drones by their motors, which emit a frequency that can be tracked, allowing leaders to figure out the type of drone, its speed and direction of travel. Recent advancements in data analytics have led to optical sensors that use analytics to identify drones in the sky and track them. Organizations can even use radio frequency detection to detect drones, usually controlled by RF signals on varying bandwidths.
The most important information a business needs to determine about a drone is its direction of travel. Drones have a short flying time because they run on batteries, while their range is limited to around 1,500 meters for those that operate on the typical 2.4 GHz frequency. If leaders can find out a drone’s direction of travel, they can discover where it came from and potential places where a pilot could control the drone.
Create an Action Plan for Drone Overflights
Although both people and businesses are prohibited from taking offensive action against drones, organizations should still plan what to do if a drone does enter their airspace. Many enterprises have clearly displayed signals banning unauthorized drone flights near their facility; while this won’t prevent all incidents, it can deter hobbyists from unintentionally flying their drones too close to a property.
I highly recommend establishing clear policies and response procedures for a facility, so everyone knows what to do if they observe a drone. These responses should help organizations find out information such as where the drone went and if the drone did anything, such as take photos or drop something. Because drones can be really small, they can be used to drop explosives in areas that are difficult to access. In January 2019, Greenpeace activists in France flew a drone over a nuclear facility and dropped a harmless smoke bomb on a building housing “the largest amount of radioactive material in the world” to prove that nuclear plants were not sufficiently protected.
Because of the potential of drones to cause significant damage to life and property, an organization’s drone response protocol should be similar to a bomb threat response. The goal is to move people to safety, search the facility and secure the site.
Make Contact with the Drone Pilot
If organizations do come across a drone in the airspace and track its direction of travel, that information can be used to find the pilot. Drone pilots are often far enough away, which makes seeing them difficult, but pilots still need to be in range to control the drone, typically within 2,000 to 3,000 meters of the drone.
To make it easier to locate drone pilots, organizations can use intelligence preparation of a facility and the surrounding areas to help identify likely areas where pilots would be. This includes outlining potential launch-and-recovery sites, like open spaces without power lines or other structures that could interfere with a drone’s flight.
Along with pinpointing these potential areas, organizations should also establish clear lines of communication with local law enforcement, so they are involved in the response. In December 2020, the FAA fined a man $182,000 for multiple unauthorized drone flights in the Philadelphia area, which was only possible because they found the drone pilot in the first place. Although organizations do not have the authority to take action against the pilot of an unauthorized drone flight, they can provide law enforcement with information about the drone to support their investigation.
What’s Next for Hostile Drones
Isolated drone incidents happen frequently, but many people do not recognize that these events are part of a greater issue. The drone problem is only increasing now, and it’s likely to worsen quickly. We have already seen drones used to commit violent crimes, like the assassination attempt on Venezuelan President Nicolás Maduro in 2018. Soon more bad actors will realize the potential of drones as a new way to attack people and businesses.
The most effective security strategies focus on preventing problems before they happen, and this approach is critical when defending your business from hostile drones. Without any clear regulation that allows businesses to take down hostile drones in their airspace, organizations must ensure they have full surveillance capabilities of their airspace, plan for potential drone overflights and partner with local law enforcement in the event a drone does enter their airspace.
