The context in which the FAA issued the Notice of Proposed Rulemaking (NPRM) for restricting access to critical infrastructure and sensitive sites is a rising threat from rogue drones. Certainly, the danger is far more diverse and acute than in 2016 when Congress first mandated the FAA promulgate Section 2209 regulations, and there is a widespread belief among critical infrastructure operators and experts in drone detection and mitigation that the threat is rapidly escalating.
“We're seeing increased threats and more occurrences of unknown drones flying over our sites,” Jeff Gunnulfsen, the American Fuel & Petrochemical Manufacturers (AFPM) assistant VP of security and risk management, told Commercial UAV News. “We're worried about surveillance, we're worried about espionage, we’re worried about the drone being weaponized and hitting one of our units within a refinery or petrochemical site—or even a non-malicious drone that crashes into one of our sites.”
Such sites are an example cited by the FAA in the NPRM, which states that “chemical sector operations are vulnerable to a variety of disruptions stemming from a UAS incident.” The FAA notes that “local or regional disruptions to critical suppliers can cause cascading supply chain disruptions across geographic regions and in multiple industries.”
Gunnulfsen said the Section 2209 NPRM is an “important step forward” to deal with “risks from malicious and extraneous drone flights.”
Anthony McCarty, senior VP-government for Asylon Robotics—a firm that provides security for infrastructure, including utilizing UAVs and detecting unknown drones—said the threat from malicious drones has escalated over the last several years and is likely to rise further as rogue operators gain access to more sophisticated technology.
“I think the use of small UAS in the engagements between Ukraine and Russia is really bringing to light some of the true capabilities of small drones,” McCarty, a retired Air Force colonel with decades of experience in sensitive site security, told CUAV News. “That's really drawn attention to how effective those systems can be. As AI becomes more adept, it adds even more complexity to small UAS capabilities. Drones pose the risk of being used in a malign way for everything from surveillance and privacy violations all the way to potential weaponization, where bad actors are looking to use the system in some kinetic or non-kinetic way.”
Eyebrows were raised in March when 15 agricultural spray drones were stolen from logistics firm CAC International’s warehouse in Harrison, New Jersey. While the UAVs were quickly recovered by authorities, and the intent of those stealing the UAVs is not clear, the incident highlighted worries over the potential of such drones to be used by bad actors to spray dangerous substances over infrastructure sites or mass gatherings.
In another example, the NPRM notes that in April 2024, Georgia Governor Brian Kemp “announced the arrest of around 150 people in an alleged ‘multi-state criminal enterprise using drones to smuggle drugs, guns, cellphones and other contraband in Georgia prisons.’ The pace and scope of multi-state, multi-facility, and multi-actor schemes demonstrate the acute risk posed to state prisons and the need to better protect these facilities from drone-introduced contraband.”
The NPRM adds: “While no government-wide comprehensive database of unmanned aircraft-related events currently exists, facility operators or proprietors have reported a number of such events to the Department of Justice and other security agencies.”
Asking Questions
Given this context, commercial and public service drone operators generally agree there is a need for federal regulations regarding restricting drones’ access to airspace over critical infrastructure and a system for facilities to request to be designated by the FAA as such. But they are also concerned about the implications of the proposed regulations for legitimate UAV commercial activity and public safety operations. Drone operators now have until July 6 to publicly comment on the 181-page Section 2209 NPRM—which proposes to create a new 14 CFR Part 74 FAA regulatory category—to express support for or concern over various provisions in the document.
“This proposal represents a significant step forward in modernizing how our low-altitude ecosystem works,” Liz Forro, policy director of the Commercial Drone Alliance, said. “Everyone who flies drones legally, or who is experiencing rogue unauthorized drone overflight, should participate in this comment period to provide concrete advice to regulators on how to further refine the proposal.”
Early public comments and CUAV News conversations with affected parties point to a number of questions being considered:
1) Is the scope of the NPRM too broad? An estimated 9,000 sites across 16 sectors are eligible to be designated as “Standard” or "Special” Unmanned Aircraft Flight Restriction (UAFR) zones.
2) Will the final rule lead to an overregulated patchwork of airspace restrictions that could compromise free navigation by legitimate drone operators?
3) Are the proposed Section 74.250 exceptions for access to restricted airspace permissive enough for the commercial and public services drone sector while being restrictive enough from the perspective of operators of critical infrastructure?
4) How does the proposed Section 2209 rule mesh with the proposed Part 108 rule that would enable Beyond Visual Line of Sight (BVLOS) flights?
5) How effectively will UAFRs protect sites from drones operated by bad actors who have no intention of adhering to the airspace restrictions?
Vic Moss, the CEO of the Drone Service Providers Alliance, told CUAV News that “the two-tiered UAFR approach [proposed in the NPRM] is a very palatable solution for drone operators.”
While generally viewing a potential final rule based on the NPRM as both workable for the commercial drone sector and necessary to help protect critical infrastructure, he does push the FAA to be very clear in its language and place a high bar for sites to gain UAFR status.
“The more restrictive Special Unmanned Aircraft Flight Restriction is critically necessary for the protection of some of the country’s more sensitive infrastructure,” he said. “However, applicants requesting Special status must provide a demonstrable reason and, ideally, a documented history of UAS incursions as part of their application. Likewise, applicants seeking the less restrictive Standard Unmanned Aircraft Flight Restriction designation should also be required to demonstrate a legitimate need. Simply not wanting drones in the airspace above or near their facilities cannot be sufficient justification. They must prove that a UAS incursion would create enough disruption to adversely affect day-to-day operations.”
He added: “Either designation must be site-specific and limited to areas directly associated with the facility. Simply flying near a facility cannot be part of the final rule. UAFR definitions should be limited to fence-line boundaries only. A minimum altitude restriction may even be acceptable to the remote pilot community, but only if that limitation is reasonable.”
In a public comment to the FAA, Daniel Cavanagh, the chief of the Gerrittsen Beach Fire Department in Brooklyn, New York, said the “FAA’s overall approach is sound,” but cautioned the final rule must avoid “unintentionally slowing public safety drone operations that protect life and property.”
In a large metropolitan area like New York, “critical infrastructure, residential neighborhoods, marshland, bridges, waterways, utilities, transportation assets, and public safety response areas are all close together,” he stated. “Even if one UAFR is narrowly drawn, multiple UAFRs close together could create confusion for public safety operators trying to launch, recover, train, or respond during an emergency.” He recommended that the final rule “clearly state that public safety Part 107 emergency and readiness operations are permitted operations in Standard UAFRs.”
Legitimate Access
A key point of focus for legitimate drone operators is the NPRM’s 74.250 section, which outlines exemptions for UAVs to access UAFRs. The types of exemptions envisioned in the NPRM include drones being used by the critical infrastructure facility itself for inspections, security, and other routine activities; necessary public safety operations occurring within the UAFR; package delivery; and transit rights through UAFRs that allow UAVs not tied to the site to move through the airspace.
“The navigability of the UAFR airspace, within the bounds of known and vetted operators, allows for the continued integration of UAS into the [National Airspace System] with its commensurate economic and societal benefits, be it by allowing approved operations at the behest of the fixed site facility owner or by allowing a UAS to take the most expeditious and safest path by transiting through a UAFR,” the NPRM says. “FAA believes these operations must be able to either provide commercial services to the fixed site or be able to transit through UAFRs to access communities near a UAFR unabated.”
Distinguishing between legitimate and illegitimate access will be accomplished by “a strict Remote ID equipage requirement for operations within a UAFR to aid with identification for fixed site facilities,” the NPRM states. Sites with UAFRs will be required to have a Remote ID sensing capability, which the FAA views as a “crucial component” of allowing approved operations within a UAFR.
Critical infrastructure sites such as refineries are taking advantage of drone technology and want to make sure their own operations will not be affected by a UAFR. “We have many, many members that use drones for safety inspections and safety audits, for example, because obviously drones save a lot of money and reduce risk to facility staff,” AFPM’s Gunnulfsen said. “We also have had some members who use drones for security patrols.” In addition to enabling facilities’ own UAV operations, he is supportive of a final rule that would allow for “safe, legitimate innovation in the low-altitude airspace.”
Closely scrutinized is the meaning of the NPRM’s requirement for drones not associated with critical infrastructure sites to transit UAFRs “in the shortest amount of time practicable.” The FAA says “the intent is to minimize the amount of time that operations unrelated to the fixed site have within a UAFR to reduce security concerns.”
The FAA is not proposing a specific time requirement for transiting drones because UAVs have various speed capabilities. But some UAV operators are expressing concern that the “shortest amount of practicable time” language is ambiguous and could, for example, overly constrict photographers who may be covering a news event happening in or around a UAFR.
“That language does need to be tightened up,” Moss said. “As a commercial drone pilot, I should also be able to ‘linger’ over a site like that if I need to get a photograph of something else. So it needs to be something other than strictly transitory. I think for the less restrictive Standard airspace designation, we should be allowed to hover in that airspace to get the imagery we need … There cannot be language in the final rule that runs counter to the First Amendment.”
Catalyst Visual Media, a small Oklahoma-based commercial media production company operating under Part 107, said in its public comment that it has identified “several provisions of the proposed rule that would impose disproportionate burdens on commercial media operators and small businesses.” The company said a final rule needs “to accommodate non-transitory operations conducted for newsgathering, documentary, and other First Amendment-protected purposes, which the ‘shortest practicable time’ standard would effectively prohibit.” Catalyst Visual Media noted that the NPRM allows law enforcement to operate in a UAFR for extended periods of time if necessary and said such “flexibility [should be extended] to journalism and time-sensitive media production.”
The FAA is asking for public comments “on whether it would be appropriate to include other categories of allowed operations in proposed 74.250.” Similarly, FAA is requesting comments “on if there are circumstances where allowed operations should not be allowed entry and transit through a UAFR … please define what those use cases are, if there is a limited subset of allowed operations that are affected, and potential solutions that would ameliorate any perceived issues.” The agency is also asking whether specific UAFR sectors, such as chemical and energy sites, “should have more limited allowed operations” rather than the currently proposed blanket access regulations for all sites with UAFRs.
Navigating Rules
A common reaction to the NPRM has been that it imposes a labyrinth of rules on drone operators who are already compliant with laws and do not pose a threat. Those intending to use drones to cause harm will not follow the rules or respect UAFRs, say those with this perspective. The counterargument is that a finalized 2209 rule will allow critical infrastructure operators to distinguish between legitimate and illegitimate drones and give the federal government a legal framework to potentially penalize operators who do not respect the UAFR.
FAA acknowledges the proposed Part 74 would not prevent unauthorized drones from accessing UAFRs.
“Once activated, a UAFR communicates a legal restriction on unmanned aircraft via a publicly accessible website, directing operators to avoid the restricted airspace,” the NPRM states. “While the UAFR serves as a ‘virtual no trespassing sign,’ it does not physically prevent unauthorized access. Violations of Standard UAFRs may lead to civil enforcement actions, while violations of Special UAFRs may lead to civil or criminal enforcement actions consistent with FAA's authority … as well as potential criminal penalties … for national security-related UAFRs.”
Critical infrastructure sites will not be allowed to engage in counter-drone activity. “The UAFR does not authorize the use of detection or mitigation technologies to interfere with unmanned aircraft,” the FAA states. “The UAFR alone does not create a physical or electromagnetic boundary to prevent unauthorized access. However, facilities with independent authority to operate such systems may continue to do so lawfully, and manufacturers may leverage the publicly available UAFR database. Additionally, the rule requires the deployment of Remote ID receivers … to monitor UAS activity.”
Cordell Bennigson, the U.S. CEO of R2 Wireless, an Israeli firm that produces passive radio frequency drone detection technology, noted Remote ID has limitations. “Remote ID is nice and it certainly works for a piece of the airspace management where maybe what you have is hobbyists who shouldn't be there and don't realize that they shouldn't be there,” he told CUAV News. “Basically, Remote ID is a friendly, cooperative communication. And there's a certain amount of drones out there that works well for. But there are a large number—an increasing number—of drones operated by individuals who have nefarious intent, who aren't going to have that friendly, cooperative approach, who aren't going to have Remote ID.”
UAFRs will “never stop bad actors who are determined to disrupt operations at these sites,” Moss said. “Making something more illegal has never prevented criminals from committing crimes, and that reality must guide the [Part 74 UAFR] application process. The goal of the final rule should be to reduce false alarms and provide the FAA with the information needed to educate careless and clueless operators who inadvertently fly over these facilities. As such, the process for reporting incursions must be standardized. Facilities need a clear process for gathering and forwarding relevant information to the FAA for education when appropriate and for [federal] prosecution when warranted.”
Comments