Hostile Drones: Reconnaissance, Payloads and Signal Interception

Drones have moved from hobbyist gadgets to tools of war in little more than a decade. Armed conflicts, most prominently the war in Ukraine, have seen drones used at enormous scale for reconnaissance, artillery spotting, electronic warfare and direct attack. The innovation cycle has been extraordinarily fast: tactics, modifications and countermeasures evolve in months, not years.

Those lessons do not stay on the battlefield. Security teams responsible for sensitive facilities and operations need to understand how drone threats are evolving.

Patterns from public reporting

Surveillance of sensitive sites

U.S. media and official statements have described unexplained drone activity over military installations and other sensitive sites, including repeated incursions reported at Langley Air Force Base in late 2023. Officials have testified to Congress about the difficulty of detecting and responding to such activity with current authorities. Whatever the intent in individual cases, the pattern demonstrates how easily drones can observe facilities.

Critical infrastructure overflights

Law enforcement and security agencies have warned about drones operating near critical infrastructure such as power substations, and about the potential for surveillance or disruption.

Contraband and smuggling

Drones are routinely used to deliver contraband into prisons, demonstrating precise delivery over secured perimeters.

Battlefield innovation

In armed conflicts, commercial drones have been modified for payload delivery, and first-person-view drones have been used as precision weapons. Electronic warfare has driven adaptations such as alternative navigation, frequency agility and autonomy that reduce reliance on jammable links. Fiber-optic-guided drones, which are immune to radio jamming, have also been reported.

Signal collection and cyber access

Researchers have demonstrated that drones can carry equipment to capture wireless signals or attack wireless networks from the air, bringing attack capability within range of networks that are otherwise hard to reach.

What this means for facilities

Physical security plans must look up

Many perimeter security designs assume threats arrive at ground level. Drones bypass fences, gates and guards entirely.

Emissions and wireless are exposed

Signals leaking beyond the perimeter can be collected or attacked by a drone hovering nearby, even when ground access is well controlled.

Detection is the realistic first step

Radar, radio frequency sensing, acoustic sensors and cameras can detect many drones. Each has limitations: small drones are hard to see on radar, autonomous or fiber-guided drones may not emit detectable control signals, and urban environments create clutter. Layered detection is more reliable.

Mitigation authority is limited

In the United States, the authority to disrupt or disable drones is limited by federal law to specific federal agencies for protecting designated facilities and missions. Other organizations should focus on detection, response procedures and coordination with law enforcement, and seek legal advice before considering any active countermeasures.

Building a response plan

• Define what counts as an incident: any drone over the site, or only persistent or suspicious activity?
• Assign roles: who is notified, who observes and records, who contacts law enforcement?
• Protect operations: what sensitive activities pause or move under cover when a drone is detected?
• Preserve information: record times, flight behavior and any operator location for investigators.
• Coordinate externally: establish contacts with local law enforcement and, where relevant, federal partners before an incident.
• Exercise the plan, and update it as threats and tools evolve.

Frequently asked questions

Are drone threats relevant to organizations that are not military? Yes. Critical infrastructure, defense contractors, research facilities, stadiums, prisons and corporate campuses have all dealt with drone activity.

Will jamming stop a hostile drone? Jamming is generally illegal for non-authorized entities in the United States, and newer drones increasingly resist it. Detection and response planning are the realistic priorities for most organizations.

How quickly is the threat changing? Very quickly. Tactics and technology refined in conflicts can appear in other contexts within a short time. Revisit drone risk assessments regularly.

What to do this week

• Identify sensitive activities and equipment at your sites that are visible from above.
• Establish who staff should call if they see a drone, and make sure they know.
• Record contact details for local law enforcement and airport or airspace authorities.
• Check which wireless networks are reachable from outside your perimeter.
• Add drone activity to your security incident reporting categories.

How CDT can help

CDT helps organizations assess physical-cyber exposure, including wireless signals reachable from outside the perimeter, through penetration testing and security engineering. CDT is developing RAVEN-X SKYFALL, a planned module of the RAVEN-X platform focused on drone detection and authorized drone security evaluation; it is not yet available and its capabilities may change.

Sources

• FAA, Unmanned Aircraft Systems (UAS)
• CISA, Unmanned Aircraft Systems