Harold Shaw, chief security officer for the Massachusetts Port Authority, can’t stop a potentially dangerous drone hovering over his turf, which includes Boston Logan International Airport.
"No pun intended, but we’re flying blind at this point," he told a Senate Commerce, Science and Transportation subcommittee in a hearing on drone security yesterday.
Shaw urged the Security Subcommittee to grant new authority for local law enforcement to intercept unmanned aircraft systems, so critical infrastructure operators like him "can in turn lean on them to hopefully be able to react and respond to any drone incident."
Under current law, four federal agencies — the departments of Defense, Homeland Security, Energy and Justice — have a legal green light to "jam" or shoot down threatening drones in certain circumstances.
"They’ve been given those authorities for very specific mission sets — largely for the protection of national security assets," noted Angela Stubblefield, deputy associate administrator for the Federal Aviation Administration.
A nuclear power plant operator that detects a drone over the facility’s airspace can’t capture or disable it without likely running afoul of multiple federal laws, including the Computer Fraud and Abuse Act. Calling the cops wouldn’t help, either — they also lack any legal basis for bringing down drones.
"I think it’s time for us — that is, the Congress — to think about modifying that authority so that we can deal with this tsunami of threats that is going to be out there and allow for additional protections," said Sen. Ed Markey (D-Mass.), the subcommittee’s ranking member.
Stubblefield pointed out that tools for disrupting drone operations "can cause significant safety impacts" for avionics and air navigation systems. That risk of collateral damage could make the technology "problematic" for widespread use.
Markey countered that first responders and critical infrastructure owners are "caught in no-man’s land" for protecting themselves against urgent threats. "We need a balance that is struck here, and right now, I don’t think we have a full balance."
There’s more legal leeway to track down and apprehend the pilots of trespassing drones — if they can be found.
"Currently, individuals cannot hold drone operators accountable because it is essentially impossible to identify the drone or the operator of a drone," advocates at the Electronic Privacy Information Center wrote in a letter to Markey and subcommittee Chairman Dan Sullivan (R-Alaska). EPIC urged the FAA to require drones to broadcast their course, location and operator registration number as a matter of course.
"Drones should simply not continue to fly above the laws that protect public safety," the group said.
China threat
Drone technology isn’t all about danger. Power utilities, pipeline companies and even farmers use unmanned aircraft for inspections.
But experts say the lion’s share of the U.S. market for commercial drones is dominated by one company, SZ DJI Technology Co. Ltd., that happens to be based in China (Energywire, May 21).
"DJI says that American data is safe, but its use of proprietary software networks means: How would we know?" said Harry Wingo, a faculty member at the National Defense University’s College of Information and Cyberspace. "American geospatial information is flowing to Chinese data centers at an unprecedented level. This literally gives a Chinese company a view from above of our nation."
Sen. Rick Scott (R-Fla.) asked whether Wingo would support an outright ban on DJI products. "Why don’t we just say, ‘You can’t sell anything here’?"
Wingo compared the supply chain risk posed by drones to that of Chinese telecommunications giant Huawei Technologies Co. Ltd., which has faced a constrained business environment in the United States over concerns about the cybersecurity of its products.
For drones, "if you’re touching public safety issues, if you’re looking at critical infrastructure, I think the case could be made to having a ban like that," Wingo replied.
DJI has vociferously denied Department of Homeland Security allegations that it could support Chinese spying. The company told E&E News in a recent statement that "we give all customers full and complete control over how their data is collected, stored, and transmitted."
"For government and critical infrastructure customers that require additional assurances, we provide drones that do not transfer data to DJI or via the internet, and our customers can enable all the precautions DHS recommends," DJI added.
Those assurances haven’t fully convinced the most cautious U.S. customers, including Catherine Cahill, director of the Alaska Center for Unmanned Aircraft Systems Integration at the University of Alaska, Fairbanks, who spoke at yesterday’s hearing.
"Given the recent reports about Chinese companies being required to provide intelligence to their government upon request, we at ACUASI are hesitant to use any DJI system for any important research or approved flights over critical infrastructure," she said in written testimony. "I confess we fly a small DJI system for public relations footage because it is quiet and produces good quality video, but we take actions to ensure the system is unable to communicate when not in use."
