Drones have the potential to contribute many positive long-term benefits to society, like replacing humans to perform dangerous tasks. Yet, the darker side of drone use is also escalating as hobbyists and criminals alike have easy access to drone assembly instructions and inexpensive toy or hobby components online that can provide near-military capabilities.
In addition, recent drone incidents at Heathrow, Gatwick and Newark airports have wreaked havoc on the airspace and suggest there could be catastrophic events to come. These incidents highlight concerns with in their security strategies. Dr. Max Klein, CTO at SCI Technology, Inc., counsels both commercial and government organizations on this topic. He explains more to Digital Journal.
Digital Journal: What are the risks arising from airport drone incidents?
Dr. Max Klein: By far, the largest and most public risk at airports with drone operations is the chance of a mid-air collision between a manned aircraft and a drone, especially one that causes even partial loss of controllability of the manned aircraft. The FAA, through its ASSURE program and other avenues, is actively investigating drone safety issues, both to humans as well as air traffic. These programs are using simulations to determine injury severity to humans and aircraft in various scenarios, and are also testing drone strikes against test dummies and aircraft components. The University of Dayton Research Institute has publicly released a video of a small “Phantom 3” sized drone striking an airplane wing and causing significant damage. Other studies have examined cockpit window and turbofan engine integrity upon a drone strike with less-than-reassuring results.
Drones are also posing additional security risks at airports and to a wide variety of other secure facilities, as they can easily breach most current physical perimeter security systems (bollards, fences, and traditional intrusion detection systems) and transport dangerous goods to sterile areas. This threat vector at airports ranges from smuggling drugs or other contraband to the ramp area for loading onto aircraft by an insider, to intentional destruction of aircraft by use of weaponized drones.
DJ: Why are police often unable to track drone owners?
Klein: One of the greatest intrinsic characteristics of drones is also arguably its biggest threat to security – the separation of the operator from the aircraft. In many applications, such as surveying chemical processing facilities for structural fatigue, damage and leaks, using a drone allows the operator to stay in a safe location while the aircraft performs a task in a hazardous location. This intrinsic separation is part of what makes Counter unmanned aerial systems (UAS) so challenging – the location of the operator can literally be anywhere.
Most toy and commercial drones today use WiFi or a dedicated radio to communicate between the operator and aircraft, typically allowing a separation between 100m and 10km, depending on model. Tracking the location of the operator for this class of drone requires sophisticated radio surveillance equipment that very few state or local law enforcement departments have access to. Industrial drones often include additional communication methods, such as LTE. This allows the operator to be literally anywhere that has Internet connectivity and makes the tracing challenge even greater, especially when it needs to happen in real time to counter fast-acting threats.
To further complicate matters, many commercial drones can also be pre-programmed with a mission so that a constant communication link is not necessary for operation, allowing the operator to emplace the drone and drive away before it ever takes flight. With no live radio link to trace, finding the operator requires traditional forensics and detective work to trace the (hopefully-captured) drone back to the owner.
DJ: What are some of the potential motivations of drone owners?
Klein: By far, the most common motivation from drone owners/operators that we have seen is a desire to get a “cool” picture/video or to just be able to see what is going on in a particular area. Most illegal drone operations are conducted by otherwise law-abiding citizens who do not know or understand the flight restrictions in place for small UAS, including hobby drones.
From our research, a very small minority of drone operators intend to disrupt air traffic or otherwise cause harm. However, with the agility of commercial drones and the lack of comprehensive air security, a single malicious operator with a single inexpensive drone can cause massive operational issues for our air traffic system.
DJ: What security measures can be put in place to prevent drones from accessing air space?
Klein: As with all security, a layered approach is key to minimizing risk. The value of public education about where drones can and cannot be flown and why a seemingly harmless “toy” can be fatal to air traffic cannot be underestimated. Most people who recklessly fly drones are not intending to endanger lives but are focused on obtaining particular footage or something similar, and they do not believe that what they are doing is dangerous.
Geofencing is the second ring of security and the first technical countermeasure, where commercial manufacturers voluntarily (or possibly through regulation in the future) program no-fly locations into their product so that customers cannot easily fly in those areas without willfully circumventing those protections. These first two layers of security effectively eliminate law-abiding but potentially uninformed operators from inadvertently intruding in protected airspace, meaning most incursions would be by nefarious actors with wrongful intent.
The next layer of security is a detection system that alerts you or automatically activates your countermeasure(s) when airspace has been breached, coupled closely with a countermeasure or neutralization system. Detection is typically performed by radar, electro-optical/infrared (EO-IR) cameras, acoustic sensors, and RF detection systems that look for the telemetry and video downlink from the drone and/or the command uplink. For a high-risk target, typically multiple detection methodologies are used. Together, they attain the highest Probability of Detection (Pd), or the probability that you detect a drone when it is actually there, and the lowest False Alarm Rate (FAR) that indicates how often the system incorrectly detects the presence of something that is not there.
Once a threat is detected, neutralization can take many forms, including jamming the communications link (if there is one) or the GPS or GNSS systems; and sending false radio commands that impersonate the operator to command the drone to return home or land at its current location (again, assuming that the drone has a radio link and uses a known protocol).
Plus, Higher collateral-damage directed energy (i.e., laser) and kinematic systems that literally shoot the drone out of the sky; and sophisticated Counter UAS solutions such as SCI Technology’s AeroGuard system that autonomously intercept a drone mid-air, captures it, and tows it to a safe location.
It is important to note that the legalities of various detection and neutralization technologies can vary greatly by state and country and is by no means trivial to navigate today. Additionally, many neutralization technologies can cause uncontrolled descent of the target drone and/or additional shrapnel, which may increase the risk of harm to those on the ground or in the protected airspace.
DJ: Have there been any serious incidents of drones disrupting air travel?
Klein: Unfortunately, there have been a number of incidents over the past few years that have caused major air travel disruption at a huge financial cost. Several incidents of note include:
Dubai International Airport (DBX) closures in January 2015, June, September, and October 2016 and February 2019, with an estimated financial loss of US $95k per minute.
London’s Gatwick Airport (LGW) closures in July 2017 and multiple closures in December 2018. NATS, the UK’s airport authority, published a very informative video showing the July 2017 air traffic disruption caused by the drone. The December 2018 closures are reported to have affected approximately 140,000 fliers with an estimated financial impact of £50M.
London Heathrow Airport (LHR) closure in January 2019.
New Jersey’s Newark Liberty International Airport (EWR) closure in January 2019.
Additionally, there was an airplane strike on a Boeing 737-800, AeroMexico flight AM770 on December 12, 2018, that is being investigated as a potential drone strike. To my knowledge, the investigation is ongoing as to whether this was indeed a drone. While there were no injuries from this incident, the damage and cost to repair the aircraft was significant. A confirmed drone strike against a US Army UH-60M Blackhawk flying over New York that was providing security for the UN General Assembly, took place on September 21, 2017 with no casualties but caused some damage to the helicopter. Unfortunately, drone incidents with manned aviation are far from rare and are likely to increase with the increasing civilian and commercial use of drones.
DJ: What other services are at risk from drones?
Klein: The threat vectors posed by drones extend far beyond “peeping toms” in people’s backyards and the havoc that unauthorized drone flights can cause to commercial air traffic. We are regularly seeing inexpensive and readily available commercial drones used by nefarious actors for a wide range of activities.
Industrial espionage is enabled through remote video surveillance at sensitive test and manufacturing centers that previously required physical trespass of perimeter security. Cybercriminals are able to add off-the-shelf hardware, such as a Raspberry Pi with WiFi and Bluetooth capabilities, or even more advanced USB Software Defined Radios, to attack unsecured or under-secured wireless devices. These include wireless access points, wireless-enabled printers (even if only using a wired connection for normal business operations), Bluetooth devices, and cell phones (via WiFi, Bluetooth, or cellular) in corporate and datacenter environments that have previously been physically out of reach.
Young adults in the US and abroad have posted videos of themselves arming drones with pistols, sub-machineguns, flamethrowers, and explosives for “fun.” And non-nation-state actors, including ISIS and several drug cartels, have been actively using commercial and home-built drones to surveil and bomb their enemies, affording them capabilities previously reserved for much larger and better funded organizations and governments.
DJ: Are the penalties sufficient to deter drone owners from engaging in irresponsible behavior?
Klein: While I would argue that there are sufficiently severe penalties already codified for drone operations near airports, I suggest that the larger problem is really three-fold:
First, lack of public awareness about what is and what is not legal to do with a simple “toy” drone and why the rules are truly important.
Second, lack of technical capability for civilian enforcement officials to locate a drone operator, as evidenced by the extremely long duration of the London Gatwick and London Heathrow airport closures (compared to the typical ~30 minute hobby drone flight endurance).
Third, lack of “boots on the ground” that are focused on enforcement.
DJ: In terms of anti-drone technology in general, how will this advance over the next few years?
Klein: Counter-Drone / Counter-UAS technology is rapidly advancing, but in many areas, is still in its infancy. While jammers are a well-known and highly developed technology in the military environment, they are only effective against drones that rely on a radio link for control, which is not always the case. Lower collateral-damage kinematic and capture systems are best suited for use in urban and highly-populated environments and will continue to mature. I expect that detection systems will continue to improve in both Pd and FAR, as well as in positional accuracy of detected targets.
I believe one of the strongest influencers of how Counter-UAS technology evolves in the next few years will be the regulatory environment. Up until a few months ago, countering a drone in the US was legally equivalent to hijacking a commercial jetliner, as there is no distinction in the US Criminal Code sections that discuss aircraft piracy between an “Aircraft” that is a toy drone and an “Aircraft” that carries people. The FAA Reauthorization Act of 2018 and other legislation are starting to improve this issue but there is still a long way to go before there is legal clarity about who can protect an open-air stadium and what methods may be employed.
