Are Drone Intrusion Prevention Systems (Drone IPS) systems illegal?

Question

A drone intrusion prevention product being advertised at RSA Conference this year has piqued my interest, and I'm trying to determine whether it and other drone IPS systems are illegal.

For background, a WIPS is a device which looks for unexpected WiFi access points nearby and purposefully sends de-authentication packets in order to prevent them from working. In August 2015 the FCC ruled that doing this to hotel guests was illegal, citing Section 333 of the Communications Act 1934. This appears to tally with the FCC's guidance. However, it has been pointed out to me that this precedent may not be applicable as the ruling was in relation to internet service being denied.

One could potentially also argue that such actions are in violation of the Computer Fraud and Abuse Act (CFAA) under the same provisions which make denial-of-service (DoS) attacks illegal. UK law also has provisions under the Communications Act 2003 and the Computer Misuse Act 1990 (CMA), with similar advice given by OFCOM (1, 2, 3) as the FCC gives.

Drone Intrusion Prevention Systems are a similar concept, designed as security devices which identify drones in the vicinity and inject commands into the control channel in order to disable them. The advertised use-case is to prevent an attacker from using a drone to spy on people's screens, or gain entry to a secured facility. The apparent functionality is that the system identifies a drone in the area, and an operator can choose to have the system disable or otherwise inhibit that drone's functionality.

One could argue that injecting commands into the control stream would constitute a violation of both the CFAA and CMA since it causes a computerised system (the drone) to stop functioning or be taken over without the consent of the drone operator.

A key thing to note in both cases is that the denial of service is not indiscriminate in terms of jamming the radio spectrum: devices operating on that band will continue to work unless specifically targeted.

47 U.S.C. § 333 states:

No person shall willfully or maliciously interfere with or cause interference to any radio communications of any station licensed or authorized by or under this chapter or operated by the United States Government.

It is clear to me that indiscriminately jamming a radio band is illegal under both the US and UK Communications Acts. What is not clear to me is whether interjecting additional commands is illegal, nor whether a drone user operating within the vicinity of such a device counts as "authorized" under this particular facet of law. From what I have read, the term appears to refer to communications which are not themselves in violation of the Communications Act, but I'm not certain whether this matters.

Are these devices illegal under US/UK law? Is there any precedent in this matter?

Answer 1

In the United States -

• Flying within Class G airspace (max 400 ft.) over private property without permission is trespassing (min 500 ft.)

• A 107 certified pilot is not restricted to 400 ft., and may have a BVLOS waiver. (It can be difficult to assess whether a drone is above 500 feet.)

• In the US, it is a violation of federal criminal law to instigate any attack intended to interfere with the flightworthiness of a craft currently in flight. The penalties for doing so or attempting to do so are severe (especially if the attack involved ballistics, such as shooting at it with a firearm.) Throwing anything at all - a rock, your shoes, a spear, a towel, your shirt, etc. intended to deliberately cause a flying craft to free-fall.

• FAA regulations explicitly disallow any attempt at "towing" by a craft in flight of another craft in flight.

• CFAA absolutely applies to a drone's companion computer, which means that targeting Wi-Fi, Bluetooth or network services (including spoofing, etc.) are all illegal. Because CFAA is part of the Patriot Act, attempting to disable a drone in this fashion could lead to a terrorism charge.

• The only generalized exemptions to this are reserved for the military and only for military purposes; shooting down a civilian's Phantom 4 with a Stinger missile is no more permissible than blowing up their car with a bazooka.

• This includes the overwhelming majority of law enforcement including state, local, and federal, who will seek to identify the pilot with the assistance of the FAA. Once they locate the pilot, they will take control of the craft or order the pilot to land.

The only generally "legal" way to interfere with a UAV in flight is to crash into it with your own drone. This qualifies as an in-air collision, and is considered an accident.

My startup builds aerial security drones, one of which performs autonomous nuisance drone control. We do this without using any form of ballistics, RF interference (illegal without a waiver from the FCC which are almost impossible to obtain and do not scale), EM discharge, etc. We have developed a way of disabling nuisance drones (it is not considered towing if the craft is not in flight), at which point we force the nuisance drone to ground in a controlled manner (not a freefall.) At this time, we do not provide these drones to private sector pilots, including private sector commercial pilots; they are only available to law enforcement and public safety officials whose agencies / departments who are willing to obtain the waiver granting permission to use them (we will help them with this process, if needed.)

Answer 2

For the USA, the FCC has a few words to say on the subject:

“Generally, “jammers” — which are also commonly called signal blockers, GPS jammers, cell phone jammers, text blockers, etc. — are illegal radio frequency transmitters that are designed to block, jam, or otherwise interfere with authorized radio communications.” (https://transition.fcc.gov/eb/jammerenforcement/jamfaq.pdf)

In addition, the FCC specifically calls out WiFi blocking devices using deauth attacks as you described, calling them “Willful or malicious interference” in a warning they issued in 2015

This is the closest thing to precedent I could find, related specifically to WiFi . That pretty much sums it up. If the device’s primary purpose involves disabling radio communication, it is illegal. It does not matter to the FCC how targeted or filtered the attack may be, it is still unauthorized. At the core of the issue, you (a private citizen) are not allowed to maliciously or willfully interfere with someone operating their radio, no ifs, ands, or buts. Drone IPS system using such an attack would most likely be illegal. The FCC may change this interpretation in the future, but for now it is illegal.

Answer 3

UK-based answer:

With regards to rights above land, we know from Bernstein v Skyviews and General Ltd [1978] QB 479 that a person owns: "the airspace above his land to such height as was necessary for the ordinary use and enjoyment of his land and the structures upon it"

Though this wouldn't allow you to sue someone for flying a helicopter or airplane above your land, I would believe that drones would count as flying low enough as to be potentially infringing on your right.

That said, this only really means that if someone flies their drown over your land, low enough to annoy you, you could ask them to cease and desist. I don't think you would be justified in installing a "drone-jammer" or any system which injects commands to a drone to render it inoperable or to gain control over it.

In the same way that if there is an intruder to your property, you can't without warning just physically shove them off of your property.