Killer Drones: How Commercial Drones are Changing the International Security Environment

ABUSE OF COMMERCIAL DRONES

As of 2022, there are more than half a million drones in private hands in the United States alone. The global market on drones is expected to grow at a compound annual growth rate of 20.5 percent to reach nearly $43 billion in 2024 from drone sales.[4]  This is good news for technology enthusiasts and entrepreneurs but, unfortunately, is also drastically reshaping the tools and methods of illicit actors, and allowing them to enhance their capabilities against military and law enforcement measures.

Drones have become the tool of choice and commonplace in visible attacks on critical infrastructure. Look no further than a recent event at a Pennsylvania electric substation to demonstrate that commercial drones can be used to target key facilities in the United States’ homeland.[5] The ripple effects from various conflicts have shown that drone technology and the nefarious uses of drones (bombings, suicide attacks, surveillance) are now making their way from combat zones to the private sector in the United States and other countries. More importantly, our airspace controls from a legal and regulatory perspective are being outpaced by the change in the environment from the use of commercial drones. Complicating issues still remain unsolved concerning unmanned traffic management (UTM) and in the future urban air mobility (UAM)—think of this as a way to move people and goods in the unmanned environment. A sort of drone superhighway that remains unsupervised and unregulated. 

Commercial drones in today’s market can be outfitted with small computing devices called raspberry pi and execute spoofing techniques to exploit unsecured networks and devices.[6] In basic terms, the drone makes you believe you are on your network, but you are communicating through the drone’s onboard computer as it takes over your connection. Moreover, local networks are not the only target; these platforms can also attack your smart devices through Wi-Fi and Bluetooth connections. Your data is easily accessed by a drone simply following you down the street.

As the world looks to address the growing interest in commercial drone usage as an everyday tool and a societal norm, there should be an emphasis put on these platforms and how they affect the security of critical infrastructure, transportation, industrial, commercial, and personal data.

NEW TECHNOLOGY, NEW THREAT

When I was stationed in Iraq in the U.S. Army from 2010 to 2011, I witnessed both the benefits and dangers of drones as a commander with Unmanned Aircraft Systems (UAS) capabilities and then later as a theater director of intelligence. In the latter role, I saw firsthand how drones can be used to carry weapons weighing up to 15 pounds on commercial UAS platforms and much heavier weapons on other platforms designed for military use.

Years later, in 2016, the U.S. admitted a lapse in tactical superiority of the airspace during the battle of Mosul against the Islamic State in Iraq and Syria (ISIS).[7] This shows how drones are leveling the playing field between violent non-state actors and the militaries tasked with combatting them. Look no further than the war in Ukraine to see commercial and military-grade drones working together to bring a sense of air parity to Ukrainian forces.

From kinetic attacks to cyberattacks, intellectual property theft, to spying and assassinations. The list goes on, perhaps limited only by the imagination of the nefarious non-state actor or a rogue nation-state. Terrorist and criminal organizations have developed, conducted, and promoted weaponized drone attacks in conflict zones, and even promulgated the technology for use outside of these areas.[8] The malicious use of these platforms by criminals and terrorists is an inevitable fact and can no longer be pushed aside.

COMING TO A BORDER NEAR YOU

In September 2019, the Colombian Army announced it found two Syma drones between the municipalities of Pasto and Tumaco, in Nariño, along the border of Colombia and Ecuador.[9] A subsequent Colombian Army press release stated the owner of the drones was the Oliver Sinisterra Front (Frente Oliver Sinisterra – FOS), dissidents of the Revolutionary Armed Forces of Colombia (FARC), an armed non-state actor once designated as a terrorist group by the United States.[10] That same month, Colombian police reported seeing drones flying over the Saravena, Neiva, San Jose del Guaviare, and Tumaco cities of Colombia, along the border with Ecuador. Some analysts suggested that these drones belonged to the National Liberation Army (ELN), another recognized narco-terrorist group operating in Colombia and Venezuela.[11]

Drone usage by criminal groups has been reported before for surveillance, but this was the first time in Colombia that drones were found for use as weapons. In 2021, the Colombian military stated that FARC dissidents could be planning drone attacks against public security forces in the Tibú municipality in the northeast of the country on the border with Venezuela.[12] 

Colombia is just one country where drones are quickly becoming a game-changer for public security forces combatting transnational organized crime and terrorism. A more pressing example is in Michoacan, a Mexican state with the third-highest number of murders and where rival cartels are using drones to transport small amounts of drugs and on occasion, to launch attacks.

In mid-January, a video recorded by a drone controlled by the Jalisco New Generation Cartel (Cartel Jalisco Nuevas Generaciones—CJNG) went viral. In the footage, the drone is seen to drop several bombs on Tepalcatepec, a municipality in Michoacán that has been hard hit by narco-violence.[13] This type of drone attack has psychological effects on the Mexican population who begin to perceive the drug cartels as more powerful than the public security forces tasked with protecting them.

This means that as drone technology continues to develop, it presents an ever-growing challenge for policymakers and security professionals worldwide. The concern increases as the targets of drone attacks become more strategic, such as critical infrastructure and/or supply chains, and as drones become more readily available on the commercial market. There is no simple solution as the range of threats from drones is wide, but there are various risk mitigation measures that can be taken and tailored to address specific security situations involving drone technology.

RISK MITIGATION

Staying informed about current advances in drone technology and how it is being used in different conflicts across the globe is critical in this new security and business environment. The good news is there are operational security measures that can be taken to mitigate the growing risks presented by commercial drones.

Individually, for instance, one can combat the threat posed by the abuse of commercial drones by ensuring that every network or connection accessed is secure. That would mean staying clear of public Wi-Fi that is accessible without a password. If you are a business, it is advised that you secure your employee networks, remember to change passwords daily, and monitor your network for nefarious or suspicious activity. Additionally, dedicating a secure space and RF shielding for very sensitive meetings is another way to layer your defense against misuse of drone technology.

There are also new advanced software and modeling tools that can be used to identify vulnerabilities in a specific airspace. Technological mitigation platforms — like a drone detection and monitoring system, mass communication notification system, physical air-space observation posts, and communication systems — are necessary, as is an early warning system that allows for the time and space necessary for a quick reaction.

These measures are often nested within a Drone Vulnerability and Risk Assessment (DVRA), a Drone Detection, and Response (DDR) plan, and Drone Emergency Response Plan (DERP),[14] which establish and confirm standard operating procedures and emergency response actions, bringing in law enforcement, private security, medical services, and hazardous material experts when necessary.

More unsettling, however, are concerns for critical infrastructure, supply chains, and data centers. The growing use, from personal devices to complex business operations, of cloud storage is taking over as the world’s data storage technology of choice. On-premise storage of data is becoming a technique of the past. This makes cloud storage within critical infrastructure and supply chains a possible vulnerability for electronic espionage and intellectual property theft via drone technology. That is why it’s imperative that policymakers, security professionals, and intelligence personnel stay current with the technology, understand the capabilities, and proactively work with all key stakeholders to address the quickly evolving pace of technological advancement and access of commercial drones in public space.

POLICY SOLUTIONS

From Ukraine to Colombia to our U.S. southern border, the use of drones is changing and extending the battlefield in modern warfare. Drones now have access where access control is almost obsolete. The concept of detection and monitoring is only beginning to take shape in environments where laws and regulations haven’t kept pace with technological growth.

These are steps that policymakers can take to mitigate the growing risks associated with commercial drones, and to protect critical infrastructure, transportation, supply chains, and public spaces from unauthorized drone activity: 

• Policymakers need to mandate that all entities associated with critical infrastructure conduct a targeted drone security and vulnerability assessment (DVRA) focusing on access to the facility, vessel, platform, and public space.[15] This will include identifying and prioritizing vulnerabilities that require protection and expanding outward from those areas, establishing no-fly boundaries that should be heavily monitored by technical solutions that have the capability for offensive measures if warranted. This will require identifying the resources — including capital, personnel, systems, and outside experts — to implement the infrastructure and expertise required for the detection and monitoring of threats. In addition, stakeholder engagement on many levels, including leveraging security consultants to advise and assist policymakers from a practitioner level, is necessary.
• Policymakers should research to better understand product lines, specifications, and capabilities associated with commercial drones which will make establishing control measures around critical infrastructure, transportation, and public venues simpler. The market is controlled by three companies that supply nearly 100 percent of drones sold globally. However, the fourth major producer of commercial drones is the hobbyist, and in this area of production, extending similar controls is nearly impossible. Careful and creative thought is needed to address the fourth dimension of drone use in public space.
• Policymakers, and particularly the U.S. Congress, should create a standing Task Force on Commercial Drones. This task force should be composed of relevant federal agencies, private sector practitione, academic , and subject matter experts, to create a holistic integrated approach to ensuring resources are allocated in the most effective manner. A true public/private partnership that helps define the division of labor between federal, state, local and tribal governments that regulate commercial drone use and protect privacy concerns while supporting safe regulation and coordination of airspace.[16]

In the end, there needs to be a concerted effort from policymakers to take drone technology seriously and develop supportive measures for internal and external entities associated with protecting and securing critical infrastructure, transportation, and public space. Eliminate the stovepipes and one-off efforts. Drone technology is on a clear glide path to pick up even more momentum as a norm in everyday life. This has the potential to help improve market efficiency, but if left unattended, it also has the potential to disrupt life systems, free flow of goods, services, and labor, and impede our ability to safely participate in public events. The future is now– there is no time to waste.

NOTES