A drone intrusion prevention product being advertised at RSA Conference this year has piqued my interest, and I'm trying to determine whether it and other drone IPS systems are illegal.
For background, a WIPS is a device which looks for unexpected WiFi access points nearby and purposefully sends de-authentication packets in order to prevent them from working. In August 2015 the FCC ruled that doing this to hotel guests was illegal, citing Section 333 of the Communications Act 1934. This appears to tally with the FCC's guidance. However, it has been pointed out to me that this precedent may not be applicable as the ruling was in relation to internet service being denied.
One could potentially also argue that such actions are in violation of the Computer Fraud and Abuse Act (CFAA) under the same provisions which make denial-of-service (DoS) attacks illegal. UK law also has provisions under the Communications Act 2003 and the Computer Misuse Act 1990 (CMA), with similar advice given by OFCOM (1, 2, 3) as the FCC gives.
Drone Intrusion Prevention Systems are a similar concept, designed as security devices which identify drones in the vicinity and inject commands into the control channel in order to disable them. The advertised use-case is to prevent an attacker from using a drone to spy on people's screens, or gain entry to a secured facility. The apparent functionality is that the system identifies a drone in the area, and an operator can choose to have the system disable or otherwise inhibit that drone's functionality.
One could argue that injecting commands into the control stream would constitute a violation of both the CFAA and CMA since it causes a computerised system (the drone) to stop functioning or be taken over without the consent of the drone operator.
A key thing to note in both cases is that the denial of service is not indiscriminate in terms of jamming the radio spectrum: devices operating on that band will continue to work unless specifically targeted.
47 U.S.C. § 333 states:
No person shall willfully or maliciously interfere with or cause interference to any radio communications of any station licensed or authorized by or under this chapter or operated by the United States Government.
It is clear to me that indiscriminately jamming a radio band is illegal under both the US and UK Communications Acts. What is not clear to me is whether interjecting additional commands is illegal, nor whether a drone user operating within the vicinity of such a device counts as "authorized" under this particular facet of law. From what I have read, the term appears to refer to communications which are not themselves in violation of the Communications Act, but I'm not certain whether this matters.
Are these devices illegal under US/UK law? Is there any precedent in this matter?