Drone Security (Part 1)

Remotely piloted aircraft are becoming increasingly common. Individuals and companies buy and operate drones for personal or professional purposes, sometimes without understanding the technical and legal implications.

Drones come in all sizes and offer a wide range of technological capabilities, including Wi-Fi communication, GPS positioning, video recording, sensors and the ability to carry objects. They are used in public spaces such as parks, beaches, festivals and concerts, as well as in unpopulated areas, primarily for research and commercial activities.

The development and use of drones pose a significant physical safety challenge, particularly when it comes to preventing accidents that could harm people or damage buildings and other facilities. From a cybersecurity perspective, these devices are also exposed to risks involving the loss of confidentiality, integrity and availability.

Technical issues involving the identification, alteration and disruption of the signals used to control drones can affect their security and cause accidents.

Legal issues, such as non-compliance with regulations, breaches of security standards or violations of personal data protection requirements relating to image recording or signal collection, can compromise individuals’ privacy.

Key Challenges

As the use of these devices grows and attracts global interest, some countries have sought to establish a common regulatory framework for civilian drone operations. The aim is to protect the safety and privacy of individuals and institutions and, wherever possible, coordinate with industry on the technical specifications needed to comply with the law.

For civilian use, it is therefore necessary to define the purposes for which drones are operated in order to determine the applicable regulations and identify the authorities responsible for granting the relevant authorisations.

The use of drones for personal purposes is internationally accepted, and there is no specific legislation; their operation is governed, among other things, by general recommendations such as:

• Do not fly above 100 metres.
• Do not fly over populated areas or urban centres.
• Do not fly beyond visual line of sight.
• Drones must weigh less than 2 kg at take-off.
• Do not capture or distribute images of identified or identifiable individuals without their authorisation or informed consent.

Professional drone use is subject to restrictions. Operational scenarios primarily include research and development, emergency operations, search and rescue, forest fire monitoring, and radio and television broadcasting, among other activities. Whether undertaken by private organisations or public authorities, these operations must comply with the relevant administrative procedures, depending on the drone’s weight and type.

Security Threats

From the perspective of information security, physical security and the protection of strategic infrastructure, drones can pose risks that warrant consideration.

Drone-related incidents have put governments and public institutions on alert. Concerns include recordings of individuals, protected facilities and private property, as well as the malicious interception of drones to alter their behaviour.

Malicious use and human error highlight the implications of drones for physical security and personal safety in public spaces such as concerts, football grounds, parks and beaches. Other incidents involving recordings of critical infrastructure have alerted governments to the problem and exposed technological limitations in countering these threats.

Privacy incidents can be common because many countries have no drone-specific laws, or because drone pilots are simply unaware of them.

Other significant concerns involve cyberattacks that may once have seemed impossible but could now be carried out using drone technology to hack servers, spy on networks, extract data and disrupt communications.

Corporate networks can be severely affected by the malicious use of drones. Businesses therefore need robust security measures to prevent unauthorised access and protect themselves against cyberwarfare attacks.

Attackers can fly over locations they would normally be unable or unauthorised to enter and then exploit vulnerabilities in Wi-Fi, Bluetooth or radio-frequency identification (RFID) networks.

For example, they could impersonate the Wi-Fi networks that victims connect to and steal information from their devices, including passwords and banking details. They could also compromise Bluetooth connections and access connected devices such as keyboards, capturing keystrokes to obtain users’ login credentials.

GPS spoofing is another way to cause harm involving drones. This technique involves transmitting a false signal to a GPS receiver. As a result, the drone uses an incorrect location and may be captured or crashed.

Drone cybersecurity is primarily affected by attacks on confidentiality and compromises to system integrity.

Confidentiality attacks include downloading a drone’s recorded images and sensor data and using them to spy on another company’s operations. Attacks on system integrity involve tampering with drone controls to disrupt their operation.

Many technological methods are available to protect drone cybersecurity. Not every drone uses all of them, but it is important to take the issue seriously, even for recreational drone owners.

Technical Recommendations

Industry, drone users and regulatory bodies must consider cybersecurity throughout the design, manufacture, operation and maintenance of these devices. Recommendations for drone technology security include:

• Raise public awareness of drone use and the associated privacy risks.
• Encourage industry to minimise the personal data collected and processed and to establish good security practices.
• Build an accurate picture of incidents by establishing databases of drone-related news and events.
• Develop security technologies for identifying, detecting and neutralising drones.

Depending on their purpose, other cybersecurity measures and controls that may apply to drone operating systems include:

• Implement robust access control and identification systems to ensure that the operator is authorised.
• Use mechanisms that obscure images when people are recorded without their authorisation.
• Use robust communications encryption to prevent interference with drone operation.
• Regularly assess potential security flaws and vulnerabilities.
• Use automatic application updates to maintain application security.
• Implement continuous monitoring systems that provide alerts for any type of incident.
• Establish maps of no-fly zones, including airports, borders and critical facilities, that prevent GPS-guided drones from entering these areas.

The benefits of drones are clear across many activities in which planning, access, observation, analysis, decision-making and action can be carried out more efficiently than through other methods.

Understanding the level of cybersecurity against applicable standards and regulations, and requiring compliance with them, would build greater confidence and reduce the risks associated with drone use.

Security regulations must therefore be continually updated and applied by all stakeholders, including users, manufacturers and regulators, to ensure safe operation and allow drones to continue delivering the benefits expected in the years ahead.