Drones as a Security Risk: What Facility Security Teams Should Know

Small unmanned aircraft systems (UAS) have become everyday tools for photography, inspection, agriculture, delivery and public safety. The same capabilities that make them useful make them a security concern: they are inexpensive, easy to fly, capable of carrying cameras and payloads, and able to reach places ground-based intruders cannot.

Reports of drones operating over sensitive sites, including military installations, critical infrastructure, prisons, stadiums and airports, have become common. Armed conflicts have shown how rapidly drones can be adapted for surveillance and attack. For facility security teams, drones are no longer a hypothetical risk.

How drones create risk

Reconnaissance

A drone with a camera can map a facility's layout, observe operations, identify security measures and track people and vehicles. For adversaries, this is low-cost, low-risk surveillance.

Signal collection

Drones can carry equipment that captures wireless and other emissions near a site. Wireless networks, radios and devices whose signals extend beyond a building's walls may be exposed.

Cyber access

A drone can place a device near a building to attack wireless networks, or bring attack equipment within range of systems that are otherwise hard to reach. Security researchers have demonstrated these techniques.

Contraband and delivery

Drones have been used to carry items into controlled areas, such as prisons, and could be used to remove items as well.

Disruption

A drone's presence alone can halt operations, close airspace, interrupt events or force protective actions.

Physical harm

Weaponized drones have been used extensively in armed conflicts. While such use against domestic facilities is rare, security planning for high-value sites must consider it.

What organizations can and cannot do

This is where many security teams need care. In the United States:

• Detection technologies, such as radar, radio frequency sensing, acoustic sensors and cameras, can identify drones and sometimes locate their operators. Even so, some detection techniques, particularly those that capture communications, may raise legal questions.
• Mitigation, such as jamming, spoofing, taking control of or physically disabling a drone, is restricted. Federal law generally prohibits interfering with aircraft and radio communications, and specific counter-UAS authorities have been granted by statute to certain federal departments, such as the Departments of War, Homeland Security, Justice and Energy, for protecting designated facilities and missions.

Private organizations and most state and local entities should obtain legal advice before deploying any capability beyond passive detection, and should coordinate with law enforcement on response.

Assessing your exposure

A drone risk assessment asks:

• What would an adversary learn from overhead observation of your site? Are sensitive operations, equipment or documents visible from above?
• What wireless signals extend beyond your perimeter, and what could be collected or attacked from the air?
• Where are you vulnerable to disruption? Which operations would stop if a drone appeared?
• What is your detection capability today? Would you know a drone was present?
• What is your response plan? Who is notified, what actions are taken, and how are law enforcement and aviation authorities engaged?

Practical measures

• Reduce overhead exposure of sensitive activities, equipment and documents.
• Assess wireless emanations and harden wireless networks, since a drone may bring an attacker within range.
• Evaluate detection options appropriate to your site's risk and legal authorities.
• Write and exercise response procedures, including coordination with local law enforcement and, where relevant, federal partners.
• Train staff to recognize and report drone activity.
• Integrate drone risk into physical security, cybersecurity and business continuity plans.

Looking ahead

Drone capabilities are advancing quickly, including longer range, autonomy and swarming. Detection and assessment capabilities are advancing too. Organizations that build drone awareness into their security programs now will be better placed as both the threat and the tools evolve.

CDT is developing RAVEN-X SKYFALL, a planned module of the RAVEN-X platform focused on drone detection and authorized drone security evaluation. It is not yet available; capabilities may change as it is developed.

Frequently asked questions

Can we shoot down or jam a drone over our facility? In the United States, generally no. Interfering with aircraft and radio communications is restricted by federal law, and specific counter-drone authorities belong to certain federal agencies. Consult counsel and coordinate with law enforcement.

Is drone detection legal? Many detection approaches, such as cameras and radar, are commonly used. Some techniques that capture communications may raise legal issues. Get legal advice before deploying detection that intercepts signals.

Are drones really a cyber threat, or just a physical one? Both. A drone can bring attack equipment within wireless range of a building, or collect emissions, bypassing perimeter defenses designed for ground-based threats.

How CDT can help

CDT assesses wireless and physical-cyber exposure as part of our penetration testing and security engineering services, and can help organizations plan how drone risk fits into their broader security program. Learn more about the RAVEN-X platform.

Sources

• FAA, Unmanned Aircraft Systems (UAS)
• CISA, Unmanned Aircraft Systems