Drone incidents are on the rise. Recent high-profile events have begun to show the potential damage and threat that drones can pose to Governments and commercial organisations as well as by dint of the targeting of individuals. This isn’t unexpected. Security experts have long been talking about the threats and disruption drones can cause through accidental or criminal activity. This poses a challenging problem as there are no simple solutions that can solve, prevent or negate the threat. Here, Anthony Leather and Steven Webb consider how Government and commercial organisations should respond to the growing disruption and impact that drones can cause.
As reported by Risk Xtra, this week’s release of the UK Government’s Counter-Unmanned Aircraft Strategy is a step in the right direction when it comes to combating the drone threat, but it’s fair to suggest that more must be done across Government and industry in order to address the problem.
Since the beginning of this year there have been a number of high-profile drone attacks targeting critical infrastructure. There are also numerous examples of drones having been used by organised criminal entities for surveillance purposes, attack delivery and the transportation of illicit materials. Figure 1 (below, left) documents some of the most widely reported incidents over the last three years in addition to highlighting both the threat and disruption caused by drones.
Two high-profile events in 2019 have changed how the security industry talks about countering drones: the incident at Gatwick Airport at the beginning of the year that realised around 1,000 flight cancellations and affected nearly 150,000 passengers and the targeted attack on the Abqaiq and Khurais oil facilities in Saudi Arabia back in September that disrupted over half of the country’s oil production.
Both episodes resulted in serious financial consequences, much disruption and a threat to life. The Gatwick Airport incident reportedly cost airlines something in the region of £50 million and Gatwick Airport itself around £1.4 million, while Sussex Police spent upwards of £700,000 on the operational response and subsequent investigation.
The drone attack in Saudi Arabia prevented 5.7 million of crude barrels being produced and caused oil prices to increase. It’s reported that full operational capacity will not be restored until November.
Both incidents prompted Government intervention and investment in more advanced counter-drone technology. They also served as a stark warning to all other operators of critical infrastructure that they too could be targeted.
Driving potential threats
While these episodes were clearly planned and targeted attacks, the great majority of drone incidents remain accidental and originate as a result of end users who don’t realise they’re breaking the law or operating drones in restricted areas. Most users comply with legislation and operate their drones in a responsible manner.
The increasing use of drones in areas such as aerial filming, surveying, Search and Rescue and the consumer recreational market will see significant growth in the number of drones over the next five years. Those increasing numbers coupled with the availability of more advanced systems will drive potential threats to organisations and infrastructure, both through intended criminal activity and the aforementioned accidental misuse.
Unsurprisingly, media-reported incidents are those that target critical infrastructure or pose national security issues. Somewhat less reported are the more innovative ways in which criminals are now using the new technology against corporations. Examples of the latter include:
*Reconnaissance missions: Usually, a criminal, foreign or terrorist organisation planning a large-scale attack will make six-to-eight reconnaissance missions to plan and co-ordinate that attack. Traditionally, this reconnaissance has had to be carried out in person and has increased the risk of the individual(s) involved being spotted or caught. The use of drones for such a task reduces this risk and helps in criminals bypassing counter surveillance measures
*Attacks on IT and Wi-Fi Networks: Drones that can fly into Wi-Fi range with technology on board that can then connect to a corporate network, manipulate Wi-Fi or run attacks on the IT system are undoubtedly growing. As more organisations move towards digital operations that rely on Wi-Fi over wired connectivity, those drones with jamming systems become an increasing threat
These evolving threats have been the catalyst for both Government and organisations to review their threat assessments, security plans and targeted response to drone incidents.
Addressing the issue
Providing a solution that mitigates the drone threat is complicated. There are several legislative, technical, policy and cost challenges that must be considered.
First, legislation needs to be refreshed to match the existing threat. This is challenging as it remains illegal in many countries for people or organisations (with the exception of the police and the military) to shoot down any aircraft. While there are several reasons why these laws are sensible and proportionate, more regulations and legislative guidelines need to be developed in order to give greater clarity on how to address the drone threat.
Policy is another area that needs further development across the world. Countries are beginning to engage more seriously with the issue. As mentioned, this month the UK Government issued its Counter-Unmanned Aircraft Strategy. Indeed, the Conservative Government is the first to provide such clear guidance.
The document outlines four main objectives:
*to develop a comprehensive understanding of the evolving risks posed by the malicious and illegal use of drones
*to take a ‘full spectrum’ approach towards deterring, detecting and disrupting the misuse of drones
*to build strong relationships with industry and ensure that drone products meet the highest security standards
*to empower the police service and other operational responders through access to counter-drone capabilities and effective legislation, training and guidance
Implementation of the Counter-Unmanned Aircraft Strategy is significant. As stated, our present Government is the first to take this approach and, through the Centre for the Protection of National Infrastructure, provide a set of standards that helps to inform the counter-drone industry. Other countries are closely monitoring how successful this approach is going to be and, where appropriate, beginning to follow suit.
Critically, the Counter-Unmanned Aircraft Strategy acknowledges that there’s no technological ‘silver bullet’ for the problems that drones can cause. It goes on to outline a defined commitment to develop regulation, legislation and standards to work closely with the counter-drone industry in helping to implement more measures and capabilities that can increase protection and improve the response to illegal drone activity.
Counter-drone technology has developed in response to the threat, but issues remain with deployment and success in an operational environment. The counter-drone industry has seen significant growth over the last year and is already a crowded and complex market. The Centre for the Study of the Drone at Bard College reports that there are already over 235 C-UAS products available from 155 manufacturers and that figure’s growing. This can create confusion for end users and buyers as suppliers rush to promote different products and services which then results in ‘information overload’ and a degree of buyer confusion.
Detection and interception
The market can be broken down into two main capabilities: detection and interception.
Solutions that help to identify, monitor and detect include acoustic, radar, elector-optical, video and infrared technology. In addition, geofencing creates a virtual barrier to prevent consumer drones flying in restricted airspace. This solution is implemented by most large drone manufacturers, but it can be disabled.
When it comes to interception and eliminating the threats there are more complicated issues to address. Figure 2 (below, left) lists the systems available on the market and the challenges they face. For example, radio frequency jamming can be effective, but requires line of sight of the drone, may cause wider disruption to RF channels, could lead to collateral damage when a drone falls from the airspace and has legal implications.
Despite these challenges, there are industry solutions that help to protect a range of sites and operations. High-profile events (including those run by the NFL and the World Economic Forum) have deployed counter-drone systems, as have those professionals operating drones at critical sites on a daily basis.
While Government and critical sites have budgets to invest in more comprehensive counter-drone systems, commercial and corporate entities don’t always harbour the level of resources they need to address the threat. However, there are practical steps that organisations can take to help prepare and better protect their operations, people and property.
Drones provide a similar risk level to traditional threats, but use a different method and operating environment that has previously not been a priority for security operators. That said, they should be treated in a similar way.
To address the issue, practising security and risk managers should follow a similar risk assessment and security operational procedure.
Understanding vulnerabilities and threat levels
In its simplest form, security is about problem solving. It’s incredibly difficult to solve or prevent a problem if you don’t fully understand what that problem is or, indeed, the impact that the problem may have. In many cases the drone threat has not been fully investigated and organisations have usually reacted to that threat following incursions or incidents, rather than being proactive about the matter.
Organisations must complete a threat assessment that provides full situational awareness of the size, scale and risk of the drone threat posed to their operations. This can be done by assessing the frequency and timing of incursions and the model of the drone that’s being used.
Dedrone, a counter-UAS organisation, puts this approach at the core of its engagements with clients. The company provides solutions that detect and identify drones in lower airspace. The organisation is focused on providing security teams with a clear picture of how drones are affecting businesses and works towards building plans designed to remediate threats and protect a given organisation moving forward.
Once organisations understand the threat level posed, steps can then be taken to manage the risk. This doesn’t always involve huge investment and complex technology. It could entail some simple passive counter measures such as shutting blinds, changing routines and picking closed locations for those meetings where sensitive conversations or presentations will be staged.
If the host organisation needs to implement more comprehensive counter-drone defences then it should consider what it’s trying to achieve – detection, elimination, interception or an end-to-end solution. When going through this process there are some key considerations to observe:
*Choosing the right solution(s) for your operating environment and threat level – ensure that the technology selected can solve the problem and is effective for the operating environment
*Creating a clear and realistic budget that allows investment in proven technology
*Planning for scaleability – the threat will evolve and organisations need a solution that can grow with it
*Mapping the solution to your standard operational procedures – making sure that it’s integrated with security operations including video surveillance, Control Rooms and security officers. Ensure that simple measures are encouraged. For example, during initial training it’s rare that security officers are told to look up and check the sky
*Ensuring value for money – make certain that the counter-drone solution is cost-effective and can demonstrate a solid return on investment for the host business
*Engaging stakeholders – the problem will not simply be solved by technology. Relevant stakeholders across the organisation need to be educated on the threat levels and procedures and what to do in the event of a drone incident. This fine detail should be incorporated within the organisation’s business continuity and crisis management plans.
Anthony Leather and Steven Webb are Directors of Westlands Advisory (www.westlandsadvisory.com)
*Westlands Advisory is happy to provide more information to organisations that need advice on how to better protect themselves against drone threats. Send an e-mail to firstname.lastname@example.org or contact Anthony Leather direct at email@example.com