When Good Drones Go Bad

LATE IN THE summer of 2014, surveillance footage of Syria’s Tabqa air base showed up on YouTube. That it was taken by ISIS forces is unremarkable. That it was shot with a DJI Phantom FC40—a popular consumer drone at the time, the kind you might have found under the Christmas tree—certainly was.

In the intervening year and a half, small quadcopter drones have become even more affordable and more broadly available. That’s enabled them to find all sorts of positive new purposes, from agriculture to inspecting cell towers. That increased accessibility, though, has also inspired a proportionate amount of concern about the misuse of drones. A new report (PDF) from the non-profit group Open Briefing lays bare just how far the threat from hobbyist drones has evolved, and how seriously we should take it.

The Threat Abroad

Let’s start with a healthy dose of perspective. Consumer drones aren’t currently a major part of the ISIS arsenal. There aren’t roaming packs of DJI Phantoms or Parrot Bebops terrorizing the streets of Ramadi. Even that first public incident, the 2014 Tabqa footage, “appeared to be for propaganda purposes only,” according to the Open Briefing report.

That perspective need also include, though, the swift evolution of the uses ISIS forces have found for these quadcopters. “The range of scenarios that threat groups have or are likely to use drone in can be broadly divided into two types of threat: intelligence gathering or attack,” says Chris Abbott, founder and executive director of Open Briefing.

His group’s report details multiple instances of the former. ISIS used a hobbyist UAV in April of last year to help coordinate its attack on Iraq’s Baiji oil refinery complex. The following month, Kurdish forces shot down an ISIS drone that had been monitoring their positions. And these are just the times they’ve been caught.

Reports of weaponized drones are more muddled, though one unconfirmed report claims that Kurdish forces recently shot down a small drone—the kind you can make at home from a mail-order kit— carrying explosives. Most consumer drones can’t currently carry heavy enough payloads to do very significant harm, but that doesn’t mean they’re ineffective.

“It’s a really crude method of packing a drone with explosives, and using it like a flying IED,” says Colin Clarke, associate political scientist at the RAND Corporation. “It’s more of a psychological threat than anything. It’s probably far more effective to lob artillery, or mortars, or RPGs toward the front line. But if all of a sudden you’ve got this drone flying forth, it strikes fear in the heart of the enemy.”

Clarke and Abbott agree that ISIS primarily leans on drones for intelligence gathering at the moment, and even that effort could be charitably described as piecemeal. Both also, though, see the potential for much more harmful pursuits ahead.

“These groups are highly adaptable. They’re able to learn from each other and their own mistakes,” says Clarke. “They’re going to get better at this stuff. They’re going to perfect it.”

However steep that learning curve turns out to be, it likely ends not in Syria or Iraq, but in one of the Western nations ISIS has clear intent to attack.

“The failure of Islamic State to successfully use drones for attack in Iraq and Syria shows that the method of attack has some difficulties,” says Abbott. “However, Iraq and Syria provides the group with the testing ground to perfect the delivery of IEDs by unmanned aerial or ground vehicles. Once perfected, multiple sources have suggested that the group is looking to use drone swarms to overwhelm any defenses and deliver spectacular attacks.”

The idea of a coordinated drone attack rightly sounds terrifying. (These are, after all, terrorists). For that matter, so does a precisely placed lone wolf quadcopter. How likely that type of attack is to take place outside of the Middle East theater, though, remains a question of some debate.

The Threat at Home

While the Open Briefing report focuses on the UK, the findings can largely be applied to the United States as well, especially in terms of the range of bad actors that could make use of drones.

A lone wolf. A terrorist group. Drug cartels. Espionage-minded corporations. Activist organizations. The list of those who could benefit—or already have—from the illicit use of drones is long, and not getting any shorter.

There appears to be no shortage of opportunity, either. You might remember the rogue DJI Phantom quadcopter that crash-landed on the White House lawn a year ago, or an unidentified drone that collided with the Sydney Opera House last fall, or any number of college and professional football stadium fly-bys over the last two years.

These incidents all turned out to be benign, the result of poor piloting, poor judgment, or both. Still, they and a cascade of similar events illustrate the ease with which consumer drones can occupy vulnerable spaces. And while drones have yet to be used in a terrorist attack in Europe or the United States, not all close quadcopter encounters have been entirely innocent.

“What could be was demonstrated in April 2015 when a man landed a drone on the Japanese prime minister’s office in Tokyo,” recounts the Open Briefing report. “The drone was carrying a bottle containing radioactive sand from Fukushima, which was emanating up to 1.0 microsievert per hour.” What’s scary here isn’t the amount, which is roughly the same exposure you’d get from a single arm X-ray. It’s the proximity.

It’s not all bad news. The availability of drones, and even their ability to fly near or into restricted places, is still a far cry from those drones causing significant harm.

“While consumer drones are readily available, lightweight explosives and weapons of mass destruction are not,” said Gregory McNeal, an associate professor of law and public policy at Pepperdine University, at a Congressional hearing last March. “Even if terrorists were able to procure explosives or WMD, using a consumer drone to conduct an attack would be one of the least effective means of carrying out an attack.”

Then again, an effective drone attack wouldn’t necessarily require scale.

“Whether or not an attack does real damage, the psychological is tremendous,” says Clarke. “It’ll be picked up by the media, emphasized far beyond what it is. Even if it kills one person and injures three, the damage has already been done. The images have already been built.”

There are easier ways to do harm than arming a drone. There aren’t many that can grab the same headlines.

Countermeasures

Let’s assume that a quadcopter attack will happen at some point in the United States. It very well may not! The threat is real enough, though, to merit at least some preparedness, at least in so far as one can prepare.

In fact, there’s plenty that’s already been done in response to those errant drones mentioned above, as well as to the possibility of bad actors in the future.

“DJI pioneered geofencing in the consumer drone sector in 2013, integrating no-fly zones into our aerial platforms and app, preventing takeoff in and flight into areas deemed off-limits for security reasons,” says DJI spokesman Adam Najberg. Current restrictions on DJI drones include not being allowed to fly within a 15.5 mile radius of the White House. The company also maintains a list of No Fly Zonesthat prevent certain of its products from taking off in locations where drones are dangerous or illegal, or keep them from entering those spaces if already in the air.

Not all drones are made by DJI, though, and not all manufacturers are quite so fastidious. Besides which, security features based on drone software have the same vulnerabilities any software solution does: It can be tampered with.

“With only minor changes to [a] UAV’s autopilot software, of which highly capable open-source variants exist, an attacker could readily disable geofencing and could configure the UAV to operate under ‘radio silence,’ ignoring external radio control commands and emitting no radio signals of its own,” said Todd Humphreys, associate professor at UT-Austin, before Congress last March.

In truth, no single effort can guarantee safety from a determined drone attacker. “The best defense against the hostile use of drones is to employ a hierarchy of countermeasures encompassing regulatory countermeasures, passive countermeasures and active countermeasures,” says the Open Briefing report.

Regulatory measures include those that are already present in the United States, which include drone registration and maintaining a line of sight. Those could be expanded to include certain manufacturing restrictions and mandates, which range from requiring DJI-type geofencing of all quadcopter makers to putting limits on carrying capacity and range.

Passive countermeasures include traditional technologies like radar tech and the newer drone detection devices like DroneShield, which “contains a database of common acoustic signatures unique to drones,” and informs nearby security of their presence. Radio jammers are also effective, though Open Briefing notes that blocking popular drone control frequencies would also interfere with mobile phones.

Active defense, meanwhile, is exactly what it sounds like: shoot the drone. Missile, bullet, rock, net, laser, another drone, doesn’t matter. Just hit the drone with something that makes it go plop.

Abbot says that all of these defense mechanisms—aside from lasers that shoot drones out of the sky—are available today. As you might imagine, though, each comes with its own set of benefits and drawbacks. A missile would make short work of a DJI Phantom, but also any nearby buildings. Regulations are often more effective on paper than in practice. And passive drone detection and prevention presents a host of problems all its own.

“Imposing restrictions on small UAVs beyond the sensible restrictions the Federal Aviation Administration recently proposed would not significantly reduce the threat of rogue UAVs yet would shackle the emerging commercial UAV industry,” testified Humphreys. “Powerful GPS jamming around the White House, for example, would deny GPS aiding to commercial aircraft at nearby Reagan National Airport. Similarly, anti-UAV laser or electromagnetic pulse systems are a danger to nearby civil infrastructure and transport.”

The trick, then, will be finding the right combination of the three that prevent harm while still enabling good.

Ultimately, though, there may be no perfect solution. Hobbyist drones, like cars or pressure cookers or any number of household objects, can be used for ill.

“Is there, realistically, a regulation that could—or should—be put in place to restrict sale and use of consumer products and technology used properly by hundreds of thousands or even millions of people,” asks DJI’s Najberg. “I’m not seeing that. Do you ban all sales and use of trucks all over the world?”

Well, no. But you do invent roadblocks, and require drivers licenses, and keep trucks away from areas where they could cause undo harm. Eventually, we’ll find an effective version of that for small flying toys. Or come to terms with the reality of a world where there isn’t one.