Drone and Counter-UAS Security Guide

Drones are now flying IoT devices that collect imagery, survey data and site layouts, and they are also a physical threat that many sites cannot legally stop. Organisations meet drones from two directions. Utilities, construction firms, insurers, police and inspection teams run their own fleets, which raise questions about where data goes, who controls firmware updates and which manufacturers are still allowed. Sites such as data centres, energy assets, prisons and stadiums worry about other people's drones overhead, and quickly discover that buying a counter-drone system is easy while using one lawfully is not. This guide covers both sides for security teams: securing an owned fleet, planning counter-UAS detection, and the US and UK legal limits on mitigation. It does not describe how to interfere with drones.

Key takeaways

Treat every drone as an IoT endpoint. CISA and the FBI advise managing UAS under the same asset, patch, segmentation and monitoring controls as other connected devices.
Data flow and firmware are the core fleet risks. Know where imagery, flight logs and telemetry are stored, and who can push firmware that changes what the aircraft collects or sends.
Procurement rules changed in December 2025. The US FCC added foreign-produced UAS and critical components to its Covered List, which blocks new equipment authorisations while leaving already authorised models legal to sell and use.
Detection is a security tool; mitigation is a legal power. In the US only specified federal agencies and, since July 2026, certified state and local law enforcement may mitigate. In the UK, deliberate radio interference without authority is a criminal offence.
Counter-UAS starts with a plan, not a sensor. UK NPSA guidance puts governance, vulnerability assessment, deterrence and physical measures before technology, with the police involved from the start.

Two problems: your fleet and other people's drones

Fleet security and counter-UAS share vocabulary but have different owners, budgets and legal exposure. Keep them separate in the risk register.

Aspect	Securing your own fleet	Counter-UAS for your site
Main risk	Data leakage, firmware tampering, account takeover, loss of aircraft	Surveillance, disruption, contraband delivery, collision, payload attack
Typical owner	Operations or aviation lead with IT security	Physical security or site security manager
Control types	Procurement, configuration, patching, encryption, identity	Deterrence, physical hardening, detection, response plans
Legal exposure	Aviation rules, data protection, supply chain restrictions	Interception, radio spectrum and aviation laws if anything beyond passive detection is attempted
Key guidance	CISA and FBI UAS guidance (January 2024), FCC Covered List	NPSA counter-UAS guidance, US interagency advisory, SAFER SKIES Act rules

Fleet security: data, firmware and connectivity

A commercial drone is a system: the aircraft, a ground control station (often a tablet running the manufacturer app), a radio link, removable storage, a docking station for automated missions, and usually a cloud service for fleet management and flight logs. CISA and the FBI's January 2024 guidance warns that connected UAS and peripherals such as docking stations can collect sensitive imagery, survey data and facility layouts, and that firmware or patches controlled by the manufacturer could add data collection or transmission without the user knowing.

Controls by component

Component	Risk	Controls
Aircraft and SD card	Imagery, GPS history and telemetry left on board or on lost cards	Delete collected data from the aircraft after transfer, remove and lock away SD cards when not in use, encrypt storage where supported
Ground control station	Manufacturer app syncing logs to the cloud, shared tablets, unmanaged devices	Dedicated managed tablets under MDM, app updates through change control, local data mode where the vendor offers it, no personal accounts
Radio and command link	Unauthenticated or unencrypted control and video links	Prefer encrypted links; for MAVLink-based systems enable MAVLink 2 message signing, noting it authenticates but does not encrypt
Firmware	Updates that change behaviour, or tampered images	Obtain firmware only from the manufacturer or a trusted party, test updates on a standalone terminal first, record versions before each operation
Docking stations	Always-on network devices at remote sites	Segment on their own VLAN or VPN, restrict outbound traffic to known endpoints, monitor like any other OT or IoT device
Cloud fleet service	Admin account takeover, data residency, live streams	Phishing-resistant MFA, least-privilege roles, do not broadcast or live stream to the internet, review where data is stored

MAVLink 2 signing, used by many open autopilot ecosystems, appends a 48-bit signature derived from SHA-256 over a 32-byte shared key, the packet and a timestamp, so receivers can reject spoofed or replayed commands. It provides no confidentiality, and whether unsigned packets are accepted is left to each implementation, so check the ground station and autopilot settings rather than assuming signing is enforced. See the Firmware and Boot Security Guide and the Wi-Fi Security Guide.

Supply chain and procurement

Drone procurement has become a regulatory as well as a security decision, and it moves quickly.

CISA and FBI guidance (17 January 2024): the guidance on Chinese-manufactured UAS for critical infrastructure points to the PRC's 2017 National Intelligence Law, 2021 Data Security Law and 2021 vulnerability reporting rules as giving the state broad access to company data and early sight of vulnerabilities. It recommends checking where a UAS is made and which laws the manufacturer is subject to, reviewing the vendor privacy policy, running supply chain risk management, and maintaining software and hardware bills of materials (SBOM and HBOM).
FCC Covered List (22 December 2025): the FCC's Public Safety and Homeland Security Bureau added all UAS and UAS critical components produced in foreign countries, covering items such as data transmission devices, flight controllers, navigation systems, cameras and sensors, batteries, motors and associated software, plus DJI and Autel communications and video surveillance equipment named in section 1709 of the FY2025 NDAA. Placement bars new FCC equipment authorisations; it does not by itself stop the sale or use of models already authorised. The Department of Defense or DHS can determine that a specific UAS or component does not pose an unacceptable risk, and the FCC can restrict existing authorisations only after notice and comment. Check the live list before every purchase.
Blue UAS: the US Department of Defense's Blue UAS Cleared List of vetted models, referenced in the CISA guidance, is moving from DIU to the Defense Contract Management Agency.
Outside the US: the FCC action does not apply, but the data residency, firmware control and SBOM questions do. Apply the same supplier assessment. See the Vendor Security Assessment Template.

Procurement questions

Where is flight data, imagery and telemetry stored by default, and can all cloud sync be switched off?
Who signs firmware, how are updates delivered, and can updates be staged and held back?
Is the command and video link encrypted, and with what?
Can the vendor supply an SBOM and HBOM, and a vulnerability disclosure process?
Does the fleet platform support SSO, phishing-resistant MFA and role separation?
What is the model's current status on the FCC Covered List or any national equivalent?

Where identity fits

Fleet platforms create several identities that are easy to forget. Pilots hold accounts in the manufacturer app and the fleet portal; aircraft and docks have device identities and certificates; integrations push imagery to GIS, inspection or evidence systems using API keys or service accounts; and regulators issue operator IDs and pilot competency records. CISA recommends phishing-resistant MFA for UAS operations. Put fleet portal accounts behind corporate SSO, remove shared pilot logins, scope integration tokens to one destination and rotate them when staff or vendors change. Remote ID links a broadcast serial number to the registration record of the operator, so registration details belong in the same joiner, mover and leaver process as other licences. See the Device and IoT Identity Guide.

Threats from other people's drones

NPSA lists the threat actors a site should consider: hostile states, terrorists, criminals, protesters, journalists conducting unauthorised surveillance, and negligent or reckless users. Most incidents involve the last group, which is why deterrence and education carry so much weight.

Threat	Example at a site	Primary non-technical response
Hostile reconnaissance	Imaging perimeter, camera positions, guard routines or a substation layout	Cover from view for sensitive assets, vary routines, report sightings to police
Cyber reconnaissance	Drone carrying a wireless receiver near a building to survey Wi-Fi or badge systems	Wireless security hardening, rogue device monitoring
Disruption	Flights near airports, events or operations forcing a pause	Pre-agreed decision criteria for pausing operations, police escalation
Contraband	Drops into prisons or secure compounds	Physical netting, patrol plans, evidence recovery
Weaponised payload	Rare in civilian settings but central to state and terrorist threat assessments	Shelter procedures, police and national security engagement
Negligent use	Hobbyist overflying without knowing the rules	Signage, community engagement, airspace awareness apps

First-person view (FPV) drones, flown through video goggles and often home-built, matter here because they may not carry manufacturer geo-fencing or Remote ID and can fly fast at low level. NPSA notes that geo-fencing is manufacturer-specific and that only geo-awareness, not geo-fencing, is mandated at European level, so geo-fencing cannot be relied on as a site control. See the Physical Security Guide for Security Teams.

Counter-UAS: detection versus mitigation

NPSA separates Detect, Track, Identify (DTI) systems, which inform a response, from Detect, Track, Identify, Effect (DTIE) systems, which also apply a technical effect to stop a drone. That split mirrors the legal split: most private sites can only consider DTI.

Detection approach	What it does	Limits
Remote ID receivers	Read broadcast identity and location messages from compliant drones over Wi-Fi or Bluetooth	Non-compliant, legacy and home-built drones broadcast nothing
RF detection	Identifies control and video link signals, sometimes the pilot position	Misses autonomous or non-standard links; whether passive decoding is lawful depends on jurisdiction and system design
Radar	Tracks small airborne objects regardless of radio emissions	Clutter, birds, line of sight, licensing of the radar itself
Electro-optical and thermal cameras	Visual confirmation and evidence	Weather, night, range; usually cued by other sensors
Acoustic sensors	Detect rotor noise at short range	Short range, noisy environments

The 2020 interagency advisory from the US Department of Justice, FAA, DHS and FCC stresses that even detection technologies can implicate federal law, depending on how a system works, and that the agencies cannot approve non-federal use or review commercial products for legal compliance. Get legal review of the specific product before deployment, and test it in situ: NPSA publishes a C-UAS DTI testing standard for independent testing of commercial detection products, and its Operational Requirements guidance helps write the specification.

Legal limits on mitigation

Jamming, spoofing, taking control of, or physically capturing a drone are mitigation. The legal position is strict in both the US and UK, and it changes, so confirm current law with counsel before any procurement.

Question	United States	United Kingdom
Who may mitigate	Congress gave limited authority to the Departments of Defense, Energy, Justice and Homeland Security. The SAFER SKIES Act in the FY2026 NDAA (Public Law 119-60, signed 18 December 2025) extended it, through 6 U.S.C. 124n, to certified state, local, Tribal and territorial law enforcement and correctional agencies	Police and other authorised agencies under specific legal powers; the Air Traffic Management and Unmanned Aircraft Act 2021 lets senior police officers authorise interference with property or wireless telegraphy for specified drone offences
Private companies	The DHS and DOJ interim final rule (effective 1 July 2026) states that only agency officers and employees may exercise the authority, so private firms cannot operate mitigation, including as a managed service. Vendors may sell, install, maintain and train, and offer detection that does not need the Act's relief	No general power. Ofcom states it does not authorise or licence jammers, and deliberate interference without authority is an offence under section 68(1) of the Wireless Telegraphy Act 2006, with up to two years' imprisonment and an unlimited fine
Conditions on authorised users	Detection and Warning and separate Mitigation certifications through the FBI National Counter-UAS Training Center, authorised technologies, privacy rules, an operations plan, and reporting of mitigation actions to DHS and DOJ within 48 hours	Senior officer authorisation; police also gained powers to require grounding and to request documents
Penalties for unauthorised C-UAS	The FY2026 NDAA adds civil penalties of up to $100,000 per violation for unauthorised counter-UAS actions, on top of existing criminal laws	Criminal offences under the Wireless Telegraphy Act; sale of non-compliant jammers is also an offence under the Electromagnetic Compatibility Regulations 2016

The practical consequence for a private site: your role is to detect, record, report and protect people and assets, and to give police what they need to act. Be wary of any vendor that offers to "take down" drones for you.

Working with authorities

Engage early: NPSA advises building the police relationship before an incident, including on risk understanding, response plans, testing and training. In the UK, a police Counter Terrorism Security Adviser or NPSA adviser can help with technology selection before procurement.
Know the airspace: check whether the site sits in a prohibited, restricted or danger area, or could justify a temporary restriction. A drone flown within the Drone Code over unrestricted airspace may be lawful.
Agree an evidence policy: NPSA recommends agreeing with police how the site will support prosecutions, including evidence recovery and forensic handling of recovered drones. Preserve sensor logs, video, Remote ID records and time stamps.
US sites: under the SAFER SKIES rules, a certified local agency can act, and mutual aid can support agencies without certification, but certified personnel must perform any action needing the Act's authority. Identify the certified agency in your area before you need it.
Report sightings: use the NPSA "no drone zone" signage with a reporting number, and give staff a simple form capturing time, location, direction, description and any pilot sighting.

Implementation roadmap

Inventory: list every aircraft, controller, dock, SD card, app and cloud account, with firmware versions and country of manufacture.
Assess: check each model against the FCC Covered List (US) and your own supplier criteria; record data flows and cloud dependencies.
Harden the fleet: segment docks and controllers, enforce SSO and MFA on fleet portals, disable internet live streaming, switch to local data modes where available.
Pilot firmware control: test updates on a standalone terminal and one aircraft before fleet rollout; keep the previous signed image so you can roll back if a release changes behaviour.
Site counter-UAS plan: complete the NPSA-style vulnerability assessment (launch points, key assets, historic activity) and deterrence and physical measures before any technology.
Detection trial: if residual risk remains, trial a detection system in situ with legal sign-off, measuring false alarms over several weeks before purchase.
Response and exercise: write a concept of operations and standard operating procedures, then run table-top and live exercises with police.

Detection and measurement

Log fleet portal sign-ins and role changes, firmware versions per aircraft, data exports and API use, and dock network traffic. For counter-UAS, log every detection with sensor source, track, classification and response taken.

Fleet inventory coverage: percentage of aircraft and docks with a recorded owner, firmware version and data flow review.
Firmware currency: share of the fleet on the approved firmware version, and days from release to tested deployment.
Portal access hygiene: percentage of fleet accounts behind SSO with phishing-resistant MFA, and number of shared logins.
Data retention compliance: percentage of missions where on-aircraft data was deleted after transfer.
Detection quality: confirmed detections versus false alarms per month, and time from detection to police notification.
Exercise cadence: exercises run with police per year and actions closed afterwards.

Framework mapping

Control area	NIST CSF 2.0	NIST SP 800-53 Rev. 5
Fleet and component inventory	ID.AM-01	CM-8
Supplier and manufacturer risk	GV.SC-07	SR-3, SR-5, SR-11
Firmware integrity and updates	PR.PS-02	SI-7, CM-14
Data at rest and in transit	PR.DS-01, PR.DS-02	SC-28, SC-8
Wireless links	PR.DS-02	AC-18
SD card and media handling	PR.DS-01	MP-6
Monitoring and response	DE.CM-01	AU-6, IR-4

Common failure patterns

Drones bought by operations, outside IT: aircraft and apps arrive on personal tablets with consumer cloud accounts and never enter the asset register.
Automatic firmware updates in the field: an update applied on site changes data behaviour or breaks a mission, with no tested image to fall back to.
Weak fleet portal admin accounts: a single shared admin login to a cloud device platform exposes every connected asset, as the Verkada camera breach showed for cloud-managed cameras.
Live streaming by default: inspection footage of critical sites streamed to public platforms or unmanaged cloud links, against CISA's advice.
Buying mitigation the site cannot legally use: a jammer or takeover system purchased before legal review, exposing staff to criminal liability.
Technology before plan: sensors installed with no response procedure, so alerts lead to no action and the system is ignored within months.

Practitioner checklist

Register every drone, controller, dock and fleet account as an IT asset with an owner.
Check each model's status on the FCC Covered List or national equivalent before purchase and at renewal.
Segment docks and ground stations, and block internet live streaming.
Take firmware only from trusted sources, test it offline first and keep a rollback image.
Delete on-aircraft data after transfer and secure SD cards.
Put fleet portals behind SSO with phishing-resistant MFA and least-privilege roles.
Complete a site UAS vulnerability assessment before buying counter-UAS technology.
Limit private counter-UAS to lawful detection, with legal sign-off for the specific product.
Agree response, evidence and escalation procedures with police and exercise them.

Drone and Counter-UAS Security Guide: Fleet Security, Threats and Legal Limits